- Freeradius-Users - lists.freeradius.org

Uses of Active directory User's attribute
by Luc Paulin 28 Feb '19

28 Feb '19

Hi List, I was wondering if it would be possible to use the Active Directory user's attributes. As we're standardizing our AD, all user should have the Department attribute field fill. So instead of using AD groups to dynamically assign vlan, I was thinking to use that field instead. Would that be something possible? Thanx! -- !!!!! ( o o ) --------------oOO----(_)----OOo-------------- Luc Paulin email: paulinster(at)gmail.com Skype: paulinster

1 1

Attribute showing in Hex or Some other format
by Nimesha Balasuriya 28 Feb '19

28 Feb '19

Dear Friends, I am having a problem in radius accounting message which showing some other format for particular attribute. Framed-Interface-Id = 0x520c0000520c00 How to convert this into following format. Framed-Interface-Id = ff0c:6192:9e9a:30fe My NAS is Juniper MX480 Please find the sample packet as bellow; Wed Nov 28 18:02:18 2018 NAS-Port-Type = Ethernet ERX-Pppoe-Description = "pppoe 90:61:0c:4b:4b:1c" Acct-Session-Id = "1328282907" ERX-Dhcp-Mac-Addr = "9061.0c4b.4b1c" Service-Type = Framed-User Acct-Authentic = RADIUS Acct-Status-Type = Start NAS-IP-Address = 203.0.113.22 Framed-IP-Netmask = 255.255.255.255 NAS-Port-Id = "HK-AGJ_C300M_01 atm 1/1/8/7:8.35" Filter-Id = "IPV4-ingress:pbr-pp0.3221286001-in" ERX-Virtual-Router-Name = "default:sltbb.lk" Framed-Protocol = PPP User-Name = "HK2501112@SLTBB" ERX-Attr-177 = 0x506f72742073706565643a2031303030303030306b NAS-Identifier = "HK_MX480" Event-Timestamp = "Nov 28 2018 18:00:37 IST" ERX-Ingress-Policy-Name = "PBR" ADSL-Agent-Circuit-Id = "HK-AGJ_C300M_01 atm 1/1/8/7:8.35" Class = "ADSLWebFamilyPlus" Framed-IP-Address = 100.72.248.51 NAS-Port = 1342178323 Framed-Interface-Id = 0x6bd536006bd536 Acct-Delay-Time = 0 Acct-Unique-Session-Id = "d06986707183a0ac" Stripped-User-Name = "HK2501112" Realm = "sltbb" Timestamp = 1543408338 Thank you in advanced!!

2 1

Free Radius HA
by Aditya Vijjan 27 Feb '19

27 Feb '19

Hi Team, Can we configure HA Active - Active or Active-Passive for free-radius. -- Thanks & Regards Aditya Vijjan

3 2

Group ID of user
by Boudjoudad Abdelkader 27 Feb '19

27 Feb '19

Hello, Is there a way to return the group GID of user during the freeradius authentication process? Thanks,

2 1

Multiple ldap instances - User Group Membership search not done
by Florian Sus | indevis GmbH 27 Feb '19

27 Feb '19

Hi all, I have a question regarding multiple ldap instances in freeradius and searching users in LDAP-Groups. First of all, what do I try to achieve: Freeradius has to authenticate and authorize our admin users for our customers network devices. It has to perform user authentication with a simple ldap bind authentication and look up the group membership of the user. If the password of the user is correct and the user is member of a specific group, access shall be granted. I have already achieved a working configuration for the tasks above. I recently got a new task to allow also our customers access to their network devices with read-only access. The customer users are already configured in another ldap server. So I would like to configure two named ldap instances in rlm_ldap. If I do so, the authentication part for the admin user still works, but freeradius will not search the LDAP for user membership anymore and reject access. Please find below the config and debug output of the working configuration with only one ldap server And the modified config with two named ldap instances. Any help appreciated. If further debug output is needed, please let me know. Best regards, Florian #################### ## ## Sinlge LDAP Server configuration working ## LDAP search is performed and user is found in the configured group ## #################### Single LDAP Server configured: :/etc/freeradius/3.0# grep -v '#' mods-enabled/ldap | grep -v -e '^$' ldap { server = 'IP' identity = 'CN=freerad,OU=Service-Accounts,OU=User,OU=mycompany,DC=mycompany,DC=de' password = removed base_dn = 'OU=mycompany,DC=mycompany,DC=de' sasl { } update { control:Password-With-Header += 'userPassword' control: += 'radiusControlAttribute' request: += 'radiusRequestAttribute' reply: += 'radiusReplyAttribute' } user { base_dn = "${..base_dn}" filter = "(sAMAccountName=%{%{Stripped-User-Name}:-%{User-Name}})" sasl { } } group { base_dn = "${..base_dn}" filter = '(objectClass=posixGroup)' scope = 'sub' name_attribute = cn membership_filter = "(|(&(objectClass=group)(member=%{control:Ldap-UserDn})))" membership_attribute = 'memberOf' } profile { } client { base_dn = "${..base_dn}" filter = '(objectClass=radiusClient)' template { } attribute { ipaddr = 'radiusClientIdentifier' secret = 'radiusClientSecret' } } accounting { reference = "%{tolower:type.%{Acct-Status-Type}}" type { start { update { description := "Online at %S" } } interim-update { update { description := "Last seen at %S" } } stop { update { description := "Offline at %S" } } } } post-auth { update { description := "Authenticated at %S" } } options { chase_referrals = yes rebind = yes res_timeout = 10 srv_timelimit = 3 net_timeout = 1 idle = 60 probes = 3 interval = 3 ldap_debug = 0x0028 } tls { } pool { start = ${thread[pool].start_servers} min = ${thread[pool].min_spare_servers} max = ${thread[pool].max_servers} spare = ${thread[pool].max_spare_servers} uses = 0 retry_delay = 30 lifetime = 0 idle_timeout = 60 } } :/etc/freeradius/3.0# grep -v '#' sites-enabled/default | grep -v -e '^$' server default { listen { type = auth ipaddr = * port = 0 limit { max_connections = 16 lifetime = 0 idle_timeout = 30 } } listen { ipaddr = * port = 0 type = acct limit { } } listen { type = auth port = 0 limit { max_connections = 16 lifetime = 0 idle_timeout = 30 } } listen { ipv6addr = :: port = 0 type = acct limit { } } authorize { preprocess eap { ok = return } ldap if ((ok || updated) && User-Password) { update { control:Auth-Type := ldap } } } authenticate { digest Auth-Type LDAP { ldap if (LDAP-Group == "mycompany_Technik_Sec"){ if (Huntgroup-Name == "fortigate") { update reply { Fortinet-Group-Name = "mycompany_Operations" Fortinet-Access-Profile = "super_admin" } } } else { reject } } eap } preacct { preprocess acct_unique suffix files } accounting { detail unix -sql exec attr_filter.accounting_response } session { } post-auth { update { &reply: += &session-state: } -sql exec remove_reply_message_if_eap Post-Auth-Type REJECT { -sql attr_filter.access_reject eap remove_reply_message_if_eap } Post-Auth-Type Challenge { } } pre-proxy { } post-proxy { eap } } Debug output of auth request tested via radtest -t pap user.name pw-removed localhost 0 testing123 (0) Received Access-Request Id 178 from 127.0.0.1:52807 to 127.0.0.1:1812 length 81 (0) User-Name = "user.name" (0) User-Password = "pw-removed" (0) NAS-IP-Address = 127.0.1.1 (0) NAS-Port = 0 (0) Message-Authenticator = 0x87ca46d1ef7da1eb772aef641e0d9e02 (0) # Executing section authorize from file /etc/freeradius/3.0/sites-enabled/default (0) authorize { (0) [preprocess] = ok (0) eap: No EAP-Message, not doing EAP (0) [eap] = noop rlm_ldap (ldap): Reserved connection (0) (0) ldap: EXPAND (sAMAccountName=%{%{Stripped-User-Name}:-%{User-Name}}) (0) ldap: --> (sAMAccountName=user.name) (0) ldap: Performing search in "OU=mycompany,DC=mycompany,DC=mycompany,DC=de" with filter "(sAMAccountName=user.name)", scope "sub" (0) ldap: Waiting for search result... (0) ldap: User object found at DN "CN=User Name,OU=Windows 10 User,OU=User,OU=mycompany,DC=mycompany,DC=mycompany,DC=de" (0) ldap: Processing user attributes (0) ldap: WARNING: No "known good" password added. Ensure the admin user has permission to read the password attribute (0) ldap: WARNING: PAP authentication will *NOT* work with Active Directory (if that is what you were trying to configure) rlm_ldap (ldap): Released connection (0) Need 5 more connections to reach 10 spares rlm_ldap (ldap): Opening additional connection (5), 1 of 27 pending slots used rlm_ldap (ldap): Connecting to ldap://IP:389 rlm_ldap (ldap): Waiting for bind result... rlm_ldap (ldap): Bind successful (0) [ldap] = ok (0) if ((ok || updated) && User-Password) { (0) if ((ok || updated) && User-Password) -> TRUE (0) if ((ok || updated) && User-Password) { (0) update { (0) control:Auth-Type := LDAP (0) } # update = noop (0) } # if ((ok || updated) && User-Password) = noop (0) } # authorize = ok (0) Found Auth-Type = LDAP (0) # Executing group from file /etc/freeradius/3.0/sites-enabled/default (0) Auth-Type LDAP { rlm_ldap (ldap): Reserved connection (1) (0) ldap: Login attempt by "user.name" (0) ldap: Using user DN from request "CN=User Name,OU=Windows 10 User,OU=User,OU=mycompany,DC=mycompany,DC=mycompany,DC=de" (0) ldap: Waiting for bind result... (0) ldap: Bind successful (0) ldap: Bind as user "CN=User Name,OU=Windows 10 User,OU=User,OU=mycompany,DC=mycompany,DC=mycompany,DC=de" was successful rlm_ldap (ldap): Released connection (1) (0) [ldap] = ok (0) if (LDAP-Group == "mycompany_Technik_Sec"){ (0) Searching for user in group "mycompany_Technik_Sec" rlm_ldap (ldap): Reserved connection (2) (0) Using user DN from request "CN=User Name,OU=Windows 10 User,OU=User,OU=mycompany,DC=mycompany,DC=mycompany,DC=de" (0) Checking for user in group objects (0) EXPAND (&(cn=mycompany_Technik_Sec)(objectClass=posixGroup)(|(&(objectClass=group)(member=%{control:Ldap-UserDn})))) (0) --> (&(cn=mycompany_Technik_Sec)(objectClass=posixGroup)(|(&(objectClass=group)(member=CN\3dUser Name\2cOU\3dWindows 10 User\2cOU\3dUser\2cOU\3dmycompany\2cDC\3dmycompany\2cDC\3dmycompany\2cDC\3dde)))) (0) Performing search in "OU=mycompany,DC=mycompany,DC=mycompany,DC=de" with filter "(&(cn=mycompany_Technik_Sec)(objectClass=posixGroup)(|(&(objectClass=group)(member=CN\3dUser Name\2cOU\3dWindows 10 User\2cOU\3dUser\2cOU\3dmycompany\2cDC\3dmycompany\2cDC\3dmycompany\2cDC\3dde))))", scope "sub" (0) Waiting for search result... (0) Search returned no results (0) Checking user object's memberOf attributes (0) Performing unfiltered search in "CN=User Name,OU=Windows 10 User,OU=User,OU=mycompany,DC=mycompany,DC=mycompany,DC=de", scope "base" (0) Waiting for search result... ber_get_next failed. ber_get_next failed. (0) Processing memberOf value "CN=mycompany_pdns_operator,OU=PDNS,OU=Sicherheitsgruppen,OU=Gruppen,OU=mycompany,DC=mycompany,DC=mycompany,DC=de" as a DN (0) Resolving group DN "CN=mycompany_pdns_operator,OU=PDNS,OU=Sicherheitsgruppen,OU=Gruppen,OU=mycompany,DC=mycompany,DC=mycompany,DC=de" to group name ... (0) Processing memberOf value "CN=mycompany_Technik_Sec,OU=Sicherheitsgruppen,OU=Gruppen,OU=mycompany,DC=mycompany,DC=mycompany,DC=de" as a DN (0) Resolving group DN "CN=mycompany_Technik_Sec,OU=Sicherheitsgruppen,OU=Gruppen,OU=mycompany,DC=mycompany,DC=mycompany,DC=de" to group name (0) Performing unfiltered search in "CN=mycompany_Technik_Sec,OU=Sicherheitsgruppen,OU=Gruppen,OU=mycompany,DC=mycompany,DC=mycompany,DC=de", scope "base" (0) Waiting for search result... (0) Group DN "CN=mycompany_Technik_Sec,OU=Sicherheitsgruppen,OU=Gruppen,OU=mycompany,DC=mycompany,DC=mycompany,DC=de" resolves to name "mycompany_Technik_Sec" (0) User found in group "mycompany_Technik_Sec". Comparison between membership: name (resolved from DN "CN=mycompany_Technik_Sec,OU=Sicherheitsgruppen,OU=Gruppen,OU=mycompany,DC=mycompany,DC=mycompany,DC=de"), check: name rlm_ldap (ldap): Released connection (2) (0) if (LDAP-Group == "mycompany_Technik_Sec") -> TRUE (0) if (LDAP-Group == "mycompany_Technik_Sec") { (0) if (Huntgroup-Name == "fortigate") { (0) ERROR: Failed retrieving values required to evaluate condition (0) } # if (LDAP-Group == "mycompany_Technik_Sec") = ok (0) ... skipping else: Preceding "if" was taken (0) } # Auth-Type LDAP = ok (0) # Executing section post-auth from file /etc/freeradius/3.0/sites-enabled/default (0) post-auth { (0) update { (0) No attributes updated (0) } # update = noop (0) [exec] = noop (0) policy remove_reply_message_if_eap { (0) if (&reply:EAP-Message && &reply:Reply-Message) { (0) if (&reply:EAP-Message && &reply:Reply-Message) -> FALSE (0) else { (0) [noop] = noop (0) } # else = noop (0) } # policy remove_reply_message_if_eap = noop (0) } # post-auth = noop (0) Sent Access-Accept Id 178 from 127.0.0.1:1812 to 127.0.0.1:52807 length 0 (0) Finished request Waking up in 4.9 seconds. (0) Cleaning up request packet ID 178 with timestamp +15 Ready to process requests #################### ## ## Multiple LDAP Server configuration not working ## Looks like freeradius is not searching the ldap ## #################### :/etc/freeradius/3.0# grep -v '#' mods-enabled/ldap | grep -v -e '^$' ldap mycompany { server = 'IP' identity = 'CN=freerad,OU=Service-Accounts,OU=User,OU=mycompany,DC=mycompany,DC=de' password = removed base_dn = 'OU=mycompany,DC=mycompany,DC=de' sasl { } update { control:Password-With-Header += 'userPassword' control: += 'radiusControlAttribute' request: += 'radiusRequestAttribute' reply: += 'radiusReplyAttribute' } user { base_dn = "${..base_dn}" filter = "(sAMAccountName=%{%{Stripped-User-Name}:-%{User-Name}})" sasl { } } group { base_dn = "${..base_dn}" filter = '(objectClass=posixGroup)' scope = 'sub' name_attribute = cn membership_filter = "(|(&(objectClass=group)(member=%{control:Ldap-UserDn})))" membership_attribute = 'memberOf' } profile { } client { base_dn = "${..base_dn}" filter = '(objectClass=radiusClient)' template { } attribute { ipaddr = 'radiusClientIdentifier' secret = 'radiusClientSecret' } } accounting { reference = "%{tolower:type.%{Acct-Status-Type}}" type { start { update { description := "Online at %S" } } interim-update { update { description := "Last seen at %S" } } stop { update { description := "Offline at %S" } } } } post-auth { update { description := "Authenticated at %S" } } options { chase_referrals = yes rebind = yes res_timeout = 10 srv_timelimit = 3 net_timeout = 1 idle = 60 probes = 3 interval = 3 ldap_debug = 0x0028 } tls { } pool { start = ${thread[pool].start_servers} min = ${thread[pool].min_spare_servers} max = ${thread[pool].max_servers} spare = ${thread[pool].max_spare_servers} uses = 0 retry_delay = 30 lifetime = 0 idle_timeout = 60 } } ldap customers { server = 'IP' identity = 'CN=freerad,OU=Service-Accounts,OU=User,OU=mycompany,DC=mycompany,DC=de' password = removed base_dn = 'OU=mycompany,DC=mycompany,DC=mycompany,DC=de' sasl { } update { control:Password-With-Header += 'userPassword' control: += 'radiusControlAttribute' request: += 'radiusRequestAttribute' reply: += 'radiusReplyAttribute' } user { base_dn = "${..base_dn}" filter = "(sAMAccountName=%{%{Stripped-User-Name}:-%{User-Name}})" sasl { } } group { base_dn = "${..base_dn}" filter = '(objectClass=posixGroup)' scope = 'sub' name_attribute = cn membership_filter = "(|(&(objectClass=group)(member=%{control:Ldap-UserDn})))" membership_attribute = 'memberOf' } profile { } client { base_dn = "${..base_dn}" filter = '(objectClass=radiusClient)' template { } attribute { ipaddr = 'radiusClientIdentifier' secret = 'radiusClientSecret' } } accounting { reference = "%{tolower:type.%{Acct-Status-Type}}" type { start { update { description := "Online at %S" } } interim-update { update { description := "Last seen at %S" } } stop { update { description := "Offline at %S" } } } } post-auth { update { description := "Authenticated at %S" } } options { chase_referrals = yes rebind = yes res_timeout = 10 srv_timelimit = 3 net_timeout = 1 idle = 60 probes = 3 interval = 3 ldap_debug = 0x0028 } tls { } pool { start = ${thread[pool].start_servers} min = ${thread[pool].min_spare_servers} max = ${thread[pool].max_servers} spare = ${thread[pool].max_spare_servers} uses = 0 retry_delay = 30 lifetime = 0 idle_timeout = 60 } } :/etc/freeradius/3.0# grep -v '#' sites-enabled/default | grep -v -e '^$' server default { listen { type = auth ipaddr = * port = 0 limit { max_connections = 16 lifetime = 0 idle_timeout = 30 } } listen { ipaddr = * port = 0 type = acct limit { } } listen { type = auth port = 0 limit { max_connections = 16 lifetime = 0 idle_timeout = 30 } } listen { ipv6addr = :: port = 0 type = acct limit { } } authorize { filter_username preprocess eap { ok = return } mycompany if ((ok || updated) && User-Password) { update { control:Auth-Type := ldap } } customers if ((ok || updated) && User-Password) { update { control:Auth-Type := ldap } } } authenticate { digest Auth-Type LDAP { mycompany if (mycompany-LDAP-Group == "mycompany_Technik_Sec"){ if (Huntgroup-Name == "fortigate") { update reply { Fortinet-Group-Name = "mycompany_Operations" Fortinet-Access-Profile = "super_admin" } } } else { reject } customers } eap } preacct { preprocess acct_unique suffix files } accounting { detail unix -sql exec attr_filter.accounting_response } session { } post-auth { update { &reply: += &session-state: } -sql exec remove_reply_message_if_eap Post-Auth-Type REJECT { -sql attr_filter.access_reject eap remove_reply_message_if_eap } Post-Auth-Type Challenge { } } pre-proxy { } post-proxy { eap } } Debug output of auth request tested via radtest -t pap user.name pw-removed localhost 0 testing123 (0) Received Access-Request Id 85 from 127.0.0.1:42556 to 127.0.0.1:1812 length 81 (0) User-Name = "user.name" (0) User-Password = "pw-removed" (0) NAS-IP-Address = 127.0.1.1 (0) NAS-Port = 0 (0) Message-Authenticator = 0xd04d42343938af1eb2a54bbed931ccd6 (0) # Executing section authorize from file /etc/freeradius/3.0/sites-enabled/default (0) authorize { (0) policy filter_username { (0) if (&User-Name) { (0) if (&User-Name) -> TRUE (0) if (&User-Name) { (0) if (&User-Name =~ / /) { (0) if (&User-Name =~ / /) -> FALSE (0) if (&User-Name =~ /@[^@]*@/ ) { (0) if (&User-Name =~ /@[^@]*@/ ) -> FALSE (0) if (&User-Name =~ /\.\./ ) { (0) if (&User-Name =~ /\.\./ ) -> FALSE (0) if ((&User-Name =~ /@/) && (&User-Name !~ /(a)(.+)\.(.+)$/)) { (0) if ((&User-Name =~ /@/) && (&User-Name !~ /(a)(.+)\.(.+)$/)) -> FALSE (0) if (&User-Name =~ /\.$/) { (0) if (&User-Name =~ /\.$/) -> FALSE (0) if (&User-Name =~ /(a)\./) { (0) if (&User-Name =~ /(a)\./) -> FALSE (0) } # if (&User-Name) = notfound (0) } # policy filter_username = notfound (0) [preprocess] = ok (0) eap: No EAP-Message, not doing EAP (0) [eap] = noop rlm_ldap (mycompany): Reserved connection (0) (0) mycompany: EXPAND (sAMAccountName=%{%{Stripped-User-Name}:-%{User-Name}}) (0) mycompany: --> (sAMAccountName=user.name) (0) mycompany: Performing search in "OU=mycompany,DC=mycompany,DC=mycompany,DC=de" with filter "(sAMAccountName=user.name)", scope "sub" (0) mycompany: Waiting for search result... (0) mycompany: User object found at DN "CN=User Name,OU=Windows 10 User,OU=User,OU=mycompany,DC=mycompany,DC=mycompany,DC=de" (0) mycompany: Processing user attributes (0) mycompany: WARNING: No "known good" password added. Ensure the admin user has permission to read the password attribute (0) mycompany: WARNING: PAP authentication will *NOT* work with Active Directory (if that is what you were trying to configure) rlm_ldap (mycompany): Released connection (0) Need 5 more connections to reach 10 spares rlm_ldap (mycompany): Opening additional connection (5), 1 of 27 pending slots used rlm_ldap (mycompany): Connecting to ldap://IP:389 rlm_ldap (mycompany): Waiting for bind result... rlm_ldap (mycompany): Bind successful (0) [mycompany] = ok (0) if ((ok || updated) && User-Password) { (0) if ((ok || updated) && User-Password) -> TRUE (0) if ((ok || updated) && User-Password) { (0) update { (0) control:Auth-Type := LDAP (0) } # update = noop (0) } # if ((ok || updated) && User-Password) = noop rlm_ldap (customers): Reserved connection (0) (0) customers: EXPAND (sAMAccountName=%{%{Stripped-User-Name}:-%{User-Name}}) (0) customers: --> (sAMAccountName=user.name) (0) customers: Performing search in "OU=mycompany,DC=mycompany,DC=mycompany,DC=de" with filter "(sAMAccountName=user.name)", scope "sub" (0) customers: Waiting for search result... (0) customers: User object found at DN "CN=User Name,OU=Windows 10 User,OU=User,OU=mycompany,DC=mycompany,DC=mycompany,DC=de" (0) customers: Processing user attributes (0) customers: WARNING: No "known good" password added. Ensure the admin user has permission to read the password attribute (0) customers: WARNING: PAP authentication will *NOT* work with Active Directory (if that is what you were trying to configure) rlm_ldap (customers): Released connection (0) Need 5 more connections to reach 10 spares rlm_ldap (customers): Opening additional connection (5), 1 of 27 pending slots used rlm_ldap (customers): Connecting to ldap://IP:389 rlm_ldap (customers): Waiting for bind result... rlm_ldap (customers): Bind successful (0) [customers] = ok (0) if ((ok || updated) && User-Password) { (0) if ((ok || updated) && User-Password) -> TRUE (0) if ((ok || updated) && User-Password) { (0) update { (0) control:Auth-Type := LDAP (0) } # update = noop (0) } # if ((ok || updated) && User-Password) = noop (0) } # authorize = ok (0) Found Auth-Type = LDAP (0) # Executing group from file /etc/freeradius/3.0/sites-enabled/default (0) Auth-Type LDAP { rlm_ldap (mycompany): Reserved connection (1) (0) mycompany: Login attempt by "user.name" (0) mycompany: Using user DN from request "CN=User Name,OU=Windows 10 User,OU=User,OU=mycompany,DC=mycompany,DC=mycompany,DC=de" (0) mycompany: Waiting for bind result... (0) mycompany: Bind successful (0) mycompany: Bind as user "CN=User Name,OU=Windows 10 User,OU=User,OU=mycompany,DC=mycompany,DC=mycompany,DC=de" was successful rlm_ldap (mycompany): Released connection (1) (0) [mycompany] = ok (0) if (mycompany-LDAP-Group == "mycompany_Technik_Sec"){ (0) if (mycompany-LDAP-Group == "mycompany_Technik_Sec") -> FALSE (0) else { (0) [reject] = reject (0) } # else = reject (0) } # Auth-Type LDAP = reject (0) Failed to authenticate the user (0) Using Post-Auth-Type Reject (0) # Executing group from file /etc/freeradius/3.0/sites-enabled/default (0) Post-Auth-Type REJECT { (0) attr_filter.access_reject: EXPAND %{User-Name} (0) attr_filter.access_reject: --> user.name (0) attr_filter.access_reject: Matched entry DEFAULT at line 11 (0) [attr_filter.access_reject] = updated (0) [eap] = noop (0) policy remove_reply_message_if_eap { (0) if (&reply:EAP-Message && &reply:Reply-Message) { (0) if (&reply:EAP-Message && &reply:Reply-Message) -> FALSE (0) else { (0) [noop] = noop (0) } # else = noop (0) } # policy remove_reply_message_if_eap = noop (0) } # Post-Auth-Type REJECT = updated (0) Delaying response for 1.000000 seconds Waking up in 0.3 seconds. Waking up in 0.6 seconds. (0) Sending delayed response (0) Sent Access-Reject Id 85 from 127.0.0.1:1812 to 127.0.0.1:42556 length 20 Waking up in 3.9 seconds.

2 4

sqlippool on 3.0.18
by Nathan Ward 27 Feb '19

27 Feb '19

Hi, Wading in to this one now - not sure if this is a bug or if it’s known/fixed so posting here in the hope someone else has had this and looked in to it. If not, I’m learning a lot, so, that’s good. Will post more when I have it. I’m testing upgrading to 3.0.18, and when I get an Accounting-On with sqlippool (I am running a NAS simulator which sends Accounting-On first, not sure if other messages are impacted), I get: <snip> rlm_sql (sql-radiusippool): Reserved connection (0) (0) sqlippool-ipv4: EXPAND %{%{Chargeable-User-Identity}:-%{%{Stripped-User-Name}:-UNKNOWN}} (0) sqlippool-ipv4: --> UNKNOWN (0) sqlippool-ipv4: SQL-User-Name set to 'UNKNOWN' (0) sqlippool-ipv4: EXPAND START TRANSACTION (0) sqlippool-ipv4: --> START TRANSACTION (0) sqlippool-ipv4: Executing query: START TRANSACTION rlm_sql_postgresql: Status: PGRES_COMMAND_OK rlm_sql_postgresql: query affected rows = 0 src/modules/rlm_sql/rlm_sql.c:381: Type mismatch: name[rlm_sql_t] expected[rlm_sql_handle_t] talloc abort: src/modules/rlm_sql/rlm_sql.c:381: Type mismatch: name[rlm_sql_t] expected[rlm_sql_handle_t] </snip> src/modules/rlm_sqlippool/rlm_sqlippool.c:320 is: if (radius_axlat(&expanded, request, query, data->sql_inst->sql_escape_func, data->sql_inst) < 0) return -1; And I notice in Herwin Weststrate’s commit @ c8736367583 there is a lot of use of the handle as the last param for that function rather than the sql module instance: - if (radius_axlat(&expanded, request, inst->config->simul_verify_query, sql_escape_func, inst) < 0) { + if (radius_axlat(&expanded, request, inst->config->simul_verify_query, inst->sql_escape_func, handle) < 0) { Etc. so I’m thinking that commit didn’t take sqlippool in to account. I notice there’s a new function, sql_escape_for_xlat_func, which gets a connection from the pool then releases it, but I’m not sure that’s right for this situation in sqlippool - we’re doing these xlats in the middle of a transaction, so we should have a handle already? I've tried passing the handle to radius_axlat rather than the instance, i.e. (in rlm_sqlippool.c): - if (radius_axlat(&expanded, request, query, data->sql_inst->sql_escape_func, data->sql_inst) < 0) return -1; + if (radius_axlat(&expanded, request, query, data->sql_inst->sql_escape_func, handle) < 0) return -1; But now I get a talloc error - <snip> (0) sqlippool-ipv4: Executing query: START TRANSACTION rlm_sql_postgresql: Status: PGRES_COMMAND_OK rlm_sql_postgresql: query affected rows = 0 Bad talloc magic value - unknown value talloc abort: Bad talloc magic value - unknown value </snip> Here’s a backtrace for that - note the handle is passed through, so I’m not entirely clear why this is objecting. Is the handle freed somewhere? I’m wondering if this is simply because we’re running several queries in a transaction - the first query (i.e. START TRANSACTION) is always fine, even if I put an xlat in it. The second query always triggers this error. Should this handle even still be useable? The next line after the one I’ve changed above calls sql_query, which needs handle to have a ‘conn’ member, so, I expect so.. #3 0x00007fa228d5e77a in _talloc_get_type_abort () from /lib64/libtalloc.so.2 #4 0x00007fa2210f0f40 in sql_escape_func (request=request@entry=0x55a14277f330, out=out@entry=0x55a1427820d0 "", outlen=outlen@entry=30, in=0x55a1427819b0 "192.0.2.0", arg=arg@entry=0x7ffeb7db2ba0) at src/modules/rlm_sql/rlm_sql.c:381 #5 0x00007fa229aa6afe in xlat_aprint (ctx=ctx@entry=0x55a14277f330, request=0x55a14277f330, node=<optimized out>, escape=escape@entry=0x7fa2210f0f10 <sql_escape_func>, escape_ctx=0x7ffeb7db2ba0, lvl=0) at src/main/xlat.c:2371 #6 0x00007fa229aa7aed in xlat_process (out=0x7ffeb7db1990, request=0x55a14277f330, head=0x55a142781f60, escape=0x7fa2210f0f10 <sql_escape_func>, escape_ctx=0x7ffeb7db2ba0) at src/main/xlat.c:2410 #7 0x00007fa229aa6b51 in xlat_aprint (ctx=ctx@entry=0x55a142781a30, request=request@entry=0x55a14277f330, node=node@entry=0x55a142781df0, escape=escape@entry=0x7fa2210f0f10 <sql_escape_func>, escape_ctx=escape_ctx@entry=0x7ffeb7db2ba0, lvl=0) at src/main/xlat.c:2344 #8 0x00007fa229aa79d1 in xlat_process (out=0x7ffeb7db1a90, request=0x55a14277f330, head=<optimized out>, escape=0x7fa2210f0f10 <sql_escape_func>, escape_ctx=0x7ffeb7db2ba0) at src/main/xlat.c:2428 #9 0x00007fa229aa7b44 in xlat_expand_struct (out=out@entry=0x7ffeb7db1b48, outlen=outlen@entry=0, request=request@entry=0x55a14277f330, node=<optimized out>, escape=escape@entry=0x7fa2210f0f10 <sql_escape_func>, escape_ctx=escape_ctx@entry=0x7ffeb7db2ba0) at src/main/xlat.c:2482 #10 0x00007fa229aa8094 in xlat_expand (out=out@entry=0x7ffeb7db1b48, outlen=outlen@entry=0, request=request@entry=0x55a14277f330, fmt=fmt@entry=0x7ffeb7db1b50 "UPDATE radippool SET nasipaddress = '', pool_key = 0, callingstationid = '', expiry_time = 'now'::timestamp(0) - '1 second'::interval WHERE nasipaddress = '%{%{Nas-IP-Address}:-%{Nas-IPv6-Address}}'", escape=0x7fa2210f0f10 <sql_escape_func>, escape_ctx=escape_ctx@entry=0x7ffeb7db2ba0) at src/main/xlat.c:2547 #11 0x00007fa229aa95fa in radius_axlat (out=out@entry=0x7ffeb7db1b48, request=request@entry=0x55a14277f330, fmt=fmt@entry=0x7ffeb7db1b50 "UPDATE radippool SET nasipaddress = '', pool_key = 0, callingstationid = '', expiry_time = 'now'::timestamp(0) - '1 second'::interval WHERE nasipaddress = '%{%{Nas-IP-Address}:-%{Nas-IPv6-Address}}'", escape=<optimized out>, ctx=ctx@entry=0x7ffeb7db2ba0) at src/main/xlat.c:2617 #12 0x00007fa2212fae4f in sqlippool_command (fmt=<optimized out>, handle=handle@entry=0x7ffeb7db2ba0, data=data@entry=0x55a14264d250, request=request@entry=0x55a14277f330, param=param@entry=0x0, param_len=param_len@entry=0) at src/modules/rlm_sqlippool/rlm_sqlippool.c:320 #13 0x00007fa2212fb66e in mod_accounting_on (request=0x55a14277f330, inst=0x55a14264d250, handle=0x7ffeb7db2ba0) at src/modules/rlm_sqlippool/rlm_sqlippool.c:706 #14 mod_accounting (instance=0x55a14264d250, request=0x55a14277f330) at src/modules/rlm_sqlippool/rlm_sqlippool.c:779 -- Nathan Ward

2 1

Add support for systemd service and watchdogs Fixes #2499.
by Stefano Mason 27 Feb '19

27 Feb '19

Dear all, "systemctl start radiusd.service" it doesn't exit but remain in a stuck state, it's necessary to do a CTRL-C, after that I check the status e the process list: all it's okay. - systemctl start radiusd.service (stuck in) - systemctl status radiusd.service (okay) - systemctl stop radiusd.service (okay) Environment Centos 7 # cat /etc/redhat-release CentOS Linux release 7.6.1810 (Core) cd freeradius-server git pull git checkout v3.0.x git archive --format=tar --prefix=freeradius-server-3.0.19/ v3.0.x | bzip2 -c >../freeradius-server-3.0.19.tar.bz2 build from freeradius.spec results: x86_64]# ls -1 freeradius-3.0.19-2.el7.centos.x86_64.rpm freeradius-config-3.0.19-2.el7.centos.x86_64.rpm freeradius-debuginfo-3.0.19-2.el7.centos.x86_64.rpm freeradius-freetds-3.0.19-2.el7.centos.x86_64.rpm freeradius-krb5-3.0.19-2.el7.centos.x86_64.rpm freeradius-ldap-3.0.19-2.el7.centos.x86_64.rpm freeradius-mysql-3.0.19-2.el7.centos.x86_64.rpm freeradius-perl-3.0.19-2.el7.centos.x86_64.rpm freeradius-postgresql-3.0.19-2.el7.centos.x86_64.rpm freeradius-python-3.0.19-2.el7.centos.x86_64.rpm freeradius-redis-3.0.19-2.el7.centos.x86_64.rpm freeradius-rest-3.0.19-2.el7.centos.x86_64.rpm freeradius-sqlite-3.0.19-2.el7.centos.x86_64.rpm freeradius-unixODBC-3.0.19-2.el7.centos.x86_64.rpm freeradius-utils-3.0.19-2.el7.centos.x86_64.rpm Upgrade: # yum localinstall freeradius-3.0.18-2.el7.centos.x86_64.rpm freeradius-config-3.0.18-2.el7.centos.x86_64.rpm freeradius-ldap-3.0.18-2.el7.centos.x86_64.rpm freeradius-utils-3.0.18-2.el7.centos.x86_64.rpm # systemctl daemon-reload systemd read the new instructions from # cat /usr/lib/systemd/system/radiusd.service [Unit] Description=FreeRADIUS multi-protocol policy server After=network-online.target Documentation=man:radiusd(8) man:radiusd.conf(5) http://wiki.freeradius.org/ http://networkradius.com/doc/ [Service] Type=notify WatchdogSec=60 NotifyAccess=all PIDFile=/var/run/radiusd/radiusd.pid EnvironmentFile=-/etc/sysconfig/radiusd # FreeRADIUS can do static evaluation of policy language rules based # on environmental variables which is very useful for doing per-host # customization. # Unfortunately systemd does not allow variable substitutions such # as %H or $(hostname) in the EnvironmentFile. # We provide HOSTNAME here for convenience. Environment=HOSTNAME=%H # Limit memory to 2G this is fine for %99.99 of deployments. FreeRADIUS # is not memory hungry, if it's using more than this, then there's probably # a leak somewhere. MemoryLimit=2G RuntimeDirectory=radiusd RuntimeDirectoryMode=0775 ExecStartPre=/usr/sbin/radiusd $FREERADIUS_OPTIONS -Cx -lstdout ExecStartPre=/usr/bin/chown radiusd:radiusd /var/run/radiusd ExecStart=/usr/sbin/radiusd $FREERADIUS_OPTIONS Restart=on-failure RestartSec=5 [Install] WantedBy=multi-user.target STATUS works: # systemctl status radiusd.service ● radiusd.service - FreeRADIUS multi-protocol policy server Loaded: loaded (/usr/lib/systemd/system/radiusd.service; enabled; vendor preset: disabled) Active: activating (start) since Wed 2019-02-27 10:33:43 CET; 1min 13s ago Docs: man:radiusd(8) man:radiusd.conf(5) http://wiki.freeradius.org/ http://networkradius.com/doc/ Process: 31202 ExecStartPre=/usr/bin/chown radiusd:radiusd /var/run/radiusd (code=exited, status=0/SUCCESS) Process: 31199 ExecStartPre=/usr/sbin/radiusd $FREERADIUS_OPTIONS -Cx -lstdout (code=exited, status=0/SUCCESS) Main PID: 31208 (radiusd) Memory: 21.8M (limit: 2.0G) CGroup: /system.slice/radiusd.service └─31208 /usr/sbin/radiusd STOP works: # systemctl stop radiusd.service # START stuck in: # systemctl start radiusd.service ^C # LOG from journalctl: Feb 27 10:37:04 betty systemd[1]: Starting FreeRADIUS multi-protocol policy server... Feb 27 10:37:04 betty radiusd[31406]: FreeRADIUS Version 3.0.19 Feb 27 10:37:04 betty radiusd[31406]: Copyright (C) 1999-2019 The FreeRADIUS server project and contributors Feb 27 10:37:04 betty radiusd[31406]: There is NO warranty; not even for MERCHANTABILITY or FITNESS FOR A Feb 27 10:37:04 betty radiusd[31406]: PARTICULAR PURPOSE Feb 27 10:37:04 betty radiusd[31406]: You may redistribute copies of FreeRADIUS under the terms of the Feb 27 10:37:04 betty radiusd[31406]: GNU General Public License Feb 27 10:37:04 betty radiusd[31406]: For more information about these matters, see the file named COPYRIGHT Feb 27 10:37:04 betty radiusd[31406]: Starting - reading configuration files ... Feb 27 10:37:04 betty radiusd[31406]: Debugger not attached Best regards. Stefano

2 1

Building the 3.0.18 version
by Elias Pereira 27 Feb '19

27 Feb '19

hello, I'm trying to build version 3.0.18 in a debian 9.8 by following the link https://wiki.freeradius.org/building/Debian%20and%20Ubuntu#building-packages, but when I run the "make deb" command the error "make: *** No rule to make target 'deb'" occurs. Getting the source ok Installing build dependencies ok Building Packages *error* Any idea? -- Elias Pereira

3 13

mschap: eapol_test peap/mschap fails
by Peter Kain 26 Feb '19

26 Feb '19

Hi, First time poster. I've been tasked with setting up a freeRADIUS (FR) server in order to join eduroam under the following conditions: authentication against Active Directory where we have two domains, the realm passed doesn't indicate the AD domain, and I can only join one domain "domainA", but there's trust between the domains. realm = user(a)uni.edu domainA.ad.uni.edu domainB.ad.uni.edu I've built a CentOS 7 server with FR 3.0.13 and winbind 4.8.3. Joined the server to the first domain and I'm able to authenticate users against both domains using the ntlm_auth command. As a first step, following the posted instructions "Configuring Authentication with Active Directory" I edited the mschap to use ntlm_auth setting "--domain=domainA". And I've set radiusd to run as root. Using the eapol_test program I'm able to authenticate as userA using both "-c ttls-mschap.conf" & "-c peap-mschap.conf" and I'm able to authenticate my iPad to our wireless . So far everything works as expected when setup for a single domain. file: mods-enabled/mschap mschap { ... ntlm_auth --domain=domainA ... In order to authenticate to both AD domains I followed a forum posting "PEAP and multiple domains" and created two additional domain instances for mschap in the radius.conf and updated both the default and inner-tunnels. raddb/radius.conf ... modules { $INCLUDE mods-enabled/ mschap mschap.domainA{ ntlm_auth = "/usr/bin/ntlm_auth --domain=domainA --allow-mschapv2 ... } mschap mschap.domainB{ ntlm_auth = "/usr/bin/ntlm_auth --domain=domainB --allow-mschapv2 ... } } sites-enabled/inner-tunnel (updated both default and inner-tunnel) In the "authorize section {" if mschap isn't commented out then it sets "Auth-Type = mschap". This seems contrary to the documentation within the file. Again running FR 3.0.13. Commented out mschap adding "mschap.domainA". This appears to set "Auth-Type = MS-CHAP". I'm not sure how the "Auth-Type" is determine, why one configuration results in "Auth-Type = mschap" and another "Auth-Type = MS-CHAP". aurhorized { ... # If the users are logging in with an MS-CHAP-Challenge # attribute for authentication, the mschap module will find # the MS-CHAP-Challenge attribute, and add 'Auth-Type := MS-CHAP' # to the request, which will cause the server to then use # the mschap module for authentication. #mschap mschap.domainA ... authenticate { ... Auth-Type MS-CHAP { # mschap group { mschap.domainA { reject = 1 ok = return } mschap.domainB { ok = return } } } # # For old names, too. # mschap In order to make it clear in the logs, I edited mods-enabled/mschap setting "--domain=FOO" in the ntml_auth command. --> eapol_test -c ttls-mshchap.conf -s testing123 ... WORKS Looking at the logs I see "Auth-Type = MS-CHAP" being set and my defined mschap.domainA module being used. Works exactly as expected using the modules I defined. If a user isn't found in domainA it then searches domainB. I can authenticate to my wireless (ssid eduroam) using an Android phone where I can set the authentication to TTLS/mschapv2. (6) Virtual server inner-tunnel received request (6) User-Name = "userA" (6) MS-CHAP-Challenge = 0x74624904a951c158262f9cd8b0abc750 (6) MS-CHAP2-Response = 0x70008158d62efd7635c9fb5b701e2fb44ee300000000000000005390d893765b4f1900adee9e21dd10f5827472b58eeb8e48 (6) FreeRADIUS-Proxied-To = 127.0.0.1 (6) server inner-tunnel { (6) # Executing section authorize from file /etc/raddb/sites-enabled/inner-tunnel (6) authorize { (6) policy filter_username { (6) if (&User-Name) { (6) if (&User-Name) -> TRUE (6) if (&User-Name) { (6) if (&User-Name =~ / /) { (6) if (&User-Name =~ / /) -> FALSE (6) if (&User-Name =~ /@[^@]*@/ ) { (6) if (&User-Name =~ /@[^@]*@/ ) -> FALSE (6) if (&User-Name =~ /\.\./ ) { (6) if (&User-Name =~ /\.\./ ) -> FALSE (6) if ((&User-Name =~ /@/) && (&User-Name !~ /(a)(.+)\.(.+)$/)) { (6) if ((&User-Name =~ /@/) && (&User-Name !~ /(a)(.+)\.(.+)$/)) -> FALSE (6) if (&User-Name =~ /\.$/) { (6) if (&User-Name =~ /\.$/) -> FALSE (6) if (&User-Name =~ /(a)\./) { (6) if (&User-Name =~ /(a)\./) -> FALSE (6) } # if (&User-Name) = notfound (6) } # policy filter_username = notfound (6) [chap] = noop (6) mschap.domainA: Found MS-CHAP attributes. Setting 'Auth-Type = mschap.domainA' (6) [mschap.domainA] = ok (6) suffix: Checking for suffix after "@" (6) suffix: No '@' in User-Name = "userA", looking up realm NULL (6) suffix: No such realm "NULL" (6) [suffix] = noop (6) update control { (6) &Proxy-To-Realm := LOCAL (6) } # update control = noop (6) eap: No EAP-Message, not doing EAP (6) [eap] = noop (6) [files] = noop (6) [expiration] = noop (6) [logintime] = noop (6) [pap] = noop (6) } # authorize = ok (6) Found Auth-Type = MS-CHAP (6) # Executing group from file /etc/raddb/sites-enabled/inner-tunnel (6) Auth-Type MS-CHAP { (6) group { (6) mschap.domainA: Creating challenge hash with username: userA (6) mschap.domainA: Client is using MS-CHAPv2 (6) mschap.domainA: Executing: /usr/bin/ntlm_auth --request-nt-key --allow-mschapv2 --username=%{%{Stripped-User-Name}:-%{%{User-Name}:-None}} ... --> eapol_test -c peap-mschapv2.conf -s testing123 ... FAILS The above test is using mods-enabled/mschap where I've set "--domain=FOO". Tracing through the logs, it looks like the eap module is called (expected), within eap it executes the peap section (expected) which sets "default_eap_type = mschapv2". Not sure if I'm saying this correctly, but the mschapv2 section is executes using the default mschap module. (8) # Executing section authorize from file /etc/raddb/sites-enabled/inner-tunnel (8) authorize { (8) policy filter_username { (8) if (&User-Name) { (8) if (&User-Name) -> TRUE (8) if (&User-Name) { (8) if (&User-Name =~ / /) { (8) if (&User-Name =~ / /) -> FALSE (8) if (&User-Name =~ /@[^@]*@/ ) { (8) if (&User-Name =~ /@[^@]*@/ ) -> FALSE (8) if (&User-Name =~ /\.\./ ) { (8) if (&User-Name =~ /\.\./ ) -> FALSE (8) if ((&User-Name =~ /@/) && (&User-Name !~ /(a)(.+)\.(.+)$/)) { (8) if ((&User-Name =~ /@/) && (&User-Name !~ /(a)(.+)\.(.+)$/)) -> FALSE (8) if (&User-Name =~ /\.$/) { (8) if (&User-Name =~ /\.$/) -> FALSE (8) if (&User-Name =~ /(a)\./) { (8) if (&User-Name =~ /(a)\./) -> FALSE (8) } # if (&User-Name) = notfound (8) } # policy filter_username = notfound (8) [chap] = noop (8) [mschap.domainA] = noop (8) suffix: Checking for suffix after "@" (8) suffix: No '@' in User-Name = "userA", looking up realm NULL (8) suffix: No such realm "NULL" (8) [suffix] = noop (8) update control { (8) &Proxy-To-Realm := LOCAL (8) } # update control = noop (8) eap: Peer sent EAP Response (code 2) ID 8 length 65 (8) eap: No EAP Start, assuming it's an on-going EAP conversation (8) [eap] = updated (8) [files] = noop (8) [expiration] = noop (8) [logintime] = noop (8) [pap] = noop (8) } # authorize = updated (8) Found Auth-Type = eap (8) # Executing group from file /etc/raddb/sites-enabled/inner-tunnel (8) authenticate { (8) eap: Expiring EAP session with state 0xa3eaf94ca3e2e3ae (8) eap: Finished EAP session with state 0xa3eaf94ca3e2e3ae (8) eap: Previous EAP request found for state 0xa3eaf94ca3e2e3ae, released from the list (8) eap: Peer sent packet with method EAP MSCHAPv2 (26) (8) eap: Calling submodule eap_mschapv2 to process data (8) eap_mschapv2: # Executing group from file /etc/raddb/sites-enabled/inner-tunnel (8) eap_mschapv2: authenticate { (8) mschap: Creating challenge hash with username: userA (8) mschap: Client is using MS-CHAPv2 (8) mschap: Executing: /usr/bin/ntlm_auth --request-nt-key --username=%{%{Stripped-User-Name}:-%{%{User-Name}:-None}} --domain=%{%{mschap:NT-Domain}:-FOO} --challenge=%{%{mschap:Challenge}:-00} --nt-response=%{%{mschap:NT-Response}:-00}: My apologies for not posting the "radius -X" for the failed eapol_test. There are restrictions at my site about posting server logs, I'm working on it. Questions: 1) Does it look like I've made any glaring mistakes or am I on the correct path? 2) What can I do to make peap/mschap work under this circumstances? Any help is appreciated. Pete K.

2 1

Reading dynamic clients from "clients" files in /etc/raddb/dynamic-clients doesn't work 2
by smith john 26 Feb '19

26 Feb '19

Thank you, Alan. > So... the file is empty? No, the file is named 18.220.171.233, under /etc/raddb/dynamic-clients, with the following content: client mynas { ipaddr = 18.220.171.233 secret = testing456 } At https://networkradius.com/doc/3.0.10/raddb/mods-available/dynamic_clients.h…, it first create a dynamic client, then start the server in debugging mode. Shouldn't it first start the server in debugging mode, then open another shell and create the client definition file to test if dynamic client works ? > Hmm... if anything in v2 doesn't work, upgrade to v3. In fact, I first tried FreeRADIUS 3.0.13 on centos 7.6. Because v3.0.13 doesn't work, I guess that v2 may work. In addition, for all the test, I store the users in mysql, but don't store nas clients in mysql. When store nas clients in mysql, dynamic-clients does work. So I test v3.0.13 on centos 7.6 again. This is the steps: 1. link /etc/raddb/sites-enabled/dynamic_clients to /etc/raddb/sites-available/dynamic_clients, and change the ownership of /etc/raddb/sites-enabled/dynamic_clients to root:radiusd 2. Change the content of /etc/raddb/sites-enabled/dynamic_clients to: client dynamic { ipaddr = 0.0.0.0/0 dynamic_clients = dynamic_clients directory = ${confdir}/dynamic-clients/ lifetime = 3600 } server dynamic_clients { authorize { # Example 2: Read the clients from "clients" files dynamic_clients # Tell the caller that the client was defined properly. ok } } 3. Create the /etc/raddb/dynamic-clients directory, change its ownership to root:radiusd 4. Run "setenforce 0' to disable selinux. 5. Start the server in debug mode. 6. Open another shell, create a file named 18.220.171.233 under / etc/raddb/dynamic-clients, with the following content: client mynas { ipaddr = 18.220.171.233 secret = testing456 } I also changed the ownership of 18.220.171.233 to root:radiusd 7. SSH to the nas server at 18.220.171.233, and run the radtest command to test the setup. 8. The debug gives the following result: Ready to process requests (0) server dynamic_clients { (0) # Executing section authorize from file /etc/raddb/sites-enabled/dynamic-clients (0) authorize { (0) dynamic_clients: Improper configuration (0) [dynamic_clients] = noop (0) [ok] = ok (0) } # authorize = ok (0) } # server dynamic_clients (0) Converting control list to client fields (0) ERROR: Cannot add client 18.220.171.233: Required attribute "FreeRADIUS-Client-Secret" is missing Ignoring request to auth address * port 1812 bound to server default from unknown client 18.220.171.233 port 60872 proto udp Ready to process requests 9. This is the full debug output: FreeRADIUS Version 3.0.13 Copyright (C) 1999-2017 The FreeRADIUS server project and contributors There is NO warranty; not even for MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE You may redistribute copies of FreeRADIUS under the terms of the GNU General Public License For more information about these matters, see the file named COPYRIGHT Starting - reading configuration files ... including dictionary file /usr/share/freeradius/dictionary including dictionary file /usr/share/freeradius/dictionary.dhcp including dictionary file /usr/share/freeradius/dictionary.vqp including dictionary file /etc/raddb/dictionary including configuration file /etc/raddb/radiusd.conf including configuration file /etc/raddb/proxy.conf including configuration file /etc/raddb/clients.conf including files in directory /etc/raddb/mods-enabled/ including configuration file /etc/raddb/mods-enabled/always including configuration file /etc/raddb/mods-enabled/attr_filter including configuration file /etc/raddb/mods-enabled/cache_eap including configuration file /etc/raddb/mods-enabled/chap including configuration file /etc/raddb/mods-enabled/date including configuration file /etc/raddb/mods-enabled/detail including configuration file /etc/raddb/mods-enabled/detail.log including configuration file /etc/raddb/mods-enabled/dhcp including configuration file /etc/raddb/mods-enabled/digest including configuration file /etc/raddb/mods-enabled/dynamic_clients including configuration file /etc/raddb/mods-enabled/eap including configuration file /etc/raddb/mods-enabled/echo including configuration file /etc/raddb/mods-enabled/exec including configuration file /etc/raddb/mods-enabled/expiration including configuration file /etc/raddb/mods-enabled/expr including configuration file /etc/raddb/mods-enabled/files including configuration file /etc/raddb/mods-enabled/linelog including configuration file /etc/raddb/mods-enabled/logintime including configuration file /etc/raddb/mods-enabled/mschap including configuration file /etc/raddb/mods-enabled/ntlm_auth including configuration file /etc/raddb/mods-enabled/pap including configuration file /etc/raddb/mods-enabled/passwd including configuration file /etc/raddb/mods-enabled/preprocess including configuration file /etc/raddb/mods-enabled/radutmp including configuration file /etc/raddb/mods-enabled/realm including configuration file /etc/raddb/mods-enabled/replicate including configuration file /etc/raddb/mods-enabled/soh including configuration file /etc/raddb/mods-enabled/sradutmp including configuration file /etc/raddb/mods-enabled/unix including configuration file /etc/raddb/mods-enabled/unpack including configuration file /etc/raddb/mods-enabled/utf8 including configuration file /etc/raddb/mods-enabled/sql including configuration file /etc/raddb/mods-config/sql/main/mysql/queries.conf including files in directory /etc/raddb/policy.d/ including configuration file /etc/raddb/policy.d/accounting including configuration file /etc/raddb/policy.d/canonicalization including configuration file /etc/raddb/policy.d/control including configuration file /etc/raddb/policy.d/cui including configuration file /etc/raddb/policy.d/debug including configuration file /etc/raddb/policy.d/dhcp including configuration file /etc/raddb/policy.d/eap including configuration file /etc/raddb/policy.d/filter including configuration file /etc/raddb/policy.d/operator-name including files in directory /etc/raddb/sites-enabled/ including configuration file /etc/raddb/sites-enabled/default including configuration file /etc/raddb/sites-enabled/inner-tunnel including configuration file /etc/raddb/sites-enabled/dynamic-clients main { security { user = "radiusd" group = "radiusd" allow_core_dumps = no } name = "radiusd" prefix = "/usr" localstatedir = "/var" logdir = "/var/log/radius" run_dir = "/var/run/radiusd" } main { name = "radiusd" prefix = "/usr" localstatedir = "/var" sbindir = "/usr/sbin" logdir = "/var/log/radius" run_dir = "/var/run/radiusd" libdir = "/usr/lib64/freeradius" radacctdir = "/var/log/radius/radacct" hostname_lookups = no max_request_time = 30 cleanup_delay = 5 max_requests = 16384 pidfile = "/var/run/radiusd/radiusd.pid" checkrad = "/usr/sbin/checkrad" debug_level = 0 proxy_requests = yes log { stripped_names = no auth = no auth_badpass = no auth_goodpass = no colourise = yes msg_denied = "You are already logged in - access denied" } resources { } security { max_attributes = 200 reject_delay = 1.000000 status_server = yes } } radiusd: #### Loading Realms and Home Servers #### proxy server { retry_delay = 5 retry_count = 3 default_fallback = no dead_time = 120 wake_all_if_all_dead = no } home_server localhost { ipaddr = 127.0.0.1 port = 1812 type = "auth" secret = <<< secret >>> response_window = 20.000000 response_timeouts = 1 max_outstanding = 65536 zombie_period = 40 status_check = "status-server" ping_interval = 30 check_interval = 30 check_timeout = 4 num_answers_to_alive = 3 revive_interval = 120 limit { max_connections = 16 max_requests = 0 lifetime = 0 idle_timeout = 0 } coa { irt = 2 mrt = 16 mrc = 5 mrd = 30 } } home_server_pool my_auth_failover { type = fail-over home_server = localhost } realm example.com { auth_pool = my_auth_failover } realm LOCAL { } radiusd: #### Loading Clients #### client localhost { ipaddr = 127.0.0.1 require_message_authenticator = no secret = <<< secret >>> nas_type = "other" proto = "*" limit { max_connections = 16 lifetime = 0 idle_timeout = 30 } } client localhost_ipv6 { ipv6addr = ::1 require_message_authenticator = no secret = <<< secret >>> limit { max_connections = 16 lifetime = 0 idle_timeout = 30 } } client dynamic { ipaddr = 0.0.0.0/0 require_message_authenticator = no limit { max_connections = 16 lifetime = 0 idle_timeout = 30 } dynamic_clients = "dynamic_clients" lifetime = 3600 } including dynamic clients in /etc/raddb/dynamic-clients/ Debugger not attached # Creating Auth-Type = mschap # Creating Auth-Type = digest # Creating Auth-Type = eap # Creating Auth-Type = PAP # Creating Auth-Type = CHAP # Creating Auth-Type = MS-CHAP radiusd: #### Instantiating modules #### modules { # Loaded module rlm_always # Loading module "reject" from file /etc/raddb/mods-enabled/always always reject { rcode = "reject" simulcount = 0 mpp = no } # Loading module "fail" from file /etc/raddb/mods-enabled/always always fail { rcode = "fail" simulcount = 0 mpp = no } # Loading module "ok" from file /etc/raddb/mods-enabled/always always ok { rcode = "ok" simulcount = 0 mpp = no } # Loading module "handled" from file /etc/raddb/mods-enabled/always always handled { rcode = "handled" simulcount = 0 mpp = no } # Loading module "invalid" from file /etc/raddb/mods-enabled/always always invalid { rcode = "invalid" simulcount = 0 mpp = no } # Loading module "userlock" from file /etc/raddb/mods-enabled/always always userlock { rcode = "userlock" simulcount = 0 mpp = no } # Loading module "notfound" from file /etc/raddb/mods-enabled/always always notfound { rcode = "notfound" simulcount = 0 mpp = no } # Loading module "noop" from file /etc/raddb/mods-enabled/always always noop { rcode = "noop" simulcount = 0 mpp = no } # Loading module "updated" from file /etc/raddb/mods-enabled/always always updated { rcode = "updated" simulcount = 0 mpp = no } # Loaded module rlm_attr_filter # Loading module "attr_filter.post-proxy" from file /etc/raddb/mods-enabled/attr_filter attr_filter attr_filter.post-proxy { filename = "/etc/raddb/mods-config/attr_filter/post-proxy" key = "%{Realm}" relaxed = no } # Loading module "attr_filter.pre-proxy" from file /etc/raddb/mods-enabled/attr_filter attr_filter attr_filter.pre-proxy { filename = "/etc/raddb/mods-config/attr_filter/pre-proxy" key = "%{Realm}" relaxed = no } # Loading module "attr_filter.access_reject" from file /etc/raddb/mods-enabled/attr_filter attr_filter attr_filter.access_reject { filename = "/etc/raddb/mods-config/attr_filter/access_reject" key = "%{User-Name}" relaxed = no } # Loading module "attr_filter.access_challenge" from file /etc/raddb/mods-enabled/attr_filter attr_filter attr_filter.access_challenge { filename = "/etc/raddb/mods-config/attr_filter/access_challenge" key = "%{User-Name}" relaxed = no } # Loading module "attr_filter.accounting_response" from file /etc/raddb/mods-enabled/attr_filter attr_filter attr_filter.accounting_response { filename = "/etc/raddb/mods-config/attr_filter/accounting_response" key = "%{User-Name}" relaxed = no } # Loaded module rlm_cache # Loading module "cache_eap" from file /etc/raddb/mods-enabled/cache_eap cache cache_eap { driver = "rlm_cache_rbtree" key = "%{%{control:State}:-%{%{reply:State}:-%{State}}}" ttl = 15 max_entries = 0 epoch = 0 add_stats = no } # Loaded module rlm_chap # Loading module "chap" from file /etc/raddb/mods-enabled/chap # Loaded module rlm_date # Loading module "date" from file /etc/raddb/mods-enabled/date date { format = "%b %e %Y %H:%M:%S %Z" } # Loaded module rlm_detail # Loading module "detail" from file /etc/raddb/mods-enabled/detail detail { filename = "/var/log/radius/radacct/%{%{Packet-Src-IP-Address}:-%{Packet-Src-IPv6-Address}}/detail-%Y%m%d" header = "%t" permissions = 384 locking = no escape_filenames = no log_packet_header = no } # Loading module "auth_log" from file /etc/raddb/mods-enabled/detail.log detail auth_log { filename = "/var/log/radius/radacct/%{%{Packet-Src-IP-Address}:-%{Packet-Src-IPv6-Address}}/auth-detail-%Y%m%d" header = "%t" permissions = 384 locking = no escape_filenames = no log_packet_header = no } # Loading module "reply_log" from file /etc/raddb/mods-enabled/detail.log detail reply_log { filename = "/var/log/radius/radacct/%{%{Packet-Src-IP-Address}:-%{Packet-Src-IPv6-Address}}/reply-detail-%Y%m%d" header = "%t" permissions = 384 locking = no escape_filenames = no log_packet_header = no } # Loading module "pre_proxy_log" from file /etc/raddb/mods-enabled/detail.log detail pre_proxy_log { filename = "/var/log/radius/radacct/%{%{Packet-Src-IP-Address}:-%{Packet-Src-IPv6-Address}}/pre-proxy-detail-%Y%m%d" header = "%t" permissions = 384 locking = no escape_filenames = no log_packet_header = no } # Loading module "post_proxy_log" from file /etc/raddb/mods-enabled/detail.log detail post_proxy_log { filename = "/var/log/radius/radacct/%{%{Packet-Src-IP-Address}:-%{Packet-Src-IPv6-Address}}/post-proxy-detail-%Y%m%d" header = "%t" permissions = 384 locking = no escape_filenames = no log_packet_header = no } # Loaded module rlm_dhcp # Loading module "dhcp" from file /etc/raddb/mods-enabled/dhcp # Loaded module rlm_digest # Loading module "digest" from file /etc/raddb/mods-enabled/digest # Loaded module rlm_dynamic_clients # Loading module "dynamic_clients" from file /etc/raddb/mods-enabled/dynamic_clients # Loaded module rlm_eap # Loading module "eap" from file /etc/raddb/mods-enabled/eap eap { default_eap_type = "md5" timer_expire = 60 ignore_unknown_eap_types = no cisco_accounting_username_bug = no max_sessions = 16384 } # Loaded module rlm_exec # Loading module "echo" from file /etc/raddb/mods-enabled/echo exec echo { wait = yes program = "/bin/echo %{User-Name}" input_pairs = "request" output_pairs = "reply" shell_escape = yes } # Loading module "exec" from file /etc/raddb/mods-enabled/exec exec { wait = no input_pairs = "request" shell_escape = yes timeout = 10 } # Loaded module rlm_expiration # Loading module "expiration" from file /etc/raddb/mods-enabled/expiration # Loaded module rlm_expr # Loading module "expr" from file /etc/raddb/mods-enabled/expr expr { safe_characters = "@abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ0123456789.-_: /äéöüàâæçèéêëîïôœùûüaÿÄÉÖÜßÀÂÆÇÈÉÊËÎÏÔŒÙÛÜŸ" } # Loaded module rlm_files # Loading module "files" from file /etc/raddb/mods-enabled/files files { filename = "/etc/raddb/mods-config/files/authorize" acctusersfile = "/etc/raddb/mods-config/files/accounting" preproxy_usersfile = "/etc/raddb/mods-config/files/pre-proxy" } # Loaded module rlm_linelog # Loading module "linelog" from file /etc/raddb/mods-enabled/linelog linelog { filename = "/var/log/radius/linelog" escape_filenames = no syslog_severity = "info" permissions = 384 format = "This is a log message for %{User-Name}" reference = "messages.%{%{reply:Packet-Type}:-default}" } # Loading module "log_accounting" from file /etc/raddb/mods-enabled/linelog linelog log_accounting { filename = "/var/log/radius/linelog-accounting" escape_filenames = no syslog_severity = "info" permissions = 384 format = "" reference = "Accounting-Request.%{%{Acct-Status-Type}:-unknown}" } # Loaded module rlm_logintime # Loading module "logintime" from file /etc/raddb/mods-enabled/logintime logintime { minimum_timeout = 60 } # Loaded module rlm_mschap # Loading module "mschap" from file /etc/raddb/mods-enabled/mschap mschap { use_mppe = yes require_encryption = no require_strong = no with_ntdomain_hack = yes passchange { } allow_retry = yes winbind_retry_with_normalised_username = no } # Loading module "ntlm_auth" from file /etc/raddb/mods-enabled/ntlm_auth exec ntlm_auth { wait = yes program = "/path/to/ntlm_auth --request-nt-key --domain=MYDOMAIN --username=%{mschap:User-Name} --password=%{User-Password}" shell_escape = yes } # Loaded module rlm_pap # Loading module "pap" from file /etc/raddb/mods-enabled/pap pap { normalise = yes } # Loaded module rlm_passwd # Loading module "etc_passwd" from file /etc/raddb/mods-enabled/passwd passwd etc_passwd { filename = "/etc/passwd" format = "*User-Name:Crypt-Password:" delimiter = ":" ignore_nislike = no ignore_empty = yes allow_multiple_keys = no hash_size = 100 } # Loaded module rlm_preprocess # Loading module "preprocess" from file /etc/raddb/mods-enabled/preprocess preprocess { huntgroups = "/etc/raddb/mods-config/preprocess/huntgroups" hints = "/etc/raddb/mods-config/preprocess/hints" with_ascend_hack = no ascend_channels_per_line = 23 with_ntdomain_hack = no with_specialix_jetstream_hack = no with_cisco_vsa_hack = no with_alvarion_vsa_hack = no } # Loaded module rlm_radutmp # Loading module "radutmp" from file /etc/raddb/mods-enabled/radutmp radutmp { filename = "/var/log/radius/radutmp" username = "%{User-Name}" case_sensitive = yes check_with_nas = yes permissions = 384 caller_id = yes } # Loaded module rlm_realm # Loading module "IPASS" from file /etc/raddb/mods-enabled/realm realm IPASS { format = "prefix" delimiter = "/" ignore_default = no ignore_null = no } # Loading module "suffix" from file /etc/raddb/mods-enabled/realm realm suffix { format = "suffix" delimiter = "@" ignore_default = no ignore_null = no } # Loading module "realmpercent" from file /etc/raddb/mods-enabled/realm realm realmpercent { format = "suffix" delimiter = "%" ignore_default = no ignore_null = no } # Loading module "ntdomain" from file /etc/raddb/mods-enabled/realm realm ntdomain { format = "prefix" delimiter = "\\" ignore_default = no ignore_null = no } # Loaded module rlm_replicate # Loading module "replicate" from file /etc/raddb/mods-enabled/replicate # Loaded module rlm_soh # Loading module "soh" from file /etc/raddb/mods-enabled/soh soh { dhcp = yes } # Loading module "sradutmp" from file /etc/raddb/mods-enabled/sradutmp radutmp sradutmp { filename = "/var/log/radius/sradutmp" username = "%{User-Name}" case_sensitive = yes check_with_nas = yes permissions = 420 caller_id = no } # Loaded module rlm_unix # Loading module "unix" from file /etc/raddb/mods-enabled/unix unix { radwtmp = "/var/log/radius/radwtmp" } Creating attribute Unix-Group # Loaded module rlm_unpack # Loading module "unpack" from file /etc/raddb/mods-enabled/unpack # Loaded module rlm_utf8 # Loading module "utf8" from file /etc/raddb/mods-enabled/utf8 # Loaded module rlm_sql # Loading module "sql" from file /etc/raddb/mods-enabled/sql sql { driver = "rlm_sql_mysql" server = "localhost" port = 3306 login = "radius" password = <<< secret >>> radius_db = "radius" read_groups = yes read_profiles = yes read_clients = no delete_stale_sessions = yes sql_user_name = "%{User-Name}" default_user_profile = "" client_query = "SELECT id, nasname, shortname, type, secret, server FROM nas" authorize_check_query = "SELECT id, username, attribute, value, op FROM radcheck WHERE username = '%{SQL-User-Name}' ORDER BY id" authorize_reply_query = "SELECT id, username, attribute, value, op FROM radreply WHERE username = '%{SQL-User-Name}' ORDER BY id" authorize_group_check_query = "SELECT id, groupname, attribute, Value, op FROM radgroupcheck WHERE groupname = '%{SQL-Group}' ORDER BY id" authorize_group_reply_query = "SELECT id, groupname, attribute, value, op FROM radgroupreply WHERE groupname = '%{SQL-Group}' ORDER BY id" group_membership_query = "SELECT groupname FROM radusergroup WHERE username = '%{SQL-User-Name}' ORDER BY priority" simul_count_query = "SELECT COUNT(*) FROM radacct WHERE username = '%{SQL-User-Name}' AND acctstoptime IS NULL" simul_verify_query = "SELECT radacctid, acctsessionid, username, nasipaddress, nasportid, framedipaddress, callingstationid, framedprotocol FROM radacct WHERE username = '%{SQL-User-Name}' AND acctstoptime IS NULL" safe_characters = "@abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ0123456789.-_: /" accounting { reference = "%{tolower:type.%{Acct-Status-Type}.query}" type { accounting-on { query = "UPDATE radacct SET acctstoptime = FROM_UNIXTIME(%{integer:Event-Timestamp}), acctsessiontime = '%{integer:Event-Timestamp}' - UNIX_TIMESTAMP(acctstarttime), acctterminatecause = '%{%{Acct-Terminate-Cause}:-NAS-Reboot}' WHERE acctstoptime IS NULL AND nasipaddress = '%{NAS-IP-Address}' AND acctstarttime <= FROM_UNIXTIME(%{integer:Event-Timestamp})" } accounting-off { query = "UPDATE radacct SET acctstoptime = FROM_UNIXTIME(%{integer:Event-Timestamp}), acctsessiontime = '%{integer:Event-Timestamp}' - UNIX_TIMESTAMP(acctstarttime), acctterminatecause = '%{%{Acct-Terminate-Cause}:-NAS-Reboot}' WHERE acctstoptime IS NULL AND nasipaddress = '%{NAS-IP-Address}' AND acctstarttime <= FROM_UNIXTIME(%{integer:Event-Timestamp})" } start { query = "INSERT INTO radacct (acctsessionid, acctuniqueid, username, realm, nasipaddress, nasportid, nasporttype, acctstarttime, acctupdatetime, acctstoptime, acctsessiontime, acctauthentic, connectinfo_start, connectinfo_stop, acctinputoctets, acctoutputoctets, calledstationid, callingstationid, acctterminatecause, servicetype, framedprotocol, framedipaddress) VALUES ('%{Acct-Session-Id}', '%{Acct-Unique-Session-Id}', '%{SQL-User-Name}', '%{Realm}', '%{NAS-IP-Address}', '%{%{NAS-Port-ID}:-%{NAS-Port}}', '%{NAS-Port-Type}', FROM_UNIXTIME(%{integer:Event-Timestamp}), FROM_UNIXTIME(%{integer:Event-Timestamp}), NULL, '0', '%{Acct-Authentic}', '%{Connect-Info}', '', '0', '0', '%{Called-Station-Id}', '%{Calling-Station-Id}', '', '%{Service-Type}', '%{Framed-Protocol}', '%{Framed-IP-Address}')" } interim-update { query = "UPDATE radacct SET acctupdatetime = (@acctupdatetime_old:=acctupdatetime), acctupdatetime = FROM_UNIXTIME(%{integer:Event-Timestamp}), acctinterval = %{integer:Event-Timestamp} - UNIX_TIMESTAMP(@acctupdatetime_old), framedipaddress = '%{Framed-IP-Address}', acctsessiontime = %{%{Acct-Session-Time}:-NULL}, acctinputoctets = '%{%{Acct-Input-Gigawords}:-0}' << 32 | '%{%{Acct-Input-Octets}:-0}', acctoutputoctets = '%{%{Acct-Output-Gigawords}:-0}' << 32 | '%{%{Acct-Output-Octets}:-0}' WHERE AcctUniqueId = '%{Acct-Unique-Session-Id}'" } stop { query = "UPDATE radacct SET acctstoptime = FROM_UNIXTIME(%{integer:Event-Timestamp}), acctsessiontime = %{%{Acct-Session-Time}:-NULL}, acctinputoctets = '%{%{Acct-Input-Gigawords}:-0}' << 32 | '%{%{Acct-Input-Octets}:-0}', acctoutputoctets = '%{%{Acct-Output-Gigawords}:-0}' << 32 | '%{%{Acct-Output-Octets}:-0}', acctterminatecause = '%{Acct-Terminate-Cause}', connectinfo_stop = '%{Connect-Info}' WHERE AcctUniqueId = '%{Acct-Unique-Session-Id}'" } } } post-auth { reference = ".query" query = "INSERT INTO radpostauth (username, pass, reply, authdate) VALUES ( '%{SQL-User-Name}', '%{%{User-Password}:-%{Chap-Password}}', '%{reply:Packet-Type}', '%S')" } } rlm_sql (sql): Driver rlm_sql_mysql (module rlm_sql_mysql) loaded and linked Creating attribute SQL-Group instantiate { } # Instantiating module "reject" from file /etc/raddb/mods-enabled/always # Instantiating module "fail" from file /etc/raddb/mods-enabled/always # Instantiating module "ok" from file /etc/raddb/mods-enabled/always # Instantiating module "handled" from file /etc/raddb/mods-enabled/always # Instantiating module "invalid" from file /etc/raddb/mods-enabled/always # Instantiating module "userlock" from file /etc/raddb/mods-enabled/always # Instantiating module "notfound" from file /etc/raddb/mods-enabled/always # Instantiating module "noop" from file /etc/raddb/mods-enabled/always # Instantiating module "updated" from file /etc/raddb/mods-enabled/always # Instantiating module "attr_filter.post-proxy" from file /etc/raddb/mods-enabled/attr_filter reading pairlist file /etc/raddb/mods-config/attr_filter/post-proxy # Instantiating module "attr_filter.pre-proxy" from file /etc/raddb/mods-enabled/attr_filter reading pairlist file /etc/raddb/mods-config/attr_filter/pre-proxy # Instantiating module "attr_filter.access_reject" from file /etc/raddb/mods-enabled/attr_filter reading pairlist file /etc/raddb/mods-config/attr_filter/access_reject [/etc/raddb/mods-config/attr_filter/access_reject]:11 Check item "FreeRADIUS-Response-Delay" found in filter list for realm "DEFAULT". [/etc/raddb/mods-config/attr_filter/access_reject]:11 Check item "FreeRADIUS-Response-Delay-USec" found in filter list for realm "DEFAULT". # Instantiating module "attr_filter.access_challenge" from file /etc/raddb/mods-enabled/attr_filter reading pairlist file /etc/raddb/mods-config/attr_filter/access_challenge # Instantiating module "attr_filter.accounting_response" from file /etc/raddb/mods-enabled/attr_filter reading pairlist file /etc/raddb/mods-config/attr_filter/accounting_response # Instantiating module "cache_eap" from file /etc/raddb/mods-enabled/cache_eap rlm_cache (cache_eap): Driver rlm_cache_rbtree (module rlm_cache_rbtree) loaded and linked # Instantiating module "detail" from file /etc/raddb/mods-enabled/detail # Instantiating module "auth_log" from file /etc/raddb/mods-enabled/detail.log rlm_detail (auth_log): 'User-Password' suppressed, will not appear in detail output # Instantiating module "reply_log" from file /etc/raddb/mods-enabled/detail.log # Instantiating module "pre_proxy_log" from file /etc/raddb/mods-enabled/detail.log # Instantiating module "post_proxy_log" from file /etc/raddb/mods-enabled/detail.log # Instantiating module "eap" from file /etc/raddb/mods-enabled/eap # Linked to sub-module rlm_eap_md5 # Linked to sub-module rlm_eap_leap # Linked to sub-module rlm_eap_gtc gtc { challenge = "Password: " auth_type = "PAP" } # Linked to sub-module rlm_eap_tls tls { tls = "tls-common" } tls-config tls-common { verify_depth = 0 ca_path = "/etc/raddb/certs" pem_file_type = yes private_key_file = "/etc/raddb/certs/server.pem" certificate_file = "/etc/raddb/certs/server.pem" ca_file = "/etc/raddb/certs/ca.pem" private_key_password = <<< secret >>> dh_file = "/etc/raddb/certs/dh" fragment_size = 1024 include_length = yes auto_chain = yes check_crl = no check_all_crl = no cipher_list = "DEFAULT" cipher_server_preference = no ecdh_curve = "prime256v1" cache { enable = no lifetime = 24 max_entries = 255 } verify { skip_if_ocsp_ok = no } ocsp { enable = no override_cert_url = yes url = "http://127.0.0.1/ocsp/" use_nonce = yes timeout = 0 softfail = no } } # Linked to sub-module rlm_eap_ttls ttls { tls = "tls-common" default_eap_type = "md5" copy_request_to_tunnel = no use_tunneled_reply = no virtual_server = "inner-tunnel" include_length = yes require_client_cert = no } tls: Using cached TLS configuration from previous invocation # Linked to sub-module rlm_eap_peap peap { tls = "tls-common" default_eap_type = "mschapv2" copy_request_to_tunnel = no use_tunneled_reply = no proxy_tunneled_request_as_eap = yes virtual_server = "inner-tunnel" soh = no require_client_cert = no } tls: Using cached TLS configuration from previous invocation # Linked to sub-module rlm_eap_mschapv2 mschapv2 { with_ntdomain_hack = no send_error = no } # Instantiating module "expiration" from file /etc/raddb/mods-enabled/expiration # Instantiating module "files" from file /etc/raddb/mods-enabled/files reading pairlist file /etc/raddb/mods-config/files/authorize reading pairlist file /etc/raddb/mods-config/files/accounting reading pairlist file /etc/raddb/mods-config/files/pre-proxy # Instantiating module "linelog" from file /etc/raddb/mods-enabled/linelog # Instantiating module "log_accounting" from file /etc/raddb/mods-enabled/linelog # Instantiating module "logintime" from file /etc/raddb/mods-enabled/logintime # Instantiating module "mschap" from file /etc/raddb/mods-enabled/mschap rlm_mschap (mschap): using internal authentication # Instantiating module "pap" from file /etc/raddb/mods-enabled/pap # Instantiating module "etc_passwd" from file /etc/raddb/mods-enabled/passwd rlm_passwd: nfields: 3 keyfield 0(User-Name) listable: no # Instantiating module "preprocess" from file /etc/raddb/mods-enabled/preprocess reading pairlist file /etc/raddb/mods-config/preprocess/huntgroups reading pairlist file /etc/raddb/mods-config/preprocess/hints # Instantiating module "IPASS" from file /etc/raddb/mods-enabled/realm # Instantiating module "suffix" from file /etc/raddb/mods-enabled/realm # Instantiating module "realmpercent" from file /etc/raddb/mods-enabled/realm # Instantiating module "ntdomain" from file /etc/raddb/mods-enabled/realm # Instantiating module "sql" from file /etc/raddb/mods-enabled/sql rlm_sql_mysql: libmysql version: 5.5.60-MariaDB mysql { tls { } warnings = "auto" } rlm_sql (sql): Attempting to connect to database "radius" rlm_sql (sql): Initialising connection pool pool { start = 5 min = 3 max = 32 spare = 10 uses = 0 lifetime = 0 cleanup_interval = 30 idle_timeout = 60 retry_delay = 30 spread = no } rlm_sql (sql): Opening additional connection (0), 1 of 32 pending slots used rlm_sql_mysql: Starting connect to MySQL server rlm_sql_mysql: Connected to database 'radius' on Localhost via UNIX socket, server version 5.5.60-MariaDB, protocol version 10 rlm_sql (sql): Opening additional connection (1), 1 of 31 pending slots used rlm_sql_mysql: Starting connect to MySQL server rlm_sql_mysql: Connected to database 'radius' on Localhost via UNIX socket, server version 5.5.60-MariaDB, protocol version 10 rlm_sql (sql): Opening additional connection (2), 1 of 30 pending slots used rlm_sql_mysql: Starting connect to MySQL server rlm_sql_mysql: Connected to database 'radius' on Localhost via UNIX socket, server version 5.5.60-MariaDB, protocol version 10 rlm_sql (sql): Opening additional connection (3), 1 of 29 pending slots used rlm_sql_mysql: Starting connect to MySQL server rlm_sql_mysql: Connected to database 'radius' on Localhost via UNIX socket, server version 5.5.60-MariaDB, protocol version 10 rlm_sql (sql): Opening additional connection (4), 1 of 28 pending slots used rlm_sql_mysql: Starting connect to MySQL server rlm_sql_mysql: Connected to database 'radius' on Localhost via UNIX socket, server version 5.5.60-MariaDB, protocol version 10 } # modules radiusd: #### Loading Virtual Servers #### server { # from file /etc/raddb/radiusd.conf } # server server default { # from file /etc/raddb/sites-enabled/default # Loading authenticate {...} # Loading authorize {...} # Loading preacct {...} # Loading accounting {...} # Loading session {...} # Loading post-proxy {...} # Loading post-auth {...} } # server default server inner-tunnel { # from file /etc/raddb/sites-enabled/inner-tunnel # Loading authenticate {...} # Loading authorize {...} # Loading session {...} # Loading post-proxy {...} # Loading post-auth {...} # Skipping contents of 'if' as it is always 'false' -- /etc/raddb/sites-enabled/inner-tunnel:330 } # server inner-tunnel server dynamic_clients { # from file /etc/raddb/sites-enabled/dynamic-clients # Loading authorize {...} } # server dynamic_clients radiusd: #### Opening IP addresses and Ports #### listen { type = "auth" ipaddr = * port = 0 limit { max_connections = 16 lifetime = 0 idle_timeout = 30 } } listen { type = "acct" ipaddr = * port = 0 limit { max_connections = 16 lifetime = 0 idle_timeout = 30 } } listen { type = "auth" ipv6addr = :: port = 0 limit { max_connections = 16 lifetime = 0 idle_timeout = 30 } } listen { type = "acct" ipv6addr = :: port = 0 limit { max_connections = 16 lifetime = 0 idle_timeout = 30 } } listen { type = "auth" ipaddr = 127.0.0.1 port = 18120 } Listening on auth address * port 1812 bound to server default Listening on acct address * port 1813 bound to server default Listening on auth address :: port 1812 bound to server default Listening on acct address :: port 1813 bound to server default Listening on auth address 127.0.0.1 port 18120 bound to server inner-tunnel Listening on proxy address * port 39011 Listening on proxy address :: port 49988 Ready to process requests (0) server dynamic_clients { (0) # Executing section authorize from file /etc/raddb/sites-enabled/dynamic-clients (0) authorize { (0) dynamic_clients: Improper configuration (0) [dynamic_clients] = noop (0) [ok] = ok (0) } # authorize = ok (0) } # server dynamic_clients (0) Converting control list to client fields (0) ERROR: Cannot add client 18.220.171.233: Required attribute "FreeRADIUS-Client-Secret" is missing Ignoring request to auth address * port 1812 bound to server default from unknown client 18.220.171.233 port 60872 proto udp Ready to process requests

2 3