- Freeradius-Users - lists.freeradius.org

Inconsistent escaping of regex parentheses
by Tim 20 Jan '20

20 Jan '20

Hi all, I'm in the process of upgrading an old 2.2.0 installation of FreeRADIUS to a more sane 3.0.17 release (stock from current CentOS). I've hit a problem while trying to migrate the MySQL module due to the way that regular expressions seem to be getting escaped, and was hoping someone could see if anything looks amiss. We have a custom attribute, My-Regex-Pattern, that is defined as a simple string. In this instance, the attribute is held within the radgroupcheck MySQL table with the following regex stored as a string: @(.+\\.)?(DOMAIN1|DOMAIN2)$ During the authorize_check_query stage, a stored procedure is successfully called and the attribute is returned along with the correct value: (1) sql: Executing select query: Call getChecks('foo(a)bar.com'); (1) sql: User found in radcheck table (1) sql: Conditional check items matched, merging assignment check items (1) sql: My-Regex-Pattern := "@(.+\\.)?(DOMAIN1|DOMAIN2)$" However, when that string is later expanded via Unlang, the escaping appears to break as the opening parentheses get escaped while the closing ones do not: (1) if ( &control:My-Regex-Pattern && &User-Name =~ /%{control:My-Regex-Pattern}/i ) { (1) EXPAND %{control:My-Regex-Pattern} (1) --> @\(\.\+\\.)\?\(DOMAIN1|DOMAIN2)\$ (1) ERROR: @\(\.\+\\.)\?\(DOMAIN1|DOMAIN2)\$ (1) ERROR: ^ Pattern compilation failed: unmatched parentheses (1) ERROR: Failed retrieving values required to evaluate condition The error message makes perfect sense, but I'm unclear why this is happening and whether it's a misconfiguration, a bug or simply new intended behaviour that the migration needs to adapt to use. 'correct_escapes' is set to true and the sql modules 'safe_characters' option has been left as its default value. Thanks in advance. -- Tim

2 1

Can I retrieve session logs not registered in radacct?
by CESAR MURILO DA SILVA JUNIOR 19 Jan '20

19 Jan '20

Hello Are sessions recorded in the detail logs only after being recorded in the radacct and radpostauth table? I caused a lock on these tables and my boss asked me to retrieve the start and end times of the session by details, but there are only the records from before the transaction that caused the table locks. Att *César Murilo da Silva Júnior* *Téc. Oper. Monit. Computadores Help Desk | Redes e Segurança* *UNIPAM - Centro Universitário de Patos de Minas* *T1: 34 3823 0131 | T2: 34 3823 0120 | T3: 34 3823 0356 | C: 34 9 9220 5680* *cesarsj(a)unipam.edu.br <cesarsj(a)unipam.edu.br>* <https://www.unipam.edu.br/index.php/> <https://www.facebook.com/unipam> <https://www.instagram.com/unipamnet/?hl=pt> <https://twitter.com/UNIPAMNET> <https://www.youtube.com/user/CanalUNIPAM> <https://www.linkedin.com/school/centro-universit-rio-de-patos-de-minas---un…> <https://api.whatsapp.com/send?phone=5534999776622>

2 1

Can I partition the radacct and radpostauh tables by month?
by CESAR MURILO DA SILVA JUNIOR 19 Jan '20

19 Jan '20

Hello, I went to delete the records with more than 30 days (there are 96 million currently) in radacct, and gave a table lock that stopped the wifi in the whole company. The delete was inside a transaction. I believe that if I partition the radacct and radpostauth tables I will be saved from this problem. Att *César Murilo da Silva Júnior* *Téc. Oper. Monit. Computadores Help Desk | Redes e Segurança* *UNIPAM - Centro Universitário de Patos de Minas* *T1: 34 3823 0131 | T2: 34 3823 0120 | T3: 34 3823 0356 | C: 34 9 9220 5680* *cesarsj(a)unipam.edu.br <cesarsj(a)unipam.edu.br>* <https://www.unipam.edu.br/index.php/> <https://www.facebook.com/unipam> <https://www.instagram.com/unipamnet/?hl=pt> <https://twitter.com/UNIPAMNET> <https://www.youtube.com/user/CanalUNIPAM> <https://www.linkedin.com/school/centro-universit-rio-de-patos-de-minas---un…> <https://api.whatsapp.com/send?phone=5534999776622>

2 1

rlm_python learnings - PAP and MSCHAPv2
by Lang, Russell 18 Jan '20

18 Jan '20

FreeRADIUS is working, using rlm_python to do authentication for WPA2-Personal and WPA2-Enterprise Wi-Fi clients. This is a summary of the issues I found and suggested improvements. Using FreeRADIUS 3.0.15 package on Ubuntu 18.04. We previously had FreeRADIUS configured to exec a python process for each PAP or MSCHAPv2 authentication, which then called a REST API to check the user. This was slow (120ms) due to the time taken to start a process and load python. To speed this up, I first tried to use rlm_rest. This didn't work because we don't have the cleartext password, only the NT hash. Next I tried rlm_python, which I did get working. For PAP, during FreeRADIUS default authorize processing, it says no cleartext password, so it does not set Auth-Type=PAP, and so it does not call the PAP authenticate code. My workaround is python authorize code to set config:Auth-Type=python if User-Name and User-Password are set, but not EAP-Message. The default site config has "python" in the authorize section, and "Auth-Type python { python }" in the authenticate section. This is fragile, so if you have any better suggestions... For PEAP-MSCHAPv2, the default site config is unchanged. The inner-tunnel authenticate config has "Auth-Type mschap { python }". In the python authenticate code, I take the params and pass them to a REST API as JSON, then take the response from the REST API and return this as the reply. This means I am passing MS-CHAP-User-Name, MS-CHAP-Challenge and MS-CHAP2-Response into the API, and getting MS-CHAP2-Success as the reply. MS-CHAP-Challenge is in the expected format. Issue 1: MS-CHAP2-Response is NOT in the format defined in the RFC. The first byte is unknown. Second byte is the flag, moved from the end of the response, which is still wrong because it isn't 0. Subsequent bytes are as expected (16 bytes peer challenge, 8 bytes padding, 24 bytes NT response). I reformat the response to the RFC format before handing to the REST API. MS-CHAP-Response is also wrong in the same way, although the flag byte is the expected 1 (to indicate NT response is present). Issue 2: I generate the correct MS-CHAP2-Success packet "S=40hex" and include it in the python module reply. FreeRADIUS removes the first byte of this (source code confirms this) and sends the remainder, making it incorrect. My kludge is to add a padding byte at the start of the MS-CHAP2-Success python reply, for FreeRADIUS to remove. Suggestions: Have a fall-through authenticate method if Auth-Type is not set. This would avoid my fragile python authorize code, and allow PAP authentication without a cleartext password. Allow PAP authorize and rlm_rest to work if the NT hash of the password is available.

2 4

How to connect to PAP or how to use PEAP with Google LDAP?
by Mathias Maes 17 Jan '20

17 Jan '20

Hello I have set up freeradius with the simple tutorial found on Google help pages about their Secure LDAP: https://support.google.com/a/answer/9089736?hl=en&ref_topic=9173976 I followed all steps, freeradius starts, I get Access-Accept responses when I use the radtest tool. Perfect! Although, when trying to connect to an AP with an Android device, I can only connect with an EAP protocol, PAP seems to be unavailable. This is a problem, as other protocols encrypt the password (TTLS + PAP) for example shows no User-Password field in the incoming request. So freeradius can't handle the request because Google really needs that unencrypted User-Password field. So, how do I connect with an Android device with the PAP protocol the server needs after following that Google tutorial, or is there a way to let Freeradius decrypt the password and pass it to Google? Thanks for any insights, I'm pretty new with this. Mathias Maes

2 6

eap-tls with valid and fake certificates.
by codythejack 17 Jan '20

17 Jan '20

Hello ! The Idea is to authenticate users with eap-tls with certficates. People without any certificate should use different vlan provided by Radius. Only supported authentication should be eap-tls. Is it possible to make authentication with eap-tls with certficates for valid users and some "guest vlan" for users which hasnt any or unknown certificates ? I'tried many things like default authenticate , post-auth-type (with update control Auth-Type :=Accept). Allways i had reject or stuck with no network configuration. Radius should provide attributes for valid users: Tunnel-Type � = 13 Tunnel-Medium-Type = 6, Tunnel-Private-Group-ID = 2111 and Tunnel-Type � = 13 Tunnel-Medium-Type = 6, Tunnel-Private-Group-ID = 2211 for invalid users. How i do it ? thanks for help Marcin

4 6

log rotation
by Bill Schoolfield 16 Jan '20

16 Jan '20

On centos at least, rotating the radius.log file (compress and rename) results in lost log entries as a new log file is not opened. Before I go off and code this so the server is stopped momentarily, is there another strategy for handling log rotation while keeping the server up?

2 1

Cannot connect to Win10 PC with client certificate (no connection possible)
by uj2.hahn＠posteo.de 16 Jan '20

16 Jan '20

Hi, all! I installed CA and client certificates on Win 10 Pro client PC and configured a certificate based WLAN profile via Cisco AP (named ciscosb) to freeradius. (login via certificate, no password). But I dont't get it to work. PC says "no connection to this network possible". Windows WLAN report says "Error during authentification of EAP method type 13. Error: 0x54F. And it also says : Disconnect reason: explicit Eap error. I'm still not clear where to find the issue: Client PC or Cisco AP or freeradius configuration. Here is the log of one connection attempt. Could you please check if from radius perspective everything looks ok? Thanks a lot! Uwe FreeRADIUS Version 3.0.17 Copyright (C) 1999-2017 The FreeRADIUS server project and contributors There is NO warranty; not even for MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE You may redistribute copies of FreeRADIUS under the terms of the GNU General Public License For more information about these matters, see the file named COPYRIGHT Starting - reading configuration files ... including dictionary file /usr/share/freeradius/dictionary including dictionary file /usr/share/freeradius/dictionary.dhcp including dictionary file /usr/share/freeradius/dictionary.vqp including dictionary file /etc/freeradius/3.0/dictionary including configuration file /etc/freeradius/3.0/radiusd.conf including configuration file /etc/freeradius/3.0/proxy.conf including configuration file /etc/freeradius/3.0/clients.conf including files in directory /etc/freeradius/3.0/mods-enabled/ including configuration file /etc/freeradius/3.0/mods-enabled/soh including configuration file /etc/freeradius/3.0/mods-enabled/detail including configuration file /etc/freeradius/3.0/mods-enabled/exec including configuration file /etc/freeradius/3.0/mods-enabled/eap including configuration file /etc/freeradius/3.0/mods-enabled/unpack including configuration file /etc/freeradius/3.0/mods-enabled/digest including configuration file /etc/freeradius/3.0/mods-enabled/preprocess including configuration file /etc/freeradius/3.0/mods-enabled/ldap including configuration file /etc/freeradius/3.0/mods-enabled/sradutmp including configuration file /etc/freeradius/3.0/mods-enabled/utf8 including configuration file /etc/freeradius/3.0/mods-enabled/radutmp including configuration file /etc/freeradius/3.0/mods-enabled/mschap including configuration file /etc/freeradius/3.0/mods-enabled/logintime including configuration file /etc/freeradius/3.0/mods-enabled/passwd including configuration file /etc/freeradius/3.0/mods-enabled/ntlm_auth including configuration file /etc/freeradius/3.0/mods-enabled/always including configuration file /etc/freeradius/3.0/mods-enabled/dynamic_clients including configuration file /etc/freeradius/3.0/mods-enabled/expr including configuration file /etc/freeradius/3.0/mods-enabled/realm including configuration file /etc/freeradius/3.0/mods-enabled/attr_filter including configuration file /etc/freeradius/3.0/mods-enabled/files including configuration file /etc/freeradius/3.0/mods-enabled/echo including configuration file /etc/freeradius/3.0/mods-enabled/unix including configuration file /etc/freeradius/3.0/mods-enabled/chap including configuration file /etc/freeradius/3.0/mods-enabled/linelog including configuration file /etc/freeradius/3.0/mods-enabled/expiration including configuration file /etc/freeradius/3.0/mods-enabled/replicate including configuration file /etc/freeradius/3.0/mods-enabled/detail.log including configuration file /etc/freeradius/3.0/mods-enabled/cache_eap including configuration file /etc/freeradius/3.0/mods-enabled/pap including files in directory /etc/freeradius/3.0/policy.d/ including configuration file /etc/freeradius/3.0/policy.d/canonicalization including configuration file /etc/freeradius/3.0/policy.d/operator-name including configuration file /etc/freeradius/3.0/policy.d/eap including configuration file /etc/freeradius/3.0/policy.d/abfab-tr including configuration file /etc/freeradius/3.0/policy.d/cui including configuration file /etc/freeradius/3.0/policy.d/accounting including configuration file /etc/freeradius/3.0/policy.d/filter including configuration file /etc/freeradius/3.0/policy.d/moonshot-targeted-ids including configuration file /etc/freeradius/3.0/policy.d/debug including configuration file /etc/freeradius/3.0/policy.d/control including configuration file /etc/freeradius/3.0/policy.d/dhcp including files in directory /etc/freeradius/3.0/sites-enabled/ including configuration file /etc/freeradius/3.0/sites-enabled/inner-tunnel including configuration file /etc/freeradius/3.0/sites-enabled/default main { security { user = "freerad" group = "freerad" allow_core_dumps = no } name = "freeradius" prefix = "/usr" localstatedir = "/var" logdir = "/var/log/freeradius" run_dir = "/var/run/freeradius" } main { name = "freeradius" prefix = "/usr" localstatedir = "/var" sbindir = "/usr/sbin" logdir = "/var/log/freeradius" run_dir = "/var/run/freeradius" libdir = "/usr/lib/freeradius" radacctdir = "/var/log/freeradius/radacct" hostname_lookups = no max_request_time = 30 cleanup_delay = 5 max_requests = 16384 pidfile = "/var/run/freeradius/freeradius.pid" checkrad = "/usr/sbin/checkrad" debug_level = 0 proxy_requests = yes log { stripped_names = no auth = no auth_badpass = no auth_goodpass = no colourise = yes msg_denied = "You are already logged in - access denied" } resources { } security { max_attributes = 200 reject_delay = 1.000000 status_server = yes } } radiusd: #### Loading Realms and Home Servers #### proxy server { retry_delay = 5 retry_count = 3 default_fallback = no dead_time = 120 wake_all_if_all_dead = no } home_server localhost { ipaddr = 127.0.0.1 port = 1812 type = "auth" secret = <<< secret >>> response_window = 20.000000 response_timeouts = 1 max_outstanding = 65536 zombie_period = 40 status_check = "status-server" ping_interval = 30 check_interval = 30 check_timeout = 4 num_answers_to_alive = 3 revive_interval = 120 limit { max_connections = 16 max_requests = 0 lifetime = 0 idle_timeout = 0 } coa { irt = 2 mrt = 16 mrc = 5 mrd = 30 } } home_server_pool my_auth_failover { type = fail-over home_server = localhost } realm example.com { auth_pool = my_auth_failover } realm LOCAL { } radiusd: #### Loading Clients #### client localhost { ipaddr = 127.0.0.1 ipv4addr = * require_message_authenticator = no secret = <<< secret >>> nas_type = "other" proto = "*" limit { max_connections = 16 lifetime = 0 idle_timeout = 30 } } client localhost_ipv6 { ipv6addr = ::1 require_message_authenticator = no secret = <<< secret >>> limit { max_connections = 16 lifetime = 0 idle_timeout = 30 } } Debugger not attached # Creating Auth-Type = mschap # Creating Auth-Type = eap # Creating Auth-Type = PAP # Creating Auth-Type = CHAP # Creating Auth-Type = MS-CHAP # Creating Auth-Type = LDAP # Creating Auth-Type = digest radiusd: #### Instantiating modules #### modules { # Loaded module rlm_soh # Loading module "soh" from file /etc/freeradius/3.0/mods-enabled/soh soh { dhcp = yes } # Loaded module rlm_detail # Loading module "detail" from file /etc/freeradius/3.0/mods-enabled/detail detail { filename = "/var/log/freeradius/radacct/%{%{Packet-Src-IP-Address}:-%{Packet-Src-IPv6-Address}}/detail-%Y%m%d" header = "%t" permissions = 384 locking = no escape_filenames = no log_packet_header = no } # Loaded module rlm_exec # Loading module "exec" from file /etc/freeradius/3.0/mods-enabled/exec exec { wait = no input_pairs = "request" shell_escape = yes timeout = 10 } # Loaded module rlm_eap # Loading module "eap" from file /etc/freeradius/3.0/mods-enabled/eap eap { default_eap_type = "md5" timer_expire = 60 ignore_unknown_eap_types = no cisco_accounting_username_bug = no max_sessions = 16384 } # Loaded module rlm_unpack # Loading module "unpack" from file /etc/freeradius/3.0/mods-enabled/unpack # Loaded module rlm_digest # Loading module "digest" from file /etc/freeradius/3.0/mods-enabled/digest # Loaded module rlm_preprocess # Loading module "preprocess" from file /etc/freeradius/3.0/mods-enabled/preprocess preprocess { huntgroups = "/etc/freeradius/3.0/mods-config/preprocess/huntgroups" hints = "/etc/freeradius/3.0/mods-config/preprocess/hints" with_ascend_hack = no ascend_channels_per_line = 23 with_ntdomain_hack = no with_specialix_jetstream_hack = no with_cisco_vsa_hack = no with_alvarion_vsa_hack = no } # Loaded module rlm_ldap # Loading module "ldap" from file /etc/freeradius/3.0/mods-enabled/ldap ldap { server = "LDAPServer" port = 389 identity = "cn=admin,dc=kms,dc=de" password = <<< secret >>> sasl { } valuepair_attribute = "radiusAttribute" user { scope = "sub" access_positive = yes sasl { } } group { filter = "(objectClass=groupOfNames)" scope = "sub" name_attribute = "cn" membership_filter = "(|(member=%{control:Ldap-UserDn})(memberUid=%{%{Stripped-User-Name}:-%{User-Name}}))" cacheable_name = yes cacheable_dn = no } client { filter = "(objectClass=radiusClient)" scope = "sub" base_dn = "dc=kms,dc=de" } profile { } options { ldap_debug = 40 chase_referrals = yes rebind = yes net_timeout = 1 res_timeout = 10 srv_timelimit = 3 idle = 60 probes = 3 interval = 3 } tls { start_tls = no } } Creating attribute LDAP-Group # Loaded module rlm_radutmp # Loading module "sradutmp" from file /etc/freeradius/3.0/mods-enabled/sradutmp radutmp sradutmp { filename = "/var/log/freeradius/sradutmp" username = "%{User-Name}" case_sensitive = yes check_with_nas = yes permissions = 420 caller_id = no } # Loaded module rlm_utf8 # Loading module "utf8" from file /etc/freeradius/3.0/mods-enabled/utf8 # Loading module "radutmp" from file /etc/freeradius/3.0/mods-enabled/radutmp radutmp { filename = "/var/log/freeradius/radutmp" username = "%{User-Name}" case_sensitive = yes check_with_nas = yes permissions = 384 caller_id = yes } # Loaded module rlm_mschap # Loading module "mschap" from file /etc/freeradius/3.0/mods-enabled/mschap mschap { use_mppe = yes require_encryption = no require_strong = no with_ntdomain_hack = yes passchange { } allow_retry = yes winbind_retry_with_normalised_username = no } # Loaded module rlm_logintime # Loading module "logintime" from file /etc/freeradius/3.0/mods-enabled/logintime logintime { minimum_timeout = 60 } # Loaded module rlm_passwd # Loading module "etc_passwd" from file /etc/freeradius/3.0/mods-enabled/passwd passwd etc_passwd { filename = "/etc/passwd" format = "*User-Name:Crypt-Password:" delimiter = ":" ignore_nislike = no ignore_empty = yes allow_multiple_keys = no hash_size = 100 } # Loading module "ntlm_auth" from file /etc/freeradius/3.0/mods-enabled/ntlm_auth exec ntlm_auth { wait = yes program = "/path/to/ntlm_auth --request-nt-key --domain=MYDOMAIN --username=%{mschap:User-Name} --password=%{User-Password}" shell_escape = yes } # Loaded module rlm_always # Loading module "reject" from file /etc/freeradius/3.0/mods-enabled/always always reject { rcode = "reject" simulcount = 0 mpp = no } # Loading module "fail" from file /etc/freeradius/3.0/mods-enabled/always always fail { rcode = "fail" simulcount = 0 mpp = no } # Loading module "ok" from file /etc/freeradius/3.0/mods-enabled/always always ok { rcode = "ok" simulcount = 0 mpp = no } # Loading module "handled" from file /etc/freeradius/3.0/mods-enabled/always always handled { rcode = "handled" simulcount = 0 mpp = no } # Loading module "invalid" from file /etc/freeradius/3.0/mods-enabled/always always invalid { rcode = "invalid" simulcount = 0 mpp = no } # Loading module "userlock" from file /etc/freeradius/3.0/mods-enabled/always always userlock { rcode = "userlock" simulcount = 0 mpp = no } # Loading module "notfound" from file /etc/freeradius/3.0/mods-enabled/always always notfound { rcode = "notfound" simulcount = 0 mpp = no } # Loading module "noop" from file /etc/freeradius/3.0/mods-enabled/always always noop { rcode = "noop" simulcount = 0 mpp = no } # Loading module "updated" from file /etc/freeradius/3.0/mods-enabled/always always updated { rcode = "updated" simulcount = 0 mpp = no } # Loaded module rlm_dynamic_clients # Loading module "dynamic_clients" from file /etc/freeradius/3.0/mods-enabled/dynamic_clients # Loaded module rlm_expr # Loading module "expr" from file /etc/freeradius/3.0/mods-enabled/expr expr { safe_characters = "@abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ0123456789.-_: /Ã¤Ã©Ã¶Ã¼Ã Ã¢Ã¦Ã§Ã¨Ã©ÃªÃ«Ã®Ã¯Ã´ÅÃ¹Ã»Ã¼aÃ¿ÃÃÃÃÃÃÃÃÃÃÃÃÃÃÃÃÅÃÃÃÅ¸" } # Loaded module rlm_realm # Loading module "IPASS" from file /etc/freeradius/3.0/mods-enabled/realm realm IPASS { format = "prefix" delimiter = "/" ignore_default = no ignore_null = no } # Loading module "suffix" from file /etc/freeradius/3.0/mods-enabled/realm realm suffix { format = "suffix" delimiter = "@" ignore_default = no ignore_null = no } # Loading module "realmpercent" from file /etc/freeradius/3.0/mods-enabled/realm realm realmpercent { format = "suffix" delimiter = "%" ignore_default = no ignore_null = no } # Loading module "ntdomain" from file /etc/freeradius/3.0/mods-enabled/realm realm ntdomain { format = "prefix" delimiter = "\\" ignore_default = no ignore_null = no } # Loaded module rlm_attr_filter # Loading module "attr_filter.post-proxy" from file /etc/freeradius/3.0/mods-enabled/attr_filter attr_filter attr_filter.post-proxy { filename = "/etc/freeradius/3.0/mods-config/attr_filter/post-proxy" key = "%{Realm}" relaxed = no } # Loading module "attr_filter.pre-proxy" from file /etc/freeradius/3.0/mods-enabled/attr_filter attr_filter attr_filter.pre-proxy { filename = "/etc/freeradius/3.0/mods-config/attr_filter/pre-proxy" key = "%{Realm}" relaxed = no } # Loading module "attr_filter.access_reject" from file /etc/freeradius/3.0/mods-enabled/attr_filter attr_filter attr_filter.access_reject { filename = "/etc/freeradius/3.0/mods-config/attr_filter/access_reject" key = "%{User-Name}" relaxed = no } # Loading module "attr_filter.access_challenge" from file /etc/freeradius/3.0/mods-enabled/attr_filter attr_filter attr_filter.access_challenge { filename = "/etc/freeradius/3.0/mods-config/attr_filter/access_challenge" key = "%{User-Name}" relaxed = no } # Loading module "attr_filter.accounting_response" from file /etc/freeradius/3.0/mods-enabled/attr_filter attr_filter attr_filter.accounting_response { filename = "/etc/freeradius/3.0/mods-config/attr_filter/accounting_response" key = "%{User-Name}" relaxed = no } # Loaded module rlm_files # Loading module "files" from file /etc/freeradius/3.0/mods-enabled/files files { filename = "/etc/freeradius/3.0/mods-config/files/authorize" acctusersfile = "/etc/freeradius/3.0/mods-config/files/accounting" preproxy_usersfile = "/etc/freeradius/3.0/mods-config/files/pre-proxy" } # Loading module "echo" from file /etc/freeradius/3.0/mods-enabled/echo exec echo { wait = yes program = "/bin/echo %{User-Name}" input_pairs = "request" output_pairs = "reply" shell_escape = yes } # Loaded module rlm_unix # Loading module "unix" from file /etc/freeradius/3.0/mods-enabled/unix unix { radwtmp = "/var/log/freeradius/radwtmp" } Creating attribute Unix-Group # Loaded module rlm_chap # Loading module "chap" from file /etc/freeradius/3.0/mods-enabled/chap # Loaded module rlm_linelog # Loading module "linelog" from file /etc/freeradius/3.0/mods-enabled/linelog linelog { filename = "/var/log/freeradius/linelog" escape_filenames = no syslog_severity = "info" permissions = 384 format = "This is a log message for %{User-Name}" reference = "messages.%{%{reply:Packet-Type}:-default}" } # Loading module "log_accounting" from file /etc/freeradius/3.0/mods-enabled/linelog linelog log_accounting { filename = "/var/log/freeradius/linelog-accounting" escape_filenames = no syslog_severity = "info" permissions = 384 format = "" reference = "Accounting-Request.%{%{Acct-Status-Type}:-unknown}" } # Loaded module rlm_expiration # Loading module "expiration" from file /etc/freeradius/3.0/mods-enabled/expiration # Loaded module rlm_replicate # Loading module "replicate" from file /etc/freeradius/3.0/mods-enabled/replicate # Loading module "auth_log" from file /etc/freeradius/3.0/mods-enabled/detail.log detail auth_log { filename = "/var/log/freeradius/radacct/%{%{Packet-Src-IP-Address}:-%{Packet-Src-IPv6-Address}}/auth-detail-%Y%m%d" header = "%t" permissions = 384 locking = no escape_filenames = no log_packet_header = no } # Loading module "reply_log" from file /etc/freeradius/3.0/mods-enabled/detail.log detail reply_log { filename = "/var/log/freeradius/radacct/%{%{Packet-Src-IP-Address}:-%{Packet-Src-IPv6-Address}}/reply-detail-%Y%m%d" header = "%t" permissions = 384 locking = no escape_filenames = no log_packet_header = no } # Loading module "pre_proxy_log" from file /etc/freeradius/3.0/mods-enabled/detail.log detail pre_proxy_log { filename = "/var/log/freeradius/radacct/%{%{Packet-Src-IP-Address}:-%{Packet-Src-IPv6-Address}}/pre-proxy-detail-%Y%m%d" header = "%t" permissions = 384 locking = no escape_filenames = no log_packet_header = no } # Loading module "post_proxy_log" from file /etc/freeradius/3.0/mods-enabled/detail.log detail post_proxy_log { filename = "/var/log/freeradius/radacct/%{%{Packet-Src-IP-Address}:-%{Packet-Src-IPv6-Address}}/post-proxy-detail-%Y%m%d" header = "%t" permissions = 384 locking = no escape_filenames = no log_packet_header = no } # Loaded module rlm_cache # Loading module "cache_eap" from file /etc/freeradius/3.0/mods-enabled/cache_eap cache cache_eap { driver = "rlm_cache_rbtree" key = "%{%{control:State}:-%{%{reply:State}:-%{State}}}" ttl = 15 max_entries = 0 epoch = 0 add_stats = no } # Loaded module rlm_pap # Loading module "pap" from file /etc/freeradius/3.0/mods-enabled/pap pap { normalise = yes } instantiate { } # Instantiating module "detail" from file /etc/freeradius/3.0/mods-enabled/detail # Instantiating module "eap" from file /etc/freeradius/3.0/mods-enabled/eap # Linked to sub-module rlm_eap_md5 # Linked to sub-module rlm_eap_leap # Linked to sub-module rlm_eap_gtc gtc { challenge = "Password: " auth_type = "PAP" } # Linked to sub-module rlm_eap_tls tls { tls = "tls-common" } tls-config tls-common { verify_depth = 0 ca_path = "/etc/freeradius/3.0/certs" pem_file_type = yes private_key_file = "/etc/freeradius/3.0/certs/server.key" certificate_file = "/etc/freeradius/3.0/certs/server.pem" ca_file = "/etc/freeradius/3.0/certs/ca.pem" private_key_password = <<< secret >>> dh_file = "/etc/freeradius/3.0/certs/dh" fragment_size = 1024 include_length = yes auto_chain = yes check_crl = no check_all_crl = no cipher_list = "DEFAULT" cipher_server_preference = no ecdh_curve = "prime256v1" tls_max_version = "" tls_min_version = "1.0" cache { enable = no lifetime = 24 max_entries = 255 } verify { skip_if_ocsp_ok = no } ocsp { enable = no override_cert_url = yes url = "http://127.0.0.1/ocsp/" use_nonce = yes timeout = 0 softfail = no } } # Linked to sub-module rlm_eap_ttls ttls { tls = "tls-common" default_eap_type = "md5" copy_request_to_tunnel = no use_tunneled_reply = no virtual_server = "inner-tunnel" include_length = yes require_client_cert = no } tls: Using cached TLS configuration from previous invocation # Linked to sub-module rlm_eap_peap peap { tls = "tls-common" default_eap_type = "mschapv2" copy_request_to_tunnel = no use_tunneled_reply = no proxy_tunneled_request_as_eap = yes virtual_server = "inner-tunnel" soh = no require_client_cert = no } tls: Using cached TLS configuration from previous invocation # Linked to sub-module rlm_eap_mschapv2 mschapv2 { with_ntdomain_hack = no send_error = no } # Instantiating module "preprocess" from file /etc/freeradius/3.0/mods-enabled/preprocess reading pairlist file /etc/freeradius/3.0/mods-config/preprocess/huntgroups reading pairlist file /etc/freeradius/3.0/mods-config/preprocess/hints # Instantiating module "ldap" from file /etc/freeradius/3.0/mods-enabled/ldap rlm_ldap: libldap vendor: OpenLDAP, version: 20447 accounting { reference = "%{tolower:type.%{Acct-Status-Type}}" } post-auth { reference = "." } rlm_ldap (ldap): Initialising connection pool pool { start = 5 min = 3 max = 32 spare = 10 uses = 0 lifetime = 0 cleanup_interval = 30 idle_timeout = 60 retry_delay = 30 spread = no } rlm_ldap (ldap): Opening additional connection (0), 1 of 32 pending slots used rlm_ldap (ldap): Connecting to ldap://LDAPServer:389 rlm_ldap (ldap): Waiting for bind result... rlm_ldap (ldap): Bind successful rlm_ldap (ldap): Opening additional connection (1), 1 of 31 pending slots used rlm_ldap (ldap): Connecting to ldap://LDAPServer:389 rlm_ldap (ldap): Waiting for bind result... rlm_ldap (ldap): Bind successful rlm_ldap (ldap): Opening additional connection (2), 1 of 30 pending slots used rlm_ldap (ldap): Connecting to ldap://LDAPServer:389 rlm_ldap (ldap): Waiting for bind result... rlm_ldap (ldap): Bind successful rlm_ldap (ldap): Opening additional connection (3), 1 of 29 pending slots used rlm_ldap (ldap): Connecting to ldap://LDAPServer:389 rlm_ldap (ldap): Waiting for bind result... rlm_ldap (ldap): Bind successful rlm_ldap (ldap): Opening additional connection (4), 1 of 28 pending slots used rlm_ldap (ldap): Connecting to ldap://LDAPServer:389 rlm_ldap (ldap): Waiting for bind result... rlm_ldap (ldap): Bind successful # Instantiating module "mschap" from file /etc/freeradius/3.0/mods-enabled/mschap rlm_mschap (mschap): using internal authentication # Instantiating module "logintime" from file /etc/freeradius/3.0/mods-enabled/logintime # Instantiating module "etc_passwd" from file /etc/freeradius/3.0/mods-enabled/passwd rlm_passwd: nfields: 3 keyfield 0(User-Name) listable: no # Instantiating module "reject" from file /etc/freeradius/3.0/mods-enabled/always # Instantiating module "fail" from file /etc/freeradius/3.0/mods-enabled/always # Instantiating module "ok" from file /etc/freeradius/3.0/mods-enabled/always # Instantiating module "handled" from file /etc/freeradius/3.0/mods-enabled/always # Instantiating module "invalid" from file /etc/freeradius/3.0/mods-enabled/always # Instantiating module "userlock" from file /etc/freeradius/3.0/mods-enabled/always # Instantiating module "notfound" from file /etc/freeradius/3.0/mods-enabled/always # Instantiating module "noop" from file /etc/freeradius/3.0/mods-enabled/always # Instantiating module "updated" from file /etc/freeradius/3.0/mods-enabled/always # Instantiating module "IPASS" from file /etc/freeradius/3.0/mods-enabled/realm # Instantiating module "suffix" from file /etc/freeradius/3.0/mods-enabled/realm # Instantiating module "realmpercent" from file /etc/freeradius/3.0/mods-enabled/realm # Instantiating module "ntdomain" from file /etc/freeradius/3.0/mods-enabled/realm # Instantiating module "attr_filter.post-proxy" from file /etc/freeradius/3.0/mods-enabled/attr_filter reading pairlist file /etc/freeradius/3.0/mods-config/attr_filter/post-proxy # Instantiating module "attr_filter.pre-proxy" from file /etc/freeradius/3.0/mods-enabled/attr_filter reading pairlist file /etc/freeradius/3.0/mods-config/attr_filter/pre-proxy # Instantiating module "attr_filter.access_reject" from file /etc/freeradius/3.0/mods-enabled/attr_filter reading pairlist file /etc/freeradius/3.0/mods-config/attr_filter/access_reject [/etc/freeradius/3.0/mods-config/attr_filter/access_reject]:11 Check item "FreeRADIUS-Response-Delay" found in filter list for realm "DEFAULT". [/etc/freeradius/3.0/mods-config/attr_filter/access_reject]:11 Check item "FreeRADIUS-Response-Delay-USec" found in filter list for realm "DEFAULT". # Instantiating module "attr_filter.access_challenge" from file /etc/freeradius/3.0/mods-enabled/attr_filter reading pairlist file /etc/freeradius/3.0/mods-config/attr_filter/access_challenge # Instantiating module "attr_filter.accounting_response" from file /etc/freeradius/3.0/mods-enabled/attr_filter reading pairlist file /etc/freeradius/3.0/mods-config/attr_filter/accounting_response # Instantiating module "files" from file /etc/freeradius/3.0/mods-enabled/files reading pairlist file /etc/freeradius/3.0/mods-config/files/authorize reading pairlist file /etc/freeradius/3.0/mods-config/files/accounting reading pairlist file /etc/freeradius/3.0/mods-config/files/pre-proxy # Instantiating module "linelog" from file /etc/freeradius/3.0/mods-enabled/linelog # Instantiating module "log_accounting" from file /etc/freeradius/3.0/mods-enabled/linelog # Instantiating module "expiration" from file /etc/freeradius/3.0/mods-enabled/expiration # Instantiating module "auth_log" from file /etc/freeradius/3.0/mods-enabled/detail.log rlm_detail (auth_log): 'User-Password' suppressed, will not appear in detail output # Instantiating module "reply_log" from file /etc/freeradius/3.0/mods-enabled/detail.log # Instantiating module "pre_proxy_log" from file /etc/freeradius/3.0/mods-enabled/detail.log # Instantiating module "post_proxy_log" from file /etc/freeradius/3.0/mods-enabled/detail.log # Instantiating module "cache_eap" from file /etc/freeradius/3.0/mods-enabled/cache_eap rlm_cache (cache_eap): Driver rlm_cache_rbtree (module rlm_cache_rbtree) loaded and linked # Instantiating module "pap" from file /etc/freeradius/3.0/mods-enabled/pap } # modules radiusd: #### Loading Virtual Servers #### server { # from file /etc/freeradius/3.0/radiusd.conf } # server server inner-tunnel { # from file /etc/freeradius/3.0/sites-enabled/inner-tunnel # Loading authenticate {...} # Loading authorize {...} Ignoring "sql" (see raddb/mods-available/README.rst) # Loading session {...} # Loading post-proxy {...} # Loading post-auth {...} # Skipping contents of 'if' as it is always 'false' -- /etc/freeradius/3.0/sites-enabled/inner-tunnel:334 } # server inner-tunnel server default { # from file /etc/freeradius/3.0/sites-enabled/default # Loading authenticate {...} # Loading authorize {...} # Loading preacct {...} # Loading accounting {...} # Loading post-proxy {...} # Loading post-auth {...} } # server default radiusd: #### Opening IP addresses and Ports #### listen { type = "auth" ipaddr = 127.0.0.1 port = 18120 } listen { type = "auth" ipaddr = * port = 0 limit { max_connections = 16 lifetime = 0 idle_timeout = 30 } } listen { type = "acct" ipaddr = * port = 0 limit { max_connections = 16 lifetime = 0 idle_timeout = 30 } } listen { type = "auth" ipv6addr = :: port = 0 limit { max_connections = 16 lifetime = 0 idle_timeout = 30 } } listen { type = "acct" ipv6addr = :: port = 0 limit { max_connections = 16 lifetime = 0 idle_timeout = 30 } } Listening on auth address 127.0.0.1 port 18120 bound to server inner-tunnel Listening on auth address * port 1812 bound to server default Listening on acct address * port 1813 bound to server default Listening on auth address :: port 1812 bound to server default Listening on acct address :: port 1813 bound to server default Listening on proxy address * port 39463 Listening on proxy address :: port 35211 Ready to process requests (0) Received Access-Request Id 23 from 192.168.188.45:41837 to 192.168.188.50:1812 length 174 (0) User-Name = "host/RadiusClient" (0) NAS-IP-Address = 192.168.1.245 (0) NAS-Port = 0 (0) Called-Station-Id = "88-90-8D-42-55-70:ciscosb" (0) Calling-Station-Id = "24-41-8C-4E-CA-B9" (0) Framed-MTU = 1400 (0) NAS-Port-Type = Wireless-802.11 (0) Connect-Info = "CONNECT 0Mbps 802.11g" (0) EAP-Message = 0x0200001601686f73742f526164697573436c69656e74 (0) Message-Authenticator = 0x3b4fe4a59f73c0b31684f6b9c5a8387f (0) # Executing section authorize from file /etc/freeradius/3.0/sites-enabled/default (0) authorize { (0) policy filter_username { (0) if (&User-Name) { (0) if (&User-Name) -> TRUE (0) if (&User-Name) { (0) if (&User-Name =~ / /) { (0) if (&User-Name =~ / /) -> FALSE (0) if (&User-Name =~ /@[^@]*@/ ) { (0) if (&User-Name =~ /@[^@]*@/ ) -> FALSE (0) if (&User-Name =~ /\.\./ ) { (0) if (&User-Name =~ /\.\./ ) -> FALSE (0) if ((&User-Name =~ /@/) && (&User-Name !~ /(a)(.+)\.(.+)$/)) { (0) if ((&User-Name =~ /@/) && (&User-Name !~ /(a)(.+)\.(.+)$/)) -> FALSE (0) if (&User-Name =~ /\.$/) { (0) if (&User-Name =~ /\.$/) -> FALSE (0) if (&User-Name =~ /(a)\./) { (0) if (&User-Name =~ /(a)\./) -> FALSE (0) } # if (&User-Name) = notfound (0) } # policy filter_username = notfound (0) [preprocess] = ok (0) [chap] = noop (0) [mschap] = noop (0) [digest] = noop (0) suffix: Checking for suffix after "@" (0) suffix: No '@' in User-Name = "host/RadiusClient", looking up realm NULL (0) suffix: No such realm "NULL" (0) [suffix] = noop (0) eap: Peer sent EAP Response (code 2) ID 0 length 22 (0) eap: EAP-Identity reply, returning 'ok' so we can short-circuit the rest of authorize (0) [eap] = ok (0) } # authorize = ok (0) Found Auth-Type = eap (0) # Executing group from file /etc/freeradius/3.0/sites-enabled/default (0) authenticate { (0) eap: Peer sent packet with method EAP Identity (1) (0) eap: Calling submodule eap_md5 to process data (0) eap_md5: Issuing MD5 Challenge (0) eap: Sending EAP Request (code 1) ID 1 length 22 (0) eap: EAP session adding &reply:State = 0xc9df8823c9de8c01 (0) [eap] = handled (0) } # authenticate = handled (0) Using Post-Auth-Type Challenge (0) # Executing group from file /etc/freeradius/3.0/sites-enabled/default (0) Challenge { ... } # empty sub-section is ignored (0) Sent Access-Challenge Id 23 from 192.168.188.50:1812 to 192.168.188.45:41837 length 0 (0) EAP-Message = 0x0101001604107528b5d8ffd31ed0736adf8aded7efa2 (0) Message-Authenticator = 0x00000000000000000000000000000000 (0) State = 0xc9df8823c9de8c015646fbec6ae272f2 (0) Finished request Waking up in 4.9 seconds. (1) Received Access-Request Id 24 from 192.168.188.45:41837 to 192.168.188.50:1812 length 176 (1) User-Name = "host/RadiusClient" (1) NAS-IP-Address = 192.168.1.245 (1) NAS-Port = 0 (1) Called-Station-Id = "88-90-8D-42-55-70:ciscosb" (1) Calling-Station-Id = "24-41-8C-4E-CA-B9" (1) Framed-MTU = 1400 (1) NAS-Port-Type = Wireless-802.11 (1) Connect-Info = "CONNECT 0Mbps 802.11g" (1) EAP-Message = 0x02010006030d (1) State = 0xc9df8823c9de8c015646fbec6ae272f2 (1) Message-Authenticator = 0x58b1b87c2350c89ce023b7c5a1152bea (1) session-state: No cached attributes (1) # Executing section authorize from file /etc/freeradius/3.0/sites-enabled/default (1) authorize { (1) policy filter_username { (1) if (&User-Name) { (1) if (&User-Name) -> TRUE (1) if (&User-Name) { (1) if (&User-Name =~ / /) { (1) if (&User-Name =~ / /) -> FALSE (1) if (&User-Name =~ /@[^@]*@/ ) { (1) if (&User-Name =~ /@[^@]*@/ ) -> FALSE (1) if (&User-Name =~ /\.\./ ) { (1) if (&User-Name =~ /\.\./ ) -> FALSE (1) if ((&User-Name =~ /@/) && (&User-Name !~ /(a)(.+)\.(.+)$/)) { (1) if ((&User-Name =~ /@/) && (&User-Name !~ /(a)(.+)\.(.+)$/)) -> FALSE (1) if (&User-Name =~ /\.$/) { (1) if (&User-Name =~ /\.$/) -> FALSE (1) if (&User-Name =~ /(a)\./) { (1) if (&User-Name =~ /(a)\./) -> FALSE (1) } # if (&User-Name) = notfound (1) } # policy filter_username = notfound (1) [preprocess] = ok (1) [chap] = noop (1) [mschap] = noop (1) [digest] = noop (1) suffix: Checking for suffix after "@" (1) suffix: No '@' in User-Name = "host/RadiusClient", looking up realm NULL (1) suffix: No such realm "NULL" (1) [suffix] = noop (1) eap: Peer sent EAP Response (code 2) ID 1 length 6 (1) eap: No EAP Start, assuming it's an on-going EAP conversation (1) [eap] = updated (1) [files] = noop rlm_ldap (ldap): Reserved connection (0) (1) ldap: EXPAND (uid=%{%{Stripped-User-Name}:-%{User-Name}}) (1) ldap: --> (uid=host/RadiusClient) (1) ldap: Performing search in "dc=kms,dc=de" with filter "(uid=host/RadiusClient)", scope "sub" (1) ldap: Waiting for search result... (1) ldap: User object found at DN "uid=host/RadiusClient,ou=people,dc=kms,dc=de" (1) ldap: EXPAND (&(objectClass=groupOfNames)(|(member=%{control:Ldap-UserDn})(memberUid=%{%{Stripped-User-Name}:-%{User-Name}}))) (1) ldap: --> (&(objectClass=groupOfNames)(|(member=uid\3dhost/RadiusClient\2cou\3dpeople\2cdc\3dkms\2cdc\3dde)(memberUid=host/RadiusClient))) (1) ldap: Performing search in "dc=kms,dc=de" with filter "(&(objectClass=groupOfNames)(|(member=uid\3dhost/RadiusClient\2cou\3dpeople\2cdc\3dkms\2cdc\3dde)(memberUid=host/RadiusClient)))", scope "sub" (1) ldap: Waiting for search result... (1) ldap: Search returned no results (1) ldap: No cacheable group memberships found in group objects (1) ldap: Processing user attributes (1) ldap: control:Password-With-Header += 'mydummypassword' rlm_ldap (ldap): Released connection (0) Need 5 more connections to reach 10 spares rlm_ldap (ldap): Opening additional connection (5), 1 of 27 pending slots used rlm_ldap (ldap): Connecting to ldap://LDAPServer:389 rlm_ldap (ldap): Waiting for bind result... rlm_ldap (ldap): Bind successful (1) [ldap] = updated (1) [expiration] = noop (1) [logintime] = noop (1) pap: No {...} in Password-With-Header, re-writing to Cleartext-Password (1) pap: Removing &control:Password-With-Header (1) pap: WARNING: Auth-Type already set. Not setting to PAP (1) [pap] = noop (1) } # authorize = updated (1) Found Auth-Type = eap (1) # Executing group from file /etc/freeradius/3.0/sites-enabled/default (1) authenticate { (1) eap: Expiring EAP session with state 0xc9df8823c9de8c01 (1) eap: Finished EAP session with state 0xc9df8823c9de8c01 (1) eap: Previous EAP request found for state 0xc9df8823c9de8c01, released from the list (1) eap: Peer sent packet with method EAP NAK (3) (1) eap: Found mutually acceptable type TLS (13) (1) eap: Calling submodule eap_tls to process data (1) eap_tls: Initiating new EAP-TLS session (1) eap_tls: Setting verify mode to require certificate from client (1) eap_tls: [eaptls start] = request (1) eap: Sending EAP Request (code 1) ID 2 length 6 (1) eap: EAP session adding &reply:State = 0xc9df8823c8dd8501 (1) [eap] = handled (1) } # authenticate = handled (1) Using Post-Auth-Type Challenge (1) # Executing group from file /etc/freeradius/3.0/sites-enabled/default (1) Challenge { ... } # empty sub-section is ignored (1) Sent Access-Challenge Id 24 from 192.168.188.50:1812 to 192.168.188.45:41837 length 0 (1) EAP-Message = 0x010200060d20 (1) Message-Authenticator = 0x00000000000000000000000000000000 (1) State = 0xc9df8823c8dd85015646fbec6ae272f2 (1) Finished request Waking up in 4.9 seconds. (2) Received Access-Request Id 25 from 192.168.188.45:41837 to 192.168.188.50:1812 length 174 (2) User-Name = "host/RadiusClient" (2) NAS-IP-Address = 192.168.1.245 (2) NAS-Port = 0 (2) Called-Station-Id = "88-90-8D-42-55-70:ciscosb" (2) Calling-Station-Id = "24-41-8C-4E-CA-B9" (2) Framed-MTU = 1400 (2) NAS-Port-Type = Wireless-802.11 (2) Connect-Info = "CONNECT 0Mbps 802.11g" (2) EAP-Message = 0x0200001601686f73742f526164697573436c69656e74 (2) Message-Authenticator = 0x6bb8bc01b38cfbb96fd02f67096577e5 (2) # Executing section authorize from file /etc/freeradius/3.0/sites-enabled/default (2) authorize { (2) policy filter_username { (2) if (&User-Name) { (2) if (&User-Name) -> TRUE (2) if (&User-Name) { (2) if (&User-Name =~ / /) { (2) if (&User-Name =~ / /) -> FALSE (2) if (&User-Name =~ /@[^@]*@/ ) { (2) if (&User-Name =~ /@[^@]*@/ ) -> FALSE (2) if (&User-Name =~ /\.\./ ) { (2) if (&User-Name =~ /\.\./ ) -> FALSE (2) if ((&User-Name =~ /@/) && (&User-Name !~ /(a)(.+)\.(.+)$/)) { (2) if ((&User-Name =~ /@/) && (&User-Name !~ /(a)(.+)\.(.+)$/)) -> FALSE (2) if (&User-Name =~ /\.$/) { (2) if (&User-Name =~ /\.$/) -> FALSE (2) if (&User-Name =~ /(a)\./) { (2) if (&User-Name =~ /(a)\./) -> FALSE (2) } # if (&User-Name) = notfound (2) } # policy filter_username = notfound (2) [preprocess] = ok (2) [chap] = noop (2) [mschap] = noop (2) [digest] = noop (2) suffix: Checking for suffix after "@" (2) suffix: No '@' in User-Name = "host/RadiusClient", looking up realm NULL (2) suffix: No such realm "NULL" (2) [suffix] = noop (2) eap: Peer sent EAP Response (code 2) ID 0 length 22 (2) eap: EAP-Identity reply, returning 'ok' so we can short-circuit the rest of authorize (2) [eap] = ok (2) } # authorize = ok (2) Found Auth-Type = eap (2) # Executing group from file /etc/freeradius/3.0/sites-enabled/default (2) authenticate { (2) eap: Peer sent packet with method EAP Identity (1) (2) eap: Calling submodule eap_md5 to process data (2) eap_md5: Issuing MD5 Challenge (2) eap: Sending EAP Request (code 1) ID 1 length 22 (2) eap: EAP session adding &reply:State = 0xca374eaeca364a72 (2) [eap] = handled (2) } # authenticate = handled (2) Using Post-Auth-Type Challenge (2) # Executing group from file /etc/freeradius/3.0/sites-enabled/default (2) Challenge { ... } # empty sub-section is ignored (2) Sent Access-Challenge Id 25 from 192.168.188.50:1812 to 192.168.188.45:41837 length 0 (2) EAP-Message = 0x01010016041040ba8bec57e9693bd0c6bc053ddb69c9 (2) Message-Authenticator = 0x00000000000000000000000000000000 (2) State = 0xca374eaeca364a720219c4f185b69853 (2) Finished request Waking up in 4.1 seconds. (3) Received Access-Request Id 26 from 192.168.188.45:41837 to 192.168.188.50:1812 length 176 (3) User-Name = "host/RadiusClient" (3) NAS-IP-Address = 192.168.1.245 (3) NAS-Port = 0 (3) Called-Station-Id = "88-90-8D-42-55-70:ciscosb" (3) Calling-Station-Id = "24-41-8C-4E-CA-B9" (3) Framed-MTU = 1400 (3) NAS-Port-Type = Wireless-802.11 (3) Connect-Info = "CONNECT 0Mbps 802.11g" (3) EAP-Message = 0x02010006030d (3) State = 0xca374eaeca364a720219c4f185b69853 (3) Message-Authenticator = 0x631455556a9f0d894f13e6e3bbf1d50c (3) session-state: No cached attributes (3) # Executing section authorize from file /etc/freeradius/3.0/sites-enabled/default (3) authorize { (3) policy filter_username { (3) if (&User-Name) { (3) if (&User-Name) -> TRUE (3) if (&User-Name) { (3) if (&User-Name =~ / /) { (3) if (&User-Name =~ / /) -> FALSE (3) if (&User-Name =~ /@[^@]*@/ ) { (3) if (&User-Name =~ /@[^@]*@/ ) -> FALSE (3) if (&User-Name =~ /\.\./ ) { (3) if (&User-Name =~ /\.\./ ) -> FALSE (3) if ((&User-Name =~ /@/) && (&User-Name !~ /(a)(.+)\.(.+)$/)) { (3) if ((&User-Name =~ /@/) && (&User-Name !~ /(a)(.+)\.(.+)$/)) -> FALSE (3) if (&User-Name =~ /\.$/) { (3) if (&User-Name =~ /\.$/) -> FALSE (3) if (&User-Name =~ /(a)\./) { (3) if (&User-Name =~ /(a)\./) -> FALSE (3) } # if (&User-Name) = notfound (3) } # policy filter_username = notfound (3) [preprocess] = ok (3) [chap] = noop (3) [mschap] = noop (3) [digest] = noop (3) suffix: Checking for suffix after "@" (3) suffix: No '@' in User-Name = "host/RadiusClient", looking up realm NULL (3) suffix: No such realm "NULL" (3) [suffix] = noop (3) eap: Peer sent EAP Response (code 2) ID 1 length 6 (3) eap: No EAP Start, assuming it's an on-going EAP conversation (3) [eap] = updated (3) [files] = noop rlm_ldap (ldap): Reserved connection (1) (3) ldap: EXPAND (uid=%{%{Stripped-User-Name}:-%{User-Name}}) (3) ldap: --> (uid=host/RadiusClient) (3) ldap: Performing search in "dc=kms,dc=de" with filter "(uid=host/RadiusClient)", scope "sub" (3) ldap: Waiting for search result... (3) ldap: User object found at DN "uid=host/RadiusClient,ou=people,dc=kms,dc=de" (3) ldap: EXPAND (&(objectClass=groupOfNames)(|(member=%{control:Ldap-UserDn})(memberUid=%{%{Stripped-User-Name}:-%{User-Name}}))) (3) ldap: --> (&(objectClass=groupOfNames)(|(member=uid\3dhost/RadiusClient\2cou\3dpeople\2cdc\3dkms\2cdc\3dde)(memberUid=host/RadiusClient))) (3) ldap: Performing search in "dc=kms,dc=de" with filter "(&(objectClass=groupOfNames)(|(member=uid\3dhost/RadiusClient\2cou\3dpeople\2cdc\3dkms\2cdc\3dde)(memberUid=host/RadiusClient)))", scope "sub" (3) ldap: Waiting for search result... (3) ldap: Search returned no results (3) ldap: No cacheable group memberships found in group objects (3) ldap: Processing user attributes (3) ldap: control:Password-With-Header += 'mydummypassword' rlm_ldap (ldap): Released connection (1) Need 4 more connections to reach 10 spares rlm_ldap (ldap): Opening additional connection (6), 1 of 26 pending slots used rlm_ldap (ldap): Connecting to ldap://LDAPServer:389 rlm_ldap (ldap): Waiting for bind result... rlm_ldap (ldap): Bind successful (3) [ldap] = updated (3) [expiration] = noop (3) [logintime] = noop (3) pap: No {...} in Password-With-Header, re-writing to Cleartext-Password (3) pap: Removing &control:Password-With-Header (3) pap: WARNING: Auth-Type already set. Not setting to PAP (3) [pap] = noop (3) } # authorize = updated (3) Found Auth-Type = eap (3) # Executing group from file /etc/freeradius/3.0/sites-enabled/default (3) authenticate { (3) eap: Expiring EAP session with state 0xc9df8823c8dd8501 (3) eap: Finished EAP session with state 0xca374eaeca364a72 (3) eap: Previous EAP request found for state 0xca374eaeca364a72, released from the list (3) eap: Peer sent packet with method EAP NAK (3) (3) eap: Found mutually acceptable type TLS (13) (3) eap: Calling submodule eap_tls to process data (3) eap_tls: Initiating new EAP-TLS session (3) eap_tls: Setting verify mode to require certificate from client (3) eap_tls: [eaptls start] = request (3) eap: Sending EAP Request (code 1) ID 2 length 6 (3) eap: EAP session adding &reply:State = 0xca374eaecb354372 (3) [eap] = handled (3) } # authenticate = handled (3) Using Post-Auth-Type Challenge (3) # Executing group from file /etc/freeradius/3.0/sites-enabled/default (3) Challenge { ... } # empty sub-section is ignored (3) Sent Access-Challenge Id 26 from 192.168.188.50:1812 to 192.168.188.45:41837 length 0 (3) EAP-Message = 0x010200060d20 (3) Message-Authenticator = 0x00000000000000000000000000000000 (3) State = 0xca374eaecb3543720219c4f185b69853 (3) Finished request Waking up in 4.1 seconds.

3 9

Do servers share the resources in radiusd.conf?
by adrian.p.smith＠bt.com 16 Jan '20

16 Jan '20

If I have more than one "server" defined in sites-enabled, does each one have their own thread pool, or do they all share a common pool? Thanks, Adrian

2 1

Stripping the domain from the username
by Stuart Ramdeen 15 Jan '20

15 Jan '20

Hi all I would be grateful for some pointers with an issue I am experiencing at a customer's site. I need to strip the domain part of the username that users are authenticating with. For example, a user will type in bob(a)example.com during authentication to the wireless network, but the username at the backend in the directory system is just 'bob'. I know that this is a common request of freeradius and I have tried to configure it in the conf files, but clearly I am not doing something correctly. I can't seem to get the 'Stripped-User-Name' to be used where I expect it. If someone can prod me in the right direction, I'd really appreciate it. The actual domain name in the below text has been replaced with example.co.uk. sh-3.2# radiusd -X radiusd: FreeRADIUS Version 2.2.9, for host i386-apple-darwin13.0, built on Sep 15 2016 at 12:27:36 Copyright (C) 1999-2015 The FreeRADIUS server project and contributors. There is NO warranty; not even for MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. You may redistribute copies of FreeRADIUS under the terms of the GNU General Public License. For more information about these matters, see the file named COPYRIGHT. Starting - reading configuration files ... including configuration file /Library/Server/radius/raddb/radiusd.conf including configuration file /Library/Server/radius/raddb/proxy.conf including configuration file /Library/Server/radius/raddb/clients.conf including files in directory /Library/Server/radius/raddb/modules/ including configuration file /Library/Server/radius/raddb/modules/acct_unique including configuration file /Library/Server/radius/raddb/modules/always including configuration file /Library/Server/radius/raddb/modules/attr_filter including configuration file /Library/Server/radius/raddb/modules/attr_rewrite including configuration file /Library/Server/radius/raddb/modules/cache including configuration file /Library/Server/radius/raddb/modules/chap including configuration file /Library/Server/radius/raddb/modules/checkval including configuration file /Library/Server/radius/raddb/modules/counter including configuration file /Library/Server/radius/raddb/modules/cui including configuration file /Library/Server/radius/raddb/modules/detail including configuration file /Library/Server/radius/raddb/modules/ detail.example.com including configuration file /Library/Server/radius/raddb/modules/detail.log including configuration file /Library/Server/radius/raddb/modules/dhcp_sqlippool including configuration file /Library/Server/radius/raddb/sql/mysql/ippool-dhcp.conf including configuration file /Library/Server/radius/raddb/modules/digest including configuration file /Library/Server/radius/raddb/modules/dynamic_clients including configuration file /Library/Server/radius/raddb/modules/echo including configuration file /Library/Server/radius/raddb/modules/etc_group including configuration file /Library/Server/radius/raddb/modules/exec including configuration file /Library/Server/radius/raddb/modules/expiration including configuration file /Library/Server/radius/raddb/modules/expr including configuration file /Library/Server/radius/raddb/modules/files including configuration file /Library/Server/radius/raddb/modules/inner-eap including configuration file /Library/Server/radius/raddb/modules/ippool including configuration file /Library/Server/radius/raddb/modules/krb5 including configuration file /Library/Server/radius/raddb/modules/ldap including configuration file /Library/Server/radius/raddb/modules/linelog including configuration file /Library/Server/radius/raddb/modules/logintime including configuration file /Library/Server/radius/raddb/modules/mac2ip including configuration file /Library/Server/radius/raddb/modules/mac2vlan including configuration file /Library/Server/radius/raddb/modules/mschap including configuration file /Library/Server/radius/raddb/modules/ntlm_auth including configuration file /Library/Server/radius/raddb/modules/opendirectory including configuration file /Library/Server/radius/raddb/modules/otp including configuration file /Library/Server/radius/raddb/modules/pam including configuration file /Library/Server/radius/raddb/modules/pap including configuration file /Library/Server/radius/raddb/modules/passwd including configuration file /Library/Server/radius/raddb/modules/perl including configuration file /Library/Server/radius/raddb/modules/policy including configuration file /Library/Server/radius/raddb/modules/preprocess including configuration file /Library/Server/radius/raddb/modules/radrelay including configuration file /Library/Server/radius/raddb/modules/radutmp including configuration file /Library/Server/radius/raddb/modules/realm including configuration file /Library/Server/radius/raddb/modules/redis including configuration file /Library/Server/radius/raddb/modules/rediswho including configuration file /Library/Server/radius/raddb/modules/replicate including configuration file /Library/Server/radius/raddb/modules/smbpasswd including configuration file /Library/Server/radius/raddb/modules/smsotp including configuration file /Library/Server/radius/raddb/modules/soh including configuration file /Library/Server/radius/raddb/modules/sql_log including configuration file /Library/Server/radius/raddb/modules/sqlcounter_expire_on_login including configuration file /Library/Server/radius/raddb/modules/sradutmp including configuration file /Library/Server/radius/raddb/modules/unix including configuration file /Library/Server/radius/raddb/modules/wimax including configuration file /Library/Server/radius/raddb/eap.conf including configuration file /Library/Server/radius/raddb/sql.conf including configuration file /Library/Server/radius/raddb/sql/sqlite/dialup.conf including configuration file /Library/Server/radius/raddb/policy.conf including files in directory /Library/Server/radius/raddb/sites-enabled/ including configuration file /Library/Server/radius/raddb/sites-enabled/control-socket including configuration file /Library/Server/radius/raddb/sites-enabled/default including configuration file /Library/Server/radius/raddb/sites-enabled/inner-tunnel main { allow_core_dumps = no } including dictionary file /Library/Server/radius/raddb/dictionary main { name = "radiusd" prefix = "/Applications/Server.app/Contents/ServerRoot/usr" localstatedir = "/private/var" sbindir = "/Applications/Server.app/Contents/ServerRoot/usr/sbin" logdir = "/private/var/log/radius" run_dir = "/private/var" libdir = "/Applications/Server.app/Contents/ServerRoot/usr/lib/freeradius" radacctdir = "/private/var/log/radius/radacct" hostname_lookups = no max_request_time = 30 cleanup_delay = 5 max_requests = 1024 pidfile = "/private/var/radiusd.pid" checkrad = "/Applications/Server.app/Contents/ServerRoot/usr/sbin/checkrad" debug_level = 0 proxy_requests = yes log { stripped_names = no auth = yes auth_badpass = yes auth_goodpass = yes } security { max_attributes = 200 reject_delay = 1 status_server = yes allow_vulnerable_openssl = no } } radiusd: #### Loading Realms and Home Servers #### proxy server { retry_delay = 5 retry_count = 3 default_fallback = no dead_time = 120 wake_all_if_all_dead = no } home_server localhost { ipaddr = 127.0.0.1 port = 1812 type = "auth" secret = "testing123" response_window = 20 max_outstanding = 65536 require_message_authenticator = yes zombie_period = 40 status_check = "status-server" ping_interval = 30 check_interval = 30 num_answers_to_alive = 3 num_pings_to_alive = 3 revive_interval = 120 status_check_timeout = 4 coa { irt = 2 mrt = 16 mrc = 5 mrd = 30 } } home_server_pool my_auth_failover { type = fail-over home_server = localhost } realm example.com { auth_pool = my_auth_failover } realm example.co.uk { auth_pool = my_auth_failover } realm LOCAL { } radiusd: #### Loading Clients #### client localhost { ipaddr = 127.0.0.1 require_message_authenticator = no secret = "testing123" nastype = "other" } radiusd: #### Instantiating modules #### instantiate { Module: Linked to module rlm_exec Module: Instantiating module "exec" from file /Library/Server/radius/raddb/modules/exec exec { wait = no input_pairs = "request" shell_escape = yes } Module: Linked to module rlm_expr Module: Instantiating module "expr" from file /Library/Server/radius/raddb/modules/expr Module: Linked to module rlm_expiration Module: Instantiating module "expiration" from file /Library/Server/radius/raddb/modules/expiration expiration { reply-message = "Password Has Expired " } Module: Linked to module rlm_logintime Module: Instantiating module "logintime" from file /Library/Server/radius/raddb/modules/logintime logintime { reply-message = "You are calling outside your allowed timespan " minimum-timeout = 60 } Module: Linked to module rlm_sql Module: Instantiating module "sql" from file /Library/Server/radius/raddb/sql.conf sql { driver = "rlm_sql_sqlite" server = "localhost" port = "" login = "radius" password = "radpass" radius_db = "radius" read_groups = yes sqltrace = no sqltracefile = "/private/var/log/radius/sqltrace.sql" readclients = yes deletestalesessions = yes num_sql_socks = 5 lifetime = 0 max_queries = 0 sql_user_name = "%{User-Name}" default_user_profile = "" nas_query = "SELECT id,nasname,shortname,type,secret FROM nas" authorize_check_query = "" authorize_group_check_query = "" authorize_group_reply_query = "" accounting_onoff_query = "" accounting_update_query = "" accounting_update_query_alt = "" accounting_start_query = "" accounting_start_query_alt = "" accounting_stop_query = "" accounting_stop_query_alt = "" connect_failure_retry_delay = 60 simul_count_query = "" simul_verify_query = "" postauth_query = "" safe-characters = "@abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ0123456789.-_: /" } rlm_sql (sql): Driver rlm_sql_sqlite (module rlm_sql_sqlite) loaded and linked rlm_sql (sql): Attempting to connect to radius@localhost:/radius rlm_sql (sql): starting 0 rlm_sql (sql): Attempting to connect rlm_sql_sqlite #0 rlm_sql_sqlite: Opening sqlite database /Library/Server/radius/raddb/sqlite_radius_client_database for #0 rlm_sql_sqlite: sqlite3_open() = 0 rlm_sql (sql): Connected new DB handle, #0 rlm_sql (sql): starting 1 rlm_sql (sql): Attempting to connect rlm_sql_sqlite #1 rlm_sql_sqlite: Opening sqlite database /Library/Server/radius/raddb/sqlite_radius_client_database for #1 rlm_sql_sqlite: sqlite3_open() = 0 rlm_sql (sql): Connected new DB handle, #1 rlm_sql (sql): starting 2 rlm_sql (sql): Attempting to connect rlm_sql_sqlite #2 rlm_sql_sqlite: Opening sqlite database /Library/Server/radius/raddb/sqlite_radius_client_database for #2 rlm_sql_sqlite: sqlite3_open() = 0 rlm_sql (sql): Connected new DB handle, #2 rlm_sql (sql): starting 3 rlm_sql (sql): Attempting to connect rlm_sql_sqlite #3 rlm_sql_sqlite: Opening sqlite database /Library/Server/radius/raddb/sqlite_radius_client_database for #3 rlm_sql_sqlite: sqlite3_open() = 0 rlm_sql (sql): Connected new DB handle, #3 rlm_sql (sql): starting 4 rlm_sql (sql): Attempting to connect rlm_sql_sqlite #4 rlm_sql_sqlite: Opening sqlite database /Library/Server/radius/raddb/sqlite_radius_client_database for #4 rlm_sql_sqlite: sqlite3_open() = 0 rlm_sql (sql): Connected new DB handle, #4 rlm_sql (sql): Processing generate_sql_clients rlm_sql (sql) in generate_sql_clients: query is SELECT id,nasname,shortname,type,secret FROM nas rlm_sql (sql): Reserving sql socket id: 4 rlm_sql_sqlite: sqlite3_prepare() = 0 rlm_sql_sqlite: sqlite3_step = 100 rlm_sql (sql): Read entry nasname=10.40.92.126,shortname=SCH-WAP-02,secret=testing123 rlm_sql (sql): Adding client 10.40.92.126 (SCH-WAP-02, server=<none>) to clients list rlm_sql_sqlite: sqlite3_step = 100 rlm_sql (sql): Read entry nasname=10.40.92.127,shortname=SCH-WAP-01,secret=testing123 rlm_sql (sql): Adding client 10.40.92.127 (SCH-WAP-01, server=<none>) to clients list rlm_sql_sqlite: sqlite3_step = 100 rlm_sql (sql): Read entry nasname=10.40.92.125,shortname=SCH-WAP-03,secret=testing123 rlm_sql (sql): Adding client 10.40.92.125 (SCH-WAP-03, server=<none>) to clients list rlm_sql_sqlite: sqlite3_step = 100 rlm_sql (sql): Read entry nasname=10.40.92.179,shortname=Test-SG300,secret=testing123 rlm_sql (sql): Adding client 10.40.92.179 (Test-SG300, server=<none>) to clients list rlm_sql_sqlite: sqlite3_step = 100 rlm_sql (sql): Read entry nasname=10.40.92.121,shortname=SCH-SWI-04-T13,secret=testing123 rlm_sql (sql): Adding client 10.40.92.121 (SCH-SWI-04-T13, server=<none>) to clients list rlm_sql_sqlite: sqlite3_step = 100 rlm_sql (sql): Read entry nasname=10.40.92.122,shortname=SCH-SWI-03-T12,secret=testing123 rlm_sql (sql): Adding client 10.40.92.122 (SCH-SWI-03-T12, server=<none>) to clients list rlm_sql_sqlite: sqlite3_step = 100 rlm_sql (sql): Read entry nasname=10.40.92.124,shortname=SCH-SWI-01-T11,secret=testing123 rlm_sql (sql): Adding client 10.40.92.124 (SCH-SWI-01-T11, server=<none>) to clients list rlm_sql_sqlite: sqlite3_step = 100 rlm_sql (sql): Read entry nasname=10.40.92.123,shortname=SCH-SWI-02-T12,secret=testing123 rlm_sql (sql): Adding client 10.40.92.123 (SCH-SWI-02-T12, server=<none>) to clients list rlm_sql_sqlite: sqlite3_step = 100 rlm_sql (sql): Read entry nasname= 192.168.236.32/28,shortname=clearpass,secret=HHNueA8LTj rlm_sql (sql): Adding client 192.168.236.32 (clearpass, server=<none>) to clients list rlm_sql_sqlite: sqlite3_step = 100 rlm_sql (sql): Read entry nasname=10.40.92.251,shortname=nana,secret=HHNueA8LTj rlm_sql (sql): Adding client 10.40.92.251 (nana, server=<none>) to clients list rlm_sql_sqlite: sqlite3_step = 101 rlm_sql_sqlite: sqlite3_finalize() = 0 rlm_sql (sql): Released sql socket id: 4 } radiusd: #### Loading Virtual Servers #### server { # from file /Library/Server/radius/raddb/radiusd.conf modules { Module: Creating Auth-Type = digest Module: Creating Auth-Type = opendirectory Module: Checking authenticate {...} for more modules to load Module: Linked to module rlm_pap Module: Instantiating module "pap" from file /Library/Server/radius/raddb/modules/pap pap { encryption_scheme = "auto" auto_header = no } Module: Linked to module rlm_chap Module: Instantiating module "chap" from file /Library/Server/radius/raddb/modules/chap Module: Linked to module rlm_mschap Module: Instantiating module "mschap" from file /Library/Server/radius/raddb/modules/mschap mschap { use_mppe = yes require_encryption = no require_strong = no with_ntdomain_hack = no allow_retry = yes use_open_directory = yes } Module: Linked to module rlm_digest Module: Instantiating module "digest" from file /Library/Server/radius/raddb/modules/digest Module: Linked to module rlm_opendirectory Module: Instantiating module "opendirectory" from file /Library/Server/radius/raddb/modules/opendirectory Module: Linked to module rlm_unix Module: Instantiating module "unix" from file /Library/Server/radius/raddb/modules/unix unix { radwtmp = "/private/var/log/radius/radwtmp" } Module: Linked to module rlm_eap Module: Instantiating module "eap" from file /Library/Server/radius/raddb/eap.conf eap { default_eap_type = "ttls" timer_expire = 60 ignore_unknown_eap_types = no cisco_accounting_username_bug = no max_sessions = 4096 } Module: Linked to sub-module rlm_eap_md5 Module: Instantiating eap-md5 Module: Linked to sub-module rlm_eap_leap Module: Instantiating eap-leap Module: Linked to sub-module rlm_eap_gtc Module: Instantiating eap-gtc gtc { challenge = "Password: " auth_type = "PAP" } Module: Linked to sub-module rlm_eap_tls Module: Instantiating eap-tls tls { rsa_key_exchange = no dh_key_exchange = yes rsa_key_length = 512 dh_key_length = 512 verify_depth = 0 CA_path = "/Library/Server/radius/raddb/certs" pem_file_type = yes private_key_file = "/Library/Server/radius/raddb/certs/server.key" certificate_file = "/Library/Server/radius/raddb/certs/server.crt" CA_file = "/Library/Server/radius/raddb/certs/server.crt" private_key_password = "whatever" dh_file = "/Library/Server/radius/raddb/certs/dh" random_file = "/Library/Server/radius/raddb/certs/random" fragment_size = 1024 include_length = yes check_crl = no check_all_crl = no cipher_list = "DEFAULT" make_cert_command = "/Library/Server/radius/raddb/certs/bootstrap" ecdh_curve = "prime256v1" cache { enable = no lifetime = 24 max_entries = 255 } verify { } ocsp { enable = no override_cert_url = yes url = "http://127.0.0.1/ocsp/" use_nonce = yes timeout = 0 softfail = no } } Module: Linked to sub-module rlm_eap_ttls Module: Instantiating eap-ttls ttls { default_eap_type = "mschapv2" copy_request_to_tunnel = no use_tunneled_reply = no virtual_server = "inner-tunnel" include_length = yes } Module: Linked to sub-module rlm_eap_peap Module: Instantiating eap-peap peap { default_eap_type = "mschapv2" copy_request_to_tunnel = no use_tunneled_reply = no proxy_tunneled_request_as_eap = yes virtual_server = "inner-tunnel" soh = no } Module: Linked to sub-module rlm_eap_mschapv2 Module: Instantiating eap-mschapv2 mschapv2 { with_ntdomain_hack = no send_error = no } Module: Checking authorize {...} for more modules to load Module: Linked to module rlm_preprocess Module: Instantiating module "preprocess" from file /Library/Server/radius/raddb/modules/preprocess preprocess { huntgroups = "/Library/Server/radius/raddb/huntgroups" hints = "/Library/Server/radius/raddb/hints" with_ascend_hack = no ascend_channels_per_line = 23 with_ntdomain_hack = no with_specialix_jetstream_hack = no with_cisco_vsa_hack = no with_alvarion_vsa_hack = no } reading pairlist file /Library/Server/radius/raddb/huntgroups reading pairlist file /Library/Server/radius/raddb/hints Module: Linked to module rlm_realm Module: Instantiating module "suffix" from file /Library/Server/radius/raddb/modules/realm realm suffix { format = "suffix" delimiter = "@" ignore_default = no ignore_null = no } Module: Linked to module rlm_files Module: Instantiating module "files" from file /Library/Server/radius/raddb/modules/files files { usersfile = "/Library/Server/radius/raddb/users" acctusersfile = "/Library/Server/radius/raddb/acct_users" preproxy_usersfile = "/Library/Server/radius/raddb/preproxy_users" compat = "no" } reading pairlist file /Library/Server/radius/raddb/users reading pairlist file /Library/Server/radius/raddb/acct_users reading pairlist file /Library/Server/radius/raddb/preproxy_users Module: Checking preacct {...} for more modules to load Module: Linked to module rlm_acct_unique Module: Instantiating module "acct_unique" from file /Library/Server/radius/raddb/modules/acct_unique acct_unique { key = "User-Name, Acct-Session-Id, NAS-IP-Address, NAS-Identifier, NAS-Port" } Module: Checking accounting {...} for more modules to load Module: Linked to module rlm_detail Module: Instantiating module "detail" from file /Library/Server/radius/raddb/modules/detail detail { detailfile = "/private/var/log/radius/radacct/%{%{Packet-Src-IP-Address}:-%{Packet-Src-IPv6-Address}}/detail-%Y%m%d" header = "%t" detailperm = 384 dirperm = 493 locking = no log_packet_header = no escape_filenames = no } Module: Linked to module rlm_attr_filter Module: Instantiating module "attr_filter.accounting_response" from file /Library/Server/radius/raddb/modules/attr_filter attr_filter attr_filter.accounting_response { attrsfile = "/Library/Server/radius/raddb/attrs.accounting_response" key = "%{User-Name}" relaxed = no } reading pairlist file /Library/Server/radius/raddb/attrs.accounting_response Module: Checking session {...} for more modules to load Module: Linked to module rlm_radutmp Module: Instantiating module "radutmp" from file /Library/Server/radius/raddb/modules/radutmp radutmp { filename = "/private/var/log/radius/radutmp" username = "%{User-Name}" case_sensitive = yes check_with_nas = yes perm = 384 callerid = yes } Module: Checking post-proxy {...} for more modules to load Module: Checking post-auth {...} for more modules to load Module: Instantiating module "attr_filter.access_reject" from file /Library/Server/radius/raddb/modules/attr_filter attr_filter attr_filter.access_reject { attrsfile = "/Library/Server/radius/raddb/attrs.access_reject" key = "%{User-Name}" relaxed = no } reading pairlist file /Library/Server/radius/raddb/attrs.access_reject } # modules } # server server inner-tunnel { # from file /Library/Server/radius/raddb/sites-enabled/inner-tunnel modules { Module: Checking authenticate {...} for more modules to load Module: Checking authorize {...} for more modules to load Module: Checking session {...} for more modules to load Module: Checking post-proxy {...} for more modules to load Module: Checking post-auth {...} for more modules to load } # modules } # server radiusd: #### Opening IP addresses and Ports #### listen { type = "auth" ipaddr = * port = 0 } listen { type = "acct" ipaddr = * port = 0 } listen { type = "control" listen { socket = "/private/var/radiusd.sock" } } listen { type = "auth" ipaddr = 127.0.0.1 port = 18120 } ... adding new socket proxy address * port 53788 Listening on authentication address * port 1812 Listening on accounting address * port 1813 Listening on command file /private/var/radiusd.sock Listening on authentication address 127.0.0.1 port 18120 as server inner-tunnel Listening on proxy address * port 1814 Ready to process requests. rad_recv: Access-Request packet from host 192.168.236.44 port 1815, id=240, length=225 User-Name = "radiustest(a)example.co.uk" NAS-IP-Address = 192.168.236.28 NAS-Port = 0 NAS-Identifier = "192.168.236.26" NAS-Port-Type = Wireless-802.11 Calling-Station-Id = "109ADDC49B75" Called-Station-Id = "001A1E04AB58" Service-Type = Framed-User Framed-MTU = 1100 EAP-Message = 0x02010022017261646975737465737440676f73682e63616d64656e2e7363682e756b Aruba-Essid-Name = "school" Aruba-Location-Id = "ICT-TEST" Aruba-AP-Group = "test" Message-Authenticator = 0xcb3673c30e1a008614b794492d7bdc13 Proxy-State = 0x3230 # Executing section authorize from file /Library/Server/radius/raddb/sites-enabled/default +group authorize { ++[preprocess] = ok ++[chap] = noop ++[mschap] = noop ++[digest] = noop [suffix] Looking up realm "example.co.uk" for User-Name = " radiustest(a)example.co.uk" [suffix] Found realm "example.co.uk" [suffix] Adding Stripped-User-Name = "radiustest" [suffix] Adding Realm = "example.co.uk" [suffix] Proxying request from user radiustest to realm example.co.uk [suffix] Preparing to proxy authentication request to realm "example.co.uk" ++[suffix] = updated [eap] Request is supposed to be proxied to Realm example.co.uk. Not doing EAP. ++[eap] = noop ++[files] = noop [opendirectory] The host 192.168.236.44 does not have an access group. [opendirectory] User radiustest exists in OD [opendirectory] User radiustest is a member of the RADUIS SACL [opendirectory] Setting Auth-Type = opendirectory ++[opendirectory] = ok ++[expiration] = noop ++[logintime] = noop ++[pap] = noop +} # group authorize = updated WARNING: Empty pre-proxy section. Using default return values. Sending Access-Request of id 175 to 127.0.0.1 port 1812 User-Name = "radiustest" NAS-IP-Address = 192.168.236.28 NAS-Port = 0 NAS-Identifier = "192.168.236.26" NAS-Port-Type = Wireless-802.11 Calling-Station-Id = "109ADDC49B75" Called-Station-Id = "001A1E04AB58" Service-Type = Framed-User Framed-MTU = 1100 EAP-Message = 0x02010022017261646975737465737440676f73682e63616d64656e2e7363682e756b Aruba-Essid-Name = "school" Aruba-Location-Id = "ICT-TEST" Aruba-AP-Group = "test" Message-Authenticator = 0x00000000000000000000000000000000 Proxy-State = 0x3230 Proxy-State = 0x323430 Proxying request 0 to home server 127.0.0.1 port 1812 Sending Access-Request of id 175 to 127.0.0.1 port 1812 User-Name = "radiustest" NAS-IP-Address = 192.168.236.28 NAS-Port = 0 NAS-Identifier = "192.168.236.26" NAS-Port-Type = Wireless-802.11 Calling-Station-Id = "109ADDC49B75" Called-Station-Id = "001A1E04AB58" Service-Type = Framed-User Framed-MTU = 1100 EAP-Message = 0x02010022017261646975737465737440676f73682e63616d64656e2e7363682e756b Aruba-Essid-Name = "school" Aruba-Location-Id = "ICT-TEST" Aruba-AP-Group = "test" Message-Authenticator = 0x00000000000000000000000000000000 Proxy-State = 0x3230 Proxy-State = 0x323430 Going to the next request Waking up in 0.9 seconds. rad_recv: Access-Request packet from host 127.0.0.1 port 1814, id=175, length=211 User-Name = "radiustest" NAS-IP-Address = 192.168.236.28 NAS-Port = 0 NAS-Identifier = "192.168.236.26" NAS-Port-Type = Wireless-802.11 Calling-Station-Id = "109ADDC49B75" Called-Station-Id = "001A1E04AB58" Service-Type = Framed-User Framed-MTU = 1100 EAP-Message = 0x02010022017261646975737465737440676f73682e63616d64656e2e7363682e756b Aruba-Essid-Name = "school" Aruba-Location-Id = "ICT-TEST" Aruba-AP-Group = "test" Message-Authenticator = 0x3501877b8486b13298815dbd61d54947 Proxy-State = 0x3230 Proxy-State = 0x323430 # Executing section authorize from file /Library/Server/radius/raddb/sites-enabled/default +group authorize { ++[preprocess] = ok ++[chap] = noop ++[mschap] = noop ++[digest] = noop [suffix] No '@' in User-Name = "radiustest", looking up realm NULL [suffix] No such realm "NULL" ++[suffix] = noop [eap] EAP packet type response id 1 length 34 [eap] No EAP Start, assuming it's an on-going EAP conversation ++[eap] = updated ++[files] = noop [opendirectory] The host 127.0.0.1 does not have an access group. [opendirectory] User radiustest exists in OD [opendirectory] User radiustest is a member of the RADUIS SACL ++[opendirectory] = ok ++[expiration] = noop ++[logintime] = noop [pap] WARNING! No "known good" password found for the user. Authentication may fail because of this. ++[pap] = noop +} # group authorize = updated Found Auth-Type = EAP # Executing group from file /Library/Server/radius/raddb/sites-enabled/default +group authenticate { [eap] Identity (radiustest(a)example.co.uk) does not match User-Name (radiustest). Authentication failed. [eap] Failed in handler ++[eap] = invalid +} # group authenticate = invalid Failed to authenticate the user. Login incorrect: [radiustest/<via Auth-Type = EAP>] (from client localhost port 0 cli 109ADDC49B75) Using Post-Auth-Type Reject # Executing group from file /Library/Server/radius/raddb/sites-enabled/default +group REJECT { ++? if ("%{EAP-Message}") expand: %{EAP-Message} -> 0x02010022017261646975737465737440676f73682e63616d64656e2e7363682e756b ? Evaluating ("%{EAP-Message}") -> TRUE ++? if ("%{EAP-Message}") -> TRUE ++if ("%{EAP-Message}") { +++update reply { expand: %{Message-Authenticator} -> 0x3501877b8486b13298815dbd61d54947 +++} # update reply = noop ++} # if ("%{EAP-Message}") = noop [attr_filter.access_reject] expand: %{User-Name} -> radiustest attr_filter: Matched entry DEFAULT at line 11 ++[attr_filter.access_reject] = updated +} # group REJECT = updated Delaying reject of request 1 for 1 seconds Going to the next request Waking up in 0.9 seconds. Sending delayed reject for request 1 Sending Access-Reject of id 175 to 127.0.0.1 port 1814 Proxy-State = 0x3230 Proxy-State = 0x323430 EAP-Message = 0x04040004 Message-Authenticator = 0x00000000000000000000000000000000 Waking up in 4.9 seconds. rad_recv: Access-Reject packet from host 127.0.0.1 port 1812, id=175, length=53 Proxy-State = 0x3230 Proxy-State = 0x323430 EAP-Message = 0x04040004 Message-Authenticator = 0xe9f8dcb50c101f38f7426e72c427df74 # Executing section post-proxy from file /Library/Server/radius/raddb/sites-enabled/default +group post-proxy { [eap] No pre-existing handler found ++[eap] = noop +} # group post-proxy = noop Login incorrect (Home Server says so): [radiustest(a)example.co.uk/<via Auth-Type = opendirectory>] (from client clearpass port 0 cli 109ADDC49B75) Using Post-Auth-Type Reject # Executing group from file /Library/Server/radius/raddb/sites-enabled/default +group REJECT { ++? if ("%{EAP-Message}") expand: %{EAP-Message} -> 0x02010022017261646975737465737440676f73682e63616d64656e2e7363682e756b ? Evaluating ("%{EAP-Message}") -> TRUE ++? if ("%{EAP-Message}") -> TRUE ++if ("%{EAP-Message}") { +++update reply { expand: %{Message-Authenticator} -> 0xcb3673c30e1a008614b794492d7bdc13 +++} # update reply = noop ++} # if ("%{EAP-Message}") = noop [attr_filter.access_reject] expand: %{User-Name} -> radiustest(a)example.co.uk attr_filter: Matched entry DEFAULT at line 11 ++[attr_filter.access_reject] = updated +} # group REJECT = updated Sending Access-Reject of id 240 to 192.168.236.44 port 1815 EAP-Message = 0x04040004 Message-Authenticator = 0x00000000000000000000000000000000 Proxy-State = 0x3230 Finished request 0. Going to the next request Waking up in 4.9 seconds. rad_recv: Access-Request packet from host 192.168.236.44 port 1815, id=241, length=225 User-Name = "radiustest(a)example.co.uk" NAS-IP-Address = 192.168.236.28 NAS-Port = 0 NAS-Identifier = "192.168.236.26" NAS-Port-Type = Wireless-802.11 Calling-Station-Id = "109ADDC49B75" Called-Station-Id = "001A1E04AB58" Service-Type = Framed-User Framed-MTU = 1100 EAP-Message = 0x02020022017261646975737465737440676f73682e63616d64656e2e7363682e756b Aruba-Essid-Name = "school" Aruba-Location-Id = "ICT-TEST" Aruba-AP-Group = "test" Message-Authenticator = 0xf8eff948324a373824b6eeb749b7a675 Proxy-State = 0x3231 # Executing section authorize from file /Library/Server/radius/raddb/sites-enabled/default +group authorize { ++[preprocess] = ok ++[chap] = noop ++[mschap] = noop ++[digest] = noop [suffix] Looking up realm "example.co.uk" for User-Name = " radiustest(a)example.co.uk" [suffix] Found realm "example.co.uk" [suffix] Adding Stripped-User-Name = "radiustest" [suffix] Adding Realm = "example.co.uk" [suffix] Proxying request from user radiustest to realm example.co.uk [suffix] Preparing to proxy authentication request to realm "example.co.uk" ++[suffix] = updated [eap] Request is supposed to be proxied to Realm example.co.uk. Not doing EAP. ++[eap] = noop ++[files] = noop [opendirectory] The host 192.168.236.44 does not have an access group. [opendirectory] User radiustest exists in OD [opendirectory] User radiustest is a member of the RADUIS SACL [opendirectory] Setting Auth-Type = opendirectory ++[opendirectory] = ok ++[expiration] = noop ++[logintime] = noop ++[pap] = noop +} # group authorize = updated WARNING: Empty pre-proxy section. Using default return values. Sending Access-Request of id 193 to 127.0.0.1 port 1812 User-Name = "radiustest" NAS-IP-Address = 192.168.236.28 NAS-Port = 0 NAS-Identifier = "192.168.236.26" NAS-Port-Type = Wireless-802.11 Calling-Station-Id = "109ADDC49B75" Called-Station-Id = "001A1E04AB58" Service-Type = Framed-User Framed-MTU = 1100 EAP-Message = 0x02020022017261646975737465737440676f73682e63616d64656e2e7363682e756b Aruba-Essid-Name = "school" Aruba-Location-Id = "ICT-TEST" Aruba-AP-Group = "test" Message-Authenticator = 0x00000000000000000000000000000000 Proxy-State = 0x3231 Proxy-State = 0x323431 Proxying request 2 to home server 127.0.0.1 port 1812 Sending Access-Request of id 193 to 127.0.0.1 port 1812 User-Name = "radiustest" NAS-IP-Address = 192.168.236.28 NAS-Port = 0 NAS-Identifier = "192.168.236.26" NAS-Port-Type = Wireless-802.11 Calling-Station-Id = "109ADDC49B75" Called-Station-Id = "001A1E04AB58" Service-Type = Framed-User Framed-MTU = 1100 EAP-Message = 0x02020022017261646975737465737440676f73682e63616d64656e2e7363682e756b Aruba-Essid-Name = "school" Aruba-Location-Id = "ICT-TEST" Aruba-AP-Group = "test" Message-Authenticator = 0x00000000000000000000000000000000 Proxy-State = 0x3231 Proxy-State = 0x323431 Going to the next request Waking up in 0.9 seconds. rad_recv: Access-Request packet from host 127.0.0.1 port 1814, id=193, length=211 User-Name = "radiustest" NAS-IP-Address = 192.168.236.28 NAS-Port = 0 NAS-Identifier = "192.168.236.26" NAS-Port-Type = Wireless-802.11 Calling-Station-Id = "109ADDC49B75" Called-Station-Id = "001A1E04AB58" Service-Type = Framed-User Framed-MTU = 1100 EAP-Message = 0x02020022017261646975737465737440676f73682e63616d64656e2e7363682e756b Aruba-Essid-Name = "school" Aruba-Location-Id = "ICT-TEST" Aruba-AP-Group = "test" Message-Authenticator = 0xebdffca338692d279cfd1828df9606fe Proxy-State = 0x3231 Proxy-State = 0x323431 # Executing section authorize from file /Library/Server/radius/raddb/sites-enabled/default +group authorize { ++[preprocess] = ok ++[chap] = noop ++[mschap] = noop ++[digest] = noop [suffix] No '@' in User-Name = "radiustest", looking up realm NULL [suffix] No such realm "NULL" ++[suffix] = noop [eap] EAP packet type response id 2 length 34 [eap] No EAP Start, assuming it's an on-going EAP conversation ++[eap] = updated ++[files] = noop [opendirectory] The host 127.0.0.1 does not have an access group. [opendirectory] User radiustest exists in OD [opendirectory] User radiustest is a member of the RADUIS SACL ++[opendirectory] = ok ++[expiration] = noop ++[logintime] = noop [pap] WARNING! No "known good" password found for the user. Authentication may fail because of this. ++[pap] = noop +} # group authorize = updated Found Auth-Type = EAP # Executing group from file /Library/Server/radius/raddb/sites-enabled/default +group authenticate { [eap] Identity (radiustest(a)example.co.uk) does not match User-Name (radiustest). Authentication failed. [eap] Failed in handler ++[eap] = invalid +} # group authenticate = invalid Failed to authenticate the user. Login incorrect: [radiustest/<via Auth-Type = EAP>] (from client localhost port 0 cli 109ADDC49B75) Using Post-Auth-Type Reject # Executing group from file /Library/Server/radius/raddb/sites-enabled/default +group REJECT { ++? if ("%{EAP-Message}") expand: %{EAP-Message} -> 0x02020022017261646975737465737440676f73682e63616d64656e2e7363682e756b ? Evaluating ("%{EAP-Message}") -> TRUE ++? if ("%{EAP-Message}") -> TRUE ++if ("%{EAP-Message}") { +++update reply { expand: %{Message-Authenticator} -> 0xebdffca338692d279cfd1828df9606fe +++} # update reply = noop ++} # if ("%{EAP-Message}") = noop [attr_filter.access_reject] expand: %{User-Name} -> radiustest attr_filter: Matched entry DEFAULT at line 11 ++[attr_filter.access_reject] = updated +} # group REJECT = updated Delaying reject of request 3 for 1 seconds Going to the next request Waking up in 0.9 seconds. Sending delayed reject for request 3 Sending Access-Reject of id 193 to 127.0.0.1 port 1814 Proxy-State = 0x3231 Proxy-State = 0x323431 EAP-Message = 0x04040004 Message-Authenticator = 0x00000000000000000000000000000000 rad_recv: Access-Reject packet from host 127.0.0.1 port 1812, id=193, length=53 Proxy-State = 0x3231 Proxy-State = 0x323431 EAP-Message = 0x04040004 Message-Authenticator = 0xee1e8865c1c3badd0ed55be65dc5dbe9 # Executing section post-proxy from file /Library/Server/radius/raddb/sites-enabled/default +group post-proxy { [eap] No pre-existing handler found ++[eap] = noop +} # group post-proxy = noop Login incorrect (Home Server says so): [radiustest(a)example.co.uk/<via Auth-Type = opendirectory>] (from client clearpass port 0 cli 109ADDC49B75) Using Post-Auth-Type Reject # Executing group from file /Library/Server/radius/raddb/sites-enabled/default +group REJECT { ++? if ("%{EAP-Message}") expand: %{EAP-Message} -> 0x02020022017261646975737465737440676f73682e63616d64656e2e7363682e756b ? Evaluating ("%{EAP-Message}") -> TRUE ++? if ("%{EAP-Message}") -> TRUE ++if ("%{EAP-Message}") { +++update reply { expand: %{Message-Authenticator} -> 0xf8eff948324a373824b6eeb749b7a675 +++} # update reply = noop ++} # if ("%{EAP-Message}") = noop [attr_filter.access_reject] expand: %{User-Name} -> radiustest(a)example.co.uk attr_filter: Matched entry DEFAULT at line 11 ++[attr_filter.access_reject] = updated +} # group REJECT = updated Sending Access-Reject of id 241 to 192.168.236.44 port 1815 EAP-Message = 0x04040004 Message-Authenticator = 0x00000000000000000000000000000000 Proxy-State = 0x3231 Finished request 2. Going to the next request Cleaning up request 1 ID 175 with timestamp +43 Cleaning up request 0 ID 240 with timestamp +43 Waking up in 4.9 seconds. Thank you Stuart -- Crossover Solutions Ltd Pound House, 62A Highgate High Street, London, N6 5HX www.crossover.solutions <http://crossover.solutions> • 020 3637 4655 Registered in England and Wales No: 9593204 Registered address as stated Members of the Apple Consultants Network <https://consultants.apple.com/uk/988258> Please submit new support requests to support(a)crossover.solutions <mailto:support@crossover.solutions>

2 5