- Freeradius-Users - lists.freeradius.org

FreeRadius 3.0.12 - Select radreply but dont send them
by Thibault Lansiaux 27 Sep '19

27 Sep '19

Hi, We are having a problem with a freeradius migration, from two different servers. The first (old) 1.x : is OK On the new server (freeradius 3.0.12) FreeRadius select the user's radreply but don't send them in the "Access-Accept" We compared "sites-enabled/default" from the old and new, and didn't find differences in "authorize {" and "preprocess {" Bellow the Freeradius -X request : Ready to process requests (0) Received Access-Request Id 212 from 4.5.6.7:20506 to 1.2.3.4:1812 length 179 (0) Acct-Session-Id = "008fe531" (0) NAS-Port = 0 (0) NAS-Port-Type = Virtual (0) User-Name = "MY-NAS-ID" (0) Calling-Station-Id = "01-02-03-04-05-06" (0) Called-Station-Id = "11-12-13-14-15-16" (0) Framed-IP-Address = 192.168.3.254 (0) User-Password = "mypassword" (0) NAS-Identifier = "MY-NAS-ID" (0) NAS-IP-Address = 10.0.50.1 (0) Framed-MTU = 1496 (0) Connect-Info = "HTTPS" (0) Service-Type = Administrative-User (0) Message-Authenticator = 0x26fc427cba3a98946382a756c6659634 (0) # Executing section authorize from file /etc/freeradius/3.0/sites-enabled/default (0) authorize { (0) [preprocess] = ok (0) update request { (0) EXPAND %{User-Name} (0) --> MY-NAS-ID (0) SQL-User-Name set to 'MY-NAS-ID' rlm_sql (sql): Reserved connection (0) (0) Executing select query: SELECT groupname FROM radhuntgroup WHERE nasipaddress="MY-NAS-ID" rlm_sql (sql): Released connection (0) rlm_sql (sql): Need 5 more connections to reach 10 spares rlm_sql (sql): Opening additional connection (5), 1 of 27 pending slots used rlm_sql_mysql: Starting connect to MySQL server rlm_sql_mysql: Connected to database 'radius' on Localhost via UNIX socket, server version 10.1.26-MariaDB-0+deb9u1, protocol version 10 (0) EXPAND %{sql:SELECT groupname FROM radhuntgroup WHERE nasipaddress="%{NAS-Identifier}"} (0) --> my-nas-id-group (0) &Huntgroup-Name := my-nas-id-group (0) } # update request = noop (0) if (&Huntgroup-Name == "%{sql:SELECT groupname FROM radusergroup WHERE username="%{User-Name}"}"){ (0) EXPAND %{User-Name} (0) --> MY-NAS-ID (0) SQL-User-Name set to 'MY-NAS-ID' rlm_sql (sql): Reserved connection (1) (0) Executing select query: SELECT groupname FROM radusergroup WHERE username="MY-NAS-ID" rlm_sql (sql): Released connection (1) (0) EXPAND %{sql:SELECT groupname FROM radusergroup WHERE username="%{User-Name}"} (0) --> my-nas-id-group (0) if (&Huntgroup-Name == "%{sql:SELECT groupname FROM radusergroup WHERE username="%{User-Name}"}") -> TRUE (0) if (&Huntgroup-Name == "%{sql:SELECT groupname FROM radusergroup WHERE username="%{User-Name}"}") { (0) [ok] = ok (0) } # if (&Huntgroup-Name == "%{sql:SELECT groupname FROM radusergroup WHERE username="%{User-Name}"}") = ok (0) ... skipping else: Preceding "if" was taken (0) auth_log: EXPAND /var/log/freeradius/radacct/%{%{Packet-Src-IP-Address}:-%{Packet-Src-IPv6-Address}}/auth-detail-%Y%m%d (0) auth_log: --> /var/log/freeradius/radacct/4.5.6.7/auth-detail-20190927 (0) auth_log: /var/log/freeradius/radacct/%{%{Packet-Src-IP-Address}:-%{Packet-Src-IPv6-Address}}/auth-detail-%Y%m%d expands to /var/log/freeradius/radacct/4.5.6.7/auth-detail-20190927 (0) auth_log: EXPAND %t (0) auth_log: --> Fri Sep 27 11:58:20 2019 (0) [auth_log] = ok (0) [chap] = noop (0) [mschap] = noop (0) suffix: Checking for suffix after "@" (0) suffix: No '@' in User-Name = "MY-NAS-ID", looking up realm NULL (0) suffix: No such realm "NULL" (0) [suffix] = noop (0) eap: No EAP-Message, not doing EAP (0) [eap] = noop (0) [unix] = notfound (0) sql: EXPAND %{User-Name} (0) sql: --> MY-NAS-ID (0) sql: SQL-User-Name set to 'MY-NAS-ID' rlm_sql (sql): Reserved connection (2) (0) sql: EXPAND SELECT id, username, attribute, value, op FROM radcheck WHERE username = '%{SQL-User-Name}' ORDER BY id (0) sql: --> SELECT id, username, attribute, value, op FROM radcheck WHERE username = 'MY-NAS-ID' ORDER BY id (0) sql: Executing select query: SELECT id, username, attribute, value, op FROM radcheck WHERE username = 'MY-NAS-ID' ORDER BY id (0) sql: User found in radcheck table (0) sql: Conditional check items matched, merging assignment check items (0) sql: Cleartext-Password := "mypassword" (0) sql: EXPAND SELECT id, username, attribute, value, op FROM radreply WHERE username = '%{SQL-User-Name}' ORDER BY id (0) sql: --> SELECT id, username, attribute, value, op FROM radreply WHERE username = 'MY-NAS-ID' ORDER BY id (0) sql: Executing select query: SELECT id, username, attribute, value, op FROM radreply WHERE username = 'MY-NAS-ID' ORDER BY id (0) sql: User found in radreply table, merging reply items (0) sql: Colubris-AVPair == "access-list=loginserver,DENY,all,192.168.0.0/18,all" (0) sql: Colubris-AVPair == "access-list=loginserver,DENY,all,172.16.0.0/12,all" (0) sql: Colubris-AVPair == "access-list=loginserver,DENY,all,10.0.0.0/8,all" (0) sql: Colubris-AVPair == "access-list=loginserver,ACCEPT,tcp,www.mydomain.com,all" (0) sql: Colubris-AVPair == "use-access-list=loginserver" (0) sql: Colubris-AVPair == "logo=https://webportail.mydomain.com/directory/logo.gif" (0) sql: Colubris-AVPair == "fail-page=https://webportail.mydomain.com/directory/fail.html" (0) sql: Colubris-AVPair == "session-page=https://webportail.mydomain.com/directory/session.html" (0) sql: Colubris-AVPair == "messages=https://webportail.mydomain.com/directory/messages.txt" (0) sql: Colubris-AVPair == "transport-page=https://webportail.mydomain.com/directory/transport.html" (0) sql: Colubris-AVPair == "login-err-url=https://webportail.mydomain.com/directory/login-error.php" (0) sql: Colubris-AVPair == "goodbye-url=https://webportail.mydomain.com/directory/goodbye.php" (0) sql: Colubris-AVPair == "login-url=https://webportail.mydomain.com/directory/index.php?mac=%m" (0) sql: EXPAND SELECT groupname FROM radusergroup WHERE username = '%{SQL-User-Name}' ORDER BY priority (0) sql: --> SELECT groupname FROM radusergroup WHERE username = 'MY-NAS-ID' ORDER BY priority (0) sql: Executing select query: SELECT groupname FROM radusergroup WHERE username = 'MY-NAS-ID' ORDER BY priority (0) sql: User found in the group table (0) sql: EXPAND SELECT id, groupname, attribute, Value, op FROM radgroupcheck WHERE groupname = '%{SQL-Group}' ORDER BY id (0) sql: --> SELECT id, groupname, attribute, Value, op FROM radgroupcheck WHERE groupname = 'my-nas-id-group' ORDER BY id (0) sql: Executing select query: SELECT id, groupname, attribute, Value, op FROM radgroupcheck WHERE groupname = 'my-nas-id-group' ORDER BY id (0) sql: Group "my-nas-id-group": Conditional check items matched (0) sql: Group "my-nas-id-group": Merging assignment check items (0) sql: EXPAND SELECT id, groupname, attribute, value, op FROM radgroupreply WHERE groupname = '%{SQL-Group}' ORDER BY id (0) sql: --> SELECT id, groupname, attribute, value, op FROM radgroupreply WHERE groupname = 'my-nas-id-group' ORDER BY id (0) sql: Executing select query: SELECT id, groupname, attribute, value, op FROM radgroupreply WHERE groupname = 'my-nas-id-group' ORDER BY id (0) sql: Group "my-nas-id-group": Merging reply items rlm_sql (sql): Released connection (2) (0) [sql] = ok (0) [expiration] = noop (0) [logintime] = noop (0) [pap] = updated (0) } # authorize = updated (0) Found Auth-Type = PAP (0) # Executing group from file /etc/freeradius/3.0/sites-enabled/default (0) Auth-Type PAP { (0) pap: Login attempt with password (0) pap: Comparing with "known good" Cleartext-Password (0) pap: User authenticated successfully (0) [pap] = ok (0) } # Auth-Type PAP = ok (0) # Executing section post-auth from file /etc/freeradius/3.0/sites-enabled/default (0) post-auth { (0) update { (0) No attributes updated (0) } # update = noop (0) reply_log: EXPAND /var/log/freeradius/radacct/%{%{Packet-Src-IP-Address}:-%{Packet-Src-IPv6-Address}}/reply-detail-%Y%m%d (0) reply_log: --> /var/log/freeradius/radacct/4.5.6.7/reply-detail-20190927 (0) reply_log: /var/log/freeradius/radacct/%{%{Packet-Src-IP-Address}:-%{Packet-Src-IPv6-Address}}/reply-detail-%Y%m%d expands to /var/log/freeradius/radacct/4.5.6.7/reply-detail-20190927 (0) reply_log: EXPAND %t (0) reply_log: --> Fri Sep 27 11:58:20 2019 (0) [reply_log] = ok (0) sql: EXPAND .query (0) sql: --> .query (0) sql: Using query template 'query' rlm_sql (sql): Reserved connection (3) (0) sql: EXPAND %{User-Name} (0) sql: --> MY-NAS-ID (0) sql: SQL-User-Name set to 'MY-NAS-ID' (0) sql: EXPAND INSERT INTO radpostauth (username, pass, reply, authdate) VALUES ( '%{SQL-User-Name}', '%{%{User-Password}:-%{Chap-Password}}', '%{reply:Packet-Type}', '%S') (0) sql: --> INSERT INTO radpostauth (username, pass, reply, authdate) VALUES ( 'MY-NAS-ID', 'mypassword', 'Access-Accept', '2019-09-27 11:58:20') (0) sql: Executing query: INSERT INTO radpostauth (username, pass, reply, authdate) VALUES ( 'MY-NAS-ID', 'mypassword', 'Access-Accept', '2019-09-27 11:58:20') (0) sql: SQL query returned: success (0) sql: 1 record(s) updated rlm_sql (sql): Released connection (3) (0) [sql] = ok (0) [exec] = noop (0) policy remove_reply_message_if_eap { (0) if (&reply:EAP-Message && &reply:Reply-Message) { (0) if (&reply:EAP-Message && &reply:Reply-Message) -> FALSE (0) else { (0) [noop] = noop (0) } # else = noop (0) } # policy remove_reply_message_if_eap = noop (0) } # post-auth = ok (0) Login OK: [MY-NAS-ID/mypassword] (from client MY_CLIENT-WAN-IP port 0 cli 01-02-03-04-05-06) (0) Sent Access-Accept Id 212 from 1.2.3.4:1812 to 4.5.6.7:20506 length 0 (0) Finished request Waking up in 4.9 seconds. Regards, -- /Thibault Lansiaux/

2 1

Is it possible to use CHAP authentication with pam_radius?
by Dan Swartzendruber 27 Sep '19

27 Sep '19

I'm trying to implement external authentication for an appliance running CentOS 7. My research turned up the easiest solution as simply installing pam_radius from the repository. I did, and it works just fine (tested against a Freeradius 3.0 server with a single test user.) Running freeradiux with '-X' indicates that is using PAP: (0) User-Name = "XXX" (0) User-Password = "XXX" (0) NAS-IP-Address = XXX.XXX.XXX.XXX (0) NAS-Identifier = "sshd" (0) NAS-Port = 15050 (0) NAS-Port-Type = Virtual (0) Service-Type = Authenticate-Only ... (0) Found Auth-Type = PAP (0) # Executing group from file /etc/freeradius/3.0/sites-enabled/default (0) Auth-Type PAP { (0) pap: Login attempt with password (0) pap: Comparing with "known good" Cleartext-Password (0) pap: User authenticated successfully (0) [pap] = ok (0) } # Auth-Type PAP = ok For security reasons, I'd really like to use CHAP instead, but it doesn't seem to support that? The man pages and such don't mention CHAP. I went as far as downloading 1.4.0 and extracting the tarball and looking at the code. User-Password is Radius attribute 2, and looking at the source: 0 radius.h <global> 71 #define PW_PASSWORD 2 and 1 pam_radius_auth.c add_password 541 attr = find_attribute(request, PW_PASSWORD); 2 pam_radius_auth.c add_password 543 if (type == PW_PASSWORD) { 3 pam_radius_auth.c build_radius_packet 721 add_password(request, PW_PASSWORD, password, conf->server->secret); 4 pam_radius_auth.c build_radius_packet 727 add_password(request, PW_PASSWORD, "", conf->server->secret); 5 pam_radius_auth.c talk_radius 975 add_password(request, PW_PASSWORD, password, old_password); 6 pam_radius_auth.c talk_radius 978 add_password(request, PW_PASSWORD, password, server->secret); Am I missing something? Or am I out of luck? Thanks!

4 8

Freeradius - how to reply "memberof" active directory information for Strongswan
by Sébastien Genesta 25 Sep '19

25 Sep '19

Hi, I'm using Freeradius for the Active Directory authentication of my Strongswan clients. My goal is to declare 2 vpn connections with different virtual IP leases, allowing me to separate traffic (as an example, one vpn connection for sales and the other for technicians). To do it, I'm trying to use Group selection option (rightgroups) on Strongswan. According to Strongswan documentation ( https://wiki.strongswan.org/projects/strongswan/wiki/EapRadius) I have to use class attribute on my freeradius server to return the group membership. The issue is that I don't know how. I'm using mschap for authentication to Active Directory. *My current configuration:* */etc/freeradius/3.0/mods-available/mschap* with_ntdomain_hack = yes require_encryption = yes require_strong = yes ntlm_auth = "/usr/bin/ntlm_auth --request-nt-key --username=%{%{Stripped-User-Name}:-%{%{User-Name}:-None}} --challenge=%{%{mschap:Challenge}:-00} --nt-response=%{%{mschap:NT-Response}:-00}" */etc/freeradius/3.0/mods-enabled/eap* eap { [...] default_eap_type = mschapv2 copy_request_to_tunnel = yes use_tunneled_reply = no */etc/freeradius/3.0/clients.conf* client localhost { ipaddr = 127.0.0.1 proto = * secret = <radius-secret> require_message_authenticator = no nas_type = other limit { max_connections = 16 lifetime = 0 idle_timeout = 30 } } # IPv6 Client #client localhost_ipv6 { # ipv6addr = ::1 # secret = testing123 #} I've tried to follow this post but it didn't work http://freeradius.1045715.n5.nabble.com/Return-User-Groups-in-Class-field-t… More precisaly below part (replacing ldap module by mschap module and also changing path because my freeradius version is 3.0): *1) Added a mapping in ldap mod.* # /etc/raddb/mods-enabled/ldap ldap { ... update { ... reply:memberOf += 'memberOf' } ... } *2) Added an Attribute reference* # /etc/raddb/dictionary ATTRIBUTE memberOf 3001 string *3) Added a update reply* # /etc/raddb/sites-enabled/default post-auth { ... foreach &reply:memberOf { update reply { Class += "%{Foreach-Variable-0}" } } ... } I also tried to set below information (according to http://freeradius.1045715.n5.nabble.com/Reply-with-group-attribute-td278105… ) post-auth { ... update reply { Class += %{Group} } } ... } I've searched accross the Internet but didn't find a way to do it properly. Is there any official guide explaning how to reply memberOf attribute? How can I do it? Thanks for your help <https://www.avast.com/sig-email?utm_medium=email&utm_source=link&utm_campai…> Garanti sans virus. www.avast.com <https://www.avast.com/sig-email?utm_medium=email&utm_source=link&utm_campai…> <#m_-4546190989838674270_DAB4FAD8-2DD7-40BB-A1B8-4E2AA1F9FDF2>

2 4

How to set Tag = 0x00 in Tunnel-Private-Group-ID attribute
by Phani Siriki 24 Sep '19

24 Sep '19

Hi Team Is there a way to set "Tag = 0x00" in Tunnel-Private-Group-ID attribute? I have the following user listed in users file. When access-accept is sent, tag-id is set to 0x00 in Tunnel-Medium-Type and Tunnel-Type attributes. RFC 2868 didn't mention anything about tag=0x00 and I assume thats the reason we are not sending it from Freeradius. IxiaScale12000 Cleartext-Password := passwd12000 Tunnel-Medium-Type:0 = IEEE-802 , Tunnel-Type:0 = VLAN , Tunnel-Private-Group-Id:0 = "105", Filter-id = "Radius-block", Session-timeout = 500, Termination-Action = RADIUS-Request Version: ====== [root@yagna-freeradius1 ~]# radiusd -X FreeRADIUS Version 3.0.17 Best Regards Phani

2 4

Client Compatibility with PEAP and Certificates
by Shan . 24 Sep '19

24 Sep '19

Hello All, I've recently setup FreeRADIUS 3.0.17 using MySQL (Mariadb) together with phpMyAdmin all running on a Raspberry Pi 3. I'm using FreeRADIUS to send Mikrotik attributes to my NAS for my PEAP authenticated wireless clients which works well. I'm now moving to a production setup for a community, so I've obtained new certificates (DomainSSL) which have been issued by 'GoGetSSL'. To do this, I've updated the 'snake-oil' certificates, including the 'private key' and 'server.crt' provided by the certificate issuer. With regard to the 'Trusted root CA' certificates', I've combined both the 'USERTrust_RSA_Certificate_Authority.crt' and 'AddTrustExternal_CA_Root.crt' into one file and updated the ./etc/mods-enabled/eap to use my keys and certificates. The issue I'm having is that when using my updated certificates and authenticating my wireless clients via PEAP, some devices such as my Macbook Air (MacOS Mojave) mark the certificates as valid while others, such as my iPhone (iOS 12) mark the certificate as invalid. I believe this issue relates to the root trust certificate? What could I do to improve compatibility and prevent this invalid certificate issue for my end users? Could this be solved by using a different certificate provider? such as LetsEncrypt with a public CA? With Thanks, Shan. For reference, included below is the EAP config and Freeradius debug. ./etc/freeradius/3.0/mods-enabled/eap Config: # -*- text -*- ## ## eap.conf -- Configuration for EAP types (PEAP, TTLS, etc.) ## ## $Id: f67cbdbff9b6560cec9f68da1adb82b59723d2ef $ ####################################################################### # # Whatever you do, do NOT set 'Auth-Type := EAP'. The server # is smart enough to figure this out on its own. The most # common side effect of setting 'Auth-Type := EAP' is that the # users then cannot use ANY other authentication method. # eap { # Invoke the default supported EAP type when # EAP-Identity response is received. # # The incoming EAP messages DO NOT specify which EAP # type they will be using, so it MUST be set here. # # For now, only one default EAP type may be used at a time. # # If the EAP-Type attribute is set by another module, # then that EAP type takes precedence over the # default type configured here. # default_eap_type = md5 # A list is maintained to correlate EAP-Response # packets with EAP-Request packets. After a # configurable length of time, entries in the list # expire, and are deleted. # timer_expire = 60 # There are many EAP types, but the server has support # for only a limited subset. If the server receives # a request for an EAP type it does not support, then # it normally rejects the request. By setting this # configuration to "yes", you can tell the server to # instead keep processing the request. Another module # MUST then be configured to proxy the request to # another RADIUS server which supports that EAP type. # # If another module is NOT configured to handle the # request, then the request will still end up being # rejected. ignore_unknown_eap_types = no # Cisco AP1230B firmware 12.2(13)JA1 has a bug. When given # a User-Name attribute in an Access-Accept, it copies one # more byte than it should. # # We can work around it by configurably adding an extra # zero byte. cisco_accounting_username_bug = no # # Help prevent DoS attacks by limiting the number of # sessions that the server is tracking. For simplicity, # this is taken from the "max_requests" directive in # radiusd.conf. max_sessions = ${max_requests} # Supported EAP-types # # We do NOT recommend using EAP-MD5 authentication # for wireless connections. It is insecure, and does # not provide for dynamic WEP keys. # md5 { } # # EAP-pwd -- secure password-based authentication # # pwd { # group = 19 # # server_id = theserver(a)example.com # This has the same meaning as for TLS. # fragment_size = 1020 # The virtual server which determines the # "known good" password for the user. # Note that unlike TLS, only the "authorize" # section is processed. EAP-PWD requests can be # distinguished by having a User-Name, but # no User-Password, CHAP-Password, EAP-Message, etc. # virtual_server = "inner-tunnel" # } # Cisco LEAP # # We do not recommend using LEAP in new deployments. See: # http://www.securiteam.com/tools/5TP012ACKE.html # # Cisco LEAP uses the MS-CHAP algorithm (but not # the MS-CHAP attributes) to perform it's authentication. # # As a result, LEAP *requires* access to the plain-text # User-Password, or the NT-Password attributes. # 'System' authentication is impossible with LEAP. # leap { } # Generic Token Card. # # Currently, this is only permitted inside of EAP-TTLS, # or EAP-PEAP. The module "challenges" the user with # text, and the response from the user is taken to be # the User-Password. # # Proxying the tunneled EAP-GTC session is a bad idea, # the users password will go over the wire in plain-text, # for anyone to see. # gtc { # The default challenge, which many clients # ignore.. #challenge = "Password: " # The plain-text response which comes back # is put into a User-Password attribute, # and passed to another module for # authentication. This allows the EAP-GTC # response to be checked against plain-text, # or crypt'd passwords. # # If you say "Local" instead of "PAP", then # the module will look for a User-Password # configured for the request, and do the # authentication itself. # auth_type = PAP } ## Common TLS configuration for TLS-based EAP types # # See raddb/certs/README for additional comments # on certificates. # # If OpenSSL was not found at the time the server was # built, the "tls", "ttls", and "peap" sections will # be ignored. # # If you do not currently have certificates signed by # a trusted CA you may use the 'snakeoil' certificates. # Included with the server in raddb/certs. # # If these certificates have not been auto-generated: # cd raddb/certs # make # # These test certificates SHOULD NOT be used in a normal # deployment. They are created only to make it easier # to install the server, and to perform some simple # tests with EAP-TLS, TTLS, or PEAP. # # See also: # # http://www.dslreports.com/forum/remark,9286052~mode=flat # # Note that you should NOT use a globally known CA here! # e.g. using a Verisign cert as a "known CA" means that # ANYONE who has a certificate signed by them can # authenticate via EAP-TLS! This is likely not what you want. tls-config tls-common { private_key_password = whatever private_key_file = /etc/ssl/private/private.key #MODIFIED 19SEP19 #private_key_file = /etc/ssl/private/ssl-cert-snakeoil.key # If Private key & Certificate are located in # the same file, then private_key_file & # certificate_file must contain the same file # name. # # If ca_file (below) is not used, then the # certificate_file below MUST include not # only the server certificate, but ALSO all # of the CA certificates used to sign the # server certificate. #MODIFIED 19SEP19 certificate_file = /etc/ssl/certs/server.crt #certificate_file = /etc/ssl/certs/ssl-cert-snakeoil.pem # Trusted Root CA list # # ALL of the CA's in this list will be trusted # to issue client certificates for authentication. # # In general, you should use self-signed # certificates for 802.1x (EAP) authentication. # In that case, this CA file should contain # *one* CA certificate. # #MODIFIED 19SEP19 ca_file = /etc/ssl/certs/usertrust_and_addtrust_combined.crt #ca_file = /etc/ssl/certs/ca-certificates.crt # OpenSSL will automatically create certificate chains, # unless we tell it to not do that. The problem is that # it sometimes gets the chains right from a certificate # signature view, but wrong from the clients view. # # When setting "auto_chain = no", the server certificate # file MUST include the full certificate chain. # auto_chain = yes # # If OpenSSL supports TLS-PSK, then we can use # a PSK identity and (hex) password. When the # following two configuration items are specified, # then certificate-based configuration items are # not allowed. e.g.: # # private_key_password # private_key_file # certificate_file # ca_file # ca_path # # For now, the identity is fixed, and must be the # same on the client. The passphrase must be a hex # value, and can be up to 256 hex digits. # # Future versions of the server may be able to # look up the shared key (hexphrase) based on the # identity. # # psk_identity = "test" # psk_hexphrase = "036363823" # # For DH cipher suites to work, you have to # run OpenSSL to create the DH file first: # # openssl dhparam -out certs/dh 2048 # dh_file = ${certdir}/dh # # If your system doesn't have /dev/urandom, # you will need to create this file, and # periodically change its contents. # # For security reasons, FreeRADIUS doesn't # write to files in its configuration # directory. # # random_file = /dev/urandom # # This can never exceed the size of a RADIUS # packet (4096 bytes), and is preferably half # that, to accommodate other attributes in # RADIUS packet. On most APs the MAX packet # length is configured between 1500 - 1600 # In these cases, fragment size should be # 1024 or less. # # fragment_size = 1024 # include_length is a flag which is # by default set to yes If set to # yes, Total Length of the message is # included in EVERY packet we send. # If set to no, Total Length of the # message is included ONLY in the # First packet of a fragment series. # # include_length = yes # Check the Certificate Revocation List # # 1) Copy CA certificates and CRLs to same directory. # 2) Execute 'c_rehash <CA certs&CRLs Directory>'. # 'c_rehash' is OpenSSL's command. # 3) uncomment the lines below. # 5) Restart radiusd # check_crl = yes # Check if intermediate CAs have been revoked. # check_all_crl = yes ca_path = ${cadir} # Accept an expired Certificate Revocation List # # allow_expired_crl = no # # If check_cert_issuer is set, the value will # be checked against the DN of the issuer in # the client certificate. If the values do not # match, the certificate verification will fail, # rejecting the user. # # This check can be done more generally by checking # the value of the TLS-Client-Cert-Issuer attribute. # This check can be done via any mechanism you # choose. # # check_cert_issuer = "/C=GB/ST=Berkshire/L=Newbury/O=My Company Ltd" # # If check_cert_cn is set, the value will # be xlat'ed and checked against the CN # in the client certificate. If the values # do not match, the certificate verification # will fail rejecting the user. # # This check is done only if the previous # "check_cert_issuer" is not set, or if # the check succeeds. # # In 2.1.10 and later, this check can be done # more generally by checking the value of the # TLS-Client-Cert-CN attribute. This check # can be done via any mechanism you choose. # # check_cert_cn = %{User-Name} # # Set this option to specify the allowed # TLS cipher suites. The format is listed # in "man 1 ciphers". # # For EAP-FAST, use "ALL:!EXPORT:!eNULL:!SSLv2" # cipher_list = "DEFAULT" # If enabled, OpenSSL will use server cipher list # (possibly defined by cipher_list option above) # for choosing right cipher suite rather than # using client-specified list which is OpenSSl default # behavior. Having it set to yes is a current best practice # for TLS cipher_server_preference = no # # You can selectively disable TLS versions for # compatability with old client devices. # # If your system has OpenSSL 1.1.0 or greater, do NOT # use these. Instead, set tls_min_version and # tls_max_version. # # disable_tlsv1_2 = no # disable_tlsv1_1 = no # disable_tlsv1 = no # # Set min / max TLS version. Mainly for Debian # "trusty", which disables older versions of TLS, and # requires the application to manually enable them. # # If you are running Debian trusty, you should set # these options, otherwise older clients will not be # able to connect. # # Allowed values are "1.0", "1.1", and "1.2". # # The values must be in quotes. # # tls_min_version = "1.0" # tls_max_version = "1.2" # # Elliptical cryptography configuration # # Only for OpenSSL >= 0.9.8.f # ecdh_curve = "prime256v1" # # Session resumption / fast reauthentication # cache. # # The cache contains the following information: # # session Id - unique identifier, managed by SSL # User-Name - from the Access-Accept # Stripped-User-Name - from the Access-Request # Cached-Session-Policy - from the Access-Accept # # The "Cached-Session-Policy" is the name of a # policy which should be applied to the cached # session. This policy can be used to assign # VLANs, IP addresses, etc. It serves as a useful # way to re-apply the policy from the original # Access-Accept to the subsequent Access-Accept # for the cached session. # # On session resumption, these attributes are # copied from the cache, and placed into the # reply list. # # You probably also want "use_tunneled_reply = yes" # when using fast session resumption. # cache { # # Enable it. The default is "no". Deleting the entire "cache" # subsection also disables caching. # # As of version 3.0.14, the session cache requires the use # of the "name" and "persist_dir" configuration items, below. # # The internal OpenSSL session cache has been permanently # disabled. # # You can disallow resumption for a particular user by adding the # following attribute to the control item list: # # Allow-Session-Resumption = No # # If "enable = no" below, you CANNOT enable resumption for just one # user by setting the above attribute to "yes". # enable = no # # Lifetime of the cached entries, in hours. The sessions will be # deleted/invalidated after this time. # lifetime = 24 # hours # # Internal "name" of the session cache. Used to # distinguish which TLS context sessions belong to. # # The server will generate a random value if unset. # This will change across server restart so you MUST # set the "name" if you want to persist sessions (see # below). # #name = "EAP module" # # Simple directory-based storage of sessions. # Two files per session will be written, the SSL # state and the cached VPs. This will persist session # across server restarts. # # The default directory is ${logdir}, for historical # reasons. You should ${db_dir} instead. And check # the value of db_dir in the main radiusd.conf file. # It should not point to ${raddb} # # The server will need write perms, and the directory # should be secured from anyone else. You might want # a script to remove old files from here periodically: # # find ${logdir}/tlscache -mtime +2 -exec rm -f {} \; # # This feature REQUIRES "name" option be set above. # #persist_dir = "${logdir}/tlscache" } # # As of version 2.1.10, client certificates can be # validated via an external command. This allows # dynamic CRLs or OCSP to be used. # # This configuration is commented out in the # default configuration. Uncomment it, and configure # the correct paths below to enable it. # # If OCSP checking is enabled, and the OCSP checks fail, # the verify section is not run. # # If OCSP checking is disabled, the verify section is # run on successful certificate validation. # verify { # If the OCSP checks succeed, the verify section # is run to allow additional checks. # # If you want to skip verify on OCSP success, # uncomment this configuration item, and set it # to "yes". # skip_if_ocsp_ok = no # A temporary directory where the client # certificates are stored. This directory # MUST be owned by the UID of the server, # and MUST not be accessible by any other # users. When the server starts, it will do # "chmod go-rwx" on the directory, for # security reasons. The directory MUST # exist when the server starts. # # You should also delete all of the files # in the directory when the server starts. # tmpdir = /tmp/radiusd # The command used to verify the client cert. # We recommend using the OpenSSL command-line # tool. # # The ${..ca_path} text is a reference to # the ca_path variable defined above. # # The %{TLS-Client-Cert-Filename} is the name # of the temporary file containing the cert # in PEM format. This file is automatically # deleted by the server when the command # returns. # client = "/path/to/openssl verify -CApath ${..ca_path} %{TLS-Client-Cert-Filename}" } # # OCSP Configuration # Certificates can be verified against an OCSP # Responder. This makes it possible to immediately # revoke certificates without the distribution of # new Certificate Revocation Lists (CRLs). # ocsp { # # Enable it. The default is "no". # Deleting the entire "ocsp" subsection # also disables ocsp checking # enable = no # # The OCSP Responder URL can be automatically # extracted from the certificate in question. # To override the OCSP Responder URL set # "override_cert_url = yes". # override_cert_url = yes # # If the OCSP Responder address is not extracted from # the certificate, the URL can be defined here. # url = "http://127.0.0.1/ocsp/" # # If the OCSP Responder can not cope with nonce # in the request, then it can be disabled here. # # For security reasons, disabling this option # is not recommended as nonce protects against # replay attacks. # # Note that Microsoft AD Certificate Services OCSP # Responder does not enable nonce by default. It is # more secure to enable nonce on the responder than # to disable it in the query here. # See http://technet.microsoft.com/en-us/library/cc770413%28WS.10%29.aspx # # use_nonce = yes # # Number of seconds before giving up waiting # for OCSP response. 0 uses system default. # # timeout = 0 # # Normally an error in querying the OCSP # responder (no response from server, server did # not understand the request, etc) will result in # a validation failure. # # To treat these errors as 'soft' failures and # still accept the certificate, enable this # option. # # Warning: this may enable clients with revoked # certificates to connect if the OCSP responder # is not available. Use with caution. # # softfail = no } } ## EAP-TLS # # As of Version 3.0, the TLS configuration for TLS-based # EAP types is above in the "tls-config" section. # tls { # Point to the common TLS configuration tls = tls-common # # As part of checking a client certificate, the EAP-TLS # sets some attributes such as TLS-Client-Cert-CN. This # virtual server has access to these attributes, and can # be used to accept or reject the request. # # virtual_server = check-eap-tls } ## EAP-TTLS # # The TTLS module implements the EAP-TTLS protocol, # which can be described as EAP inside of Diameter, # inside of TLS, inside of EAP, inside of RADIUS... # # Surprisingly, it works quite well. # ttls { # Which tls-config section the TLS negotiation parameters # are in - see EAP-TLS above for an explanation. # # In the case that an old configuration from FreeRADIUS # v2.x is being used, all the options of the tls-config # section may also appear instead in the 'tls' section # above. If that is done, the tls= option here (and in # tls above) MUST be commented out. # tls = tls-common # The tunneled EAP session needs a default EAP type # which is separate from the one for the non-tunneled # EAP module. Inside of the TTLS tunnel, we recommend # using EAP-MD5. If the request does not contain an # EAP conversation, then this configuration entry is # ignored. # default_eap_type = md5 # The tunneled authentication request does not usually # contain useful attributes like 'Calling-Station-Id', # etc. These attributes are outside of the tunnel, # and normally unavailable to the tunneled # authentication request. # # By setting this configuration entry to 'yes', # any attribute which is NOT in the tunneled # authentication request, but which IS available # outside of the tunnel, is copied to the tunneled # request. # # allowed values: {no, yes} # copy_request_to_tunnel = no # # As of version 3.0.5, this configuration item # is deprecated. Instead, you should use # # update outer.session-state { # ... # # } # # This will cache attributes for the final Access-Accept. # # The reply attributes sent to the NAS are usually # based on the name of the user 'outside' of the # tunnel (usually 'anonymous'). If you want to send # the reply attributes based on the user name inside # of the tunnel, then set this configuration entry to # 'yes', and the reply to the NAS will be taken from # the reply to the tunneled request. # # allowed values: {no, yes} # use_tunneled_reply = yes # # The inner tunneled request can be sent # through a virtual server constructed # specifically for this purpose. # # If this entry is commented out, the inner # tunneled request will be sent through # the virtual server that processed the # outer requests. # virtual_server = "inner-tunnel" # This has the same meaning, and overwrites, the # same field in the "tls" configuration, above. # The default value here is "yes". # # include_length = yes # # Unlike EAP-TLS, EAP-TTLS does not require a client # certificate. However, you can require one by setting the # following option. You can also override this option by # setting # # EAP-TLS-Require-Client-Cert = Yes # # in the control items for a request. # # Note that the majority of supplicants do not support using a # client certificate with EAP-TTLS, so this option is unlikely # to be usable for most people. # # require_client_cert = yes } ## EAP-PEAP # ################################################## # # !!!!! WARNINGS for Windows compatibility !!!!! # ################################################## # # If you see the server send an Access-Challenge, # and the client never sends another Access-Request, # then # # STOP! # # The server certificate has to have special OID's # in it, or else the Microsoft clients will silently # fail. See the "scripts/xpextensions" file for # details, and the following page: # # http://support.microsoft.com/kb/814394/en-us # # For additional Windows XP SP2 issues, see: # # http://support.microsoft.com/kb/885453/en-us # # # If is still doesn't work, and you're using Samba, # you may be encountering a Samba bug. See: # # https://bugzilla.samba.org/show_bug.cgi?id=6563 # # Note that we do not necessarily agree with their # explanation... but the fix does appear to work. # ################################################## # # The tunneled EAP session needs a default EAP type # which is separate from the one for the non-tunneled # EAP module. Inside of the TLS/PEAP tunnel, we # recommend using EAP-MS-CHAPv2. # peap { # Which tls-config section the TLS negotiation parameters # are in - see EAP-TLS above for an explanation. # # In the case that an old configuration from FreeRADIUS # v2.x is being used, all the options of the tls-config # section may also appear instead in the 'tls' section # above. If that is done, the tls= option here (and in # tls above) MUST be commented out. # tls = tls-common # The tunneled EAP session needs a default # EAP type which is separate from the one for # the non-tunneled EAP module. Inside of the # PEAP tunnel, we recommend using MS-CHAPv2, # as that is the default type supported by # Windows clients. # default_eap_type = mschapv2 # The PEAP module also has these configuration # items, which are the same as for TTLS. # copy_request_to_tunnel = no # # As of version 3.0.5, this configuration item # is deprecated. Instead, you should use # # update outer.session-state { # ... # # } # # This will cache attributes for the final Access-Accept. # use_tunneled_reply = no # When the tunneled session is proxied, the # home server may not understand EAP-MSCHAP-V2. # Set this entry to "no" to proxy the tunneled # EAP-MSCHAP-V2 as normal MSCHAPv2. # # proxy_tunneled_request_as_eap = yes # # The inner tunneled request can be sent # through a virtual server constructed # specifically for this purpose. # # If this entry is commented out, the inner # tunneled request will be sent through # the virtual server that processed the # outer requests. # virtual_server = "inner-tunnel" # This option enables support for MS-SoH # see doc/SoH.txt for more info. # It is disabled by default. # # soh = yes # # The SoH reply will be turned into a request which # can be sent to a specific virtual server: # # soh_virtual_server = "soh-server" # # Unlike EAP-TLS, PEAP does not require a client certificate. # However, you can require one by setting the following # option. You can also override this option by setting # # EAP-TLS-Require-Client-Cert = Yes # # in the control items for a request. # # Note that the majority of supplicants do not support using a # client certificate with PEAP, so this option is unlikely to # be usable for most people. # # require_client_cert = yes } # # This takes no configuration. # # Note that it is the EAP MS-CHAPv2 sub-module, not # the main 'mschap' module. # # Note also that in order for this sub-module to work, # the main 'mschap' module MUST ALSO be configured. # # This module is the *Microsoft* implementation of MS-CHAPv2 # in EAP. There is another (incompatible) implementation # of MS-CHAPv2 in EAP by Cisco, which FreeRADIUS does not # currently support. # mschapv2 { # Prior to version 2.1.11, the module never # sent the MS-CHAP-Error message to the # client. This worked, but it had issues # when the cached password was wrong. The # server *should* send "E=691 R=0" to the # client, which tells it to prompt the user # for a new password. # # The default is to behave as in 2.1.10 and # earlier, which is known to work. If you # set "send_error = yes", then the error # message will be sent back to the client. # This *may* help some clients work better, # but *may* also cause other clients to stop # working. # # send_error = no # Server identifier to send back in the challenge. # This should generally be the host name of the # RADIUS server. Or, some information to uniquely # identify it. # identity = "FreeRADIUS" } ## EAP-FAST # # The FAST module implements the EAP-FAST protocol # # fast { # Point to the common TLS configuration # # tls = tls-common # # If 'cipher_list' is set here, it will over-ride the # 'cipher_list' configuration from the 'tls-common' # configuration. The EAP-FAST module has it's own # over-ride for 'cipher_list' because the # specifications mandata a different set of ciphers # than are used by the other EAP methods. # # cipher_list though must include "ADH" for anonymous provisioning. # This is not as straight forward as appending "ADH" alongside # "DEFAULT" as "DEFAULT" contains "!aNULL" so instead it is # recommended "ALL:!EXPORT:!eNULL:!SSLv2" is used # # Note - for OpenSSL 1.1.0 and above you may need # to add ":@SECLEVEL=0" # # cipher_list = "ALL:!EXPORT:!eNULL:!SSLv2" # PAC lifetime in seconds (default: seven days) # # pac_lifetime = 604800 # Authority ID of the server # # if you are running a cluster of RADIUS servers, you should make # the value chosen here (and for "pac_opaque_key") the same on all # your RADIUS servers. This value should be unique to your # installation. We suggest using a domain name. # # authority_identity = "1234" # PAC Opaque encryption key (must be exactly 32 bytes in size) # # This value MUST be secret, and MUST be generated using # a secure method, such as via 'openssl rand -hex 32' # # pac_opaque_key = "PAC_KEY" # Same as for TTLS, PEAP, etc. # # virtual_server = inner-tunnel # } } root@local:/# freeradius -X FreeRADIUS Version 3.0.17 Copyright (C) 1999-2017 The FreeRADIUS server project and contributors There is NO warranty; not even for MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE You may redistribute copies of FreeRADIUS under the terms of the GNU General Public License For more information about these matters, see the file named COPYRIGHT Starting - reading configuration files ... including dictionary file /usr/share/freeradius/dictionary including dictionary file /usr/share/freeradius/dictionary.dhcp including dictionary file /usr/share/freeradius/dictionary.vqp including dictionary file /etc/freeradius/3.0/dictionary including configuration file /etc/freeradius/3.0/radiusd.conf including configuration file /etc/freeradius/3.0/proxy.conf including configuration file /etc/freeradius/3.0/clients.conf including files in directory /etc/freeradius/3.0/mods-enabled/ including configuration file /etc/freeradius/3.0/mods-enabled/files including configuration file /etc/freeradius/3.0/mods-enabled/attr_filter including configuration file /etc/freeradius/3.0/mods-enabled/unix including configuration file /etc/freeradius/3.0/mods-enabled/exec including configuration file /etc/freeradius/3.0/mods-enabled/sradutmp including configuration file /etc/freeradius/3.0/mods-enabled/logintime including configuration file /etc/freeradius/3.0/mods-enabled/sql including configuration file /etc/freeradius/3.0/mods-config/sql/main/mysql/queries.conf including configuration file /etc/freeradius/3.0/mods-enabled/replicate including configuration file /etc/freeradius/3.0/mods-enabled/mschap including configuration file /etc/freeradius/3.0/mods-enabled/echo including configuration file /etc/freeradius/3.0/mods-enabled/chap including configuration file /etc/freeradius/3.0/mods-enabled/realm including configuration file /etc/freeradius/3.0/mods-enabled/soh including configuration file /etc/freeradius/3.0/mods-enabled/detail including configuration file /etc/freeradius/3.0/mods-enabled/digest including configuration file /etc/freeradius/3.0/mods-enabled/preprocess including configuration file /etc/freeradius/3.0/mods-enabled/utf8 including configuration file /etc/freeradius/3.0/mods-enabled/always including configuration file /etc/freeradius/3.0/mods-enabled/pap including configuration file /etc/freeradius/3.0/mods-enabled/linelog including configuration file /etc/freeradius/3.0/mods-enabled/expr including configuration file /etc/freeradius/3.0/mods-enabled/expiration including configuration file /etc/freeradius/3.0/mods-enabled/eap including configuration file /etc/freeradius/3.0/mods-enabled/passwd including configuration file /etc/freeradius/3.0/mods-enabled/unpack including configuration file /etc/freeradius/3.0/mods-enabled/radutmp including configuration file /etc/freeradius/3.0/mods-enabled/dynamic_clients including configuration file /etc/freeradius/3.0/mods-enabled/cache_eap including configuration file /etc/freeradius/3.0/mods-enabled/detail.log including configuration file /etc/freeradius/3.0/mods-enabled/ntlm_auth including files in directory /etc/freeradius/3.0/policy.d/ including configuration file /etc/freeradius/3.0/policy.d/control including configuration file /etc/freeradius/3.0/policy.d/operator-name including configuration file /etc/freeradius/3.0/policy.d/accounting including configuration file /etc/freeradius/3.0/policy.d/dhcp including configuration file /etc/freeradius/3.0/policy.d/filter including configuration file /etc/freeradius/3.0/policy.d/abfab-tr including configuration file /etc/freeradius/3.0/policy.d/canonicalization including configuration file /etc/freeradius/3.0/policy.d/eap including configuration file /etc/freeradius/3.0/policy.d/moonshot-targeted-ids including configuration file /etc/freeradius/3.0/policy.d/debug including configuration file /etc/freeradius/3.0/policy.d/cui including files in directory /etc/freeradius/3.0/sites-enabled/ including configuration file /etc/freeradius/3.0/sites-enabled/inner-tunnel including configuration file /etc/freeradius/3.0/sites-enabled/default main { security { user = "freerad" group = "freerad" allow_core_dumps = no } name = "freeradius" prefix = "/usr" localstatedir = "/var" logdir = "/var/log/freeradius" run_dir = "/var/run/freeradius" } main { name = "freeradius" prefix = "/usr" localstatedir = "/var" sbindir = "/usr/sbin" logdir = "/var/log/freeradius" run_dir = "/var/run/freeradius" libdir = "/usr/lib/freeradius" radacctdir = "/var/log/freeradius/radacct" hostname_lookups = no max_request_time = 30 cleanup_delay = 5 max_requests = 16384 pidfile = "/var/run/freeradius/freeradius.pid" checkrad = "/usr/sbin/checkrad" debug_level = 0 proxy_requests = yes log { stripped_names = no auth = no auth_badpass = no auth_goodpass = no colourise = yes msg_denied = "You are already logged in - access denied" } resources { } security { max_attributes = 200 reject_delay = 1.000000 status_server = yes } } radiusd: #### Loading Realms and Home Servers #### proxy server { retry_delay = 5 retry_count = 3 default_fallback = no dead_time = 120 wake_all_if_all_dead = no } home_server localhost { ipaddr = 127.0.0.1 port = 1812 type = "auth" secret = <<< secret >>> response_window = 20.000000 response_timeouts = 1 max_outstanding = 65536 zombie_period = 40 status_check = "status-server" ping_interval = 30 check_interval = 30 check_timeout = 4 num_answers_to_alive = 3 revive_interval = 120 limit { max_connections = 16 max_requests = 0 lifetime = 0 idle_timeout = 0 } coa { irt = 2 mrt = 16 mrc = 5 mrd = 30 } } home_server_pool my_auth_failover { type = fail-over home_server = localhost } realm example.com { auth_pool = my_auth_failover } realm LOCAL { } radiusd: #### Loading Clients #### client localhost { ipaddr = 127.0.0.1 require_message_authenticator = no secret = <<< secret >>> nas_type = "other" proto = "*" limit { max_connections = 16 lifetime = 0 idle_timeout = 30 } } Debugger not attached # Creating Auth-Type = mschap # Creating Auth-Type = eap # Creating Auth-Type = PAP # Creating Auth-Type = CHAP # Creating Auth-Type = MS-CHAP # Creating Auth-Type = digest radiusd: #### Instantiating modules #### modules { # Loaded module rlm_files # Loading module "files" from file /etc/freeradius/3.0/mods-enabled/files files { filename = "/etc/freeradius/3.0/mods-config/files/authorize" acctusersfile = "/etc/freeradius/3.0/mods-config/files/accounting" preproxy_usersfile = "/etc/freeradius/3.0/mods-config/files/pre-proxy" } # Loaded module rlm_attr_filter # Loading module "attr_filter.post-proxy" from file /etc/freeradius/3.0/mods-enabled/attr_filter attr_filter attr_filter.post-proxy { filename = "/etc/freeradius/3.0/mods-config/attr_filter/post-proxy" key = "%{Realm}" relaxed = no } # Loading module "attr_filter.pre-proxy" from file /etc/freeradius/3.0/mods-enabled/attr_filter attr_filter attr_filter.pre-proxy { filename = "/etc/freeradius/3.0/mods-config/attr_filter/pre-proxy" key = "%{Realm}" relaxed = no } # Loading module "attr_filter.access_reject" from file /etc/freeradius/3.0/mods-enabled/attr_filter attr_filter attr_filter.access_reject { filename = "/etc/freeradius/3.0/mods-config/attr_filter/access_reject" key = "%{User-Name}" relaxed = no } # Loading module "attr_filter.access_challenge" from file /etc/freeradius/3.0/mods-enabled/attr_filter attr_filter attr_filter.access_challenge { filename = "/etc/freeradius/3.0/mods-config/attr_filter/access_challenge" key = "%{User-Name}" relaxed = no } # Loading module "attr_filter.accounting_response" from file /etc/freeradius/3.0/mods-enabled/attr_filter attr_filter attr_filter.accounting_response { filename = "/etc/freeradius/3.0/mods-config/attr_filter/accounting_response" key = "%{User-Name}" relaxed = no } # Loaded module rlm_unix # Loading module "unix" from file /etc/freeradius/3.0/mods-enabled/unix unix { radwtmp = "/var/log/freeradius/radwtmp" } Creating attribute Unix-Group # Loaded module rlm_exec # Loading module "exec" from file /etc/freeradius/3.0/mods-enabled/exec exec { wait = no input_pairs = "request" shell_escape = yes timeout = 10 } # Loaded module rlm_radutmp # Loading module "sradutmp" from file /etc/freeradius/3.0/mods-enabled/sradutmp radutmp sradutmp { filename = "/var/log/freeradius/sradutmp" username = "%{User-Name}" case_sensitive = yes check_with_nas = yes permissions = 420 caller_id = no } # Loaded module rlm_logintime # Loading module "logintime" from file /etc/freeradius/3.0/mods-enabled/logintime logintime { minimum_timeout = 60 } # Loaded module rlm_sql # Loading module "sql" from file /etc/freeradius/3.0/mods-enabled/sql sql { driver = "rlm_sql_mysql" server = "localhost" port = 3306 login = "radius" password = <<< secret >>> radius_db = "radius" read_groups = yes read_profiles = yes read_clients = yes delete_stale_sessions = yes sql_user_name = "%{User-Name}" default_user_profile = "" client_query = "SELECT id, nasname, shortname, type, secret, server FROM nas" authorize_check_query = "SELECT id, username, attribute, value, op FROM radcheck WHERE username = '%{SQL-User-Name}' ORDER BY id" authorize_reply_query = "SELECT id, username, attribute, value, op FROM radreply WHERE username = '%{SQL-User-Name}' ORDER BY id" authorize_group_check_query = "SELECT id, groupname, attribute, Value, op FROM radgroupcheck WHERE groupname = '%{SQL-Group}' ORDER BY id" authorize_group_reply_query = "SELECT id, groupname, attribute, value, op FROM radgroupreply WHERE groupname = '%{SQL-Group}' ORDER BY id" group_membership_query = "SELECT groupname FROM radusergroup WHERE username = '%{SQL-User-Name}' ORDER BY priority" simul_count_query = "SELECT COUNT(*) FROM radacct WHERE username = '%{SQL-User-Name}' AND acctstoptime IS NULL" simul_verify_query = "SELECT radacctid, acctsessionid, username, nasipaddress, nasportid, framedipaddress, callingstationid, framedprotocol FROM radacct WHERE username = '%{SQL-User-Name}' AND acctstoptime IS NULL" safe_characters = "@abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ0123456789.-_: /" accounting { reference = "%{tolower:type.%{Acct-Status-Type}.query}" type { accounting-on { query = "UPDATE radacct SET acctstoptime = FROM_UNIXTIME(%{integer:Event-Timestamp}), acctsessiontime = '%{integer:Event-Timestamp}' - UNIX_TIMESTAMP(acctstarttime), acctterminatecause = '%{%{Acct-Terminate-Cause}:-NAS-Reboot}' WHERE acctstoptime IS NULL AND nasipaddress = '%{NAS-IP-Address}' AND acctstarttime <= FROM_UNIXTIME(%{integer:Event-Timestamp})" } accounting-off { query = "UPDATE radacct SET acctstoptime = FROM_UNIXTIME(%{integer:Event-Timestamp}), acctsessiontime = '%{integer:Event-Timestamp}' - UNIX_TIMESTAMP(acctstarttime), acctterminatecause = '%{%{Acct-Terminate-Cause}:-NAS-Reboot}' WHERE acctstoptime IS NULL AND nasipaddress = '%{NAS-IP-Address}' AND acctstarttime <= FROM_UNIXTIME(%{integer:Event-Timestamp})" } start { query = "INSERT INTO radacct (acctsessionid, acctuniqueid, username, realm, nasipaddress, nasportid, nasporttype, acctstarttime, acctupdatetime, acctstoptime, acctsessiontime, acctauthentic, connectinfo_start, connectinfo_stop, acctinputoctets, acctoutputoctets, calledstationid, callingstationid, acctterminatecause, servicetype, framedprotocol, framedipaddress) VALUES ('%{Acct-Session-Id}', '%{Acct-Unique-Session-Id}', '%{SQL-User-Name}', '%{Realm}', '%{NAS-IP-Address}', '%{%{NAS-Port-ID}:-%{NAS-Port}}', '%{NAS-Port-Type}', FROM_UNIXTIME(%{integer:Event-Timestamp}), FROM_UNIXTIME(%{integer:Event-Timestamp}), NULL, '0', '%{Acct-Authentic}', '%{Connect-Info}', '', '0', '0', '%{Called-Station-Id}', '%{Calling-Station-Id}', '', '%{Service-Type}', '%{Framed-Protocol}', '%{Framed-IP-Address}')" } interim-update { query = "UPDATE radacct SET acctupdatetime = (@acctupdatetime_old:=acctupdatetime), acctupdatetime = FROM_UNIXTIME(%{integer:Event-Timestamp}), acctinterval = %{integer:Event-Timestamp} - UNIX_TIMESTAMP(@acctupdatetime_old), framedipaddress = '%{Framed-IP-Address}', acctsessiontime = %{%{Acct-Session-Time}:-NULL}, acctinputoctets = '%{%{Acct-Input-Gigawords}:-0}' << 32 | '%{%{Acct-Input-Octets}:-0}', acctoutputoctets = '%{%{Acct-Output-Gigawords}:-0}' << 32 | '%{%{Acct-Output-Octets}:-0}' WHERE AcctUniqueId = '%{Acct-Unique-Session-Id}'" } stop { query = "UPDATE radacct SET acctstoptime = FROM_UNIXTIME(%{integer:Event-Timestamp}), acctsessiontime = %{%{Acct-Session-Time}:-NULL}, acctinputoctets = '%{%{Acct-Input-Gigawords}:-0}' << 32 | '%{%{Acct-Input-Octets}:-0}', acctoutputoctets = '%{%{Acct-Output-Gigawords}:-0}' << 32 | '%{%{Acct-Output-Octets}:-0}', acctterminatecause = '%{Acct-Terminate-Cause}', connectinfo_stop = '%{Connect-Info}' WHERE AcctUniqueId = '%{Acct-Unique-Session-Id}'" } } } post-auth { reference = ".query" query = "INSERT INTO radpostauth (username, pass, reply, authdate) VALUES ( '%{SQL-User-Name}', '%{%{User-Password}:-%{Chap-Password}}', '%{reply:Packet-Type}', '%S')" } } rlm_sql (sql): Driver rlm_sql_mysql (module rlm_sql_mysql) loaded and linked Creating attribute SQL-Group # Loaded module rlm_replicate # Loading module "replicate" from file /etc/freeradius/3.0/mods-enabled/replicate # Loaded module rlm_mschap # Loading module "mschap" from file /etc/freeradius/3.0/mods-enabled/mschap mschap { use_mppe = yes require_encryption = no require_strong = no with_ntdomain_hack = yes passchange { } allow_retry = yes winbind_retry_with_normalised_username = no } # Loading module "echo" from file /etc/freeradius/3.0/mods-enabled/echo exec echo { wait = yes program = "/bin/echo %{User-Name}" input_pairs = "request" output_pairs = "reply" shell_escape = yes } # Loaded module rlm_chap # Loading module "chap" from file /etc/freeradius/3.0/mods-enabled/chap # Loaded module rlm_realm # Loading module "IPASS" from file /etc/freeradius/3.0/mods-enabled/realm realm IPASS { format = "prefix" delimiter = "/" ignore_default = no ignore_null = no } # Loading module "suffix" from file /etc/freeradius/3.0/mods-enabled/realm realm suffix { format = "suffix" delimiter = "@" ignore_default = no ignore_null = no } # Loading module "realmpercent" from file /etc/freeradius/3.0/mods-enabled/realm realm realmpercent { format = "suffix" delimiter = "%" ignore_default = no ignore_null = no } # Loading module "ntdomain" from file /etc/freeradius/3.0/mods-enabled/realm realm ntdomain { format = "prefix" delimiter = "\\" ignore_default = no ignore_null = no } # Loaded module rlm_soh # Loading module "soh" from file /etc/freeradius/3.0/mods-enabled/soh soh { dhcp = yes } # Loaded module rlm_detail # Loading module "detail" from file /etc/freeradius/3.0/mods-enabled/detail detail { filename = "/var/log/freeradius/radacct/%{%{Packet-Src-IP-Address}:-%{Packet-Src-IPv6-Address}}/detail-%Y%m%d" header = "%t" permissions = 384 locking = no escape_filenames = no log_packet_header = no } # Loaded module rlm_digest # Loading module "digest" from file /etc/freeradius/3.0/mods-enabled/digest # Loaded module rlm_preprocess # Loading module "preprocess" from file /etc/freeradius/3.0/mods-enabled/preprocess preprocess { huntgroups = "/etc/freeradius/3.0/mods-config/preprocess/huntgroups" hints = "/etc/freeradius/3.0/mods-config/preprocess/hints" with_ascend_hack = no ascend_channels_per_line = 23 with_ntdomain_hack = no with_specialix_jetstream_hack = no with_cisco_vsa_hack = no with_alvarion_vsa_hack = no } # Loaded module rlm_utf8 # Loading module "utf8" from file /etc/freeradius/3.0/mods-enabled/utf8 # Loaded module rlm_always # Loading module "reject" from file /etc/freeradius/3.0/mods-enabled/always always reject { rcode = "reject" simulcount = 0 mpp = no } # Loading module "fail" from file /etc/freeradius/3.0/mods-enabled/always always fail { rcode = "fail" simulcount = 0 mpp = no } # Loading module "ok" from file /etc/freeradius/3.0/mods-enabled/always always ok { rcode = "ok" simulcount = 0 mpp = no } # Loading module "handled" from file /etc/freeradius/3.0/mods-enabled/always always handled { rcode = "handled" simulcount = 0 mpp = no } # Loading module "invalid" from file /etc/freeradius/3.0/mods-enabled/always always invalid { rcode = "invalid" simulcount = 0 mpp = no } # Loading module "userlock" from file /etc/freeradius/3.0/mods-enabled/always always userlock { rcode = "userlock" simulcount = 0 mpp = no } # Loading module "notfound" from file /etc/freeradius/3.0/mods-enabled/always always notfound { rcode = "notfound" simulcount = 0 mpp = no } # Loading module "noop" from file /etc/freeradius/3.0/mods-enabled/always always noop { rcode = "noop" simulcount = 0 mpp = no } # Loading module "updated" from file /etc/freeradius/3.0/mods-enabled/always always updated { rcode = "updated" simulcount = 0 mpp = no } # Loaded module rlm_pap # Loading module "pap" from file /etc/freeradius/3.0/mods-enabled/pap pap { normalise = yes } # Loaded module rlm_linelog # Loading module "linelog" from file /etc/freeradius/3.0/mods-enabled/linelog linelog { filename = "/var/log/freeradius/linelog" escape_filenames = no syslog_severity = "info" permissions = 384 format = "This is a log message for %{User-Name}" reference = "messages.%{%{reply:Packet-Type}:-default}" } # Loading module "log_accounting" from file /etc/freeradius/3.0/mods-enabled/linelog linelog log_accounting { filename = "/var/log/freeradius/linelog-accounting" escape_filenames = no syslog_severity = "info" permissions = 384 format = "" reference = "Accounting-Request.%{%{Acct-Status-Type}:-unknown}" } # Loaded module rlm_expr # Loading module "expr" from file /etc/freeradius/3.0/mods-enabled/expr expr { safe_characters = "@abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ0123456789.-_: /äéöüàâæçèéêëîïôoeùûüaÿÄÉÖÜßÀÂÆÇÈÉÊËÎÏÔOEÙÛÜY" } # Loaded module rlm_expiration # Loading module "expiration" from file /etc/freeradius/3.0/mods-enabled/expiration # Loaded module rlm_eap # Loading module "eap" from file /etc/freeradius/3.0/mods-enabled/eap eap { default_eap_type = "md5" timer_expire = 60 ignore_unknown_eap_types = no cisco_accounting_username_bug = no max_sessions = 16384 } # Loaded module rlm_passwd # Loading module "etc_passwd" from file /etc/freeradius/3.0/mods-enabled/passwd passwd etc_passwd { filename = "/etc/passwd" format = "*User-Name:Crypt-Password:" delimiter = ":" ignore_nislike = no ignore_empty = yes allow_multiple_keys = no hash_size = 100 } # Loaded module rlm_unpack # Loading module "unpack" from file /etc/freeradius/3.0/mods-enabled/unpack # Loading module "radutmp" from file /etc/freeradius/3.0/mods-enabled/radutmp radutmp { filename = "/var/log/freeradius/radutmp" username = "%{User-Name}" case_sensitive = yes check_with_nas = yes permissions = 384 caller_id = yes } # Loaded module rlm_dynamic_clients # Loading module "dynamic_clients" from file /etc/freeradius/3.0/mods-enabled/dynamic_clients # Loaded module rlm_cache # Loading module "cache_eap" from file /etc/freeradius/3.0/mods-enabled/cache_eap cache cache_eap { driver = "rlm_cache_rbtree" key = "%{%{control:State}:-%{%{reply:State}:-%{State}}}" ttl = 15 max_entries = 0 epoch = 0 add_stats = no } # Loading module "auth_log" from file /etc/freeradius/3.0/mods-enabled/detail.log detail auth_log { filename = "/var/log/freeradius/radacct/%{%{Packet-Src-IP-Address}:-%{Packet-Src-IPv6-Address}}/auth-detail-%Y%m%d" header = "%t" permissions = 384 locking = no escape_filenames = no log_packet_header = no } # Loading module "reply_log" from file /etc/freeradius/3.0/mods-enabled/detail.log detail reply_log { filename = "/var/log/freeradius/radacct/%{%{Packet-Src-IP-Address}:-%{Packet-Src-IPv6-Address}}/reply-detail-%Y%m%d" header = "%t" permissions = 384 locking = no escape_filenames = no log_packet_header = no } # Loading module "pre_proxy_log" from file /etc/freeradius/3.0/mods-enabled/detail.log detail pre_proxy_log { filename = "/var/log/freeradius/radacct/%{%{Packet-Src-IP-Address}:-%{Packet-Src-IPv6-Address}}/pre-proxy-detail-%Y%m%d" header = "%t" permissions = 384 locking = no escape_filenames = no log_packet_header = no } # Loading module "post_proxy_log" from file /etc/freeradius/3.0/mods-enabled/detail.log detail post_proxy_log { filename = "/var/log/freeradius/radacct/%{%{Packet-Src-IP-Address}:-%{Packet-Src-IPv6-Address}}/post-proxy-detail-%Y%m%d" header = "%t" permissions = 384 locking = no escape_filenames = no log_packet_header = no } # Loading module "ntlm_auth" from file /etc/freeradius/3.0/mods-enabled/ntlm_auth exec ntlm_auth { wait = yes program = "/path/to/ntlm_auth --request-nt-key --domain=MYDOMAIN --username=%{mschap:User-Name} --password=%{User-Password}" shell_escape = yes } instantiate { } # Instantiating module "files" from file /etc/freeradius/3.0/mods-enabled/files reading pairlist file /etc/freeradius/3.0/mods-config/files/authorize reading pairlist file /etc/freeradius/3.0/mods-config/files/accounting reading pairlist file /etc/freeradius/3.0/mods-config/files/pre-proxy # Instantiating module "attr_filter.post-proxy" from file /etc/freeradius/3.0/mods-enabled/attr_filter reading pairlist file /etc/freeradius/3.0/mods-config/attr_filter/post-proxy # Instantiating module "attr_filter.pre-proxy" from file /etc/freeradius/3.0/mods-enabled/attr_filter reading pairlist file /etc/freeradius/3.0/mods-config/attr_filter/pre-proxy # Instantiating module "attr_filter.access_reject" from file /etc/freeradius/3.0/mods-enabled/attr_filter reading pairlist file /etc/freeradius/3.0/mods-config/attr_filter/access_reject [/etc/freeradius/3.0/mods-config/attr_filter/access_reject]:11 Check item "FreeRADIUS-Response-Delay" found in filter list for realm "DEFAULT". [/etc/freeradius/3.0/mods-config/attr_filter/access_reject]:11 Check item "FreeRADIUS-Response-Delay-USec" found in filter list for realm "DEFAULT". # Instantiating module "attr_filter.access_challenge" from file /etc/freeradius/3.0/mods-enabled/attr_filter reading pairlist file /etc/freeradius/3.0/mods-config/attr_filter/access_challenge # Instantiating module "attr_filter.accounting_response" from file /etc/freeradius/3.0/mods-enabled/attr_filter reading pairlist file /etc/freeradius/3.0/mods-config/attr_filter/accounting_response # Instantiating module "logintime" from file /etc/freeradius/3.0/mods-enabled/logintime # Instantiating module "sql" from file /etc/freeradius/3.0/mods-enabled/sql rlm_sql_mysql: libmysql version: 10.3.15 mysql { tls { } warnings = "auto" } rlm_sql (sql): Attempting to connect to database "radius" rlm_sql (sql): Initialising connection pool pool { start = 5 min = 3 max = 32 spare = 10 uses = 0 lifetime = 0 cleanup_interval = 30 idle_timeout = 60 retry_delay = 30 spread = no } rlm_sql (sql): Opening additional connection (0), 1 of 32 pending slots used rlm_sql_mysql: Starting connect to MySQL server rlm_sql_mysql: Connected to database 'radius' on Localhost via UNIX socket, server version 10.3.15-MariaDB-1, protocol version 10 rlm_sql (sql): Opening additional connection (1), 1 of 31 pending slots used rlm_sql_mysql: Starting connect to MySQL server rlm_sql_mysql: Connected to database 'radius' on Localhost via UNIX socket, server version 10.3.15-MariaDB-1, protocol version 10 rlm_sql (sql): Opening additional connection (2), 1 of 30 pending slots used rlm_sql_mysql: Starting connect to MySQL server rlm_sql_mysql: Connected to database 'radius' on Localhost via UNIX socket, server version 10.3.15-MariaDB-1, protocol version 10 rlm_sql (sql): Opening additional connection (3), 1 of 29 pending slots used rlm_sql_mysql: Starting connect to MySQL server rlm_sql_mysql: Connected to database 'radius' on Localhost via UNIX socket, server version 10.3.15-MariaDB-1, protocol version 10 rlm_sql (sql): Opening additional connection (4), 1 of 28 pending slots used rlm_sql_mysql: Starting connect to MySQL server rlm_sql_mysql: Connected to database 'radius' on Localhost via UNIX socket, server version 10.3.15-MariaDB-1, protocol version 10 rlm_sql (sql): Processing generate_sql_clients rlm_sql (sql) in generate_sql_clients: query is SELECT id, nasname, shortname, type, secret, server FROM nas rlm_sql (sql): Reserved connection (0) rlm_sql (sql): Executing select query: SELECT id, nasname, shortname, type, secret, server FROM nas rlm_sql (sql): Adding client 192.168.0.0/16 (myNAS) to global clients list rlm_sql (192.168.0.0): Client "myNAS" (sql) added rlm_sql (sql): Released connection (0) Need 5 more connections to reach 10 spares rlm_sql (sql): Opening additional connection (5), 1 of 27 pending slots used rlm_sql_mysql: Starting connect to MySQL server rlm_sql_mysql: Connected to database 'radius' on Localhost via UNIX socket, server version 10.3.15-MariaDB-1, protocol version 10 # Instantiating module "mschap" from file /etc/freeradius/3.0/mods-enabled/mschap rlm_mschap (mschap): using internal authentication # Instantiating module "IPASS" from file /etc/freeradius/3.0/mods-enabled/realm # Instantiating module "suffix" from file /etc/freeradius/3.0/mods-enabled/realm # Instantiating module "realmpercent" from file /etc/freeradius/3.0/mods-enabled/realm # Instantiating module "ntdomain" from file /etc/freeradius/3.0/mods-enabled/realm # Instantiating module "detail" from file /etc/freeradius/3.0/mods-enabled/detail # Instantiating module "preprocess" from file /etc/freeradius/3.0/mods-enabled/preprocess reading pairlist file /etc/freeradius/3.0/mods-config/preprocess/huntgroups reading pairlist file /etc/freeradius/3.0/mods-config/preprocess/hints # Instantiating module "reject" from file /etc/freeradius/3.0/mods-enabled/always # Instantiating module "fail" from file /etc/freeradius/3.0/mods-enabled/always # Instantiating module "ok" from file /etc/freeradius/3.0/mods-enabled/always # Instantiating module "handled" from file /etc/freeradius/3.0/mods-enabled/always # Instantiating module "invalid" from file /etc/freeradius/3.0/mods-enabled/always # Instantiating module "userlock" from file /etc/freeradius/3.0/mods-enabled/always # Instantiating module "notfound" from file /etc/freeradius/3.0/mods-enabled/always # Instantiating module "noop" from file /etc/freeradius/3.0/mods-enabled/always # Instantiating module "updated" from file /etc/freeradius/3.0/mods-enabled/always # Instantiating module "pap" from file /etc/freeradius/3.0/mods-enabled/pap # Instantiating module "linelog" from file /etc/freeradius/3.0/mods-enabled/linelog # Instantiating module "log_accounting" from file /etc/freeradius/3.0/mods-enabled/linelog # Instantiating module "expiration" from file /etc/freeradius/3.0/mods-enabled/expiration # Instantiating module "eap" from file /etc/freeradius/3.0/mods-enabled/eap # Linked to sub-module rlm_eap_md5 # Linked to sub-module rlm_eap_leap # Linked to sub-module rlm_eap_gtc gtc { challenge = "Password: " auth_type = "PAP" } # Linked to sub-module rlm_eap_tls tls { tls = "tls-common" } tls-config tls-common { verify_depth = 0 ca_path = "/etc/freeradius/3.0/certs" pem_file_type = yes private_key_file = "/etc/ssl/private/private.key" certificate_file = "/etc/ssl/certs/server.crt" ca_file = "/etc/ssl/certs/usertrust_and_addtrust_combined.crt" private_key_password = <<< secret >>> dh_file = "/etc/freeradius/3.0/certs/dh" fragment_size = 1024 include_length = yes auto_chain = yes check_crl = no check_all_crl = no cipher_list = "DEFAULT" cipher_server_preference = no ecdh_curve = "prime256v1" tls_max_version = "" tls_min_version = "1.0" cache { enable = no lifetime = 24 max_entries = 255 } verify { skip_if_ocsp_ok = no } ocsp { enable = no override_cert_url = yes url = "http://127.0.0.1/ocsp/" use_nonce = yes timeout = 0 softfail = no } } # Linked to sub-module rlm_eap_ttls ttls { tls = "tls-common" default_eap_type = "md5" copy_request_to_tunnel = no use_tunneled_reply = yes virtual_server = "inner-tunnel" include_length = yes require_client_cert = no } tls: Using cached TLS configuration from previous invocation # Linked to sub-module rlm_eap_peap peap { tls = "tls-common" default_eap_type = "mschapv2" copy_request_to_tunnel = no use_tunneled_reply = no proxy_tunneled_request_as_eap = yes virtual_server = "inner-tunnel" soh = no require_client_cert = no } tls: Using cached TLS configuration from previous invocation # Linked to sub-module rlm_eap_mschapv2 mschapv2 { with_ntdomain_hack = no send_error = no } # Instantiating module "etc_passwd" from file /etc/freeradius/3.0/mods-enabled/passwd rlm_passwd: nfields: 3 keyfield 0(User-Name) listable: no # Instantiating module "cache_eap" from file /etc/freeradius/3.0/mods-enabled/cache_eap rlm_cache (cache_eap): Driver rlm_cache_rbtree (module rlm_cache_rbtree) loaded and linked # Instantiating module "auth_log" from file /etc/freeradius/3.0/mods-enabled/detail.log rlm_detail (auth_log): 'User-Password' suppressed, will not appear in detail output # Instantiating module "reply_log" from file /etc/freeradius/3.0/mods-enabled/detail.log # Instantiating module "pre_proxy_log" from file /etc/freeradius/3.0/mods-enabled/detail.log # Instantiating module "post_proxy_log" from file /etc/freeradius/3.0/mods-enabled/detail.log } # modules radiusd: #### Loading Virtual Servers #### server { # from file /etc/freeradius/3.0/radiusd.conf } # server server inner-tunnel { # from file /etc/freeradius/3.0/sites-enabled/inner-tunnel # Loading authenticate {...} # Loading authorize {...} Ignoring "ldap" (see raddb/mods-available/README.rst) # Loading session {...} # Loading post-proxy {...} # Loading post-auth {...} } # server inner-tunnel server default { # from file /etc/freeradius/3.0/sites-enabled/default # Loading authenticate {...} # Loading authorize {...} # Loading preacct {...} # Loading accounting {...} # Loading post-proxy {...} # Loading post-auth {...} } # server default radiusd: #### Opening IP addresses and Ports #### listen { type = "auth" ipaddr = 127.0.0.1 port = 18120 } listen { type = "auth" ipaddr = * port = 0 limit { max_connections = 16 lifetime = 0 idle_timeout = 30 } } listen { type = "acct" ipaddr = * port = 0 limit { max_connections = 16 lifetime = 0 idle_timeout = 30 } } listen { type = "auth" ipv6addr = :: port = 0 limit { max_connections = 16 lifetime = 0 idle_timeout = 30 } } listen { type = "acct" ipv6addr = :: port = 0 limit { max_connections = 16 lifetime = 0 idle_timeout = 30 } } Listening on auth address 127.0.0.1 port 18120 bound to server inner-tunnel Listening on auth address * port 1812 bound to server default Listening on acct address * port 1813 bound to server default Listening on auth address :: port 1812 bound to server default Listening on acct address :: port 1813 bound to server default Listening on proxy address * port 49830 Listening on proxy address :: port 50519 Ready to process requests

2 1

couldn't reconnect to the home server
by Prem Khanal 24 Sep '19

24 Sep '19

Hi All, I have configured freeradius 3.0.19 as proxy server which forwards radius accounting packets to specific home servers based on NAS IP. The problem I am having is once the connectivity to the home server goes down, the radius proxy can not reestablish the connection to the home server. If I delete detail and detail.work files and restart the freeradius service everything starts working well. I was wondering if I am missing something in configuration that is causing this problem. Here is the log detail (/var/log/freeradius/radacct/detail): Read packet from /var/log/freeradius/radacct/detail.work Acct-Session-Id = "5D8840F4-8E040D01" Framed-IP-Address = 192.168.0.1 Acct-Multi-Session-Id = "3087d99a131824da33a490c45d8840f5000d" Acct-Link-Count = 1 Acct-Status-Type = Interim-Update Acct-Authentic = RADIUS User-Name = "abcd(a)abcd.co.nz" NAS-IP-Address = 10.0.0.10 NAS-Identifier = "30-8D-D9-9D-13-18" NAS-Port = 1 Called-Station-Id = "30-8D-D9-9D-13-18:ABC" Calling-Station-Id = "24-DD-33-44-90-CA" NAS-Port-Type = Wireless-802.11 Connect-Info = "CONNECT 802.11b/g/n" Event-Timestamp = "Sep 23 2019 16:15:14 NZST" Class = 0x436f6e74656e7446696c7465722d4a6e7253747564656e74 Ruckus-SSID = "ABC" Ruckus-BSSID = 0x308dd99d1318 Ruckus-VLAN-ID = 999 Ruckus-SCG-CBlade-IP = 167837962 Ruckus-SCG-DBlade-IP = 167838210 Acct-Input-Packets = 41552 Acct-Output-Packets = 100454 Acct-Input-Octets = 3768396 Acct-Output-Octets = 130474153 Ruckus-Sta-RSSI = 50 Acct-Session-Time = 1500 Proxy-State = 0x3338 Huntgroup-Name = "NEWFortigateRealm" SQL-User-Name = "abcd(a)abcd.co.nz" Tmp-String-9 = "ai:" Acct-Unique-Session-Id = "58e58a8fd7fbccadf08241d278e4d940" Packet-Original-Timestamp = "Sep 23 2019 16:16:32 NZST" Acct-Delay-Time = 65240 Packet-Transmit-Counter = 2172 (38207) # Executing section preacct from file /etc/freeradius/3.0/sites-enabled/copy-acct-to-home-server (38207) preacct { (38207) [preprocess] = ok (38207) if (request:User-Name =~ /@/){ (38207) if (request:User-Name =~ /@/) -> TRUE (38207) if (request:User-Name =~ /@/) { (38207) if (request:Huntgroup-Name != ''){ (38207) if (request:Huntgroup-Name != '') -> TRUE (38207) if (request:Huntgroup-Name != '') { (38207) update control { (38207) Proxy-To-Realm := request:Huntgroup-Name -> 'NEWFortigateRealm' (38207) } # update control = noop (38207) } # if (request:Huntgroup-Name != '') = noop (38207) } # if (request:User-Name =~ /@/) = noop (38207) } # preacct = ok (38207) # Executing section accounting from file /etc/freeradius/3.0/sites-enabled/copy-acct-to-home-server (38207) accounting { (38207) [ok] = ok (38207) } # accounting = ok (38207) ERROR: Failed to find live home server: Cancelling proxy (38207) WARNING: No home server selected (38207) Clearing existing &reply: attributes (38207) Found Post-Proxy-Type Fail-Accounting (38207) Post-Proxy-Type sub-section not found. Ignoring. (38207) detail (/var/log/freeradius/radacct/detail): No response to request. Will retry in 30 seconds (38207) Finished request (38207) Cleaning up request packet ID 23 with timestamp +339624 Waking up in 6.1 seconds. No response to status check 38206 ID 139 for home server xx.xx.xx.xx port 1813 Waking up in 1.5 seconds. PING: Waiting 10 seconds for response to ping (38208) Sent Status-Server Id 97 from 0.0.0.0:49764 to xx.xx.xx.xx:1813 length 0 (38208) Message-Authenticator := 0x00 (38208) NAS-Identifier := "Status Check 6430. Are you alive?" PING: Next status packet in 10 seconds Waking up in 9.5 seconds. PING: Waiting 10 seconds for response to ping (38209) Sent Status-Server Id 119 from 0.0.0.0:49764 to xx.xx.xx.xx:1813 length 0 (38209) Message-Authenticator := 0x00 (38209) NAS-Identifier := "Status Check 6431. Are you alive?" PING: Next status packet in 10 seconds Waking up in 0.4 seconds. No response to status check 38208 ID 97 for home server 210.55.219.165 port 1813 Waking up in 9.5 seconds. -- Kind Regards Prem

2 1

Virtual Servers on 127.0.0.2
by Matthew Schumacher 23 Sep '19

23 Sep '19

I must be missing something. I'm building some monitoring to test various virtual servers with: client 127.0.0.1 { secret = testing virtual_server = serverA } client 127.0.0.2 { secret = testing virtual_server = serverB } But when I use radtest, only serverA responds regardless of which address I use. I can see in tcpdump the packet is sourced from the alternate IP. In the logs, I see: (9) Received Access-Request Id 182 from 127.0.0.1:33603 to 127.0.0.2:1812 length 80 So the server knows the correct address, but then later down: (9) Login OK: [testuser] (from client 127.0.0.1 port 1) (9) Sent Access-Accept Id 182 from 127.0.0.2:1812 to 127.0.0.1:33603 length 0 It seems radiusd aggregates these addresses. Is this by design? Thanks, schu

3 5

test
by Alan DeKok 20 Sep '19

20 Sep '19

List seems to have issues. One sec.

3 2

OpenDirectory on FreeRadius 3.0.19
by Dave Walsh 19 Sep '19

19 Sep '19

I had a FreeRadius 2.2.0 server running under Mac OS X 10.8.5 connected to my old wireless setup. We just replaced the wireless with Aruba gear and I'm trying to configure a new install of FreeRadius 3.0.19 to use OpenDirectory like the old install. I think I've got all the configs set straight, but client connections are failing with known good username/password combinations. And yes, I fixed the homebrew settings so the dylib for OpenDirectory loads. Is there a how-to guide on setting up FR3 with OpenDirectory? I couldn't find one with a few different searches... Or maybe something will jump out of the debug log below? Thanks for any fixes/hints/tips. -Dave Walsh Network Administrator Lincoln-Sudbury Regional HS Sudbury, MA 01776 (978) 443-9961 x3336 debug log: radiusd lsadmin:~ admin$ radiusd -X FreeRADIUS Version 3.0.19 Copyright (C) 1999-2019 The FreeRADIUS server project and contributors There is NO warranty; not even for MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE You may redistribute copies of FreeRADIUS under the terms of the GNU General Public License For more information about these matters, see the file named COPYRIGHT Starting - reading configuration files ... including dictionary file /usr/local/Cellar/freeradius-server/3.0.19/share/freeradius/dictionary including dictionary file /usr/local/Cellar/freeradius-server/3.0.19/share/freeradius/dictionary.dhcp including dictionary file /usr/local/Cellar/freeradius-server/3.0.19/share/freeradius/dictionary.vqp including dictionary file /usr/local/Cellar/freeradius-server/3.0.19/etc/raddb/dictionary including configuration file /usr/local/Cellar/freeradius-server/3.0.19/etc/raddb/radiusd.conf including configuration file /usr/local/Cellar/freeradius-server/3.0.19/etc/raddb/proxy.conf including configuration file /usr/local/Cellar/freeradius-server/3.0.19/etc/raddb/clients.conf including files in directory /usr/local/Cellar/freeradius-server/3.0.19/etc/raddb/mods-enabled/ including configuration file /usr/local/Cellar/freeradius-server/3.0.19/etc/raddb/mods-enabled/detail.log including configuration file /usr/local/Cellar/freeradius-server/3.0.19/etc/raddb/mods-enabled/eap including configuration file /usr/local/Cellar/freeradius-server/3.0.19/etc/raddb/mods-enabled/echo including configuration file /usr/local/Cellar/freeradius-server/3.0.19/etc/raddb/mods-enabled/utf8 including configuration file /usr/local/Cellar/freeradius-server/3.0.19/etc/raddb/mods-enabled/always including configuration file /usr/local/Cellar/freeradius-server/3.0.19/etc/raddb/mods-enabled/digest including configuration file /usr/local/Cellar/freeradius-server/3.0.19/etc/raddb/mods-enabled/date including configuration file /usr/local/Cellar/freeradius-server/3.0.19/etc/raddb/mods-enabled/preprocess including configuration file /usr/local/Cellar/freeradius-server/3.0.19/etc/raddb/mods-enabled/pap including configuration file /usr/local/Cellar/freeradius-server/3.0.19/etc/raddb/mods-enabled/expr including configuration file /usr/local/Cellar/freeradius-server/3.0.19/etc/raddb/mods-enabled/radutmp including configuration file /usr/local/Cellar/freeradius-server/3.0.19/etc/raddb/mods-enabled/linelog including configuration file /usr/local/Cellar/freeradius-server/3.0.19/etc/raddb/mods-enabled/unix including configuration file /usr/local/Cellar/freeradius-server/3.0.19/etc/raddb/mods-enabled/detail including configuration file /usr/local/Cellar/freeradius-server/3.0.19/etc/raddb/mods-enabled/attr_filter including configuration file /usr/local/Cellar/freeradius-server/3.0.19/etc/raddb/mods-enabled/ntlm_auth including configuration file /usr/local/Cellar/freeradius-server/3.0.19/etc/raddb/mods-enabled/exec including configuration file /usr/local/Cellar/freeradius-server/3.0.19/etc/raddb/mods-enabled/files including configuration file /usr/local/Cellar/freeradius-server/3.0.19/etc/raddb/mods-enabled/replicate including configuration file /usr/local/Cellar/freeradius-server/3.0.19/etc/raddb/mods-enabled/chap including configuration file /usr/local/Cellar/freeradius-server/3.0.19/etc/raddb/mods-enabled/unpack including configuration file /usr/local/Cellar/freeradius-server/3.0.19/etc/raddb/mods-enabled/logintime including configuration file /usr/local/Cellar/freeradius-server/3.0.19/etc/raddb/mods-enabled/expiration including configuration file /usr/local/Cellar/freeradius-server/3.0.19/etc/raddb/mods-enabled/cache_eap including configuration file /usr/local/Cellar/freeradius-server/3.0.19/etc/raddb/mods-enabled/soh including configuration file /usr/local/Cellar/freeradius-server/3.0.19/etc/raddb/mods-enabled/sradutmp including configuration file /usr/local/Cellar/freeradius-server/3.0.19/etc/raddb/mods-enabled/mschap including configuration file /usr/local/Cellar/freeradius-server/3.0.19/etc/raddb/mods-enabled/dynamic_clients including configuration file /usr/local/Cellar/freeradius-server/3.0.19/etc/raddb/mods-enabled/passwd including configuration file /usr/local/Cellar/freeradius-server/3.0.19/etc/raddb/mods-enabled/realm including configuration file /usr/local/Cellar/freeradius-server/3.0.19/etc/raddb/mods-enabled/opendirectory including files in directory /usr/local/Cellar/freeradius-server/3.0.19/etc/raddb/policy.d/ including configuration file /usr/local/Cellar/freeradius-server/3.0.19/etc/raddb/policy.d/accounting including configuration file /usr/local/Cellar/freeradius-server/3.0.19/etc/raddb/policy.d/eap including configuration file /usr/local/Cellar/freeradius-server/3.0.19/etc/raddb/policy.d/rfc7542 including configuration file /usr/local/Cellar/freeradius-server/3.0.19/etc/raddb/policy.d/canonicalization including configuration file /usr/local/Cellar/freeradius-server/3.0.19/etc/raddb/policy.d/abfab-tr including configuration file /usr/local/Cellar/freeradius-server/3.0.19/etc/raddb/policy.d/dhcp including configuration file /usr/local/Cellar/freeradius-server/3.0.19/etc/raddb/policy.d/cui including configuration file /usr/local/Cellar/freeradius-server/3.0.19/etc/raddb/policy.d/filter including configuration file /usr/local/Cellar/freeradius-server/3.0.19/etc/raddb/policy.d/moonshot-targeted-ids including configuration file /usr/local/Cellar/freeradius-server/3.0.19/etc/raddb/policy.d/operator-name including configuration file /usr/local/Cellar/freeradius-server/3.0.19/etc/raddb/policy.d/control including configuration file /usr/local/Cellar/freeradius-server/3.0.19/etc/raddb/policy.d/debug including files in directory /usr/local/Cellar/freeradius-server/3.0.19/etc/raddb/sites-enabled/ including configuration file /usr/local/Cellar/freeradius-server/3.0.19/etc/raddb/sites-enabled/default including configuration file /usr/local/Cellar/freeradius-server/3.0.19/etc/raddb/sites-enabled/inner-tunnel main { name = "radiusd" prefix = "/usr/local/Cellar/freeradius-server/3.0.19" localstatedir = "/usr/local/var" sbindir = "/usr/local/Cellar/freeradius-server/3.0.19/bin" logdir = "/usr/local/var/log/radius" run_dir = "/usr/local/var/run/radiusd" libdir = "/usr/local/Cellar/freeradius-server/3.0.19/lib" radacctdir = "/usr/local/var/log/radius/radacct" hostname_lookups = no max_request_time = 30 cleanup_delay = 5 max_requests = 16384 pidfile = "/usr/local/var/run/radiusd/radiusd.pid" checkrad = "/usr/local/Cellar/freeradius-server/3.0.19/bin/checkrad" debug_level = 0 proxy_requests = yes log { stripped_names = no auth = no auth_badpass = no auth_goodpass = no colourise = yes msg_denied = "You are already logged in - access denied" } resources { } security { max_attributes = 200 reject_delay = 1.000000 status_server = yes allow_vulnerable_openssl = "no" } } radiusd: #### Loading Realms and Home Servers #### proxy server { retry_delay = 5 retry_count = 3 default_fallback = no dead_time = 120 wake_all_if_all_dead = no } home_server localhost { ipaddr = 127.0.0.1 port = 1812 type = "auth" secret = <<< secret >>> response_window = 20.000000 response_timeouts = 1 max_outstanding = 65536 zombie_period = 40 status_check = "status-server" ping_interval = 30 check_interval = 30 check_timeout = 4 num_answers_to_alive = 3 revive_interval = 120 limit { max_connections = 16 max_requests = 0 lifetime = 0 idle_timeout = 0 } coa { irt = 2 mrt = 16 mrc = 5 mrd = 30 } } home_server_pool my_auth_failover { type = fail-over home_server = localhost } realm example.com { auth_pool = my_auth_failover } realm LOCAL { } radiusd: #### Loading Clients #### client localhost { ipaddr = 127.0.0.1 /usr/local/Cellar/freeradius-server/3.0.19/etc/raddb/clients.conf[51]: Ignoring duplicate configuration item 'ipv4addr' ipv4addr = 10.100.0.102 require_message_authenticator = no secret = <<< secret >>> nas_type = "other" proto = "*" limit { max_connections = 16 lifetime = 0 idle_timeout = 30 } } client localhost_ipv6 { ipv6addr = ::1 require_message_authenticator = no secret = <<< secret >>> limit { max_connections = 16 lifetime = 0 idle_timeout = 30 } } client private-network-1 { ipaddr = 10.100.0.0/24 require_message_authenticator = no secret = <<< secret >>> limit { max_connections = 16 lifetime = 0 idle_timeout = 30 } } Found debugger attached # Creating Auth-Type = mschap # Creating Auth-Type = digest # Creating Auth-Type = eap # Creating Auth-Type = PAP # Creating Auth-Type = CHAP # Creating Auth-Type = MS-CHAP # Creating Auth-Type = opendirectory radiusd: #### Instantiating modules #### modules { # Loaded module rlm_detail # Loading module "auth_log" from file /usr/local/Cellar/freeradius-server/3.0.19/etc/raddb/mods-enabled/detail.log detail auth_log { filename = "/usr/local/var/log/radius/radacct/%{%{Packet-Src-IP-Address}:-%{Packet-Src-IPv6-Address}}/auth-detail-%Y%m%d" header = "%t" permissions = 384 locking = no escape_filenames = no log_packet_header = no } # Loading module "reply_log" from file /usr/local/Cellar/freeradius-server/3.0.19/etc/raddb/mods-enabled/detail.log detail reply_log { filename = "/usr/local/var/log/radius/radacct/%{%{Packet-Src-IP-Address}:-%{Packet-Src-IPv6-Address}}/reply-detail-%Y%m%d" header = "%t" permissions = 384 locking = no escape_filenames = no log_packet_header = no } # Loading module "pre_proxy_log" from file /usr/local/Cellar/freeradius-server/3.0.19/etc/raddb/mods-enabled/detail.log detail pre_proxy_log { filename = "/usr/local/var/log/radius/radacct/%{%{Packet-Src-IP-Address}:-%{Packet-Src-IPv6-Address}}/pre-proxy-detail-%Y%m%d" header = "%t" permissions = 384 locking = no escape_filenames = no log_packet_header = no } # Loading module "post_proxy_log" from file /usr/local/Cellar/freeradius-server/3.0.19/etc/raddb/mods-enabled/detail.log detail post_proxy_log { filename = "/usr/local/var/log/radius/radacct/%{%{Packet-Src-IP-Address}:-%{Packet-Src-IPv6-Address}}/post-proxy-detail-%Y%m%d" header = "%t" permissions = 384 locking = no escape_filenames = no log_packet_header = no } # Loaded module rlm_eap # Loading module "eap" from file /usr/local/Cellar/freeradius-server/3.0.19/etc/raddb/mods-enabled/eap eap { default_eap_type = "md5" timer_expire = 60 ignore_unknown_eap_types = no cisco_accounting_username_bug = no max_sessions = 16384 } # Loaded module rlm_exec # Loading module "echo" from file /usr/local/Cellar/freeradius-server/3.0.19/etc/raddb/mods-enabled/echo exec echo { wait = yes program = "/bin/echo %{User-Name}" input_pairs = "request" output_pairs = "reply" shell_escape = yes } # Loaded module rlm_utf8 # Loading module "utf8" from file /usr/local/Cellar/freeradius-server/3.0.19/etc/raddb/mods-enabled/utf8 # Loaded module rlm_always # Loading module "reject" from file /usr/local/Cellar/freeradius-server/3.0.19/etc/raddb/mods-enabled/always always reject { rcode = "reject" simulcount = 0 mpp = no } # Loading module "fail" from file /usr/local/Cellar/freeradius-server/3.0.19/etc/raddb/mods-enabled/always always fail { rcode = "fail" simulcount = 0 mpp = no } # Loading module "ok" from file /usr/local/Cellar/freeradius-server/3.0.19/etc/raddb/mods-enabled/always always ok { rcode = "ok" simulcount = 0 mpp = no } # Loading module "handled" from file /usr/local/Cellar/freeradius-server/3.0.19/etc/raddb/mods-enabled/always always handled { rcode = "handled" simulcount = 0 mpp = no } # Loading module "invalid" from file /usr/local/Cellar/freeradius-server/3.0.19/etc/raddb/mods-enabled/always always invalid { rcode = "invalid" simulcount = 0 mpp = no } # Loading module "userlock" from file /usr/local/Cellar/freeradius-server/3.0.19/etc/raddb/mods-enabled/always always userlock { rcode = "userlock" simulcount = 0 mpp = no } # Loading module "notfound" from file /usr/local/Cellar/freeradius-server/3.0.19/etc/raddb/mods-enabled/always always notfound { rcode = "notfound" simulcount = 0 mpp = no } # Loading module "noop" from file /usr/local/Cellar/freeradius-server/3.0.19/etc/raddb/mods-enabled/always always noop { rcode = "noop" simulcount = 0 mpp = no } # Loading module "updated" from file /usr/local/Cellar/freeradius-server/3.0.19/etc/raddb/mods-enabled/always always updated { rcode = "updated" simulcount = 0 mpp = no } # Loaded module rlm_digest # Loading module "digest" from file /usr/local/Cellar/freeradius-server/3.0.19/etc/raddb/mods-enabled/digest # Loaded module rlm_date # Loading module "date" from file /usr/local/Cellar/freeradius-server/3.0.19/etc/raddb/mods-enabled/date date { format = "%b %e %Y %H:%M:%S %Z" utc = no } # Loading module "wispr2date" from file /usr/local/Cellar/freeradius-server/3.0.19/etc/raddb/mods-enabled/date date wispr2date { format = "%Y-%m-%dT%H:%M:%S" utc = no } # Loaded module rlm_preprocess # Loading module "preprocess" from file /usr/local/Cellar/freeradius-server/3.0.19/etc/raddb/mods-enabled/preprocess preprocess { huntgroups = "/usr/local/Cellar/freeradius-server/3.0.19/etc/raddb/mods-config/preprocess/huntgroups" hints = "/usr/local/Cellar/freeradius-server/3.0.19/etc/raddb/mods-config/preprocess/hints" with_ascend_hack = no ascend_channels_per_line = 23 with_ntdomain_hack = no with_specialix_jetstream_hack = no with_cisco_vsa_hack = no with_alvarion_vsa_hack = no } # Loaded module rlm_pap # Loading module "pap" from file /usr/local/Cellar/freeradius-server/3.0.19/etc/raddb/mods-enabled/pap pap { normalise = yes } # Loaded module rlm_expr # Loading module "expr" from file /usr/local/Cellar/freeradius-server/3.0.19/etc/raddb/mods-enabled/expr expr { safe_characters = "@abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ0123456789.-_: /äéöüàâæçèéêëîïôœùûüaÿÄÉÖÜßÀÂÆÇÈÉÊËÎÏÔŒÙÛÜŸ" } # Loaded module rlm_radutmp # Loading module "radutmp" from file /usr/local/Cellar/freeradius-server/3.0.19/etc/raddb/mods-enabled/radutmp radutmp { filename = "/usr/local/var/log/radius/radutmp" username = "%{User-Name}" case_sensitive = yes check_with_nas = yes permissions = 384 caller_id = yes } # Loaded module rlm_linelog # Loading module "linelog" from file /usr/local/Cellar/freeradius-server/3.0.19/etc/raddb/mods-enabled/linelog linelog { filename = "/usr/local/var/log/radius/linelog" escape_filenames = no syslog_severity = "info" permissions = 384 format = "This is a log message for %{User-Name}" reference = "messages.%{%{reply:Packet-Type}:-default}" } # Loading module "log_accounting" from file /usr/local/Cellar/freeradius-server/3.0.19/etc/raddb/mods-enabled/linelog linelog log_accounting { filename = "/usr/local/var/log/radius/linelog-accounting" escape_filenames = no syslog_severity = "info" permissions = 384 format = "" reference = "Accounting-Request.%{%{Acct-Status-Type}:-unknown}" } # Loaded module rlm_unix # Loading module "unix" from file /usr/local/Cellar/freeradius-server/3.0.19/etc/raddb/mods-enabled/unix unix { radwtmp = "/usr/local/var/log/radius/radwtmp" } Creating attribute Unix-Group # Loading module "detail" from file /usr/local/Cellar/freeradius-server/3.0.19/etc/raddb/mods-enabled/detail detail { filename = "/usr/local/var/log/radius/radacct/%{%{Packet-Src-IP-Address}:-%{Packet-Src-IPv6-Address}}/detail-%Y%m%d" header = "%t" permissions = 384 locking = no escape_filenames = no log_packet_header = no } # Loaded module rlm_attr_filter # Loading module "attr_filter.post-proxy" from file /usr/local/Cellar/freeradius-server/3.0.19/etc/raddb/mods-enabled/attr_filter attr_filter attr_filter.post-proxy { filename = "/usr/local/Cellar/freeradius-server/3.0.19/etc/raddb/mods-config/attr_filter/post-proxy" key = "%{Realm}" relaxed = no } # Loading module "attr_filter.pre-proxy" from file /usr/local/Cellar/freeradius-server/3.0.19/etc/raddb/mods-enabled/attr_filter attr_filter attr_filter.pre-proxy { filename = "/usr/local/Cellar/freeradius-server/3.0.19/etc/raddb/mods-config/attr_filter/pre-proxy" key = "%{Realm}" relaxed = no } # Loading module "attr_filter.access_reject" from file /usr/local/Cellar/freeradius-server/3.0.19/etc/raddb/mods-enabled/attr_filter attr_filter attr_filter.access_reject { filename = "/usr/local/Cellar/freeradius-server/3.0.19/etc/raddb/mods-config/attr_filter/access_reject" key = "%{User-Name}" relaxed = no } # Loading module "attr_filter.access_challenge" from file /usr/local/Cellar/freeradius-server/3.0.19/etc/raddb/mods-enabled/attr_filter attr_filter attr_filter.access_challenge { filename = "/usr/local/Cellar/freeradius-server/3.0.19/etc/raddb/mods-config/attr_filter/access_challenge" key = "%{User-Name}" relaxed = no } # Loading module "attr_filter.accounting_response" from file /usr/local/Cellar/freeradius-server/3.0.19/etc/raddb/mods-enabled/attr_filter attr_filter attr_filter.accounting_response { filename = "/usr/local/Cellar/freeradius-server/3.0.19/etc/raddb/mods-config/attr_filter/accounting_response" key = "%{User-Name}" relaxed = no } # Loading module "ntlm_auth" from file /usr/local/Cellar/freeradius-server/3.0.19/etc/raddb/mods-enabled/ntlm_auth exec ntlm_auth { wait = yes program = "/path/to/ntlm_auth --request-nt-key --domain=MYDOMAIN --username=%{mschap:User-Name} --password=%{User-Password}" shell_escape = yes } # Loading module "exec" from file /usr/local/Cellar/freeradius-server/3.0.19/etc/raddb/mods-enabled/exec exec { wait = no input_pairs = "request" shell_escape = yes timeout = 10 } # Loaded module rlm_files # Loading module "files" from file /usr/local/Cellar/freeradius-server/3.0.19/etc/raddb/mods-enabled/files files { filename = "/usr/local/Cellar/freeradius-server/3.0.19/etc/raddb/mods-config/files/authorize" acctusersfile = "/usr/local/Cellar/freeradius-server/3.0.19/etc/raddb/mods-config/files/accounting" preproxy_usersfile = "/usr/local/Cellar/freeradius-server/3.0.19/etc/raddb/mods-config/files/pre-proxy" } # Loaded module rlm_replicate # Loading module "replicate" from file /usr/local/Cellar/freeradius-server/3.0.19/etc/raddb/mods-enabled/replicate # Loaded module rlm_chap # Loading module "chap" from file /usr/local/Cellar/freeradius-server/3.0.19/etc/raddb/mods-enabled/chap # Loaded module rlm_unpack # Loading module "unpack" from file /usr/local/Cellar/freeradius-server/3.0.19/etc/raddb/mods-enabled/unpack # Loaded module rlm_logintime # Loading module "logintime" from file /usr/local/Cellar/freeradius-server/3.0.19/etc/raddb/mods-enabled/logintime logintime { minimum_timeout = 60 } # Loaded module rlm_expiration # Loading module "expiration" from file /usr/local/Cellar/freeradius-server/3.0.19/etc/raddb/mods-enabled/expiration # Loaded module rlm_cache # Loading module "cache_eap" from file /usr/local/Cellar/freeradius-server/3.0.19/etc/raddb/mods-enabled/cache_eap cache cache_eap { driver = "rlm_cache_rbtree" key = "%{%{control:State}:-%{%{reply:State}:-%{State}}}" ttl = 15 max_entries = 0 epoch = 0 add_stats = no } # Loaded module rlm_soh # Loading module "soh" from file /usr/local/Cellar/freeradius-server/3.0.19/etc/raddb/mods-enabled/soh soh { dhcp = yes } # Loading module "sradutmp" from file /usr/local/Cellar/freeradius-server/3.0.19/etc/raddb/mods-enabled/sradutmp radutmp sradutmp { filename = "/usr/local/var/log/radius/sradutmp" username = "%{User-Name}" case_sensitive = yes check_with_nas = yes permissions = 420 caller_id = no } # Loaded module rlm_mschap # Loading module "mschap" from file /usr/local/Cellar/freeradius-server/3.0.19/etc/raddb/mods-enabled/mschap mschap { use_mppe = yes require_encryption = no require_strong = no with_ntdomain_hack = yes passchange { } allow_retry = yes winbind_retry_with_normalised_username = no use_open_directory = yes } # Loaded module rlm_dynamic_clients # Loading module "dynamic_clients" from file /usr/local/Cellar/freeradius-server/3.0.19/etc/raddb/mods-enabled/dynamic_clients # Loaded module rlm_passwd # Loading module "etc_passwd" from file /usr/local/Cellar/freeradius-server/3.0.19/etc/raddb/mods-enabled/passwd passwd etc_passwd { filename = "/etc/passwd" format = "*User-Name:Crypt-Password:" delimiter = ":" ignore_nislike = no ignore_empty = yes allow_multiple_keys = no hash_size = 100 } # Loaded module rlm_realm # Loading module "IPASS" from file /usr/local/Cellar/freeradius-server/3.0.19/etc/raddb/mods-enabled/realm realm IPASS { format = "prefix" delimiter = "/" ignore_default = no ignore_null = no } # Loading module "suffix" from file /usr/local/Cellar/freeradius-server/3.0.19/etc/raddb/mods-enabled/realm realm suffix { format = "suffix" delimiter = "@" ignore_default = no ignore_null = no } # Loading module "bangpath" from file /usr/local/Cellar/freeradius-server/3.0.19/etc/raddb/mods-enabled/realm realm bangpath { format = "prefix" delimiter = "!" ignore_default = no ignore_null = no } # Loading module "realmpercent" from file /usr/local/Cellar/freeradius-server/3.0.19/etc/raddb/mods-enabled/realm realm realmpercent { format = "suffix" delimiter = "%" ignore_default = no ignore_null = no } # Loading module "ntdomain" from file /usr/local/Cellar/freeradius-server/3.0.19/etc/raddb/mods-enabled/realm realm ntdomain { format = "prefix" delimiter = "\\" ignore_default = no ignore_null = no } # Loaded module rlm_opendirectory # Loading module "opendirectory" from file /usr/local/Cellar/freeradius-server/3.0.19/etc/raddb/mods-enabled/opendirectory instantiate { } # Instantiating module "auth_log" from file /usr/local/Cellar/freeradius-server/3.0.19/etc/raddb/mods-enabled/detail.log rlm_detail (auth_log): 'User-Password' suppressed, will not appear in detail output # Instantiating module "reply_log" from file /usr/local/Cellar/freeradius-server/3.0.19/etc/raddb/mods-enabled/detail.log # Instantiating module "pre_proxy_log" from file /usr/local/Cellar/freeradius-server/3.0.19/etc/raddb/mods-enabled/detail.log # Instantiating module "post_proxy_log" from file /usr/local/Cellar/freeradius-server/3.0.19/etc/raddb/mods-enabled/detail.log # Instantiating module "eap" from file /usr/local/Cellar/freeradius-server/3.0.19/etc/raddb/mods-enabled/eap # Linked to sub-module rlm_eap_md5 # Linked to sub-module rlm_eap_leap # Linked to sub-module rlm_eap_gtc gtc { challenge = "Password: " auth_type = "PAP" } # Linked to sub-module rlm_eap_tls tls { tls = "tls-common" } tls-config tls-common { verify_depth = 0 ca_path = "/usr/local/Cellar/freeradius-server/3.0.19/etc/raddb/certs" pem_file_type = yes private_key_file = "/usr/local/Cellar/freeradius-server/3.0.19/etc/raddb/certs/server.pem" certificate_file = "/usr/local/Cellar/freeradius-server/3.0.19/etc/raddb/certs/server.pem" ca_file = "/usr/local/Cellar/freeradius-server/3.0.19/etc/raddb/certs/ca.pem" private_key_password = <<< secret >>> dh_file = "/usr/local/Cellar/freeradius-server/3.0.19/etc/raddb/certs/dh" fragment_size = 1024 include_length = yes auto_chain = yes check_crl = no check_all_crl = no cipher_list = "DEFAULT" cipher_server_preference = no ecdh_curve = "prime256v1" tls_max_version = "" tls_min_version = "1.0" cache { enable = no lifetime = 24 max_entries = 255 } verify { skip_if_ocsp_ok = no } ocsp { enable = no override_cert_url = yes url = "http://127.0.0.1/ocsp/" use_nonce = yes timeout = 0 softfail = no } } # Linked to sub-module rlm_eap_ttls ttls { tls = "tls-common" default_eap_type = "md5" copy_request_to_tunnel = no use_tunneled_reply = no virtual_server = "inner-tunnel" include_length = yes require_client_cert = no } tls: Using cached TLS configuration from previous invocation # Linked to sub-module rlm_eap_peap peap { tls = "tls-common" default_eap_type = "mschapv2" copy_request_to_tunnel = no use_tunneled_reply = no proxy_tunneled_request_as_eap = yes virtual_server = "inner-tunnel" soh = no require_client_cert = no } tls: Using cached TLS configuration from previous invocation # Linked to sub-module rlm_eap_mschapv2 mschapv2 { with_ntdomain_hack = no send_error = no } # Instantiating module "reject" from file /usr/local/Cellar/freeradius-server/3.0.19/etc/raddb/mods-enabled/always # Instantiating module "fail" from file /usr/local/Cellar/freeradius-server/3.0.19/etc/raddb/mods-enabled/always # Instantiating module "ok" from file /usr/local/Cellar/freeradius-server/3.0.19/etc/raddb/mods-enabled/always # Instantiating module "handled" from file /usr/local/Cellar/freeradius-server/3.0.19/etc/raddb/mods-enabled/always # Instantiating module "invalid" from file /usr/local/Cellar/freeradius-server/3.0.19/etc/raddb/mods-enabled/always # Instantiating module "userlock" from file /usr/local/Cellar/freeradius-server/3.0.19/etc/raddb/mods-enabled/always # Instantiating module "notfound" from file /usr/local/Cellar/freeradius-server/3.0.19/etc/raddb/mods-enabled/always # Instantiating module "noop" from file /usr/local/Cellar/freeradius-server/3.0.19/etc/raddb/mods-enabled/always # Instantiating module "updated" from file /usr/local/Cellar/freeradius-server/3.0.19/etc/raddb/mods-enabled/always # Instantiating module "preprocess" from file /usr/local/Cellar/freeradius-server/3.0.19/etc/raddb/mods-enabled/preprocess reading pairlist file /usr/local/Cellar/freeradius-server/3.0.19/etc/raddb/mods-config/preprocess/huntgroups reading pairlist file /usr/local/Cellar/freeradius-server/3.0.19/etc/raddb/mods-config/preprocess/hints # Instantiating module "pap" from file /usr/local/Cellar/freeradius-server/3.0.19/etc/raddb/mods-enabled/pap # Instantiating module "linelog" from file /usr/local/Cellar/freeradius-server/3.0.19/etc/raddb/mods-enabled/linelog # Instantiating module "log_accounting" from file /usr/local/Cellar/freeradius-server/3.0.19/etc/raddb/mods-enabled/linelog # Instantiating module "detail" from file /usr/local/Cellar/freeradius-server/3.0.19/etc/raddb/mods-enabled/detail # Instantiating module "attr_filter.post-proxy" from file /usr/local/Cellar/freeradius-server/3.0.19/etc/raddb/mods-enabled/attr_filter reading pairlist file /usr/local/Cellar/freeradius-server/3.0.19/etc/raddb/mods-config/attr_filter/post-proxy # Instantiating module "attr_filter.pre-proxy" from file /usr/local/Cellar/freeradius-server/3.0.19/etc/raddb/mods-enabled/attr_filter reading pairlist file /usr/local/Cellar/freeradius-server/3.0.19/etc/raddb/mods-config/attr_filter/pre-proxy # Instantiating module "attr_filter.access_reject" from file /usr/local/Cellar/freeradius-server/3.0.19/etc/raddb/mods-enabled/attr_filter reading pairlist file /usr/local/Cellar/freeradius-server/3.0.19/etc/raddb/mods-config/attr_filter/access_reject # Instantiating module "attr_filter.access_challenge" from file /usr/local/Cellar/freeradius-server/3.0.19/etc/raddb/mods-enabled/attr_filter reading pairlist file /usr/local/Cellar/freeradius-server/3.0.19/etc/raddb/mods-config/attr_filter/access_challenge # Instantiating module "attr_filter.accounting_response" from file /usr/local/Cellar/freeradius-server/3.0.19/etc/raddb/mods-enabled/attr_filter reading pairlist file /usr/local/Cellar/freeradius-server/3.0.19/etc/raddb/mods-config/attr_filter/accounting_response # Instantiating module "files" from file /usr/local/Cellar/freeradius-server/3.0.19/etc/raddb/mods-enabled/files reading pairlist file /usr/local/Cellar/freeradius-server/3.0.19/etc/raddb/mods-config/files/authorize reading pairlist file /usr/local/Cellar/freeradius-server/3.0.19/etc/raddb/mods-config/files/accounting reading pairlist file /usr/local/Cellar/freeradius-server/3.0.19/etc/raddb/mods-config/files/pre-proxy # Instantiating module "logintime" from file /usr/local/Cellar/freeradius-server/3.0.19/etc/raddb/mods-enabled/logintime # Instantiating module "expiration" from file /usr/local/Cellar/freeradius-server/3.0.19/etc/raddb/mods-enabled/expiration # Instantiating module "cache_eap" from file /usr/local/Cellar/freeradius-server/3.0.19/etc/raddb/mods-enabled/cache_eap rlm_cache (cache_eap): Driver rlm_cache_rbtree (module rlm_cache_rbtree) loaded and linked # Instantiating module "mschap" from file /usr/local/Cellar/freeradius-server/3.0.19/etc/raddb/mods-enabled/mschap rlm_mschap (mschap): using internal authentication # Instantiating module "etc_passwd" from file /usr/local/Cellar/freeradius-server/3.0.19/etc/raddb/mods-enabled/passwd rlm_passwd: nfields: 3 keyfield 0(User-Name) listable: no # Instantiating module "IPASS" from file /usr/local/Cellar/freeradius-server/3.0.19/etc/raddb/mods-enabled/realm # Instantiating module "suffix" from file /usr/local/Cellar/freeradius-server/3.0.19/etc/raddb/mods-enabled/realm # Instantiating module "bangpath" from file /usr/local/Cellar/freeradius-server/3.0.19/etc/raddb/mods-enabled/realm # Instantiating module "realmpercent" from file /usr/local/Cellar/freeradius-server/3.0.19/etc/raddb/mods-enabled/realm # Instantiating module "ntdomain" from file /usr/local/Cellar/freeradius-server/3.0.19/etc/raddb/mods-enabled/realm } # modules radiusd: #### Loading Virtual Servers #### server { # from file /usr/local/Cellar/freeradius-server/3.0.19/etc/raddb/radiusd.conf } # server server default { # from file /usr/local/Cellar/freeradius-server/3.0.19/etc/raddb/sites-enabled/default # Loading authenticate {...} # Loading authorize {...} Ignoring "sql" (see raddb/mods-available/README.rst) Ignoring "ldap" (see raddb/mods-available/README.rst) # Loading preacct {...} # Loading accounting {...} # Loading post-proxy {...} # Loading post-auth {...} } # server default server inner-tunnel { # from file /usr/local/Cellar/freeradius-server/3.0.19/etc/raddb/sites-enabled/inner-tunnel # Loading authenticate {...} # Loading authorize {...} # Loading session {...} # Loading post-proxy {...} # Loading post-auth {...} # Skipping contents of 'if' as it is always 'false' -- /usr/local/Cellar/freeradius-server/3.0.19/etc/raddb/sites-enabled/inner-tunnel:357 } # server inner-tunnel radiusd: #### Opening IP addresses and Ports #### listen { type = "auth" ipaddr = * port = 0 limit { max_connections = 16 lifetime = 0 idle_timeout = 30 } } listen { type = "acct" ipaddr = * port = 0 limit { max_connections = 16 lifetime = 0 idle_timeout = 30 } } listen { type = "auth" ipv6addr = :: port = 0 limit { max_connections = 16 lifetime = 0 idle_timeout = 30 } } listen { type = "acct" ipv6addr = :: port = 0 limit { max_connections = 16 lifetime = 0 idle_timeout = 30 } } listen { type = "auth" ipaddr = 127.0.0.1 port = 18120 } Listening on auth address * port 1812 bound to server default Listening on acct address * port 1813 bound to server default Listening on auth address :: port 1812 bound to server default Listening on acct address :: port 1813 bound to server default Listening on auth address 127.0.0.1 port 18120 bound to server inner-tunnel Listening on proxy address * port 57167 Listening on proxy address :: port 57168 Ready to process requests (0) Received Access-Request Id 14 from 10.100.0.102:53924 to 10.0.0.3:1812 length 186 (0) User-Name = "average" (0) NAS-IP-Address = 10.100.0.100 (0) NAS-Port = 0 (0) NAS-Identifier = "10.100.0.102" (0) NAS-Port-Type = Wireless-802.11 (0) Calling-Station-Id = "8489AD6745C3" (0) Called-Station-Id = "001A1E05A6B8" (0) Service-Type = Framed-User (0) Framed-MTU = 1100 (0) EAP-Message = 0x0201000c0161766572616765 (0) Aruba-Essid-Name = "LSwifi" (0) Aruba-Location-Id = "B339" (0) Aruba-AP-Group = "lsrhs-main-ap-group" (0) Message-Authenticator = 0x59652efe566f776aba14e8a1a32023f4 (0) # Executing section authorize from file /usr/local/Cellar/freeradius-server/3.0.19/etc/raddb/sites-enabled/default (0) authorize { (0) policy filter_username { (0) if (&User-Name) { (0) if (&User-Name) -> TRUE (0) if (&User-Name) { (0) if (&User-Name =~ / /) { (0) if (&User-Name =~ / /) -> FALSE (0) if (&User-Name =~ /@[^@]*@/ ) { (0) if (&User-Name =~ /@[^@]*@/ ) -> FALSE (0) if (&User-Name =~ /\.\./ ) { (0) if (&User-Name =~ /\.\./ ) -> FALSE (0) if ((&User-Name =~ /@/) && (&User-Name !~ /(a)(.+)\.(.+)$/)) { (0) if ((&User-Name =~ /@/) && (&User-Name !~ /(a)(.+)\.(.+)$/)) -> FALSE (0) if (&User-Name =~ /\.$/) { (0) if (&User-Name =~ /\.$/) -> FALSE (0) if (&User-Name =~ /(a)\./) { (0) if (&User-Name =~ /(a)\./) -> FALSE (0) } # if (&User-Name) = notfound (0) } # policy filter_username = notfound (0) policy filter_password { (0) if (&User-Password && (&User-Password != "%{string:User-Password}")) { (0) if (&User-Password && (&User-Password != "%{string:User-Password}")) -> FALSE (0) } # policy filter_password = notfound (0) [preprocess] = ok (0) [chap] = noop (0) [mschap] = noop (0) [digest] = noop (0) suffix: Checking for suffix after "@" (0) suffix: No '@' in User-Name = "average", looking up realm NULL (0) suffix: No such realm "NULL" (0) [suffix] = noop (0) eap: Peer sent EAP Response (code 2) ID 1 length 12 (0) eap: EAP-Identity reply, returning 'ok' so we can short-circuit the rest of authorize (0) [eap] = ok (0) } # authorize = ok (0) Found Auth-Type = eap (0) # Executing group from file /usr/local/Cellar/freeradius-server/3.0.19/etc/raddb/sites-enabled/default (0) authenticate { (0) eap: Peer sent packet with method EAP Identity (1) (0) eap: Calling submodule eap_md5 to process data (0) eap_md5: Issuing MD5 Challenge (0) eap: Sending EAP Request (code 1) ID 2 length 22 (0) eap: EAP session adding &reply:State = 0x5456726054547634 (0) [eap] = handled (0) } # authenticate = handled (0) Using Post-Auth-Type Challenge (0) # Executing group from file /usr/local/Cellar/freeradius-server/3.0.19/etc/raddb/sites-enabled/default (0) Challenge { ... } # empty sub-section is ignored (0) Sent Access-Challenge Id 14 from 10.0.0.3:1812 to 10.100.0.102:53924 length 0 (0) EAP-Message = 0x01020016041066c76cbec700c1fb0150cd5c81a267b1 (0) Message-Authenticator = 0x00000000000000000000000000000000 (0) State = 0x545672605454763402c4bd3843c9e021 (0) Finished request Waking up in 4.9 seconds. (1) Received Access-Request Id 15 from 10.100.0.102:53924 to 10.0.0.3:1812 length 200 (1) User-Name = "average" (1) NAS-IP-Address = 10.100.0.100 (1) NAS-Port = 0 (1) NAS-Identifier = "10.100.0.102" (1) NAS-Port-Type = Wireless-802.11 (1) Calling-Station-Id = "8489AD6745C3" (1) Called-Station-Id = "001A1E05A6B8" (1) Service-Type = Framed-User (1) Framed-MTU = 1100 (1) EAP-Message = 0x020200080319152b (1) State = 0x545672605454763402c4bd3843c9e021 (1) Aruba-Essid-Name = "LSwifi" (1) Aruba-Location-Id = "B339" (1) Aruba-AP-Group = "lsrhs-main-ap-group" (1) Message-Authenticator = 0xd72c06082eda7c2faf5e7d6daba605e8 (1) session-state: No cached attributes (1) # Executing section authorize from file /usr/local/Cellar/freeradius-server/3.0.19/etc/raddb/sites-enabled/default (1) authorize { (1) policy filter_username { (1) if (&User-Name) { (1) if (&User-Name) -> TRUE (1) if (&User-Name) { (1) if (&User-Name =~ / /) { (1) if (&User-Name =~ / /) -> FALSE (1) if (&User-Name =~ /@[^@]*@/ ) { (1) if (&User-Name =~ /@[^@]*@/ ) -> FALSE (1) if (&User-Name =~ /\.\./ ) { (1) if (&User-Name =~ /\.\./ ) -> FALSE (1) if ((&User-Name =~ /@/) && (&User-Name !~ /(a)(.+)\.(.+)$/)) { (1) if ((&User-Name =~ /@/) && (&User-Name !~ /(a)(.+)\.(.+)$/)) -> FALSE (1) if (&User-Name =~ /\.$/) { (1) if (&User-Name =~ /\.$/) -> FALSE (1) if (&User-Name =~ /(a)\./) { (1) if (&User-Name =~ /(a)\./) -> FALSE (1) } # if (&User-Name) = notfound (1) } # policy filter_username = notfound (1) policy filter_password { (1) if (&User-Password && (&User-Password != "%{string:User-Password}")) { (1) if (&User-Password && (&User-Password != "%{string:User-Password}")) -> FALSE (1) } # policy filter_password = notfound (1) [preprocess] = ok (1) [chap] = noop (1) [mschap] = noop (1) [digest] = noop (1) suffix: Checking for suffix after "@" (1) suffix: No '@' in User-Name = "average", looking up realm NULL (1) suffix: No such realm "NULL" (1) [suffix] = noop (1) eap: Peer sent EAP Response (code 2) ID 2 length 8 (1) eap: No EAP Start, assuming it's an on-going EAP conversation (1) [eap] = updated (1) [files] = noop (1) opendirectory: The SACL group "com.apple.access_radius" does not exist on this system. (1) opendirectory: The host 10.100.0.102 does not have an access group. (1) opendirectory: no access control groups, all users allowed (1) [opendirectory] = ok (1) [expiration] = noop (1) [logintime] = noop Not doing PAP as Auth-Type is already set. (1) [pap] = noop (1) if (noop && User-Password) { (1) if (noop && User-Password) -> FALSE (1) } # authorize = updated (1) Found Auth-Type = eap (1) # Executing group from file /usr/local/Cellar/freeradius-server/3.0.19/etc/raddb/sites-enabled/default (1) authenticate { (1) eap: Expiring EAP session with state 0x5456726054547634 (1) eap: Finished EAP session with state 0x5456726054547634 (1) eap: Previous EAP request found for state 0x5456726054547634, released from the list (1) eap: Peer sent packet with method EAP NAK (3) (1) eap: Found mutually acceptable type PEAP (25) (1) eap: Calling submodule eap_peap to process data (1) eap_peap: Initiating new TLS session (1) eap_peap: [eaptls start] = request (1) eap: Sending EAP Request (code 1) ID 3 length 6 (1) eap: EAP session adding &reply:State = 0x5456726055556b34 (1) [eap] = handled (1) } # authenticate = handled (1) Using Post-Auth-Type Challenge (1) # Executing group from file /usr/local/Cellar/freeradius-server/3.0.19/etc/raddb/sites-enabled/default (1) Challenge { ... } # empty sub-section is ignored (1) Sent Access-Challenge Id 15 from 10.0.0.3:1812 to 10.100.0.102:53924 length 0 (1) EAP-Message = 0x010300061920 (1) Message-Authenticator = 0x00000000000000000000000000000000 (1) State = 0x5456726055556b3402c4bd3843c9e021 (1) Finished request Waking up in 4.9 seconds. (2) Received Access-Request Id 16 from 10.100.0.102:53924 to 10.0.0.3:1812 length 353 (2) User-Name = "average" (2) NAS-IP-Address = 10.100.0.100 (2) NAS-Port = 0 (2) NAS-Identifier = "10.100.0.102" (2) NAS-Port-Type = Wireless-802.11 (2) Calling-Station-Id = "8489AD6745C3" (2) Called-Station-Id = "001A1E05A6B8" (2) Service-Type = Framed-User (2) Framed-MTU = 1100 (2) EAP-Message = 0x020300a119800000009716030100920100008e03035d53fac5bd59b6d9b42eec9ec11acb1c8ed94fae81b30192ee691cf5815e444500002c00ffc02cc02bc024c023c00ac009c008c030c02fc028c027c014c013c012009d009c003d003c0035002f000a01000039000a00080006001700180019000b00020100000d00120010040102010501060104030203050306030005000501000000000012000000170000 (2) State = 0x5456726055556b3402c4bd3843c9e021 (2) Aruba-Essid-Name = "LSwifi" (2) Aruba-Location-Id = "B339" (2) Aruba-AP-Group = "lsrhs-main-ap-group" (2) Message-Authenticator = 0x6a1f054258b15c3d9c85f983653fdd8f (2) session-state: No cached attributes (2) # Executing section authorize from file /usr/local/Cellar/freeradius-server/3.0.19/etc/raddb/sites-enabled/default (2) authorize { (2) policy filter_username { (2) if (&User-Name) { (2) if (&User-Name) -> TRUE (2) if (&User-Name) { (2) if (&User-Name =~ / /) { (2) if (&User-Name =~ / /) -> FALSE (2) if (&User-Name =~ /@[^@]*@/ ) { (2) if (&User-Name =~ /@[^@]*@/ ) -> FALSE (2) if (&User-Name =~ /\.\./ ) { (2) if (&User-Name =~ /\.\./ ) -> FALSE (2) if ((&User-Name =~ /@/) && (&User-Name !~ /(a)(.+)\.(.+)$/)) { (2) if ((&User-Name =~ /@/) && (&User-Name !~ /(a)(.+)\.(.+)$/)) -> FALSE (2) if (&User-Name =~ /\.$/) { (2) if (&User-Name =~ /\.$/) -> FALSE (2) if (&User-Name =~ /(a)\./) { (2) if (&User-Name =~ /(a)\./) -> FALSE (2) } # if (&User-Name) = notfound (2) } # policy filter_username = notfound (2) policy filter_password { (2) if (&User-Password && (&User-Password != "%{string:User-Password}")) { (2) if (&User-Password && (&User-Password != "%{string:User-Password}")) -> FALSE (2) } # policy filter_password = notfound (2) [preprocess] = ok (2) [chap] = noop (2) [mschap] = noop (2) [digest] = noop (2) suffix: Checking for suffix after "@" (2) suffix: No '@' in User-Name = "average", looking up realm NULL (2) suffix: No such realm "NULL" (2) [suffix] = noop (2) eap: Peer sent EAP Response (code 2) ID 3 length 161 (2) eap: Continuing tunnel setup (2) [eap] = ok (2) } # authorize = ok (2) Found Auth-Type = eap (2) # Executing group from file /usr/local/Cellar/freeradius-server/3.0.19/etc/raddb/sites-enabled/default (2) authenticate { (2) eap: Expiring EAP session with state 0x5456726055556b34 (2) eap: Finished EAP session with state 0x5456726055556b34 (2) eap: Previous EAP request found for state 0x5456726055556b34, released from the list (2) eap: Peer sent packet with method EAP PEAP (25) (2) eap: Calling submodule eap_peap to process data (2) eap_peap: Continuing EAP-TLS (2) eap_peap: Peer indicated complete TLS record size will be 151 bytes (2) eap_peap: Got complete TLS record (151 bytes) (2) eap_peap: [eaptls verify] = length included (2) eap_peap: (other): before/accept initialization (2) eap_peap: TLS_accept: before/accept initialization (2) eap_peap: <<< recv TLS 1.2 [length 0092] (2) eap_peap: TLS_accept: unknown state (2) eap_peap: >>> send TLS 1.2 [length 0039] (2) eap_peap: TLS_accept: unknown state (2) eap_peap: >>> send TLS 1.2 [length 14a7] (2) eap_peap: TLS_accept: unknown state (2) eap_peap: >>> send TLS 1.2 [length 014d] (2) eap_peap: TLS_accept: unknown state (2) eap_peap: >>> send TLS 1.2 [length 0004] (2) eap_peap: TLS_accept: unknown state (2) eap_peap: TLS_accept: unknown state (2) eap_peap: TLS_accept: unknown state (2) eap_peap: TLS_accept: Need to read more data: unknown state (2) eap_peap: TLS_accept: Need to read more data: unknown state (2) eap_peap: TLS - In Handshake Phase (2) eap_peap: TLS - got 5701 bytes of data (2) eap_peap: [eaptls process] = handled (2) eap: Sending EAP Request (code 1) ID 4 length 1004 (2) eap: EAP session adding &reply:State = 0x5456726056526b34 (2) [eap] = handled (2) } # authenticate = handled (2) Using Post-Auth-Type Challenge (2) # Executing group from file /usr/local/Cellar/freeradius-server/3.0.19/etc/raddb/sites-enabled/default (2) Challenge { ... } # empty sub-section is ignored (2) Sent Access-Challenge Id 16 from 10.0.0.3:1812 to 10.100.0.102:53924 length 0 (2) EAP-Message = 0x010403ec19c00000164516030300390200003503038c9017e78d1e2b8a6baee403290f9cffce77fc552296069db2c5b9698ca6cc7500c03000000dff01000100000b00040300010216030314a70b0014a30014a00006d9308206d5308205bda003020102020900c12d683df1391b72300d06092a864886f70d01010b05003081c6310b30090603550406130255533110300e060355040813074172697a6f6e61311330110603550407130a53636f74747364616c6531253023060355040a131c537461726669656c6420546563686e6f6c6f676965732c20496e632e31333031060355040b132a687474703a2f2f63657274732e737461726669656c64746563682e636f6d2f7265706f7369746f72792f313430320603550403132b537461726669656c642053656375726520436572746966696361746520417574686f72697479202d204732301e170d3138303932303132323432355a170d3230313131393139313833385a30393121301f060355040b1318446f6d (2) Message-Authenticator = 0x00000000000000000000000000000000 (2) State = 0x5456726056526b3402c4bd3843c9e021 (2) Finished request Waking up in 4.9 seconds. (3) Received Access-Request Id 17 from 10.100.0.102:53924 to 10.0.0.3:1812 length 198 (3) User-Name = "average" (3) NAS-IP-Address = 10.100.0.100 (3) NAS-Port = 0 (3) NAS-Identifier = "10.100.0.102" (3) NAS-Port-Type = Wireless-802.11 (3) Calling-Station-Id = "8489AD6745C3" (3) Called-Station-Id = "001A1E05A6B8" (3) Service-Type = Framed-User (3) Framed-MTU = 1100 (3) EAP-Message = 0x020400061900 (3) State = 0x5456726056526b3402c4bd3843c9e021 (3) Aruba-Essid-Name = "LSwifi" (3) Aruba-Location-Id = "B339" (3) Aruba-AP-Group = "lsrhs-main-ap-group" (3) Message-Authenticator = 0x76592fb8b78a8d3188995da103f171a0 (3) session-state: No cached attributes (3) # Executing section authorize from file /usr/local/Cellar/freeradius-server/3.0.19/etc/raddb/sites-enabled/default (3) authorize { (3) policy filter_username { (3) if (&User-Name) { (3) if (&User-Name) -> TRUE (3) if (&User-Name) { (3) if (&User-Name =~ / /) { (3) if (&User-Name =~ / /) -> FALSE (3) if (&User-Name =~ /@[^@]*@/ ) { (3) if (&User-Name =~ /@[^@]*@/ ) -> FALSE (3) if (&User-Name =~ /\.\./ ) { (3) if (&User-Name =~ /\.\./ ) -> FALSE (3) if ((&User-Name =~ /@/) && (&User-Name !~ /(a)(.+)\.(.+)$/)) { (3) if ((&User-Name =~ /@/) && (&User-Name !~ /(a)(.+)\.(.+)$/)) -> FALSE (3) if (&User-Name =~ /\.$/) { (3) if (&User-Name =~ /\.$/) -> FALSE (3) if (&User-Name =~ /(a)\./) { (3) if (&User-Name =~ /(a)\./) -> FALSE (3) } # if (&User-Name) = notfound (3) } # policy filter_username = notfound (3) policy filter_password { (3) if (&User-Password && (&User-Password != "%{string:User-Password}")) { (3) if (&User-Password && (&User-Password != "%{string:User-Password}")) -> FALSE (3) } # policy filter_password = notfound (3) [preprocess] = ok (3) [chap] = noop (3) [mschap] = noop (3) [digest] = noop (3) suffix: Checking for suffix after "@" (3) suffix: No '@' in User-Name = "average", looking up realm NULL (3) suffix: No such realm "NULL" (3) [suffix] = noop (3) eap: Peer sent EAP Response (code 2) ID 4 length 6 (3) eap: Continuing tunnel setup (3) [eap] = ok (3) } # authorize = ok (3) Found Auth-Type = eap (3) # Executing group from file /usr/local/Cellar/freeradius-server/3.0.19/etc/raddb/sites-enabled/default (3) authenticate { (3) eap: Expiring EAP session with state 0x5456726056526b34 (3) eap: Finished EAP session with state 0x5456726056526b34 (3) eap: Previous EAP request found for state 0x5456726056526b34, released from the list (3) eap: Peer sent packet with method EAP PEAP (25) (3) eap: Calling submodule eap_peap to process data (3) eap_peap: Continuing EAP-TLS (3) eap_peap: Peer ACKed our handshake fragment (3) eap_peap: [eaptls verify] = request (3) eap_peap: [eaptls process] = handled (3) eap: Sending EAP Request (code 1) ID 5 length 1000 (3) eap: EAP session adding &reply:State = 0x5456726057536b34 (3) [eap] = handled (3) } # authenticate = handled (3) Using Post-Auth-Type Challenge (3) # Executing group from file /usr/local/Cellar/freeradius-server/3.0.19/etc/raddb/sites-enabled/default (3) Challenge { ... } # empty sub-section is ignored (3) Sent Access-Challenge Id 17 from 10.0.0.3:1812 to 10.100.0.102:53924 length 0 (3) EAP-Message = 0x010503e819406d2f304606082b06010505073002863a687474703a2f2f6365727469666963617465732e737461726669656c64746563682e636f6d2f7265706f7369746f72792f73666967322e637274301f0603551d23041830168014254581685026383d3b2d2cbecd6ad9b63db3666330210603551d11041a3018820b2a2e6c737268732e6e657482096c737268732e6e6574301d0603551d0e041604141d7d311eae75cb33ddd9eeb936e7e587027894153082017f060a2b06010401d6790204020482016f0482016b0169007600a4b90990b418581487bb13a2cc67700a3c359804f91bdfb8e377cd0ec80ddc1000000165f6f0478100000403004730450220580af79bf47ef594890251fe24c2b6c6994233ea6cec1b388e97cc8e5fae0736022100b5eddb5bb0906db075472cda3ca153f9b882eccde948e4f405d925902752ae9a007700ee4bbdb775ce60bae142691fabe19e66a30f7e5fb072d88300c47b897aa8fdcb00000165f6f04be700000403004830 (3) Message-Authenticator = 0x00000000000000000000000000000000 (3) State = 0x5456726057536b3402c4bd3843c9e021 (3) Finished request Waking up in 4.9 seconds. (4) Received Access-Request Id 18 from 10.100.0.102:53924 to 10.0.0.3:1812 length 198 (4) User-Name = "average" (4) NAS-IP-Address = 10.100.0.100 (4) NAS-Port = 0 (4) NAS-Identifier = "10.100.0.102" (4) NAS-Port-Type = Wireless-802.11 (4) Calling-Station-Id = "8489AD6745C3" (4) Called-Station-Id = "001A1E05A6B8" (4) Service-Type = Framed-User (4) Framed-MTU = 1100 (4) EAP-Message = 0x020500061900 (4) State = 0x5456726057536b3402c4bd3843c9e021 (4) Aruba-Essid-Name = "LSwifi" (4) Aruba-Location-Id = "B339" (4) Aruba-AP-Group = "lsrhs-main-ap-group" (4) Message-Authenticator = 0xebbb5929ea7e1fda20fcf379a9fed2f1 (4) session-state: No cached attributes (4) # Executing section authorize from file /usr/local/Cellar/freeradius-server/3.0.19/etc/raddb/sites-enabled/default (4) authorize { (4) policy filter_username { (4) if (&User-Name) { (4) if (&User-Name) -> TRUE (4) if (&User-Name) { (4) if (&User-Name =~ / /) { (4) if (&User-Name =~ / /) -> FALSE (4) if (&User-Name =~ /@[^@]*@/ ) { (4) if (&User-Name =~ /@[^@]*@/ ) -> FALSE (4) if (&User-Name =~ /\.\./ ) { (4) if (&User-Name =~ /\.\./ ) -> FALSE (4) if ((&User-Name =~ /@/) && (&User-Name !~ /(a)(.+)\.(.+)$/)) { (4) if ((&User-Name =~ /@/) && (&User-Name !~ /(a)(.+)\.(.+)$/)) -> FALSE (4) if (&User-Name =~ /\.$/) { (4) if (&User-Name =~ /\.$/) -> FALSE (4) if (&User-Name =~ /(a)\./) { (4) if (&User-Name =~ /(a)\./) -> FALSE (4) } # if (&User-Name) = notfound (4) } # policy filter_username = notfound (4) policy filter_password { (4) if (&User-Password && (&User-Password != "%{string:User-Password}")) { (4) if (&User-Password && (&User-Password != "%{string:User-Password}")) -> FALSE (4) } # policy filter_password = notfound (4) [preprocess] = ok (4) [chap] = noop (4) [mschap] = noop (4) [digest] = noop (4) suffix: Checking for suffix after "@" (4) suffix: No '@' in User-Name = "average", looking up realm NULL (4) suffix: No such realm "NULL" (4) [suffix] = noop (4) eap: Peer sent EAP Response (code 2) ID 5 length 6 (4) eap: Continuing tunnel setup (4) [eap] = ok (4) } # authorize = ok (4) Found Auth-Type = eap (4) # Executing group from file /usr/local/Cellar/freeradius-server/3.0.19/etc/raddb/sites-enabled/default (4) authenticate { (4) eap: Expiring EAP session with state 0x5456726057536b34 (4) eap: Finished EAP session with state 0x5456726057536b34 (4) eap: Previous EAP request found for state 0x5456726057536b34, released from the list (4) eap: Peer sent packet with method EAP PEAP (25) (4) eap: Calling submodule eap_peap to process data (4) eap_peap: Continuing EAP-TLS (4) eap_peap: Peer ACKed our handshake fragment (4) eap_peap: [eaptls verify] = request (4) eap_peap: [eaptls process] = handled (4) eap: Sending EAP Request (code 1) ID 6 length 1000 (4) eap: EAP session adding &reply:State = 0x5456726050506b34 (4) [eap] = handled (4) } # authenticate = handled (4) Using Post-Auth-Type Challenge (4) # Executing group from file /usr/local/Cellar/freeradius-server/3.0.19/etc/raddb/sites-enabled/default (4) Challenge { ... } # empty sub-section is ignored (4) Sent Access-Challenge Id 18 from 10.0.0.3:1812 to 10.100.0.102:53924 length 0 (4) EAP-Message = 0x010603e819406966696361746520417574686f72697479202d204732301e170d3131303530333037303030305a170d3331303530333037303030305a3081c6310b30090603550406130255533110300e060355040813074172697a6f6e61311330110603550407130a53636f74747364616c6531253023060355040a131c537461726669656c6420546563686e6f6c6f676965732c20496e632e31333031060355040b132a687474703a2f2f63657274732e737461726669656c64746563682e636f6d2f7265706f7369746f72792f313430320603550403132b537461726669656c642053656375726520436572746966696361746520417574686f72697479202d20473230820122300d06092a864886f70d01010105000382010f003082010a0282010100e590664becf94671a92083bee96cbf4ac9486981754e6d24f6cb1713f8b07159847a6b2b85a434b516e5cbcce941702ca42ed6fa327de1a8de9410ac31c1c0d86aff5927ab76d6fc0b746bb8a7ae3fc454 (4) Message-Authenticator = 0x00000000000000000000000000000000 (4) State = 0x5456726050506b3402c4bd3843c9e021 (4) Finished request Waking up in 4.9 seconds. (5) Received Access-Request Id 19 from 10.100.0.102:53924 to 10.0.0.3:1812 length 198 (5) User-Name = "average" (5) NAS-IP-Address = 10.100.0.100 (5) NAS-Port = 0 (5) NAS-Identifier = "10.100.0.102" (5) NAS-Port-Type = Wireless-802.11 (5) Calling-Station-Id = "8489AD6745C3" (5) Called-Station-Id = "001A1E05A6B8" (5) Service-Type = Framed-User (5) Framed-MTU = 1100 (5) EAP-Message = 0x020600061900 (5) State = 0x5456726050506b3402c4bd3843c9e021 (5) Aruba-Essid-Name = "LSwifi" (5) Aruba-Location-Id = "B339" (5) Aruba-AP-Group = "lsrhs-main-ap-group" (5) Message-Authenticator = 0x2ed86125369ed5eee969c5e690c63e3b (5) session-state: No cached attributes (5) # Executing section authorize from file /usr/local/Cellar/freeradius-server/3.0.19/etc/raddb/sites-enabled/default (5) authorize { (5) policy filter_username { (5) if (&User-Name) { (5) if (&User-Name) -> TRUE (5) if (&User-Name) { (5) if (&User-Name =~ / /) { (5) if (&User-Name =~ / /) -> FALSE (5) if (&User-Name =~ /@[^@]*@/ ) { (5) if (&User-Name =~ /@[^@]*@/ ) -> FALSE (5) if (&User-Name =~ /\.\./ ) { (5) if (&User-Name =~ /\.\./ ) -> FALSE (5) if ((&User-Name =~ /@/) && (&User-Name !~ /(a)(.+)\.(.+)$/)) { (5) if ((&User-Name =~ /@/) && (&User-Name !~ /(a)(.+)\.(.+)$/)) -> FALSE (5) if (&User-Name =~ /\.$/) { (5) if (&User-Name =~ /\.$/) -> FALSE (5) if (&User-Name =~ /(a)\./) { (5) if (&User-Name =~ /(a)\./) -> FALSE (5) } # if (&User-Name) = notfound (5) } # policy filter_username = notfound (5) policy filter_password { (5) if (&User-Password && (&User-Password != "%{string:User-Password}")) { (5) if (&User-Password && (&User-Password != "%{string:User-Password}")) -> FALSE (5) } # policy filter_password = notfound (5) [preprocess] = ok (5) [chap] = noop (5) [mschap] = noop (5) [digest] = noop (5) suffix: Checking for suffix after "@" (5) suffix: No '@' in User-Name = "average", looking up realm NULL (5) suffix: No such realm "NULL" (5) [suffix] = noop (5) eap: Peer sent EAP Response (code 2) ID 6 length 6 (5) eap: Continuing tunnel setup (5) [eap] = ok (5) } # authorize = ok (5) Found Auth-Type = eap (5) # Executing group from file /usr/local/Cellar/freeradius-server/3.0.19/etc/raddb/sites-enabled/default (5) authenticate { (5) eap: Expiring EAP session with state 0x5456726050506b34 (5) eap: Finished EAP session with state 0x5456726050506b34 (5) eap: Previous EAP request found for state 0x5456726050506b34, released from the list (5) eap: Peer sent packet with method EAP PEAP (25) (5) eap: Calling submodule eap_peap to process data (5) eap_peap: Continuing EAP-TLS (5) eap_peap: Peer ACKed our handshake fragment (5) eap_peap: [eaptls verify] = request (5) eap_peap: [eaptls process] = handled (5) eap: Sending EAP Request (code 1) ID 7 length 1000 (5) eap: EAP session adding &reply:State = 0x5456726051516b34 (5) [eap] = handled (5) } # authenticate = handled (5) Using Post-Auth-Type Challenge (5) # Executing group from file /usr/local/Cellar/freeradius-server/3.0.19/etc/raddb/sites-enabled/default (5) Challenge { ... } # empty sub-section is ignored (5) Sent Access-Challenge Id 19 from 10.0.0.3:1812 to 10.100.0.102:53924 length 0 (5) EAP-Message = 0x010703e819402418ce793da991bf541813899954110d55c5260b794f5a1c6ef963db1480a407abfab2a5b988dd91fe653ba4a379be894de1d0b0f4c8170c0a96147c09b76ce1c2d855d418a0aa41697024a3b9efe95adc3eeb944af0b7de5f0e76fafbfb6903454050ee720ca4128681cd13d14ec43cca4e0dd226f100b7b4a6a2e16e7a81fd30ac7a1fc7597b0004a4308204a030820388a0030201020203391484300d06092a864886f70d01010b05003068310b300906035504061302555331253023060355040a131c537461726669656c6420546563686e6f6c6f676965732c20496e632e31323030060355040b1329537461726669656c6420436c61737320322043657274696669636174696f6e20417574686f72697479301e170d3134303130313037303030305a170d3331303533303037303030305a30818f310b30090603550406130255533110300e060355040813074172697a6f6e61311330110603550407130a53636f74747364616c653125302306 (5) Message-Authenticator = 0x00000000000000000000000000000000 (5) State = 0x5456726051516b3402c4bd3843c9e021 (5) Finished request Waking up in 4.9 seconds. (6) Received Access-Request Id 20 from 10.100.0.102:53924 to 10.0.0.3:1812 length 198 (6) User-Name = "average" (6) NAS-IP-Address = 10.100.0.100 (6) NAS-Port = 0 (6) NAS-Identifier = "10.100.0.102" (6) NAS-Port-Type = Wireless-802.11 (6) Calling-Station-Id = "8489AD6745C3" (6) Called-Station-Id = "001A1E05A6B8" (6) Service-Type = Framed-User (6) Framed-MTU = 1100 (6) EAP-Message = 0x020700061900 (6) State = 0x5456726051516b3402c4bd3843c9e021 (6) Aruba-Essid-Name = "LSwifi" (6) Aruba-Location-Id = "B339" (6) Aruba-AP-Group = "lsrhs-main-ap-group" (6) Message-Authenticator = 0xe8ec0a8fb9baa0cc7028adbb0cde30c5 (6) session-state: No cached attributes (6) # Executing section authorize from file /usr/local/Cellar/freeradius-server/3.0.19/etc/raddb/sites-enabled/default (6) authorize { (6) policy filter_username { (6) if (&User-Name) { (6) if (&User-Name) -> TRUE (6) if (&User-Name) { (6) if (&User-Name =~ / /) { (6) if (&User-Name =~ / /) -> FALSE (6) if (&User-Name =~ /@[^@]*@/ ) { (6) if (&User-Name =~ /@[^@]*@/ ) -> FALSE (6) if (&User-Name =~ /\.\./ ) { (6) if (&User-Name =~ /\.\./ ) -> FALSE (6) if ((&User-Name =~ /@/) && (&User-Name !~ /(a)(.+)\.(.+)$/)) { (6) if ((&User-Name =~ /@/) && (&User-Name !~ /(a)(.+)\.(.+)$/)) -> FALSE (6) if (&User-Name =~ /\.$/) { (6) if (&User-Name =~ /\.$/) -> FALSE (6) if (&User-Name =~ /(a)\./) { (6) if (&User-Name =~ /(a)\./) -> FALSE (6) } # if (&User-Name) = notfound (6) } # policy filter_username = notfound (6) policy filter_password { (6) if (&User-Password && (&User-Password != "%{string:User-Password}")) { (6) if (&User-Password && (&User-Password != "%{string:User-Password}")) -> FALSE (6) } # policy filter_password = notfound (6) [preprocess] = ok (6) [chap] = noop (6) [mschap] = noop (6) [digest] = noop (6) suffix: Checking for suffix after "@" (6) suffix: No '@' in User-Name = "average", looking up realm NULL (6) suffix: No such realm "NULL" (6) [suffix] = noop (6) eap: Peer sent EAP Response (code 2) ID 7 length 6 (6) eap: Continuing tunnel setup (6) [eap] = ok (6) } # authorize = ok (6) Found Auth-Type = eap (6) # Executing group from file /usr/local/Cellar/freeradius-server/3.0.19/etc/raddb/sites-enabled/default (6) authenticate { (6) eap: Expiring EAP session with state 0x5456726051516b34 (6) eap: Finished EAP session with state 0x5456726051516b34 (6) eap: Previous EAP request found for state 0x5456726051516b34, released from the list (6) eap: Peer sent packet with method EAP PEAP (25) (6) eap: Calling submodule eap_peap to process data (6) eap_peap: Continuing EAP-TLS (6) eap_peap: Peer ACKed our handshake fragment (6) eap_peap: [eaptls verify] = request (6) eap_peap: [eaptls process] = handled (6) eap: Sending EAP Request (code 1) ID 8 length 1000 (6) eap: EAP session adding &reply:State = 0x54567260525e6b34 (6) [eap] = handled (6) } # authenticate = handled (6) Using Post-Auth-Type Challenge (6) # Executing group from file /usr/local/Cellar/freeradius-server/3.0.19/etc/raddb/sites-enabled/default (6) Challenge { ... } # empty sub-section is ignored (6) Sent Access-Challenge Id 20 from 10.0.0.3:1812 to 10.100.0.102:53924 length 0 (6) EAP-Message = 0x010803e819403706082b06010505070201162b68747470733a2f2f63657274732e737461726669656c64746563682e636f6d2f7265706f7369746f72792f300d06092a864886f70d01010b050003820101008563c1d9ddb9ffa9bda619dcbf133a11382254b1ac0510fb7cb3963f318b66ff88f3e1bffbc71f00ff466a8b6132c9015176fb9ac6fa2051c846c498d779a3e304723f8b4d345367ec332c7be89401287c3a345b0277168d402533b0bc6c97d7057aff8c85ce6fa05300176e1e6cbd22d70a8837f67deb9941ef27cb8c606b4c017e65500b4fb8959a9a6e34fd733a33f191d5f34e2d74e8efd39035f1066864d4d013fd52d3c66dc13a8a31dd0526354a8c65b8526b81ecd29cb53410979c3ec62fed8e4242242ee9739a25f911f1f22369cbe59469a0d2dcb0fc4489ac17a8ccd5377716c580b90c8f57025599857b49f02e5ba0c257535da2e8a637c301fa0004133082040f308202f7a003020102020100300d06092a864886f70d0101050500306831 (6) Message-Authenticator = 0x00000000000000000000000000000000 (6) State = 0x54567260525e6b3402c4bd3843c9e021 (6) Finished request Waking up in 4.9 seconds. (7) Received Access-Request Id 21 from 10.100.0.102:53924 to 10.0.0.3:1812 length 198 (7) User-Name = "average" (7) NAS-IP-Address = 10.100.0.100 (7) NAS-Port = 0 (7) NAS-Identifier = "10.100.0.102" (7) NAS-Port-Type = Wireless-802.11 (7) Calling-Station-Id = "8489AD6745C3" (7) Called-Station-Id = "001A1E05A6B8" (7) Service-Type = Framed-User (7) Framed-MTU = 1100 (7) EAP-Message = 0x020800061900 (7) State = 0x54567260525e6b3402c4bd3843c9e021 (7) Aruba-Essid-Name = "LSwifi" (7) Aruba-Location-Id = "B339" (7) Aruba-AP-Group = "lsrhs-main-ap-group" (7) Message-Authenticator = 0x6f938516feec91e3f7dba371f608ebe4 (7) session-state: No cached attributes (7) # Executing section authorize from file /usr/local/Cellar/freeradius-server/3.0.19/etc/raddb/sites-enabled/default (7) authorize { (7) policy filter_username { (7) if (&User-Name) { (7) if (&User-Name) -> TRUE (7) if (&User-Name) { (7) if (&User-Name =~ / /) { (7) if (&User-Name =~ / /) -> FALSE (7) if (&User-Name =~ /@[^@]*@/ ) { (7) if (&User-Name =~ /@[^@]*@/ ) -> FALSE (7) if (&User-Name =~ /\.\./ ) { (7) if (&User-Name =~ /\.\./ ) -> FALSE (7) if ((&User-Name =~ /@/) && (&User-Name !~ /(a)(.+)\.(.+)$/)) { (7) if ((&User-Name =~ /@/) && (&User-Name !~ /(a)(.+)\.(.+)$/)) -> FALSE (7) if (&User-Name =~ /\.$/) { (7) if (&User-Name =~ /\.$/) -> FALSE (7) if (&User-Name =~ /(a)\./) { (7) if (&User-Name =~ /(a)\./) -> FALSE (7) } # if (&User-Name) = notfound (7) } # policy filter_username = notfound (7) policy filter_password { (7) if (&User-Password && (&User-Password != "%{string:User-Password}")) { (7) if (&User-Password && (&User-Password != "%{string:User-Password}")) -> FALSE (7) } # policy filter_password = notfound (7) [preprocess] = ok (7) [chap] = noop (7) [mschap] = noop (7) [digest] = noop (7) suffix: Checking for suffix after "@" (7) suffix: No '@' in User-Name = "average", looking up realm NULL (7) suffix: No such realm "NULL" (7) [suffix] = noop (7) eap: Peer sent EAP Response (code 2) ID 8 length 6 (7) eap: Continuing tunnel setup (7) [eap] = ok (7) } # authorize = ok (7) Found Auth-Type = eap (7) # Executing group from file /usr/local/Cellar/freeradius-server/3.0.19/etc/raddb/sites-enabled/default (7) authenticate { (7) eap: Expiring EAP session with state 0x54567260525e6b34 (7) eap: Finished EAP session with state 0x54567260525e6b34 (7) eap: Previous EAP request found for state 0x54567260525e6b34, released from the list (7) eap: Peer sent packet with method EAP PEAP (25) (7) eap: Calling submodule eap_peap to process data (7) eap_peap: Continuing EAP-TLS (7) eap_peap: Peer ACKed our handshake fragment (7) eap_peap: [eaptls verify] = request (7) eap_peap: [eaptls process] = handled (7) eap: Sending EAP Request (code 1) ID 9 length 737 (7) eap: EAP session adding &reply:State = 0x54567260535f6b34 (7) [eap] = handled (7) } # authenticate = handled (7) Using Post-Auth-Type Challenge (7) # Executing group from file /usr/local/Cellar/freeradius-server/3.0.19/etc/raddb/sites-enabled/default (7) Challenge { ... } # empty sub-section is ignored (7) Sent Access-Challenge Id 21 from 10.0.0.3:1812 to 10.100.0.102:53924 length 0 (7) EAP-Message = 0x010902e1190031253023060355040a131c537461726669656c6420546563686e6f6c6f676965732c20496e632e31323030060355040b1329537461726669656c6420436c61737320322043657274696669636174696f6e20417574686f72697479820100300c0603551d13040530030101ff300d06092a864886f70d01010505000382010100059d3f889dd1c91a55a1ac69f3f359da9b01871a4f57a9a179092adbf72fb21eccc75e6ad88387a197ef49353e7706415862bf8e58b80a673fecb3dd21661fc954fa72cc3d4c40d881af779e837abba2c7f534178ed91140f4fc2c2a4d157fa7625d2e25d3000b201a1d68f917b8f4bd8bed2859dd4d168b1783c8b265c72d7aa5aabc53866ddd57a4caf820410b68f0f4fb74be565d7a79f5f91d85e32d95bef5719043cc8d1f9a000a8729e95522580023eae31243295b4708dd8c416a6506a8e521aa41b4952195b97dd134ab13d6adbcdce23d39cdbd3e7570a1185903c922b48f9cd55e2ad7a5b6d40a6df8b74011 (7) Message-Authenticator = 0x00000000000000000000000000000000 (7) State = 0x54567260535f6b3402c4bd3843c9e021 (7) Finished request Waking up in 4.9 seconds. (8) Received Access-Request Id 22 from 10.100.0.102:53924 to 10.0.0.3:1812 length 328 (8) User-Name = "average" (8) NAS-IP-Address = 10.100.0.100 (8) NAS-Port = 0 (8) NAS-Identifier = "10.100.0.102" (8) NAS-Port-Type = Wireless-802.11 (8) Calling-Station-Id = "8489AD6745C3" (8) Called-Station-Id = "001A1E05A6B8" (8) Service-Type = Framed-User (8) Framed-MTU = 1100 (8) EAP-Message = 0x0209008819800000007e16030300461000004241042af163952be7da8b154a2c69487def1248f5a485d4444c8228737b5001812d4840f8bb2b672a265c20ea4bddd1027ce5abfd6dcd6e0b4171ce44e8a3e5e836cd1403030001011603030028fcd1cf9b8c26f1fcad3172e8bcad6f3d3d12185a4608a9f9c670ae97bfb63fd89b259f5e5fc54cd3 (8) State = 0x54567260535f6b3402c4bd3843c9e021 (8) Aruba-Essid-Name = "LSwifi" (8) Aruba-Location-Id = "B339" (8) Aruba-AP-Group = "lsrhs-main-ap-group" (8) Message-Authenticator = 0x24534f2185f387623436d1b8a3a5884c (8) session-state: No cached attributes (8) # Executing section authorize from file /usr/local/Cellar/freeradius-server/3.0.19/etc/raddb/sites-enabled/default (8) authorize { (8) policy filter_username { (8) if (&User-Name) { (8) if (&User-Name) -> TRUE (8) if (&User-Name) { (8) if (&User-Name =~ / /) { (8) if (&User-Name =~ / /) -> FALSE (8) if (&User-Name =~ /@[^@]*@/ ) { (8) if (&User-Name =~ /@[^@]*@/ ) -> FALSE (8) if (&User-Name =~ /\.\./ ) { (8) if (&User-Name =~ /\.\./ ) -> FALSE (8) if ((&User-Name =~ /@/) && (&User-Name !~ /(a)(.+)\.(.+)$/)) { (8) if ((&User-Name =~ /@/) && (&User-Name !~ /(a)(.+)\.(.+)$/)) -> FALSE (8) if (&User-Name =~ /\.$/) { (8) if (&User-Name =~ /\.$/) -> FALSE (8) if (&User-Name =~ /(a)\./) { (8) if (&User-Name =~ /(a)\./) -> FALSE (8) } # if (&User-Name) = notfound (8) } # policy filter_username = notfound (8) policy filter_password { (8) if (&User-Password && (&User-Password != "%{string:User-Password}")) { (8) if (&User-Password && (&User-Password != "%{string:User-Password}")) -> FALSE (8) } # policy filter_password = notfound (8) [preprocess] = ok (8) [chap] = noop (8) [mschap] = noop (8) [digest] = noop (8) suffix: Checking for suffix after "@" (8) suffix: No '@' in User-Name = "average", looking up realm NULL (8) suffix: No such realm "NULL" (8) [suffix] = noop (8) eap: Peer sent EAP Response (code 2) ID 9 length 136 (8) eap: Continuing tunnel setup (8) [eap] = ok (8) } # authorize = ok (8) Found Auth-Type = eap (8) # Executing group from file /usr/local/Cellar/freeradius-server/3.0.19/etc/raddb/sites-enabled/default (8) authenticate { (8) eap: Expiring EAP session with state 0x54567260535f6b34 (8) eap: Finished EAP session with state 0x54567260535f6b34 (8) eap: Previous EAP request found for state 0x54567260535f6b34, released from the list (8) eap: Peer sent packet with method EAP PEAP (25) (8) eap: Calling submodule eap_peap to process data (8) eap_peap: Continuing EAP-TLS (8) eap_peap: Peer indicated complete TLS record size will be 126 bytes (8) eap_peap: Got complete TLS record (126 bytes) (8) eap_peap: [eaptls verify] = length included (8) eap_peap: <<< recv TLS 1.2 [length 0046] (8) eap_peap: TLS_accept: unknown state (8) eap_peap: TLS_accept: unknown state (8) eap_peap: <<< recv TLS 1.2 [length 0001] (8) eap_peap: <<< recv TLS 1.2 [length 0010] (8) eap_peap: TLS_accept: unknown state (8) eap_peap: >>> send TLS 1.2 [length 0001] (8) eap_peap: TLS_accept: unknown state (8) eap_peap: >>> send TLS 1.2 [length 0010] (8) eap_peap: TLS_accept: unknown state (8) eap_peap: TLS_accept: unknown state (8) eap_peap: (other): SSL negotiation finished successfully (8) eap_peap: TLS - Connection Established (8) eap_peap: TLS-Session-Cipher-Suite = "ECDHE-RSA-AES256-GCM-SHA384" (8) eap_peap: TLS-Session-Version = "TLS 1.2" (8) eap_peap: TLS - got 51 bytes of data (8) eap_peap: [eaptls process] = handled (8) eap: Sending EAP Request (code 1) ID 10 length 57 (8) eap: EAP session adding &reply:State = 0x545672605c5c6b34 (8) [eap] = handled (8) } # authenticate = handled (8) Using Post-Auth-Type Challenge (8) # Executing group from file /usr/local/Cellar/freeradius-server/3.0.19/etc/raddb/sites-enabled/default (8) Challenge { ... } # empty sub-section is ignored (8) session-state: Saving cached attributes (8) TLS-Session-Cipher-Suite = "ECDHE-RSA-AES256-GCM-SHA384" (8) TLS-Session-Version = "TLS 1.2" (8) Sent Access-Challenge Id 22 from 10.0.0.3:1812 to 10.100.0.102:53924 length 0 (8) EAP-Message = 0x010a0039190014030300010116030300288dffdbeb985e68c3e2dbdf2952fe500f6a886ad0031c7c028d7fee84af7c25901faf40a4f6eea8f1 (8) Message-Authenticator = 0x00000000000000000000000000000000 (8) State = 0x545672605c5c6b3402c4bd3843c9e021 (8) Finished request Waking up in 1.7 seconds. (9) Received Access-Request Id 23 from 10.100.0.102:53924 to 10.0.0.3:1812 length 198 (9) User-Name = "average" (9) NAS-IP-Address = 10.100.0.100 (9) NAS-Port = 0 (9) NAS-Identifier = "10.100.0.102" (9) NAS-Port-Type = Wireless-802.11 (9) Calling-Station-Id = "8489AD6745C3" (9) Called-Station-Id = "001A1E05A6B8" (9) Service-Type = Framed-User (9) Framed-MTU = 1100 (9) EAP-Message = 0x020a00061900 (9) State = 0x545672605c5c6b3402c4bd3843c9e021 (9) Aruba-Essid-Name = "LSwifi" (9) Aruba-Location-Id = "B339" (9) Aruba-AP-Group = "lsrhs-main-ap-group" (9) Message-Authenticator = 0xbcad9541d46bc96cbdd95701e6f25dea (9) Restoring &session-state (9) &session-state:TLS-Session-Cipher-Suite = "ECDHE-RSA-AES256-GCM-SHA384" (9) &session-state:TLS-Session-Version = "TLS 1.2" (9) # Executing section authorize from file /usr/local/Cellar/freeradius-server/3.0.19/etc/raddb/sites-enabled/default (9) authorize { (9) policy filter_username { (9) if (&User-Name) { (9) if (&User-Name) -> TRUE (9) if (&User-Name) { (9) if (&User-Name =~ / /) { (9) if (&User-Name =~ / /) -> FALSE (9) if (&User-Name =~ /@[^@]*@/ ) { (9) if (&User-Name =~ /@[^@]*@/ ) -> FALSE (9) if (&User-Name =~ /\.\./ ) { (9) if (&User-Name =~ /\.\./ ) -> FALSE (9) if ((&User-Name =~ /@/) && (&User-Name !~ /(a)(.+)\.(.+)$/)) { (9) if ((&User-Name =~ /@/) && (&User-Name !~ /(a)(.+)\.(.+)$/)) -> FALSE (9) if (&User-Name =~ /\.$/) { (9) if (&User-Name =~ /\.$/) -> FALSE (9) if (&User-Name =~ /(a)\./) { (9) if (&User-Name =~ /(a)\./) -> FALSE (9) } # if (&User-Name) = notfound (9) } # policy filter_username = notfound (9) policy filter_password { (9) if (&User-Password && (&User-Password != "%{string:User-Password}")) { (9) if (&User-Password && (&User-Password != "%{string:User-Password}")) -> FALSE (9) } # policy filter_password = notfound (9) [preprocess] = ok (9) [chap] = noop (9) [mschap] = noop (9) [digest] = noop (9) suffix: Checking for suffix after "@" (9) suffix: No '@' in User-Name = "average", looking up realm NULL (9) suffix: No such realm "NULL" (9) [suffix] = noop (9) eap: Peer sent EAP Response (code 2) ID 10 length 6 (9) eap: Continuing tunnel setup (9) [eap] = ok (9) } # authorize = ok (9) Found Auth-Type = eap (9) # Executing group from file /usr/local/Cellar/freeradius-server/3.0.19/etc/raddb/sites-enabled/default (9) authenticate { (9) eap: Expiring EAP session with state 0x545672605c5c6b34 (9) eap: Finished EAP session with state 0x545672605c5c6b34 (9) eap: Previous EAP request found for state 0x545672605c5c6b34, released from the list (9) eap: Peer sent packet with method EAP PEAP (25) (9) eap: Calling submodule eap_peap to process data (9) eap_peap: Continuing EAP-TLS (9) eap_peap: Peer ACKed our handshake fragment. handshake is finished (9) eap_peap: [eaptls verify] = success (9) eap_peap: [eaptls process] = success (9) eap_peap: Session established. Decoding tunneled attributes (9) eap_peap: PEAP state TUNNEL ESTABLISHED (9) eap: Sending EAP Request (code 1) ID 11 length 40 (9) eap: EAP session adding &reply:State = 0x545672605d5d6b34 (9) [eap] = handled (9) } # authenticate = handled (9) Using Post-Auth-Type Challenge (9) # Executing group from file /usr/local/Cellar/freeradius-server/3.0.19/etc/raddb/sites-enabled/default (9) Challenge { ... } # empty sub-section is ignored (9) session-state: Saving cached attributes (9) TLS-Session-Cipher-Suite = "ECDHE-RSA-AES256-GCM-SHA384" (9) TLS-Session-Version = "TLS 1.2" (9) Sent Access-Challenge Id 23 from 10.0.0.3:1812 to 10.100.0.102:53924 length 0 (9) EAP-Message = 0x010b00281900170303001d8dffdbeb985e68c4c1607aeeb734e5a2316f3a81c5dc36a045fdf85114 (9) Message-Authenticator = 0x00000000000000000000000000000000 (9) State = 0x545672605d5d6b3402c4bd3843c9e021 (9) Finished request Waking up in 1.7 seconds. (10) Received Access-Request Id 24 from 10.100.0.102:53924 to 10.0.0.3:1812 length 235 (10) User-Name = "average" (10) NAS-IP-Address = 10.100.0.100 (10) NAS-Port = 0 (10) NAS-Identifier = "10.100.0.102" (10) NAS-Port-Type = Wireless-802.11 (10) Calling-Station-Id = "8489AD6745C3" (10) Called-Station-Id = "001A1E05A6B8" (10) Service-Type = Framed-User (10) Framed-MTU = 1100 (10) EAP-Message = 0x020b002b19001703030020fcd1cf9b8c26f1fd945baa0316d6481f050756ad86fdd8315d914066555aad3d (10) State = 0x545672605d5d6b3402c4bd3843c9e021 (10) Aruba-Essid-Name = "LSwifi" (10) Aruba-Location-Id = "B339" (10) Aruba-AP-Group = "lsrhs-main-ap-group" (10) Message-Authenticator = 0x50b30ad849acde1dbaf2240651affcdd (10) Restoring &session-state (10) &session-state:TLS-Session-Cipher-Suite = "ECDHE-RSA-AES256-GCM-SHA384" (10) &session-state:TLS-Session-Version = "TLS 1.2" (10) # Executing section authorize from file /usr/local/Cellar/freeradius-server/3.0.19/etc/raddb/sites-enabled/default (10) authorize { (10) policy filter_username { (10) if (&User-Name) { (10) if (&User-Name) -> TRUE (10) if (&User-Name) { (10) if (&User-Name =~ / /) { (10) if (&User-Name =~ / /) -> FALSE (10) if (&User-Name =~ /@[^@]*@/ ) { (10) if (&User-Name =~ /@[^@]*@/ ) -> FALSE (10) if (&User-Name =~ /\.\./ ) { (10) if (&User-Name =~ /\.\./ ) -> FALSE (10) if ((&User-Name =~ /@/) && (&User-Name !~ /(a)(.+)\.(.+)$/)) { (10) if ((&User-Name =~ /@/) && (&User-Name !~ /(a)(.+)\.(.+)$/)) -> FALSE (10) if (&User-Name =~ /\.$/) { (10) if (&User-Name =~ /\.$/) -> FALSE (10) if (&User-Name =~ /(a)\./) { (10) if (&User-Name =~ /(a)\./) -> FALSE (10) } # if (&User-Name) = notfound (10) } # policy filter_username = notfound (10) policy filter_password { (10) if (&User-Password && (&User-Password != "%{string:User-Password}")) { (10) if (&User-Password && (&User-Password != "%{string:User-Password}")) -> FALSE (10) } # policy filter_password = notfound (10) [preprocess] = ok (10) [chap] = noop (10) [mschap] = noop (10) [digest] = noop (10) suffix: Checking for suffix after "@" (10) suffix: No '@' in User-Name = "average", looking up realm NULL (10) suffix: No such realm "NULL" (10) [suffix] = noop (10) eap: Peer sent EAP Response (code 2) ID 11 length 43 (10) eap: Continuing tunnel setup (10) [eap] = ok (10) } # authorize = ok (10) Found Auth-Type = eap (10) # Executing group from file /usr/local/Cellar/freeradius-server/3.0.19/etc/raddb/sites-enabled/default (10) authenticate { (10) eap: Expiring EAP session with state 0x545672605d5d6b34 (10) eap: Finished EAP session with state 0x545672605d5d6b34 (10) eap: Previous EAP request found for state 0x545672605d5d6b34, released from the list (10) eap: Peer sent packet with method EAP PEAP (25) (10) eap: Calling submodule eap_peap to process data (10) eap_peap: Continuing EAP-TLS (10) eap_peap: [eaptls verify] = ok (10) eap_peap: Done initial handshake (10) eap_peap: [eaptls process] = ok (10) eap_peap: Session established. Decoding tunneled attributes (10) eap_peap: PEAP state WAITING FOR INNER IDENTITY (10) eap_peap: Identity - average (10) eap_peap: Got inner identity 'average' (10) eap_peap: Setting default EAP type for tunneled EAP session (10) eap_peap: Got tunneled request (10) eap_peap: EAP-Message = 0x020b000c0161766572616765 (10) eap_peap: Setting User-Name to average (10) eap_peap: Sending tunneled request to inner-tunnel (10) eap_peap: EAP-Message = 0x020b000c0161766572616765 (10) eap_peap: FreeRADIUS-Proxied-To = 127.0.0.1 (10) eap_peap: User-Name = "average" (10) Virtual server inner-tunnel received request (10) EAP-Message = 0x020b000c0161766572616765 (10) FreeRADIUS-Proxied-To = 127.0.0.1 (10) User-Name = "average" (10) WARNING: Outer and inner identities are the same. User privacy is compromised. (10) server inner-tunnel { (10) # Executing section authorize from file /usr/local/Cellar/freeradius-server/3.0.19/etc/raddb/sites-enabled/inner-tunnel (10) authorize { (10) policy filter_username { (10) if (&User-Name) { (10) if (&User-Name) -> TRUE (10) if (&User-Name) { (10) if (&User-Name =~ / /) { (10) if (&User-Name =~ / /) -> FALSE (10) if (&User-Name =~ /@[^@]*@/ ) { (10) if (&User-Name =~ /@[^@]*@/ ) -> FALSE (10) if (&User-Name =~ /\.\./ ) { (10) if (&User-Name =~ /\.\./ ) -> FALSE (10) if ((&User-Name =~ /@/) && (&User-Name !~ /(a)(.+)\.(.+)$/)) { (10) if ((&User-Name =~ /@/) && (&User-Name !~ /(a)(.+)\.(.+)$/)) -> FALSE (10) if (&User-Name =~ /\.$/) { (10) if (&User-Name =~ /\.$/) -> FALSE (10) if (&User-Name =~ /(a)\./) { (10) if (&User-Name =~ /(a)\./) -> FALSE (10) } # if (&User-Name) = notfound (10) } # policy filter_username = notfound (10) [chap] = noop (10) [mschap] = noop (10) suffix: Checking for suffix after "@" (10) suffix: No '@' in User-Name = "average", looking up realm NULL (10) suffix: No such realm "NULL" (10) [suffix] = noop (10) update control { (10) &Proxy-To-Realm := LOCAL (10) } # update control = noop (10) eap: Peer sent EAP Response (code 2) ID 11 length 12 (10) eap: EAP-Identity reply, returning 'ok' so we can short-circuit the rest of authorize (10) [eap] = ok (10) } # authorize = ok (10) Found Auth-Type = eap (10) # Executing group from file /usr/local/Cellar/freeradius-server/3.0.19/etc/raddb/sites-enabled/inner-tunnel (10) authenticate { (10) eap: Peer sent packet with method EAP Identity (1) (10) eap: Calling submodule eap_mschapv2 to process data (10) eap_mschapv2: Issuing Challenge (10) eap: Sending EAP Request (code 1) ID 12 length 43 (10) eap: EAP session adding &reply:State = 0x42072a37420b3078 (10) [eap] = handled (10) } # authenticate = handled (10) } # server inner-tunnel (10) Virtual server sending reply (10) EAP-Message = 0x010c002b1a010c002610745c7894a486ecfcf4f9683cfb994608667265657261646975732d332e302e3139 (10) Message-Authenticator = 0x00000000000000000000000000000000 (10) State = 0x42072a37420b30786166650813d23d53 (10) eap_peap: Got tunneled reply code 11 (10) eap_peap: EAP-Message = 0x010c002b1a010c002610745c7894a486ecfcf4f9683cfb994608667265657261646975732d332e302e3139 (10) eap_peap: Message-Authenticator = 0x00000000000000000000000000000000 (10) eap_peap: State = 0x42072a37420b30786166650813d23d53 (10) eap_peap: Got tunneled reply RADIUS code 11 (10) eap_peap: EAP-Message = 0x010c002b1a010c002610745c7894a486ecfcf4f9683cfb994608667265657261646975732d332e302e3139 (10) eap_peap: Message-Authenticator = 0x00000000000000000000000000000000 (10) eap_peap: State = 0x42072a37420b30786166650813d23d53 (10) eap_peap: Got tunneled Access-Challenge (10) eap: Sending EAP Request (code 1) ID 12 length 74 (10) eap: EAP session adding &reply:State = 0x545672605e5a6b34 (10) [eap] = handled (10) } # authenticate = handled (10) Using Post-Auth-Type Challenge (10) # Executing group from file /usr/local/Cellar/freeradius-server/3.0.19/etc/raddb/sites-enabled/default (10) Challenge { ... } # empty sub-section is ignored (10) session-state: Saving cached attributes (10) TLS-Session-Cipher-Suite = "ECDHE-RSA-AES256-GCM-SHA384" (10) TLS-Session-Version = "TLS 1.2" (10) Sent Access-Challenge Id 24 from 10.0.0.3:1812 to 10.100.0.102:53924 length 0 (10) EAP-Message = 0x010c004a1900170303003f8dffdbeb985e68c5e5d1f857bd3a006c4d6c5985309ee0c4b770649b3ad1651905b0f5c52ae50234542b1f8f9370dfb896b2a0f8e978e898d93be6d87a6a47 (10) Message-Authenticator = 0x00000000000000000000000000000000 (10) State = 0x545672605e5a6b3402c4bd3843c9e021 (10) Finished request Waking up in 1.7 seconds. (11) Received Access-Request Id 25 from 10.100.0.102:53924 to 10.0.0.3:1812 length 289 (11) User-Name = "average" (11) NAS-IP-Address = 10.100.0.100 (11) NAS-Port = 0 (11) NAS-Identifier = "10.100.0.102" (11) NAS-Port-Type = Wireless-802.11 (11) Calling-Station-Id = "8489AD6745C3" (11) Called-Station-Id = "001A1E05A6B8" (11) Service-Type = Framed-User (11) Framed-MTU = 1100 (11) EAP-Message = 0x020c006119001703030056fcd1cf9b8c26f1fe4073f711a14fd826e249b83dfc9b7c99959452eaaf720cf2b3b73779d2a5d7fcd210429d3180dbc482390f76aadca0ee350c078acb0bb1867cfecb28754cf977724d8afc116c73816011a630b497 (11) State = 0x545672605e5a6b3402c4bd3843c9e021 (11) Aruba-Essid-Name = "LSwifi" (11) Aruba-Location-Id = "B339" (11) Aruba-AP-Group = "lsrhs-main-ap-group" (11) Message-Authenticator = 0x6dfe59a2fd29d360d88b9b59739211a2 (11) Restoring &session-state (11) &session-state:TLS-Session-Cipher-Suite = "ECDHE-RSA-AES256-GCM-SHA384" (11) &session-state:TLS-Session-Version = "TLS 1.2" (11) # Executing section authorize from file /usr/local/Cellar/freeradius-server/3.0.19/etc/raddb/sites-enabled/default (11) authorize { (11) policy filter_username { (11) if (&User-Name) { (11) if (&User-Name) -> TRUE (11) if (&User-Name) { (11) if (&User-Name =~ / /) { (11) if (&User-Name =~ / /) -> FALSE (11) if (&User-Name =~ /@[^@]*@/ ) { (11) if (&User-Name =~ /@[^@]*@/ ) -> FALSE (11) if (&User-Name =~ /\.\./ ) { (11) if (&User-Name =~ /\.\./ ) -> FALSE (11) if ((&User-Name =~ /@/) && (&User-Name !~ /(a)(.+)\.(.+)$/)) { (11) if ((&User-Name =~ /@/) && (&User-Name !~ /(a)(.+)\.(.+)$/)) -> FALSE (11) if (&User-Name =~ /\.$/) { (11) if (&User-Name =~ /\.$/) -> FALSE (11) if (&User-Name =~ /(a)\./) { (11) if (&User-Name =~ /(a)\./) -> FALSE (11) } # if (&User-Name) = notfound (11) } # policy filter_username = notfound (11) policy filter_password { (11) if (&User-Password && (&User-Password != "%{string:User-Password}")) { (11) if (&User-Password && (&User-Password != "%{string:User-Password}")) -> FALSE (11) } # policy filter_password = notfound (11) [preprocess] = ok (11) [chap] = noop (11) [mschap] = noop (11) [digest] = noop (11) suffix: Checking for suffix after "@" (11) suffix: No '@' in User-Name = "average", looking up realm NULL (11) suffix: No such realm "NULL" (11) [suffix] = noop (11) eap: Peer sent EAP Response (code 2) ID 12 length 97 (11) eap: Continuing tunnel setup (11) [eap] = ok (11) } # authorize = ok (11) Found Auth-Type = eap (11) # Executing group from file /usr/local/Cellar/freeradius-server/3.0.19/etc/raddb/sites-enabled/default (11) authenticate { (11) eap: Expiring EAP session with state 0x42072a37420b3078 (11) eap: Finished EAP session with state 0x545672605e5a6b34 (11) eap: Previous EAP request found for state 0x545672605e5a6b34, released from the list (11) eap: Peer sent packet with method EAP PEAP (25) (11) eap: Calling submodule eap_peap to process data (11) eap_peap: Continuing EAP-TLS (11) eap_peap: [eaptls verify] = ok (11) eap_peap: Done initial handshake (11) eap_peap: [eaptls process] = ok (11) eap_peap: Session established. Decoding tunneled attributes (11) eap_peap: PEAP state phase2 (11) eap_peap: EAP method MSCHAPv2 (26) (11) eap_peap: Got tunneled request (11) eap_peap: EAP-Message = 0x020c00421a020c003d3197cbe3fdca4e339f53ada1b2ea7502360000000000000000cbfb303c4e912de85bdde107942837c08bc69bee796812430061766572616765 (11) eap_peap: Setting User-Name to average (11) eap_peap: Sending tunneled request to inner-tunnel (11) eap_peap: EAP-Message = 0x020c00421a020c003d3197cbe3fdca4e339f53ada1b2ea7502360000000000000000cbfb303c4e912de85bdde107942837c08bc69bee796812430061766572616765 (11) eap_peap: FreeRADIUS-Proxied-To = 127.0.0.1 (11) eap_peap: User-Name = "average" (11) eap_peap: State = 0x42072a37420b30786166650813d23d53 (11) Virtual server inner-tunnel received request (11) EAP-Message = 0x020c00421a020c003d3197cbe3fdca4e339f53ada1b2ea7502360000000000000000cbfb303c4e912de85bdde107942837c08bc69bee796812430061766572616765 (11) FreeRADIUS-Proxied-To = 127.0.0.1 (11) User-Name = "average" (11) State = 0x42072a37420b30786166650813d23d53 (11) WARNING: Outer and inner identities are the same. User privacy is compromised. (11) server inner-tunnel { (11) session-state: No cached attributes (11) # Executing section authorize from file /usr/local/Cellar/freeradius-server/3.0.19/etc/raddb/sites-enabled/inner-tunnel (11) authorize { (11) policy filter_username { (11) if (&User-Name) { (11) if (&User-Name) -> TRUE (11) if (&User-Name) { (11) if (&User-Name =~ / /) { (11) if (&User-Name =~ / /) -> FALSE (11) if (&User-Name =~ /@[^@]*@/ ) { (11) if (&User-Name =~ /@[^@]*@/ ) -> FALSE (11) if (&User-Name =~ /\.\./ ) { (11) if (&User-Name =~ /\.\./ ) -> FALSE (11) if ((&User-Name =~ /@/) && (&User-Name !~ /(a)(.+)\.(.+)$/)) { (11) if ((&User-Name =~ /@/) && (&User-Name !~ /(a)(.+)\.(.+)$/)) -> FALSE (11) if (&User-Name =~ /\.$/) { (11) if (&User-Name =~ /\.$/) -> FALSE (11) if (&User-Name =~ /(a)\./) { (11) if (&User-Name =~ /(a)\./) -> FALSE (11) } # if (&User-Name) = notfound (11) } # policy filter_username = notfound (11) [chap] = noop (11) [mschap] = noop (11) suffix: Checking for suffix after "@" (11) suffix: No '@' in User-Name = "average", looking up realm NULL (11) suffix: No such realm "NULL" (11) [suffix] = noop (11) update control { (11) &Proxy-To-Realm := LOCAL (11) } # update control = noop (11) eap: Peer sent EAP Response (code 2) ID 12 length 66 (11) eap: No EAP Start, assuming it's an on-going EAP conversation (11) [eap] = updated (11) [files] = noop (11) opendirectory: The SACL group "com.apple.access_radius" does not exist on this system. (11) opendirectory: The host 10.100.0.102 does not have an access group. (11) opendirectory: no access control groups, all users allowed (11) [opendirectory] = ok (11) [expiration] = noop (11) [logintime] = noop (11) [pap] = noop (11) if (noop && User-Password) { (11) if (noop && User-Password) -> FALSE (11) } # authorize = updated (11) Found Auth-Type = eap (11) # Executing group from file /usr/local/Cellar/freeradius-server/3.0.19/etc/raddb/sites-enabled/inner-tunnel (11) authenticate { (11) eap: Expiring EAP session with state 0x42072a37420b3078 (11) eap: Finished EAP session with state 0x42072a37420b3078 (11) eap: Previous EAP request found for state 0x42072a37420b3078, released from the list (11) eap: Peer sent packet with method EAP MSCHAPv2 (26) (11) eap: Calling submodule eap_mschapv2 to process data (11) eap_mschapv2: # Executing group from file /usr/local/Cellar/freeradius-server/3.0.19/etc/raddb/sites-enabled/inner-tunnel (11) eap_mschapv2: authenticate { (11) mschap: WARNING: No Cleartext-Password configured. Cannot create NT-Password (11) mschap: WARNING: No Cleartext-Password configured. Cannot create LM-Password (11) mschap: No NT-Password configured. Trying OpenDirectory Authentication (11) mschap: OD username_string = average, OD shortUserName=average? (length = 8) (11) mschap: ERROR: rlm_mschap: authentication failed - status = eUndefinedError (11) eap_mschapv2: [mschap] = reject (11) eap_mschapv2: } # authenticate = reject (11) eap: Sending EAP Failure (code 4) ID 12 length 4 (11) eap: Freeing handler (11) [eap] = reject (11) } # authenticate = reject (11) Failed to authenticate the user (11) Using Post-Auth-Type Reject (11) # Executing group from file /usr/local/Cellar/freeradius-server/3.0.19/etc/raddb/sites-enabled/inner-tunnel (11) Post-Auth-Type REJECT { (11) attr_filter.access_reject: EXPAND %{User-Name} (11) attr_filter.access_reject: --> average (11) attr_filter.access_reject: Matched entry DEFAULT at line 11 (11) [attr_filter.access_reject] = updated (11) update outer.session-state { (11) &Module-Failure-Message := &request:Module-Failure-Message -> 'mschap: rlm_mschap: authentication failed - status = eUndefinedError' (11) } # update outer.session-state = noop (11) } # Post-Auth-Type REJECT = updated (11) } # server inner-tunnel (11) Virtual server sending reply (11) EAP-Message = 0x040c0004 (11) Message-Authenticator = 0x00000000000000000000000000000000 (11) eap_peap: Got tunneled reply code 3 (11) eap_peap: EAP-Message = 0x040c0004 (11) eap_peap: Message-Authenticator = 0x00000000000000000000000000000000 (11) eap_peap: Got tunneled reply RADIUS code 3 (11) eap_peap: EAP-Message = 0x040c0004 (11) eap_peap: Message-Authenticator = 0x00000000000000000000000000000000 (11) eap_peap: Tunneled authentication was rejected (11) eap_peap: FAILURE (11) eap: Sending EAP Request (code 1) ID 13 length 46 (11) eap: EAP session adding &reply:State = 0x545672605f5b6b34 (11) [eap] = handled (11) } # authenticate = handled (11) Using Post-Auth-Type Challenge (11) # Executing group from file /usr/local/Cellar/freeradius-server/3.0.19/etc/raddb/sites-enabled/default (11) Challenge { ... } # empty sub-section is ignored (11) session-state: Saving cached attributes (11) TLS-Session-Cipher-Suite = "ECDHE-RSA-AES256-GCM-SHA384" (11) TLS-Session-Version = "TLS 1.2" (11) Module-Failure-Message := "mschap: rlm_mschap: authentication failed - status = eUndefinedError" (11) Sent Access-Challenge Id 25 from 10.0.0.3:1812 to 10.100.0.102:53924 length 0 (11) EAP-Message = 0x010d002e190017030300238dffdbeb985e68c67ce7e0ff1b57738c7654a6125e8aecaef97a03a6ad1419582c93f0 (11) Message-Authenticator = 0x00000000000000000000000000000000 (11) State = 0x545672605f5b6b3402c4bd3843c9e021 (11) Finished request Waking up in 1.7 seconds. (12) Received Access-Request Id 26 from 10.100.0.102:53924 to 10.0.0.3:1812 length 238 (12) User-Name = "average" (12) NAS-IP-Address = 10.100.0.100 (12) NAS-Port = 0 (12) NAS-Identifier = "10.100.0.102" (12) NAS-Port-Type = Wireless-802.11 (12) Calling-Station-Id = "8489AD6745C3" (12) Called-Station-Id = "001A1E05A6B8" (12) Service-Type = Framed-User (12) Framed-MTU = 1100 (12) EAP-Message = 0x020d002e19001703030023fcd1cf9b8c26f1ffa0472f7f4d0c7b282710036d9fbd1285f7b20d51f0cf185e24be37 (12) State = 0x545672605f5b6b3402c4bd3843c9e021 (12) Aruba-Essid-Name = "LSwifi" (12) Aruba-Location-Id = "B339" (12) Aruba-AP-Group = "lsrhs-main-ap-group" (12) Message-Authenticator = 0x32db44d57d93d5c0fdb2e3f3c8019c80 (12) Restoring &session-state (12) &session-state:TLS-Session-Cipher-Suite = "ECDHE-RSA-AES256-GCM-SHA384" (12) &session-state:TLS-Session-Version = "TLS 1.2" (12) &session-state:Module-Failure-Message := "mschap: rlm_mschap: authentication failed - status = eUndefinedError" (12) # Executing section authorize from file /usr/local/Cellar/freeradius-server/3.0.19/etc/raddb/sites-enabled/default (12) authorize { (12) policy filter_username { (12) if (&User-Name) { (12) if (&User-Name) -> TRUE (12) if (&User-Name) { (12) if (&User-Name =~ / /) { (12) if (&User-Name =~ / /) -> FALSE (12) if (&User-Name =~ /@[^@]*@/ ) { (12) if (&User-Name =~ /@[^@]*@/ ) -> FALSE (12) if (&User-Name =~ /\.\./ ) { (12) if (&User-Name =~ /\.\./ ) -> FALSE (12) if ((&User-Name =~ /@/) && (&User-Name !~ /(a)(.+)\.(.+)$/)) { (12) if ((&User-Name =~ /@/) && (&User-Name !~ /(a)(.+)\.(.+)$/)) -> FALSE (12) if (&User-Name =~ /\.$/) { (12) if (&User-Name =~ /\.$/) -> FALSE (12) if (&User-Name =~ /(a)\./) { (12) if (&User-Name =~ /(a)\./) -> FALSE (12) } # if (&User-Name) = notfound (12) } # policy filter_username = notfound (12) policy filter_password { (12) if (&User-Password && (&User-Password != "%{string:User-Password}")) { (12) if (&User-Password && (&User-Password != "%{string:User-Password}")) -> FALSE (12) } # policy filter_password = notfound (12) [preprocess] = ok (12) [chap] = noop (12) [mschap] = noop (12) [digest] = noop (12) suffix: Checking for suffix after "@" (12) suffix: No '@' in User-Name = "average", looking up realm NULL (12) suffix: No such realm "NULL" (12) [suffix] = noop (12) eap: Peer sent EAP Response (code 2) ID 13 length 46 (12) eap: Continuing tunnel setup (12) [eap] = ok (12) } # authorize = ok (12) Found Auth-Type = eap (12) # Executing group from file /usr/local/Cellar/freeradius-server/3.0.19/etc/raddb/sites-enabled/default (12) authenticate { (12) eap: Expiring EAP session with state 0x545672605f5b6b34 (12) eap: Finished EAP session with state 0x545672605f5b6b34 (12) eap: Previous EAP request found for state 0x545672605f5b6b34, released from the list (12) eap: Peer sent packet with method EAP PEAP (25) (12) eap: Calling submodule eap_peap to process data (12) eap_peap: Continuing EAP-TLS (12) eap_peap: [eaptls verify] = ok (12) eap_peap: Done initial handshake (12) eap_peap: [eaptls process] = ok (12) eap_peap: Session established. Decoding tunneled attributes (12) eap_peap: PEAP state send tlv failure (12) eap_peap: Received EAP-TLV response (12) eap_peap: ERROR: The users session was previously rejected: returning reject (again.) (12) eap_peap: This means you need to read the PREVIOUS messages in the debug output (12) eap_peap: to find out the reason why the user was rejected (12) eap_peap: Look for "reject" or "fail". Those earlier messages will tell you (12) eap_peap: what went wrong, and how to fix the problem (12) eap: ERROR: Failed continuing EAP PEAP (25) session. EAP sub-module failed (12) eap: Sending EAP Failure (code 4) ID 13 length 4 (12) eap: Failed in EAP select (12) [eap] = invalid (12) } # authenticate = invalid (12) Failed to authenticate the user (12) Using Post-Auth-Type Reject (12) # Executing group from file /usr/local/Cellar/freeradius-server/3.0.19/etc/raddb/sites-enabled/default (12) Post-Auth-Type REJECT { (12) attr_filter.access_reject: EXPAND %{User-Name} (12) attr_filter.access_reject: --> average (12) attr_filter.access_reject: Matched entry DEFAULT at line 11 (12) [attr_filter.access_reject] = updated (12) [eap] = noop (12) policy remove_reply_message_if_eap { (12) if (&reply:EAP-Message && &reply:Reply-Message) { (12) if (&reply:EAP-Message && &reply:Reply-Message) -> FALSE (12) else { (12) [noop] = noop (12) } # else = noop (12) } # policy remove_reply_message_if_eap = noop (12) } # Post-Auth-Type REJECT = updated (12) Delaying response for 1.000000 seconds Waking up in 0.3 seconds. Waking up in 0.6 seconds. (12) Sending delayed response (12) Sent Access-Reject Id 26 from 10.0.0.3:1812 to 10.100.0.102:53924 length 44 (12) EAP-Message = 0x040d0004 (12) Message-Authenticator = 0x00000000000000000000000000000000 Waking up in 0.6 seconds. (0) Cleaning up request packet ID 14 with timestamp +29 (1) Cleaning up request packet ID 15 with timestamp +29 (2) Cleaning up request packet ID 16 with timestamp +29 (3) Cleaning up request packet ID 17 with timestamp +29 (4) Cleaning up request packet ID 18 with timestamp +29 (5) Cleaning up request packet ID 19 with timestamp +29 (6) Cleaning up request packet ID 20 with timestamp +29 (7) Cleaning up request packet ID 21 with timestamp +29 Waking up in 3.2 seconds. (8) Cleaning up request packet ID 22 with timestamp +32 (9) Cleaning up request packet ID 23 with timestamp +32 (10) Cleaning up request packet ID 24 with timestamp +32 (11) Cleaning up request packet ID 25 with timestamp +32 (12) Cleaning up request packet ID 26 with timestamp +32 Ready to process requests ^CDebugger detected, raising SIGTRAP Trace/BPT trap: 5 lsadmin:~ admin$

4 5

Windows10 PEAP: "Could not find Pool-Name attribute"
by Volodymyr Litovka 17 Sep '19

17 Sep '19

Dear colleagues, I’m facing a problem connecting Windows 10 client to Strongswan (IKEv2) with Freeradius as AAA backend. Configuration of Freeradius is almost untouched and it works like a charm for OSX->Strongswan clients: - added ippool to mods-enabled (main_pool) - enabled main_pool in ‘default’ site in ‘post-auth’ and ‘accounting’ sections Unlike OSX, Windows10 falls into PEAP conversation, thus I modified sites-enabled/inner-tunnel - added main_pool into ‘post-auth’ section as well. Output from ‘freeradius -X' is available at the following link: https://pastebin.com/FKFep8Za where you can see that until and during step (8) Freeradius successfully authenticates user, assigns Framed-IP-Address from the pool and returns it (line 926) for further processing, but during step (9) it tries to do the same (line 1034) and fails. It either don’t see Framed-IP-Address attribute or losing information about main_pool during passes over inner-tunnel? User definition is quite simple: aeris Cleartext-Password := "q1w2e3", Pool-Name := main_pool Service-Type = Framed-User Removing main_pool from sites-enabled/inner-tunnel (in order to leave this to sites/default) changed nothing - same message "Could not find Pool-Name attribute” appears in log. I tried to play with some configurations parameters in mods-enabled/eap (copy_request_to_tunnel, use_tunneled_reply), sites-enabled/inner-tunnel (if(0)/if(1)) but since I don’t clearly understand for what they’re responsible, I've got no success. Can anybody point me to the cause of the problem? Thank you. -- Volodymyr Litovka "Vision without Execution is Hallucination." -- Thomas Edison

2 3