- Freeradius-Users - lists.freeradius.org

Module sqlippool and logs
by Rafael Ganascim 27 Aug '19

27 Aug '19

Hello all, I'm using freeradius 3.0.19. I have three sqlippool modules configured and working in my radius server (for ipv4, ipv6 and ipv6pd). For now, I want to enable the logs via linelog for the three instances, but I'm getting messages only from the first one, even when I declare three linelog instances. Here is the debug: >From IPV4 module: (67191) Mon Aug 26 16:27:43 2019: Debug: IPV4: EXPAND Released IP %{Framed-IP-Address} (did %{Called-Station-Id} cli %{Calling-Station-Id} user %{User-Name}) (67191) Mon Aug 26 16:27:43 2019: Debug: IPV4: --> Released IP x.x.x.x (did cli BRAS-31#914508 user xxxxx@xxxxxxxx) (67191) Mon Aug 26 16:27:43 2019: Debug: [IPV4] = ok (67191) Mon Aug 26 16:27:43 2019: Debug: if (control:Module-Success-Message) { (67191) Mon Aug 26 16:27:43 2019: Debug: if (control:Module-Success-Message) -> TRUE (67191) Mon Aug 26 16:27:43 2019: Debug: if (control:Module-Success-Message) { (67191) Mon Aug 26 16:27:43 2019: Debug: linelog: EXPAND %t %{control:Module-Success-Message} (67191) Mon Aug 26 16:27:43 2019: Debug: linelog: --> Mon Aug 26 16:27:43 2019 Released IP 201.x.x.x (did cli BRAS-31#914508 user xxxxx@xxxxxxxx) (67191) Mon Aug 26 16:27:43 2019: Debug: linelog: EXPAND /var/log/radius/radius.log (67191) Mon Aug 26 16:27:43 2019: Debug: linelog: --> /var/log/radius/radius.log (67191) Mon Aug 26 16:27:43 2019: Debug: [linelog] = ok (67191) Mon Aug 26 16:27:43 2019: Debug: } # if (control:Module-Success-Message) = ok >From IPV6PD module: (67191) Mon Aug 26 16:27:43 2019: Debug: IPV6PD: EXPAND Released IPv6PD %{Delegated-IPv6-Prefix} (did %{Called-Station-Id} cli %{Calling-Station-Id} user %{User-Name}) (67191) Mon Aug 26 16:27:43 2019: Debug: IPV6PD: --> Released IPv6PD 2804:xxxx/56 (did cli BRAS-31#914508 user xxxxx@xxxxxxxx) (67191) Mon Aug 26 16:27:43 2019: Debug: [IPV6PD] = ok (67191) Mon Aug 26 16:27:43 2019: Debug: linelogv6: EXPAND %t %{control:Module-Success-Message} (67191) Mon Aug 26 16:27:43 2019: Debug: linelogv6: --> Mon Aug 26 16:27:43 2019 Released IP 201.x.x.x (did cli BRAS-31#914508 user xxxxx@xxxxxxxx) (67191) Mon Aug 26 16:27:43 2019: Debug: linelogv6: EXPAND /var/log/radius/radius.log (67191) Mon Aug 26 16:27:43 2019: Debug: linelogv6: --> /var/log/radius/radius.log The linelog config is the same for both instances: linelog linelogv6 { filename = ${logdir}/radius.log escape_filenames = no permissions = 0600 format = "%t %{control:Module-Success-Message}" } The module SQLIPPOOL expands correctly to the IPv6PD address, but the linelog is only getting the data from the first IPv4 instance. Is it possible to get the last %{control:Module-Success-Message} instead of the first one? Regards, Rafael

2 6

Many Mac Addresses to several Vlan ID's Authentication(Aruba Switch) - How to deploy?
by Sabic, Enes 27 Aug '19

27 Aug '19

Hello I'm new to freeradius and not experienced. We've have 6 VlanID's in our deployment to special Images. So, we're deploying about 100 clients with these special images every day. We made a powershell script on windows where we can put in Mac Addresses and vlan id's. After putting in these entries, the script copies it to the freeradius server /tmp/mac2vlan.txt In the documentation there is a mac2vlan file. So the problem is how to deploy these mac addresses and vlan id's to this mac2vlan file? Will it be a good idea to make a mariadb import from /tmp/mac2vlan into the table(with two entries - one is macaddress and the other vlanid) or to work with the mac2vlan file itself?? I don't know how to approach this problem? I hope you understand what I mean.... Br, Enes

2 1

External shell script return value for inner-tunnel
by Trevor Jennings 27 Aug '19

27 Aug '19

Hello, We have been using FreeRadius for a long time and now we are in the process of doing dynamic vlan assignments for EAP clients based on a custom AD attribute "persontype". I created a new module called bowdpersontype which does a LDAP search for the user to pull their persontype attribute, then placed this under eap in the inner tunnel. Testing vlan assignment works here, however I want to base their vlan on what their attribute is, for example staff, faculty, admin. This part is easy, however I'm not sure on how I use the value returned in the external script. My module looks like this:- --- exec bowdpersontype { wait = yes output_pairs = reply shell_escape = yes program = "/etc/freeradius/testldap.sh %{Stripped-User-Name}" } --- This test script will output:- echo "UserType=$bowdpersontype" And the inner tunnel:- --- bowdpersontype if (UserType =~ /STAFF/) { update reply { ..... ..... } } --- The debug output does show me the result from the external script and 'ok' message. How do I read the value to be used after the call? Cheers, - Trevor

3 2

Auth: (24) Login incorrect (No Auth-Type found: rejecting the user via Post-Auth-Type = Reject):
by Gilbert Rebeiro 25 Aug '19

25 Aug '19

I'm migrating a functioning freeradius install version 2.2.8 on ubuntu 16.04 LTS to version 3.0.16 on ubuntu 18.04 LTS I setup daloradius this time. I've setup my clients I've setup my users I deliver DSL and do auth and assign static IP addresses I need radius to return the Framed-IP-Address attribute if required This is all in mysql and I need accounting to be stored in mysql also. So far I'm getting this: Auth: (24) Login incorrect (No Auth-Type found: rejecting the user via Post-Auth-Type = Reject): [test(a)xxx.xxxx.xx/!yyyyyyyy!] (from client 999.888.777.666 port 268439551 cli xxxxxxadsfad-47:621) Any suggestions? Thank you. G

4 10

wifi 802.11 to pap and perl handoff
by Linux Threads 23 Aug '19

23 Aug '19

Hi FR Users, please can you guide me how to handoff my wifi auth username and password to FR outer-el via PAP and then pass the username and password to linotp perl script via the inner-tunnel tried to follow this http://lists.freeradius.org/pipermail/freeradius-users/2016-November/085830… however not getting it to work Fri Aug 23 12:28:17 2019 : Debug: (3) Auth-Type Perl { Fri Aug 23 12:28:17 2019 : Debug: (3) modsingle[authenticate]: calling perl (rlm_perl) Fri Aug 23 12:28:17 2019 : Debug: (3) perl: $RAD_REQUEST{'User-Name'} = &request:User-Name -> 'user(a)domain.com' Fri Aug 23 12:28:17 2019 : Debug: (3) perl: $RAD_REQUEST{'NAS-IP-Address'} = &request:NAS-IP-Address -> '10.0.1.200' Fri Aug 23 12:28:17 2019 : Debug: (3) perl: $RAD_REQUEST{'NAS-Port'} = &request:NAS-Port -> '0' Fri Aug 23 12:28:17 2019 : Debug: (3) perl: $RAD_REQUEST{'Framed-MTU'} = &request:Framed-MTU -> '1400' Fri Aug 23 12:28:17 2019 : Debug: (3) perl: $RAD_REQUEST{'State'} = &request:State -> '0xddf0c4bcddf2c0541f3e258e95c5a160' Fri Aug 23 12:28:17 2019 : Debug: (3) perl: $RAD_REQUEST{'Called-Station-Id'} = &request:Called-Station-Id -> '60-03-47-12-C5-7F' Fri Aug 23 12:28:17 2019 : Debug: (3) perl: $RAD_REQUEST{'Calling-Station-Id'} = &request:Calling-Station-Id -> 'A0-D3-7A-2A-9F-B3' Fri Aug 23 12:28:17 2019 : Debug: (3) perl: $RAD_REQUEST{'NAS-Port-Type'} = &request:NAS-Port-Type -> 'Wireless-802.11' Fri Aug 23 12:28:17 2019 : Debug: (3) perl: $RAD_REQUEST{'Event-Timestamp'} = &request:Event-Timestamp -> 'Aug 23 2019 12:28:17 SAST' Fri Aug 23 12:28:17 2019 : Debug: (3) perl: $RAD_REQUEST{'EAP-Message'} = &request:EAP-Message -> '0x020200060315' Fri Aug 23 12:28:17 2019 : Debug: (3) perl: $RAD_REQUEST{'Message-Authenticator'} = &request:Message-Authenticator -> '0x6bc127eb10d5809e9d53dd36e30ffa26' Fri Aug 23 12:28:17 2019 : Debug: (3) perl: $RAD_REQUEST{'EAP-Type'} = &request:EAP-Type -> 'NAK' Fri Aug 23 12:28:17 2019 : Debug: (3) perl: $RAD_CHECK{'Auth-Type'} = &control:Auth-Type -> 'Perl' Fri Aug 23 12:28:17 2019 : Debug: (3) perl: $RAD_CONFIG{'Auth-Type'} = &control:Auth-Type -> 'Perl' Fri Aug 23 12:28:17 2019 : Debug: (3) perl: &request:Framed-MTU = $RAD_REQUEST{'Framed-MTU'} -> '1400' Fri Aug 23 12:28:17 2019 : Debug: (3) perl: &request:User-Name = $RAD_REQUEST{'User-Name'} -> 'user(a)domain.com' Fri Aug 23 12:28:17 2019 : Debug: (3) perl: &request:State = $RAD_REQUEST{'State'} -> '0xddf0c4bcddf2c0541f3e258e95c5a160' Fri Aug 23 12:28:17 2019 : Debug: (3) perl: &request:EAP-Message = $RAD_REQUEST{'EAP-Message'} -> '0x020200060315' Fri Aug 23 12:28:17 2019 : Debug: (3) perl: &request:Called-Station-Id = $RAD_REQUEST{'Called-Station-Id'} -> '60-03-47-12-C5-7F' Fri Aug 23 12:28:17 2019 : Debug: (3) perl: &request:NAS-IP-Address = $RAD_REQUEST{'NAS-IP-Address'} -> '10.0.1.200' Fri Aug 23 12:28:17 2019 : Debug: (3) perl: &request:Calling-Station-Id = $RAD_REQUEST{'Calling-Station-Id'} -> 'A0-D3-7A-2A-9F-B3' Fri Aug 23 12:28:17 2019 : Debug: (3) perl: &request:Event-Timestamp = $RAD_REQUEST{'Event-Timestamp'} -> 'Aug 23 2019 12:28:17 SAST' Fri Aug 23 12:28:17 2019 : Debug: (3) perl: &request:NAS-Port-Type = $RAD_REQUEST{'NAS-Port-Type'} -> 'Wireless-802.11' Fri Aug 23 12:28:17 2019 : Debug: (3) perl: &request:Message-Authenticator = $RAD_REQUEST{'Message-Authenticator'} -> '0x6bc127eb10d5809e9d53dd36e30ffa26' Fri Aug 23 12:28:17 2019 : Debug: (3) perl: &request:EAP-Type = $RAD_REQUEST{'EAP-Type'} -> 'NAK' Fri Aug 23 12:28:17 2019 : Debug: (3) perl: &request:NAS-Port = $RAD_REQUEST{'NAS-Port'} -> '0' Fri Aug 23 12:28:17 2019 : Debug: (3) perl: &reply:Reply-Message = $RAD_REPLY{'Reply-Message'} -> 'LinOTP server denied access!' Fri Aug 23 12:28:17 2019 : Debug: (3) perl: &control:Auth-Type = $RAD_CHECK{'Auth-Type'} -> 'Perl' Fri Aug 23 12:28:17 2019 : Debug: (3) modsingle[authenticate]: returned from perl (rlm_perl) Fri Aug 23 12:28:17 2019 : Debug: (3) [perl] = reject Fri Aug 23 12:28:17 2019 : Debug: (3) } # Auth-Type Perl = reject Fri Aug 23 12:28:17 2019 : Debug: (3) Failed to authenticate the user Fri Aug 23 12:28:17 2019 : Debug: (3) Using Post-Auth-Type Reject Fri Aug 23 12:28:17 2019 : Debug: (3) # Executing group from file /etc/freeradius/3.0/sites-enabled/default Fri Aug 23 12:28:17 2019 : Debug: (3) Post-Auth-Type REJECT { Fri Aug 23 12:28:17 2019 : Debug: (3) modsingle[post-auth]: calling attr_filter.access_reject (rlm_attr_filter) Regards Juan

2 2

How to limit internet bandwidth consumption by radius
by juliana sales porto 22 Aug '19

22 Aug '19

Hello everyone, I would like to know how I can limit bandwidth consumption by radusergroup on freeradius for aruba equipment. By Mikrotik I use the parameters username, groupname and the user authenticates to the hotspot with this bandwidth navigation limit I would like to know if is possible do the same to aruba Att, Juliana Porto

4 3

freeradius with UNIFI APs
by Nawar Al Tarazi 22 Aug '19

22 Aug '19

I have a problem , My freeradius Server works with Radtest , with Normal Home Router but not with UNIFI APs , he is the debug , The Server send the Access-Accept but the AP seems to not accept the connection from the Server my Hardware is Unifi please Help (0) Received Access-Request Id 4 from 192.168.1.6:44463 to 192.168.1.10:1812 length 245 (0) User-Name = "oktaradius(a)contentful.com" (0) NAS-IP-Address = 192.168.1.6 (0) NAS-Identifier = "F09FC2307B82D74DA8A1" (0) Called-Station-Id = "F0-9F-C2-32-7B-82:Seko" (0) NAS-Port-Type = Wireless-802.11 (0) Service-Type = Framed-User (0) Calling-Station-Id = "8C-85-90-C9-C4-A5" (0) Connect-Info = "CONNECT 0Mbps 802.11b" (0) Acct-Session-Id = "9CDA00101279DBED" (0) WLAN-Pairwise-Cipher = 1027076 (0) WLAN-Group-Cipher = 1027074 (0) WLAN-AKM-Suite = 1027073 (0) Framed-MTU = 1400 (0) EAP-Message = 0x0216001e016f6b746172616469757340636f6e74656e7466756c2e636f6d (0) Message-Authenticator = 0xeec65192e2ddf53d4d33db8190adf232 (0) # Executing section authorize from file /etc/freeradius/3.0/sites-enabled/inner-tunnel (0) authorize { (0) update control { (0) Proxy-To-Realm := LOCAL (0) } # update control = noop (0) eap: Peer sent EAP Response (code 2) ID 22 length 30 (0) eap: EAP-Identity reply, returning 'ok' so we can short-circuit the rest of authorize (0) [eap] = ok (0) } # authorize = ok (0) Found Auth-Type = eap (0) # Executing group from file /etc/freeradius/3.0/sites-enabled/inner-tunnel (0) authenticate { (0) eap: Peer sent packet with method EAP Identity (1) (0) eap: Calling submodule eap_ttls to process data (0) eap_ttls: Initiating new EAP-TLS session (0) eap_ttls: [eaptls start] = request (0) eap: Sending EAP Request (code 1) ID 23 length 6 (0) eap: EAP session adding &reply:State = 0xfaa47198fab36411 (0) [eap] = handled (0) } # authenticate = handled (0) Using Post-Auth-Type Challenge (0) Post-Auth-Type sub-section not found. Ignoring. (0) # Executing group from file /etc/freeradius/3.0/sites-enabled/inner-tunnel (0) Sent Access-Challenge Id 4 from 192.168.1.10:1812 to 192.168.1.6:44463 length 0 (0) EAP-Message = 0x011700061520 (0) Message-Authenticator = 0x00000000000000000000000000000000 (0) State = 0xfaa47198fab36411baefeb91c43d0602 (0) Finished request Waking up in 4.9 seconds. (1) Received Access-Request Id 5 from 192.168.1.6:44463 to 192.168.1.10:1812 length 394 (1) User-Name = "oktaradius(a)contentful.com" (1) NAS-IP-Address = 192.168.1.6 (1) NAS-Identifier = "F09FC2307B82D74DA8A1" (1) Called-Station-Id = "F0-9F-C2-32-7B-82:Seko" (1) NAS-Port-Type = Wireless-802.11 (1) Service-Type = Framed-User (1) Calling-Station-Id = "8C-85-90-C9-C4-A5" (1) Connect-Info = "CONNECT 0Mbps 802.11b" (1) Acct-Session-Id = "9CDA00101279DBED" (1) WLAN-Pairwise-Cipher = 1027076 (1) WLAN-Group-Cipher = 1027074 (1) WLAN-AKM-Suite = 1027073 (1) Framed-MTU = 1400 (1) EAP-Message = 0x021700a115800000009716030100920100008e03035d5188828d15cd4d7a82bf0731e77373065ecf57a0bf3f4d4082633bee46876100002c00ffc02cc02bc024c023c00ac009c008c030c02fc028c027c014c013c012009d009c003d003c0035002f000a01000039000a00080006001700180019000b00 (1) State = 0xfaa47198fab36411baefeb91c43d0602 (1) Message-Authenticator = 0xbe4a540bc251f8055feaedc56f6d5fff (1) session-state: No cached attributes (1) # Executing section authorize from file /etc/freeradius/3.0/sites-enabled/inner-tunnel (1) authorize { (1) update control { (1) Proxy-To-Realm := LOCAL (1) } # update control = noop (1) eap: Peer sent EAP Response (code 2) ID 23 length 161 (1) eap: Continuing tunnel setup (1) [eap] = ok (1) } # authorize = ok (1) Found Auth-Type = eap (1) # Executing group from file /etc/freeradius/3.0/sites-enabled/inner-tunnel (1) authenticate { (1) eap: Expiring EAP session with state 0xfaa47198fab36411 (1) eap: Finished EAP session with state 0xfaa47198fab36411 (1) eap: Previous EAP request found for state 0xfaa47198fab36411, released from the list (1) eap: Peer sent packet with method EAP TTLS (21) (1) eap: Calling submodule eap_ttls to process data (1) eap_ttls: Authenticate (1) eap_ttls: Continuing EAP-TLS (1) eap_ttls: Peer indicated complete TLS record size will be 151 bytes (1) eap_ttls: Got complete TLS record (151 bytes) (1) eap_ttls: [eaptls verify] = length included (1) eap_ttls: (other): before SSL initialization (1) eap_ttls: TLS_accept: before SSL initialization (1) eap_ttls: TLS_accept: before SSL initialization (1) eap_ttls: <<< recv UNKNOWN TLS VERSION ?0304? [length 0092] (1) eap_ttls: TLS_accept: SSLv3/TLS read client hello (1) eap_ttls: >>> send TLS 1.2 [length 003d] (1) eap_ttls: TLS_accept: SSLv3/TLS write server hello (1) eap_ttls: >>> send TLS 1.2 [length 03e8] (1) eap_ttls: TLS_accept: SSLv3/TLS write certificate (1) eap_ttls: >>> send TLS 1.2 [length 014d] (1) eap_ttls: TLS_accept: SSLv3/TLS write key exchange (1) eap_ttls: >>> send TLS 1.2 [length 0004] (1) eap_ttls: TLS_accept: SSLv3/TLS write server done (1) eap_ttls: TLS_accept: Need to read more data: SSLv3/TLS write server done (1) eap_ttls: In SSL Handshake Phase (1) eap_ttls: In SSL Accept mode (1) eap_ttls: [eaptls process] = handled (1) eap: Sending EAP Request (code 1) ID 24 length 1004 (1) eap: EAP session adding &reply:State = 0xfaa47198fbbc6411 (1) [eap] = handled (1) } # authenticate = handled (1) Using Post-Auth-Type Challenge (1) Post-Auth-Type sub-section not found. Ignoring. (1) # Executing group from file /etc/freeradius/3.0/sites-enabled/inner-tunnel (1) Sent Access-Challenge Id 5 from 192.168.1.10:1812 to 192.168.1.6:44463 length 0 (1) EAP-Message = 0x011803ec15c00000058a160303003d02000039030349e81822793d24a35e670383027a3eada3f2f3378a72d3789a4e393459bb0f3600c030000011ff01000100000b0004030001020017000016030303e80b0003e40003e10003de308203da308202c2a003020102020101300d06092a864886f70d0101 (1) Message-Authenticator = 0x00000000000000000000000000000000 (1) State = 0xfaa47198fbbc6411baefeb91c43d0602 (1) Finished request Waking up in 4.9 seconds. (2) Received Access-Request Id 6 from 192.168.1.6:44463 to 192.168.1.10:1812 length 239 (2) User-Name = "oktaradius(a)contentful.com" (2) NAS-IP-Address = 192.168.1.6 (2) NAS-Identifier = "F09FC2307B82D74DA8A1" (2) Called-Station-Id = "F0-9F-C2-32-7B-82:Seko" (2) NAS-Port-Type = Wireless-802.11 (2) Service-Type = Framed-User (2) Calling-Station-Id = "8C-85-90-C9-C4-A5" (2) Connect-Info = "CONNECT 0Mbps 802.11b" (2) Acct-Session-Id = "9CDA00101279DBED" (2) WLAN-Pairwise-Cipher = 1027076 (2) WLAN-Group-Cipher = 1027074 (2) WLAN-AKM-Suite = 1027073 (2) Framed-MTU = 1400 (2) EAP-Message = 0x021800061500 (2) State = 0xfaa47198fbbc6411baefeb91c43d0602 (2) Message-Authenticator = 0xd673ec1af4da37f49eee91a44fff135f (2) session-state: No cached attributes (2) # Executing section authorize from file /etc/freeradius/3.0/sites-enabled/inner-tunnel (2) authorize { (2) update control { (2) Proxy-To-Realm := LOCAL (2) } # update control = noop (2) eap: Peer sent EAP Response (code 2) ID 24 length 6 (2) eap: Continuing tunnel setup (2) [eap] = ok (2) } # authorize = ok (2) Found Auth-Type = eap (2) # Executing group from file /etc/freeradius/3.0/sites-enabled/inner-tunnel (2) authenticate { (2) eap: Expiring EAP session with state 0xfaa47198fbbc6411 (2) eap: Finished EAP session with state 0xfaa47198fbbc6411 (2) eap: Previous EAP request found for state 0xfaa47198fbbc6411, released from the list (2) eap: Peer sent packet with method EAP TTLS (21) (2) eap: Calling submodule eap_ttls to process data (2) eap_ttls: Authenticate (2) eap_ttls: Continuing EAP-TLS (2) eap_ttls: Peer ACKed our handshake fragment (2) eap_ttls: [eaptls verify] = request (2) eap_ttls: [eaptls process] = handled (2) eap: Sending EAP Request (code 1) ID 25 length 434 (2) eap: EAP session adding &reply:State = 0xfaa47198f8bd6411 (2) [eap] = handled (2) } # authenticate = handled (2) Using Post-Auth-Type Challenge (2) Post-Auth-Type sub-section not found. Ignoring. (2) # Executing group from file /etc/freeradius/3.0/sites-enabled/inner-tunnel (2) Sent Access-Challenge Id 6 from 192.168.1.10:1812 to 192.168.1.6:44463 length 0 (2) EAP-Message = 0x011901b215800000058a1243396539a2f1ad1b6a17603569def5a0794b3af441b40273fd27a0361b18742b5e898d798d94b85c2aaa4ede14cfe7c5f7406c7d5eb178bc1e609fbfefb1920ce1f720d4bbd7ea7e4c91a2b0160303014d0c0001490300174104c4784b7e2fc3e8cf21033a4766054d0266e0 (2) Message-Authenticator = 0x00000000000000000000000000000000 (2) State = 0xfaa47198f8bd6411baefeb91c43d0602 (2) Finished request Waking up in 4.9 seconds. (3) Received Access-Request Id 7 from 192.168.1.6:44463 to 192.168.1.10:1812 length 369 (3) User-Name = "oktaradius(a)contentful.com" (3) NAS-IP-Address = 192.168.1.6 (3) NAS-Identifier = "F09FC2307B82D74DA8A1" (3) Called-Station-Id = "F0-9F-C2-32-7B-82:Seko" (3) NAS-Port-Type = Wireless-802.11 (3) Service-Type = Framed-User (3) Calling-Station-Id = "8C-85-90-C9-C4-A5" (3) Connect-Info = "CONNECT 0Mbps 802.11b" (3) Acct-Session-Id = "9CDA00101279DBED" (3) WLAN-Pairwise-Cipher = 1027076 (3) WLAN-Group-Cipher = 1027074 (3) WLAN-AKM-Suite = 1027073 (3) Framed-MTU = 1400 (3) EAP-Message = 0x0219008815800000007e1603030046100000424104c9371a045101d7c7d9563212df6bc5a5b2417a499869eeaa50453d1f81bc96938addc1a9bf0512021dfdf2091938b4da9646febec921b00a57a717e72e7155861403030001011603030028860b3611b6543395b1c6bbaaf83beea322054daf0beb35 (3) State = 0xfaa47198f8bd6411baefeb91c43d0602 (3) Message-Authenticator = 0xd8e7b2d6e17e721eda1f459d4d421864 (3) session-state: No cached attributes (3) # Executing section authorize from file /etc/freeradius/3.0/sites-enabled/inner-tunnel (3) authorize { (3) update control { (3) Proxy-To-Realm := LOCAL (3) } # update control = noop (3) eap: Peer sent EAP Response (code 2) ID 25 length 136 (3) eap: Continuing tunnel setup (3) [eap] = ok (3) } # authorize = ok (3) Found Auth-Type = eap (3) # Executing group from file /etc/freeradius/3.0/sites-enabled/inner-tunnel (3) authenticate { (3) eap: Expiring EAP session with state 0xfaa47198f8bd6411 (3) eap: Finished EAP session with state 0xfaa47198f8bd6411 (3) eap: Previous EAP request found for state 0xfaa47198f8bd6411, released from the list (3) eap: Peer sent packet with method EAP TTLS (21) (3) eap: Calling submodule eap_ttls to process data (3) eap_ttls: Authenticate (3) eap_ttls: Continuing EAP-TLS (3) eap_ttls: Peer indicated complete TLS record size will be 126 bytes (3) eap_ttls: Got complete TLS record (126 bytes) (3) eap_ttls: [eaptls verify] = length included (3) eap_ttls: TLS_accept: SSLv3/TLS write server done (3) eap_ttls: <<< recv TLS 1.2 [length 0046] (3) eap_ttls: TLS_accept: SSLv3/TLS read client key exchange (3) eap_ttls: TLS_accept: SSLv3/TLS read change cipher spec (3) eap_ttls: <<< recv TLS 1.2 [length 0010] (3) eap_ttls: TLS_accept: SSLv3/TLS read finished (3) eap_ttls: >>> send TLS 1.2 [length 0001] (3) eap_ttls: TLS_accept: SSLv3/TLS write change cipher spec (3) eap_ttls: >>> send TLS 1.2 [length 0010] (3) eap_ttls: TLS_accept: SSLv3/TLS write finished (3) eap_ttls: (other): SSL negotiation finished successfully (3) eap_ttls: SSL Connection Established (3) eap_ttls: [eaptls process] = handled (3) eap: Sending EAP Request (code 1) ID 26 length 61 (3) eap: EAP session adding &reply:State = 0xfaa47198f9be6411 (3) [eap] = handled (3) } # authenticate = handled (3) Using Post-Auth-Type Challenge (3) Post-Auth-Type sub-section not found. Ignoring. (3) # Executing group from file /etc/freeradius/3.0/sites-enabled/inner-tunnel (3) Sent Access-Challenge Id 7 from 192.168.1.10:1812 to 192.168.1.6:44463 length 0 (3) EAP-Message = 0x011a003d15800000003314030300010116030300286d3279646040945eb6f8d448620c0719de823b9e656e0260d632d35eacaa5fa8a16d89afdfad464c (3) Message-Authenticator = 0x00000000000000000000000000000000 (3) State = 0xfaa47198f9be6411baefeb91c43d0602 (3) Finished request Waking up in 4.8 seconds. (4) Received Access-Request Id 8 from 192.168.1.6:44463 to 192.168.1.10:1812 length 332 (4) User-Name = "oktaradius(a)contentful.com" (4) NAS-IP-Address = 192.168.1.6 (4) NAS-Identifier = "F09FC2307B82D74DA8A1" (4) Called-Station-Id = "F0-9F-C2-32-7B-82:Seko" (4) NAS-Port-Type = Wireless-802.11 (4) Service-Type = Framed-User (4) Calling-Station-Id = "8C-85-90-C9-C4-A5" (4) Connect-Info = "CONNECT 0Mbps 802.11b" (4) Acct-Session-Id = "9CDA00101279DBED" (4) WLAN-Pairwise-Cipher = 1027076 (4) WLAN-Group-Cipher = 1027074 (4) WLAN-AKM-Suite = 1027073 (4) Framed-MTU = 1400 (4) EAP-Message = 0x021a00631580000000591703030054860b3611b65433960489141a64f3a8cb7c13b947583a4921f0806cd7acc46445465f35fb81bd6104f94599eefeb0d061f172f627a632af17613fac442a331cd9cb5030708bebf6dcf788682be55ac8c3f52b02ae (4) State = 0xfaa47198f9be6411baefeb91c43d0602 (4) Message-Authenticator = 0xdfcd2b5cc81d4042154a25f616974409 (4) session-state: No cached attributes (4) # Executing section authorize from file /etc/freeradius/3.0/sites-enabled/inner-tunnel (4) authorize { (4) update control { (4) Proxy-To-Realm := LOCAL (4) } # update control = noop (4) eap: Peer sent EAP Response (code 2) ID 26 length 99 (4) eap: Continuing tunnel setup (4) [eap] = ok (4) } # authorize = ok (4) Found Auth-Type = eap (4) # Executing group from file /etc/freeradius/3.0/sites-enabled/inner-tunnel (4) authenticate { (4) eap: Expiring EAP session with state 0xfaa47198f9be6411 (4) eap: Finished EAP session with state 0xfaa47198f9be6411 (4) eap: Previous EAP request found for state 0xfaa47198f9be6411, released from the list (4) eap: Peer sent packet with method EAP TTLS (21) (4) eap: Calling submodule eap_ttls to process data (4) eap_ttls: Authenticate (4) eap_ttls: Continuing EAP-TLS (4) eap_ttls: Peer indicated complete TLS record size will be 89 bytes (4) eap_ttls: Got complete TLS record (89 bytes) (4) eap_ttls: [eaptls verify] = length included (4) eap_ttls: [eaptls process] = ok (4) eap_ttls: Session established. Proceeding to decode tunneled attributes (4) eap_ttls: Got tunneled request (4) eap_ttls: User-Name = "oktaradius(a)contentful.com" (4) eap_ttls: User-Password = "BetAThetA135" (4) eap_ttls: FreeRADIUS-Proxied-To = 127.0.0.1 (4) eap_ttls: Sending tunneled request (4) Virtual server inner-tunnel received request (4) User-Name = "oktaradius(a)contentful.com" (4) User-Password = "BetAThetA135" (4) FreeRADIUS-Proxied-To = 127.0.0.1 (4) NAS-IP-Address = 192.168.1.6 (4) NAS-Identifier = "F09FC2307B82D74DA8A1" (4) Called-Station-Id = "F0-9F-C2-32-7B-82:Seko" (4) NAS-Port-Type = Wireless-802.11 (4) Service-Type = Framed-User (4) Calling-Station-Id = "8C-85-90-C9-C4-A5" (4) Connect-Info = "CONNECT 0Mbps 802.11b" (4) Acct-Session-Id = "9CDA00101279DBED" (4) WLAN-Pairwise-Cipher = 1027076 (4) WLAN-Group-Cipher = 1027074 (4) WLAN-AKM-Suite = 1027073 (4) Framed-MTU = 1400 (4) WARNING: Outer and inner identities are the same. User privacy is compromised. (4) server inner-tunnel { (4) # Executing section authorize from file /etc/freeradius/3.0/sites-enabled/inner-tunnel (4) authorize { (4) update control { (4) Proxy-To-Realm := LOCAL (4) } # update control = noop (4) eap: No EAP-Message, not doing EAP (4) [eap] = noop (4) [pap] = noop (4) if (User-Password) { (4) if (User-Password) -> TRUE (4) if (User-Password) { (4) update control { (4) Auth-Type := ldap (4) } # update control = noop (4) } # if (User-Password) = noop (4) } # authorize = noop (4) Found Auth-Type = ldap (4) # Executing group from file /etc/freeradius/3.0/sites-enabled/inner-tunnel (4) authenticate { rlm_ldap (ldap): Closing connection (0): Hit idle_timeout, was idle for 153 seconds rlm_ldap (ldap): Closing connection (1): Hit idle_timeout, was idle for 152 seconds rlm_ldap (ldap): Closing connection (2): Hit idle_timeout, was idle for 151 seconds rlm_ldap (ldap): You probably need to lower "min" rlm_ldap (ldap): Closing connection (3): Hit idle_timeout, was idle for 150 seconds rlm_ldap (ldap): You probably need to lower "min" rlm_ldap (ldap): Closing connection (4): Hit idle_timeout, was idle for 149 seconds rlm_ldap (ldap): You probably need to lower "min" rlm_ldap (ldap): 0 of 0 connections in use. You may need to increase "spare" rlm_ldap (ldap): Opening additional connection (5), 1 of 32 pending slots used rlm_ldap (ldap): Connecting to ldap://contentful.ldap.oktapreview.com:636 rlm_ldap (ldap): Waiting for bind result... rlm_ldap (ldap): Bind successful rlm_ldap (ldap): Reserved connection (5) (4) ldap: Login attempt by "oktaradius(a)contentful.com" (4) ldap: EXPAND (uid=%{%{Stripped-User-Name}:-%{User-Name}}) (4) ldap: --> (uid=oktaradius(a)contentful.com) (4) ldap: Performing search in "ou=users,dc=contentful, dc=oktapreview, dc=com" with filter "(uid=oktaradius(a)contentful.com)", scope "sub" (4) ldap: Waiting for search result... (4) ldap: User object found at DN "uid=oktaradius(a)contentful.com ,ou=users,dc=contentful,dc=oktapreview,dc=com" (4) ldap: Waiting for bind result... (4) ldap: Bind successful (4) ldap: Bind as user "uid=oktaradius(a)contentful.com,ou=users,dc=contentful,dc=oktapreview,dc=com" was successful rlm_ldap (ldap): Released connection (5) Need 2 more connections to reach min connections (3) rlm_ldap (ldap): Opening additional connection (6), 1 of 31 pending slots used rlm_ldap (ldap): Connecting to ldap://contentful.ldap.oktapreview.com:636 rlm_ldap (ldap): Waiting for bind result... rlm_ldap (ldap): Bind successful (4) [ldap] = ok (4) } # authenticate = ok (4) # Executing section post-auth from file /etc/freeradius/3.0/sites-enabled/inner-tunnel (4) } # server inner-tunnel (4) Virtual server sending reply (4) eap_ttls: Got tunneled Access-Accept (4) eap: Sending EAP Success (code 3) ID 26 length 4 (4) eap: Freeing handler (4) [eap] = ok (4) } # authenticate = ok (4) # Executing section post-auth from file /etc/freeradius/3.0/sites-enabled/inner-tunnel (4) Sent Access-Accept Id 8 from 192.168.1.10:1812 to 192.168.1.6:44463 length 0 (4) MS-MPPE-Recv-Key = 0x8c05d9a6191d353cf4101fe02b866e7a91dc69e4192eacd39647f6167f7cfd41 (4) MS-MPPE-Send-Key = 0x6e524da319bdd251d5f4b702316813dfed52e1ee2eb530ff93e742b8d1be8df4 (4) EAP-Message = 0x031a0004 (4) Message-Authenticator = 0x00000000000000000000000000000000 (4) User-Name = "oktaradius(a)contentful.com" (4) Finished request Waking up in 2.1 seconds. Waking up in 2.1 seconds. (0) Cleaning up request packet ID 4 with timestamp +149 (1) Cleaning up request packet ID 5 with timestamp +149 (2) Cleaning up request packet ID 6 with timestamp +149 (3) Cleaning up request packet ID 7 with timestamp +149 Waking up in 7.7 seconds. (4) Cleaning up request packet ID 8 with timestamp +149 Ready to process requests -- Nawar Al Tarazi IT Working Student nawar.tarazi(a)contentful.com +4915787991702 www.contentful.com

7 10

Max Connections Limit
by chrisming520 21 Aug '19

21 Aug '19

Hi experts: I have 3000,0+ users , when 1500 users connect radius server at same time , all can be authenticated . but if there are more than 1500 users,the rest (some of them ) can not get connect to server , get error like : NO REPLY FROM SERVER . can you tell me how to solve this problem ? thank you in advance . looking forward your answer Best regards Chris:-) 发自我的iPhone

4 3

Working with LDAP, radius clients, users, etc
by Paul Pathiakis 21 Aug '19

21 Aug '19

Hi, What would be the correct configuration for something like this: I'd like all the clients in domain example.com to authenticate using the same 'secret' - foobar If the address space for example.com is 192.168.0.0/22, does my client entry look like this in clients.conf: client example.com { ipaddr = 192.168.0.0/22 secret = foobar}? Is my understanding correct that any and all clients that are configured in the 192.168.0.1 - 192.168.3.254 range can be authenticated via freeradius at that point, using just the secret 'foobar'? Moving on, I also want to verify that the user is in the LDAP database before starting the login process. In my /etc/raddb/mods-available/ldap file, I should have an entry that looks like (without certs for now): ldap { server = 192.168.1.20 (LDAP Server address) port = 389 base_dn = 'ou=People,dc=example,dc=com' (Where my 'user' entries live) update { control:Password-With-Header += 'userPassword' control: += 'radiusControlAttribute' request: += 'radiusRequestAttribute' reply: += 'radiusReplyAttribute' } user { base_dn = "${..base_dn}" filter = "(uid=%{%{Stripped-User-Name}:-%{User-Name}})" } group { base_dn = "${..base_dn}" filter = '(objectClass=posixGroup)' membership_attribute = 'memberOf' } attribute { ipaddr = 'radiusClientIdentifier' secret = 'radiusClientSecret' # shortname = 'radiusClientShortname' # nas_type = 'radiusClientType' # virtual_server = 'radiusClientVirtualServer' # require_message_authenticator = 'radiusClientRequireMa' }} ### OK, I'm a little confused about the attribute block above.### In my openldap configuration, I have put the schema files include /etc/openldap/schema/freeradius.schema include /etc/openldap/schema/freeradius-clients.schema in the location above and those are the schema files I got from downloading the FreeRADIUS source in the <path>/doc/schemas/ldap/openldap/ location and I copied them into correct location. I know this isn't an LDAP list, however with regards to the schemas and attribute block, is thischecking to see if those entries exist (radiusClientIndentifier, radiusClientSecret) in the user entry in ldap?That is, is this using those schema entries to authenticate the user for access to the client? I'm starting to see that FreeRADIUS will authenticate all the units on a network from the first two points and then check the existence of the user from LDAP. However, if I'm trying to be very secure, wouldn't I want to limit the scope of the machines? For example, say I have a smallish network that grows/contracts with the number of hosts on the desktop and it has as few as a 100 and almost 250. So, I have 192.168.1.0/24 as my CIDR network. I can use DHCP and Dynamic Updating of DNS, to track everything at the IP level but I don't want to have hosts that are in an 'unknown' state on my network. For arguments sake, I have someone that plugs into my network and knows the address space that is used. They are not a 'sanctioned user' for that network space but due to the scope of what RADIUS allows in my above network range of 192.168.0.0/22, the machine gets authenticated. It seems that it would be beneficial to have an entry for all the machines in my LDAP to allow authentication for that client. Is this possible? I'm thinking it would be a good thing to be able to have entry upon entry of clients and users on a case-by-case basis added and removed to LDAP with a flag in the record to allow authentication. Do people do this? Am I going in the wrong direction? If so, which way? If not, how would this be addressed? TY! P

2 3

session is nil
by Sajad Tahernejad 21 Aug '19

21 Aug '19

Hi, I want use session:playAndGetDigits in position lua script, but gived me this error /scripts/lua/callcenter-announce-position.lua:39: attempt to index global 'session' (a nil value) Please help me Thanks.

2 1