- Freeradius-Users - lists.freeradius.org

sqlippool on 3.0.18
by Nathan Ward 27 Feb '19

27 Feb '19

Hi, Wading in to this one now - not sure if this is a bug or if it’s known/fixed so posting here in the hope someone else has had this and looked in to it. If not, I’m learning a lot, so, that’s good. Will post more when I have it. I’m testing upgrading to 3.0.18, and when I get an Accounting-On with sqlippool (I am running a NAS simulator which sends Accounting-On first, not sure if other messages are impacted), I get: <snip> rlm_sql (sql-radiusippool): Reserved connection (0) (0) sqlippool-ipv4: EXPAND %{%{Chargeable-User-Identity}:-%{%{Stripped-User-Name}:-UNKNOWN}} (0) sqlippool-ipv4: --> UNKNOWN (0) sqlippool-ipv4: SQL-User-Name set to 'UNKNOWN' (0) sqlippool-ipv4: EXPAND START TRANSACTION (0) sqlippool-ipv4: --> START TRANSACTION (0) sqlippool-ipv4: Executing query: START TRANSACTION rlm_sql_postgresql: Status: PGRES_COMMAND_OK rlm_sql_postgresql: query affected rows = 0 src/modules/rlm_sql/rlm_sql.c:381: Type mismatch: name[rlm_sql_t] expected[rlm_sql_handle_t] talloc abort: src/modules/rlm_sql/rlm_sql.c:381: Type mismatch: name[rlm_sql_t] expected[rlm_sql_handle_t] </snip> src/modules/rlm_sqlippool/rlm_sqlippool.c:320 is: if (radius_axlat(&expanded, request, query, data->sql_inst->sql_escape_func, data->sql_inst) < 0) return -1; And I notice in Herwin Weststrate’s commit @ c8736367583 there is a lot of use of the handle as the last param for that function rather than the sql module instance: - if (radius_axlat(&expanded, request, inst->config->simul_verify_query, sql_escape_func, inst) < 0) { + if (radius_axlat(&expanded, request, inst->config->simul_verify_query, inst->sql_escape_func, handle) < 0) { Etc. so I’m thinking that commit didn’t take sqlippool in to account. I notice there’s a new function, sql_escape_for_xlat_func, which gets a connection from the pool then releases it, but I’m not sure that’s right for this situation in sqlippool - we’re doing these xlats in the middle of a transaction, so we should have a handle already? I've tried passing the handle to radius_axlat rather than the instance, i.e. (in rlm_sqlippool.c): - if (radius_axlat(&expanded, request, query, data->sql_inst->sql_escape_func, data->sql_inst) < 0) return -1; + if (radius_axlat(&expanded, request, query, data->sql_inst->sql_escape_func, handle) < 0) return -1; But now I get a talloc error - <snip> (0) sqlippool-ipv4: Executing query: START TRANSACTION rlm_sql_postgresql: Status: PGRES_COMMAND_OK rlm_sql_postgresql: query affected rows = 0 Bad talloc magic value - unknown value talloc abort: Bad talloc magic value - unknown value </snip> Here’s a backtrace for that - note the handle is passed through, so I’m not entirely clear why this is objecting. Is the handle freed somewhere? I’m wondering if this is simply because we’re running several queries in a transaction - the first query (i.e. START TRANSACTION) is always fine, even if I put an xlat in it. The second query always triggers this error. Should this handle even still be useable? The next line after the one I’ve changed above calls sql_query, which needs handle to have a ‘conn’ member, so, I expect so.. #3 0x00007fa228d5e77a in _talloc_get_type_abort () from /lib64/libtalloc.so.2 #4 0x00007fa2210f0f40 in sql_escape_func (request=request@entry=0x55a14277f330, out=out@entry=0x55a1427820d0 "", outlen=outlen@entry=30, in=0x55a1427819b0 "192.0.2.0", arg=arg@entry=0x7ffeb7db2ba0) at src/modules/rlm_sql/rlm_sql.c:381 #5 0x00007fa229aa6afe in xlat_aprint (ctx=ctx@entry=0x55a14277f330, request=0x55a14277f330, node=<optimized out>, escape=escape@entry=0x7fa2210f0f10 <sql_escape_func>, escape_ctx=0x7ffeb7db2ba0, lvl=0) at src/main/xlat.c:2371 #6 0x00007fa229aa7aed in xlat_process (out=0x7ffeb7db1990, request=0x55a14277f330, head=0x55a142781f60, escape=0x7fa2210f0f10 <sql_escape_func>, escape_ctx=0x7ffeb7db2ba0) at src/main/xlat.c:2410 #7 0x00007fa229aa6b51 in xlat_aprint (ctx=ctx@entry=0x55a142781a30, request=request@entry=0x55a14277f330, node=node@entry=0x55a142781df0, escape=escape@entry=0x7fa2210f0f10 <sql_escape_func>, escape_ctx=escape_ctx@entry=0x7ffeb7db2ba0, lvl=0) at src/main/xlat.c:2344 #8 0x00007fa229aa79d1 in xlat_process (out=0x7ffeb7db1a90, request=0x55a14277f330, head=<optimized out>, escape=0x7fa2210f0f10 <sql_escape_func>, escape_ctx=0x7ffeb7db2ba0) at src/main/xlat.c:2428 #9 0x00007fa229aa7b44 in xlat_expand_struct (out=out@entry=0x7ffeb7db1b48, outlen=outlen@entry=0, request=request@entry=0x55a14277f330, node=<optimized out>, escape=escape@entry=0x7fa2210f0f10 <sql_escape_func>, escape_ctx=escape_ctx@entry=0x7ffeb7db2ba0) at src/main/xlat.c:2482 #10 0x00007fa229aa8094 in xlat_expand (out=out@entry=0x7ffeb7db1b48, outlen=outlen@entry=0, request=request@entry=0x55a14277f330, fmt=fmt@entry=0x7ffeb7db1b50 "UPDATE radippool SET nasipaddress = '', pool_key = 0, callingstationid = '', expiry_time = 'now'::timestamp(0) - '1 second'::interval WHERE nasipaddress = '%{%{Nas-IP-Address}:-%{Nas-IPv6-Address}}'", escape=0x7fa2210f0f10 <sql_escape_func>, escape_ctx=escape_ctx@entry=0x7ffeb7db2ba0) at src/main/xlat.c:2547 #11 0x00007fa229aa95fa in radius_axlat (out=out@entry=0x7ffeb7db1b48, request=request@entry=0x55a14277f330, fmt=fmt@entry=0x7ffeb7db1b50 "UPDATE radippool SET nasipaddress = '', pool_key = 0, callingstationid = '', expiry_time = 'now'::timestamp(0) - '1 second'::interval WHERE nasipaddress = '%{%{Nas-IP-Address}:-%{Nas-IPv6-Address}}'", escape=<optimized out>, ctx=ctx@entry=0x7ffeb7db2ba0) at src/main/xlat.c:2617 #12 0x00007fa2212fae4f in sqlippool_command (fmt=<optimized out>, handle=handle@entry=0x7ffeb7db2ba0, data=data@entry=0x55a14264d250, request=request@entry=0x55a14277f330, param=param@entry=0x0, param_len=param_len@entry=0) at src/modules/rlm_sqlippool/rlm_sqlippool.c:320 #13 0x00007fa2212fb66e in mod_accounting_on (request=0x55a14277f330, inst=0x55a14264d250, handle=0x7ffeb7db2ba0) at src/modules/rlm_sqlippool/rlm_sqlippool.c:706 #14 mod_accounting (instance=0x55a14264d250, request=0x55a14277f330) at src/modules/rlm_sqlippool/rlm_sqlippool.c:779 -- Nathan Ward

2 1

Add support for systemd service and watchdogs Fixes #2499.
by Stefano Mason 27 Feb '19

27 Feb '19

Dear all, "systemctl start radiusd.service" it doesn't exit but remain in a stuck state, it's necessary to do a CTRL-C, after that I check the status e the process list: all it's okay. - systemctl start radiusd.service (stuck in) - systemctl status radiusd.service (okay) - systemctl stop radiusd.service (okay) Environment Centos 7 # cat /etc/redhat-release CentOS Linux release 7.6.1810 (Core) cd freeradius-server git pull git checkout v3.0.x git archive --format=tar --prefix=freeradius-server-3.0.19/ v3.0.x | bzip2 -c >../freeradius-server-3.0.19.tar.bz2 build from freeradius.spec results: x86_64]# ls -1 freeradius-3.0.19-2.el7.centos.x86_64.rpm freeradius-config-3.0.19-2.el7.centos.x86_64.rpm freeradius-debuginfo-3.0.19-2.el7.centos.x86_64.rpm freeradius-freetds-3.0.19-2.el7.centos.x86_64.rpm freeradius-krb5-3.0.19-2.el7.centos.x86_64.rpm freeradius-ldap-3.0.19-2.el7.centos.x86_64.rpm freeradius-mysql-3.0.19-2.el7.centos.x86_64.rpm freeradius-perl-3.0.19-2.el7.centos.x86_64.rpm freeradius-postgresql-3.0.19-2.el7.centos.x86_64.rpm freeradius-python-3.0.19-2.el7.centos.x86_64.rpm freeradius-redis-3.0.19-2.el7.centos.x86_64.rpm freeradius-rest-3.0.19-2.el7.centos.x86_64.rpm freeradius-sqlite-3.0.19-2.el7.centos.x86_64.rpm freeradius-unixODBC-3.0.19-2.el7.centos.x86_64.rpm freeradius-utils-3.0.19-2.el7.centos.x86_64.rpm Upgrade: # yum localinstall freeradius-3.0.18-2.el7.centos.x86_64.rpm freeradius-config-3.0.18-2.el7.centos.x86_64.rpm freeradius-ldap-3.0.18-2.el7.centos.x86_64.rpm freeradius-utils-3.0.18-2.el7.centos.x86_64.rpm # systemctl daemon-reload systemd read the new instructions from # cat /usr/lib/systemd/system/radiusd.service [Unit] Description=FreeRADIUS multi-protocol policy server After=network-online.target Documentation=man:radiusd(8) man:radiusd.conf(5) http://wiki.freeradius.org/ http://networkradius.com/doc/ [Service] Type=notify WatchdogSec=60 NotifyAccess=all PIDFile=/var/run/radiusd/radiusd.pid EnvironmentFile=-/etc/sysconfig/radiusd # FreeRADIUS can do static evaluation of policy language rules based # on environmental variables which is very useful for doing per-host # customization. # Unfortunately systemd does not allow variable substitutions such # as %H or $(hostname) in the EnvironmentFile. # We provide HOSTNAME here for convenience. Environment=HOSTNAME=%H # Limit memory to 2G this is fine for %99.99 of deployments. FreeRADIUS # is not memory hungry, if it's using more than this, then there's probably # a leak somewhere. MemoryLimit=2G RuntimeDirectory=radiusd RuntimeDirectoryMode=0775 ExecStartPre=/usr/sbin/radiusd $FREERADIUS_OPTIONS -Cx -lstdout ExecStartPre=/usr/bin/chown radiusd:radiusd /var/run/radiusd ExecStart=/usr/sbin/radiusd $FREERADIUS_OPTIONS Restart=on-failure RestartSec=5 [Install] WantedBy=multi-user.target STATUS works: # systemctl status radiusd.service ● radiusd.service - FreeRADIUS multi-protocol policy server Loaded: loaded (/usr/lib/systemd/system/radiusd.service; enabled; vendor preset: disabled) Active: activating (start) since Wed 2019-02-27 10:33:43 CET; 1min 13s ago Docs: man:radiusd(8) man:radiusd.conf(5) http://wiki.freeradius.org/ http://networkradius.com/doc/ Process: 31202 ExecStartPre=/usr/bin/chown radiusd:radiusd /var/run/radiusd (code=exited, status=0/SUCCESS) Process: 31199 ExecStartPre=/usr/sbin/radiusd $FREERADIUS_OPTIONS -Cx -lstdout (code=exited, status=0/SUCCESS) Main PID: 31208 (radiusd) Memory: 21.8M (limit: 2.0G) CGroup: /system.slice/radiusd.service └─31208 /usr/sbin/radiusd STOP works: # systemctl stop radiusd.service # START stuck in: # systemctl start radiusd.service ^C # LOG from journalctl: Feb 27 10:37:04 betty systemd[1]: Starting FreeRADIUS multi-protocol policy server... Feb 27 10:37:04 betty radiusd[31406]: FreeRADIUS Version 3.0.19 Feb 27 10:37:04 betty radiusd[31406]: Copyright (C) 1999-2019 The FreeRADIUS server project and contributors Feb 27 10:37:04 betty radiusd[31406]: There is NO warranty; not even for MERCHANTABILITY or FITNESS FOR A Feb 27 10:37:04 betty radiusd[31406]: PARTICULAR PURPOSE Feb 27 10:37:04 betty radiusd[31406]: You may redistribute copies of FreeRADIUS under the terms of the Feb 27 10:37:04 betty radiusd[31406]: GNU General Public License Feb 27 10:37:04 betty radiusd[31406]: For more information about these matters, see the file named COPYRIGHT Feb 27 10:37:04 betty radiusd[31406]: Starting - reading configuration files ... Feb 27 10:37:04 betty radiusd[31406]: Debugger not attached Best regards. Stefano

2 1

Building the 3.0.18 version
by Elias Pereira 27 Feb '19

27 Feb '19

hello, I'm trying to build version 3.0.18 in a debian 9.8 by following the link https://wiki.freeradius.org/building/Debian%20and%20Ubuntu#building-packages, but when I run the "make deb" command the error "make: *** No rule to make target 'deb'" occurs. Getting the source ok Installing build dependencies ok Building Packages *error* Any idea? -- Elias Pereira

3 13

mschap: eapol_test peap/mschap fails
by Peter Kain 26 Feb '19

26 Feb '19

Hi, First time poster. I've been tasked with setting up a freeRADIUS (FR) server in order to join eduroam under the following conditions: authentication against Active Directory where we have two domains, the realm passed doesn't indicate the AD domain, and I can only join one domain "domainA", but there's trust between the domains. realm = user(a)uni.edu domainA.ad.uni.edu domainB.ad.uni.edu I've built a CentOS 7 server with FR 3.0.13 and winbind 4.8.3. Joined the server to the first domain and I'm able to authenticate users against both domains using the ntlm_auth command. As a first step, following the posted instructions "Configuring Authentication with Active Directory" I edited the mschap to use ntlm_auth setting "--domain=domainA". And I've set radiusd to run as root. Using the eapol_test program I'm able to authenticate as userA using both "-c ttls-mschap.conf" & "-c peap-mschap.conf" and I'm able to authenticate my iPad to our wireless . So far everything works as expected when setup for a single domain. file: mods-enabled/mschap mschap { ... ntlm_auth --domain=domainA ... In order to authenticate to both AD domains I followed a forum posting "PEAP and multiple domains" and created two additional domain instances for mschap in the radius.conf and updated both the default and inner-tunnels. raddb/radius.conf ... modules { $INCLUDE mods-enabled/ mschap mschap.domainA{ ntlm_auth = "/usr/bin/ntlm_auth --domain=domainA --allow-mschapv2 ... } mschap mschap.domainB{ ntlm_auth = "/usr/bin/ntlm_auth --domain=domainB --allow-mschapv2 ... } } sites-enabled/inner-tunnel (updated both default and inner-tunnel) In the "authorize section {" if mschap isn't commented out then it sets "Auth-Type = mschap". This seems contrary to the documentation within the file. Again running FR 3.0.13. Commented out mschap adding "mschap.domainA". This appears to set "Auth-Type = MS-CHAP". I'm not sure how the "Auth-Type" is determine, why one configuration results in "Auth-Type = mschap" and another "Auth-Type = MS-CHAP". aurhorized { ... # If the users are logging in with an MS-CHAP-Challenge # attribute for authentication, the mschap module will find # the MS-CHAP-Challenge attribute, and add 'Auth-Type := MS-CHAP' # to the request, which will cause the server to then use # the mschap module for authentication. #mschap mschap.domainA ... authenticate { ... Auth-Type MS-CHAP { # mschap group { mschap.domainA { reject = 1 ok = return } mschap.domainB { ok = return } } } # # For old names, too. # mschap In order to make it clear in the logs, I edited mods-enabled/mschap setting "--domain=FOO" in the ntml_auth command. --> eapol_test -c ttls-mshchap.conf -s testing123 ... WORKS Looking at the logs I see "Auth-Type = MS-CHAP" being set and my defined mschap.domainA module being used. Works exactly as expected using the modules I defined. If a user isn't found in domainA it then searches domainB. I can authenticate to my wireless (ssid eduroam) using an Android phone where I can set the authentication to TTLS/mschapv2. (6) Virtual server inner-tunnel received request (6) User-Name = "userA" (6) MS-CHAP-Challenge = 0x74624904a951c158262f9cd8b0abc750 (6) MS-CHAP2-Response = 0x70008158d62efd7635c9fb5b701e2fb44ee300000000000000005390d893765b4f1900adee9e21dd10f5827472b58eeb8e48 (6) FreeRADIUS-Proxied-To = 127.0.0.1 (6) server inner-tunnel { (6) # Executing section authorize from file /etc/raddb/sites-enabled/inner-tunnel (6) authorize { (6) policy filter_username { (6) if (&User-Name) { (6) if (&User-Name) -> TRUE (6) if (&User-Name) { (6) if (&User-Name =~ / /) { (6) if (&User-Name =~ / /) -> FALSE (6) if (&User-Name =~ /@[^@]*@/ ) { (6) if (&User-Name =~ /@[^@]*@/ ) -> FALSE (6) if (&User-Name =~ /\.\./ ) { (6) if (&User-Name =~ /\.\./ ) -> FALSE (6) if ((&User-Name =~ /@/) && (&User-Name !~ /(a)(.+)\.(.+)$/)) { (6) if ((&User-Name =~ /@/) && (&User-Name !~ /(a)(.+)\.(.+)$/)) -> FALSE (6) if (&User-Name =~ /\.$/) { (6) if (&User-Name =~ /\.$/) -> FALSE (6) if (&User-Name =~ /(a)\./) { (6) if (&User-Name =~ /(a)\./) -> FALSE (6) } # if (&User-Name) = notfound (6) } # policy filter_username = notfound (6) [chap] = noop (6) mschap.domainA: Found MS-CHAP attributes. Setting 'Auth-Type = mschap.domainA' (6) [mschap.domainA] = ok (6) suffix: Checking for suffix after "@" (6) suffix: No '@' in User-Name = "userA", looking up realm NULL (6) suffix: No such realm "NULL" (6) [suffix] = noop (6) update control { (6) &Proxy-To-Realm := LOCAL (6) } # update control = noop (6) eap: No EAP-Message, not doing EAP (6) [eap] = noop (6) [files] = noop (6) [expiration] = noop (6) [logintime] = noop (6) [pap] = noop (6) } # authorize = ok (6) Found Auth-Type = MS-CHAP (6) # Executing group from file /etc/raddb/sites-enabled/inner-tunnel (6) Auth-Type MS-CHAP { (6) group { (6) mschap.domainA: Creating challenge hash with username: userA (6) mschap.domainA: Client is using MS-CHAPv2 (6) mschap.domainA: Executing: /usr/bin/ntlm_auth --request-nt-key --allow-mschapv2 --username=%{%{Stripped-User-Name}:-%{%{User-Name}:-None}} ... --> eapol_test -c peap-mschapv2.conf -s testing123 ... FAILS The above test is using mods-enabled/mschap where I've set "--domain=FOO". Tracing through the logs, it looks like the eap module is called (expected), within eap it executes the peap section (expected) which sets "default_eap_type = mschapv2". Not sure if I'm saying this correctly, but the mschapv2 section is executes using the default mschap module. (8) # Executing section authorize from file /etc/raddb/sites-enabled/inner-tunnel (8) authorize { (8) policy filter_username { (8) if (&User-Name) { (8) if (&User-Name) -> TRUE (8) if (&User-Name) { (8) if (&User-Name =~ / /) { (8) if (&User-Name =~ / /) -> FALSE (8) if (&User-Name =~ /@[^@]*@/ ) { (8) if (&User-Name =~ /@[^@]*@/ ) -> FALSE (8) if (&User-Name =~ /\.\./ ) { (8) if (&User-Name =~ /\.\./ ) -> FALSE (8) if ((&User-Name =~ /@/) && (&User-Name !~ /(a)(.+)\.(.+)$/)) { (8) if ((&User-Name =~ /@/) && (&User-Name !~ /(a)(.+)\.(.+)$/)) -> FALSE (8) if (&User-Name =~ /\.$/) { (8) if (&User-Name =~ /\.$/) -> FALSE (8) if (&User-Name =~ /(a)\./) { (8) if (&User-Name =~ /(a)\./) -> FALSE (8) } # if (&User-Name) = notfound (8) } # policy filter_username = notfound (8) [chap] = noop (8) [mschap.domainA] = noop (8) suffix: Checking for suffix after "@" (8) suffix: No '@' in User-Name = "userA", looking up realm NULL (8) suffix: No such realm "NULL" (8) [suffix] = noop (8) update control { (8) &Proxy-To-Realm := LOCAL (8) } # update control = noop (8) eap: Peer sent EAP Response (code 2) ID 8 length 65 (8) eap: No EAP Start, assuming it's an on-going EAP conversation (8) [eap] = updated (8) [files] = noop (8) [expiration] = noop (8) [logintime] = noop (8) [pap] = noop (8) } # authorize = updated (8) Found Auth-Type = eap (8) # Executing group from file /etc/raddb/sites-enabled/inner-tunnel (8) authenticate { (8) eap: Expiring EAP session with state 0xa3eaf94ca3e2e3ae (8) eap: Finished EAP session with state 0xa3eaf94ca3e2e3ae (8) eap: Previous EAP request found for state 0xa3eaf94ca3e2e3ae, released from the list (8) eap: Peer sent packet with method EAP MSCHAPv2 (26) (8) eap: Calling submodule eap_mschapv2 to process data (8) eap_mschapv2: # Executing group from file /etc/raddb/sites-enabled/inner-tunnel (8) eap_mschapv2: authenticate { (8) mschap: Creating challenge hash with username: userA (8) mschap: Client is using MS-CHAPv2 (8) mschap: Executing: /usr/bin/ntlm_auth --request-nt-key --username=%{%{Stripped-User-Name}:-%{%{User-Name}:-None}} --domain=%{%{mschap:NT-Domain}:-FOO} --challenge=%{%{mschap:Challenge}:-00} --nt-response=%{%{mschap:NT-Response}:-00}: My apologies for not posting the "radius -X" for the failed eapol_test. There are restrictions at my site about posting server logs, I'm working on it. Questions: 1) Does it look like I've made any glaring mistakes or am I on the correct path? 2) What can I do to make peap/mschap work under this circumstances? Any help is appreciated. Pete K.

2 1

Reading dynamic clients from "clients" files in /etc/raddb/dynamic-clients doesn't work 2
by smith john 26 Feb '19

26 Feb '19

Thank you, Alan. > So... the file is empty? No, the file is named 18.220.171.233, under /etc/raddb/dynamic-clients, with the following content: client mynas { ipaddr = 18.220.171.233 secret = testing456 } At https://networkradius.com/doc/3.0.10/raddb/mods-available/dynamic_clients.h…, it first create a dynamic client, then start the server in debugging mode. Shouldn't it first start the server in debugging mode, then open another shell and create the client definition file to test if dynamic client works ? > Hmm... if anything in v2 doesn't work, upgrade to v3. In fact, I first tried FreeRADIUS 3.0.13 on centos 7.6. Because v3.0.13 doesn't work, I guess that v2 may work. In addition, for all the test, I store the users in mysql, but don't store nas clients in mysql. When store nas clients in mysql, dynamic-clients does work. So I test v3.0.13 on centos 7.6 again. This is the steps: 1. link /etc/raddb/sites-enabled/dynamic_clients to /etc/raddb/sites-available/dynamic_clients, and change the ownership of /etc/raddb/sites-enabled/dynamic_clients to root:radiusd 2. Change the content of /etc/raddb/sites-enabled/dynamic_clients to: client dynamic { ipaddr = 0.0.0.0/0 dynamic_clients = dynamic_clients directory = ${confdir}/dynamic-clients/ lifetime = 3600 } server dynamic_clients { authorize { # Example 2: Read the clients from "clients" files dynamic_clients # Tell the caller that the client was defined properly. ok } } 3. Create the /etc/raddb/dynamic-clients directory, change its ownership to root:radiusd 4. Run "setenforce 0' to disable selinux. 5. Start the server in debug mode. 6. Open another shell, create a file named 18.220.171.233 under / etc/raddb/dynamic-clients, with the following content: client mynas { ipaddr = 18.220.171.233 secret = testing456 } I also changed the ownership of 18.220.171.233 to root:radiusd 7. SSH to the nas server at 18.220.171.233, and run the radtest command to test the setup. 8. The debug gives the following result: Ready to process requests (0) server dynamic_clients { (0) # Executing section authorize from file /etc/raddb/sites-enabled/dynamic-clients (0) authorize { (0) dynamic_clients: Improper configuration (0) [dynamic_clients] = noop (0) [ok] = ok (0) } # authorize = ok (0) } # server dynamic_clients (0) Converting control list to client fields (0) ERROR: Cannot add client 18.220.171.233: Required attribute "FreeRADIUS-Client-Secret" is missing Ignoring request to auth address * port 1812 bound to server default from unknown client 18.220.171.233 port 60872 proto udp Ready to process requests 9. This is the full debug output: FreeRADIUS Version 3.0.13 Copyright (C) 1999-2017 The FreeRADIUS server project and contributors There is NO warranty; not even for MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE You may redistribute copies of FreeRADIUS under the terms of the GNU General Public License For more information about these matters, see the file named COPYRIGHT Starting - reading configuration files ... including dictionary file /usr/share/freeradius/dictionary including dictionary file /usr/share/freeradius/dictionary.dhcp including dictionary file /usr/share/freeradius/dictionary.vqp including dictionary file /etc/raddb/dictionary including configuration file /etc/raddb/radiusd.conf including configuration file /etc/raddb/proxy.conf including configuration file /etc/raddb/clients.conf including files in directory /etc/raddb/mods-enabled/ including configuration file /etc/raddb/mods-enabled/always including configuration file /etc/raddb/mods-enabled/attr_filter including configuration file /etc/raddb/mods-enabled/cache_eap including configuration file /etc/raddb/mods-enabled/chap including configuration file /etc/raddb/mods-enabled/date including configuration file /etc/raddb/mods-enabled/detail including configuration file /etc/raddb/mods-enabled/detail.log including configuration file /etc/raddb/mods-enabled/dhcp including configuration file /etc/raddb/mods-enabled/digest including configuration file /etc/raddb/mods-enabled/dynamic_clients including configuration file /etc/raddb/mods-enabled/eap including configuration file /etc/raddb/mods-enabled/echo including configuration file /etc/raddb/mods-enabled/exec including configuration file /etc/raddb/mods-enabled/expiration including configuration file /etc/raddb/mods-enabled/expr including configuration file /etc/raddb/mods-enabled/files including configuration file /etc/raddb/mods-enabled/linelog including configuration file /etc/raddb/mods-enabled/logintime including configuration file /etc/raddb/mods-enabled/mschap including configuration file /etc/raddb/mods-enabled/ntlm_auth including configuration file /etc/raddb/mods-enabled/pap including configuration file /etc/raddb/mods-enabled/passwd including configuration file /etc/raddb/mods-enabled/preprocess including configuration file /etc/raddb/mods-enabled/radutmp including configuration file /etc/raddb/mods-enabled/realm including configuration file /etc/raddb/mods-enabled/replicate including configuration file /etc/raddb/mods-enabled/soh including configuration file /etc/raddb/mods-enabled/sradutmp including configuration file /etc/raddb/mods-enabled/unix including configuration file /etc/raddb/mods-enabled/unpack including configuration file /etc/raddb/mods-enabled/utf8 including configuration file /etc/raddb/mods-enabled/sql including configuration file /etc/raddb/mods-config/sql/main/mysql/queries.conf including files in directory /etc/raddb/policy.d/ including configuration file /etc/raddb/policy.d/accounting including configuration file /etc/raddb/policy.d/canonicalization including configuration file /etc/raddb/policy.d/control including configuration file /etc/raddb/policy.d/cui including configuration file /etc/raddb/policy.d/debug including configuration file /etc/raddb/policy.d/dhcp including configuration file /etc/raddb/policy.d/eap including configuration file /etc/raddb/policy.d/filter including configuration file /etc/raddb/policy.d/operator-name including files in directory /etc/raddb/sites-enabled/ including configuration file /etc/raddb/sites-enabled/default including configuration file /etc/raddb/sites-enabled/inner-tunnel including configuration file /etc/raddb/sites-enabled/dynamic-clients main { security { user = "radiusd" group = "radiusd" allow_core_dumps = no } name = "radiusd" prefix = "/usr" localstatedir = "/var" logdir = "/var/log/radius" run_dir = "/var/run/radiusd" } main { name = "radiusd" prefix = "/usr" localstatedir = "/var" sbindir = "/usr/sbin" logdir = "/var/log/radius" run_dir = "/var/run/radiusd" libdir = "/usr/lib64/freeradius" radacctdir = "/var/log/radius/radacct" hostname_lookups = no max_request_time = 30 cleanup_delay = 5 max_requests = 16384 pidfile = "/var/run/radiusd/radiusd.pid" checkrad = "/usr/sbin/checkrad" debug_level = 0 proxy_requests = yes log { stripped_names = no auth = no auth_badpass = no auth_goodpass = no colourise = yes msg_denied = "You are already logged in - access denied" } resources { } security { max_attributes = 200 reject_delay = 1.000000 status_server = yes } } radiusd: #### Loading Realms and Home Servers #### proxy server { retry_delay = 5 retry_count = 3 default_fallback = no dead_time = 120 wake_all_if_all_dead = no } home_server localhost { ipaddr = 127.0.0.1 port = 1812 type = "auth" secret = <<< secret >>> response_window = 20.000000 response_timeouts = 1 max_outstanding = 65536 zombie_period = 40 status_check = "status-server" ping_interval = 30 check_interval = 30 check_timeout = 4 num_answers_to_alive = 3 revive_interval = 120 limit { max_connections = 16 max_requests = 0 lifetime = 0 idle_timeout = 0 } coa { irt = 2 mrt = 16 mrc = 5 mrd = 30 } } home_server_pool my_auth_failover { type = fail-over home_server = localhost } realm example.com { auth_pool = my_auth_failover } realm LOCAL { } radiusd: #### Loading Clients #### client localhost { ipaddr = 127.0.0.1 require_message_authenticator = no secret = <<< secret >>> nas_type = "other" proto = "*" limit { max_connections = 16 lifetime = 0 idle_timeout = 30 } } client localhost_ipv6 { ipv6addr = ::1 require_message_authenticator = no secret = <<< secret >>> limit { max_connections = 16 lifetime = 0 idle_timeout = 30 } } client dynamic { ipaddr = 0.0.0.0/0 require_message_authenticator = no limit { max_connections = 16 lifetime = 0 idle_timeout = 30 } dynamic_clients = "dynamic_clients" lifetime = 3600 } including dynamic clients in /etc/raddb/dynamic-clients/ Debugger not attached # Creating Auth-Type = mschap # Creating Auth-Type = digest # Creating Auth-Type = eap # Creating Auth-Type = PAP # Creating Auth-Type = CHAP # Creating Auth-Type = MS-CHAP radiusd: #### Instantiating modules #### modules { # Loaded module rlm_always # Loading module "reject" from file /etc/raddb/mods-enabled/always always reject { rcode = "reject" simulcount = 0 mpp = no } # Loading module "fail" from file /etc/raddb/mods-enabled/always always fail { rcode = "fail" simulcount = 0 mpp = no } # Loading module "ok" from file /etc/raddb/mods-enabled/always always ok { rcode = "ok" simulcount = 0 mpp = no } # Loading module "handled" from file /etc/raddb/mods-enabled/always always handled { rcode = "handled" simulcount = 0 mpp = no } # Loading module "invalid" from file /etc/raddb/mods-enabled/always always invalid { rcode = "invalid" simulcount = 0 mpp = no } # Loading module "userlock" from file /etc/raddb/mods-enabled/always always userlock { rcode = "userlock" simulcount = 0 mpp = no } # Loading module "notfound" from file /etc/raddb/mods-enabled/always always notfound { rcode = "notfound" simulcount = 0 mpp = no } # Loading module "noop" from file /etc/raddb/mods-enabled/always always noop { rcode = "noop" simulcount = 0 mpp = no } # Loading module "updated" from file /etc/raddb/mods-enabled/always always updated { rcode = "updated" simulcount = 0 mpp = no } # Loaded module rlm_attr_filter # Loading module "attr_filter.post-proxy" from file /etc/raddb/mods-enabled/attr_filter attr_filter attr_filter.post-proxy { filename = "/etc/raddb/mods-config/attr_filter/post-proxy" key = "%{Realm}" relaxed = no } # Loading module "attr_filter.pre-proxy" from file /etc/raddb/mods-enabled/attr_filter attr_filter attr_filter.pre-proxy { filename = "/etc/raddb/mods-config/attr_filter/pre-proxy" key = "%{Realm}" relaxed = no } # Loading module "attr_filter.access_reject" from file /etc/raddb/mods-enabled/attr_filter attr_filter attr_filter.access_reject { filename = "/etc/raddb/mods-config/attr_filter/access_reject" key = "%{User-Name}" relaxed = no } # Loading module "attr_filter.access_challenge" from file /etc/raddb/mods-enabled/attr_filter attr_filter attr_filter.access_challenge { filename = "/etc/raddb/mods-config/attr_filter/access_challenge" key = "%{User-Name}" relaxed = no } # Loading module "attr_filter.accounting_response" from file /etc/raddb/mods-enabled/attr_filter attr_filter attr_filter.accounting_response { filename = "/etc/raddb/mods-config/attr_filter/accounting_response" key = "%{User-Name}" relaxed = no } # Loaded module rlm_cache # Loading module "cache_eap" from file /etc/raddb/mods-enabled/cache_eap cache cache_eap { driver = "rlm_cache_rbtree" key = "%{%{control:State}:-%{%{reply:State}:-%{State}}}" ttl = 15 max_entries = 0 epoch = 0 add_stats = no } # Loaded module rlm_chap # Loading module "chap" from file /etc/raddb/mods-enabled/chap # Loaded module rlm_date # Loading module "date" from file /etc/raddb/mods-enabled/date date { format = "%b %e %Y %H:%M:%S %Z" } # Loaded module rlm_detail # Loading module "detail" from file /etc/raddb/mods-enabled/detail detail { filename = "/var/log/radius/radacct/%{%{Packet-Src-IP-Address}:-%{Packet-Src-IPv6-Address}}/detail-%Y%m%d" header = "%t" permissions = 384 locking = no escape_filenames = no log_packet_header = no } # Loading module "auth_log" from file /etc/raddb/mods-enabled/detail.log detail auth_log { filename = "/var/log/radius/radacct/%{%{Packet-Src-IP-Address}:-%{Packet-Src-IPv6-Address}}/auth-detail-%Y%m%d" header = "%t" permissions = 384 locking = no escape_filenames = no log_packet_header = no } # Loading module "reply_log" from file /etc/raddb/mods-enabled/detail.log detail reply_log { filename = "/var/log/radius/radacct/%{%{Packet-Src-IP-Address}:-%{Packet-Src-IPv6-Address}}/reply-detail-%Y%m%d" header = "%t" permissions = 384 locking = no escape_filenames = no log_packet_header = no } # Loading module "pre_proxy_log" from file /etc/raddb/mods-enabled/detail.log detail pre_proxy_log { filename = "/var/log/radius/radacct/%{%{Packet-Src-IP-Address}:-%{Packet-Src-IPv6-Address}}/pre-proxy-detail-%Y%m%d" header = "%t" permissions = 384 locking = no escape_filenames = no log_packet_header = no } # Loading module "post_proxy_log" from file /etc/raddb/mods-enabled/detail.log detail post_proxy_log { filename = "/var/log/radius/radacct/%{%{Packet-Src-IP-Address}:-%{Packet-Src-IPv6-Address}}/post-proxy-detail-%Y%m%d" header = "%t" permissions = 384 locking = no escape_filenames = no log_packet_header = no } # Loaded module rlm_dhcp # Loading module "dhcp" from file /etc/raddb/mods-enabled/dhcp # Loaded module rlm_digest # Loading module "digest" from file /etc/raddb/mods-enabled/digest # Loaded module rlm_dynamic_clients # Loading module "dynamic_clients" from file /etc/raddb/mods-enabled/dynamic_clients # Loaded module rlm_eap # Loading module "eap" from file /etc/raddb/mods-enabled/eap eap { default_eap_type = "md5" timer_expire = 60 ignore_unknown_eap_types = no cisco_accounting_username_bug = no max_sessions = 16384 } # Loaded module rlm_exec # Loading module "echo" from file /etc/raddb/mods-enabled/echo exec echo { wait = yes program = "/bin/echo %{User-Name}" input_pairs = "request" output_pairs = "reply" shell_escape = yes } # Loading module "exec" from file /etc/raddb/mods-enabled/exec exec { wait = no input_pairs = "request" shell_escape = yes timeout = 10 } # Loaded module rlm_expiration # Loading module "expiration" from file /etc/raddb/mods-enabled/expiration # Loaded module rlm_expr # Loading module "expr" from file /etc/raddb/mods-enabled/expr expr { safe_characters = "@abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ0123456789.-_: /äéöüàâæçèéêëîïôœùûüaÿÄÉÖÜßÀÂÆÇÈÉÊËÎÏÔŒÙÛÜŸ" } # Loaded module rlm_files # Loading module "files" from file /etc/raddb/mods-enabled/files files { filename = "/etc/raddb/mods-config/files/authorize" acctusersfile = "/etc/raddb/mods-config/files/accounting" preproxy_usersfile = "/etc/raddb/mods-config/files/pre-proxy" } # Loaded module rlm_linelog # Loading module "linelog" from file /etc/raddb/mods-enabled/linelog linelog { filename = "/var/log/radius/linelog" escape_filenames = no syslog_severity = "info" permissions = 384 format = "This is a log message for %{User-Name}" reference = "messages.%{%{reply:Packet-Type}:-default}" } # Loading module "log_accounting" from file /etc/raddb/mods-enabled/linelog linelog log_accounting { filename = "/var/log/radius/linelog-accounting" escape_filenames = no syslog_severity = "info" permissions = 384 format = "" reference = "Accounting-Request.%{%{Acct-Status-Type}:-unknown}" } # Loaded module rlm_logintime # Loading module "logintime" from file /etc/raddb/mods-enabled/logintime logintime { minimum_timeout = 60 } # Loaded module rlm_mschap # Loading module "mschap" from file /etc/raddb/mods-enabled/mschap mschap { use_mppe = yes require_encryption = no require_strong = no with_ntdomain_hack = yes passchange { } allow_retry = yes winbind_retry_with_normalised_username = no } # Loading module "ntlm_auth" from file /etc/raddb/mods-enabled/ntlm_auth exec ntlm_auth { wait = yes program = "/path/to/ntlm_auth --request-nt-key --domain=MYDOMAIN --username=%{mschap:User-Name} --password=%{User-Password}" shell_escape = yes } # Loaded module rlm_pap # Loading module "pap" from file /etc/raddb/mods-enabled/pap pap { normalise = yes } # Loaded module rlm_passwd # Loading module "etc_passwd" from file /etc/raddb/mods-enabled/passwd passwd etc_passwd { filename = "/etc/passwd" format = "*User-Name:Crypt-Password:" delimiter = ":" ignore_nislike = no ignore_empty = yes allow_multiple_keys = no hash_size = 100 } # Loaded module rlm_preprocess # Loading module "preprocess" from file /etc/raddb/mods-enabled/preprocess preprocess { huntgroups = "/etc/raddb/mods-config/preprocess/huntgroups" hints = "/etc/raddb/mods-config/preprocess/hints" with_ascend_hack = no ascend_channels_per_line = 23 with_ntdomain_hack = no with_specialix_jetstream_hack = no with_cisco_vsa_hack = no with_alvarion_vsa_hack = no } # Loaded module rlm_radutmp # Loading module "radutmp" from file /etc/raddb/mods-enabled/radutmp radutmp { filename = "/var/log/radius/radutmp" username = "%{User-Name}" case_sensitive = yes check_with_nas = yes permissions = 384 caller_id = yes } # Loaded module rlm_realm # Loading module "IPASS" from file /etc/raddb/mods-enabled/realm realm IPASS { format = "prefix" delimiter = "/" ignore_default = no ignore_null = no } # Loading module "suffix" from file /etc/raddb/mods-enabled/realm realm suffix { format = "suffix" delimiter = "@" ignore_default = no ignore_null = no } # Loading module "realmpercent" from file /etc/raddb/mods-enabled/realm realm realmpercent { format = "suffix" delimiter = "%" ignore_default = no ignore_null = no } # Loading module "ntdomain" from file /etc/raddb/mods-enabled/realm realm ntdomain { format = "prefix" delimiter = "\\" ignore_default = no ignore_null = no } # Loaded module rlm_replicate # Loading module "replicate" from file /etc/raddb/mods-enabled/replicate # Loaded module rlm_soh # Loading module "soh" from file /etc/raddb/mods-enabled/soh soh { dhcp = yes } # Loading module "sradutmp" from file /etc/raddb/mods-enabled/sradutmp radutmp sradutmp { filename = "/var/log/radius/sradutmp" username = "%{User-Name}" case_sensitive = yes check_with_nas = yes permissions = 420 caller_id = no } # Loaded module rlm_unix # Loading module "unix" from file /etc/raddb/mods-enabled/unix unix { radwtmp = "/var/log/radius/radwtmp" } Creating attribute Unix-Group # Loaded module rlm_unpack # Loading module "unpack" from file /etc/raddb/mods-enabled/unpack # Loaded module rlm_utf8 # Loading module "utf8" from file /etc/raddb/mods-enabled/utf8 # Loaded module rlm_sql # Loading module "sql" from file /etc/raddb/mods-enabled/sql sql { driver = "rlm_sql_mysql" server = "localhost" port = 3306 login = "radius" password = <<< secret >>> radius_db = "radius" read_groups = yes read_profiles = yes read_clients = no delete_stale_sessions = yes sql_user_name = "%{User-Name}" default_user_profile = "" client_query = "SELECT id, nasname, shortname, type, secret, server FROM nas" authorize_check_query = "SELECT id, username, attribute, value, op FROM radcheck WHERE username = '%{SQL-User-Name}' ORDER BY id" authorize_reply_query = "SELECT id, username, attribute, value, op FROM radreply WHERE username = '%{SQL-User-Name}' ORDER BY id" authorize_group_check_query = "SELECT id, groupname, attribute, Value, op FROM radgroupcheck WHERE groupname = '%{SQL-Group}' ORDER BY id" authorize_group_reply_query = "SELECT id, groupname, attribute, value, op FROM radgroupreply WHERE groupname = '%{SQL-Group}' ORDER BY id" group_membership_query = "SELECT groupname FROM radusergroup WHERE username = '%{SQL-User-Name}' ORDER BY priority" simul_count_query = "SELECT COUNT(*) FROM radacct WHERE username = '%{SQL-User-Name}' AND acctstoptime IS NULL" simul_verify_query = "SELECT radacctid, acctsessionid, username, nasipaddress, nasportid, framedipaddress, callingstationid, framedprotocol FROM radacct WHERE username = '%{SQL-User-Name}' AND acctstoptime IS NULL" safe_characters = "@abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ0123456789.-_: /" accounting { reference = "%{tolower:type.%{Acct-Status-Type}.query}" type { accounting-on { query = "UPDATE radacct SET acctstoptime = FROM_UNIXTIME(%{integer:Event-Timestamp}), acctsessiontime = '%{integer:Event-Timestamp}' - UNIX_TIMESTAMP(acctstarttime), acctterminatecause = '%{%{Acct-Terminate-Cause}:-NAS-Reboot}' WHERE acctstoptime IS NULL AND nasipaddress = '%{NAS-IP-Address}' AND acctstarttime <= FROM_UNIXTIME(%{integer:Event-Timestamp})" } accounting-off { query = "UPDATE radacct SET acctstoptime = FROM_UNIXTIME(%{integer:Event-Timestamp}), acctsessiontime = '%{integer:Event-Timestamp}' - UNIX_TIMESTAMP(acctstarttime), acctterminatecause = '%{%{Acct-Terminate-Cause}:-NAS-Reboot}' WHERE acctstoptime IS NULL AND nasipaddress = '%{NAS-IP-Address}' AND acctstarttime <= FROM_UNIXTIME(%{integer:Event-Timestamp})" } start { query = "INSERT INTO radacct (acctsessionid, acctuniqueid, username, realm, nasipaddress, nasportid, nasporttype, acctstarttime, acctupdatetime, acctstoptime, acctsessiontime, acctauthentic, connectinfo_start, connectinfo_stop, acctinputoctets, acctoutputoctets, calledstationid, callingstationid, acctterminatecause, servicetype, framedprotocol, framedipaddress) VALUES ('%{Acct-Session-Id}', '%{Acct-Unique-Session-Id}', '%{SQL-User-Name}', '%{Realm}', '%{NAS-IP-Address}', '%{%{NAS-Port-ID}:-%{NAS-Port}}', '%{NAS-Port-Type}', FROM_UNIXTIME(%{integer:Event-Timestamp}), FROM_UNIXTIME(%{integer:Event-Timestamp}), NULL, '0', '%{Acct-Authentic}', '%{Connect-Info}', '', '0', '0', '%{Called-Station-Id}', '%{Calling-Station-Id}', '', '%{Service-Type}', '%{Framed-Protocol}', '%{Framed-IP-Address}')" } interim-update { query = "UPDATE radacct SET acctupdatetime = (@acctupdatetime_old:=acctupdatetime), acctupdatetime = FROM_UNIXTIME(%{integer:Event-Timestamp}), acctinterval = %{integer:Event-Timestamp} - UNIX_TIMESTAMP(@acctupdatetime_old), framedipaddress = '%{Framed-IP-Address}', acctsessiontime = %{%{Acct-Session-Time}:-NULL}, acctinputoctets = '%{%{Acct-Input-Gigawords}:-0}' << 32 | '%{%{Acct-Input-Octets}:-0}', acctoutputoctets = '%{%{Acct-Output-Gigawords}:-0}' << 32 | '%{%{Acct-Output-Octets}:-0}' WHERE AcctUniqueId = '%{Acct-Unique-Session-Id}'" } stop { query = "UPDATE radacct SET acctstoptime = FROM_UNIXTIME(%{integer:Event-Timestamp}), acctsessiontime = %{%{Acct-Session-Time}:-NULL}, acctinputoctets = '%{%{Acct-Input-Gigawords}:-0}' << 32 | '%{%{Acct-Input-Octets}:-0}', acctoutputoctets = '%{%{Acct-Output-Gigawords}:-0}' << 32 | '%{%{Acct-Output-Octets}:-0}', acctterminatecause = '%{Acct-Terminate-Cause}', connectinfo_stop = '%{Connect-Info}' WHERE AcctUniqueId = '%{Acct-Unique-Session-Id}'" } } } post-auth { reference = ".query" query = "INSERT INTO radpostauth (username, pass, reply, authdate) VALUES ( '%{SQL-User-Name}', '%{%{User-Password}:-%{Chap-Password}}', '%{reply:Packet-Type}', '%S')" } } rlm_sql (sql): Driver rlm_sql_mysql (module rlm_sql_mysql) loaded and linked Creating attribute SQL-Group instantiate { } # Instantiating module "reject" from file /etc/raddb/mods-enabled/always # Instantiating module "fail" from file /etc/raddb/mods-enabled/always # Instantiating module "ok" from file /etc/raddb/mods-enabled/always # Instantiating module "handled" from file /etc/raddb/mods-enabled/always # Instantiating module "invalid" from file /etc/raddb/mods-enabled/always # Instantiating module "userlock" from file /etc/raddb/mods-enabled/always # Instantiating module "notfound" from file /etc/raddb/mods-enabled/always # Instantiating module "noop" from file /etc/raddb/mods-enabled/always # Instantiating module "updated" from file /etc/raddb/mods-enabled/always # Instantiating module "attr_filter.post-proxy" from file /etc/raddb/mods-enabled/attr_filter reading pairlist file /etc/raddb/mods-config/attr_filter/post-proxy # Instantiating module "attr_filter.pre-proxy" from file /etc/raddb/mods-enabled/attr_filter reading pairlist file /etc/raddb/mods-config/attr_filter/pre-proxy # Instantiating module "attr_filter.access_reject" from file /etc/raddb/mods-enabled/attr_filter reading pairlist file /etc/raddb/mods-config/attr_filter/access_reject [/etc/raddb/mods-config/attr_filter/access_reject]:11 Check item "FreeRADIUS-Response-Delay" found in filter list for realm "DEFAULT". [/etc/raddb/mods-config/attr_filter/access_reject]:11 Check item "FreeRADIUS-Response-Delay-USec" found in filter list for realm "DEFAULT". # Instantiating module "attr_filter.access_challenge" from file /etc/raddb/mods-enabled/attr_filter reading pairlist file /etc/raddb/mods-config/attr_filter/access_challenge # Instantiating module "attr_filter.accounting_response" from file /etc/raddb/mods-enabled/attr_filter reading pairlist file /etc/raddb/mods-config/attr_filter/accounting_response # Instantiating module "cache_eap" from file /etc/raddb/mods-enabled/cache_eap rlm_cache (cache_eap): Driver rlm_cache_rbtree (module rlm_cache_rbtree) loaded and linked # Instantiating module "detail" from file /etc/raddb/mods-enabled/detail # Instantiating module "auth_log" from file /etc/raddb/mods-enabled/detail.log rlm_detail (auth_log): 'User-Password' suppressed, will not appear in detail output # Instantiating module "reply_log" from file /etc/raddb/mods-enabled/detail.log # Instantiating module "pre_proxy_log" from file /etc/raddb/mods-enabled/detail.log # Instantiating module "post_proxy_log" from file /etc/raddb/mods-enabled/detail.log # Instantiating module "eap" from file /etc/raddb/mods-enabled/eap # Linked to sub-module rlm_eap_md5 # Linked to sub-module rlm_eap_leap # Linked to sub-module rlm_eap_gtc gtc { challenge = "Password: " auth_type = "PAP" } # Linked to sub-module rlm_eap_tls tls { tls = "tls-common" } tls-config tls-common { verify_depth = 0 ca_path = "/etc/raddb/certs" pem_file_type = yes private_key_file = "/etc/raddb/certs/server.pem" certificate_file = "/etc/raddb/certs/server.pem" ca_file = "/etc/raddb/certs/ca.pem" private_key_password = <<< secret >>> dh_file = "/etc/raddb/certs/dh" fragment_size = 1024 include_length = yes auto_chain = yes check_crl = no check_all_crl = no cipher_list = "DEFAULT" cipher_server_preference = no ecdh_curve = "prime256v1" cache { enable = no lifetime = 24 max_entries = 255 } verify { skip_if_ocsp_ok = no } ocsp { enable = no override_cert_url = yes url = "http://127.0.0.1/ocsp/" use_nonce = yes timeout = 0 softfail = no } } # Linked to sub-module rlm_eap_ttls ttls { tls = "tls-common" default_eap_type = "md5" copy_request_to_tunnel = no use_tunneled_reply = no virtual_server = "inner-tunnel" include_length = yes require_client_cert = no } tls: Using cached TLS configuration from previous invocation # Linked to sub-module rlm_eap_peap peap { tls = "tls-common" default_eap_type = "mschapv2" copy_request_to_tunnel = no use_tunneled_reply = no proxy_tunneled_request_as_eap = yes virtual_server = "inner-tunnel" soh = no require_client_cert = no } tls: Using cached TLS configuration from previous invocation # Linked to sub-module rlm_eap_mschapv2 mschapv2 { with_ntdomain_hack = no send_error = no } # Instantiating module "expiration" from file /etc/raddb/mods-enabled/expiration # Instantiating module "files" from file /etc/raddb/mods-enabled/files reading pairlist file /etc/raddb/mods-config/files/authorize reading pairlist file /etc/raddb/mods-config/files/accounting reading pairlist file /etc/raddb/mods-config/files/pre-proxy # Instantiating module "linelog" from file /etc/raddb/mods-enabled/linelog # Instantiating module "log_accounting" from file /etc/raddb/mods-enabled/linelog # Instantiating module "logintime" from file /etc/raddb/mods-enabled/logintime # Instantiating module "mschap" from file /etc/raddb/mods-enabled/mschap rlm_mschap (mschap): using internal authentication # Instantiating module "pap" from file /etc/raddb/mods-enabled/pap # Instantiating module "etc_passwd" from file /etc/raddb/mods-enabled/passwd rlm_passwd: nfields: 3 keyfield 0(User-Name) listable: no # Instantiating module "preprocess" from file /etc/raddb/mods-enabled/preprocess reading pairlist file /etc/raddb/mods-config/preprocess/huntgroups reading pairlist file /etc/raddb/mods-config/preprocess/hints # Instantiating module "IPASS" from file /etc/raddb/mods-enabled/realm # Instantiating module "suffix" from file /etc/raddb/mods-enabled/realm # Instantiating module "realmpercent" from file /etc/raddb/mods-enabled/realm # Instantiating module "ntdomain" from file /etc/raddb/mods-enabled/realm # Instantiating module "sql" from file /etc/raddb/mods-enabled/sql rlm_sql_mysql: libmysql version: 5.5.60-MariaDB mysql { tls { } warnings = "auto" } rlm_sql (sql): Attempting to connect to database "radius" rlm_sql (sql): Initialising connection pool pool { start = 5 min = 3 max = 32 spare = 10 uses = 0 lifetime = 0 cleanup_interval = 30 idle_timeout = 60 retry_delay = 30 spread = no } rlm_sql (sql): Opening additional connection (0), 1 of 32 pending slots used rlm_sql_mysql: Starting connect to MySQL server rlm_sql_mysql: Connected to database 'radius' on Localhost via UNIX socket, server version 5.5.60-MariaDB, protocol version 10 rlm_sql (sql): Opening additional connection (1), 1 of 31 pending slots used rlm_sql_mysql: Starting connect to MySQL server rlm_sql_mysql: Connected to database 'radius' on Localhost via UNIX socket, server version 5.5.60-MariaDB, protocol version 10 rlm_sql (sql): Opening additional connection (2), 1 of 30 pending slots used rlm_sql_mysql: Starting connect to MySQL server rlm_sql_mysql: Connected to database 'radius' on Localhost via UNIX socket, server version 5.5.60-MariaDB, protocol version 10 rlm_sql (sql): Opening additional connection (3), 1 of 29 pending slots used rlm_sql_mysql: Starting connect to MySQL server rlm_sql_mysql: Connected to database 'radius' on Localhost via UNIX socket, server version 5.5.60-MariaDB, protocol version 10 rlm_sql (sql): Opening additional connection (4), 1 of 28 pending slots used rlm_sql_mysql: Starting connect to MySQL server rlm_sql_mysql: Connected to database 'radius' on Localhost via UNIX socket, server version 5.5.60-MariaDB, protocol version 10 } # modules radiusd: #### Loading Virtual Servers #### server { # from file /etc/raddb/radiusd.conf } # server server default { # from file /etc/raddb/sites-enabled/default # Loading authenticate {...} # Loading authorize {...} # Loading preacct {...} # Loading accounting {...} # Loading session {...} # Loading post-proxy {...} # Loading post-auth {...} } # server default server inner-tunnel { # from file /etc/raddb/sites-enabled/inner-tunnel # Loading authenticate {...} # Loading authorize {...} # Loading session {...} # Loading post-proxy {...} # Loading post-auth {...} # Skipping contents of 'if' as it is always 'false' -- /etc/raddb/sites-enabled/inner-tunnel:330 } # server inner-tunnel server dynamic_clients { # from file /etc/raddb/sites-enabled/dynamic-clients # Loading authorize {...} } # server dynamic_clients radiusd: #### Opening IP addresses and Ports #### listen { type = "auth" ipaddr = * port = 0 limit { max_connections = 16 lifetime = 0 idle_timeout = 30 } } listen { type = "acct" ipaddr = * port = 0 limit { max_connections = 16 lifetime = 0 idle_timeout = 30 } } listen { type = "auth" ipv6addr = :: port = 0 limit { max_connections = 16 lifetime = 0 idle_timeout = 30 } } listen { type = "acct" ipv6addr = :: port = 0 limit { max_connections = 16 lifetime = 0 idle_timeout = 30 } } listen { type = "auth" ipaddr = 127.0.0.1 port = 18120 } Listening on auth address * port 1812 bound to server default Listening on acct address * port 1813 bound to server default Listening on auth address :: port 1812 bound to server default Listening on acct address :: port 1813 bound to server default Listening on auth address 127.0.0.1 port 18120 bound to server inner-tunnel Listening on proxy address * port 39011 Listening on proxy address :: port 49988 Ready to process requests (0) server dynamic_clients { (0) # Executing section authorize from file /etc/raddb/sites-enabled/dynamic-clients (0) authorize { (0) dynamic_clients: Improper configuration (0) [dynamic_clients] = noop (0) [ok] = ok (0) } # authorize = ok (0) } # server dynamic_clients (0) Converting control list to client fields (0) ERROR: Cannot add client 18.220.171.233: Required attribute "FreeRADIUS-Client-Secret" is missing Ignoring request to auth address * port 1812 bound to server default from unknown client 18.220.171.233 port 60872 proto udp Ready to process requests

2 3

Re: Freeradius-Users Digest, Vol 166, Issue 51
by smith john 26 Feb '19

26 Feb '19

Thank you, Alan. > So... the file is empty? No, the file is named 18.220.171.233, under /etc/raddb/dynamic-clients, with the following content: client mynas { ipaddr = 18.220.171.233 secret = testing456 } At https://networkradius.com/doc/3.0.10/raddb/mods-available/dynamic_clients.h…, it first create a dynamic client, then start the server in debugging mode. Shouldn't it first start the server in debugging mode, then open another shell and create the client definition file to test if dynamic client works ? > Hmm... if anything in v2 doesn't work, upgrade to v3. In fact, I first tried FreeRADIUS 3.0.13 on centos 7.6. Because v3.0.13 doesn't work, I guess that v2 may work. In addition, for all the test, I store the users in mysql, but don't store nas clients in mysql. When store nas clients in mysql, dynamic-clients does work. So I test v3.0.13 on centos 7.6 again. This is the steps: 1. link /etc/raddb/sites-enabled/dynamic_clients to /etc/raddb/sites-available/dynamic_clients, and change the ownership of /etc/raddb/sites-enabled/dynamic_clients to root:radiusd 2. Change the content of /etc/raddb/sites-enabled/dynamic_clients to: client dynamic { ipaddr = 0.0.0.0/0 dynamic_clients = dynamic_clients directory = ${confdir}/dynamic-clients/ lifetime = 3600 } server dynamic_clients { authorize { # Example 2: Read the clients from "clients" files dynamic_clients # Tell the caller that the client was defined properly. ok } } 3. Create the /etc/raddb/dynamic-clients directory, change its ownership to root:radiusd 4. Run "setenforce 0' to disable selinux. 5. Start the server in debug mode. 6. Open another shell, create a file named 18.220.171.233 under / etc/raddb/dynamic-clients, with the following content: client mynas { ipaddr = 18.220.171.233 secret = testing456 } I also changed the ownership of 18.220.171.233 to root:radiusd 7. SSH to the nas server at 18.220.171.233, and run the radtest command to test the setup. 8. The debug gives the following result: (0) server dynamic_clients { (0) # Executing section authorize from file /etc/raddb/sites-enabled/dynamic-clients (0) authorize { (0) dynamic_clients: Improper configuration (0) [dynamic_clients] = noop (0) [ok] = ok (0) } # authorize = ok (0) } # server dynamic_clients (0) Converting control list to client fields (0) ERROR: Cannot add client 18.220.171.233: Required attribute "FreeRADIUS-Client-Secret" is missing Ignoring request to auth address * port 1812 bound to server default from unknown client 18.220.171.233 port 41902 proto udp 9. This is the full debug output: FreeRADIUS Version 3.0.13 Copyright (C) 1999-2017 The FreeRADIUS server project and contributors There is NO warranty; not even for MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE You may redistribute copies of FreeRADIUS under the terms of the GNU General Public License For more information about these matters, see the file named COPYRIGHT Starting - reading configuration files ... including dictionary file /usr/share/freeradius/dictionary including dictionary file /usr/share/freeradius/dictionary.dhcp including dictionary file /usr/share/freeradius/dictionary.vqp including dictionary file /etc/raddb/dictionary including configuration file /etc/raddb/radiusd.conf including configuration file /etc/raddb/proxy.conf including configuration file /etc/raddb/clients.conf including files in directory /etc/raddb/mods-enabled/ including configuration file /etc/raddb/mods-enabled/always including configuration file /etc/raddb/mods-enabled/attr_filter including configuration file /etc/raddb/mods-enabled/cache_eap including configuration file /etc/raddb/mods-enabled/chap including configuration file /etc/raddb/mods-enabled/date including configuration file /etc/raddb/mods-enabled/detail including configuration file /etc/raddb/mods-enabled/detail.log including configuration file /etc/raddb/mods-enabled/dhcp including configuration file /etc/raddb/mods-enabled/digest including configuration file /etc/raddb/mods-enabled/dynamic_clients including configuration file /etc/raddb/mods-enabled/eap including configuration file /etc/raddb/mods-enabled/echo including configuration file /etc/raddb/mods-enabled/exec including configuration file /etc/raddb/mods-enabled/expiration including configuration file /etc/raddb/mods-enabled/expr including configuration file /etc/raddb/mods-enabled/files including configuration file /etc/raddb/mods-enabled/linelog including configuration file /etc/raddb/mods-enabled/logintime including configuration file /etc/raddb/mods-enabled/mschap including configuration file /etc/raddb/mods-enabled/ntlm_auth including configuration file /etc/raddb/mods-enabled/pap including configuration file /etc/raddb/mods-enabled/passwd including configuration file /etc/raddb/mods-enabled/preprocess including configuration file /etc/raddb/mods-enabled/radutmp including configuration file /etc/raddb/mods-enabled/realm including configuration file /etc/raddb/mods-enabled/replicate including configuration file /etc/raddb/mods-enabled/soh including configuration file /etc/raddb/mods-enabled/sradutmp including configuration file /etc/raddb/mods-enabled/unix including configuration file /etc/raddb/mods-enabled/unpack including configuration file /etc/raddb/mods-enabled/utf8 including configuration file /etc/raddb/mods-enabled/sql including configuration file /etc/raddb/mods-config/sql/main/mysql/queries.conf including files in directory /etc/raddb/policy.d/ including configuration file /etc/raddb/policy.d/accounting including configuration file /etc/raddb/policy.d/canonicalization including configuration file /etc/raddb/policy.d/control including configuration file /etc/raddb/policy.d/cui including configuration file /etc/raddb/policy.d/debug including configuration file /etc/raddb/policy.d/dhcp including configuration file /etc/raddb/policy.d/eap including configuration file /etc/raddb/policy.d/filter including configuration file /etc/raddb/policy.d/operator-name including files in directory /etc/raddb/sites-enabled/ including configuration file /etc/raddb/sites-enabled/default including configuration file /etc/raddb/sites-enabled/inner-tunnel including configuration file /etc/raddb/sites-enabled/dynamic-clients main { security { user = "radiusd" group = "radiusd" allow_core_dumps = no } name = "radiusd" prefix = "/usr" localstatedir = "/var" logdir = "/var/log/radius" run_dir = "/var/run/radiusd" } main { name = "radiusd" prefix = "/usr" localstatedir = "/var" sbindir = "/usr/sbin" logdir = "/var/log/radius" run_dir = "/var/run/radiusd" libdir = "/usr/lib64/freeradius" radacctdir = "/var/log/radius/radacct" hostname_lookups = no max_request_time = 30 cleanup_delay = 5 max_requests = 16384 pidfile = "/var/run/radiusd/radiusd.pid" checkrad = "/usr/sbin/checkrad" debug_level = 0 proxy_requests = yes log { stripped_names = no auth = no auth_badpass = no auth_goodpass = no colourise = yes msg_denied = "You are already logged in - access denied" } resources { } security { max_attributes = 200 reject_delay = 1.000000 status_server = yes } } radiusd: #### Loading Realms and Home Servers #### proxy server { retry_delay = 5 retry_count = 3 default_fallback = no dead_time = 120 wake_all_if_all_dead = no } home_server localhost { ipaddr = 127.0.0.1 port = 1812 type = "auth" secret = <<< secret >>> response_window = 20.000000 response_timeouts = 1 max_outstanding = 65536 zombie_period = 40 status_check = "status-server" ping_interval = 30 check_interval = 30 check_timeout = 4 num_answers_to_alive = 3 revive_interval = 120 limit { max_connections = 16 max_requests = 0 lifetime = 0 idle_timeout = 0 } coa { irt = 2 mrt = 16 mrc = 5 mrd = 30 } } home_server_pool my_auth_failover { type = fail-over home_server = localhost } realm example.com { auth_pool = my_auth_failover } realm LOCAL { } radiusd: #### Loading Clients #### client localhost { ipaddr = 127.0.0.1 require_message_authenticator = no secret = <<< secret >>> nas_type = "other" proto = "*" limit { max_connections = 16 lifetime = 0 idle_timeout = 30 } } client localhost_ipv6 { ipv6addr = ::1 require_message_authenticator = no secret = <<< secret >>> limit { max_connections = 16 lifetime = 0 idle_timeout = 30 } } client dynamic { ipaddr = 0.0.0.0/0 require_message_authenticator = no limit { max_connections = 16 lifetime = 0 idle_timeout = 30 } dynamic_clients = "dynamic_clients" lifetime = 3600 } including dynamic clients in /etc/raddb/dynamic-clients/ Debugger not attached # Creating Auth-Type = mschap # Creating Auth-Type = digest # Creating Auth-Type = eap # Creating Auth-Type = PAP # Creating Auth-Type = CHAP # Creating Auth-Type = MS-CHAP radiusd: #### Instantiating modules #### modules { # Loaded module rlm_always # Loading module "reject" from file /etc/raddb/mods-enabled/always always reject { rcode = "reject" simulcount = 0 mpp = no } # Loading module "fail" from file /etc/raddb/mods-enabled/always always fail { rcode = "fail" simulcount = 0 mpp = no } # Loading module "ok" from file /etc/raddb/mods-enabled/always always ok { rcode = "ok" simulcount = 0 mpp = no } # Loading module "handled" from file /etc/raddb/mods-enabled/always always handled { rcode = "handled" simulcount = 0 mpp = no } # Loading module "invalid" from file /etc/raddb/mods-enabled/always always invalid { rcode = "invalid" simulcount = 0 mpp = no } # Loading module "userlock" from file /etc/raddb/mods-enabled/always always userlock { rcode = "userlock" simulcount = 0 mpp = no } # Loading module "notfound" from file /etc/raddb/mods-enabled/always always notfound { rcode = "notfound" simulcount = 0 mpp = no } # Loading module "noop" from file /etc/raddb/mods-enabled/always always noop { rcode = "noop" simulcount = 0 mpp = no } # Loading module "updated" from file /etc/raddb/mods-enabled/always always updated { rcode = "updated" simulcount = 0 mpp = no } # Loaded module rlm_attr_filter # Loading module "attr_filter.post-proxy" from file /etc/raddb/mods-enabled/attr_filter attr_filter attr_filter.post-proxy { filename = "/etc/raddb/mods-config/attr_filter/post-proxy" key = "%{Realm}" relaxed = no } # Loading module "attr_filter.pre-proxy" from file /etc/raddb/mods-enabled/attr_filter attr_filter attr_filter.pre-proxy { filename = "/etc/raddb/mods-config/attr_filter/pre-proxy" key = "%{Realm}" relaxed = no } # Loading module "attr_filter.access_reject" from file /etc/raddb/mods-enabled/attr_filter attr_filter attr_filter.access_reject { filename = "/etc/raddb/mods-config/attr_filter/access_reject" key = "%{User-Name}" relaxed = no } # Loading module "attr_filter.access_challenge" from file /etc/raddb/mods-enabled/attr_filter attr_filter attr_filter.access_challenge { filename = "/etc/raddb/mods-config/attr_filter/access_challenge" key = "%{User-Name}" relaxed = no } # Loading module "attr_filter.accounting_response" from file /etc/raddb/mods-enabled/attr_filter attr_filter attr_filter.accounting_response { filename = "/etc/raddb/mods-config/attr_filter/accounting_response" key = "%{User-Name}" relaxed = no } # Loaded module rlm_cache # Loading module "cache_eap" from file /etc/raddb/mods-enabled/cache_eap cache cache_eap { driver = "rlm_cache_rbtree" key = "%{%{control:State}:-%{%{reply:State}:-%{State}}}" ttl = 15 max_entries = 0 epoch = 0 add_stats = no } # Loaded module rlm_chap # Loading module "chap" from file /etc/raddb/mods-enabled/chap # Loaded module rlm_date # Loading module "date" from file /etc/raddb/mods-enabled/date date { format = "%b %e %Y %H:%M:%S %Z" } # Loaded module rlm_detail # Loading module "detail" from file /etc/raddb/mods-enabled/detail detail { filename = "/var/log/radius/radacct/%{%{Packet-Src-IP-Address}:-%{Packet-Src-IPv6-Address}}/detail-%Y%m%d" header = "%t" permissions = 384 locking = no escape_filenames = no log_packet_header = no } # Loading module "auth_log" from file /etc/raddb/mods-enabled/detail.log detail auth_log { filename = "/var/log/radius/radacct/%{%{Packet-Src-IP-Address}:-%{Packet-Src-IPv6-Address}}/auth-detail-%Y%m%d" header = "%t" permissions = 384 locking = no escape_filenames = no log_packet_header = no } # Loading module "reply_log" from file /etc/raddb/mods-enabled/detail.log detail reply_log { filename = "/var/log/radius/radacct/%{%{Packet-Src-IP-Address}:-%{Packet-Src-IPv6-Address}}/reply-detail-%Y%m%d" header = "%t" permissions = 384 locking = no escape_filenames = no log_packet_header = no } # Loading module "pre_proxy_log" from file /etc/raddb/mods-enabled/detail.log detail pre_proxy_log { filename = "/var/log/radius/radacct/%{%{Packet-Src-IP-Address}:-%{Packet-Src-IPv6-Address}}/pre-proxy-detail-%Y%m%d" header = "%t" permissions = 384 locking = no escape_filenames = no log_packet_header = no } # Loading module "post_proxy_log" from file /etc/raddb/mods-enabled/detail.log detail post_proxy_log { filename = "/var/log/radius/radacct/%{%{Packet-Src-IP-Address}:-%{Packet-Src-IPv6-Address}}/post-proxy-detail-%Y%m%d" header = "%t" permissions = 384 locking = no escape_filenames = no log_packet_header = no } # Loaded module rlm_dhcp # Loading module "dhcp" from file /etc/raddb/mods-enabled/dhcp # Loaded module rlm_digest # Loading module "digest" from file /etc/raddb/mods-enabled/digest # Loaded module rlm_dynamic_clients # Loading module "dynamic_clients" from file /etc/raddb/mods-enabled/dynamic_clients # Loaded module rlm_eap # Loading module "eap" from file /etc/raddb/mods-enabled/eap eap { default_eap_type = "md5" timer_expire = 60 ignore_unknown_eap_types = no cisco_accounting_username_bug = no max_sessions = 16384 } # Loaded module rlm_exec # Loading module "echo" from file /etc/raddb/mods-enabled/echo exec echo { wait = yes program = "/bin/echo %{User-Name}" input_pairs = "request" output_pairs = "reply" shell_escape = yes } # Loading module "exec" from file /etc/raddb/mods-enabled/exec exec { wait = no input_pairs = "request" shell_escape = yes timeout = 10 } # Loaded module rlm_expiration # Loading module "expiration" from file /etc/raddb/mods-enabled/expiration # Loaded module rlm_expr # Loading module "expr" from file /etc/raddb/mods-enabled/expr expr { safe_characters = "@abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ0123456789.-_: /äéöüàâæçèéêëîïôœùûüaÿÄÉÖÜßÀÂÆÇÈÉÊËÎÏÔŒÙÛÜŸ" } # Loaded module rlm_files # Loading module "files" from file /etc/raddb/mods-enabled/files files { filename = "/etc/raddb/mods-config/files/authorize" acctusersfile = "/etc/raddb/mods-config/files/accounting" preproxy_usersfile = "/etc/raddb/mods-config/files/pre-proxy" } # Loaded module rlm_linelog # Loading module "linelog" from file /etc/raddb/mods-enabled/linelog linelog { filename = "/var/log/radius/linelog" escape_filenames = no syslog_severity = "info" permissions = 384 format = "This is a log message for %{User-Name}" reference = "messages.%{%{reply:Packet-Type}:-default}" } # Loading module "log_accounting" from file /etc/raddb/mods-enabled/linelog linelog log_accounting { filename = "/var/log/radius/linelog-accounting" escape_filenames = no syslog_severity = "info" permissions = 384 format = "" reference = "Accounting-Request.%{%{Acct-Status-Type}:-unknown}" } # Loaded module rlm_logintime # Loading module "logintime" from file /etc/raddb/mods-enabled/logintime logintime { minimum_timeout = 60 } # Loaded module rlm_mschap # Loading module "mschap" from file /etc/raddb/mods-enabled/mschap mschap { use_mppe = yes require_encryption = no require_strong = no with_ntdomain_hack = yes passchange { } allow_retry = yes winbind_retry_with_normalised_username = no } # Loading module "ntlm_auth" from file /etc/raddb/mods-enabled/ntlm_auth exec ntlm_auth { wait = yes program = "/path/to/ntlm_auth --request-nt-key --domain=MYDOMAIN --username=%{mschap:User-Name} --password=%{User-Password}" shell_escape = yes } # Loaded module rlm_pap # Loading module "pap" from file /etc/raddb/mods-enabled/pap pap { normalise = yes } # Loaded module rlm_passwd # Loading module "etc_passwd" from file /etc/raddb/mods-enabled/passwd passwd etc_passwd { filename = "/etc/passwd" format = "*User-Name:Crypt-Password:" delimiter = ":" ignore_nislike = no ignore_empty = yes allow_multiple_keys = no hash_size = 100 } # Loaded module rlm_preprocess # Loading module "preprocess" from file /etc/raddb/mods-enabled/preprocess preprocess { huntgroups = "/etc/raddb/mods-config/preprocess/huntgroups" hints = "/etc/raddb/mods-config/preprocess/hints" with_ascend_hack = no ascend_channels_per_line = 23 with_ntdomain_hack = no with_specialix_jetstream_hack = no with_cisco_vsa_hack = no with_alvarion_vsa_hack = no } # Loaded module rlm_radutmp # Loading module "radutmp" from file /etc/raddb/mods-enabled/radutmp radutmp { filename = "/var/log/radius/radutmp" username = "%{User-Name}" case_sensitive = yes check_with_nas = yes permissions = 384 caller_id = yes } # Loaded module rlm_realm # Loading module "IPASS" from file /etc/raddb/mods-enabled/realm realm IPASS { format = "prefix" delimiter = "/" ignore_default = no ignore_null = no } # Loading module "suffix" from file /etc/raddb/mods-enabled/realm realm suffix { format = "suffix" delimiter = "@" ignore_default = no ignore_null = no } # Loading module "realmpercent" from file /etc/raddb/mods-enabled/realm realm realmpercent { format = "suffix" delimiter = "%" ignore_default = no ignore_null = no } # Loading module "ntdomain" from file /etc/raddb/mods-enabled/realm realm ntdomain { format = "prefix" delimiter = "\\" ignore_default = no ignore_null = no } # Loaded module rlm_replicate # Loading module "replicate" from file /etc/raddb/mods-enabled/replicate # Loaded module rlm_soh # Loading module "soh" from file /etc/raddb/mods-enabled/soh soh { dhcp = yes } # Loading module "sradutmp" from file /etc/raddb/mods-enabled/sradutmp radutmp sradutmp { filename = "/var/log/radius/sradutmp" username = "%{User-Name}" case_sensitive = yes check_with_nas = yes permissions = 420 caller_id = no } # Loaded module rlm_unix # Loading module "unix" from file /etc/raddb/mods-enabled/unix unix { radwtmp = "/var/log/radius/radwtmp" } Creating attribute Unix-Group # Loaded module rlm_unpack # Loading module "unpack" from file /etc/raddb/mods-enabled/unpack # Loaded module rlm_utf8 # Loading module "utf8" from file /etc/raddb/mods-enabled/utf8 # Loaded module rlm_sql # Loading module "sql" from file /etc/raddb/mods-enabled/sql sql { driver = "rlm_sql_mysql" server = "localhost" port = 3306 login = "radius" password = <<< secret >>> radius_db = "radius" read_groups = yes read_profiles = yes read_clients = no delete_stale_sessions = yes sql_user_name = "%{User-Name}" default_user_profile = "" client_query = "SELECT id, nasname, shortname, type, secret, server FROM nas" authorize_check_query = "SELECT id, username, attribute, value, op FROM radcheck WHERE username = '%{SQL-User-Name}' ORDER BY id" authorize_reply_query = "SELECT id, username, attribute, value, op FROM radreply WHERE username = '%{SQL-User-Name}' ORDER BY id" authorize_group_check_query = "SELECT id, groupname, attribute, Value, op FROM radgroupcheck WHERE groupname = '%{SQL-Group}' ORDER BY id" authorize_group_reply_query = "SELECT id, groupname, attribute, value, op FROM radgroupreply WHERE groupname = '%{SQL-Group}' ORDER BY id" group_membership_query = "SELECT groupname FROM radusergroup WHERE username = '%{SQL-User-Name}' ORDER BY priority" simul_count_query = "SELECT COUNT(*) FROM radacct WHERE username = '%{SQL-User-Name}' AND acctstoptime IS NULL" simul_verify_query = "SELECT radacctid, acctsessionid, username, nasipaddress, nasportid, framedipaddress, callingstationid, framedprotocol FROM radacct WHERE username = '%{SQL-User-Name}' AND acctstoptime IS NULL" safe_characters = "@abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ0123456789.-_: /" accounting { reference = "%{tolower:type.%{Acct-Status-Type}.query}" type { accounting-on { query = "UPDATE radacct SET acctstoptime = FROM_UNIXTIME(%{integer:Event-Timestamp}), acctsessiontime = '%{integer:Event-Timestamp}' - UNIX_TIMESTAMP(acctstarttime), acctterminatecause = '%{%{Acct-Terminate-Cause}:-NAS-Reboot}' WHERE acctstoptime IS NULL AND nasipaddress = '%{NAS-IP-Address}' AND acctstarttime <= FROM_UNIXTIME(%{integer:Event-Timestamp})" } accounting-off { query = "UPDATE radacct SET acctstoptime = FROM_UNIXTIME(%{integer:Event-Timestamp}), acctsessiontime = '%{integer:Event-Timestamp}' - UNIX_TIMESTAMP(acctstarttime), acctterminatecause = '%{%{Acct-Terminate-Cause}:-NAS-Reboot}' WHERE acctstoptime IS NULL AND nasipaddress = '%{NAS-IP-Address}' AND acctstarttime <= FROM_UNIXTIME(%{integer:Event-Timestamp})" } start { query = "INSERT INTO radacct (acctsessionid, acctuniqueid, username, realm, nasipaddress, nasportid, nasporttype, acctstarttime, acctupdatetime, acctstoptime, acctsessiontime, acctauthentic, connectinfo_start, connectinfo_stop, acctinputoctets, acctoutputoctets, calledstationid, callingstationid, acctterminatecause, servicetype, framedprotocol, framedipaddress) VALUES ('%{Acct-Session-Id}', '%{Acct-Unique-Session-Id}', '%{SQL-User-Name}', '%{Realm}', '%{NAS-IP-Address}', '%{%{NAS-Port-ID}:-%{NAS-Port}}', '%{NAS-Port-Type}', FROM_UNIXTIME(%{integer:Event-Timestamp}), FROM_UNIXTIME(%{integer:Event-Timestamp}), NULL, '0', '%{Acct-Authentic}', '%{Connect-Info}', '', '0', '0', '%{Called-Station-Id}', '%{Calling-Station-Id}', '', '%{Service-Type}', '%{Framed-Protocol}', '%{Framed-IP-Address}')" } interim-update { query = "UPDATE radacct SET acctupdatetime = (@acctupdatetime_old:=acctupdatetime), acctupdatetime = FROM_UNIXTIME(%{integer:Event-Timestamp}), acctinterval = %{integer:Event-Timestamp} - UNIX_TIMESTAMP(@acctupdatetime_old), framedipaddress = '%{Framed-IP-Address}', acctsessiontime = %{%{Acct-Session-Time}:-NULL}, acctinputoctets = '%{%{Acct-Input-Gigawords}:-0}' << 32 | '%{%{Acct-Input-Octets}:-0}', acctoutputoctets = '%{%{Acct-Output-Gigawords}:-0}' << 32 | '%{%{Acct-Output-Octets}:-0}' WHERE AcctUniqueId = '%{Acct-Unique-Session-Id}'" } stop { query = "UPDATE radacct SET acctstoptime = FROM_UNIXTIME(%{integer:Event-Timestamp}), acctsessiontime = %{%{Acct-Session-Time}:-NULL}, acctinputoctets = '%{%{Acct-Input-Gigawords}:-0}' << 32 | '%{%{Acct-Input-Octets}:-0}', acctoutputoctets = '%{%{Acct-Output-Gigawords}:-0}' << 32 | '%{%{Acct-Output-Octets}:-0}', acctterminatecause = '%{Acct-Terminate-Cause}', connectinfo_stop = '%{Connect-Info}' WHERE AcctUniqueId = '%{Acct-Unique-Session-Id}'" } } } post-auth { reference = ".query" query = "INSERT INTO radpostauth (username, pass, reply, authdate) VALUES ( '%{SQL-User-Name}', '%{%{User-Password}:-%{Chap-Password}}', '%{reply:Packet-Type}', '%S')" } } rlm_sql (sql): Driver rlm_sql_mysql (module rlm_sql_mysql) loaded and linked Creating attribute SQL-Group instantiate { } # Instantiating module "reject" from file /etc/raddb/mods-enabled/always # Instantiating module "fail" from file /etc/raddb/mods-enabled/always # Instantiating module "ok" from file /etc/raddb/mods-enabled/always # Instantiating module "handled" from file /etc/raddb/mods-enabled/always # Instantiating module "invalid" from file /etc/raddb/mods-enabled/always # Instantiating module "userlock" from file /etc/raddb/mods-enabled/always # Instantiating module "notfound" from file /etc/raddb/mods-enabled/always # Instantiating module "noop" from file /etc/raddb/mods-enabled/always # Instantiating module "updated" from file /etc/raddb/mods-enabled/always # Instantiating module "attr_filter.post-proxy" from file /etc/raddb/mods-enabled/attr_filter reading pairlist file /etc/raddb/mods-config/attr_filter/post-proxy # Instantiating module "attr_filter.pre-proxy" from file /etc/raddb/mods-enabled/attr_filter reading pairlist file /etc/raddb/mods-config/attr_filter/pre-proxy # Instantiating module "attr_filter.access_reject" from file /etc/raddb/mods-enabled/attr_filter reading pairlist file /etc/raddb/mods-config/attr_filter/access_reject [/etc/raddb/mods-config/attr_filter/access_reject]:11 Check item "FreeRADIUS-Response-Delay" found in filter list for realm "DEFAULT". [/etc/raddb/mods-config/attr_filter/access_reject]:11 Check item "FreeRADIUS-Response-Delay-USec" found in filter list for realm "DEFAULT". # Instantiating module "attr_filter.access_challenge" from file /etc/raddb/mods-enabled/attr_filter reading pairlist file /etc/raddb/mods-config/attr_filter/access_challenge # Instantiating module "attr_filter.accounting_response" from file /etc/raddb/mods-enabled/attr_filter reading pairlist file /etc/raddb/mods-config/attr_filter/accounting_response # Instantiating module "cache_eap" from file /etc/raddb/mods-enabled/cache_eap rlm_cache (cache_eap): Driver rlm_cache_rbtree (module rlm_cache_rbtree) loaded and linked # Instantiating module "detail" from file /etc/raddb/mods-enabled/detail # Instantiating module "auth_log" from file /etc/raddb/mods-enabled/detail.log rlm_detail (auth_log): 'User-Password' suppressed, will not appear in detail output # Instantiating module "reply_log" from file /etc/raddb/mods-enabled/detail.log # Instantiating module "pre_proxy_log" from file /etc/raddb/mods-enabled/detail.log # Instantiating module "post_proxy_log" from file /etc/raddb/mods-enabled/detail.log # Instantiating module "eap" from file /etc/raddb/mods-enabled/eap # Linked to sub-module rlm_eap_md5 # Linked to sub-module rlm_eap_leap # Linked to sub-module rlm_eap_gtc gtc { challenge = "Password: " auth_type = "PAP" } # Linked to sub-module rlm_eap_tls tls { tls = "tls-common" } tls-config tls-common { verify_depth = 0 ca_path = "/etc/raddb/certs" pem_file_type = yes private_key_file = "/etc/raddb/certs/server.pem" certificate_file = "/etc/raddb/certs/server.pem" ca_file = "/etc/raddb/certs/ca.pem" private_key_password = <<< secret >>> dh_file = "/etc/raddb/certs/dh" fragment_size = 1024 include_length = yes auto_chain = yes check_crl = no check_all_crl = no cipher_list = "DEFAULT" cipher_server_preference = no ecdh_curve = "prime256v1" cache { enable = no lifetime = 24 max_entries = 255 } verify { skip_if_ocsp_ok = no } ocsp { enable = no override_cert_url = yes url = "http://127.0.0.1/ocsp/" use_nonce = yes timeout = 0 softfail = no } } # Linked to sub-module rlm_eap_ttls ttls { tls = "tls-common" default_eap_type = "md5" copy_request_to_tunnel = no use_tunneled_reply = no virtual_server = "inner-tunnel" include_length = yes require_client_cert = no } tls: Using cached TLS configuration from previous invocation # Linked to sub-module rlm_eap_peap peap { tls = "tls-common" default_eap_type = "mschapv2" copy_request_to_tunnel = no use_tunneled_reply = no proxy_tunneled_request_as_eap = yes virtual_server = "inner-tunnel" soh = no require_client_cert = no } tls: Using cached TLS configuration from previous invocation # Linked to sub-module rlm_eap_mschapv2 mschapv2 { with_ntdomain_hack = no send_error = no } # Instantiating module "expiration" from file /etc/raddb/mods-enabled/expiration # Instantiating module "files" from file /etc/raddb/mods-enabled/files reading pairlist file /etc/raddb/mods-config/files/authorize reading pairlist file /etc/raddb/mods-config/files/accounting reading pairlist file /etc/raddb/mods-config/files/pre-proxy # Instantiating module "linelog" from file /etc/raddb/mods-enabled/linelog # Instantiating module "log_accounting" from file /etc/raddb/mods-enabled/linelog # Instantiating module "logintime" from file /etc/raddb/mods-enabled/logintime # Instantiating module "mschap" from file /etc/raddb/mods-enabled/mschap rlm_mschap (mschap): using internal authentication # Instantiating module "pap" from file /etc/raddb/mods-enabled/pap # Instantiating module "etc_passwd" from file /etc/raddb/mods-enabled/passwd rlm_passwd: nfields: 3 keyfield 0(User-Name) listable: no # Instantiating module "preprocess" from file /etc/raddb/mods-enabled/preprocess reading pairlist file /etc/raddb/mods-config/preprocess/huntgroups reading pairlist file /etc/raddb/mods-config/preprocess/hints # Instantiating module "IPASS" from file /etc/raddb/mods-enabled/realm # Instantiating module "suffix" from file /etc/raddb/mods-enabled/realm # Instantiating module "realmpercent" from file /etc/raddb/mods-enabled/realm # Instantiating module "ntdomain" from file /etc/raddb/mods-enabled/realm # Instantiating module "sql" from file /etc/raddb/mods-enabled/sql rlm_sql_mysql: libmysql version: 5.5.60-MariaDB mysql { tls { } warnings = "auto" } rlm_sql (sql): Attempting to connect to database "radius" rlm_sql (sql): Initialising connection pool pool { start = 5 min = 3 max = 32 spare = 10 uses = 0 lifetime = 0 cleanup_interval = 30 idle_timeout = 60 retry_delay = 30 spread = no } rlm_sql (sql): Opening additional connection (0), 1 of 32 pending slots used rlm_sql_mysql: Starting connect to MySQL server rlm_sql_mysql: Connected to database 'radius' on Localhost via UNIX socket, server version 5.5.60-MariaDB, protocol version 10 rlm_sql (sql): Opening additional connection (1), 1 of 31 pending slots used rlm_sql_mysql: Starting connect to MySQL server rlm_sql_mysql: Connected to database 'radius' on Localhost via UNIX socket, server version 5.5.60-MariaDB, protocol version 10 rlm_sql (sql): Opening additional connection (2), 1 of 30 pending slots used rlm_sql_mysql: Starting connect to MySQL server rlm_sql_mysql: Connected to database 'radius' on Localhost via UNIX socket, server version 5.5.60-MariaDB, protocol version 10 rlm_sql (sql): Opening additional connection (3), 1 of 29 pending slots used rlm_sql_mysql: Starting connect to MySQL server rlm_sql_mysql: Connected to database 'radius' on Localhost via UNIX socket, server version 5.5.60-MariaDB, protocol version 10 rlm_sql (sql): Opening additional connection (4), 1 of 28 pending slots used rlm_sql_mysql: Starting connect to MySQL server rlm_sql_mysql: Connected to database 'radius' on Localhost via UNIX socket, server version 5.5.60-MariaDB, protocol version 10 } # modules radiusd: #### Loading Virtual Servers #### server { # from file /etc/raddb/radiusd.conf } # server server default { # from file /etc/raddb/sites-enabled/default # Loading authenticate {...} # Loading authorize {...} # Loading preacct {...} # Loading accounting {...} # Loading session {...} # Loading post-proxy {...} # Loading post-auth {...} } # server default server inner-tunnel { # from file /etc/raddb/sites-enabled/inner-tunnel # Loading authenticate {...} # Loading authorize {...} # Loading session {...} # Loading post-proxy {...} # Loading post-auth {...} # Skipping contents of 'if' as it is always 'false' -- /etc/raddb/sites-enabled/inner-tunnel:330 } # server inner-tunnel server dynamic_clients { # from file /etc/raddb/sites-enabled/dynamic-clients # Loading authorize {...} } # server dynamic_clients radiusd: #### Opening IP addresses and Ports #### listen { type = "auth" ipaddr = * port = 0 limit { max_connections = 16 lifetime = 0 idle_timeout = 30 } } listen { type = "acct" ipaddr = * port = 0 limit { max_connections = 16 lifetime = 0 idle_timeout = 30 } } listen { type = "auth" ipv6addr = :: port = 0 limit { max_connections = 16 lifetime = 0 idle_timeout = 30 } } listen { type = "acct" ipv6addr = :: port = 0 limit { max_connections = 16 lifetime = 0 idle_timeout = 30 } } listen { type = "auth" ipaddr = 127.0.0.1 port = 18120 } Listening on auth address * port 1812 bound to server default Listening on acct address * port 1813 bound to server default Listening on auth address :: port 1812 bound to server default Listening on acct address :: port 1813 bound to server default Listening on auth address 127.0.0.1 port 18120 bound to server inner-tunnel Listening on proxy address * port 46730 Listening on proxy address :: port 50332 Ready to process requests (0) server dynamic_clients { (0) # Executing section authorize from file /etc/raddb/sites-enabled/dynamic-clients (0) authorize { (0) dynamic_clients: Improper configuration (0) [dynamic_clients] = noop (0) [ok] = ok (0) } # authorize = ok (0) } # server dynamic_clients (0) Converting control list to client fields (0) ERROR: Cannot add client 18.220.171.233: Required attribute "FreeRADIUS-Client-Secret" is missing Ignoring request to auth address * port 1812 bound to server default from unknown client 18.220.171.233 port 41902 proto udp Ready to process requests On Sun, Feb 24, 2019 at 6:05 AM < freeradius-users-request(a)lists.freeradius.org> wrote: > Send Freeradius-Users mailing list submissions to > freeradius-users(a)lists.freeradius.org > > To subscribe or unsubscribe via the World Wide Web, visit > http://lists.freeradius.org/mailman/listinfo/freeradius-users > or, via email, send a message with subject or body 'help' to > freeradius-users-request(a)lists.freeradius.org > > You can reach the person managing the list at > freeradius-users-owner(a)lists.freeradius.org > > When replying, please edit your Subject line so it is more specific > than "Re: Contents of Freeradius-Users digest..." > > > Today's Topics: > > 1. Re: How mitigate mac spoofing in mab (arjun sharma) > 2. Google LDAP integration failure (Phil Grace) > 3. Re: Google LDAP integration failure (Alan DeKok) > 4. Re: Reading dynamic clients from "clients" files in > /etc/raddb/dynamic-clients doesn't work (Alan DeKok) > 5. Re: Google LDAP integration failure (Phil Grace) > > > ---------------------------------------------------------------------- > > Message: 1 > Date: Sat, 23 Feb 2019 22:33:17 +0530 > From: arjun sharma <arjuniet.28(a)gmail.com> > To: FreeRadius users mailing list > <freeradius-users(a)lists.freeradius.org> > Subject: Re: How mitigate mac spoofing in mab > Message-ID: > < > CAFes+Jifm3X8DnJ8jjGHgfe5bWjdoK_Ekv_j8xVa7HgVXPTYeg(a)mail.gmail.com> > Content-Type: text/plain; charset="UTF-8" > > hi , > This is a very basic thing that can be handled with some efforts :- > > When you are not in position to use 802.1x ( which is also not a vulernable > proof to spoofing attacks ) . Use MAB as a auth mechanism but dont make it > a requirement to authentication but not the only condition to authenticate > . After MAB success you have to use upper layer to mitigate the Mac > spoofing, use MOD_AUTH_RADIUS https://freeradius.org/sub_projects/ . ( > link to the mod ) > > Now you can use apache ( webserver as radius client ) now bind certain > vulernable easy to spoof parametres to cookies and sent it as cookies to > the browser this way your mab can be authenticated in itself . i.e.. > consider only the clients with this cookies as the authentic holder of > that mac . This will helo you > > > By using simultaneous use and all you will find yourself in trouble while > implementing roaming ( i faced it ) > > > > > > On Fri, Feb 8, 2019 at 1:42 AM Alan DeKok <aland(a)deployingradius.com> > wrote: > > > On Feb 7, 2019, at 3:10 PM, Carlos Bordon <cgermanb(a)live.com.ar> wrote: > > > > > > Hi! i have a problem with this vulnerability, i need mitigate it. > > > > > > I have ine server with freeradius, other with dhcp and they are connect > > to cisco 6800 swicht. We aunthenticate the endpoint with mab, because we > > cant use 802.1x. the problem that i want to resolve is to mitigate mac > > spoofing on layer two. > > > For us is the same mitigate the problem on the radius or the swicht > > config. > > > > > > Do you guys know any idea? > > > > Use 802.1X. > > > > The MAC address can always be spoofed on the client machine. > > > > If you can't use 802.1X, then you need to track known MAC addresses. > > And if a MAC is online, disallow the same MAC from getting on the network > > again. > > > > There's really very little you can do with unsecured and unsafe network > > protocols. > > > > Alan DeKok. > > > > > > - > > List info/subscribe/unsubscribe? See > > http://www.freeradius.org/list/users.html > > > ------------------------------ > > Message: 2 > Date: Sat, 23 Feb 2019 11:58:19 -0600 > From: Phil Grace <phil.grace(a)hssd.k12.ar.us> > To: freeradius-users(a)lists.freeradius.org > Subject: Google LDAP integration failure > Message-ID: <E3D20FBE-C243-4E93-9A08-662419491B93(a)hssd.k12.ar.us> > Content-Type: text/plain; charset=utf-8 > > Hi everyone, I’m brand new and having an issue that I haven’t found a > clear answer to. I’m running free radius 3.x on ubuntu server 18.10. I have > LDAP enabled to auth to google secure LDAP. So far I’m binding to google > successfully and with the radtest command my LDAP user gets access-accept. > If I do raddest with -t mschap I get access-reject. > > I’m hoping that someone more experienced can point me in the right > direction as to where I can fix the issue. Here’s a snippet of my log in -X > mode. Thanks in advance to anyone that can help > > > =================================================================================================================== > > > rlm_ldap (ldap): Connecting to ldaps://ldap.google.com:636 > rlm_ldap (ldap): Waiting for bind result... > rlm_ldap (ldap): Bind successful > (15) [ldap] = ok > (15) [expiration] = noop > (15) [logintime] = noop > (15) [pap] = noop > (15) } # authorize = updated > (15) Found Auth-Type = eap > (15) # Executing group from file > /etc/freeradius/3.0/sites-enabled/inner-tunnel > (15) authenticate { > (15) eap: Expiring EAP session with state 0x53c912cb54220b41 > (15) eap: Finished EAP session with state 0x313d43603170599a > (15) eap: Previous EAP request found for state 0x313d43603170599a, > released from the list > (15) eap: Peer sent packet with method EAP MSCHAPv2 (26) > (15) eap: Calling submodule eap_mschapv2 to process data > (15) eap_mschapv2: # Executing group from file > /etc/freeradius/3.0/sites-enabled/inner-tunnel > (15) eap_mschapv2: authenticate { > (15) mschap: WARNING: No Cleartext-Password configured. Cannot create > NT-Password > (15) mschap: WARNING: No Cleartext-Password configured. Cannot create > LM-Password > (15) mschap: Creating challenge hash with username: > phil.grace(a)hssd.k12.ar.us > (15) mschap: Client is using MS-CHAPv2 > (15) mschap: ERROR: FAILED: No NT/LM-Password. Cannot perform > authentication > (15) mschap: ERROR: MS-CHAP2-Response is incorrect > (15) [mschap] = reject > (15) } # authenticate = reject > (15) eap: Sending EAP Failure (code 4) ID 77 length 4 > (15) eap: Freeing handler > (15) [eap] = reject > (15) } # authenticate = reject > (15) Failed to authenticate the user > (15) Using Post-Auth-Type Reject > (15) # Executing group from file > /etc/freeradius/3.0/sites-enabled/inner-tunnel > (15) Post-Auth-Type REJECT { > (15) attr_filter.access_reject: EXPAND %{User-Name} > (15) attr_filter.access_reject: --> phil.grace(a)hssd.k12.ar.us > (15) attr_filter.access_reject: Matched entry DEFAULT at line 11 > (15) [attr_filter.access_reject] = updated > (15) update outer.session-state { > (15) &Module-Failure-Message := &request:Module-Failure-Message -> > 'mschap: FAILED: No NT/LM-Password. Cannot perform authentication' > (15) } # update outer.session-state = noop > (15) } # Post-Auth-Type REJECT = updated > (15) } # server inner-tunnel > (15) Virtual server sending reply > (15) MS-CHAP-Error = "ME=691 R=1 C=369d22d8c278cfa7667ff5d2ab0bf287 V=3 > M=Authentication rejected" > (15) EAP-Message = 0x044d0004 > (15) Message-Authenticator = 0x00000000000000000000000000000000 > (15) eap_peap: Got tunneled reply code 3 > (15) eap_peap: MS-CHAP-Error = "ME=691 R=1 > C=369d22d8c278cfa7667ff5d2ab0bf287 V=3 M=Authentication rejected" > (15) eap_peap: EAP-Message = 0x044d0004 > (15) eap_peap: Message-Authenticator = 0x00000000000000000000000000000000 > (15) eap_peap: Got tunneled reply RADIUS code 3 > (15) eap_peap: MS-CHAP-Error = "ME=691 R=1 > C=369d22d8c278cfa7667ff5d2ab0bf287 V=3 M=Authentication rejected" > (15) eap_peap: EAP-Message = 0x044d0004 > (15) eap_peap: Message-Authenticator = 0x00000000000000000000000000000000 > (15) eap_peap: Tunneled authentication was rejected > (15) eap_peap: FAILURE > (15) eap: Sending EAP Request (code 1) ID 78 length 46 > (15) eap: EAP session adding &reply:State = 0x893d3c588e7325ea > (15) [eap] = handled > (15) } # authenticate = handled > (15) Using Post-Auth-Type Challenge > (15) # Executing group from file /etc/freeradius/3.0/sites-enabled/default > (15) Challenge { ... } # empty sub-section is ignored > (15) session-state: Saving cached attributes > (15) Module-Failure-Message := "mschap: FAILED: No NT/LM-Password. > Cannot perform authentication" > (15) Sent Access-Challenge Id 78 from 10.8.172.26:1812 to > 10.8.173.105:38595 length 0 > (15) EAP-Message = > 0x014e002e1900170303002377d07beda30c6131207f85740de5138af7d4342329fb590ca32ddd8e781256a69c9a3a > (15) Message-Authenticator = 0x00000000000000000000000000000000 > (15) State = 0x893d3c588e7325ea93a4d1f0a45e4742 > (15) Finished request > Waking up in 3.4 seconds. > (16) Received Access-Request Id 79 from 10.8.173.105:38595 to > 10.8.172.26:1812 length 320 > (16) User-Name = "phil.grace(a)hssd.k12.ar.us" > (16) NAS-IP-Address = 10.8.173.105 > (16) Called-Station-Id = "8A-15-54-AB-61-48:Faculty" > (16) NAS-Port-Type = Wireless-802.11 > (16) Service-Type = Framed-User > (16) NAS-Port = 1 > (16) Calling-Station-Id = "C8-3C-85-9C-A7-17" > (16) Connect-Info = "CONNECT 54.00 Mbps, 802.11ac, RSSI: 26, Channel: > 149" > (16) Acct-Session-Id = "03D12019BACECB86" > (16) WLAN-Pairwise-Cipher = 1027076 > (16) WLAN-Group-Cipher = 1027074 > (16) WLAN-AKM-Suite = 1027073 > (16) Meraki-Device-Name = "Technology Dept" > (16) Framed-MTU = 1400 > (16) EAP-Message = > 0x024e002e1900170303002321d3fee96f33295e5c79085340cadd61fe65772f5ac4bf4fb1b67c9346e8461e546cea > (16) State = 0x893d3c588e7325ea93a4d1f0a45e4742 > (16) Message-Authenticator = 0x36f2f741b4dbc208756af96049eeda54 > (16) Restoring &session-state > (16) &session-state:Module-Failure-Message := "mschap: FAILED: No > NT/LM-Password. Cannot perform authentication" > (16) # Executing section authorize from file > /etc/freeradius/3.0/sites-enabled/default > (16) authorize { > (16) policy filter_username { > (16) if (&User-Name) { > (16) if (&User-Name) -> TRUE > (16) if (&User-Name) { > (16) if (&User-Name =~ / /) { > (16) if (&User-Name =~ / /) -> FALSE > (16) if (&User-Name =~ /@[^@]*@/ ) { > (16) if (&User-Name =~ /@[^@]*@/ ) -> FALSE > (16) if (&User-Name =~ /\.\./ ) { > (16) if (&User-Name =~ /\.\./ ) -> FALSE > (16) if ((&User-Name =~ /@/) && (&User-Name !~ /(a)(.+)\.(.+)$/)) { > (16) if ((&User-Name =~ /@/) && (&User-Name !~ /(a)(.+)\.(.+)$/)) > -> FALSE > (16) if (&User-Name =~ /\.$/) { > (16) if (&User-Name =~ /\.$/) -> FALSE > (16) if (&User-Name =~ /(a)\./) { > (16) if (&User-Name =~ /(a)\./) -> FALSE > (16) } # if (&User-Name) = notfound > (16) } # policy filter_username = notfound > (16) [preprocess] = ok > (16) [chap] = noop > (16) [mschap] = noop > (16) [digest] = noop > (16) suffix: Checking for suffix after "@" > (16) suffix: Looking up realm "hssd.k12.ar.us" for User-Name = " > phil.grace(a)hssd.k12.ar.us" > (16) suffix: No such realm "hssd.k12.ar.us" > (16) [suffix] = noop > (16) eap: Peer sent EAP Response (code 2) ID 78 length 46 > (16) eap: Continuing tunnel setup > (16) [eap] = ok > (16) } # authorize = ok > (16) Found Auth-Type = eap > (16) # Executing group from file /etc/freeradius/3.0/sites-enabled/default > (16) authenticate { > (16) eap: Expiring EAP session with state 0x53c912cb54220b41 > (16) eap: Finished EAP session with state 0x893d3c588e7325ea > (16) eap: Previous EAP request found for state 0x893d3c588e7325ea, > released from the list > (16) eap: Peer sent packet with method EAP PEAP (25) > (16) eap: Calling submodule eap_peap to process data > (16) eap_peap: Continuing EAP-TLS > (16) eap_peap: [eaptls verify] = ok > (16) eap_peap: Done initial handshake > (16) eap_peap: [eaptls process] = ok > (16) eap_peap: Session established. Decoding tunneled attributes > (16) eap_peap: PEAP state send tlv failure > (16) eap_peap: Received EAP-TLV response > (16) eap_peap: ERROR: The users session was previously rejected: > returning reject (again.) > (16) eap_peap: This means you need to read the PREVIOUS messages in the > debug output > (16) eap_peap: to find out the reason why the user was rejected > (16) eap_peap: Look for "reject" or "fail". Those earlier messages will > tell you > (16) eap_peap: what went wrong, and how to fix the problem > (16) eap: ERROR: Failed continuing EAP PEAP (25) session. EAP sub-module > failed > (16) eap: Sending EAP Failure (code 4) ID 78 length 4 > (16) eap: Failed in EAP select > (16) [eap] = invalid > (16) } # authenticate = invalid > (16) Failed to authenticate the user > (16) Using Post-Auth-Type Reject > (16) # Executing group from file /etc/freeradius/3.0/sites-enabled/default > (16) Post-Auth-Type REJECT { > (16) attr_filter.access_reject: EXPAND %{User-Name} > (16) attr_filter.access_reject: --> phil.grace(a)hssd.k12.ar.us > (16) attr_filter.access_reject: Matched entry DEFAULT at line 11 > (16) [attr_filter.access_reject] = updated > (16) [eap] = noop > (16) policy remove_reply_message_if_eap { > (16) if (&reply:EAP-Message && &reply:Reply-Message) { > (16) if (&reply:EAP-Message && &reply:Reply-Message) -> FALSE > (16) else { > (16) [noop] = noop > (16) } # else = noop > (16) } # policy remove_reply_message_if_eap = noop > (16) } # Post-Auth-Type REJECT = updated > (16) Delaying response for 1.000000 seconds > Waking up in 0.3 seconds. > Waking up in 0.6 seconds. > (16) Sending delayed response > (16) Sent Access-Reject Id 79 from 10.8.172.26:1812 to 10.8.173.105:38595 > length 44 > (16) EAP-Message = 0x044e0004 > (16) Message-Authenticator = 0x00000000000000000000000000000000 > > > > > =================================================================================== > > > > > > Phil Grace > Director of Technology > Heber Springs School District > phil.grace(a)hssd.k12.ar.us > > Arkansas LEA Rep to the NCES Forum > National Center for Education Statistics > https://nces.ed.gov/forum/ > > > > > > > > > > ------------------------------ > > Message: 3 > Date: Sat, 23 Feb 2019 14:08:43 -0500 > From: Alan DeKok <aland(a)deployingradius.com> > To: FreeRadius users mailing list > <freeradius-users(a)lists.freeradius.org> > Subject: Re: Google LDAP integration failure > Message-ID: <049DAF36-A892-419F-8A44-82BBC77A0D5E(a)deployingradius.com> > Content-Type: text/plain; charset=utf-8 > > On Feb 23, 2019, at 12:58 PM, Phil Grace <phil.grace(a)hssd.k12.ar.us> > wrote: > > > > Hi everyone, I’m brand new and having an issue that I haven’t found a > clear answer to. I’m running free radius 3.x on ubuntu server 18.10. I have > LDAP enabled to auth to google secure LDAP. So far I’m binding to google > successfully and with the radtest command my LDAP user gets access-accept. > If I do raddest with -t mschap I get access-reject. > > Are you reading the "known good" password from LDAP? Or are you seeing > the User-Password to LDAP, and having it verify the password? > > > I’m hoping that someone more experienced can point me in the right > direction as to where I can fix the issue. Here’s a snippet of my log in -X > mode. Thanks in advance to anyone that can help > > > > ... > > (15) mschap: WARNING: No Cleartext-Password configured. Cannot create > NT-Password > > (15) mschap: WARNING: No Cleartext-Password configured. Cannot create > LM-Password > > The server didn't get the "known good" password from LDAP. So it can't > do the MS-CHAP calculations. > > And no, you can't pass the MS-CHAP stuff to LDAP. LDAP servers are > databases. They don't implement authentication protocols like MS-CHAP. > > The only solution here is to have the LDAP server return the "known > good" password to FreeRADIUS. > > Alan DeKok. > > > > > ------------------------------ > > Message: 4 > Date: Sat, 23 Feb 2019 14:12:54 -0500 > From: Alan DeKok <aland(a)deployingradius.com> > To: FreeRadius users mailing list > <freeradius-users(a)lists.freeradius.org> > Subject: Re: Reading dynamic clients from "clients" files in > /etc/raddb/dynamic-clients doesn't work > Message-ID: <A6402EDD-311A-4730-A1FB-DBD0929B62EB(a)deployingradius.com> > Content-Type: text/plain; charset=us-ascii > > On Feb 23, 2019, at 9:46 AM, smith john <johnerickson663(a)gmail.com> wrote: > > I'm trying to set up dynamic clients for freeradius 2.2.6 on centos 6.9. > > Hmm... if anything in v2 doesn't work, upgrade to v3. > > We marked v2 "end of life" many years ago. If it works, great. If it > doesn't, well, we're not going to track down & fix bugs from 10 year-old > software. > > > ... > > rad_recv: Access-Request packet from host 18.220.171.233 port 33477, > > id=170, length=76 > > server dynamic_client_server { > > } # server dynamic_client_server > > So... the file is empty? > > Alan DeKok. > > > > > ------------------------------ > > Message: 5 > Date: Sat, 23 Feb 2019 16:04:16 -0600 > From: Phil Grace <phil.grace(a)hssd.k12.ar.us> > To: FreeRadius users mailing list > <freeradius-users(a)lists.freeradius.org> > Subject: Re: Google LDAP integration failure > Message-ID: <83C09D1C-063B-4E8B-8384-D5498836987F(a)hssd.k12.ar.us> > Content-Type: text/plain; charset=utf-8 > > Alan, thanks for the reply. > > > > On Feb 23, 2019, at 1:08 PM, Alan DeKok <aland(a)deployingradius.com> > wrote: > > > > On Feb 23, 2019, at 12:58 PM, Phil Grace <phil.grace(a)hssd.k12.ar.us> > wrote: > >> > >> Hi everyone, I’m brand new and having an issue that I haven’t found a > clear answer to. I’m running free radius 3.x on ubuntu server 18.10. I have > LDAP enabled to auth to google secure LDAP. So far I’m binding to google > successfully and with the radtest command my LDAP user gets access-accept. > If I do raddest with -t mschap I get access-reject. > > > > Are you reading the "known good" password from LDAP? Or are you seeing > the User-Password to LDAP, and having it verify the password? > > I’m not sure, I just followed google’s provided setup guide for freeradius > to work with their LDAP service. > > > > >> I’m hoping that someone more experienced can point me in the right > direction as to where I can fix the issue. Here’s a snippet of my log in -X > mode. Thanks in advance to anyone that can help > >> > >> ... > >> (15) mschap: WARNING: No Cleartext-Password configured. Cannot create > NT-Password > >> (15) mschap: WARNING: No Cleartext-Password configured. Cannot create > LM-Password > > > > The server didn't get the "known good" password from LDAP. So it can't > do the MS-CHAP calculations. > > > > And no, you can't pass the MS-CHAP stuff to LDAP. LDAP servers are > databases. They don't implement authentication protocols like MS-CHAP. > > > > The only solution here is to have the LDAP server return the "known > good" password to FreeRADIUS. > > So would I just disable MS-CHAP or do something different with LDAP config > to get the “known good”password. Would my issue probably be in the > inner-tunnel file or the default file? > > > > > > Alan DeKok. > > > > > > - > > List info/subscribe/unsubscribe? See > http://www.freeradius.org/list/users.html > > > > ------------------------------ > > Subject: Digest Footer > > - > List info/subscribe/unsubscribe? See > http://www.freeradius.org/list/users.html > > ------------------------------ > > End of Freeradius-Users Digest, Vol 166, Issue 51 > ************************************************* >

3 5

[Q] "unknown IP address" mean in dynamic-clients
by Hiroyuki Sato 26 Feb '19

26 Feb '19

Hello, members. Could you tell me "unknown IP address" mean in dynamic-clients file? It means that the IP doesn't match client.conf. Is this correct? https://github.com/FreeRADIUS/freeradius-server/blob/v3.0.x/raddb/sites-ava… > When the server receives a packet from an unknown IP address > within that network, it tries to find a dynamic definition > for that client. If the definition is found, the IP address Best regards. -- Hiroyuki Sato

2 2

FR 3.0.13, reply of attributes missing
by Jürgen Northe 26 Feb '19

26 Feb '19

Hello team, I want to pass VLAN settings from ldap entry to the NAS (HP 5120 Switch) but I only get the "Reply-Message" back. The same with "users". The system is a CentOS 7.6.1810 and from Distro view up to date. I have read the ldap modue config and tried settings like below but did not succeed. So I tried it with an user entry, same result. Is there a main switch in an other config file I might have to set additionally? # valuepair_attribute = 'radiusAttribute' # control:Auth-Type := 'AuthType' # reply:Tunnel-Type := 'radiusTunnelType' # reply:Tunnel-Medium-Type := 'radiusTunnelMediumType' # reply:Tunnel-Private-Group-ID := 'radiusTunnelPrivategroupId' mac Cleartext-Password == "mac" Tunnel-Type = "VLAN", Tunnel-Medium-Type = "IEEE-802", Tunnel-Private-Group-Id = "170" --------------------- FreeRADIUS Version 3.0.13 Copyright (C) 1999-2017 The FreeRADIUS server project and contributors There is NO warranty; not even for MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE You may redistribute copies of FreeRADIUS under the terms of the GNU General Public License For more information about these matters, see the file named COPYRIGHT Starting - reading configuration files ... including dictionary file /usr/share/freeradius/dictionary including dictionary file /usr/share/freeradius/dictionary.dhcp including dictionary file /usr/share/freeradius/dictionary.vqp including dictionary file /etc/raddb/dictionary including configuration file /etc/raddb/radiusd.conf including configuration file /etc/raddb/proxy.conf including configuration file /etc/raddb/clients.conf including files in directory /etc/raddb/mods-enabled/ including configuration file /etc/raddb/mods-enabled/always including configuration file /etc/raddb/mods-enabled/attr_filter including configuration file /etc/raddb/mods-enabled/cache_eap including configuration file /etc/raddb/mods-enabled/chap including configuration file /etc/raddb/mods-enabled/date including configuration file /etc/raddb/mods-enabled/detail including configuration file /etc/raddb/mods-enabled/detail.log including configuration file /etc/raddb/mods-enabled/dhcp including configuration file /etc/raddb/mods-enabled/digest including configuration file /etc/raddb/mods-enabled/dynamic_clients including configuration file /etc/raddb/mods-enabled/eap including configuration file /etc/raddb/mods-enabled/echo including configuration file /etc/raddb/mods-enabled/exec including configuration file /etc/raddb/mods-enabled/expiration including configuration file /etc/raddb/mods-enabled/expr including configuration file /etc/raddb/mods-enabled/files including configuration file /etc/raddb/mods-enabled/linelog including configuration file /etc/raddb/mods-enabled/logintime including configuration file /etc/raddb/mods-enabled/mschap including configuration file /etc/raddb/mods-enabled/ntlm_auth including configuration file /etc/raddb/mods-enabled/pap including configuration file /etc/raddb/mods-enabled/passwd including configuration file /etc/raddb/mods-enabled/preprocess including configuration file /etc/raddb/mods-enabled/radutmp including configuration file /etc/raddb/mods-enabled/realm including configuration file /etc/raddb/mods-enabled/replicate including configuration file /etc/raddb/mods-enabled/soh including configuration file /etc/raddb/mods-enabled/sradutmp including configuration file /etc/raddb/mods-enabled/unix including configuration file /etc/raddb/mods-enabled/unpack including configuration file /etc/raddb/mods-enabled/utf8 including configuration file /etc/raddb/mods-enabled/redundant_ldap including files in directory /etc/raddb/policy.d/ including configuration file /etc/raddb/policy.d/accounting including configuration file /etc/raddb/policy.d/control including configuration file /etc/raddb/policy.d/cui including configuration file /etc/raddb/policy.d/debug including configuration file /etc/raddb/policy.d/dhcp including configuration file /etc/raddb/policy.d/eap including configuration file /etc/raddb/policy.d/filter including configuration file /etc/raddb/policy.d/operator-name including configuration file /etc/raddb/policy.d/canonicalization including files in directory /etc/raddb/sites-enabled/ including configuration file /etc/raddb/sites-enabled/default including configuration file /etc/raddb/sites-enabled/inner-tunnel main { security { user = "radiusd" group = "radiusd" allow_core_dumps = no } name = "radiusd" prefix = "/usr" localstatedir = "/var" logdir = "/var/log/radius" run_dir = "/var/run/radiusd" } main { name = "radiusd" prefix = "/usr" localstatedir = "/var" sbindir = "/usr/sbin" logdir = "/var/log/radius" run_dir = "/var/run/radiusd" libdir = "/usr/lib64/freeradius" radacctdir = "/var/log/radius/radacct" hostname_lookups = no max_request_time = 30 cleanup_delay = 5 max_requests = 16384 pidfile = "/var/run/radiusd/radiusd.pid" checkrad = "/usr/sbin/checkrad" debug_level = 0 proxy_requests = yes log { stripped_names = no auth = no auth_badpass = yes auth_goodpass = yes colourise = yes msg_denied = "You are already logged in - access denied" } resources { } security { max_attributes = 200 reject_delay = 1.000000 status_server = yes } } radiusd: #### Loading Realms and Home Servers #### proxy server { retry_delay = 5 retry_count = 3 default_fallback = no dead_time = 120 wake_all_if_all_dead = no } home_server localhost { ipaddr = 127.0.0.1 port = 1812 type = "auth" secret = <<< secret >>> response_window = 20.000000 response_timeouts = 1 max_outstanding = 65536 zombie_period = 40 status_check = "status-server" ping_interval = 30 check_interval = 30 check_timeout = 4 num_answers_to_alive = 3 revive_interval = 120 limit { max_connections = 16 max_requests = 0 lifetime = 0 idle_timeout = 0 } coa { irt = 2 mrt = 16 mrc = 5 mrd = 30 } } home_server_pool my_auth_failover { type = fail-over home_server = localhost } realm example.com { auth_pool = my_auth_failover } realm LOCAL { } radiusd: #### Loading Clients #### client localhost { ipaddr = 127.0.0.1 require_message_authenticator = no secret = <<< secret >>> nas_type = "other" proto = "*" limit { max_connections = 16 lifetime = 0 idle_timeout = 30 } } client localhost_ipv6 { ipv6addr = ::1 require_message_authenticator = no secret = <<< secret >>> limit { max_connections = 16 lifetime = 0 idle_timeout = 30 } } client 192.168.0.7/32 { ipaddr = 192.168.0.7 require_message_authenticator = no secret = <<< secret >>> shortname = "SWSG1AP1-7" limit { max_connections = 16 lifetime = 0 idle_timeout = 30 } } Debugger not attached # Creating Auth-Type = mschap # Creating Auth-Type = digest # Creating Auth-Type = eap # Creating Auth-Type = PAP # Creating Auth-Type = CHAP # Creating Auth-Type = MS-CHAP # Creating Auth-Type = LDAP radiusd: #### Instantiating modules #### modules { # Loaded module rlm_always # Loading module "reject" from file /etc/raddb/mods-enabled/always always reject { rcode = "reject" simulcount = 0 mpp = no } # Loading module "fail" from file /etc/raddb/mods-enabled/always always fail { rcode = "fail" simulcount = 0 mpp = no } # Loading module "ok" from file /etc/raddb/mods-enabled/always always ok { rcode = "ok" simulcount = 0 mpp = no } # Loading module "handled" from file /etc/raddb/mods-enabled/always always handled { rcode = "handled" simulcount = 0 mpp = no } # Loading module "invalid" from file /etc/raddb/mods-enabled/always always invalid { rcode = "invalid" simulcount = 0 mpp = no } # Loading module "userlock" from file /etc/raddb/mods-enabled/always always userlock { rcode = "userlock" simulcount = 0 mpp = no } # Loading module "notfound" from file /etc/raddb/mods-enabled/always always notfound { rcode = "notfound" simulcount = 0 mpp = no } # Loading module "noop" from file /etc/raddb/mods-enabled/always always noop { rcode = "noop" simulcount = 0 mpp = no } # Loading module "updated" from file /etc/raddb/mods-enabled/always always updated { rcode = "updated" simulcount = 0 mpp = no } # Loaded module rlm_attr_filter # Loading module "attr_filter.post-proxy" from file /etc/raddb/mods-enabled/attr_filter attr_filter attr_filter.post-proxy { filename = "/etc/raddb/mods-config/attr_filter/post-proxy" key = "%{Realm}" relaxed = no } # Loading module "attr_filter.pre-proxy" from file /etc/raddb/mods-enabled/attr_filter attr_filter attr_filter.pre-proxy { filename = "/etc/raddb/mods-config/attr_filter/pre-proxy" key = "%{Realm}" relaxed = no } # Loading module "attr_filter.access_reject" from file /etc/raddb/mods-enabled/attr_filter attr_filter attr_filter.access_reject { filename = "/etc/raddb/mods-config/attr_filter/access_reject" key = "%{User-Name}" relaxed = no } # Loading module "attr_filter.access_challenge" from file /etc/raddb/mods-enabled/attr_filter attr_filter attr_filter.access_challenge { filename = "/etc/raddb/mods-config/attr_filter/access_challenge" key = "%{User-Name}" relaxed = no } # Loading module "attr_filter.accounting_response" from file /etc/raddb/mods-enabled/attr_filter attr_filter attr_filter.accounting_response { filename = "/etc/raddb/mods-config/attr_filter/accounting_response" key = "%{User-Name}" relaxed = no } # Loaded module rlm_cache # Loading module "cache_eap" from file /etc/raddb/mods-enabled/cache_eap cache cache_eap { driver = "rlm_cache_rbtree" key = "%{%{control:State}:-%{%{reply:State}:-%{State}}}" ttl = 15 max_entries = 0 epoch = 0 add_stats = no } # Loaded module rlm_chap # Loading module "chap" from file /etc/raddb/mods-enabled/chap # Loaded module rlm_date # Loading module "date" from file /etc/raddb/mods-enabled/date date { format = "%b %e %Y %H:%M:%S %Z" } # Loaded module rlm_detail # Loading module "detail" from file /etc/raddb/mods-enabled/detail detail { filename = "/var/log/radius/radacct/%{%{Packet-Src-IP-Address}:-%{Packet-Src-IPv6-Address}}/detail-%Y%m%d" header = "%t" permissions = 384 locking = no escape_filenames = no log_packet_header = no } # Loading module "auth_log" from file /etc/raddb/mods-enabled/detail.log detail auth_log { filename = "/var/log/radius/radacct/%{%{Packet-Src-IP-Address}:-%{Packet-Src-IPv6-Address}}/auth-detail-%Y%m%d" header = "%t" permissions = 384 locking = no escape_filenames = no log_packet_header = no } # Loading module "reply_log" from file /etc/raddb/mods-enabled/detail.log detail reply_log { filename = "/var/log/radius/radacct/%{%{Packet-Src-IP-Address}:-%{Packet-Src-IPv6-Address}}/reply-detail-%Y%m%d" header = "%t" permissions = 384 locking = no escape_filenames = no log_packet_header = no } # Loading module "pre_proxy_log" from file /etc/raddb/mods-enabled/detail.log detail pre_proxy_log { filename = "/var/log/radius/radacct/%{%{Packet-Src-IP-Address}:-%{Packet-Src-IPv6-Address}}/pre-proxy-detail-%Y%m%d" header = "%t" permissions = 384 locking = no escape_filenames = no log_packet_header = no } # Loading module "post_proxy_log" from file /etc/raddb/mods-enabled/detail.log detail post_proxy_log { filename = "/var/log/radius/radacct/%{%{Packet-Src-IP-Address}:-%{Packet-Src-IPv6-Address}}/post-proxy-detail-%Y%m%d" header = "%t" permissions = 384 locking = no escape_filenames = no log_packet_header = no } # Loaded module rlm_dhcp # Loading module "dhcp" from file /etc/raddb/mods-enabled/dhcp # Loaded module rlm_digest # Loading module "digest" from file /etc/raddb/mods-enabled/digest # Loaded module rlm_dynamic_clients # Loading module "dynamic_clients" from file /etc/raddb/mods-enabled/dynamic_clients # Loaded module rlm_eap # Loading module "eap" from file /etc/raddb/mods-enabled/eap eap { default_eap_type = "md5" timer_expire = 60 ignore_unknown_eap_types = no cisco_accounting_username_bug = no max_sessions = 16384 } # Loaded module rlm_exec # Loading module "echo" from file /etc/raddb/mods-enabled/echo exec echo { wait = yes program = "/bin/echo %{User-Name}" input_pairs = "request" output_pairs = "reply" shell_escape = yes } # Loading module "exec" from file /etc/raddb/mods-enabled/exec exec { wait = no input_pairs = "request" shell_escape = yes timeout = 10 } # Loaded module rlm_expiration # Loading module "expiration" from file /etc/raddb/mods-enabled/expiration # Loaded module rlm_expr # Loading module "expr" from file /etc/raddb/mods-enabled/expr expr { safe_characters = "@abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ0123456789.-_: /äéöüàâæçèéêëîïôœùûüaÿÄÉÖÜßÀÂÆÇÈÉÊËÎÏÔŒÙÛÜŸ" } # Loaded module rlm_files # Loading module "files" from file /etc/raddb/mods-enabled/files files { filename = "/etc/raddb/mods-config/files/authorize" acctusersfile = "/etc/raddb/mods-config/files/accounting" preproxy_usersfile = "/etc/raddb/mods-config/files/pre-proxy" } # Loaded module rlm_linelog # Loading module "linelog" from file /etc/raddb/mods-enabled/linelog linelog { filename = "/var/log/radius/linelog" escape_filenames = no syslog_severity = "info" permissions = 384 format = "This is a log message for %{User-Name}" reference = "messages.%{%{reply:Packet-Type}:-default}" } # Loading module "log_accounting" from file /etc/raddb/mods-enabled/linelog linelog log_accounting { filename = "/var/log/radius/linelog-accounting" escape_filenames = no syslog_severity = "info" permissions = 384 format = "" reference = "Accounting-Request.%{%{Acct-Status-Type}:-unknown}" } # Loaded module rlm_logintime # Loading module "logintime" from file /etc/raddb/mods-enabled/logintime logintime { minimum_timeout = 60 } # Loaded module rlm_mschap # Loading module "mschap" from file /etc/raddb/mods-enabled/mschap mschap { use_mppe = yes require_encryption = no require_strong = no with_ntdomain_hack = yes passchange { } allow_retry = yes winbind_retry_with_normalised_username = no } # Loading module "ntlm_auth" from file /etc/raddb/mods-enabled/ntlm_auth exec ntlm_auth { wait = yes program = "/path/to/ntlm_auth --request-nt-key --domain=MYDOMAIN --username=%{mschap:User-Name} --password=%{User-Password}" shell_escape = yes } # Loaded module rlm_pap # Loading module "pap" from file /etc/raddb/mods-enabled/pap pap { normalise = yes } # Loaded module rlm_passwd # Loading module "etc_passwd" from file /etc/raddb/mods-enabled/passwd passwd etc_passwd { filename = "/etc/passwd" format = "*User-Name:Crypt-Password:" delimiter = ":" ignore_nislike = no ignore_empty = yes allow_multiple_keys = no hash_size = 100 } # Loaded module rlm_preprocess # Loading module "preprocess" from file /etc/raddb/mods-enabled/preprocess preprocess { huntgroups = "/etc/raddb/mods-config/preprocess/huntgroups" hints = "/etc/raddb/mods-config/preprocess/hints" with_ascend_hack = no ascend_channels_per_line = 23 with_ntdomain_hack = no with_specialix_jetstream_hack = no with_cisco_vsa_hack = no with_alvarion_vsa_hack = no } # Loaded module rlm_radutmp # Loading module "radutmp" from file /etc/raddb/mods-enabled/radutmp radutmp { filename = "/var/log/radius/radutmp" username = "%{User-Name}" case_sensitive = yes check_with_nas = yes permissions = 384 caller_id = yes } # Loaded module rlm_realm # Loading module "IPASS" from file /etc/raddb/mods-enabled/realm realm IPASS { format = "prefix" delimiter = "/" ignore_default = no ignore_null = no } # Loading module "suffix" from file /etc/raddb/mods-enabled/realm realm suffix { format = "suffix" delimiter = "@" ignore_default = no ignore_null = no } # Loading module "realmpercent" from file /etc/raddb/mods-enabled/realm realm realmpercent { format = "suffix" delimiter = "%" ignore_default = no ignore_null = no } # Loading module "ntdomain" from file /etc/raddb/mods-enabled/realm realm ntdomain { format = "prefix" delimiter = "\\" ignore_default = no ignore_null = no } # Loaded module rlm_replicate # Loading module "replicate" from file /etc/raddb/mods-enabled/replicate # Loaded module rlm_soh # Loading module "soh" from file /etc/raddb/mods-enabled/soh soh { dhcp = yes } # Loading module "sradutmp" from file /etc/raddb/mods-enabled/sradutmp radutmp sradutmp { filename = "/var/log/radius/sradutmp" username = "%{User-Name}" case_sensitive = yes check_with_nas = yes permissions = 420 caller_id = no } # Loaded module rlm_unix # Loading module "unix" from file /etc/raddb/mods-enabled/unix unix { radwtmp = "/var/log/radius/radwtmp" } Creating attribute Unix-Group # Loaded module rlm_unpack # Loading module "unpack" from file /etc/raddb/mods-enabled/unpack # Loaded module rlm_utf8 # Loading module "utf8" from file /etc/raddb/mods-enabled/utf8 # Loaded module rlm_ldap # Loading module "ldap1" from file /etc/raddb/mods-enabled/redundant_ldap ldap ldap1 { server = "cp1-215" identity = "cn=Manager,dc=compend,dc=com" password = <<< secret >>> sasl { } user { scope = "sub" access_positive = yes sasl { } } group { filter = "(objectClass=radiusprofile)" scope = "sub" name_attribute = "cn" membership_attribute = "radiusProfileDN" cacheable_name = no cacheable_dn = no } client { filter = "(objectClass=radiusClient)" scope = "sub" base_dn = "dc=compend,dc=com" } profile { } options { ldap_debug = 40 chase_referrals = yes rebind = yes net_timeout = 1 res_timeout = 10 srv_timelimit = 3 idle = 60 probes = 3 interval = 3 } tls { ca_file = "/etc/raddb/certs/cpCA.crt" certificate_file = "/etc/raddb/certs/cp1-215.crt" private_key_file = "/etc/raddb/certs/cp1-215.key" random_file = "/dev/urandom" start_tls = yes require_cert = "never" } } Creating attribute ldap1-LDAP-Group # Loading module "ldap2" from file /etc/raddb/mods-enabled/redundant_ldap ldap ldap2 { server = "cp2-216" identity = "cn=Manager,dc=compend,dc=com" password = <<< secret >>> sasl { } user { scope = "sub" access_positive = yes sasl { } } group { filter = "(objectClass=posixGroup)" scope = "sub" name_attribute = "cn" membership_attribute = "radiusProfileDN" cacheable_name = no cacheable_dn = no } client { filter = "(objectClass=radiusClient)" scope = "sub" base_dn = "dc=compend,dc=com" } profile { } options { ldap_debug = 40 chase_referrals = yes rebind = yes net_timeout = 1 res_timeout = 10 srv_timelimit = 3 idle = 60 probes = 3 interval = 3 } tls { ca_file = "/etc/raddb/certs/cpCA.crt" certificate_file = "/etc/raddb/certs/cp2-216.crt" private_key_file = "/etc/raddb/certs/cp2-216.key" random_file = "/dev/urandom" start_tls = yes require_cert = "never" } } Creating attribute ldap2-LDAP-Group instantiate { # Instantiating module "ldap1" from file /etc/raddb/mods-enabled/redundant_ldap rlm_ldap: libldap vendor: OpenLDAP, version: 20444 accounting { reference = "%{tolower:type.%{Acct-Status-Type}}" } post-auth { reference = "." } rlm_ldap (ldap1): Initialising connection pool pool { start = 5 min = 3 max = 32 spare = 10 uses = 0 lifetime = 0 cleanup_interval = 30 idle_timeout = 60 retry_delay = 30 spread = no } rlm_ldap (ldap1): Opening additional connection (0), 1 of 32 pending slots used rlm_ldap (ldap1): Connecting to ldap://cp1-215:389 TLSMC: MozNSS compatibility interception begins. tlsmc_convert: INFO: cannot open the NSS DB, expecting PEM configuration is present. tlsmc_intercept_initialization: INFO: successfully intercepted TLS initialization. Continuing with OpenSSL only. TLSMC: MozNSS compatibility interception ends. rlm_ldap (ldap1): Waiting for bind result... rlm_ldap (ldap1): Bind successful rlm_ldap (ldap1): Opening additional connection (1), 1 of 31 pending slots used rlm_ldap (ldap1): Connecting to ldap://cp1-215:389 TLSMC: MozNSS compatibility interception begins. tlsmc_convert: INFO: cannot open the NSS DB, expecting PEM configuration is present. tlsmc_intercept_initialization: INFO: successfully intercepted TLS initialization. Continuing with OpenSSL only. TLSMC: MozNSS compatibility interception ends. rlm_ldap (ldap1): Waiting for bind result... rlm_ldap (ldap1): Bind successful rlm_ldap (ldap1): Opening additional connection (2), 1 of 30 pending slots used rlm_ldap (ldap1): Connecting to ldap://cp1-215:389 TLSMC: MozNSS compatibility interception begins. tlsmc_convert: INFO: cannot open the NSS DB, expecting PEM configuration is present. tlsmc_intercept_initialization: INFO: successfully intercepted TLS initialization. Continuing with OpenSSL only. TLSMC: MozNSS compatibility interception ends. rlm_ldap (ldap1): Waiting for bind result... rlm_ldap (ldap1): Bind successful rlm_ldap (ldap1): Opening additional connection (3), 1 of 29 pending slots used rlm_ldap (ldap1): Connecting to ldap://cp1-215:389 TLSMC: MozNSS compatibility interception begins. tlsmc_convert: INFO: cannot open the NSS DB, expecting PEM configuration is present. tlsmc_intercept_initialization: INFO: successfully intercepted TLS initialization. Continuing with OpenSSL only. TLSMC: MozNSS compatibility interception ends. rlm_ldap (ldap1): Waiting for bind result... rlm_ldap (ldap1): Bind successful rlm_ldap (ldap1): Opening additional connection (4), 1 of 28 pending slots used rlm_ldap (ldap1): Connecting to ldap://cp1-215:389 TLSMC: MozNSS compatibility interception begins. tlsmc_convert: INFO: cannot open the NSS DB, expecting PEM configuration is present. tlsmc_intercept_initialization: INFO: successfully intercepted TLS initialization. Continuing with OpenSSL only. TLSMC: MozNSS compatibility interception ends. rlm_ldap (ldap1): Waiting for bind result... rlm_ldap (ldap1): Bind successful # Instantiating module "ldap2" from file /etc/raddb/mods-enabled/redundant_ldap accounting { reference = "%{tolower:type.%{Acct-Status-Type}}" } post-auth { reference = "." } rlm_ldap (ldap2): Initialising connection pool pool { start = 5 min = 3 max = 32 spare = 10 uses = 0 lifetime = 0 cleanup_interval = 30 idle_timeout = 60 retry_delay = 30 spread = no } rlm_ldap (ldap2): Opening additional connection (0), 1 of 32 pending slots used rlm_ldap (ldap2): Connecting to ldap://cp2-216:389 TLSMC: MozNSS compatibility interception begins. tlsmc_convert: INFO: cannot open the NSS DB, expecting PEM configuration is present. tlsmc_intercept_initialization: INFO: successfully intercepted TLS initialization. Continuing with OpenSSL only. TLSMC: MozNSS compatibility interception ends. rlm_ldap (ldap2): Waiting for bind result... rlm_ldap (ldap2): Bind successful rlm_ldap (ldap2): Opening additional connection (1), 1 of 31 pending slots used rlm_ldap (ldap2): Connecting to ldap://cp2-216:389 TLSMC: MozNSS compatibility interception begins. tlsmc_convert: INFO: cannot open the NSS DB, expecting PEM configuration is present. tlsmc_intercept_initialization: INFO: successfully intercepted TLS initialization. Continuing with OpenSSL only. TLSMC: MozNSS compatibility interception ends. rlm_ldap (ldap2): Waiting for bind result... rlm_ldap (ldap2): Bind successful rlm_ldap (ldap2): Opening additional connection (2), 1 of 30 pending slots used rlm_ldap (ldap2): Connecting to ldap://cp2-216:389 rlm_ldap (ldap2): Connecting to ldap://cp2-216:389 TLSMC: MozNSS compatibility interception begins. tlsmc_convert: INFO: cannot open the NSS DB, expecting PEM configuration is present. tlsmc_intercept_initialization: INFO: successfully intercepted TLS initialization. Continuing with OpenSSL only. TLSMC: MozNSS compatibility interception ends. rlm_ldap (ldap2): Waiting for bind result... rlm_ldap (ldap2): Bind successful rlm_ldap (ldap2): Opening additional connection (3), 1 of 29 pending slots used rlm_ldap (ldap2): Connecting to ldap://cp2-216:389 TLSMC: MozNSS compatibility interception begins. tlsmc_convert: INFO: cannot open the NSS DB, expecting PEM configuration is present. tlsmc_intercept_initialization: INFO: successfully intercepted TLS initialization. Continuing with OpenSSL only. TLSMC: MozNSS compatibility interception ends. rlm_ldap (ldap2): Waiting for bind result... rlm_ldap (ldap2): Bind successful rlm_ldap (ldap2): Opening additional connection (4), 1 of 28 pending slots used rlm_ldap (ldap2): Connecting to ldap://cp2-216:389 TLSMC: MozNSS compatibility interception begins. tlsmc_convert: INFO: cannot open the NSS DB, expecting PEM configuration is present. tlsmc_intercept_initialization: INFO: successfully intercepted TLS initialization. Continuing with OpenSSL only. TLSMC: MozNSS compatibility interception ends. rlm_ldap (ldap2): Waiting for bind result... rlm_ldap (ldap2): Bind successful } # Instantiating module "reject" from file /etc/raddb/mods-enabled/always # Instantiating module "fail" from file /etc/raddb/mods-enabled/always # Instantiating module "ok" from file /etc/raddb/mods-enabled/always # Instantiating module "handled" from file /etc/raddb/mods-enabled/always # Instantiating module "invalid" from file /etc/raddb/mods-enabled/always # Instantiating module "userlock" from file /etc/raddb/mods-enabled/always # Instantiating module "notfound" from file /etc/raddb/mods-enabled/always # Instantiating module "noop" from file /etc/raddb/mods-enabled/always # Instantiating module "updated" from file /etc/raddb/mods-enabled/always # Instantiating module "attr_filter.post-proxy" from file /etc/raddb/mods-enabled/attr_filter reading pairlist file /etc/raddb/mods-config/attr_filter/post-proxy # Instantiating module "attr_filter.pre-proxy" from file /etc/raddb/mods-enabled/attr_filter reading pairlist file /etc/raddb/mods-config/attr_filter/pre-proxy # Instantiating module "attr_filter.access_reject" from file /etc/raddb/mods-enabled/attr_filter reading pairlist file /etc/raddb/mods-config/attr_filter/access_reject [/etc/raddb/mods-config/attr_filter/access_reject]:11 Check item "FreeRADIUS-Response-Delay" found in filter list for realm "DEFAULT". [/etc/raddb/mods-config/attr_filter/access_reject]:11 Check item "FreeRADIUS-Response-Delay-USec" found in filter list for realm "DEFAULT". # Instantiating module "attr_filter.access_challenge" from file /etc/raddb/mods-enabled/attr_filter reading pairlist file /etc/raddb/mods-config/attr_filter/access_challenge # Instantiating module "attr_filter.accounting_response" from file /etc/raddb/mods-enabled/attr_filter reading pairlist file /etc/raddb/mods-config/attr_filter/accounting_response # Instantiating module "cache_eap" from file /etc/raddb/mods-enabled/cache_eap rlm_cache (cache_eap): Driver rlm_cache_rbtree (module rlm_cache_rbtree) loaded and linked # Instantiating module "detail" from file /etc/raddb/mods-enabled/detail # Instantiating module "auth_log" from file /etc/raddb/mods-enabled/detail.log rlm_detail (auth_log): 'User-Password' suppressed, will not appear in detail output # Instantiating module "reply_log" from file /etc/raddb/mods-enabled/detail.log # Instantiating module "pre_proxy_log" from file /etc/raddb/mods-enabled/detail.log # Instantiating module "post_proxy_log" from file /etc/raddb/mods-enabled/detail.log # Instantiating module "eap" from file /etc/raddb/mods-enabled/eap # Linked to sub-module rlm_eap_md5 # Linked to sub-module rlm_eap_leap # Linked to sub-module rlm_eap_gtc gtc { challenge = "Password: " auth_type = "PAP" } # Linked to sub-module rlm_eap_tls tls { tls = "tls-common" } tls-config tls-common { verify_depth = 0 ca_path = "/etc/raddb/certs" pem_file_type = yes private_key_file = "/etc/raddb/certs/cp1-215.key" certificate_file = "/etc/raddb/certs/cp1-215.crt" ca_file = "/etc/raddb/certs/cpCA.crt" dh_file = "/etc/raddb/certs/dh" fragment_size = 1024 include_length = yes auto_chain = yes check_crl = no check_all_crl = no cipher_list = "DEFAULT" cipher_server_preference = no ecdh_curve = "prime256v1" cache { enable = no lifetime = 24 max_entries = 255 } verify { skip_if_ocsp_ok = no } ocsp { enable = no override_cert_url = yes url = "http://127.0.0.1/ocsp/" use_nonce = yes timeout = 0 softfail = no } } # Linked to sub-module rlm_eap_ttls ttls { tls = "tls-common" default_eap_type = "md5" copy_request_to_tunnel = no use_tunneled_reply = yes virtual_server = "inner-tunnel" include_length = yes require_client_cert = no } tls: Using cached TLS configuration from previous invocation # Linked to sub-module rlm_eap_peap peap { tls = "tls-common" default_eap_type = "mschapv2" copy_request_to_tunnel = no use_tunneled_reply = yes proxy_tunneled_request_as_eap = yes virtual_server = "inner-tunnel" soh = no require_client_cert = no } tls: Using cached TLS configuration from previous invocation # Linked to sub-module rlm_eap_mschapv2 mschapv2 { with_ntdomain_hack = no send_error = no } # Instantiating module "expiration" from file /etc/raddb/mods-enabled/expiration # Instantiating module "files" from file /etc/raddb/mods-enabled/files reading pairlist file /etc/raddb/mods-config/files/authorize reading pairlist file /etc/raddb/mods-config/files/accounting reading pairlist file /etc/raddb/mods-config/files/pre-proxy # Instantiating module "linelog" from file /etc/raddb/mods-enabled/linelog # Instantiating module "log_accounting" from file /etc/raddb/mods-enabled/linelog # Instantiating module "logintime" from file /etc/raddb/mods-enabled/logintime # Instantiating module "mschap" from file /etc/raddb/mods-enabled/mschap rlm_mschap (mschap): using internal authentication # Instantiating module "pap" from file /etc/raddb/mods-enabled/pap # Instantiating module "etc_passwd" from file /etc/raddb/mods-enabled/passwd rlm_passwd: nfields: 3 keyfield 0(User-Name) listable: no # Instantiating module "preprocess" from file /etc/raddb/mods-enabled/preprocess reading pairlist file /etc/raddb/mods-config/preprocess/huntgroups reading pairlist file /etc/raddb/mods-config/preprocess/hints # Instantiating module "IPASS" from file /etc/raddb/mods-enabled/realm # Instantiating module "suffix" from file /etc/raddb/mods-enabled/realm # Instantiating module "realmpercent" from file /etc/raddb/mods-enabled/realm # Instantiating module "ntdomain" from file /etc/raddb/mods-enabled/realm } # modules radiusd: #### Loading Virtual Servers #### server { # from file /etc/raddb/radiusd.conf } # server server default { # from file /etc/raddb/sites-enabled/default # Loading authenticate {...} # Loading authorize {...} # Loading preacct {...} # Loading accounting {...} # Loading post-proxy {...} # Loading post-auth {...} } # server default server inner-tunnel { # from file /etc/raddb/sites-enabled/inner-tunnel # Loading authenticate {...} # Loading authorize {...} # Loading session {...} # Loading post-proxy {...} # Loading post-auth {...} # Skipping contents of 'if' as it is always 'false' -- /etc/raddb/sites-enabled/inner-tunnel:331 } # server inner-tunnel radiusd: #### Opening IP addresses and Ports #### listen { type = "auth" ipaddr = * port = 0 limit { max_connections = 16 lifetime = 0 idle_timeout = 30 } } listen { type = "acct" ipaddr = * port = 0 limit { max_connections = 16 lifetime = 0 idle_timeout = 30 } } listen { type = "auth" ipv6addr = :: port = 0 limit { max_connections = 16 lifetime = 0 idle_timeout = 30 } } listen { type = "acct" ipv6addr = :: port = 0 limit { max_connections = 16 lifetime = 0 idle_timeout = 30 } } listen { type = "auth" ipaddr = 127.0.0.1 port = 18120 } Listening on auth address * port 1812 bound to server default Listening on acct address * port 1813 bound to server default Listening on auth address :: port 1812 bound to server default Listening on acct address :: port 1813 bound to server default Listening on auth address 127.0.0.1 port 18120 bound to server inner-tunnel Listening on proxy address * port 55233 Listening on proxy address :: port 44514 Ready to process requests (0) Received Access-Request Id 71 from 192.168.0.7:3437 to 192.168.0.215:1812 length 241 (0) User-Name = "001f161eeb3a" (0) User-Password = "001f161eeb3a" (0) NAS-IP-Address = 192.168.0.7 (0) NAS-Identifier = "SWSG1AP1-7-v161121" (0) NAS-Port = 16879715 (0) NAS-Port-Id = "slot=1;subslot=0;port=25;vlanid=99" (0) NAS-Port-Type = Ethernet (0) Service-Type = Call-Check (0) Framed-Protocol = PPP (0) Calling-Station-Id = "00-1F-16-1E-EB-3A" (0) Acct-Session-Id = "101030710181cf010" (0) Huawei-Connect-ID = 1892353 (0) Huawei-Product-ID = "H3C S5120-52C-EI" (0) Huawei-Startup-Stamp = 956750420 (0) Attr-26.43.230 = 0x4769676162697445746865726e6574312f302f3235 (0) # Executing section authorize from file /etc/raddb/sites-enabled/default (0) authorize { (0) [preprocess] = ok (0) [chap] = noop (0) [mschap] = noop (0) [digest] = noop (0) suffix: Checking for suffix after "@" (0) suffix: No '@' in User-Name = "001f161eeb3a", looking up realm NULL (0) suffix: No such realm "NULL" (0) [suffix] = noop (0) eap: No EAP-Message, not doing EAP (0) [eap] = noop (0) files: users: Matched entry DEFAULT at line 201 (0) [files] = ok (0) redundant redundant_ldap { rlm_ldap (ldap1): Reserved connection (0) (0) ldap1: EXPAND (cn=%{%{Stripped-User-Name}:-%{User-Name}}) (0) ldap1: --> (cn=001f161eeb3a) (0) ldap1: Performing search in "dc=compend,dc=com" with filter "(cn=001f161eeb3a)", scope "sub" (0) ldap1: Waiting for search result... (0) ldap1: User object found at DN "cn=NBIVX200S-44,cn=proxmox,cn=192.168.5.0,cn=SUBNET,cn=DHCP Config,dc=compend,dc=com" (0) ldap1: Processing user attributes (0) ldap1: reply:Reply-Message := 'Hello NBIV-LENO-X200S' rlm_ldap (ldap1): Released connection (0) Need 5 more connections to reach 10 spares rlm_ldap (ldap1): Opening additional connection (5), 1 of 27 pending slots used rlm_ldap (ldap1): Connecting to ldap://cp1-215:389 TLSMC: MozNSS compatibility interception begins. tlsmc_convert: INFO: cannot open the NSS DB, expecting PEM configuration is present. tlsmc_intercept_initialization: INFO: successfully intercepted TLS initialization. Continuing with OpenSSL only. TLSMC: MozNSS compatibility interception ends. rlm_ldap (ldap1): Waiting for bind result... rlm_ldap (ldap1): Bind successful (0) [ldap1] = updated (0) } # redundant redundant_ldap = updated (0) if (!updated) { (0) if (!updated) -> FALSE (0) else { (0) update control { (0) Auth-Type := Accept (0) } # update control = noop (0) } # else = noop (0) [expiration] = noop (0) [logintime] = noop (0) pap: WARNING: Auth-Type already set. Not setting to PAP (0) [pap] = noop (0) } # authorize = updated (0) Found Auth-Type = Accept (0) Auth-Type = Accept, accepting the user (0) # Executing section post-auth from file /etc/raddb/sites-enabled/default (0) post-auth { (0) update { (0) No attributes updated (0) } # update = noop (0) [exec] = noop (0) policy remove_reply_message_if_eap { (0) if (&reply:EAP-Message && &reply:Reply-Message) { (0) if (&reply:EAP-Message && &reply:Reply-Message) -> FALSE (0) else { (0) [noop] = noop (0) } # else = noop (0) } # policy remove_reply_message_if_eap = noop (0) } # post-auth = noop (0) Sent Access-Accept Id 71 from 192.168.0.215:1812 to 192.168.0.7:3437 length 0 (0) Framed-Protocol = PPP (0) Framed-Compression = Van-Jacobson-TCP-IP (0) Reply-Message := "Hello NBIV-LENO-X200S" (0) Finished request Waking up in 4.9 seconds. (1) Received Accounting-Request Id 72 from 192.168.0.7:3437 to 192.168.0.215:1813 length 235 (1) User-Name = "001f161eeb3a" (1) NAS-Identifier = "SWSG1AP1-7-v161121" (1) NAS-Port = 16879715 (1) NAS-Port-Id = "slot=1;subslot=0;port=25;vlanid=99" (1) NAS-Port-Type = Ethernet (1) Calling-Station-Id = "00-1F-16-1E-EB-3A" (1) Acct-Status-Type = Start (1) Acct-Authentic = RADIUS (1) Acct-Session-Id = "101030710181cf010" (1) NAS-IP-Address = 192.168.0.7 (1) Event-Timestamp = "Apr 7 2001 12:18:34 CEST" (1) Huawei-Connect-ID = 1892353 (1) Huawei-Input-Burst-Size = 0 (1) Huawei-Input-Average-Rate = 0 (1) Huawei-Output-Burst-Size = 0 (1) Huawei-Output-Average-Rate = 0 (1) Huawei-Priority = 0 (1) Attr-26.43.230 = 0x4769676162697445746865726e6574312f302f3235 (1) # Executing section preacct from file /etc/raddb/sites-enabled/default (1) preacct { (1) [preprocess] = ok (1) policy acct_unique { (1) update request { (1) &Tmp-String-9 := "ai:" (1) } # update request = noop (1) if (("%{hex:&Class}" =~ /^%{hex:&Tmp-String-9}/) && ("%{string:&Class}" =~ /^ai:([0-9a-f]{32})/i)) { (1) EXPAND %{hex:&Class} (1) --> (1) EXPAND ^%{hex:&Tmp-String-9} (1) --> ^61693a (1) if (("%{hex:&Class}" =~ /^%{hex:&Tmp-String-9}/) && ("%{string:&Class}" =~ /^ai:([0-9a-f]{32})/i)) -> FALSE (1) else { (1) update request { (1) EXPAND %{md5:%{User-Name},%{Acct-Session-ID},%{%{NAS-IPv6-Address}:-%{NAS-IP-Address}},%{NAS-Identifier},%{NAS-Port-ID},%{NAS-Port}} (1) --> e883ae33989684ae47a4443ed97ad460 (1) &Acct-Unique-Session-Id := e883ae33989684ae47a4443ed97ad460 (1) } # update request = noop (1) } # else = noop (1) } # policy acct_unique = noop (1) suffix: Checking for suffix after "@" (1) suffix: No '@' in User-Name = "001f161eeb3a", looking up realm NULL (1) suffix: No such realm "NULL" (1) [suffix] = noop (1) [files] = noop (1) } # preacct = ok (1) # Executing section accounting from file /etc/raddb/sites-enabled/default (1) accounting { (1) detail: EXPAND /var/log/radius/radacct/%{%{Packet-Src-IP-Address}:-%{Packet-Src-IPv6-Address}}/detail-%Y%m%d (1) detail: --> /var/log/radius/radacct/192.168.0.7/detail-20190226 (1) detail: /var/log/radius/radacct/%{%{Packet-Src-IP-Address}:-%{Packet-Src-IPv6-Address}}/detail-%Y%m%d expands to /var/log/radius/radacct/192.168.0.7/detail-20190226 (1) detail: EXPAND %t (1) detail: --> Tue Feb 26 09:29:46 2019 (1) [detail] = ok (1) [unix] = ok (1) [exec] = noop (1) attr_filter.accounting_response: EXPAND %{User-Name} (1) attr_filter.accounting_response: --> 001f161eeb3a (1) attr_filter.accounting_response: Matched entry DEFAULT at line 12 (1) [attr_filter.accounting_response] = updated (1) } # accounting = updated (1) Sent Accounting-Response Id 72 from 192.168.0.215:1813 to 192.168.0.7:3437 length 0 (1) Finished request (1) Cleaning up request packet ID 72 with timestamp +26 Waking up in 4.9 seconds. (2) Received Accounting-Request Id 73 from 192.168.0.7:3437 to 192.168.0.215:1813 length 289 (2) User-Name = "001f161eeb3a" (2) NAS-Identifier = "SWSG1AP1-7-v161121" (2) NAS-Port = 16879715 (2) NAS-Port-Id = "slot=1;subslot=0;port=25;vlanid=99" (2) NAS-Port-Type = Ethernet (2) Calling-Station-Id = "00-1F-16-1E-EB-3A" (2) Acct-Status-Type = Stop (2) Acct-Authentic = RADIUS (2) Acct-Session-Id = "101030710181cf010" (2) NAS-IP-Address = 192.168.0.7 (2) Event-Timestamp = "Apr 7 2001 12:18:36 CEST" (2) Acct-Session-Time = 2 (2) Acct-Delay-Time = 0 (2) Acct-Input-Octets = 9046 (2) Acct-Input-Packets = 0 (2) Acct-Output-Octets = 1827 (2) Acct-Output-Packets = 0 (2) Acct-Input-Gigawords = 0 (2) Acct-Output-Gigawords = 0 (2) Acct-Terminate-Cause = User-Request (2) Huawei-Connect-ID = 1892353 (2) Huawei-Input-Burst-Size = 0 (2) Huawei-Input-Average-Rate = 0 (2) Huawei-Output-Burst-Size = 0 (2) Huawei-Output-Average-Rate = 0 (2) Huawei-Priority = 0 (2) Attr-26.43.230 = 0x4769676162697445746865726e6574312f302f3235 (2) # Executing section preacct from file /etc/raddb/sites-enabled/default (2) preacct { (2) [preprocess] = ok (2) policy acct_unique { (2) update request { (2) &Tmp-String-9 := "ai:" (2) } # update request = noop (2) if (("%{hex:&Class}" =~ /^%{hex:&Tmp-String-9}/) && ("%{string:&Class}" =~ /^ai:([0-9a-f]{32})/i)) { (2) EXPAND %{hex:&Class} (2) --> (2) EXPAND ^%{hex:&Tmp-String-9} (2) --> ^61693a (2) if (("%{hex:&Class}" =~ /^%{hex:&Tmp-String-9}/) && ("%{string:&Class}" =~ /^ai:([0-9a-f]{32})/i)) -> FALSE (2) else { (2) update request { (2) EXPAND %{md5:%{User-Name},%{Acct-Session-ID},%{%{NAS-IPv6-Address}:-%{NAS-IP-Address}},%{NAS-Identifier},%{NAS-Port-ID},%{NAS-Port}} (2) --> e883ae33989684ae47a4443ed97ad460 (2) &Acct-Unique-Session-Id := e883ae33989684ae47a4443ed97ad460 (2) } # update request = noop (2) } # else = noop (2) } # policy acct_unique = noop (2) suffix: Checking for suffix after "@" (2) suffix: No '@' in User-Name = "001f161eeb3a", looking up realm NULL (2) suffix: No such realm "NULL" (2) [suffix] = noop (2) [files] = noop (2) } # preacct = ok (2) # Executing section accounting from file /etc/raddb/sites-enabled/default (2) accounting { (2) detail: EXPAND /var/log/radius/radacct/%{%{Packet-Src-IP-Address}:-%{Packet-Src-IPv6-Address}}/detail-%Y%m%d (2) detail: --> /var/log/radius/radacct/192.168.0.7/detail-20190226 (2) detail: /var/log/radius/radacct/%{%{Packet-Src-IP-Address}:-%{Packet-Src-IPv6-Address}}/detail-%Y%m%d expands to /var/log/radius/radacct/192.168.0.7/detail-20190226 (2) detail: EXPAND %t (2) detail: --> Tue Feb 26 09:29:48 2019 (2) [detail] = ok (2) [unix] = ok (2) [exec] = noop (2) attr_filter.accounting_response: EXPAND %{User-Name} (2) attr_filter.accounting_response: --> 001f161eeb3a (2) attr_filter.accounting_response: Matched entry DEFAULT at line 12 (2) [attr_filter.accounting_response] = updated (2) } # accounting = updated (2) Sent Accounting-Response Id 73 from 192.168.0.215:1813 to 192.168.0.7:3437 length 0 (2) Finished request (2) Cleaning up request packet ID 73 with timestamp +28 Waking up in 2.9 seconds. (0) Cleaning up request packet ID 71 with timestamp +26 Ready to process requests

2 1

Use expr for reply from sql database
by kai.zemke＠hauni.com 26 Feb '19

26 Feb '19

Hi, I do have freeradius setup with a sql configuration. My mysql server is running the scheme that is proposed on the freeradius wiki. So far everything is doing fine. Now I want to replay with an Egress-VLANID. If I enter the value hexencoded everything works fine. But if I enter the value with the expr function the replied value is always zero and I have the following entry in my radius.log sql: Error parsing value: Unknown or invalid value "%{expr: 0x31000000 + 105}" for attribute Egress-VLANID) Do I have to mask certain characters in order to make this work? Example: Egress-VLANID = `%{expr: 0x31000000 + 105}` Best regards Kai ________________________________ Diese E-Mail kann vertrauliche Informationen enthalten. Das unerlaubte Kopieren sowie die unbefugte Weitergabe dieser Informationen sind nicht gestattet. Sollten Sie diese E-Mail irrt?mlich erhalten haben, informieren Sie bitte den Absender und l?schen diese E-Mail. This e-mail may contain confidential information, which should not be copied or distributed without authorization. If you have received this e-mail message by mistake, please inform the sender and delete it from your system.

2 1

RE: [EXTERNAL] How mitigate mac spoofing in mab
by Carlos Bordon 26 Feb '19

26 Feb '19

The second thing you can do is on the FreeRADIUS side, which is to use a Simultaneous Use database to prevent MAB requests from different ports at near the same time from being accepted. However, this can be problematic. If you are updating the Simultaneous Use database based on edge switch Accounting packets, then the edge switch may leave stale sessions open and continue to send updates after a host is unplugged and moved by the user to another port... especially if a minihub has been attached to the network and the link stays up. Then when the user gets to the place they have moved, they cannot get on the network because Simultaneous Use thinks they are an imposter. this is great! how can I do this? Thanks! ________________________________ De: Freeradius-Users <freeradius-users-bounces+cgermanb=live.com.ar(a)lists.freeradius.org> en nombre de Brian Julin <BJulin(a)clarku.edu> Enviado: jueves, 7 de febrero de 2019 17:20 Para: freeradius-users(a)lists.freeradius.org Asunto: Re: [EXTERNAL] How mitigate mac spoofing in mab Carlos Bordon <cgermanb(a)live.com.ar> wrote: > I have ine server with freeradius, other with dhcp and they are connect to cisco 6800 swicht. We aunthenticate the endpoint with mab, because we cant use 802.1x. the problem that i want to resolve is to mitigate mac spoofing on layer two. > For us is the same mitigate the problem on the radius or the swicht config. With MAB there is absolutely no way to tell if the host using a MAC address is the actual host that has that burned-in-address (BIA). There are a few things you can do. First, use IP DHCP snooping and ARP inspection features on the edge switch. This will at least keep one host from spoofing many IP or MAC addresses without doing a DHCP transaction for each address, which slows an attacker down. You can also use edge switch port security features to limit the number of MAC addresses allowed on a single port to something reasonable. (While you are at it, see if you also have features to prevent DHCP starvation.) The second thing you can do is on the FreeRADIUS side, which is to use a Simultaneous Use database to prevent MAB requests from different ports at near the same time from being accepted. However, this can be problematic. If you are updating the Simultaneous Use database based on edge switch Accounting packets, then the edge switch may leave stale sessions open and continue to send updates after a host is unplugged and moved by the user to another port... especially if a minihub has been attached to the network and the link stays up. Then when the user gets to the place they have moved, they cannot get on the network because Simultaneous Use thinks they are an imposter. You have to check the behavior of your edge switches and do a lot of testing to make sure that this will work without problems. - List info/subscribe/unsubscribe? See https://na01.safelinks.protection.outlook.com/?url=http%3A%2F%2Fwww.freerad… - List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html

2 1