- Freeradius-Users - lists.freeradius.org

Re: Freeradius-Users Digest, Vol 166, Issue 51
by smith john 26 Feb '19

26 Feb '19

Thank you, Alan. > So... the file is empty? No, the file is named 18.220.171.233, under /etc/raddb/dynamic-clients, with the following content: client mynas { ipaddr = 18.220.171.233 secret = testing456 } At https://networkradius.com/doc/3.0.10/raddb/mods-available/dynamic_clients.h…, it first create a dynamic client, then start the server in debugging mode. Shouldn't it first start the server in debugging mode, then open another shell and create the client definition file to test if dynamic client works ? > Hmm... if anything in v2 doesn't work, upgrade to v3. In fact, I first tried FreeRADIUS 3.0.13 on centos 7.6. Because v3.0.13 doesn't work, I guess that v2 may work. In addition, for all the test, I store the users in mysql, but don't store nas clients in mysql. When store nas clients in mysql, dynamic-clients does work. So I test v3.0.13 on centos 7.6 again. This is the steps: 1. link /etc/raddb/sites-enabled/dynamic_clients to /etc/raddb/sites-available/dynamic_clients, and change the ownership of /etc/raddb/sites-enabled/dynamic_clients to root:radiusd 2. Change the content of /etc/raddb/sites-enabled/dynamic_clients to: client dynamic { ipaddr = 0.0.0.0/0 dynamic_clients = dynamic_clients directory = ${confdir}/dynamic-clients/ lifetime = 3600 } server dynamic_clients { authorize { # Example 2: Read the clients from "clients" files dynamic_clients # Tell the caller that the client was defined properly. ok } } 3. Create the /etc/raddb/dynamic-clients directory, change its ownership to root:radiusd 4. Run "setenforce 0' to disable selinux. 5. Start the server in debug mode. 6. Open another shell, create a file named 18.220.171.233 under / etc/raddb/dynamic-clients, with the following content: client mynas { ipaddr = 18.220.171.233 secret = testing456 } I also changed the ownership of 18.220.171.233 to root:radiusd 7. SSH to the nas server at 18.220.171.233, and run the radtest command to test the setup. 8. The debug gives the following result: (0) server dynamic_clients { (0) # Executing section authorize from file /etc/raddb/sites-enabled/dynamic-clients (0) authorize { (0) dynamic_clients: Improper configuration (0) [dynamic_clients] = noop (0) [ok] = ok (0) } # authorize = ok (0) } # server dynamic_clients (0) Converting control list to client fields (0) ERROR: Cannot add client 18.220.171.233: Required attribute "FreeRADIUS-Client-Secret" is missing Ignoring request to auth address * port 1812 bound to server default from unknown client 18.220.171.233 port 41902 proto udp 9. This is the full debug output: FreeRADIUS Version 3.0.13 Copyright (C) 1999-2017 The FreeRADIUS server project and contributors There is NO warranty; not even for MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE You may redistribute copies of FreeRADIUS under the terms of the GNU General Public License For more information about these matters, see the file named COPYRIGHT Starting - reading configuration files ... including dictionary file /usr/share/freeradius/dictionary including dictionary file /usr/share/freeradius/dictionary.dhcp including dictionary file /usr/share/freeradius/dictionary.vqp including dictionary file /etc/raddb/dictionary including configuration file /etc/raddb/radiusd.conf including configuration file /etc/raddb/proxy.conf including configuration file /etc/raddb/clients.conf including files in directory /etc/raddb/mods-enabled/ including configuration file /etc/raddb/mods-enabled/always including configuration file /etc/raddb/mods-enabled/attr_filter including configuration file /etc/raddb/mods-enabled/cache_eap including configuration file /etc/raddb/mods-enabled/chap including configuration file /etc/raddb/mods-enabled/date including configuration file /etc/raddb/mods-enabled/detail including configuration file /etc/raddb/mods-enabled/detail.log including configuration file /etc/raddb/mods-enabled/dhcp including configuration file /etc/raddb/mods-enabled/digest including configuration file /etc/raddb/mods-enabled/dynamic_clients including configuration file /etc/raddb/mods-enabled/eap including configuration file /etc/raddb/mods-enabled/echo including configuration file /etc/raddb/mods-enabled/exec including configuration file /etc/raddb/mods-enabled/expiration including configuration file /etc/raddb/mods-enabled/expr including configuration file /etc/raddb/mods-enabled/files including configuration file /etc/raddb/mods-enabled/linelog including configuration file /etc/raddb/mods-enabled/logintime including configuration file /etc/raddb/mods-enabled/mschap including configuration file /etc/raddb/mods-enabled/ntlm_auth including configuration file /etc/raddb/mods-enabled/pap including configuration file /etc/raddb/mods-enabled/passwd including configuration file /etc/raddb/mods-enabled/preprocess including configuration file /etc/raddb/mods-enabled/radutmp including configuration file /etc/raddb/mods-enabled/realm including configuration file /etc/raddb/mods-enabled/replicate including configuration file /etc/raddb/mods-enabled/soh including configuration file /etc/raddb/mods-enabled/sradutmp including configuration file /etc/raddb/mods-enabled/unix including configuration file /etc/raddb/mods-enabled/unpack including configuration file /etc/raddb/mods-enabled/utf8 including configuration file /etc/raddb/mods-enabled/sql including configuration file /etc/raddb/mods-config/sql/main/mysql/queries.conf including files in directory /etc/raddb/policy.d/ including configuration file /etc/raddb/policy.d/accounting including configuration file /etc/raddb/policy.d/canonicalization including configuration file /etc/raddb/policy.d/control including configuration file /etc/raddb/policy.d/cui including configuration file /etc/raddb/policy.d/debug including configuration file /etc/raddb/policy.d/dhcp including configuration file /etc/raddb/policy.d/eap including configuration file /etc/raddb/policy.d/filter including configuration file /etc/raddb/policy.d/operator-name including files in directory /etc/raddb/sites-enabled/ including configuration file /etc/raddb/sites-enabled/default including configuration file /etc/raddb/sites-enabled/inner-tunnel including configuration file /etc/raddb/sites-enabled/dynamic-clients main { security { user = "radiusd" group = "radiusd" allow_core_dumps = no } name = "radiusd" prefix = "/usr" localstatedir = "/var" logdir = "/var/log/radius" run_dir = "/var/run/radiusd" } main { name = "radiusd" prefix = "/usr" localstatedir = "/var" sbindir = "/usr/sbin" logdir = "/var/log/radius" run_dir = "/var/run/radiusd" libdir = "/usr/lib64/freeradius" radacctdir = "/var/log/radius/radacct" hostname_lookups = no max_request_time = 30 cleanup_delay = 5 max_requests = 16384 pidfile = "/var/run/radiusd/radiusd.pid" checkrad = "/usr/sbin/checkrad" debug_level = 0 proxy_requests = yes log { stripped_names = no auth = no auth_badpass = no auth_goodpass = no colourise = yes msg_denied = "You are already logged in - access denied" } resources { } security { max_attributes = 200 reject_delay = 1.000000 status_server = yes } } radiusd: #### Loading Realms and Home Servers #### proxy server { retry_delay = 5 retry_count = 3 default_fallback = no dead_time = 120 wake_all_if_all_dead = no } home_server localhost { ipaddr = 127.0.0.1 port = 1812 type = "auth" secret = <<< secret >>> response_window = 20.000000 response_timeouts = 1 max_outstanding = 65536 zombie_period = 40 status_check = "status-server" ping_interval = 30 check_interval = 30 check_timeout = 4 num_answers_to_alive = 3 revive_interval = 120 limit { max_connections = 16 max_requests = 0 lifetime = 0 idle_timeout = 0 } coa { irt = 2 mrt = 16 mrc = 5 mrd = 30 } } home_server_pool my_auth_failover { type = fail-over home_server = localhost } realm example.com { auth_pool = my_auth_failover } realm LOCAL { } radiusd: #### Loading Clients #### client localhost { ipaddr = 127.0.0.1 require_message_authenticator = no secret = <<< secret >>> nas_type = "other" proto = "*" limit { max_connections = 16 lifetime = 0 idle_timeout = 30 } } client localhost_ipv6 { ipv6addr = ::1 require_message_authenticator = no secret = <<< secret >>> limit { max_connections = 16 lifetime = 0 idle_timeout = 30 } } client dynamic { ipaddr = 0.0.0.0/0 require_message_authenticator = no limit { max_connections = 16 lifetime = 0 idle_timeout = 30 } dynamic_clients = "dynamic_clients" lifetime = 3600 } including dynamic clients in /etc/raddb/dynamic-clients/ Debugger not attached # Creating Auth-Type = mschap # Creating Auth-Type = digest # Creating Auth-Type = eap # Creating Auth-Type = PAP # Creating Auth-Type = CHAP # Creating Auth-Type = MS-CHAP radiusd: #### Instantiating modules #### modules { # Loaded module rlm_always # Loading module "reject" from file /etc/raddb/mods-enabled/always always reject { rcode = "reject" simulcount = 0 mpp = no } # Loading module "fail" from file /etc/raddb/mods-enabled/always always fail { rcode = "fail" simulcount = 0 mpp = no } # Loading module "ok" from file /etc/raddb/mods-enabled/always always ok { rcode = "ok" simulcount = 0 mpp = no } # Loading module "handled" from file /etc/raddb/mods-enabled/always always handled { rcode = "handled" simulcount = 0 mpp = no } # Loading module "invalid" from file /etc/raddb/mods-enabled/always always invalid { rcode = "invalid" simulcount = 0 mpp = no } # Loading module "userlock" from file /etc/raddb/mods-enabled/always always userlock { rcode = "userlock" simulcount = 0 mpp = no } # Loading module "notfound" from file /etc/raddb/mods-enabled/always always notfound { rcode = "notfound" simulcount = 0 mpp = no } # Loading module "noop" from file /etc/raddb/mods-enabled/always always noop { rcode = "noop" simulcount = 0 mpp = no } # Loading module "updated" from file /etc/raddb/mods-enabled/always always updated { rcode = "updated" simulcount = 0 mpp = no } # Loaded module rlm_attr_filter # Loading module "attr_filter.post-proxy" from file /etc/raddb/mods-enabled/attr_filter attr_filter attr_filter.post-proxy { filename = "/etc/raddb/mods-config/attr_filter/post-proxy" key = "%{Realm}" relaxed = no } # Loading module "attr_filter.pre-proxy" from file /etc/raddb/mods-enabled/attr_filter attr_filter attr_filter.pre-proxy { filename = "/etc/raddb/mods-config/attr_filter/pre-proxy" key = "%{Realm}" relaxed = no } # Loading module "attr_filter.access_reject" from file /etc/raddb/mods-enabled/attr_filter attr_filter attr_filter.access_reject { filename = "/etc/raddb/mods-config/attr_filter/access_reject" key = "%{User-Name}" relaxed = no } # Loading module "attr_filter.access_challenge" from file /etc/raddb/mods-enabled/attr_filter attr_filter attr_filter.access_challenge { filename = "/etc/raddb/mods-config/attr_filter/access_challenge" key = "%{User-Name}" relaxed = no } # Loading module "attr_filter.accounting_response" from file /etc/raddb/mods-enabled/attr_filter attr_filter attr_filter.accounting_response { filename = "/etc/raddb/mods-config/attr_filter/accounting_response" key = "%{User-Name}" relaxed = no } # Loaded module rlm_cache # Loading module "cache_eap" from file /etc/raddb/mods-enabled/cache_eap cache cache_eap { driver = "rlm_cache_rbtree" key = "%{%{control:State}:-%{%{reply:State}:-%{State}}}" ttl = 15 max_entries = 0 epoch = 0 add_stats = no } # Loaded module rlm_chap # Loading module "chap" from file /etc/raddb/mods-enabled/chap # Loaded module rlm_date # Loading module "date" from file /etc/raddb/mods-enabled/date date { format = "%b %e %Y %H:%M:%S %Z" } # Loaded module rlm_detail # Loading module "detail" from file /etc/raddb/mods-enabled/detail detail { filename = "/var/log/radius/radacct/%{%{Packet-Src-IP-Address}:-%{Packet-Src-IPv6-Address}}/detail-%Y%m%d" header = "%t" permissions = 384 locking = no escape_filenames = no log_packet_header = no } # Loading module "auth_log" from file /etc/raddb/mods-enabled/detail.log detail auth_log { filename = "/var/log/radius/radacct/%{%{Packet-Src-IP-Address}:-%{Packet-Src-IPv6-Address}}/auth-detail-%Y%m%d" header = "%t" permissions = 384 locking = no escape_filenames = no log_packet_header = no } # Loading module "reply_log" from file /etc/raddb/mods-enabled/detail.log detail reply_log { filename = "/var/log/radius/radacct/%{%{Packet-Src-IP-Address}:-%{Packet-Src-IPv6-Address}}/reply-detail-%Y%m%d" header = "%t" permissions = 384 locking = no escape_filenames = no log_packet_header = no } # Loading module "pre_proxy_log" from file /etc/raddb/mods-enabled/detail.log detail pre_proxy_log { filename = "/var/log/radius/radacct/%{%{Packet-Src-IP-Address}:-%{Packet-Src-IPv6-Address}}/pre-proxy-detail-%Y%m%d" header = "%t" permissions = 384 locking = no escape_filenames = no log_packet_header = no } # Loading module "post_proxy_log" from file /etc/raddb/mods-enabled/detail.log detail post_proxy_log { filename = "/var/log/radius/radacct/%{%{Packet-Src-IP-Address}:-%{Packet-Src-IPv6-Address}}/post-proxy-detail-%Y%m%d" header = "%t" permissions = 384 locking = no escape_filenames = no log_packet_header = no } # Loaded module rlm_dhcp # Loading module "dhcp" from file /etc/raddb/mods-enabled/dhcp # Loaded module rlm_digest # Loading module "digest" from file /etc/raddb/mods-enabled/digest # Loaded module rlm_dynamic_clients # Loading module "dynamic_clients" from file /etc/raddb/mods-enabled/dynamic_clients # Loaded module rlm_eap # Loading module "eap" from file /etc/raddb/mods-enabled/eap eap { default_eap_type = "md5" timer_expire = 60 ignore_unknown_eap_types = no cisco_accounting_username_bug = no max_sessions = 16384 } # Loaded module rlm_exec # Loading module "echo" from file /etc/raddb/mods-enabled/echo exec echo { wait = yes program = "/bin/echo %{User-Name}" input_pairs = "request" output_pairs = "reply" shell_escape = yes } # Loading module "exec" from file /etc/raddb/mods-enabled/exec exec { wait = no input_pairs = "request" shell_escape = yes timeout = 10 } # Loaded module rlm_expiration # Loading module "expiration" from file /etc/raddb/mods-enabled/expiration # Loaded module rlm_expr # Loading module "expr" from file /etc/raddb/mods-enabled/expr expr { safe_characters = "@abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ0123456789.-_: /äéöüàâæçèéêëîïôœùûüaÿÄÉÖÜßÀÂÆÇÈÉÊËÎÏÔŒÙÛÜŸ" } # Loaded module rlm_files # Loading module "files" from file /etc/raddb/mods-enabled/files files { filename = "/etc/raddb/mods-config/files/authorize" acctusersfile = "/etc/raddb/mods-config/files/accounting" preproxy_usersfile = "/etc/raddb/mods-config/files/pre-proxy" } # Loaded module rlm_linelog # Loading module "linelog" from file /etc/raddb/mods-enabled/linelog linelog { filename = "/var/log/radius/linelog" escape_filenames = no syslog_severity = "info" permissions = 384 format = "This is a log message for %{User-Name}" reference = "messages.%{%{reply:Packet-Type}:-default}" } # Loading module "log_accounting" from file /etc/raddb/mods-enabled/linelog linelog log_accounting { filename = "/var/log/radius/linelog-accounting" escape_filenames = no syslog_severity = "info" permissions = 384 format = "" reference = "Accounting-Request.%{%{Acct-Status-Type}:-unknown}" } # Loaded module rlm_logintime # Loading module "logintime" from file /etc/raddb/mods-enabled/logintime logintime { minimum_timeout = 60 } # Loaded module rlm_mschap # Loading module "mschap" from file /etc/raddb/mods-enabled/mschap mschap { use_mppe = yes require_encryption = no require_strong = no with_ntdomain_hack = yes passchange { } allow_retry = yes winbind_retry_with_normalised_username = no } # Loading module "ntlm_auth" from file /etc/raddb/mods-enabled/ntlm_auth exec ntlm_auth { wait = yes program = "/path/to/ntlm_auth --request-nt-key --domain=MYDOMAIN --username=%{mschap:User-Name} --password=%{User-Password}" shell_escape = yes } # Loaded module rlm_pap # Loading module "pap" from file /etc/raddb/mods-enabled/pap pap { normalise = yes } # Loaded module rlm_passwd # Loading module "etc_passwd" from file /etc/raddb/mods-enabled/passwd passwd etc_passwd { filename = "/etc/passwd" format = "*User-Name:Crypt-Password:" delimiter = ":" ignore_nislike = no ignore_empty = yes allow_multiple_keys = no hash_size = 100 } # Loaded module rlm_preprocess # Loading module "preprocess" from file /etc/raddb/mods-enabled/preprocess preprocess { huntgroups = "/etc/raddb/mods-config/preprocess/huntgroups" hints = "/etc/raddb/mods-config/preprocess/hints" with_ascend_hack = no ascend_channels_per_line = 23 with_ntdomain_hack = no with_specialix_jetstream_hack = no with_cisco_vsa_hack = no with_alvarion_vsa_hack = no } # Loaded module rlm_radutmp # Loading module "radutmp" from file /etc/raddb/mods-enabled/radutmp radutmp { filename = "/var/log/radius/radutmp" username = "%{User-Name}" case_sensitive = yes check_with_nas = yes permissions = 384 caller_id = yes } # Loaded module rlm_realm # Loading module "IPASS" from file /etc/raddb/mods-enabled/realm realm IPASS { format = "prefix" delimiter = "/" ignore_default = no ignore_null = no } # Loading module "suffix" from file /etc/raddb/mods-enabled/realm realm suffix { format = "suffix" delimiter = "@" ignore_default = no ignore_null = no } # Loading module "realmpercent" from file /etc/raddb/mods-enabled/realm realm realmpercent { format = "suffix" delimiter = "%" ignore_default = no ignore_null = no } # Loading module "ntdomain" from file /etc/raddb/mods-enabled/realm realm ntdomain { format = "prefix" delimiter = "\\" ignore_default = no ignore_null = no } # Loaded module rlm_replicate # Loading module "replicate" from file /etc/raddb/mods-enabled/replicate # Loaded module rlm_soh # Loading module "soh" from file /etc/raddb/mods-enabled/soh soh { dhcp = yes } # Loading module "sradutmp" from file /etc/raddb/mods-enabled/sradutmp radutmp sradutmp { filename = "/var/log/radius/sradutmp" username = "%{User-Name}" case_sensitive = yes check_with_nas = yes permissions = 420 caller_id = no } # Loaded module rlm_unix # Loading module "unix" from file /etc/raddb/mods-enabled/unix unix { radwtmp = "/var/log/radius/radwtmp" } Creating attribute Unix-Group # Loaded module rlm_unpack # Loading module "unpack" from file /etc/raddb/mods-enabled/unpack # Loaded module rlm_utf8 # Loading module "utf8" from file /etc/raddb/mods-enabled/utf8 # Loaded module rlm_sql # Loading module "sql" from file /etc/raddb/mods-enabled/sql sql { driver = "rlm_sql_mysql" server = "localhost" port = 3306 login = "radius" password = <<< secret >>> radius_db = "radius" read_groups = yes read_profiles = yes read_clients = no delete_stale_sessions = yes sql_user_name = "%{User-Name}" default_user_profile = "" client_query = "SELECT id, nasname, shortname, type, secret, server FROM nas" authorize_check_query = "SELECT id, username, attribute, value, op FROM radcheck WHERE username = '%{SQL-User-Name}' ORDER BY id" authorize_reply_query = "SELECT id, username, attribute, value, op FROM radreply WHERE username = '%{SQL-User-Name}' ORDER BY id" authorize_group_check_query = "SELECT id, groupname, attribute, Value, op FROM radgroupcheck WHERE groupname = '%{SQL-Group}' ORDER BY id" authorize_group_reply_query = "SELECT id, groupname, attribute, value, op FROM radgroupreply WHERE groupname = '%{SQL-Group}' ORDER BY id" group_membership_query = "SELECT groupname FROM radusergroup WHERE username = '%{SQL-User-Name}' ORDER BY priority" simul_count_query = "SELECT COUNT(*) FROM radacct WHERE username = '%{SQL-User-Name}' AND acctstoptime IS NULL" simul_verify_query = "SELECT radacctid, acctsessionid, username, nasipaddress, nasportid, framedipaddress, callingstationid, framedprotocol FROM radacct WHERE username = '%{SQL-User-Name}' AND acctstoptime IS NULL" safe_characters = "@abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ0123456789.-_: /" accounting { reference = "%{tolower:type.%{Acct-Status-Type}.query}" type { accounting-on { query = "UPDATE radacct SET acctstoptime = FROM_UNIXTIME(%{integer:Event-Timestamp}), acctsessiontime = '%{integer:Event-Timestamp}' - UNIX_TIMESTAMP(acctstarttime), acctterminatecause = '%{%{Acct-Terminate-Cause}:-NAS-Reboot}' WHERE acctstoptime IS NULL AND nasipaddress = '%{NAS-IP-Address}' AND acctstarttime <= FROM_UNIXTIME(%{integer:Event-Timestamp})" } accounting-off { query = "UPDATE radacct SET acctstoptime = FROM_UNIXTIME(%{integer:Event-Timestamp}), acctsessiontime = '%{integer:Event-Timestamp}' - UNIX_TIMESTAMP(acctstarttime), acctterminatecause = '%{%{Acct-Terminate-Cause}:-NAS-Reboot}' WHERE acctstoptime IS NULL AND nasipaddress = '%{NAS-IP-Address}' AND acctstarttime <= FROM_UNIXTIME(%{integer:Event-Timestamp})" } start { query = "INSERT INTO radacct (acctsessionid, acctuniqueid, username, realm, nasipaddress, nasportid, nasporttype, acctstarttime, acctupdatetime, acctstoptime, acctsessiontime, acctauthentic, connectinfo_start, connectinfo_stop, acctinputoctets, acctoutputoctets, calledstationid, callingstationid, acctterminatecause, servicetype, framedprotocol, framedipaddress) VALUES ('%{Acct-Session-Id}', '%{Acct-Unique-Session-Id}', '%{SQL-User-Name}', '%{Realm}', '%{NAS-IP-Address}', '%{%{NAS-Port-ID}:-%{NAS-Port}}', '%{NAS-Port-Type}', FROM_UNIXTIME(%{integer:Event-Timestamp}), FROM_UNIXTIME(%{integer:Event-Timestamp}), NULL, '0', '%{Acct-Authentic}', '%{Connect-Info}', '', '0', '0', '%{Called-Station-Id}', '%{Calling-Station-Id}', '', '%{Service-Type}', '%{Framed-Protocol}', '%{Framed-IP-Address}')" } interim-update { query = "UPDATE radacct SET acctupdatetime = (@acctupdatetime_old:=acctupdatetime), acctupdatetime = FROM_UNIXTIME(%{integer:Event-Timestamp}), acctinterval = %{integer:Event-Timestamp} - UNIX_TIMESTAMP(@acctupdatetime_old), framedipaddress = '%{Framed-IP-Address}', acctsessiontime = %{%{Acct-Session-Time}:-NULL}, acctinputoctets = '%{%{Acct-Input-Gigawords}:-0}' << 32 | '%{%{Acct-Input-Octets}:-0}', acctoutputoctets = '%{%{Acct-Output-Gigawords}:-0}' << 32 | '%{%{Acct-Output-Octets}:-0}' WHERE AcctUniqueId = '%{Acct-Unique-Session-Id}'" } stop { query = "UPDATE radacct SET acctstoptime = FROM_UNIXTIME(%{integer:Event-Timestamp}), acctsessiontime = %{%{Acct-Session-Time}:-NULL}, acctinputoctets = '%{%{Acct-Input-Gigawords}:-0}' << 32 | '%{%{Acct-Input-Octets}:-0}', acctoutputoctets = '%{%{Acct-Output-Gigawords}:-0}' << 32 | '%{%{Acct-Output-Octets}:-0}', acctterminatecause = '%{Acct-Terminate-Cause}', connectinfo_stop = '%{Connect-Info}' WHERE AcctUniqueId = '%{Acct-Unique-Session-Id}'" } } } post-auth { reference = ".query" query = "INSERT INTO radpostauth (username, pass, reply, authdate) VALUES ( '%{SQL-User-Name}', '%{%{User-Password}:-%{Chap-Password}}', '%{reply:Packet-Type}', '%S')" } } rlm_sql (sql): Driver rlm_sql_mysql (module rlm_sql_mysql) loaded and linked Creating attribute SQL-Group instantiate { } # Instantiating module "reject" from file /etc/raddb/mods-enabled/always # Instantiating module "fail" from file /etc/raddb/mods-enabled/always # Instantiating module "ok" from file /etc/raddb/mods-enabled/always # Instantiating module "handled" from file /etc/raddb/mods-enabled/always # Instantiating module "invalid" from file /etc/raddb/mods-enabled/always # Instantiating module "userlock" from file /etc/raddb/mods-enabled/always # Instantiating module "notfound" from file /etc/raddb/mods-enabled/always # Instantiating module "noop" from file /etc/raddb/mods-enabled/always # Instantiating module "updated" from file /etc/raddb/mods-enabled/always # Instantiating module "attr_filter.post-proxy" from file /etc/raddb/mods-enabled/attr_filter reading pairlist file /etc/raddb/mods-config/attr_filter/post-proxy # Instantiating module "attr_filter.pre-proxy" from file /etc/raddb/mods-enabled/attr_filter reading pairlist file /etc/raddb/mods-config/attr_filter/pre-proxy # Instantiating module "attr_filter.access_reject" from file /etc/raddb/mods-enabled/attr_filter reading pairlist file /etc/raddb/mods-config/attr_filter/access_reject [/etc/raddb/mods-config/attr_filter/access_reject]:11 Check item "FreeRADIUS-Response-Delay" found in filter list for realm "DEFAULT". [/etc/raddb/mods-config/attr_filter/access_reject]:11 Check item "FreeRADIUS-Response-Delay-USec" found in filter list for realm "DEFAULT". # Instantiating module "attr_filter.access_challenge" from file /etc/raddb/mods-enabled/attr_filter reading pairlist file /etc/raddb/mods-config/attr_filter/access_challenge # Instantiating module "attr_filter.accounting_response" from file /etc/raddb/mods-enabled/attr_filter reading pairlist file /etc/raddb/mods-config/attr_filter/accounting_response # Instantiating module "cache_eap" from file /etc/raddb/mods-enabled/cache_eap rlm_cache (cache_eap): Driver rlm_cache_rbtree (module rlm_cache_rbtree) loaded and linked # Instantiating module "detail" from file /etc/raddb/mods-enabled/detail # Instantiating module "auth_log" from file /etc/raddb/mods-enabled/detail.log rlm_detail (auth_log): 'User-Password' suppressed, will not appear in detail output # Instantiating module "reply_log" from file /etc/raddb/mods-enabled/detail.log # Instantiating module "pre_proxy_log" from file /etc/raddb/mods-enabled/detail.log # Instantiating module "post_proxy_log" from file /etc/raddb/mods-enabled/detail.log # Instantiating module "eap" from file /etc/raddb/mods-enabled/eap # Linked to sub-module rlm_eap_md5 # Linked to sub-module rlm_eap_leap # Linked to sub-module rlm_eap_gtc gtc { challenge = "Password: " auth_type = "PAP" } # Linked to sub-module rlm_eap_tls tls { tls = "tls-common" } tls-config tls-common { verify_depth = 0 ca_path = "/etc/raddb/certs" pem_file_type = yes private_key_file = "/etc/raddb/certs/server.pem" certificate_file = "/etc/raddb/certs/server.pem" ca_file = "/etc/raddb/certs/ca.pem" private_key_password = <<< secret >>> dh_file = "/etc/raddb/certs/dh" fragment_size = 1024 include_length = yes auto_chain = yes check_crl = no check_all_crl = no cipher_list = "DEFAULT" cipher_server_preference = no ecdh_curve = "prime256v1" cache { enable = no lifetime = 24 max_entries = 255 } verify { skip_if_ocsp_ok = no } ocsp { enable = no override_cert_url = yes url = "http://127.0.0.1/ocsp/" use_nonce = yes timeout = 0 softfail = no } } # Linked to sub-module rlm_eap_ttls ttls { tls = "tls-common" default_eap_type = "md5" copy_request_to_tunnel = no use_tunneled_reply = no virtual_server = "inner-tunnel" include_length = yes require_client_cert = no } tls: Using cached TLS configuration from previous invocation # Linked to sub-module rlm_eap_peap peap { tls = "tls-common" default_eap_type = "mschapv2" copy_request_to_tunnel = no use_tunneled_reply = no proxy_tunneled_request_as_eap = yes virtual_server = "inner-tunnel" soh = no require_client_cert = no } tls: Using cached TLS configuration from previous invocation # Linked to sub-module rlm_eap_mschapv2 mschapv2 { with_ntdomain_hack = no send_error = no } # Instantiating module "expiration" from file /etc/raddb/mods-enabled/expiration # Instantiating module "files" from file /etc/raddb/mods-enabled/files reading pairlist file /etc/raddb/mods-config/files/authorize reading pairlist file /etc/raddb/mods-config/files/accounting reading pairlist file /etc/raddb/mods-config/files/pre-proxy # Instantiating module "linelog" from file /etc/raddb/mods-enabled/linelog # Instantiating module "log_accounting" from file /etc/raddb/mods-enabled/linelog # Instantiating module "logintime" from file /etc/raddb/mods-enabled/logintime # Instantiating module "mschap" from file /etc/raddb/mods-enabled/mschap rlm_mschap (mschap): using internal authentication # Instantiating module "pap" from file /etc/raddb/mods-enabled/pap # Instantiating module "etc_passwd" from file /etc/raddb/mods-enabled/passwd rlm_passwd: nfields: 3 keyfield 0(User-Name) listable: no # Instantiating module "preprocess" from file /etc/raddb/mods-enabled/preprocess reading pairlist file /etc/raddb/mods-config/preprocess/huntgroups reading pairlist file /etc/raddb/mods-config/preprocess/hints # Instantiating module "IPASS" from file /etc/raddb/mods-enabled/realm # Instantiating module "suffix" from file /etc/raddb/mods-enabled/realm # Instantiating module "realmpercent" from file /etc/raddb/mods-enabled/realm # Instantiating module "ntdomain" from file /etc/raddb/mods-enabled/realm # Instantiating module "sql" from file /etc/raddb/mods-enabled/sql rlm_sql_mysql: libmysql version: 5.5.60-MariaDB mysql { tls { } warnings = "auto" } rlm_sql (sql): Attempting to connect to database "radius" rlm_sql (sql): Initialising connection pool pool { start = 5 min = 3 max = 32 spare = 10 uses = 0 lifetime = 0 cleanup_interval = 30 idle_timeout = 60 retry_delay = 30 spread = no } rlm_sql (sql): Opening additional connection (0), 1 of 32 pending slots used rlm_sql_mysql: Starting connect to MySQL server rlm_sql_mysql: Connected to database 'radius' on Localhost via UNIX socket, server version 5.5.60-MariaDB, protocol version 10 rlm_sql (sql): Opening additional connection (1), 1 of 31 pending slots used rlm_sql_mysql: Starting connect to MySQL server rlm_sql_mysql: Connected to database 'radius' on Localhost via UNIX socket, server version 5.5.60-MariaDB, protocol version 10 rlm_sql (sql): Opening additional connection (2), 1 of 30 pending slots used rlm_sql_mysql: Starting connect to MySQL server rlm_sql_mysql: Connected to database 'radius' on Localhost via UNIX socket, server version 5.5.60-MariaDB, protocol version 10 rlm_sql (sql): Opening additional connection (3), 1 of 29 pending slots used rlm_sql_mysql: Starting connect to MySQL server rlm_sql_mysql: Connected to database 'radius' on Localhost via UNIX socket, server version 5.5.60-MariaDB, protocol version 10 rlm_sql (sql): Opening additional connection (4), 1 of 28 pending slots used rlm_sql_mysql: Starting connect to MySQL server rlm_sql_mysql: Connected to database 'radius' on Localhost via UNIX socket, server version 5.5.60-MariaDB, protocol version 10 } # modules radiusd: #### Loading Virtual Servers #### server { # from file /etc/raddb/radiusd.conf } # server server default { # from file /etc/raddb/sites-enabled/default # Loading authenticate {...} # Loading authorize {...} # Loading preacct {...} # Loading accounting {...} # Loading session {...} # Loading post-proxy {...} # Loading post-auth {...} } # server default server inner-tunnel { # from file /etc/raddb/sites-enabled/inner-tunnel # Loading authenticate {...} # Loading authorize {...} # Loading session {...} # Loading post-proxy {...} # Loading post-auth {...} # Skipping contents of 'if' as it is always 'false' -- /etc/raddb/sites-enabled/inner-tunnel:330 } # server inner-tunnel server dynamic_clients { # from file /etc/raddb/sites-enabled/dynamic-clients # Loading authorize {...} } # server dynamic_clients radiusd: #### Opening IP addresses and Ports #### listen { type = "auth" ipaddr = * port = 0 limit { max_connections = 16 lifetime = 0 idle_timeout = 30 } } listen { type = "acct" ipaddr = * port = 0 limit { max_connections = 16 lifetime = 0 idle_timeout = 30 } } listen { type = "auth" ipv6addr = :: port = 0 limit { max_connections = 16 lifetime = 0 idle_timeout = 30 } } listen { type = "acct" ipv6addr = :: port = 0 limit { max_connections = 16 lifetime = 0 idle_timeout = 30 } } listen { type = "auth" ipaddr = 127.0.0.1 port = 18120 } Listening on auth address * port 1812 bound to server default Listening on acct address * port 1813 bound to server default Listening on auth address :: port 1812 bound to server default Listening on acct address :: port 1813 bound to server default Listening on auth address 127.0.0.1 port 18120 bound to server inner-tunnel Listening on proxy address * port 46730 Listening on proxy address :: port 50332 Ready to process requests (0) server dynamic_clients { (0) # Executing section authorize from file /etc/raddb/sites-enabled/dynamic-clients (0) authorize { (0) dynamic_clients: Improper configuration (0) [dynamic_clients] = noop (0) [ok] = ok (0) } # authorize = ok (0) } # server dynamic_clients (0) Converting control list to client fields (0) ERROR: Cannot add client 18.220.171.233: Required attribute "FreeRADIUS-Client-Secret" is missing Ignoring request to auth address * port 1812 bound to server default from unknown client 18.220.171.233 port 41902 proto udp Ready to process requests On Sun, Feb 24, 2019 at 6:05 AM < freeradius-users-request(a)lists.freeradius.org> wrote: > Send Freeradius-Users mailing list submissions to > freeradius-users(a)lists.freeradius.org > > To subscribe or unsubscribe via the World Wide Web, visit > http://lists.freeradius.org/mailman/listinfo/freeradius-users > or, via email, send a message with subject or body 'help' to > freeradius-users-request(a)lists.freeradius.org > > You can reach the person managing the list at > freeradius-users-owner(a)lists.freeradius.org > > When replying, please edit your Subject line so it is more specific > than "Re: Contents of Freeradius-Users digest..." > > > Today's Topics: > > 1. Re: How mitigate mac spoofing in mab (arjun sharma) > 2. Google LDAP integration failure (Phil Grace) > 3. Re: Google LDAP integration failure (Alan DeKok) > 4. Re: Reading dynamic clients from "clients" files in > /etc/raddb/dynamic-clients doesn't work (Alan DeKok) > 5. Re: Google LDAP integration failure (Phil Grace) > > > ---------------------------------------------------------------------- > > Message: 1 > Date: Sat, 23 Feb 2019 22:33:17 +0530 > From: arjun sharma <arjuniet.28(a)gmail.com> > To: FreeRadius users mailing list > <freeradius-users(a)lists.freeradius.org> > Subject: Re: How mitigate mac spoofing in mab > Message-ID: > < > CAFes+Jifm3X8DnJ8jjGHgfe5bWjdoK_Ekv_j8xVa7HgVXPTYeg(a)mail.gmail.com> > Content-Type: text/plain; charset="UTF-8" > > hi , > This is a very basic thing that can be handled with some efforts :- > > When you are not in position to use 802.1x ( which is also not a vulernable > proof to spoofing attacks ) . Use MAB as a auth mechanism but dont make it > a requirement to authentication but not the only condition to authenticate > . After MAB success you have to use upper layer to mitigate the Mac > spoofing, use MOD_AUTH_RADIUS https://freeradius.org/sub_projects/ . ( > link to the mod ) > > Now you can use apache ( webserver as radius client ) now bind certain > vulernable easy to spoof parametres to cookies and sent it as cookies to > the browser this way your mab can be authenticated in itself . i.e.. > consider only the clients with this cookies as the authentic holder of > that mac . This will helo you > > > By using simultaneous use and all you will find yourself in trouble while > implementing roaming ( i faced it ) > > > > > > On Fri, Feb 8, 2019 at 1:42 AM Alan DeKok <aland(a)deployingradius.com> > wrote: > > > On Feb 7, 2019, at 3:10 PM, Carlos Bordon <cgermanb(a)live.com.ar> wrote: > > > > > > Hi! i have a problem with this vulnerability, i need mitigate it. > > > > > > I have ine server with freeradius, other with dhcp and they are connect > > to cisco 6800 swicht. We aunthenticate the endpoint with mab, because we > > cant use 802.1x. the problem that i want to resolve is to mitigate mac > > spoofing on layer two. > > > For us is the same mitigate the problem on the radius or the swicht > > config. > > > > > > Do you guys know any idea? > > > > Use 802.1X. > > > > The MAC address can always be spoofed on the client machine. > > > > If you can't use 802.1X, then you need to track known MAC addresses. > > And if a MAC is online, disallow the same MAC from getting on the network > > again. > > > > There's really very little you can do with unsecured and unsafe network > > protocols. > > > > Alan DeKok. > > > > > > - > > List info/subscribe/unsubscribe? See > > http://www.freeradius.org/list/users.html > > > ------------------------------ > > Message: 2 > Date: Sat, 23 Feb 2019 11:58:19 -0600 > From: Phil Grace <phil.grace(a)hssd.k12.ar.us> > To: freeradius-users(a)lists.freeradius.org > Subject: Google LDAP integration failure > Message-ID: <E3D20FBE-C243-4E93-9A08-662419491B93(a)hssd.k12.ar.us> > Content-Type: text/plain; charset=utf-8 > > Hi everyone, I’m brand new and having an issue that I haven’t found a > clear answer to. I’m running free radius 3.x on ubuntu server 18.10. I have > LDAP enabled to auth to google secure LDAP. So far I’m binding to google > successfully and with the radtest command my LDAP user gets access-accept. > If I do raddest with -t mschap I get access-reject. > > I’m hoping that someone more experienced can point me in the right > direction as to where I can fix the issue. Here’s a snippet of my log in -X > mode. Thanks in advance to anyone that can help > > > =================================================================================================================== > > > rlm_ldap (ldap): Connecting to ldaps://ldap.google.com:636 > rlm_ldap (ldap): Waiting for bind result... > rlm_ldap (ldap): Bind successful > (15) [ldap] = ok > (15) [expiration] = noop > (15) [logintime] = noop > (15) [pap] = noop > (15) } # authorize = updated > (15) Found Auth-Type = eap > (15) # Executing group from file > /etc/freeradius/3.0/sites-enabled/inner-tunnel > (15) authenticate { > (15) eap: Expiring EAP session with state 0x53c912cb54220b41 > (15) eap: Finished EAP session with state 0x313d43603170599a > (15) eap: Previous EAP request found for state 0x313d43603170599a, > released from the list > (15) eap: Peer sent packet with method EAP MSCHAPv2 (26) > (15) eap: Calling submodule eap_mschapv2 to process data > (15) eap_mschapv2: # Executing group from file > /etc/freeradius/3.0/sites-enabled/inner-tunnel > (15) eap_mschapv2: authenticate { > (15) mschap: WARNING: No Cleartext-Password configured. Cannot create > NT-Password > (15) mschap: WARNING: No Cleartext-Password configured. Cannot create > LM-Password > (15) mschap: Creating challenge hash with username: > phil.grace(a)hssd.k12.ar.us > (15) mschap: Client is using MS-CHAPv2 > (15) mschap: ERROR: FAILED: No NT/LM-Password. Cannot perform > authentication > (15) mschap: ERROR: MS-CHAP2-Response is incorrect > (15) [mschap] = reject > (15) } # authenticate = reject > (15) eap: Sending EAP Failure (code 4) ID 77 length 4 > (15) eap: Freeing handler > (15) [eap] = reject > (15) } # authenticate = reject > (15) Failed to authenticate the user > (15) Using Post-Auth-Type Reject > (15) # Executing group from file > /etc/freeradius/3.0/sites-enabled/inner-tunnel > (15) Post-Auth-Type REJECT { > (15) attr_filter.access_reject: EXPAND %{User-Name} > (15) attr_filter.access_reject: --> phil.grace(a)hssd.k12.ar.us > (15) attr_filter.access_reject: Matched entry DEFAULT at line 11 > (15) [attr_filter.access_reject] = updated > (15) update outer.session-state { > (15) &Module-Failure-Message := &request:Module-Failure-Message -> > 'mschap: FAILED: No NT/LM-Password. Cannot perform authentication' > (15) } # update outer.session-state = noop > (15) } # Post-Auth-Type REJECT = updated > (15) } # server inner-tunnel > (15) Virtual server sending reply > (15) MS-CHAP-Error = "ME=691 R=1 C=369d22d8c278cfa7667ff5d2ab0bf287 V=3 > M=Authentication rejected" > (15) EAP-Message = 0x044d0004 > (15) Message-Authenticator = 0x00000000000000000000000000000000 > (15) eap_peap: Got tunneled reply code 3 > (15) eap_peap: MS-CHAP-Error = "ME=691 R=1 > C=369d22d8c278cfa7667ff5d2ab0bf287 V=3 M=Authentication rejected" > (15) eap_peap: EAP-Message = 0x044d0004 > (15) eap_peap: Message-Authenticator = 0x00000000000000000000000000000000 > (15) eap_peap: Got tunneled reply RADIUS code 3 > (15) eap_peap: MS-CHAP-Error = "ME=691 R=1 > C=369d22d8c278cfa7667ff5d2ab0bf287 V=3 M=Authentication rejected" > (15) eap_peap: EAP-Message = 0x044d0004 > (15) eap_peap: Message-Authenticator = 0x00000000000000000000000000000000 > (15) eap_peap: Tunneled authentication was rejected > (15) eap_peap: FAILURE > (15) eap: Sending EAP Request (code 1) ID 78 length 46 > (15) eap: EAP session adding &reply:State = 0x893d3c588e7325ea > (15) [eap] = handled > (15) } # authenticate = handled > (15) Using Post-Auth-Type Challenge > (15) # Executing group from file /etc/freeradius/3.0/sites-enabled/default > (15) Challenge { ... } # empty sub-section is ignored > (15) session-state: Saving cached attributes > (15) Module-Failure-Message := "mschap: FAILED: No NT/LM-Password. > Cannot perform authentication" > (15) Sent Access-Challenge Id 78 from 10.8.172.26:1812 to > 10.8.173.105:38595 length 0 > (15) EAP-Message = > 0x014e002e1900170303002377d07beda30c6131207f85740de5138af7d4342329fb590ca32ddd8e781256a69c9a3a > (15) Message-Authenticator = 0x00000000000000000000000000000000 > (15) State = 0x893d3c588e7325ea93a4d1f0a45e4742 > (15) Finished request > Waking up in 3.4 seconds. > (16) Received Access-Request Id 79 from 10.8.173.105:38595 to > 10.8.172.26:1812 length 320 > (16) User-Name = "phil.grace(a)hssd.k12.ar.us" > (16) NAS-IP-Address = 10.8.173.105 > (16) Called-Station-Id = "8A-15-54-AB-61-48:Faculty" > (16) NAS-Port-Type = Wireless-802.11 > (16) Service-Type = Framed-User > (16) NAS-Port = 1 > (16) Calling-Station-Id = "C8-3C-85-9C-A7-17" > (16) Connect-Info = "CONNECT 54.00 Mbps, 802.11ac, RSSI: 26, Channel: > 149" > (16) Acct-Session-Id = "03D12019BACECB86" > (16) WLAN-Pairwise-Cipher = 1027076 > (16) WLAN-Group-Cipher = 1027074 > (16) WLAN-AKM-Suite = 1027073 > (16) Meraki-Device-Name = "Technology Dept" > (16) Framed-MTU = 1400 > (16) EAP-Message = > 0x024e002e1900170303002321d3fee96f33295e5c79085340cadd61fe65772f5ac4bf4fb1b67c9346e8461e546cea > (16) State = 0x893d3c588e7325ea93a4d1f0a45e4742 > (16) Message-Authenticator = 0x36f2f741b4dbc208756af96049eeda54 > (16) Restoring &session-state > (16) &session-state:Module-Failure-Message := "mschap: FAILED: No > NT/LM-Password. Cannot perform authentication" > (16) # Executing section authorize from file > /etc/freeradius/3.0/sites-enabled/default > (16) authorize { > (16) policy filter_username { > (16) if (&User-Name) { > (16) if (&User-Name) -> TRUE > (16) if (&User-Name) { > (16) if (&User-Name =~ / /) { > (16) if (&User-Name =~ / /) -> FALSE > (16) if (&User-Name =~ /@[^@]*@/ ) { > (16) if (&User-Name =~ /@[^@]*@/ ) -> FALSE > (16) if (&User-Name =~ /\.\./ ) { > (16) if (&User-Name =~ /\.\./ ) -> FALSE > (16) if ((&User-Name =~ /@/) && (&User-Name !~ /(a)(.+)\.(.+)$/)) { > (16) if ((&User-Name =~ /@/) && (&User-Name !~ /(a)(.+)\.(.+)$/)) > -> FALSE > (16) if (&User-Name =~ /\.$/) { > (16) if (&User-Name =~ /\.$/) -> FALSE > (16) if (&User-Name =~ /(a)\./) { > (16) if (&User-Name =~ /(a)\./) -> FALSE > (16) } # if (&User-Name) = notfound > (16) } # policy filter_username = notfound > (16) [preprocess] = ok > (16) [chap] = noop > (16) [mschap] = noop > (16) [digest] = noop > (16) suffix: Checking for suffix after "@" > (16) suffix: Looking up realm "hssd.k12.ar.us" for User-Name = " > phil.grace(a)hssd.k12.ar.us" > (16) suffix: No such realm "hssd.k12.ar.us" > (16) [suffix] = noop > (16) eap: Peer sent EAP Response (code 2) ID 78 length 46 > (16) eap: Continuing tunnel setup > (16) [eap] = ok > (16) } # authorize = ok > (16) Found Auth-Type = eap > (16) # Executing group from file /etc/freeradius/3.0/sites-enabled/default > (16) authenticate { > (16) eap: Expiring EAP session with state 0x53c912cb54220b41 > (16) eap: Finished EAP session with state 0x893d3c588e7325ea > (16) eap: Previous EAP request found for state 0x893d3c588e7325ea, > released from the list > (16) eap: Peer sent packet with method EAP PEAP (25) > (16) eap: Calling submodule eap_peap to process data > (16) eap_peap: Continuing EAP-TLS > (16) eap_peap: [eaptls verify] = ok > (16) eap_peap: Done initial handshake > (16) eap_peap: [eaptls process] = ok > (16) eap_peap: Session established. Decoding tunneled attributes > (16) eap_peap: PEAP state send tlv failure > (16) eap_peap: Received EAP-TLV response > (16) eap_peap: ERROR: The users session was previously rejected: > returning reject (again.) > (16) eap_peap: This means you need to read the PREVIOUS messages in the > debug output > (16) eap_peap: to find out the reason why the user was rejected > (16) eap_peap: Look for "reject" or "fail". Those earlier messages will > tell you > (16) eap_peap: what went wrong, and how to fix the problem > (16) eap: ERROR: Failed continuing EAP PEAP (25) session. EAP sub-module > failed > (16) eap: Sending EAP Failure (code 4) ID 78 length 4 > (16) eap: Failed in EAP select > (16) [eap] = invalid > (16) } # authenticate = invalid > (16) Failed to authenticate the user > (16) Using Post-Auth-Type Reject > (16) # Executing group from file /etc/freeradius/3.0/sites-enabled/default > (16) Post-Auth-Type REJECT { > (16) attr_filter.access_reject: EXPAND %{User-Name} > (16) attr_filter.access_reject: --> phil.grace(a)hssd.k12.ar.us > (16) attr_filter.access_reject: Matched entry DEFAULT at line 11 > (16) [attr_filter.access_reject] = updated > (16) [eap] = noop > (16) policy remove_reply_message_if_eap { > (16) if (&reply:EAP-Message && &reply:Reply-Message) { > (16) if (&reply:EAP-Message && &reply:Reply-Message) -> FALSE > (16) else { > (16) [noop] = noop > (16) } # else = noop > (16) } # policy remove_reply_message_if_eap = noop > (16) } # Post-Auth-Type REJECT = updated > (16) Delaying response for 1.000000 seconds > Waking up in 0.3 seconds. > Waking up in 0.6 seconds. > (16) Sending delayed response > (16) Sent Access-Reject Id 79 from 10.8.172.26:1812 to 10.8.173.105:38595 > length 44 > (16) EAP-Message = 0x044e0004 > (16) Message-Authenticator = 0x00000000000000000000000000000000 > > > > > =================================================================================== > > > > > > Phil Grace > Director of Technology > Heber Springs School District > phil.grace(a)hssd.k12.ar.us > > Arkansas LEA Rep to the NCES Forum > National Center for Education Statistics > https://nces.ed.gov/forum/ > > > > > > > > > > ------------------------------ > > Message: 3 > Date: Sat, 23 Feb 2019 14:08:43 -0500 > From: Alan DeKok <aland(a)deployingradius.com> > To: FreeRadius users mailing list > <freeradius-users(a)lists.freeradius.org> > Subject: Re: Google LDAP integration failure > Message-ID: <049DAF36-A892-419F-8A44-82BBC77A0D5E(a)deployingradius.com> > Content-Type: text/plain; charset=utf-8 > > On Feb 23, 2019, at 12:58 PM, Phil Grace <phil.grace(a)hssd.k12.ar.us> > wrote: > > > > Hi everyone, I’m brand new and having an issue that I haven’t found a > clear answer to. I’m running free radius 3.x on ubuntu server 18.10. I have > LDAP enabled to auth to google secure LDAP. So far I’m binding to google > successfully and with the radtest command my LDAP user gets access-accept. > If I do raddest with -t mschap I get access-reject. > > Are you reading the "known good" password from LDAP? Or are you seeing > the User-Password to LDAP, and having it verify the password? > > > I’m hoping that someone more experienced can point me in the right > direction as to where I can fix the issue. Here’s a snippet of my log in -X > mode. Thanks in advance to anyone that can help > > > > ... > > (15) mschap: WARNING: No Cleartext-Password configured. Cannot create > NT-Password > > (15) mschap: WARNING: No Cleartext-Password configured. Cannot create > LM-Password > > The server didn't get the "known good" password from LDAP. So it can't > do the MS-CHAP calculations. > > And no, you can't pass the MS-CHAP stuff to LDAP. LDAP servers are > databases. They don't implement authentication protocols like MS-CHAP. > > The only solution here is to have the LDAP server return the "known > good" password to FreeRADIUS. > > Alan DeKok. > > > > > ------------------------------ > > Message: 4 > Date: Sat, 23 Feb 2019 14:12:54 -0500 > From: Alan DeKok <aland(a)deployingradius.com> > To: FreeRadius users mailing list > <freeradius-users(a)lists.freeradius.org> > Subject: Re: Reading dynamic clients from "clients" files in > /etc/raddb/dynamic-clients doesn't work > Message-ID: <A6402EDD-311A-4730-A1FB-DBD0929B62EB(a)deployingradius.com> > Content-Type: text/plain; charset=us-ascii > > On Feb 23, 2019, at 9:46 AM, smith john <johnerickson663(a)gmail.com> wrote: > > I'm trying to set up dynamic clients for freeradius 2.2.6 on centos 6.9. > > Hmm... if anything in v2 doesn't work, upgrade to v3. > > We marked v2 "end of life" many years ago. If it works, great. If it > doesn't, well, we're not going to track down & fix bugs from 10 year-old > software. > > > ... > > rad_recv: Access-Request packet from host 18.220.171.233 port 33477, > > id=170, length=76 > > server dynamic_client_server { > > } # server dynamic_client_server > > So... the file is empty? > > Alan DeKok. > > > > > ------------------------------ > > Message: 5 > Date: Sat, 23 Feb 2019 16:04:16 -0600 > From: Phil Grace <phil.grace(a)hssd.k12.ar.us> > To: FreeRadius users mailing list > <freeradius-users(a)lists.freeradius.org> > Subject: Re: Google LDAP integration failure > Message-ID: <83C09D1C-063B-4E8B-8384-D5498836987F(a)hssd.k12.ar.us> > Content-Type: text/plain; charset=utf-8 > > Alan, thanks for the reply. > > > > On Feb 23, 2019, at 1:08 PM, Alan DeKok <aland(a)deployingradius.com> > wrote: > > > > On Feb 23, 2019, at 12:58 PM, Phil Grace <phil.grace(a)hssd.k12.ar.us> > wrote: > >> > >> Hi everyone, I’m brand new and having an issue that I haven’t found a > clear answer to. I’m running free radius 3.x on ubuntu server 18.10. I have > LDAP enabled to auth to google secure LDAP. So far I’m binding to google > successfully and with the radtest command my LDAP user gets access-accept. > If I do raddest with -t mschap I get access-reject. > > > > Are you reading the "known good" password from LDAP? Or are you seeing > the User-Password to LDAP, and having it verify the password? > > I’m not sure, I just followed google’s provided setup guide for freeradius > to work with their LDAP service. > > > > >> I’m hoping that someone more experienced can point me in the right > direction as to where I can fix the issue. Here’s a snippet of my log in -X > mode. Thanks in advance to anyone that can help > >> > >> ... > >> (15) mschap: WARNING: No Cleartext-Password configured. Cannot create > NT-Password > >> (15) mschap: WARNING: No Cleartext-Password configured. Cannot create > LM-Password > > > > The server didn't get the "known good" password from LDAP. So it can't > do the MS-CHAP calculations. > > > > And no, you can't pass the MS-CHAP stuff to LDAP. LDAP servers are > databases. They don't implement authentication protocols like MS-CHAP. > > > > The only solution here is to have the LDAP server return the "known > good" password to FreeRADIUS. > > So would I just disable MS-CHAP or do something different with LDAP config > to get the “known good”password. Would my issue probably be in the > inner-tunnel file or the default file? > > > > > > Alan DeKok. > > > > > > - > > List info/subscribe/unsubscribe? See > http://www.freeradius.org/list/users.html > > > > ------------------------------ > > Subject: Digest Footer > > - > List info/subscribe/unsubscribe? See > http://www.freeradius.org/list/users.html > > ------------------------------ > > End of Freeradius-Users Digest, Vol 166, Issue 51 > ************************************************* >

3 5

[Q] "unknown IP address" mean in dynamic-clients
by Hiroyuki Sato 26 Feb '19

26 Feb '19

Hello, members. Could you tell me "unknown IP address" mean in dynamic-clients file? It means that the IP doesn't match client.conf. Is this correct? https://github.com/FreeRADIUS/freeradius-server/blob/v3.0.x/raddb/sites-ava… > When the server receives a packet from an unknown IP address > within that network, it tries to find a dynamic definition > for that client. If the definition is found, the IP address Best regards. -- Hiroyuki Sato

2 2

FR 3.0.13, reply of attributes missing
by Jürgen Northe 26 Feb '19

26 Feb '19

Hello team, I want to pass VLAN settings from ldap entry to the NAS (HP 5120 Switch) but I only get the "Reply-Message" back. The same with "users". The system is a CentOS 7.6.1810 and from Distro view up to date. I have read the ldap modue config and tried settings like below but did not succeed. So I tried it with an user entry, same result. Is there a main switch in an other config file I might have to set additionally? # valuepair_attribute = 'radiusAttribute' # control:Auth-Type := 'AuthType' # reply:Tunnel-Type := 'radiusTunnelType' # reply:Tunnel-Medium-Type := 'radiusTunnelMediumType' # reply:Tunnel-Private-Group-ID := 'radiusTunnelPrivategroupId' mac Cleartext-Password == "mac" Tunnel-Type = "VLAN", Tunnel-Medium-Type = "IEEE-802", Tunnel-Private-Group-Id = "170" --------------------- FreeRADIUS Version 3.0.13 Copyright (C) 1999-2017 The FreeRADIUS server project and contributors There is NO warranty; not even for MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE You may redistribute copies of FreeRADIUS under the terms of the GNU General Public License For more information about these matters, see the file named COPYRIGHT Starting - reading configuration files ... including dictionary file /usr/share/freeradius/dictionary including dictionary file /usr/share/freeradius/dictionary.dhcp including dictionary file /usr/share/freeradius/dictionary.vqp including dictionary file /etc/raddb/dictionary including configuration file /etc/raddb/radiusd.conf including configuration file /etc/raddb/proxy.conf including configuration file /etc/raddb/clients.conf including files in directory /etc/raddb/mods-enabled/ including configuration file /etc/raddb/mods-enabled/always including configuration file /etc/raddb/mods-enabled/attr_filter including configuration file /etc/raddb/mods-enabled/cache_eap including configuration file /etc/raddb/mods-enabled/chap including configuration file /etc/raddb/mods-enabled/date including configuration file /etc/raddb/mods-enabled/detail including configuration file /etc/raddb/mods-enabled/detail.log including configuration file /etc/raddb/mods-enabled/dhcp including configuration file /etc/raddb/mods-enabled/digest including configuration file /etc/raddb/mods-enabled/dynamic_clients including configuration file /etc/raddb/mods-enabled/eap including configuration file /etc/raddb/mods-enabled/echo including configuration file /etc/raddb/mods-enabled/exec including configuration file /etc/raddb/mods-enabled/expiration including configuration file /etc/raddb/mods-enabled/expr including configuration file /etc/raddb/mods-enabled/files including configuration file /etc/raddb/mods-enabled/linelog including configuration file /etc/raddb/mods-enabled/logintime including configuration file /etc/raddb/mods-enabled/mschap including configuration file /etc/raddb/mods-enabled/ntlm_auth including configuration file /etc/raddb/mods-enabled/pap including configuration file /etc/raddb/mods-enabled/passwd including configuration file /etc/raddb/mods-enabled/preprocess including configuration file /etc/raddb/mods-enabled/radutmp including configuration file /etc/raddb/mods-enabled/realm including configuration file /etc/raddb/mods-enabled/replicate including configuration file /etc/raddb/mods-enabled/soh including configuration file /etc/raddb/mods-enabled/sradutmp including configuration file /etc/raddb/mods-enabled/unix including configuration file /etc/raddb/mods-enabled/unpack including configuration file /etc/raddb/mods-enabled/utf8 including configuration file /etc/raddb/mods-enabled/redundant_ldap including files in directory /etc/raddb/policy.d/ including configuration file /etc/raddb/policy.d/accounting including configuration file /etc/raddb/policy.d/control including configuration file /etc/raddb/policy.d/cui including configuration file /etc/raddb/policy.d/debug including configuration file /etc/raddb/policy.d/dhcp including configuration file /etc/raddb/policy.d/eap including configuration file /etc/raddb/policy.d/filter including configuration file /etc/raddb/policy.d/operator-name including configuration file /etc/raddb/policy.d/canonicalization including files in directory /etc/raddb/sites-enabled/ including configuration file /etc/raddb/sites-enabled/default including configuration file /etc/raddb/sites-enabled/inner-tunnel main { security { user = "radiusd" group = "radiusd" allow_core_dumps = no } name = "radiusd" prefix = "/usr" localstatedir = "/var" logdir = "/var/log/radius" run_dir = "/var/run/radiusd" } main { name = "radiusd" prefix = "/usr" localstatedir = "/var" sbindir = "/usr/sbin" logdir = "/var/log/radius" run_dir = "/var/run/radiusd" libdir = "/usr/lib64/freeradius" radacctdir = "/var/log/radius/radacct" hostname_lookups = no max_request_time = 30 cleanup_delay = 5 max_requests = 16384 pidfile = "/var/run/radiusd/radiusd.pid" checkrad = "/usr/sbin/checkrad" debug_level = 0 proxy_requests = yes log { stripped_names = no auth = no auth_badpass = yes auth_goodpass = yes colourise = yes msg_denied = "You are already logged in - access denied" } resources { } security { max_attributes = 200 reject_delay = 1.000000 status_server = yes } } radiusd: #### Loading Realms and Home Servers #### proxy server { retry_delay = 5 retry_count = 3 default_fallback = no dead_time = 120 wake_all_if_all_dead = no } home_server localhost { ipaddr = 127.0.0.1 port = 1812 type = "auth" secret = <<< secret >>> response_window = 20.000000 response_timeouts = 1 max_outstanding = 65536 zombie_period = 40 status_check = "status-server" ping_interval = 30 check_interval = 30 check_timeout = 4 num_answers_to_alive = 3 revive_interval = 120 limit { max_connections = 16 max_requests = 0 lifetime = 0 idle_timeout = 0 } coa { irt = 2 mrt = 16 mrc = 5 mrd = 30 } } home_server_pool my_auth_failover { type = fail-over home_server = localhost } realm example.com { auth_pool = my_auth_failover } realm LOCAL { } radiusd: #### Loading Clients #### client localhost { ipaddr = 127.0.0.1 require_message_authenticator = no secret = <<< secret >>> nas_type = "other" proto = "*" limit { max_connections = 16 lifetime = 0 idle_timeout = 30 } } client localhost_ipv6 { ipv6addr = ::1 require_message_authenticator = no secret = <<< secret >>> limit { max_connections = 16 lifetime = 0 idle_timeout = 30 } } client 192.168.0.7/32 { ipaddr = 192.168.0.7 require_message_authenticator = no secret = <<< secret >>> shortname = "SWSG1AP1-7" limit { max_connections = 16 lifetime = 0 idle_timeout = 30 } } Debugger not attached # Creating Auth-Type = mschap # Creating Auth-Type = digest # Creating Auth-Type = eap # Creating Auth-Type = PAP # Creating Auth-Type = CHAP # Creating Auth-Type = MS-CHAP # Creating Auth-Type = LDAP radiusd: #### Instantiating modules #### modules { # Loaded module rlm_always # Loading module "reject" from file /etc/raddb/mods-enabled/always always reject { rcode = "reject" simulcount = 0 mpp = no } # Loading module "fail" from file /etc/raddb/mods-enabled/always always fail { rcode = "fail" simulcount = 0 mpp = no } # Loading module "ok" from file /etc/raddb/mods-enabled/always always ok { rcode = "ok" simulcount = 0 mpp = no } # Loading module "handled" from file /etc/raddb/mods-enabled/always always handled { rcode = "handled" simulcount = 0 mpp = no } # Loading module "invalid" from file /etc/raddb/mods-enabled/always always invalid { rcode = "invalid" simulcount = 0 mpp = no } # Loading module "userlock" from file /etc/raddb/mods-enabled/always always userlock { rcode = "userlock" simulcount = 0 mpp = no } # Loading module "notfound" from file /etc/raddb/mods-enabled/always always notfound { rcode = "notfound" simulcount = 0 mpp = no } # Loading module "noop" from file /etc/raddb/mods-enabled/always always noop { rcode = "noop" simulcount = 0 mpp = no } # Loading module "updated" from file /etc/raddb/mods-enabled/always always updated { rcode = "updated" simulcount = 0 mpp = no } # Loaded module rlm_attr_filter # Loading module "attr_filter.post-proxy" from file /etc/raddb/mods-enabled/attr_filter attr_filter attr_filter.post-proxy { filename = "/etc/raddb/mods-config/attr_filter/post-proxy" key = "%{Realm}" relaxed = no } # Loading module "attr_filter.pre-proxy" from file /etc/raddb/mods-enabled/attr_filter attr_filter attr_filter.pre-proxy { filename = "/etc/raddb/mods-config/attr_filter/pre-proxy" key = "%{Realm}" relaxed = no } # Loading module "attr_filter.access_reject" from file /etc/raddb/mods-enabled/attr_filter attr_filter attr_filter.access_reject { filename = "/etc/raddb/mods-config/attr_filter/access_reject" key = "%{User-Name}" relaxed = no } # Loading module "attr_filter.access_challenge" from file /etc/raddb/mods-enabled/attr_filter attr_filter attr_filter.access_challenge { filename = "/etc/raddb/mods-config/attr_filter/access_challenge" key = "%{User-Name}" relaxed = no } # Loading module "attr_filter.accounting_response" from file /etc/raddb/mods-enabled/attr_filter attr_filter attr_filter.accounting_response { filename = "/etc/raddb/mods-config/attr_filter/accounting_response" key = "%{User-Name}" relaxed = no } # Loaded module rlm_cache # Loading module "cache_eap" from file /etc/raddb/mods-enabled/cache_eap cache cache_eap { driver = "rlm_cache_rbtree" key = "%{%{control:State}:-%{%{reply:State}:-%{State}}}" ttl = 15 max_entries = 0 epoch = 0 add_stats = no } # Loaded module rlm_chap # Loading module "chap" from file /etc/raddb/mods-enabled/chap # Loaded module rlm_date # Loading module "date" from file /etc/raddb/mods-enabled/date date { format = "%b %e %Y %H:%M:%S %Z" } # Loaded module rlm_detail # Loading module "detail" from file /etc/raddb/mods-enabled/detail detail { filename = "/var/log/radius/radacct/%{%{Packet-Src-IP-Address}:-%{Packet-Src-IPv6-Address}}/detail-%Y%m%d" header = "%t" permissions = 384 locking = no escape_filenames = no log_packet_header = no } # Loading module "auth_log" from file /etc/raddb/mods-enabled/detail.log detail auth_log { filename = "/var/log/radius/radacct/%{%{Packet-Src-IP-Address}:-%{Packet-Src-IPv6-Address}}/auth-detail-%Y%m%d" header = "%t" permissions = 384 locking = no escape_filenames = no log_packet_header = no } # Loading module "reply_log" from file /etc/raddb/mods-enabled/detail.log detail reply_log { filename = "/var/log/radius/radacct/%{%{Packet-Src-IP-Address}:-%{Packet-Src-IPv6-Address}}/reply-detail-%Y%m%d" header = "%t" permissions = 384 locking = no escape_filenames = no log_packet_header = no } # Loading module "pre_proxy_log" from file /etc/raddb/mods-enabled/detail.log detail pre_proxy_log { filename = "/var/log/radius/radacct/%{%{Packet-Src-IP-Address}:-%{Packet-Src-IPv6-Address}}/pre-proxy-detail-%Y%m%d" header = "%t" permissions = 384 locking = no escape_filenames = no log_packet_header = no } # Loading module "post_proxy_log" from file /etc/raddb/mods-enabled/detail.log detail post_proxy_log { filename = "/var/log/radius/radacct/%{%{Packet-Src-IP-Address}:-%{Packet-Src-IPv6-Address}}/post-proxy-detail-%Y%m%d" header = "%t" permissions = 384 locking = no escape_filenames = no log_packet_header = no } # Loaded module rlm_dhcp # Loading module "dhcp" from file /etc/raddb/mods-enabled/dhcp # Loaded module rlm_digest # Loading module "digest" from file /etc/raddb/mods-enabled/digest # Loaded module rlm_dynamic_clients # Loading module "dynamic_clients" from file /etc/raddb/mods-enabled/dynamic_clients # Loaded module rlm_eap # Loading module "eap" from file /etc/raddb/mods-enabled/eap eap { default_eap_type = "md5" timer_expire = 60 ignore_unknown_eap_types = no cisco_accounting_username_bug = no max_sessions = 16384 } # Loaded module rlm_exec # Loading module "echo" from file /etc/raddb/mods-enabled/echo exec echo { wait = yes program = "/bin/echo %{User-Name}" input_pairs = "request" output_pairs = "reply" shell_escape = yes } # Loading module "exec" from file /etc/raddb/mods-enabled/exec exec { wait = no input_pairs = "request" shell_escape = yes timeout = 10 } # Loaded module rlm_expiration # Loading module "expiration" from file /etc/raddb/mods-enabled/expiration # Loaded module rlm_expr # Loading module "expr" from file /etc/raddb/mods-enabled/expr expr { safe_characters = "@abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ0123456789.-_: /äéöüàâæçèéêëîïôœùûüaÿÄÉÖÜßÀÂÆÇÈÉÊËÎÏÔŒÙÛÜŸ" } # Loaded module rlm_files # Loading module "files" from file /etc/raddb/mods-enabled/files files { filename = "/etc/raddb/mods-config/files/authorize" acctusersfile = "/etc/raddb/mods-config/files/accounting" preproxy_usersfile = "/etc/raddb/mods-config/files/pre-proxy" } # Loaded module rlm_linelog # Loading module "linelog" from file /etc/raddb/mods-enabled/linelog linelog { filename = "/var/log/radius/linelog" escape_filenames = no syslog_severity = "info" permissions = 384 format = "This is a log message for %{User-Name}" reference = "messages.%{%{reply:Packet-Type}:-default}" } # Loading module "log_accounting" from file /etc/raddb/mods-enabled/linelog linelog log_accounting { filename = "/var/log/radius/linelog-accounting" escape_filenames = no syslog_severity = "info" permissions = 384 format = "" reference = "Accounting-Request.%{%{Acct-Status-Type}:-unknown}" } # Loaded module rlm_logintime # Loading module "logintime" from file /etc/raddb/mods-enabled/logintime logintime { minimum_timeout = 60 } # Loaded module rlm_mschap # Loading module "mschap" from file /etc/raddb/mods-enabled/mschap mschap { use_mppe = yes require_encryption = no require_strong = no with_ntdomain_hack = yes passchange { } allow_retry = yes winbind_retry_with_normalised_username = no } # Loading module "ntlm_auth" from file /etc/raddb/mods-enabled/ntlm_auth exec ntlm_auth { wait = yes program = "/path/to/ntlm_auth --request-nt-key --domain=MYDOMAIN --username=%{mschap:User-Name} --password=%{User-Password}" shell_escape = yes } # Loaded module rlm_pap # Loading module "pap" from file /etc/raddb/mods-enabled/pap pap { normalise = yes } # Loaded module rlm_passwd # Loading module "etc_passwd" from file /etc/raddb/mods-enabled/passwd passwd etc_passwd { filename = "/etc/passwd" format = "*User-Name:Crypt-Password:" delimiter = ":" ignore_nislike = no ignore_empty = yes allow_multiple_keys = no hash_size = 100 } # Loaded module rlm_preprocess # Loading module "preprocess" from file /etc/raddb/mods-enabled/preprocess preprocess { huntgroups = "/etc/raddb/mods-config/preprocess/huntgroups" hints = "/etc/raddb/mods-config/preprocess/hints" with_ascend_hack = no ascend_channels_per_line = 23 with_ntdomain_hack = no with_specialix_jetstream_hack = no with_cisco_vsa_hack = no with_alvarion_vsa_hack = no } # Loaded module rlm_radutmp # Loading module "radutmp" from file /etc/raddb/mods-enabled/radutmp radutmp { filename = "/var/log/radius/radutmp" username = "%{User-Name}" case_sensitive = yes check_with_nas = yes permissions = 384 caller_id = yes } # Loaded module rlm_realm # Loading module "IPASS" from file /etc/raddb/mods-enabled/realm realm IPASS { format = "prefix" delimiter = "/" ignore_default = no ignore_null = no } # Loading module "suffix" from file /etc/raddb/mods-enabled/realm realm suffix { format = "suffix" delimiter = "@" ignore_default = no ignore_null = no } # Loading module "realmpercent" from file /etc/raddb/mods-enabled/realm realm realmpercent { format = "suffix" delimiter = "%" ignore_default = no ignore_null = no } # Loading module "ntdomain" from file /etc/raddb/mods-enabled/realm realm ntdomain { format = "prefix" delimiter = "\\" ignore_default = no ignore_null = no } # Loaded module rlm_replicate # Loading module "replicate" from file /etc/raddb/mods-enabled/replicate # Loaded module rlm_soh # Loading module "soh" from file /etc/raddb/mods-enabled/soh soh { dhcp = yes } # Loading module "sradutmp" from file /etc/raddb/mods-enabled/sradutmp radutmp sradutmp { filename = "/var/log/radius/sradutmp" username = "%{User-Name}" case_sensitive = yes check_with_nas = yes permissions = 420 caller_id = no } # Loaded module rlm_unix # Loading module "unix" from file /etc/raddb/mods-enabled/unix unix { radwtmp = "/var/log/radius/radwtmp" } Creating attribute Unix-Group # Loaded module rlm_unpack # Loading module "unpack" from file /etc/raddb/mods-enabled/unpack # Loaded module rlm_utf8 # Loading module "utf8" from file /etc/raddb/mods-enabled/utf8 # Loaded module rlm_ldap # Loading module "ldap1" from file /etc/raddb/mods-enabled/redundant_ldap ldap ldap1 { server = "cp1-215" identity = "cn=Manager,dc=compend,dc=com" password = <<< secret >>> sasl { } user { scope = "sub" access_positive = yes sasl { } } group { filter = "(objectClass=radiusprofile)" scope = "sub" name_attribute = "cn" membership_attribute = "radiusProfileDN" cacheable_name = no cacheable_dn = no } client { filter = "(objectClass=radiusClient)" scope = "sub" base_dn = "dc=compend,dc=com" } profile { } options { ldap_debug = 40 chase_referrals = yes rebind = yes net_timeout = 1 res_timeout = 10 srv_timelimit = 3 idle = 60 probes = 3 interval = 3 } tls { ca_file = "/etc/raddb/certs/cpCA.crt" certificate_file = "/etc/raddb/certs/cp1-215.crt" private_key_file = "/etc/raddb/certs/cp1-215.key" random_file = "/dev/urandom" start_tls = yes require_cert = "never" } } Creating attribute ldap1-LDAP-Group # Loading module "ldap2" from file /etc/raddb/mods-enabled/redundant_ldap ldap ldap2 { server = "cp2-216" identity = "cn=Manager,dc=compend,dc=com" password = <<< secret >>> sasl { } user { scope = "sub" access_positive = yes sasl { } } group { filter = "(objectClass=posixGroup)" scope = "sub" name_attribute = "cn" membership_attribute = "radiusProfileDN" cacheable_name = no cacheable_dn = no } client { filter = "(objectClass=radiusClient)" scope = "sub" base_dn = "dc=compend,dc=com" } profile { } options { ldap_debug = 40 chase_referrals = yes rebind = yes net_timeout = 1 res_timeout = 10 srv_timelimit = 3 idle = 60 probes = 3 interval = 3 } tls { ca_file = "/etc/raddb/certs/cpCA.crt" certificate_file = "/etc/raddb/certs/cp2-216.crt" private_key_file = "/etc/raddb/certs/cp2-216.key" random_file = "/dev/urandom" start_tls = yes require_cert = "never" } } Creating attribute ldap2-LDAP-Group instantiate { # Instantiating module "ldap1" from file /etc/raddb/mods-enabled/redundant_ldap rlm_ldap: libldap vendor: OpenLDAP, version: 20444 accounting { reference = "%{tolower:type.%{Acct-Status-Type}}" } post-auth { reference = "." } rlm_ldap (ldap1): Initialising connection pool pool { start = 5 min = 3 max = 32 spare = 10 uses = 0 lifetime = 0 cleanup_interval = 30 idle_timeout = 60 retry_delay = 30 spread = no } rlm_ldap (ldap1): Opening additional connection (0), 1 of 32 pending slots used rlm_ldap (ldap1): Connecting to ldap://cp1-215:389 TLSMC: MozNSS compatibility interception begins. tlsmc_convert: INFO: cannot open the NSS DB, expecting PEM configuration is present. tlsmc_intercept_initialization: INFO: successfully intercepted TLS initialization. Continuing with OpenSSL only. TLSMC: MozNSS compatibility interception ends. rlm_ldap (ldap1): Waiting for bind result... rlm_ldap (ldap1): Bind successful rlm_ldap (ldap1): Opening additional connection (1), 1 of 31 pending slots used rlm_ldap (ldap1): Connecting to ldap://cp1-215:389 TLSMC: MozNSS compatibility interception begins. tlsmc_convert: INFO: cannot open the NSS DB, expecting PEM configuration is present. tlsmc_intercept_initialization: INFO: successfully intercepted TLS initialization. Continuing with OpenSSL only. TLSMC: MozNSS compatibility interception ends. rlm_ldap (ldap1): Waiting for bind result... rlm_ldap (ldap1): Bind successful rlm_ldap (ldap1): Opening additional connection (2), 1 of 30 pending slots used rlm_ldap (ldap1): Connecting to ldap://cp1-215:389 TLSMC: MozNSS compatibility interception begins. tlsmc_convert: INFO: cannot open the NSS DB, expecting PEM configuration is present. tlsmc_intercept_initialization: INFO: successfully intercepted TLS initialization. Continuing with OpenSSL only. TLSMC: MozNSS compatibility interception ends. rlm_ldap (ldap1): Waiting for bind result... rlm_ldap (ldap1): Bind successful rlm_ldap (ldap1): Opening additional connection (3), 1 of 29 pending slots used rlm_ldap (ldap1): Connecting to ldap://cp1-215:389 TLSMC: MozNSS compatibility interception begins. tlsmc_convert: INFO: cannot open the NSS DB, expecting PEM configuration is present. tlsmc_intercept_initialization: INFO: successfully intercepted TLS initialization. Continuing with OpenSSL only. TLSMC: MozNSS compatibility interception ends. rlm_ldap (ldap1): Waiting for bind result... rlm_ldap (ldap1): Bind successful rlm_ldap (ldap1): Opening additional connection (4), 1 of 28 pending slots used rlm_ldap (ldap1): Connecting to ldap://cp1-215:389 TLSMC: MozNSS compatibility interception begins. tlsmc_convert: INFO: cannot open the NSS DB, expecting PEM configuration is present. tlsmc_intercept_initialization: INFO: successfully intercepted TLS initialization. Continuing with OpenSSL only. TLSMC: MozNSS compatibility interception ends. rlm_ldap (ldap1): Waiting for bind result... rlm_ldap (ldap1): Bind successful # Instantiating module "ldap2" from file /etc/raddb/mods-enabled/redundant_ldap accounting { reference = "%{tolower:type.%{Acct-Status-Type}}" } post-auth { reference = "." } rlm_ldap (ldap2): Initialising connection pool pool { start = 5 min = 3 max = 32 spare = 10 uses = 0 lifetime = 0 cleanup_interval = 30 idle_timeout = 60 retry_delay = 30 spread = no } rlm_ldap (ldap2): Opening additional connection (0), 1 of 32 pending slots used rlm_ldap (ldap2): Connecting to ldap://cp2-216:389 TLSMC: MozNSS compatibility interception begins. tlsmc_convert: INFO: cannot open the NSS DB, expecting PEM configuration is present. tlsmc_intercept_initialization: INFO: successfully intercepted TLS initialization. Continuing with OpenSSL only. TLSMC: MozNSS compatibility interception ends. rlm_ldap (ldap2): Waiting for bind result... rlm_ldap (ldap2): Bind successful rlm_ldap (ldap2): Opening additional connection (1), 1 of 31 pending slots used rlm_ldap (ldap2): Connecting to ldap://cp2-216:389 TLSMC: MozNSS compatibility interception begins. tlsmc_convert: INFO: cannot open the NSS DB, expecting PEM configuration is present. tlsmc_intercept_initialization: INFO: successfully intercepted TLS initialization. Continuing with OpenSSL only. TLSMC: MozNSS compatibility interception ends. rlm_ldap (ldap2): Waiting for bind result... rlm_ldap (ldap2): Bind successful rlm_ldap (ldap2): Opening additional connection (2), 1 of 30 pending slots used rlm_ldap (ldap2): Connecting to ldap://cp2-216:389 rlm_ldap (ldap2): Connecting to ldap://cp2-216:389 TLSMC: MozNSS compatibility interception begins. tlsmc_convert: INFO: cannot open the NSS DB, expecting PEM configuration is present. tlsmc_intercept_initialization: INFO: successfully intercepted TLS initialization. Continuing with OpenSSL only. TLSMC: MozNSS compatibility interception ends. rlm_ldap (ldap2): Waiting for bind result... rlm_ldap (ldap2): Bind successful rlm_ldap (ldap2): Opening additional connection (3), 1 of 29 pending slots used rlm_ldap (ldap2): Connecting to ldap://cp2-216:389 TLSMC: MozNSS compatibility interception begins. tlsmc_convert: INFO: cannot open the NSS DB, expecting PEM configuration is present. tlsmc_intercept_initialization: INFO: successfully intercepted TLS initialization. Continuing with OpenSSL only. TLSMC: MozNSS compatibility interception ends. rlm_ldap (ldap2): Waiting for bind result... rlm_ldap (ldap2): Bind successful rlm_ldap (ldap2): Opening additional connection (4), 1 of 28 pending slots used rlm_ldap (ldap2): Connecting to ldap://cp2-216:389 TLSMC: MozNSS compatibility interception begins. tlsmc_convert: INFO: cannot open the NSS DB, expecting PEM configuration is present. tlsmc_intercept_initialization: INFO: successfully intercepted TLS initialization. Continuing with OpenSSL only. TLSMC: MozNSS compatibility interception ends. rlm_ldap (ldap2): Waiting for bind result... rlm_ldap (ldap2): Bind successful } # Instantiating module "reject" from file /etc/raddb/mods-enabled/always # Instantiating module "fail" from file /etc/raddb/mods-enabled/always # Instantiating module "ok" from file /etc/raddb/mods-enabled/always # Instantiating module "handled" from file /etc/raddb/mods-enabled/always # Instantiating module "invalid" from file /etc/raddb/mods-enabled/always # Instantiating module "userlock" from file /etc/raddb/mods-enabled/always # Instantiating module "notfound" from file /etc/raddb/mods-enabled/always # Instantiating module "noop" from file /etc/raddb/mods-enabled/always # Instantiating module "updated" from file /etc/raddb/mods-enabled/always # Instantiating module "attr_filter.post-proxy" from file /etc/raddb/mods-enabled/attr_filter reading pairlist file /etc/raddb/mods-config/attr_filter/post-proxy # Instantiating module "attr_filter.pre-proxy" from file /etc/raddb/mods-enabled/attr_filter reading pairlist file /etc/raddb/mods-config/attr_filter/pre-proxy # Instantiating module "attr_filter.access_reject" from file /etc/raddb/mods-enabled/attr_filter reading pairlist file /etc/raddb/mods-config/attr_filter/access_reject [/etc/raddb/mods-config/attr_filter/access_reject]:11 Check item "FreeRADIUS-Response-Delay" found in filter list for realm "DEFAULT". [/etc/raddb/mods-config/attr_filter/access_reject]:11 Check item "FreeRADIUS-Response-Delay-USec" found in filter list for realm "DEFAULT". # Instantiating module "attr_filter.access_challenge" from file /etc/raddb/mods-enabled/attr_filter reading pairlist file /etc/raddb/mods-config/attr_filter/access_challenge # Instantiating module "attr_filter.accounting_response" from file /etc/raddb/mods-enabled/attr_filter reading pairlist file /etc/raddb/mods-config/attr_filter/accounting_response # Instantiating module "cache_eap" from file /etc/raddb/mods-enabled/cache_eap rlm_cache (cache_eap): Driver rlm_cache_rbtree (module rlm_cache_rbtree) loaded and linked # Instantiating module "detail" from file /etc/raddb/mods-enabled/detail # Instantiating module "auth_log" from file /etc/raddb/mods-enabled/detail.log rlm_detail (auth_log): 'User-Password' suppressed, will not appear in detail output # Instantiating module "reply_log" from file /etc/raddb/mods-enabled/detail.log # Instantiating module "pre_proxy_log" from file /etc/raddb/mods-enabled/detail.log # Instantiating module "post_proxy_log" from file /etc/raddb/mods-enabled/detail.log # Instantiating module "eap" from file /etc/raddb/mods-enabled/eap # Linked to sub-module rlm_eap_md5 # Linked to sub-module rlm_eap_leap # Linked to sub-module rlm_eap_gtc gtc { challenge = "Password: " auth_type = "PAP" } # Linked to sub-module rlm_eap_tls tls { tls = "tls-common" } tls-config tls-common { verify_depth = 0 ca_path = "/etc/raddb/certs" pem_file_type = yes private_key_file = "/etc/raddb/certs/cp1-215.key" certificate_file = "/etc/raddb/certs/cp1-215.crt" ca_file = "/etc/raddb/certs/cpCA.crt" dh_file = "/etc/raddb/certs/dh" fragment_size = 1024 include_length = yes auto_chain = yes check_crl = no check_all_crl = no cipher_list = "DEFAULT" cipher_server_preference = no ecdh_curve = "prime256v1" cache { enable = no lifetime = 24 max_entries = 255 } verify { skip_if_ocsp_ok = no } ocsp { enable = no override_cert_url = yes url = "http://127.0.0.1/ocsp/" use_nonce = yes timeout = 0 softfail = no } } # Linked to sub-module rlm_eap_ttls ttls { tls = "tls-common" default_eap_type = "md5" copy_request_to_tunnel = no use_tunneled_reply = yes virtual_server = "inner-tunnel" include_length = yes require_client_cert = no } tls: Using cached TLS configuration from previous invocation # Linked to sub-module rlm_eap_peap peap { tls = "tls-common" default_eap_type = "mschapv2" copy_request_to_tunnel = no use_tunneled_reply = yes proxy_tunneled_request_as_eap = yes virtual_server = "inner-tunnel" soh = no require_client_cert = no } tls: Using cached TLS configuration from previous invocation # Linked to sub-module rlm_eap_mschapv2 mschapv2 { with_ntdomain_hack = no send_error = no } # Instantiating module "expiration" from file /etc/raddb/mods-enabled/expiration # Instantiating module "files" from file /etc/raddb/mods-enabled/files reading pairlist file /etc/raddb/mods-config/files/authorize reading pairlist file /etc/raddb/mods-config/files/accounting reading pairlist file /etc/raddb/mods-config/files/pre-proxy # Instantiating module "linelog" from file /etc/raddb/mods-enabled/linelog # Instantiating module "log_accounting" from file /etc/raddb/mods-enabled/linelog # Instantiating module "logintime" from file /etc/raddb/mods-enabled/logintime # Instantiating module "mschap" from file /etc/raddb/mods-enabled/mschap rlm_mschap (mschap): using internal authentication # Instantiating module "pap" from file /etc/raddb/mods-enabled/pap # Instantiating module "etc_passwd" from file /etc/raddb/mods-enabled/passwd rlm_passwd: nfields: 3 keyfield 0(User-Name) listable: no # Instantiating module "preprocess" from file /etc/raddb/mods-enabled/preprocess reading pairlist file /etc/raddb/mods-config/preprocess/huntgroups reading pairlist file /etc/raddb/mods-config/preprocess/hints # Instantiating module "IPASS" from file /etc/raddb/mods-enabled/realm # Instantiating module "suffix" from file /etc/raddb/mods-enabled/realm # Instantiating module "realmpercent" from file /etc/raddb/mods-enabled/realm # Instantiating module "ntdomain" from file /etc/raddb/mods-enabled/realm } # modules radiusd: #### Loading Virtual Servers #### server { # from file /etc/raddb/radiusd.conf } # server server default { # from file /etc/raddb/sites-enabled/default # Loading authenticate {...} # Loading authorize {...} # Loading preacct {...} # Loading accounting {...} # Loading post-proxy {...} # Loading post-auth {...} } # server default server inner-tunnel { # from file /etc/raddb/sites-enabled/inner-tunnel # Loading authenticate {...} # Loading authorize {...} # Loading session {...} # Loading post-proxy {...} # Loading post-auth {...} # Skipping contents of 'if' as it is always 'false' -- /etc/raddb/sites-enabled/inner-tunnel:331 } # server inner-tunnel radiusd: #### Opening IP addresses and Ports #### listen { type = "auth" ipaddr = * port = 0 limit { max_connections = 16 lifetime = 0 idle_timeout = 30 } } listen { type = "acct" ipaddr = * port = 0 limit { max_connections = 16 lifetime = 0 idle_timeout = 30 } } listen { type = "auth" ipv6addr = :: port = 0 limit { max_connections = 16 lifetime = 0 idle_timeout = 30 } } listen { type = "acct" ipv6addr = :: port = 0 limit { max_connections = 16 lifetime = 0 idle_timeout = 30 } } listen { type = "auth" ipaddr = 127.0.0.1 port = 18120 } Listening on auth address * port 1812 bound to server default Listening on acct address * port 1813 bound to server default Listening on auth address :: port 1812 bound to server default Listening on acct address :: port 1813 bound to server default Listening on auth address 127.0.0.1 port 18120 bound to server inner-tunnel Listening on proxy address * port 55233 Listening on proxy address :: port 44514 Ready to process requests (0) Received Access-Request Id 71 from 192.168.0.7:3437 to 192.168.0.215:1812 length 241 (0) User-Name = "001f161eeb3a" (0) User-Password = "001f161eeb3a" (0) NAS-IP-Address = 192.168.0.7 (0) NAS-Identifier = "SWSG1AP1-7-v161121" (0) NAS-Port = 16879715 (0) NAS-Port-Id = "slot=1;subslot=0;port=25;vlanid=99" (0) NAS-Port-Type = Ethernet (0) Service-Type = Call-Check (0) Framed-Protocol = PPP (0) Calling-Station-Id = "00-1F-16-1E-EB-3A" (0) Acct-Session-Id = "101030710181cf010" (0) Huawei-Connect-ID = 1892353 (0) Huawei-Product-ID = "H3C S5120-52C-EI" (0) Huawei-Startup-Stamp = 956750420 (0) Attr-26.43.230 = 0x4769676162697445746865726e6574312f302f3235 (0) # Executing section authorize from file /etc/raddb/sites-enabled/default (0) authorize { (0) [preprocess] = ok (0) [chap] = noop (0) [mschap] = noop (0) [digest] = noop (0) suffix: Checking for suffix after "@" (0) suffix: No '@' in User-Name = "001f161eeb3a", looking up realm NULL (0) suffix: No such realm "NULL" (0) [suffix] = noop (0) eap: No EAP-Message, not doing EAP (0) [eap] = noop (0) files: users: Matched entry DEFAULT at line 201 (0) [files] = ok (0) redundant redundant_ldap { rlm_ldap (ldap1): Reserved connection (0) (0) ldap1: EXPAND (cn=%{%{Stripped-User-Name}:-%{User-Name}}) (0) ldap1: --> (cn=001f161eeb3a) (0) ldap1: Performing search in "dc=compend,dc=com" with filter "(cn=001f161eeb3a)", scope "sub" (0) ldap1: Waiting for search result... (0) ldap1: User object found at DN "cn=NBIVX200S-44,cn=proxmox,cn=192.168.5.0,cn=SUBNET,cn=DHCP Config,dc=compend,dc=com" (0) ldap1: Processing user attributes (0) ldap1: reply:Reply-Message := 'Hello NBIV-LENO-X200S' rlm_ldap (ldap1): Released connection (0) Need 5 more connections to reach 10 spares rlm_ldap (ldap1): Opening additional connection (5), 1 of 27 pending slots used rlm_ldap (ldap1): Connecting to ldap://cp1-215:389 TLSMC: MozNSS compatibility interception begins. tlsmc_convert: INFO: cannot open the NSS DB, expecting PEM configuration is present. tlsmc_intercept_initialization: INFO: successfully intercepted TLS initialization. Continuing with OpenSSL only. TLSMC: MozNSS compatibility interception ends. rlm_ldap (ldap1): Waiting for bind result... rlm_ldap (ldap1): Bind successful (0) [ldap1] = updated (0) } # redundant redundant_ldap = updated (0) if (!updated) { (0) if (!updated) -> FALSE (0) else { (0) update control { (0) Auth-Type := Accept (0) } # update control = noop (0) } # else = noop (0) [expiration] = noop (0) [logintime] = noop (0) pap: WARNING: Auth-Type already set. Not setting to PAP (0) [pap] = noop (0) } # authorize = updated (0) Found Auth-Type = Accept (0) Auth-Type = Accept, accepting the user (0) # Executing section post-auth from file /etc/raddb/sites-enabled/default (0) post-auth { (0) update { (0) No attributes updated (0) } # update = noop (0) [exec] = noop (0) policy remove_reply_message_if_eap { (0) if (&reply:EAP-Message && &reply:Reply-Message) { (0) if (&reply:EAP-Message && &reply:Reply-Message) -> FALSE (0) else { (0) [noop] = noop (0) } # else = noop (0) } # policy remove_reply_message_if_eap = noop (0) } # post-auth = noop (0) Sent Access-Accept Id 71 from 192.168.0.215:1812 to 192.168.0.7:3437 length 0 (0) Framed-Protocol = PPP (0) Framed-Compression = Van-Jacobson-TCP-IP (0) Reply-Message := "Hello NBIV-LENO-X200S" (0) Finished request Waking up in 4.9 seconds. (1) Received Accounting-Request Id 72 from 192.168.0.7:3437 to 192.168.0.215:1813 length 235 (1) User-Name = "001f161eeb3a" (1) NAS-Identifier = "SWSG1AP1-7-v161121" (1) NAS-Port = 16879715 (1) NAS-Port-Id = "slot=1;subslot=0;port=25;vlanid=99" (1) NAS-Port-Type = Ethernet (1) Calling-Station-Id = "00-1F-16-1E-EB-3A" (1) Acct-Status-Type = Start (1) Acct-Authentic = RADIUS (1) Acct-Session-Id = "101030710181cf010" (1) NAS-IP-Address = 192.168.0.7 (1) Event-Timestamp = "Apr 7 2001 12:18:34 CEST" (1) Huawei-Connect-ID = 1892353 (1) Huawei-Input-Burst-Size = 0 (1) Huawei-Input-Average-Rate = 0 (1) Huawei-Output-Burst-Size = 0 (1) Huawei-Output-Average-Rate = 0 (1) Huawei-Priority = 0 (1) Attr-26.43.230 = 0x4769676162697445746865726e6574312f302f3235 (1) # Executing section preacct from file /etc/raddb/sites-enabled/default (1) preacct { (1) [preprocess] = ok (1) policy acct_unique { (1) update request { (1) &Tmp-String-9 := "ai:" (1) } # update request = noop (1) if (("%{hex:&Class}" =~ /^%{hex:&Tmp-String-9}/) && ("%{string:&Class}" =~ /^ai:([0-9a-f]{32})/i)) { (1) EXPAND %{hex:&Class} (1) --> (1) EXPAND ^%{hex:&Tmp-String-9} (1) --> ^61693a (1) if (("%{hex:&Class}" =~ /^%{hex:&Tmp-String-9}/) && ("%{string:&Class}" =~ /^ai:([0-9a-f]{32})/i)) -> FALSE (1) else { (1) update request { (1) EXPAND %{md5:%{User-Name},%{Acct-Session-ID},%{%{NAS-IPv6-Address}:-%{NAS-IP-Address}},%{NAS-Identifier},%{NAS-Port-ID},%{NAS-Port}} (1) --> e883ae33989684ae47a4443ed97ad460 (1) &Acct-Unique-Session-Id := e883ae33989684ae47a4443ed97ad460 (1) } # update request = noop (1) } # else = noop (1) } # policy acct_unique = noop (1) suffix: Checking for suffix after "@" (1) suffix: No '@' in User-Name = "001f161eeb3a", looking up realm NULL (1) suffix: No such realm "NULL" (1) [suffix] = noop (1) [files] = noop (1) } # preacct = ok (1) # Executing section accounting from file /etc/raddb/sites-enabled/default (1) accounting { (1) detail: EXPAND /var/log/radius/radacct/%{%{Packet-Src-IP-Address}:-%{Packet-Src-IPv6-Address}}/detail-%Y%m%d (1) detail: --> /var/log/radius/radacct/192.168.0.7/detail-20190226 (1) detail: /var/log/radius/radacct/%{%{Packet-Src-IP-Address}:-%{Packet-Src-IPv6-Address}}/detail-%Y%m%d expands to /var/log/radius/radacct/192.168.0.7/detail-20190226 (1) detail: EXPAND %t (1) detail: --> Tue Feb 26 09:29:46 2019 (1) [detail] = ok (1) [unix] = ok (1) [exec] = noop (1) attr_filter.accounting_response: EXPAND %{User-Name} (1) attr_filter.accounting_response: --> 001f161eeb3a (1) attr_filter.accounting_response: Matched entry DEFAULT at line 12 (1) [attr_filter.accounting_response] = updated (1) } # accounting = updated (1) Sent Accounting-Response Id 72 from 192.168.0.215:1813 to 192.168.0.7:3437 length 0 (1) Finished request (1) Cleaning up request packet ID 72 with timestamp +26 Waking up in 4.9 seconds. (2) Received Accounting-Request Id 73 from 192.168.0.7:3437 to 192.168.0.215:1813 length 289 (2) User-Name = "001f161eeb3a" (2) NAS-Identifier = "SWSG1AP1-7-v161121" (2) NAS-Port = 16879715 (2) NAS-Port-Id = "slot=1;subslot=0;port=25;vlanid=99" (2) NAS-Port-Type = Ethernet (2) Calling-Station-Id = "00-1F-16-1E-EB-3A" (2) Acct-Status-Type = Stop (2) Acct-Authentic = RADIUS (2) Acct-Session-Id = "101030710181cf010" (2) NAS-IP-Address = 192.168.0.7 (2) Event-Timestamp = "Apr 7 2001 12:18:36 CEST" (2) Acct-Session-Time = 2 (2) Acct-Delay-Time = 0 (2) Acct-Input-Octets = 9046 (2) Acct-Input-Packets = 0 (2) Acct-Output-Octets = 1827 (2) Acct-Output-Packets = 0 (2) Acct-Input-Gigawords = 0 (2) Acct-Output-Gigawords = 0 (2) Acct-Terminate-Cause = User-Request (2) Huawei-Connect-ID = 1892353 (2) Huawei-Input-Burst-Size = 0 (2) Huawei-Input-Average-Rate = 0 (2) Huawei-Output-Burst-Size = 0 (2) Huawei-Output-Average-Rate = 0 (2) Huawei-Priority = 0 (2) Attr-26.43.230 = 0x4769676162697445746865726e6574312f302f3235 (2) # Executing section preacct from file /etc/raddb/sites-enabled/default (2) preacct { (2) [preprocess] = ok (2) policy acct_unique { (2) update request { (2) &Tmp-String-9 := "ai:" (2) } # update request = noop (2) if (("%{hex:&Class}" =~ /^%{hex:&Tmp-String-9}/) && ("%{string:&Class}" =~ /^ai:([0-9a-f]{32})/i)) { (2) EXPAND %{hex:&Class} (2) --> (2) EXPAND ^%{hex:&Tmp-String-9} (2) --> ^61693a (2) if (("%{hex:&Class}" =~ /^%{hex:&Tmp-String-9}/) && ("%{string:&Class}" =~ /^ai:([0-9a-f]{32})/i)) -> FALSE (2) else { (2) update request { (2) EXPAND %{md5:%{User-Name},%{Acct-Session-ID},%{%{NAS-IPv6-Address}:-%{NAS-IP-Address}},%{NAS-Identifier},%{NAS-Port-ID},%{NAS-Port}} (2) --> e883ae33989684ae47a4443ed97ad460 (2) &Acct-Unique-Session-Id := e883ae33989684ae47a4443ed97ad460 (2) } # update request = noop (2) } # else = noop (2) } # policy acct_unique = noop (2) suffix: Checking for suffix after "@" (2) suffix: No '@' in User-Name = "001f161eeb3a", looking up realm NULL (2) suffix: No such realm "NULL" (2) [suffix] = noop (2) [files] = noop (2) } # preacct = ok (2) # Executing section accounting from file /etc/raddb/sites-enabled/default (2) accounting { (2) detail: EXPAND /var/log/radius/radacct/%{%{Packet-Src-IP-Address}:-%{Packet-Src-IPv6-Address}}/detail-%Y%m%d (2) detail: --> /var/log/radius/radacct/192.168.0.7/detail-20190226 (2) detail: /var/log/radius/radacct/%{%{Packet-Src-IP-Address}:-%{Packet-Src-IPv6-Address}}/detail-%Y%m%d expands to /var/log/radius/radacct/192.168.0.7/detail-20190226 (2) detail: EXPAND %t (2) detail: --> Tue Feb 26 09:29:48 2019 (2) [detail] = ok (2) [unix] = ok (2) [exec] = noop (2) attr_filter.accounting_response: EXPAND %{User-Name} (2) attr_filter.accounting_response: --> 001f161eeb3a (2) attr_filter.accounting_response: Matched entry DEFAULT at line 12 (2) [attr_filter.accounting_response] = updated (2) } # accounting = updated (2) Sent Accounting-Response Id 73 from 192.168.0.215:1813 to 192.168.0.7:3437 length 0 (2) Finished request (2) Cleaning up request packet ID 73 with timestamp +28 Waking up in 2.9 seconds. (0) Cleaning up request packet ID 71 with timestamp +26 Ready to process requests

2 1

Use expr for reply from sql database
by kai.zemke＠hauni.com 26 Feb '19

26 Feb '19

Hi, I do have freeradius setup with a sql configuration. My mysql server is running the scheme that is proposed on the freeradius wiki. So far everything is doing fine. Now I want to replay with an Egress-VLANID. If I enter the value hexencoded everything works fine. But if I enter the value with the expr function the replied value is always zero and I have the following entry in my radius.log sql: Error parsing value: Unknown or invalid value "%{expr: 0x31000000 + 105}" for attribute Egress-VLANID) Do I have to mask certain characters in order to make this work? Example: Egress-VLANID = `%{expr: 0x31000000 + 105}` Best regards Kai ________________________________ Diese E-Mail kann vertrauliche Informationen enthalten. Das unerlaubte Kopieren sowie die unbefugte Weitergabe dieser Informationen sind nicht gestattet. Sollten Sie diese E-Mail irrt?mlich erhalten haben, informieren Sie bitte den Absender und l?schen diese E-Mail. This e-mail may contain confidential information, which should not be copied or distributed without authorization. If you have received this e-mail message by mistake, please inform the sender and delete it from your system.

2 1

RE: [EXTERNAL] How mitigate mac spoofing in mab
by Carlos Bordon 26 Feb '19

26 Feb '19

The second thing you can do is on the FreeRADIUS side, which is to use a Simultaneous Use database to prevent MAB requests from different ports at near the same time from being accepted. However, this can be problematic. If you are updating the Simultaneous Use database based on edge switch Accounting packets, then the edge switch may leave stale sessions open and continue to send updates after a host is unplugged and moved by the user to another port... especially if a minihub has been attached to the network and the link stays up. Then when the user gets to the place they have moved, they cannot get on the network because Simultaneous Use thinks they are an imposter. this is great! how can I do this? Thanks! ________________________________ De: Freeradius-Users <freeradius-users-bounces+cgermanb=live.com.ar(a)lists.freeradius.org> en nombre de Brian Julin <BJulin(a)clarku.edu> Enviado: jueves, 7 de febrero de 2019 17:20 Para: freeradius-users(a)lists.freeradius.org Asunto: Re: [EXTERNAL] How mitigate mac spoofing in mab Carlos Bordon <cgermanb(a)live.com.ar> wrote: > I have ine server with freeradius, other with dhcp and they are connect to cisco 6800 swicht. We aunthenticate the endpoint with mab, because we cant use 802.1x. the problem that i want to resolve is to mitigate mac spoofing on layer two. > For us is the same mitigate the problem on the radius or the swicht config. With MAB there is absolutely no way to tell if the host using a MAC address is the actual host that has that burned-in-address (BIA). There are a few things you can do. First, use IP DHCP snooping and ARP inspection features on the edge switch. This will at least keep one host from spoofing many IP or MAC addresses without doing a DHCP transaction for each address, which slows an attacker down. You can also use edge switch port security features to limit the number of MAC addresses allowed on a single port to something reasonable. (While you are at it, see if you also have features to prevent DHCP starvation.) The second thing you can do is on the FreeRADIUS side, which is to use a Simultaneous Use database to prevent MAB requests from different ports at near the same time from being accepted. However, this can be problematic. If you are updating the Simultaneous Use database based on edge switch Accounting packets, then the edge switch may leave stale sessions open and continue to send updates after a host is unplugged and moved by the user to another port... especially if a minihub has been attached to the network and the link stays up. Then when the user gets to the place they have moved, they cannot get on the network because Simultaneous Use thinks they are an imposter. You have to check the behavior of your edge switches and do a lot of testing to make sure that this will work without problems. - List info/subscribe/unsubscribe? See https://na01.safelinks.protection.outlook.com/?url=http%3A%2F%2Fwww.freerad… - List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html

2 1

Google LDAP integration failure
by Phil Grace 26 Feb '19

26 Feb '19

Hi everyone, I’m brand new and having an issue that I haven’t found a clear answer to. I’m running free radius 3.x on ubuntu server 18.10. I have LDAP enabled to auth to google secure LDAP. So far I’m binding to google successfully and with the radtest command my LDAP user gets access-accept. If I do raddest with -t mschap I get access-reject. I’m hoping that someone more experienced can point me in the right direction as to where I can fix the issue. Here’s a snippet of my log in -X mode. Thanks in advance to anyone that can help =================================================================================================================== rlm_ldap (ldap): Connecting to ldaps://ldap.google.com:636 rlm_ldap (ldap): Waiting for bind result... rlm_ldap (ldap): Bind successful (15) [ldap] = ok (15) [expiration] = noop (15) [logintime] = noop (15) [pap] = noop (15) } # authorize = updated (15) Found Auth-Type = eap (15) # Executing group from file /etc/freeradius/3.0/sites-enabled/inner-tunnel (15) authenticate { (15) eap: Expiring EAP session with state 0x53c912cb54220b41 (15) eap: Finished EAP session with state 0x313d43603170599a (15) eap: Previous EAP request found for state 0x313d43603170599a, released from the list (15) eap: Peer sent packet with method EAP MSCHAPv2 (26) (15) eap: Calling submodule eap_mschapv2 to process data (15) eap_mschapv2: # Executing group from file /etc/freeradius/3.0/sites-enabled/inner-tunnel (15) eap_mschapv2: authenticate { (15) mschap: WARNING: No Cleartext-Password configured. Cannot create NT-Password (15) mschap: WARNING: No Cleartext-Password configured. Cannot create LM-Password (15) mschap: Creating challenge hash with username: phil.grace(a)hssd.k12.ar.us (15) mschap: Client is using MS-CHAPv2 (15) mschap: ERROR: FAILED: No NT/LM-Password. Cannot perform authentication (15) mschap: ERROR: MS-CHAP2-Response is incorrect (15) [mschap] = reject (15) } # authenticate = reject (15) eap: Sending EAP Failure (code 4) ID 77 length 4 (15) eap: Freeing handler (15) [eap] = reject (15) } # authenticate = reject (15) Failed to authenticate the user (15) Using Post-Auth-Type Reject (15) # Executing group from file /etc/freeradius/3.0/sites-enabled/inner-tunnel (15) Post-Auth-Type REJECT { (15) attr_filter.access_reject: EXPAND %{User-Name} (15) attr_filter.access_reject: --> phil.grace(a)hssd.k12.ar.us (15) attr_filter.access_reject: Matched entry DEFAULT at line 11 (15) [attr_filter.access_reject] = updated (15) update outer.session-state { (15) &Module-Failure-Message := &request:Module-Failure-Message -> 'mschap: FAILED: No NT/LM-Password. Cannot perform authentication' (15) } # update outer.session-state = noop (15) } # Post-Auth-Type REJECT = updated (15) } # server inner-tunnel (15) Virtual server sending reply (15) MS-CHAP-Error = "ME=691 R=1 C=369d22d8c278cfa7667ff5d2ab0bf287 V=3 M=Authentication rejected" (15) EAP-Message = 0x044d0004 (15) Message-Authenticator = 0x00000000000000000000000000000000 (15) eap_peap: Got tunneled reply code 3 (15) eap_peap: MS-CHAP-Error = "ME=691 R=1 C=369d22d8c278cfa7667ff5d2ab0bf287 V=3 M=Authentication rejected" (15) eap_peap: EAP-Message = 0x044d0004 (15) eap_peap: Message-Authenticator = 0x00000000000000000000000000000000 (15) eap_peap: Got tunneled reply RADIUS code 3 (15) eap_peap: MS-CHAP-Error = "ME=691 R=1 C=369d22d8c278cfa7667ff5d2ab0bf287 V=3 M=Authentication rejected" (15) eap_peap: EAP-Message = 0x044d0004 (15) eap_peap: Message-Authenticator = 0x00000000000000000000000000000000 (15) eap_peap: Tunneled authentication was rejected (15) eap_peap: FAILURE (15) eap: Sending EAP Request (code 1) ID 78 length 46 (15) eap: EAP session adding &reply:State = 0x893d3c588e7325ea (15) [eap] = handled (15) } # authenticate = handled (15) Using Post-Auth-Type Challenge (15) # Executing group from file /etc/freeradius/3.0/sites-enabled/default (15) Challenge { ... } # empty sub-section is ignored (15) session-state: Saving cached attributes (15) Module-Failure-Message := "mschap: FAILED: No NT/LM-Password. Cannot perform authentication" (15) Sent Access-Challenge Id 78 from 10.8.172.26:1812 to 10.8.173.105:38595 length 0 (15) EAP-Message = 0x014e002e1900170303002377d07beda30c6131207f85740de5138af7d4342329fb590ca32ddd8e781256a69c9a3a (15) Message-Authenticator = 0x00000000000000000000000000000000 (15) State = 0x893d3c588e7325ea93a4d1f0a45e4742 (15) Finished request Waking up in 3.4 seconds. (16) Received Access-Request Id 79 from 10.8.173.105:38595 to 10.8.172.26:1812 length 320 (16) User-Name = "phil.grace(a)hssd.k12.ar.us" (16) NAS-IP-Address = 10.8.173.105 (16) Called-Station-Id = "8A-15-54-AB-61-48:Faculty" (16) NAS-Port-Type = Wireless-802.11 (16) Service-Type = Framed-User (16) NAS-Port = 1 (16) Calling-Station-Id = "C8-3C-85-9C-A7-17" (16) Connect-Info = "CONNECT 54.00 Mbps, 802.11ac, RSSI: 26, Channel: 149" (16) Acct-Session-Id = "03D12019BACECB86" (16) WLAN-Pairwise-Cipher = 1027076 (16) WLAN-Group-Cipher = 1027074 (16) WLAN-AKM-Suite = 1027073 (16) Meraki-Device-Name = "Technology Dept" (16) Framed-MTU = 1400 (16) EAP-Message = 0x024e002e1900170303002321d3fee96f33295e5c79085340cadd61fe65772f5ac4bf4fb1b67c9346e8461e546cea (16) State = 0x893d3c588e7325ea93a4d1f0a45e4742 (16) Message-Authenticator = 0x36f2f741b4dbc208756af96049eeda54 (16) Restoring &session-state (16) &session-state:Module-Failure-Message := "mschap: FAILED: No NT/LM-Password. Cannot perform authentication" (16) # Executing section authorize from file /etc/freeradius/3.0/sites-enabled/default (16) authorize { (16) policy filter_username { (16) if (&User-Name) { (16) if (&User-Name) -> TRUE (16) if (&User-Name) { (16) if (&User-Name =~ / /) { (16) if (&User-Name =~ / /) -> FALSE (16) if (&User-Name =~ /@[^@]*@/ ) { (16) if (&User-Name =~ /@[^@]*@/ ) -> FALSE (16) if (&User-Name =~ /\.\./ ) { (16) if (&User-Name =~ /\.\./ ) -> FALSE (16) if ((&User-Name =~ /@/) && (&User-Name !~ /(a)(.+)\.(.+)$/)) { (16) if ((&User-Name =~ /@/) && (&User-Name !~ /(a)(.+)\.(.+)$/)) -> FALSE (16) if (&User-Name =~ /\.$/) { (16) if (&User-Name =~ /\.$/) -> FALSE (16) if (&User-Name =~ /(a)\./) { (16) if (&User-Name =~ /(a)\./) -> FALSE (16) } # if (&User-Name) = notfound (16) } # policy filter_username = notfound (16) [preprocess] = ok (16) [chap] = noop (16) [mschap] = noop (16) [digest] = noop (16) suffix: Checking for suffix after "@" (16) suffix: Looking up realm "hssd.k12.ar.us" for User-Name = "phil.grace(a)hssd.k12.ar.us" (16) suffix: No such realm "hssd.k12.ar.us" (16) [suffix] = noop (16) eap: Peer sent EAP Response (code 2) ID 78 length 46 (16) eap: Continuing tunnel setup (16) [eap] = ok (16) } # authorize = ok (16) Found Auth-Type = eap (16) # Executing group from file /etc/freeradius/3.0/sites-enabled/default (16) authenticate { (16) eap: Expiring EAP session with state 0x53c912cb54220b41 (16) eap: Finished EAP session with state 0x893d3c588e7325ea (16) eap: Previous EAP request found for state 0x893d3c588e7325ea, released from the list (16) eap: Peer sent packet with method EAP PEAP (25) (16) eap: Calling submodule eap_peap to process data (16) eap_peap: Continuing EAP-TLS (16) eap_peap: [eaptls verify] = ok (16) eap_peap: Done initial handshake (16) eap_peap: [eaptls process] = ok (16) eap_peap: Session established. Decoding tunneled attributes (16) eap_peap: PEAP state send tlv failure (16) eap_peap: Received EAP-TLV response (16) eap_peap: ERROR: The users session was previously rejected: returning reject (again.) (16) eap_peap: This means you need to read the PREVIOUS messages in the debug output (16) eap_peap: to find out the reason why the user was rejected (16) eap_peap: Look for "reject" or "fail". Those earlier messages will tell you (16) eap_peap: what went wrong, and how to fix the problem (16) eap: ERROR: Failed continuing EAP PEAP (25) session. EAP sub-module failed (16) eap: Sending EAP Failure (code 4) ID 78 length 4 (16) eap: Failed in EAP select (16) [eap] = invalid (16) } # authenticate = invalid (16) Failed to authenticate the user (16) Using Post-Auth-Type Reject (16) # Executing group from file /etc/freeradius/3.0/sites-enabled/default (16) Post-Auth-Type REJECT { (16) attr_filter.access_reject: EXPAND %{User-Name} (16) attr_filter.access_reject: --> phil.grace(a)hssd.k12.ar.us (16) attr_filter.access_reject: Matched entry DEFAULT at line 11 (16) [attr_filter.access_reject] = updated (16) [eap] = noop (16) policy remove_reply_message_if_eap { (16) if (&reply:EAP-Message && &reply:Reply-Message) { (16) if (&reply:EAP-Message && &reply:Reply-Message) -> FALSE (16) else { (16) [noop] = noop (16) } # else = noop (16) } # policy remove_reply_message_if_eap = noop (16) } # Post-Auth-Type REJECT = updated (16) Delaying response for 1.000000 seconds Waking up in 0.3 seconds. Waking up in 0.6 seconds. (16) Sending delayed response (16) Sent Access-Reject Id 79 from 10.8.172.26:1812 to 10.8.173.105:38595 length 44 (16) EAP-Message = 0x044e0004 (16) Message-Authenticator = 0x00000000000000000000000000000000 =================================================================================== Phil Grace Director of Technology Heber Springs School District phil.grace(a)hssd.k12.ar.us Arkansas LEA Rep to the NCES Forum National Center for Education Statistics https://nces.ed.gov/forum/

3 6

Version 3.0.18 has been released
by Alan DeKok 25 Feb '19

25 Feb '19

After many delays, we've finally managed to release version 3.0.18. This version fixes all known issues in the server. The long delay between 3.0.17 and 3.0.18 was in large part due to a few complex issues which were difficult to track down. Thanks to Graham Clinch and Matthew Newton for tracking down two different issues. A full list of feature improvements and bug fixes is listed below. We try to keep major new features to a minimum in the "stable" lease of FreeRADIUS. However, we have included a lot of minor feature enhancements in the FEATURE IMPROVEMENTS • cleanup_delay can now be 30 seconds. This helps with proxies that have packet loss. • Do-Not-Respond policies can now be set in the "post-auth" section. • Encode / Decode ADSL Forum DHCP options. • Fix module ordering issues. e.g. when "sqlippool" needs "sql". See the "instantiate" section of radiusd.conf. • Add Big Switch dictionary. Fixes #2252. • Add sql_session_start policy (raddb/policy.d/accounting) This minimizes race conditions when using Simultaneous-Use Patch from Philippe Wooding (#2257). • For rlm_perl, all variables are now tainted by default. See raddb/mods-available/perl, and the "perl_flags" configuration item. This change should only affect people who are using variables in insecure ways. • Allow "sqlcounter" module to be listed in "post-auth". • Add support for IPv6 attributes in SQL. Fixes #2280 Patches from Michael Ducharme. • The server is better at handling fail-over for outbound RadSec and TCP connections. Fixes #2284. • The server is now more aggressive about retrying failed outbound RadSec and TCP connections. Fixes #2284. • Add TLS-Session-Version and TLS-Session-Cipher-Suite to the "session_state" list. • Add expansion for Radsec connections. "%{listen:TLS-...}" for TLS-Client-Cert-* and TLS-Cert-* attributes. • Add notes on running "ldapsearch" using the parameters from the LDAP module. • "ipaddr" attributes can now be cast to "integer" type attributes in an "update" section. • Move main thread queue to using atomic queues. This should help with contention in high load scenarios. • Add "recv_buff" setting to listeners. For more details, see sites-available/default. • The sqlippool module can now use attributes other than "Pool-Name" to assign IP pools. The "Pool-Name" attribute is still the default. • The "unpack" expansion can now unpack substrings. See mods-available/unpack for documentation and examples. • The preprocess module now does "ciscvo_vsa_hack" for Eltex-AVPair Fixes #2301. Vendors SHOULD NOT USE THAT KIND OF ATTRIBUTE. • Allow for <instance>-LDAP-UserDN. See mods-available/ldap for more information. • Add sanitizing of control list for moonshot. Fixes #2318. • Update rlm_sql_mysql to be compatible with MySQL 8 Fixes https://bugs.launchpad.net/bugs/1795310. • Allow logging of only Access-Accept or Access-Reject messages See radiusd.conf, "auth_accept" and "auth_reject". • Removed Connect-Rate comparison. It was unused and broken. • Add dictionary.infinera. • RPMs can now change raddb location with rpmbuild parameter --define '_sysconfdir /etc'. • OpenDirectory module now points to Apple documentation for help with build and configuration. • Use OpenSSL HMAC functions instead of local ones. • Some SQL modules can now use "auto_escape" to escape unsafe strings See mods-config/sql/main/mysql/queries.conf. • Add wispr2date conversion in mods-available/date. • Implement dictionary-based handling in rlm_python. Fixes #2334 See mods-available/python for details. • Add support for SKIP LOCKED in sqlippool. This can improve performance by an order of magnitude or more. See raddb/mods-config/sql/ippool/*/queries.conf Fixes #2383. Patch from Nathan Ward. • Updated Debian packages to allow for libssl1.1 Fixes #2384. Patch from Alejandro Perez. • Allow PSK and certificates at the same time Except for TLS 1.3 which does not support that. • Update Debian packages for newer releases Fixes #2391. Patch from Matthew Newton. • Update docker scripts. Fixes #2306 Patch from Matthew Newton. • Add crypt xlat. • MySQL connections can now skip verifying the server certificate. Fixes #2481. See mods-available/sql. • Add better mechanism to detect MariaDB (Old MySQL). • Add RFC 7532 "bang path" support for realms Fixes #2492. • Update dictionary.ukerna documentation. Fixes #2493. • Add support for systemd service and watchdogs Fixes #2499. • Check for openss/rand.h, and allow building without OpenSSL engine. Patch from Eneas U de Queiroz Fixes #2517. • The default PosgtreSQL queries now use "ON CONFLICT" to better deal with issues. This requires PostgreSQL 9.5 or later. Please use a recent version of PostgreSQL, or edit the default queries to remove "ON CONFLICT". BUG FIXES • The session-state list is no longer cleaned in the inner-tunnel. This lets the outer Access-Reject section access session-state. • Fix typo in lock initialization for TLS sockets Found by Sergio NNX. • Add check for crash when home server down Fixes #2233. • Add username key for postauth table. • Better libpcap checks, when the header files or libraries are missing. Fixes #2245. • Allow building with old versions of OpenSSL Fixes #2247. • Allow non-FreeRADIUS State attributes to be used with the "session-state" list. i.e. State length != 16. • Be more aggressive about cleaning up zombie children when running in debug mode. • Use LTDL_DEEPBIND, which fixes issues with Oracle libraries exporting LDAP API functions. • unlock files when asked to unlock them. • return error instead of asserting in map code. • Don't write 0 bytes to SSL. Fixes #2270. • Remove "expiry_time IS NULL" from allocate_update query. Fixes #2262. • Various dictionary cleanups and consistency checks Fixes #2281. Patches from Peter Lemenkov. • rlm_python has stronger thread locking to prevent reported issues. Performance may be affected. • Don't allow Message-Authenticator to overflow past the end of a large packet. • Fix crash in sqlippool when SQL server goes away Fixes #2300. • Typos in man pages. Patch from Nikolai Kondrashov Fixes #2303. • Check for correct OpenSSL version in vulnerability list. Patch from Christian Hesse. • Fix crash with CoA packets/ Fixes #2304. • Fix crash in rlm_exec with CoA. Fixes #2328. • Print errors while parsing the log config, and don't quit when deprecated log settings are found. • Fix DHCP encoder xlat so that it can be used with a list of attributes. It previously only encoded the first member of the list, and now encodes all members. • The "expr" module now skips more whitespace. • Remove internal FreeRADIUS-Response-Delay attributes from attr_filter Access-Reject. • Don't send junk to redis when maximum args reached. • Small updates to IPv6 for accounting schema Fixes #2364. • Fix OpenDirectory integration in rlm_mschap. • Fix slow memory leak with dynamic clients. • Don't artificially truncate debug output for long strings. • Fix memory leak in EAP-PWD. • Fix crash in "hints" file with Fall-Through = yes. • Fix crash / timer issues with many CoA packets. • Fix attr_filter so that it does not treat vendor attributes of number 26 as Vendor-Specific. • Fix reconnect correctly in rlm_sql_mysql. • Fix rlm_cache to properly use Cache-TTL < 0 Fixes #2485. • Fix rare occurance of bad xlat expansion. • Check for rare race condition when a proxy reply arrives too late.

1 0

Re: Migration from GNU Radius to FreeRadius
by Aditya Vijjan 25 Feb '19

25 Feb '19

HI Team, We have old GNU Radius and have decided migration to Freeradius, we are using Mysql as db need help in migration. Do we have any documentation for the same. On Mon, Feb 25, 2019 at 9:40 AM Aditya Vijjan <aditya.vijjan(a)gmail.com> wrote: > HI Team, > > We have old GNU Radius and have decided migration to Freeradius, we are > using Mysql as db need help in migration. > > Do we have any documentation for the same. > > -- > Thanks & Regards > Aditya Vijjan > > > -- Thanks & Regards Aditya Vijjan MBA- IT Mcsa,Rhce,Mcts,Cmss,Sts,Ccnsp,Gca,Itil,Aws,Azure. 9930830957 aditya.vijjan(a)gmail.com

2 1

Reading dynamic clients from "clients" files in /etc/raddb/dynamic-clients doesn't work
by smith john 23 Feb '19

23 Feb '19

Hello, I'm trying to set up dynamic clients for freeradius 2.2.6 on centos 6.9. Following the documentation in /etc/raddb/mods-available/dynamic_clients, I linked /etc/raddb/sites-enabled/dynamic_clients to /etcraddb/sites-available/dynamic_clients. The contents of /etc/raddb/sites-enabled/dynamic_clients is changed to : client dynamic { ipaddr = 0.0.0.0 netmask = 0 dynamic_clients = dynamic_client_server directory = ${confdir}/dynamic-clients/ lifetime = 3600 } server dynamic_client_server { authorize { # # Example 2: Read the clients from "clients" files # in a directory. # # This requires you to uncomment the # "directory" configuration in the # "client dynamic" configuration above, # and then put one file per IP address in # that directory. # dynamic_clients # # Tell the caller that the client was defined properly. # # If the authorize section does NOT return "ok", then # the new client is ignored. ok } } I also created the /etc/raddb/dynamic-clients directory and changed its ownership to root:radiusd Below is how I test the config: 1. Run "radiusd -X" in one shell 2. Open another shell and create a file named "18.220.171.233" under etc/raddb/dynamic-clients. client mynas { ipaddr = 18.220.171.233 secret = testing456 } 3. ssh to the nas server at 18.220.171.233, and run the radtest command to test the setup. 4. The debug gives the following result: rad_recv: Access-Request packet from host 18.220.171.233 port 33477, id=170, length=76 server dynamic_client_server { } # server dynamic_client_server - Cannot add client 18.220.171.233: Required attribute "FreeRADIUS-Client-Secret" is missing. Ignoring request to authentication address * port 1812 from unknown client 18.220.171.233 port 33477 I can't figure out what I am missing. Can somebody help me with this? Thank you. This is the complete debug output: radiusd: FreeRADIUS Version 2.2.6, for host x86_64-redhat-linux-gnu, built on Jul 18 2017 at 12:13:14 Copyright (C) 1999-2013 The FreeRADIUS server project and contributors. There is NO warranty; not even for MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. You may redistribute copies of FreeRADIUS under the terms of the GNU General Public License. For more information about these matters, see the file named COPYRIGHT. Starting - reading configuration files ... including configuration file /etc/raddb/radiusd.conf including configuration file /etc/raddb/proxy.conf including configuration file /etc/raddb/clients.conf including files in directory /etc/raddb/modules/ including configuration file /etc/raddb/modules/mschap including configuration file /etc/raddb/modules/detail.log including configuration file /etc/raddb/modules/pam including configuration file /etc/raddb/modules/radutmp including configuration file /etc/raddb/modules/chap including configuration file /etc/raddb/modules/always including configuration file /etc/raddb/modules/acct_unique including configuration file /etc/raddb/modules/opendirectory including configuration file /etc/raddb/modules/sradutmp including configuration file /etc/raddb/modules/detail including configuration file /etc/raddb/modules/expr including configuration file /etc/raddb/modules/attr_rewrite including configuration file /etc/raddb/modules/cui including configuration file /etc/raddb/modules/wimax including configuration file /etc/raddb/modules/policy including configuration file /etc/raddb/modules/soh including configuration file /etc/raddb/modules/attr_filter including configuration file /etc/raddb/modules/detail.example.com including configuration file /etc/raddb/modules/logintime including configuration file /etc/raddb/modules/mac2vlan including configuration file /etc/raddb/modules/checkval including configuration file /etc/raddb/modules/digest including configuration file /etc/raddb/modules/exec including configuration file /etc/raddb/modules/sql_log including configuration file /etc/raddb/modules/inner-eap including configuration file /etc/raddb/modules/cache including configuration file /etc/raddb/modules/files including configuration file /etc/raddb/modules/dynamic_clients including configuration file /etc/raddb/modules/ippool including configuration file /etc/raddb/modules/passwd including configuration file /etc/raddb/modules/counter including configuration file /etc/raddb/modules/perl including configuration file /etc/raddb/modules/otp including configuration file /etc/raddb/modules/etc_group including configuration file /etc/raddb/modules/linelog including configuration file /etc/raddb/modules/rediswho including configuration file /etc/raddb/modules/smsotp including configuration file /etc/raddb/modules/ntlm_auth including configuration file /etc/raddb/modules/dhcp_sqlippool including configuration file /etc/raddb/modules/replicate including configuration file /etc/raddb/modules/mac2ip including configuration file /etc/raddb/modules/realm including configuration file /etc/raddb/modules/expiration including configuration file /etc/raddb/modules/smbpasswd including configuration file /etc/raddb/modules/sqlcounter_expire_on_login including configuration file /etc/raddb/modules/radrelay including configuration file /etc/raddb/modules/pap including configuration file /etc/raddb/modules/redis including configuration file /etc/raddb/modules/unix including configuration file /etc/raddb/modules/preprocess including configuration file /etc/raddb/modules/echo including configuration file /etc/raddb/eap.conf including configuration file /etc/raddb/sql.conf including configuration file /etc/raddb/sql/mysql/dialup.conf including configuration file /etc/raddb/policy.conf including files in directory /etc/raddb/sites-enabled/ including configuration file /etc/raddb/sites-enabled/default including configuration file /etc/raddb/sites-enabled/inner-tunnel including configuration file /etc/raddb/sites-enabled/dynamic-clients including configuration file /etc/raddb/sites-enabled/control-socket main { user = "radiusd" group = "radiusd" allow_core_dumps = no } including dictionary file /etc/raddb/dictionary main { name = "radiusd" prefix = "/usr" localstatedir = "/var" sbindir = "/usr/sbin" logdir = "/var/log/radius" run_dir = "/var/run/radiusd" libdir = "/usr/lib64/freeradius" radacctdir = "/var/log/radius/radacct" hostname_lookups = no max_request_time = 30 cleanup_delay = 5 max_requests = 1024 pidfile = "/var/run/radiusd/radiusd.pid" checkrad = "/usr/sbin/checkrad" debug_level = 0 proxy_requests = yes log { stripped_names = no auth = no auth_badpass = no auth_goodpass = no } security { max_attributes = 200 reject_delay = 1 status_server = yes } } radiusd: #### Loading Realms and Home Servers #### proxy server { retry_delay = 5 retry_count = 3 default_fallback = no dead_time = 120 wake_all_if_all_dead = no } home_server localhost { ipaddr = 127.0.0.1 port = 1812 type = "auth" secret = "testing123" response_window = 20.000000 response_timeouts = 1 max_outstanding = 65536 require_message_authenticator = yes zombie_period = 40 status_check = "status-server" ping_interval = 30 check_interval = 30 num_answers_to_alive = 3 num_pings_to_alive = 3 revive_interval = 120 status_check_timeout = 4 coa { irt = 2 mrt = 16 mrc = 5 mrd = 30 } } home_server_pool my_auth_failover { type = fail-over home_server = localhost } realm example.com { auth_pool = my_auth_failover } realm LOCAL { } radiusd: #### Loading Clients #### client localhost { ipaddr = 127.0.0.1 require_message_authenticator = no secret = "testing123" nastype = "other" } client dynamic { ipaddr = 0.0.0.0 netmask = 0 require_message_authenticator = no dynamic_clients = "dynamic_client_server" lifetime = 3600 } including dynamic clients in /etc/raddb/dynamic-clients/ radiusd: #### Instantiating modules #### instantiate { Module: Linked to module rlm_exec Module: Instantiating module "exec" from file /etc/raddb/modules/exec exec { wait = no input_pairs = "request" shell_escape = yes timeout = 10 } Module: Linked to module rlm_expr Module: Instantiating module "expr" from file /etc/raddb/modules/expr Module: Linked to module rlm_expiration Module: Instantiating module "expiration" from file /etc/raddb/modules/expiration expiration { reply-message = "Password Has Expired " } Module: Linked to module rlm_logintime Module: Instantiating module "logintime" from file /etc/raddb/modules/logintime logintime { reply-message = "You are calling outside your allowed timespan " minimum-timeout = 60 } } radiusd: #### Loading Virtual Servers #### server { # from file modules { Module: Creating Auth-Type = digest Module: Creating Post-Auth-Type = REJECT Module: Checking authenticate {...} for more modules to load Module: Linked to module rlm_pap Module: Instantiating module "pap" from file /etc/raddb/modules/pap pap { encryption_scheme = "auto" auto_header = no } Module: Linked to module rlm_chap Module: Instantiating module "chap" from file /etc/raddb/modules/chap Module: Linked to module rlm_mschap Module: Instantiating module "mschap" from file /etc/raddb/modules/mschap mschap { use_mppe = yes require_encryption = no require_strong = no with_ntdomain_hack = no allow_retry = yes } Module: Linked to module rlm_digest Module: Instantiating module "digest" from file /etc/raddb/modules/digest Module: Linked to module rlm_unix Module: Instantiating module "unix" from file /etc/raddb/modules/unix unix { radwtmp = "/var/log/radius/radwtmp" } Module: Linked to module rlm_eap Module: Instantiating module "eap" from file /etc/raddb/eap.conf eap { default_eap_type = "md5" timer_expire = 60 ignore_unknown_eap_types = no cisco_accounting_username_bug = no max_sessions = 1024 } Module: Linked to sub-module rlm_eap_md5 Module: Instantiating eap-md5 Module: Linked to sub-module rlm_eap_leap Module: Instantiating eap-leap Module: Linked to sub-module rlm_eap_gtc Module: Instantiating eap-gtc gtc { challenge = "Password: " auth_type = "PAP" } Module: Linked to sub-module rlm_eap_tls Module: Instantiating eap-tls tls { rsa_key_exchange = no dh_key_exchange = yes rsa_key_length = 512 dh_key_length = 512 verify_depth = 0 CA_path = "/etc/raddb/certs" pem_file_type = yes private_key_file = "/etc/raddb/certs/server.pem" certificate_file = "/etc/raddb/certs/server.pem" CA_file = "/etc/raddb/certs/ca.pem" private_key_password = "whatever" dh_file = "/etc/raddb/certs/dh" fragment_size = 1024 include_length = yes check_crl = no cipher_list = "DEFAULT" ecdh_curve = "prime256v1" cache { enable = no lifetime = 24 max_entries = 255 } verify { } ocsp { enable = no override_cert_url = yes url = "http://127.0.0.1/ocsp/" use_nonce = yes timeout = 0 softfail = no } } Module: Linked to sub-module rlm_eap_ttls Module: Instantiating eap-ttls ttls { default_eap_type = "md5" copy_request_to_tunnel = no use_tunneled_reply = no virtual_server = "inner-tunnel" include_length = yes } Module: Linked to sub-module rlm_eap_peap Module: Instantiating eap-peap peap { default_eap_type = "mschapv2" copy_request_to_tunnel = no use_tunneled_reply = no proxy_tunneled_request_as_eap = yes virtual_server = "inner-tunnel" soh = no } Module: Linked to sub-module rlm_eap_mschapv2 Module: Instantiating eap-mschapv2 mschapv2 { with_ntdomain_hack = no send_error = no } Module: Checking authorize {...} for more modules to load Module: Linked to module rlm_preprocess Module: Instantiating module "preprocess" from file /etc/raddb/modules/preprocess preprocess { huntgroups = "/etc/raddb/huntgroups" hints = "/etc/raddb/hints" with_ascend_hack = no ascend_channels_per_line = 23 with_ntdomain_hack = no with_specialix_jetstream_hack = no with_cisco_vsa_hack = no with_alvarion_vsa_hack = no } reading pairlist file /etc/raddb/huntgroups reading pairlist file /etc/raddb/hints Module: Linked to module rlm_realm Module: Instantiating module "suffix" from file /etc/raddb/modules/realm realm suffix { format = "suffix" delimiter = "@" ignore_default = no ignore_null = no } Module: Linked to module rlm_sql Module: Instantiating module "sql" from file /etc/raddb/sql.conf sql { driver = "rlm_sql_mysql" server = "localhost" port = "3306" login = "radius" password = "radpass" radius_db = "radius" read_groups = yes sqltrace = no sqltracefile = "/var/log/radius/sqltrace.sql" readclients = no deletestalesessions = yes num_sql_socks = 32 lifetime = 0 max_queries = 0 sql_user_name = "%{User-Name}" default_user_profile = "" nas_query = "SELECT id, nasname, shortname, type, secret, server FROM nas" authorize_check_query = "SELECT id, username, attribute, value, op FROM radcheck WHERE username = '%{SQL-User-Name}' ORDER BY id" authorize_reply_query = "SELECT id, username, attribute, value, op FROM radreply WHERE username = '%{SQL-User-Name}' ORDER BY id" authorize_group_check_query = "SELECT id, groupname, attribute, Value, op FROM radgroupcheck WHERE groupname = '%{Sql-Group}' ORDER BY id" authorize_group_reply_query = "SELECT id, groupname, attribute, value, op FROM radgroupreply WHERE groupname = '%{Sql-Group}' ORDER BY id" accounting_onoff_query = " UPDATE radacct SET acctstoptime = '%S', acctsessiontime = unix_timestamp('%S') - unix_timestamp(acctstarttime), acctterminatecause = '%{Acct-Terminate-Cause}', acctstopdelay = %{%{Acct-Delay-Time}:-0} WHERE acctstoptime IS NULL AND nasipaddress = '%{NAS-IP-Address}' AND acctstarttime <= '%S'" accounting_update_query = " UPDATE radacct SET framedipaddress = '%{Framed-IP-Address}', acctsessiontime = '%{%{Acct-Session-Time}:-0}', acctinputoctets = '%{%{Acct-Input-Gigawords}:-0}' << 32 | '%{%{Acct-Input-Octets}:-0}', acctoutputoctets = '%{%{Acct-Output-Gigawords}:-0}' << 32 | '%{%{Acct-Output-Octets}:-0}' WHERE acctsessionid = '%{Acct-Session-Id}' AND username = '%{SQL-User-Name}' AND nasipaddress = '%{NAS-IP-Address}'" accounting_update_query_alt = " INSERT INTO radacct (acctsessionid, acctuniqueid, username, realm, nasipaddress, nasportid, nasporttype, acctstarttime, acctsessiontime, acctauthentic, connectinfo_start, acctinputoctets, acctoutputoctets, calledstationid, callingstationid, servicetype, framedprotocol, framedipaddress, acctstartdelay, xascendsessionsvrkey) VALUES ('%{Acct-Session-Id}', '%{Acct-Unique-Session-Id}', '%{SQL-User-Name}', '%{Realm}', '%{NAS-IP-Address}', '%{NAS-Port}', '%{NAS-Port-Type}', DATE_SUB('%S', INTERVAL (%{%{Acct-Session-Time}:-0} + %{%{Acct-Delay-Time}:-0}) SECOND), '%{%{Acct-Session-Time}:-0}', '%{Acct-Authentic}', '', '%{%{Acct-Input-Gigawords}:-0}' << 32 | '%{%{Acct-Input-Octets}:-0}', '%{%{Acct-Output-Gigawords}:-0}' << 32 | '%{%{Acct-Output-Octets}:-0}', '%{Called-Station-Id}', '%{Calling-Station-Id}', '%{Service-Type}', '%{Framed-Protocol}', '%{Framed-IP-Address}', '0', '%{X-Ascend-Session-Svr-Key}')" accounting_start_query = " INSERT INTO radacct (acctsessionid, acctuniqueid, username, realm, nasipaddress, nasportid, nasporttype, acctstarttime, acctstoptime, acctsessiontime, acctauthentic, connectinfo_start, connectinfo_stop, acctinputoctets, acctoutputoctets, calledstationid, callingstationid, acctterminatecause, servicetype, framedprotocol, framedipaddress, acctstartdelay, acctstopdelay, xascendsessionsvrkey) VALUES ('%{Acct-Session-Id}', '%{Acct-Unique-Session-Id}', '%{SQL-User-Name}', '%{Realm}', '%{NAS-IP-Address}', '%{NAS-Port}', '%{NAS-Port-Type}', '%S', NULL, '0', '%{Acct-Authentic}', '%{Connect-Info}', '', '0', '0', '%{Called-Station-Id}', '%{Calling-Station-Id}', '', '%{Service-Type}', '%{Framed-Protocol}', '%{Framed-IP-Address}', '%{%{Acct-Delay-Time}:-0}', '0', '%{X-Ascend-Session-Svr-Key}')" accounting_start_query_alt = " UPDATE radacct SET acctstarttime = '%S', acctstartdelay = '%{%{Acct-Delay-Time}:-0}', connectinfo_start = '%{Connect-Info}' WHERE acctsessionid = '%{Acct-Session-Id}' AND username = '%{SQL-User-Name}' AND nasipaddress = '%{NAS-IP-Address}'" accounting_stop_query = " UPDATE radacct SET acctstoptime = '%S', acctsessiontime = '%{%{Acct-Session-Time}:-0}', acctinputoctets = '%{%{Acct-Input-Gigawords}:-0}' << 32 | '%{%{Acct-Input-Octets}:-0}', acctoutputoctets = '%{%{Acct-Output-Gigawords}:-0}' << 32 | '%{%{Acct-Output-Octets}:-0}', acctterminatecause = '%{Acct-Terminate-Cause}', acctstopdelay = '%{%{Acct-Delay-Time}:-0}', connectinfo_stop = '%{Connect-Info}' WHERE acctsessionid = '%{Acct-Session-Id}' AND username = '%{SQL-User-Name}' AND nasipaddress = '%{NAS-IP-Address}'" accounting_stop_query_alt = " INSERT INTO radacct (acctsessionid, acctuniqueid, username, realm, nasipaddress, nasportid, nasporttype, acctstarttime, acctstoptime, acctsessiontime, acctauthentic, connectinfo_start, connectinfo_stop, acctinputoctets, acctoutputoctets, calledstationid, callingstationid, acctterminatecause, servicetype, framedprotocol, framedipaddress, acctstartdelay, acctstopdelay) VALUES ('%{Acct-Session-Id}', '%{Acct-Unique-Session-Id}', '%{SQL-User-Name}', '%{Realm}', '%{NAS-IP-Address}', '%{NAS-Port}', '%{NAS-Port-Type}', DATE_SUB('%S', INTERVAL (%{%{Acct-Session-Time}:-0} + %{%{Acct-Delay-Time}:-0}) SECOND), '%S', '%{%{Acct-Session-Time}:-0}', '%{Acct-Authentic}', '', '%{Connect-Info}', '%{%{Acct-Input-Gigawords}:-0}' << 32 | '%{%{Acct-Input-Octets}:-0}', '%{%{Acct-Output-Gigawords}:-0}' << 32 | '%{%{Acct-Output-Octets}:-0}', '%{Called-Station-Id}', '%{Calling-Station-Id}', '%{Acct-Terminate-Cause}', '%{Service-Type}', '%{Framed-Protocol}', '%{Framed-IP-Address}', '0', '%{%{Acct-Delay-Time}:-0}')" group_membership_query = "SELECT groupname FROM radusergroup WHERE username = '%{SQL-User-Name}' ORDER BY priority" connect_failure_retry_delay = 60 simul_count_query = "" simul_verify_query = "SELECT radacctid, acctsessionid, username, nasipaddress, nasportid, framedipaddress, callingstationid, framedprotocol FROM radacct WHERE username = '%{SQL-User-Name}' AND acctstoptime IS NULL" postauth_query = "INSERT INTO radpostauth (username, pass, reply, authdate) VALUES ( '%{User-Name}', '%{%{User-Password}:-%{Chap-Password}}', '%{reply:Packet-Type}', '%S')" safe-characters = "@abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ0123456789.-_: /" } rlm_sql (sql): Driver rlm_sql_mysql (module rlm_sql_mysql) loaded and linked rlm_sql (sql): Attempting to connect to radius@localhost:3306/radius rlm_sql (sql): starting 0 rlm_sql (sql): Attempting to connect rlm_sql_mysql #0 rlm_sql_mysql: Starting connect to MySQL server for #0 rlm_sql (sql): Connected new DB handle, #0 rlm_sql (sql): starting 1 rlm_sql (sql): Attempting to connect rlm_sql_mysql #1 rlm_sql_mysql: Starting connect to MySQL server for #1 rlm_sql (sql): Connected new DB handle, #1 rlm_sql (sql): starting 2 rlm_sql (sql): Attempting to connect rlm_sql_mysql #2 rlm_sql_mysql: Starting connect to MySQL server for #2 rlm_sql (sql): Connected new DB handle, #2 rlm_sql (sql): starting 3 rlm_sql (sql): Attempting to connect rlm_sql_mysql #3 rlm_sql_mysql: Starting connect to MySQL server for #3 rlm_sql (sql): Connected new DB handle, #3 rlm_sql (sql): starting 4 rlm_sql (sql): Attempting to connect rlm_sql_mysql #4 rlm_sql_mysql: Starting connect to MySQL server for #4 rlm_sql (sql): Connected new DB handle, #4 rlm_sql (sql): starting 5 rlm_sql (sql): Attempting to connect rlm_sql_mysql #5 rlm_sql_mysql: Starting connect to MySQL server for #5 rlm_sql (sql): Connected new DB handle, #5 rlm_sql (sql): starting 6 rlm_sql (sql): Attempting to connect rlm_sql_mysql #6 rlm_sql_mysql: Starting connect to MySQL server for #6 rlm_sql (sql): Connected new DB handle, #6 rlm_sql (sql): starting 7 rlm_sql (sql): Attempting to connect rlm_sql_mysql #7 rlm_sql_mysql: Starting connect to MySQL server for #7 rlm_sql (sql): Connected new DB handle, #7 rlm_sql (sql): starting 8 rlm_sql (sql): Attempting to connect rlm_sql_mysql #8 rlm_sql_mysql: Starting connect to MySQL server for #8 rlm_sql (sql): Connected new DB handle, #8 rlm_sql (sql): starting 9 rlm_sql (sql): Attempting to connect rlm_sql_mysql #9 rlm_sql_mysql: Starting connect to MySQL server for #9 rlm_sql (sql): Connected new DB handle, #9 rlm_sql (sql): starting 10 rlm_sql (sql): Attempting to connect rlm_sql_mysql #10 rlm_sql_mysql: Starting connect to MySQL server for #10 rlm_sql (sql): Connected new DB handle, #10 rlm_sql (sql): starting 11 rlm_sql (sql): Attempting to connect rlm_sql_mysql #11 rlm_sql_mysql: Starting connect to MySQL server for #11 rlm_sql (sql): Connected new DB handle, #11 rlm_sql (sql): starting 12 rlm_sql (sql): Attempting to connect rlm_sql_mysql #12 rlm_sql_mysql: Starting connect to MySQL server for #12 rlm_sql (sql): Connected new DB handle, #12 rlm_sql (sql): starting 13 rlm_sql (sql): Attempting to connect rlm_sql_mysql #13 rlm_sql_mysql: Starting connect to MySQL server for #13 rlm_sql (sql): Connected new DB handle, #13 rlm_sql (sql): starting 14 rlm_sql (sql): Attempting to connect rlm_sql_mysql #14 rlm_sql_mysql: Starting connect to MySQL server for #14 rlm_sql (sql): Connected new DB handle, #14 rlm_sql (sql): starting 15 rlm_sql (sql): Attempting to connect rlm_sql_mysql #15 rlm_sql_mysql: Starting connect to MySQL server for #15 rlm_sql (sql): Connected new DB handle, #15 rlm_sql (sql): starting 16 rlm_sql (sql): Attempting to connect rlm_sql_mysql #16 rlm_sql_mysql: Starting connect to MySQL server for #16 rlm_sql (sql): Connected new DB handle, #16 rlm_sql (sql): starting 17 rlm_sql (sql): Attempting to connect rlm_sql_mysql #17 rlm_sql_mysql: Starting connect to MySQL server for #17 rlm_sql (sql): Connected new DB handle, #17 rlm_sql (sql): starting 18 rlm_sql (sql): Attempting to connect rlm_sql_mysql #18 rlm_sql_mysql: Starting connect to MySQL server for #18 rlm_sql (sql): Connected new DB handle, #18 rlm_sql (sql): starting 19 rlm_sql (sql): Attempting to connect rlm_sql_mysql #19 rlm_sql_mysql: Starting connect to MySQL server for #19 rlm_sql (sql): Connected new DB handle, #19 rlm_sql (sql): starting 20 rlm_sql (sql): Attempting to connect rlm_sql_mysql #20 rlm_sql_mysql: Starting connect to MySQL server for #20 rlm_sql (sql): Connected new DB handle, #20 rlm_sql (sql): starting 21 rlm_sql (sql): Attempting to connect rlm_sql_mysql #21 rlm_sql_mysql: Starting connect to MySQL server for #21 rlm_sql (sql): Connected new DB handle, #21 rlm_sql (sql): starting 22 rlm_sql (sql): Attempting to connect rlm_sql_mysql #22 rlm_sql_mysql: Starting connect to MySQL server for #22 rlm_sql (sql): Connected new DB handle, #22 rlm_sql (sql): starting 23 rlm_sql (sql): Attempting to connect rlm_sql_mysql #23 rlm_sql_mysql: Starting connect to MySQL server for #23 rlm_sql (sql): Connected new DB handle, #23 rlm_sql (sql): starting 24 rlm_sql (sql): Attempting to connect rlm_sql_mysql #24 rlm_sql_mysql: Starting connect to MySQL server for #24 rlm_sql (sql): Connected new DB handle, #24 rlm_sql (sql): starting 25 rlm_sql (sql): Attempting to connect rlm_sql_mysql #25 rlm_sql_mysql: Starting connect to MySQL server for #25 rlm_sql (sql): Connected new DB handle, #25 rlm_sql (sql): starting 26 rlm_sql (sql): Attempting to connect rlm_sql_mysql #26 rlm_sql_mysql: Starting connect to MySQL server for #26 rlm_sql (sql): Connected new DB handle, #26 rlm_sql (sql): starting 27 rlm_sql (sql): Attempting to connect rlm_sql_mysql #27 rlm_sql_mysql: Starting connect to MySQL server for #27 rlm_sql (sql): Connected new DB handle, #27 rlm_sql (sql): starting 28 rlm_sql (sql): Attempting to connect rlm_sql_mysql #28 rlm_sql_mysql: Starting connect to MySQL server for #28 rlm_sql (sql): Connected new DB handle, #28 rlm_sql (sql): starting 29 rlm_sql (sql): Attempting to connect rlm_sql_mysql #29 rlm_sql_mysql: Starting connect to MySQL server for #29 rlm_sql (sql): Connected new DB handle, #29 rlm_sql (sql): starting 30 rlm_sql (sql): Attempting to connect rlm_sql_mysql #30 rlm_sql_mysql: Starting connect to MySQL server for #30 rlm_sql (sql): Connected new DB handle, #30 rlm_sql (sql): starting 31 rlm_sql (sql): Attempting to connect rlm_sql_mysql #31 rlm_sql_mysql: Starting connect to MySQL server for #31 rlm_sql (sql): Connected new DB handle, #31 Module: Checking preacct {...} for more modules to load Module: Linked to module rlm_acct_unique Module: Instantiating module "acct_unique" from file /etc/raddb/modules/acct_unique acct_unique { key = "User-Name, Acct-Session-Id, NAS-IP-Address, NAS-Identifier, NAS-Port" } Module: Linked to module rlm_files Module: Instantiating module "files" from file /etc/raddb/modules/files files { usersfile = "/etc/raddb/users" acctusersfile = "/etc/raddb/acct_users" preproxy_usersfile = "/etc/raddb/preproxy_users" compat = "no" } reading pairlist file /etc/raddb/users reading pairlist file /etc/raddb/acct_users reading pairlist file /etc/raddb/preproxy_users Module: Checking accounting {...} for more modules to load Module: Linked to module rlm_detail Module: Instantiating module "detail" from file /etc/raddb/modules/detail detail { detailfile = "/var/log/radius/radacct/%{%{Packet-Src-IP-Address}:-%{Packet-Src-IPv6-Address}}/detail-%Y%m%d" header = "%t" detailperm = 384 dirperm = 493 locking = no log_packet_header = no } Module: Linked to module rlm_attr_filter Module: Instantiating module "attr_filter.accounting_response" from file /etc/raddb/modules/attr_filter attr_filter attr_filter.accounting_response { attrsfile = "/etc/raddb/attrs.accounting_response" key = "%{User-Name}" relaxed = no } reading pairlist file /etc/raddb/attrs.accounting_response Module: Checking session {...} for more modules to load Module: Checking post-proxy {...} for more modules to load Module: Checking post-auth {...} for more modules to load Module: Instantiating module "attr_filter.access_reject" from file /etc/raddb/modules/attr_filter attr_filter attr_filter.access_reject { attrsfile = "/etc/raddb/attrs.access_reject" key = "%{User-Name}" relaxed = no } reading pairlist file /etc/raddb/attrs.access_reject } # modules } # server server inner-tunnel { # from file /etc/raddb/sites-enabled/inner-tunnel modules { Module: Checking authenticate {...} for more modules to load Module: Checking authorize {...} for more modules to load Module: Checking session {...} for more modules to load Module: Linked to module rlm_radutmp Module: Instantiating module "radutmp" from file /etc/raddb/modules/radutmp radutmp { filename = "/var/log/radius/radutmp" username = "%{User-Name}" case_sensitive = yes check_with_nas = yes perm = 384 callerid = yes } Module: Checking post-proxy {...} for more modules to load Module: Checking post-auth {...} for more modules to load } # modules } # server server dynamic_client_server { # from file /etc/raddb/sites-enabled/dynamic-clients modules { Module: Checking authorize {...} for more modules to load Module: Linked to module rlm_dynamic_clients Module: Instantiating module "dynamic_clients" from file /etc/raddb/modules/dynamic_clients Module: Linked to module rlm_always Module: Instantiating module "ok" from file /etc/raddb/modules/always always ok { rcode = "ok" simulcount = 0 mpp = no } } # modules } # server radiusd: #### Opening IP addresses and Ports #### listen { type = "auth" ipaddr = * port = 0 } listen { type = "acct" ipaddr = * port = 0 } listen { type = "control" listen { socket = "/var/run/radiusd/radiusd.sock" } } listen { type = "auth" ipaddr = 127.0.0.1 port = 18120 } ... adding new socket proxy address * port 40163 Listening on authentication address * port 1812 Listening on accounting address * port 1813 Listening on command file /var/run/radiusd/radiusd.sock Listening on authentication address 127.0.0.1 port 18120 as server inner-tunnel Listening on proxy address * port 1814 Ready to process requests. rad_recv: Access-Request packet from host 18.220.171.233 port 33477, id=170, length=76 server dynamic_client_server { } # server dynamic_client_server - Cannot add client 18.220.171.233: Required attribute "FreeRADIUS-Client-Secret" is missing. Ignoring request to authentication address * port 1812 from unknown client 18.220.171.233 port 33477 Ready to process requests.

2 1

How mitigate mac spoofing in mab
by Carlos Bordon 23 Feb '19

23 Feb '19

Hi! i have a problem with this vulnerability, i need mitigate it. I have ine server with freeradius, other with dhcp and they are connect to cisco 6800 swicht. We aunthenticate the endpoint with mab, because we cant use 802.1x. the problem that i want to resolve is to mitigate mac spoofing on layer two. For us is the same mitigate the problem on the radius or the swicht config. Do you guys know any idea? Best regards, Say hi for your sisters!

5 4