- Freeradius-Users - lists.freeradius.org

Re: Problem with MSCHAP when migrating from freeradius2 to freeradius3
by koehne 04 Feb '19

04 Feb '19

Hi Alan, thanks for your quick response. > Which should be clear. The server is unable to get the Cleartext-Password from LDAP. As such, it can't do MS-CHAP. >> Do you mean, I shall get back the password from LDAP in Cleartext form?? Our eDir sends it in a hashed form. It works so with freeradius2 for years. > Read what you've done to the "inner-tunnel" virtual server, >> I´ve gone through this module several times in the last weeks and have no further idea ... and ask yourself: "Where is Cleartext-Password supposed to be coming from?" >> this is exactly what I´m asking myself ... with no clear answer and idea what to change. Sorry, I´m no Server-, Freeradius- or Linux-Expert. Normally I´m working with Network-Devices, but now trying to migrate a very old freeradius installation, because there´s no other person in our office able to do this. Thanks for your patience. Regards Ronald

1 0

Problem with MSCHAP when migrating from freeradius2 to freeradius3
by koehne 04 Feb '19

04 Feb '19

Hello, I´ve now spent so much time on troubleshooting, testing and searching for hints in the internet, I hope someone here from this mailing-list can support me. We are using freeradius to authenticate CLI-Access to Network-Devices, VPN-Access and WLAN-Access. As User-Database we are using Novell eDirectory via LDAP. I want to migrate from freeradius2 to freeradius3 on a new server. I´ve allready succeeded with migrating Network-CLI- and VPN-Access, however WLAN-Access is not working. These are the significant messages from the DEBUG saying "*mschap: No Cleartext-Password configured*". ... Executing group from file /etc/raddb/sites-enabled/inner-tunnel Fri Feb 1 10:18:31 2019 : Debug: (8) eap_mschapv2: authenticate { Fri Feb 1 10:18:31 2019 : Debug: (8) eap_mschapv2: modsingle[authenticate]: calling mschap (rlm_mschap) *Fri Feb 1 10:18:31 2019 : WARNING: (8) mschap: No Cleartext-Password configured. Cannot create NT-Password Fri Feb 1 10:18:31 2019 : WARNING: (8) mschap: No Cleartext-Password configured. Cannot create LM-Password* Fri Feb 1 10:18:31 2019 : Debug: (8) mschap: Creating challenge hash with username: koehne Fri Feb 1 10:18:31 2019 : Debug: (8) mschap: Client is using MS-CHAPv2 Fri Feb 1 10:18:31 2019 : ERROR: (8) mschap: FAILED: No NT/LM-Password. Cannot perform authentication ... Enclosed is a full debug. I´ve compared "old" and "new" configuration of the relevant modules several times and adapted the necessary changes in the configuration from freeradius2 to freeradius3. Here are the configs of the virtual-server and the ldap module: server mdwwlan { listen { .... } } authorize { filter_username preprocess auth_log detail suffix files -ldap eap { ok = return } Autz-Type LDAP { mdwacc_wlan mschap update { &MS-CHAP-User-Name := "%{mschap:User-Name}" } } } authenticate { Auth-Type MSCHAP { mschap } eap } } ldap mdwacc_wlan { server = "ldap.mdw.ac.at" port = 636 identity = "cn=ldap_radius,o=MDWds" password = frtz56uit33 basedn = "o=MDWds" access_attr = "mdwaccAllowwlan" filter = "(cn=%{%{Stripped-User-Name}:-%{User-Name}})" update { control:NT-Password := 'mdwaccPwwlan' } edir_autz = yes user { basedn = "o=MDWds" filter = "(cn=%{%{Stripped-User-Name}:-%{User-Name}})" scope = 'sub' access_attr = 'mdwaccAllowwlan' } group { basedn = "o=MDWds" filter = "(cn=%{%{Stripped-User-Name}:-%{User-Name}})" scope = 'sub' membership_attribute = 'radiusGroupName' } options { timeout = 4 srv_timelimit = 3 net_timeout = 1 } tls { start_tls = no } pool { start = ${thread[pool].start_servers} min = ${thread[pool].min_spare_servers} max = ${thread[pool].max_servers} uses = 0 lifetime = 0 } } And the "users" File: DEFAULT Huntgroup-Name == WISM, Autz-Type := LDAP Fall-Through = yes Do you have any hints for me, what could be missing or wrong in my configuration of version 3? Thank You!! Best Regards Ronald

2 1

FR3 odd log indentation
by Diggins Mike 02 Feb '19

02 Feb '19

Just started logging wireless authentications to my FR3 server today and noticed a couple changes from FR2. Two questions, what does the value in the brackets () represent and what's with the odd indentation on the Login OK lines. This is the way it appears in my syslog. Feb 1 09:22:41 frsrv3 radiusd[14322]: (10) Login OK: [nettest] (from client IPSentry port 0) Feb 1 09:25:59 frsrv3 radiusd[14322]: (42) Login OK: [user1] (from client WLC-TEST port 0 via TLS tunnel) Feb 1 09:25:59 frsrv3 radiusd[14322]: (43) Login OK: [user1] (from client WLC-TEST port 13 cli 94-65-2d-6c-94-82) Feb 1 09:26:19 frsrv3 radiusd[14322]: (57) Login OK: [user2] (from client WLC-TEST port 0 via TLS tunnel) Feb 1 09:26:19 frsrv3 radiusd[14322]: (58) Login OK: [user2] (from client WLC-TEST port 13 cli 58-e6-ba-45-66-c7) Feb 1 09:26:21 frsrv3 radiusd[14322]: (72) Login OK: [user3] (from client WLC-TEST port 0 via TLS tunnel) Feb 1 09:26:21 frsrv3 radiusd[14322]: (73) Login OK: [user3] (from client WLC-TEST port 13 cli b8-d7-af-05-d3-5d) Feb 1 09:26:24 frsrv3 radiusd[14322]: (87) Login OK: [user4] (from client WLC-TEST port 0 via TLS tunnel) Feb 1 09:26:24 frsrv3 radiusd[14322]: (88) Login OK: [user4] (from client WLC-TEST port 13 cli 58-e6-ba-45-66-c7) Feb 1 09:26:34 frsrv3 radiusd[14322]: (102) Login OK: [user4] (from client WLC-TEST port 0 via TLS tunnel) Feb 1 09:26:34 frsrv3 radiusd[14322]: (103) Login OK: [user4] (from client WLC-TEST port 13 cli 58-e6-ba-45-66-c7) Feb 1 09:27:23 frsrv3 radiusd[14322]: (117) Login OK: [user5] (from client WLC-TEST port 0 via TLS tunnel) Feb 1 09:27:23 frsrv3 radiusd[14322]: (118) Login OK: [user5] (from client WLC-TEST port 13 cli a4-5e-60-d5-01-d5) Feb 1 09:27:42 frsrv3 radiusd[14322]: (132) Login OK: [user6] (from client WLC-TEST port 0 via TLS tunnel) Feb 1 09:27:42 frsrv3 radiusd[14322]: (133) Login OK: [user6] (from client WLC-TEST port 13 cli 20-2d-07-03-01-34) -Mike

3 3

Historic connection error
by Leonardo Piña 01 Feb '19

01 Feb '19

I have migrated from FreeRadius 2 to FreeRadius 3, and I found the novelty that when carrying the production DB of version 2 does not work correctly in version 3, the amount in FreeRadius 3 stops saving the connection information

2 1

radius accounting issue.
by slnarayanan＠nitt.edu 31 Jan '19

31 Jan '19

Dear All, I have a problem with accounting .Everything is working fine on freeradius.Login& authentication sql everything is working fine.But i have a problem in accounting pocket.We are using sonciwall firwall in our campus.Those who logged through our radius server the login information (Radius Accounting) information need to display on sonicwall user's page.The UDP pocket 1813 not send to our firewall ip.In the firewall i have enable policy allow to all our local network.I have attached my radiususd -X log to this mail.Kindly provide the solution for resolve my issue.The Radius Accounting information now shows on radacct in the phpmyadmin. Regards. S.Lakshmi narayanan

4 10

Outer vs. inner ID in Login OK messages
by Martin Pauly 31 Jan '19

31 Jan '19

Hi, I have a question about the "Login OK" messages in radius.log. We offer both PEAP/MS-CHAPv2 and EAP-TTLS/PAP to our clients Server is FR 3.0.17 on Debian. Upon succesful authentication, the outer and inner virtual server each append a Login OK message to radius.log - so far, so good. Assume the outer id is set to eduroam(a)staff.uni-marburg.de. With PEAP, I get Wed Jan 23 15:43:45 2019 : Auth: (4903823) Login OK: [pauly1] (from client wlc3 port 13 cli 20:64:32:00:00:01 via TLS tunnel) Wed Jan 23 15:43:45 2019 : Auth: (4903824) Login OK: [eduroam(a)staff.uni-marburg.de] (from client wlc3 port 13 cli 20:64:32:00:00:01) With EAP-TTLS/PAP, I get Wed Jan 23 15:42:52 2019 : Auth: (4902040) Login OK: [pauly1] (from client rst2 port 13 cli 20:64:32:00:00:01 via TLS tunnel) Wed Jan 23 15:42:52 2019 : Auth: (4902040) Login OK: [pauly1] (from client rst2 port 13 cli 20:64:32:00:00:01) So it would seem that in the latter case the outer server still logs the inner id. Is this normal default behavior? Logging the outer id consistently would be really helpful in our case as we use it to trigger a different certificate to be presented to the client. In the post-auth sections of the virtual servers I have: ----------------- sites-available/default -------------- post-auth { ... update { &reply: += &session-state: } ---------------------------------------------------------- -------------- sites-available/inner-tunnel -------------- post-auth { ... update { &outer.session-state: += &reply: &outer.request:User-Name := &User-Name } ---------------------------------------------------------- The debug log does not tell me much in either case, here are the respective post-auth snippets (can provide full if needed): PEAP/MS-CHAPv2: (18) # Executing section post-auth from file /etc/freeradius/sites-enabled/inner-tunnel (18) post-auth { (18) update { (18) &outer.session-state::Airespace-Interface-Name += &reply:Airespace-Interface-Name[*] -> 'edu_staff_nat' (18) &outer.session-state::Tunnel-Medium-Type += &reply:Tunnel-Medium-Type[*] -> 802 (18) &outer.session-state::MS-MPPE-Encryption-Policy += &reply:MS-MPPE-Encryption-Policy[*] -> Encryption-Allowed (18) &outer.session-state::MS-MPPE-Encryption-Types += &reply:MS-MPPE-Encryption-Types[*] -> RC4-40or128-bit-Allowed (18) &outer.session-state::MS-MPPE-Send-Key += &reply:MS-MPPE-Send-Key[*] -> 0xb7ea5ac23b2680523f909d667460c17d (18) &outer.session-state::MS-MPPE-Recv-Key += &reply:MS-MPPE-Recv-Key[*] -> 0x2c8284d442c7f3d635501c3df519b1ec (18) &outer.session-state::EAP-Message += &reply:EAP-Message[*] -> 0x030e0004 (18) &outer.session-state::Message-Authenticator += &reply:Message-Authenticator[*] -> 0x00000000000000000000000000000000 (18) &outer.session-state::User-Name += &reply:User-Name[*] -> 'pauly1(a)staff.uni-marburg.de' (18) &outer.request:User-Name := &User-Name -> 'pauly1(a)staff.uni-marburg.de' (18) } # update = noop (18) update outer.session-state { (18) MS-MPPE-Encryption-Policy !* ANY (18) MS-MPPE-Encryption-Types !* ANY (18) MS-MPPE-Send-Key !* ANY (18) MS-MPPE-Recv-Key !* ANY (18) Message-Authenticator !* ANY (18) EAP-Message !* ANY (18) Proxy-State !* ANY (18) } # update outer.session-state = noop (18) } # post-auth = noop (18) Login OK: [pauly1(a)staff.uni-marburg.de] (from client rst2 port 13 cli 4c:34:88:e0:aa:42 via TLS tunnel) (18) } # server inner-tunnel (19) # Executing section post-auth from file /etc/freeradius/sites-enabled/default (19) post-auth { (19) update { (19) &reply::Airespace-Interface-Name += &session-state:Airespace-Interface-Name[*] -> 'edu_staff_nat' (19) &reply::Tunnel-Medium-Type += &session-state:Tunnel-Medium-Type[*] -> 802 (19) &reply::User-Name += &session-state:User-Name[*] -> 'pauly1(a)staff.uni-marburg.de' (19) } # update = noop (19) [exec] = noop (19) policy remove_reply_message_if_eap { (19) if (&reply:EAP-Message && &reply:Reply-Message) { (19) if (&reply:EAP-Message && &reply:Reply-Message) -> FALSE (19) else { (19) [noop] = noop (19) } # else = noop (19) } # policy remove_reply_message_if_eap = noop (19) } # post-auth = noop (19) Login OK: [eduroam(a)staff.uni-marburg.de] (from client rst2 port 13 cli 4c:34:88:e0:aa:42) EAP-TTLS/PAP: (231) # Executing section post-auth from file /etc/freeradius/sites-enabled/inner-tunnel (231) post-auth { (231) update { (231) &outer.session-state::Airespace-Interface-Name += &reply:Airespace-Interface-Name[*] -> 'edu_staff_nat' (231) &outer.session-state::Tunnel-Medium-Type += &reply:Tunnel-Medium-Type[*] -> 802 (231) &outer.request:User-Name := &User-Name -> 'pauly1' (231) } # update = noop (231) update outer.session-state { (231) MS-MPPE-Encryption-Policy !* ANY (231) MS-MPPE-Encryption-Types !* ANY (231) MS-MPPE-Send-Key !* ANY (231) MS-MPPE-Recv-Key !* ANY (231) Message-Authenticator !* ANY (231) EAP-Message !* ANY (231) Proxy-State !* ANY (231) } # update outer.session-state = noop (231) } # post-auth = noop (231) Login OK: [pauly1] (from client rst2 port 13 cli 20:64:32:3f:80:ef via TLS tunnel) (231) } # server inner-tunnel (231) # Executing section post-auth from file /etc/freeradius/sites-enabled/default (231) post-auth { (231) update { (231) &reply::Airespace-Interface-Name += &session-state:Airespace-Interface-Name[*] -> 'edu_staff_nat' (231) &reply::Tunnel-Medium-Type += &session-state:Tunnel-Medium-Type[*] -> 802 (231) } # update = noop (231) [exec] = noop (231) policy remove_reply_message_if_eap { (231) if (&reply:EAP-Message && &reply:Reply-Message) { (231) if (&reply:EAP-Message && &reply:Reply-Message) -> FALSE (231) else { (231) [noop] = noop (231) } # else = noop (231) } # policy remove_reply_message_if_eap = noop (231) } # post-auth = noop (231) Login OK: [pauly1] (from client rst2 port 13 cli 20:64:32:3f:80:ef) Any ideas? TIA, Martin -- Dr. Martin Pauly Phone: +49-6421-28-23527 HRZ Univ. Marburg Fax: +49-6421-28-26994 Hans-Meerwein-Str. E-Mail: pauly(a)HRZ.Uni-Marburg.DE D-35032 Marburg

2 6

Parse error (reply) for entry DEFAULT: Unknown name "Framed-IP-Address"
by Sezer BAGLAN 31 Jan '19

31 Jan '19

Dear all, We are able to build freeradius 3.017 version in cygwin environment. When we start radiusd in debug mode (-X) we got a parse error: *# Instantiating module "attr_filter.post-proxy" from file /usr/local/freeradius/etc/raddb/mods-enabled/attr_filter* *Wed Jan 30 22:43:38 2019 : Error: /usr/local/freeradius/etc/raddb/mods-config/attr_filter/post-proxy[103]: Parse error (reply) for entry DEFAULT: Unknown name "Framed-IP-Address"* *Wed Jan 30 22:43:38 2019 : Error: Errors reading /usr/local/freeradius/etc/raddb/mods-config/attr_filter/post-proxy* When we investigate possible reasons, it seems like it may be arisen when related name is not involved in the dictionaries. We've checked and it seems like "Framed-IP-Address" is involved in the dictionaries included. Secondly, we became suspicious about the configuration file EOLs. We checked it and it seems OK. The lines are ending with "line feed" only as in unix environment. We really appreciate that if you make us find a way to fix this issue. P.S. We are also able to build and run 2.05 version succesfully in cygwin environment. Thanks in advance, Sezer Debug output is given: $ ./radiusd.exe -X FreeRADIUS Version 3.0.17 Copyright (C) 1999-2017 The FreeRADIUS server project and contributors There is NO warranty; not even for MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE You may redistribute copies of FreeRADIUS under the terms of the GNU General Public License For more information about these matters, see the file named COPYRIGHT Starting - reading configuration files ... including dictionary file /usr/local/freeradius/share/freeradius/dictionary including dictionary file /usr/local/freeradius/share/freeradius/dictionary.dhcp including dictionary file /usr/local/freeradius/share/freeradius/dictionary.vqp including dictionary file /usr/local/freeradius/etc/raddb/dictionary including configuration file /usr/local/freeradius/etc/raddb/radiusd.conf including configuration file /usr/local/freeradius/etc/raddb/proxy.conf including configuration file /usr/local/freeradius/etc/raddb/clients.conf including files in directory /usr/local/freeradius/etc/raddb/mods-enabled/ including configuration file /usr/local/freeradius/etc/raddb/mods-enabled/always including configuration file /usr/local/freeradius/etc/raddb/mods-enabled/attr_filter including configuration file /usr/local/freeradius/etc/raddb/mods-enabled/cache_eap including configuration file /usr/local/freeradius/etc/raddb/mods-enabled/chap including configuration file /usr/local/freeradius/etc/raddb/mods-enabled/date including configuration file /usr/local/freeradius/etc/raddb/mods-enabled/detail including configuration file /usr/local/freeradius/etc/raddb/mods-enabled/detail.log including configuration file /usr/local/freeradius/etc/raddb/mods-enabled/digest including configuration file /usr/local/freeradius/etc/raddb/mods-enabled/dynamic_clients including configuration file /usr/local/freeradius/etc/raddb/mods-enabled/eap including configuration file /usr/local/freeradius/etc/raddb/mods-enabled/echo including configuration file /usr/local/freeradius/etc/raddb/mods-enabled/exec including configuration file /usr/local/freeradius/etc/raddb/mods-enabled/expiration including configuration file /usr/local/freeradius/etc/raddb/mods-enabled/expr including configuration file /usr/local/freeradius/etc/raddb/mods-enabled/files including configuration file /usr/local/freeradius/etc/raddb/mods-enabled/linelog including configuration file /usr/local/freeradius/etc/raddb/mods-enabled/logintime including configuration file /usr/local/freeradius/etc/raddb/mods-enabled/mschap including configuration file /usr/local/freeradius/etc/raddb/mods-enabled/ntlm_auth including configuration file /usr/local/freeradius/etc/raddb/mods-enabled/pap including configuration file /usr/local/freeradius/etc/raddb/mods-enabled/passwd including configuration file /usr/local/freeradius/etc/raddb/mods-enabled/preprocess including configuration file /usr/local/freeradius/etc/raddb/mods-enabled/radutmp including configuration file /usr/local/freeradius/etc/raddb/mods-enabled/realm including configuration file /usr/local/freeradius/etc/raddb/mods-enabled/replicate including configuration file /usr/local/freeradius/etc/raddb/mods-enabled/soh including configuration file /usr/local/freeradius/etc/raddb/mods-enabled/sradutmp including configuration file /usr/local/freeradius/etc/raddb/mods-enabled/unpack including configuration file /usr/local/freeradius/etc/raddb/mods-enabled/utf8 including files in directory /usr/local/freeradius/etc/raddb/policy.d/ including configuration file /usr/local/freeradius/etc/raddb/policy.d/abfab-tr including configuration file /usr/local/freeradius/etc/raddb/policy.d/accounting including configuration file /usr/local/freeradius/etc/raddb/policy.d/canonicalization including configuration file /usr/local/freeradius/etc/raddb/policy.d/control including configuration file /usr/local/freeradius/etc/raddb/policy.d/cui including configuration file /usr/local/freeradius/etc/raddb/policy.d/debug including configuration file /usr/local/freeradius/etc/raddb/policy.d/dhcp including configuration file /usr/local/freeradius/etc/raddb/policy.d/eap including configuration file /usr/local/freeradius/etc/raddb/policy.d/filter including configuration file /usr/local/freeradius/etc/raddb/policy.d/moonshot-targeted-ids including configuration file /usr/local/freeradius/etc/raddb/policy.d/operator-name including files in directory /usr/local/freeradius/etc/raddb/sites-enabled/ including configuration file /usr/local/freeradius/etc/raddb/sites-enabled/default including configuration file /usr/local/freeradius/etc/raddb/sites-enabled/inner-tunnel main { name = "radiusd" prefix = "/usr/local/freeradius" localstatedir = "/usr/local/freeradius/var" sbindir = "/usr/local/freeradius/sbin" logdir = "/usr/local/freeradius/var/log/radius" run_dir = "/usr/local/freeradius/var/run/radiusd" libdir = "/usr/local/freeradius/lib" radacctdir = "/usr/local/freeradius/var/log/radius/radacct" hostname_lookups = no max_request_time = 30 cleanup_delay = 5 max_requests = 16384 pidfile = "/usr/local/freeradius/var/run/radiusd/radiusd.pid" checkrad = "/usr/local/freeradius/sbin/checkrad" debug_level = 0 proxy_requests = yes log { stripped_names = no auth = no auth_badpass = no auth_goodpass = no colourise = yes msg_denied = "You are already logged in - access denied" } resources { } security { max_attributes = 200 reject_delay = 1.000000 status_server = yes allow_vulnerable_openssl = "no" } } radiusd: #### Loading Realms and Home Servers #### proxy server { retry_delay = 5 retry_count = 3 default_fallback = no dead_time = 120 wake_all_if_all_dead = no } home_server localhost { ipaddr = 127.0.0.1 port = 1812 type = "auth" secret = <<< secret >>> response_window = 20.000000 response_timeouts = 1 max_outstanding = 65536 zombie_period = 40 status_check = "status-server" ping_interval = 30 check_interval = 30 check_timeout = 4 num_answers_to_alive = 3 revive_interval = 120 limit { max_connections = 16 max_requests = 0 lifetime = 0 idle_timeout = 0 } coa { irt = 2 mrt = 16 mrc = 5 mrd = 30 } } home_server_pool my_auth_failover { type = fail-over home_server = localhost } realm example.com { auth_pool = my_auth_failover } realm LOCAL { } radiusd: #### Loading Clients #### client localhost { ipaddr = 127.0.0.1 require_message_authenticator = no secret = <<< secret >>> nas_type = "other" proto = "*" limit { max_connections = 16 lifetime = 0 idle_timeout = 30 } } client localhost_ipv6 { ipv6addr = ::1 require_message_authenticator = no secret = <<< secret >>> limit { max_connections = 16 lifetime = 0 idle_timeout = 30 } } Debug state unknown (ptrace functionality not available) # Creating Auth-Type = mschap # Creating Auth-Type = digest # Creating Auth-Type = eap # Creating Auth-Type = PAP # Creating Auth-Type = CHAP # Creating Auth-Type = MS-CHAP radiusd: #### Instantiating modules #### modules { # Loaded module rlm_always # Loading module "reject" from file /usr/local/freeradius/etc/raddb/mods-enabled/always always reject { rcode = "reject" simulcount = 0 mpp = no } # Loading module "fail" from file /usr/local/freeradius/etc/raddb/mods-enabled/always always fail { rcode = "fail" simulcount = 0 mpp = no } # Loading module "ok" from file /usr/local/freeradius/etc/raddb/mods-enabled/always always ok { rcode = "ok" simulcount = 0 mpp = no } # Loading module "handled" from file /usr/local/freeradius/etc/raddb/mods-enabled/always always handled { rcode = "handled" simulcount = 0 mpp = no } # Loading module "invalid" from file /usr/local/freeradius/etc/raddb/mods-enabled/always always invalid { rcode = "invalid" simulcount = 0 mpp = no } # Loading module "userlock" from file /usr/local/freeradius/etc/raddb/mods-enabled/always always userlock { rcode = "userlock" simulcount = 0 mpp = no } # Loading module "notfound" from file /usr/local/freeradius/etc/raddb/mods-enabled/always always notfound { rcode = "notfound" simulcount = 0 mpp = no } # Loading module "noop" from file /usr/local/freeradius/etc/raddb/mods-enabled/always always noop { rcode = "noop" simulcount = 0 mpp = no } # Loading module "updated" from file /usr/local/freeradius/etc/raddb/mods-enabled/always always updated { rcode = "updated" simulcount = 0 mpp = no } # Loaded module rlm_attr_filter # Loading module "attr_filter.post-proxy" from file /usr/local/freeradius/etc/raddb/mods-enabled/attr_filter attr_filter attr_filter.post-proxy { filename = "/usr/local/freeradius/etc/raddb/mods-config/attr_filter/post-proxy" key = "%{Realm}" relaxed = no } # Loading module "attr_filter.pre-proxy" from file /usr/local/freeradius/etc/raddb/mods-enabled/attr_filter attr_filter attr_filter.pre-proxy { filename = "/usr/local/freeradius/etc/raddb/mods-config/attr_filter/pre-proxy" key = "%{Realm}" relaxed = no } # Loading module "attr_filter.access_reject" from file /usr/local/freeradius/etc/raddb/mods-enabled/attr_filter attr_filter attr_filter.access_reject { filename = "/usr/local/freeradius/etc/raddb/mods-config/attr_filter/access_reject" key = "%{User-Name}" relaxed = no } # Loading module "attr_filter.access_challenge" from file /usr/local/freeradius/etc/raddb/mods-enabled/attr_filter attr_filter attr_filter.access_challenge { filename = "/usr/local/freeradius/etc/raddb/mods-config/attr_filter/access_challenge" key = "%{User-Name}" relaxed = no } # Loading module "attr_filter.accounting_response" from file /usr/local/freeradius/etc/raddb/mods-enabled/attr_filter attr_filter attr_filter.accounting_response { filename = "/usr/local/freeradius/etc/raddb/mods-config/attr_filter/accounting_response" key = "%{User-Name}" relaxed = no } # Loaded module rlm_cache # Loading module "cache_eap" from file /usr/local/freeradius/etc/raddb/mods-enabled/cache_eap cache cache_eap { driver = "rlm_cache_rbtree" key = "%{%{control:State}:-%{%{reply:State}:-%{State}}}" ttl = 15 max_entries = 0 epoch = 0 add_stats = no } # Loaded module rlm_chap # Loading module "chap" from file /usr/local/freeradius/etc/raddb/mods-enabled/chap # Loaded module rlm_date # Loading module "date" from file /usr/local/freeradius/etc/raddb/mods-enabled/date date { format = "%b %e %Y %H:%M:%S %Z" utc = no } # Loaded module rlm_detail # Loading module "detail" from file /usr/local/freeradius/etc/raddb/mods-enabled/detail detail { filename = "/usr/local/freeradius/var/log/radius/radacct/%{%{Packet-Src-IP-Address}:-%{Packet-Src-IPv6-Address}}/detail-%Y%m%d" header = "%t" permissions = 384 locking = no escape_filenames = no log_packet_header = no } # Loading module "auth_log" from file /usr/local/freeradius/etc/raddb/mods-enabled/detail.log detail auth_log { filename = "/usr/local/freeradius/var/log/radius/radacct/%{%{Packet-Src-IP-Address}:-%{Packet-Src-IPv6-Address}}/auth-detail-%Y%m%d" header = "%t" permissions = 384 locking = no escape_filenames = no log_packet_header = no } # Loading module "reply_log" from file /usr/local/freeradius/etc/raddb/mods-enabled/detail.log detail reply_log { filename = "/usr/local/freeradius/var/log/radius/radacct/%{%{Packet-Src-IP-Address}:-%{Packet-Src-IPv6-Address}}/reply-detail-%Y%m%d" header = "%t" permissions = 384 locking = no escape_filenames = no log_packet_header = no } # Loading module "pre_proxy_log" from file /usr/local/freeradius/etc/raddb/mods-enabled/detail.log detail pre_proxy_log { filename = "/usr/local/freeradius/var/log/radius/radacct/%{%{Packet-Src-IP-Address}:-%{Packet-Src-IPv6-Address}}/pre-proxy-detail-%Y%m%d" header = "%t" permissions = 384 locking = no escape_filenames = no log_packet_header = no } # Loading module "post_proxy_log" from file /usr/local/freeradius/etc/raddb/mods-enabled/detail.log detail post_proxy_log { filename = "/usr/local/freeradius/var/log/radius/radacct/%{%{Packet-Src-IP-Address}:-%{Packet-Src-IPv6-Address}}/post-proxy-detail-%Y%m%d" header = "%t" permissions = 384 locking = no escape_filenames = no log_packet_header = no } # Loaded module rlm_digest # Loading module "digest" from file /usr/local/freeradius/etc/raddb/mods-enabled/digest # Loaded module rlm_dynamic_clients # Loading module "dynamic_clients" from file /usr/local/freeradius/etc/raddb/mods-enabled/dynamic_clients # Loaded module rlm_eap # Loading module "eap" from file /usr/local/freeradius/etc/raddb/mods-enabled/eap eap { default_eap_type = "md5" timer_expire = 60 ignore_unknown_eap_types = no cisco_accounting_username_bug = no max_sessions = 16384 } # Loaded module rlm_exec # Loading module "echo" from file /usr/local/freeradius/etc/raddb/mods-enabled/echo exec echo { wait = yes program = "/bin/echo %{User-Name}" input_pairs = "request" output_pairs = "reply" shell_escape = yes } Wed Jan 30 22:43:38 2019 : Error: /usr/local/freeradius/etc/raddb/mods-enabled/echo[34]: Timeout '10' is too large (maximum: 0) Wed Jan 30 22:43:38 2019 : Error: /usr/local/freeradius/etc/raddb/mods-enabled/echo[34]: Sezerb let me go # Loading module "exec" from file /usr/local/freeradius/etc/raddb/mods-enabled/exec exec { wait = no input_pairs = "request" shell_escape = yes timeout = 10 } Wed Jan 30 22:43:38 2019 : Error: /usr/local/freeradius/etc/raddb/mods-enabled/exec[24]: Timeout '10' is too large (maximum: 0) Wed Jan 30 22:43:38 2019 : Error: /usr/local/freeradius/etc/raddb/mods-enabled/exec[24]: Sezerb let me go # Loaded module rlm_expiration # Loading module "expiration" from file /usr/local/freeradius/etc/raddb/mods-enabled/expiration # Loaded module rlm_expr # Loading module "expr" from file /usr/local/freeradius/etc/raddb/mods-enabled/expr expr { safe_characters = "@abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ0123456789.-_: /äéöüàâæçèéêëîïôœùûüaÿÄÉÖÜßÀÂÆÇÈÉÊËÎÏÔŒÙÛÜŸ" } # Loaded module rlm_files # Loading module "files" from file /usr/local/freeradius/etc/raddb/mods-enabled/files files { filename = "/usr/local/freeradius/etc/raddb/mods-config/files/authorize" acctusersfile = "/usr/local/freeradius/etc/raddb/mods-config/files/accounting" preproxy_usersfile = "/usr/local/freeradius/etc/raddb/mods-config/files/pre-proxy" } # Loaded module rlm_linelog # Loading module "linelog" from file /usr/local/freeradius/etc/raddb/mods-enabled/linelog linelog { filename = "/usr/local/freeradius/var/log/radius/linelog" escape_filenames = no syslog_severity = "info" permissions = 384 format = "This is a log message for %{User-Name}" reference = "messages.%{%{reply:Packet-Type}:-default}" } # Loading module "log_accounting" from file /usr/local/freeradius/etc/raddb/mods-enabled/linelog linelog log_accounting { filename = "/usr/local/freeradius/var/log/radius/linelog-accounting" escape_filenames = no syslog_severity = "info" permissions = 384 format = "" reference = "Accounting-Request.%{%{Acct-Status-Type}:-unknown}" } # Loaded module rlm_logintime # Loading module "logintime" from file /usr/local/freeradius/etc/raddb/mods-enabled/logintime logintime { minimum_timeout = 60 } # Loaded module rlm_mschap # Loading module "mschap" from file /usr/local/freeradius/etc/raddb/mods-enabled/mschap mschap { use_mppe = yes require_encryption = no require_strong = no with_ntdomain_hack = yes passchange { } allow_retry = yes winbind_retry_with_normalised_username = no } # Loading module "ntlm_auth" from file /usr/local/freeradius/etc/raddb/mods-enabled/ntlm_auth exec ntlm_auth { wait = yes program = "/path/to/ntlm_auth --request-nt-key --domain=MYDOMAIN --username=%{mschap:User-Name} --password=%{User-Password}" shell_escape = yes } Wed Jan 30 22:43:38 2019 : Error: /usr/local/freeradius/etc/raddb/mods-enabled/ntlm_auth[15]: Timeout '10' is too large (maximum: 0) Wed Jan 30 22:43:38 2019 : Error: /usr/local/freeradius/etc/raddb/mods-enabled/ntlm_auth[15]: Sezerb let me go # Loaded module rlm_pap # Loading module "pap" from file /usr/local/freeradius/etc/raddb/mods-enabled/pap pap { normalise = yes } # Loaded module rlm_passwd # Loading module "etc_passwd" from file /usr/local/freeradius/etc/raddb/mods-enabled/passwd passwd etc_passwd { filename = "/etc/passwd" format = "*User-Name:Crypt-Password:" delimiter = ":" ignore_nislike = no ignore_empty = yes allow_multiple_keys = no hash_size = 100 } # Loaded module rlm_preprocess # Loading module "preprocess" from file /usr/local/freeradius/etc/raddb/mods-enabled/preprocess preprocess { huntgroups = "/usr/local/freeradius/etc/raddb/mods-config/preprocess/huntgroups" hints = "/usr/local/freeradius/etc/raddb/mods-config/preprocess/hints" with_ascend_hack = no ascend_channels_per_line = 23 with_ntdomain_hack = no with_specialix_jetstream_hack = no with_cisco_vsa_hack = no with_alvarion_vsa_hack = no } # Loaded module rlm_radutmp # Loading module "radutmp" from file /usr/local/freeradius/etc/raddb/mods-enabled/radutmp radutmp { filename = "/usr/local/freeradius/var/log/radius/radutmp" username = "%{User-Name}" case_sensitive = yes check_with_nas = yes permissions = 384 caller_id = yes } # Loaded module rlm_realm # Loading module "IPASS" from file /usr/local/freeradius/etc/raddb/mods-enabled/realm realm IPASS { format = "prefix" delimiter = "/" ignore_default = no ignore_null = no } # Loading module "suffix" from file /usr/local/freeradius/etc/raddb/mods-enabled/realm realm suffix { format = "suffix" delimiter = "@" ignore_default = no ignore_null = no } # Loading module "realmpercent" from file /usr/local/freeradius/etc/raddb/mods-enabled/realm realm realmpercent { format = "suffix" delimiter = "%" ignore_default = no ignore_null = no } # Loading module "ntdomain" from file /usr/local/freeradius/etc/raddb/mods-enabled/realm realm ntdomain { format = "prefix" delimiter = "\\" ignore_default = no ignore_null = no } # Loaded module rlm_replicate # Loading module "replicate" from file /usr/local/freeradius/etc/raddb/mods-enabled/replicate # Loaded module rlm_soh # Loading module "soh" from file /usr/local/freeradius/etc/raddb/mods-enabled/soh soh { dhcp = yes } # Loading module "sradutmp" from file /usr/local/freeradius/etc/raddb/mods-enabled/sradutmp radutmp sradutmp { filename = "/usr/local/freeradius/var/log/radius/sradutmp" username = "%{User-Name}" case_sensitive = yes check_with_nas = yes permissions = 420 caller_id = no } # Loaded module rlm_unpack # Loading module "unpack" from file /usr/local/freeradius/etc/raddb/mods-enabled/unpack # Loaded module rlm_utf8 # Loading module "utf8" from file /usr/local/freeradius/etc/raddb/mods-enabled/utf8 instantiate { } # Instantiating module "reject" from file /usr/local/freeradius/etc/raddb/mods-enabled/always # Instantiating module "fail" from file /usr/local/freeradius/etc/raddb/mods-enabled/always # Instantiating module "ok" from file /usr/local/freeradius/etc/raddb/mods-enabled/always # Instantiating module "handled" from file /usr/local/freeradius/etc/raddb/mods-enabled/always # Instantiating module "invalid" from file /usr/local/freeradius/etc/raddb/mods-enabled/always # Instantiating module "userlock" from file /usr/local/freeradius/etc/raddb/mods-enabled/always # Instantiating module "notfound" from file /usr/local/freeradius/etc/raddb/mods-enabled/always # Instantiating module "noop" from file /usr/local/freeradius/etc/raddb/mods-enabled/always # Instantiating module "updated" from file /usr/local/freeradius/etc/raddb/mods-enabled/always # Instantiating module "attr_filter.post-proxy" from file /usr/local/freeradius/etc/raddb/mods-enabled/attr_filter Wed Jan 30 22:43:38 2019 : Error: /usr/local/freeradius/etc/raddb/mods-config/attr_filter/post-proxy[103]: Parse error (reply) for entry DEFAULT: Unknown name "Framed-IP-Address" Wed Jan 30 22:43:38 2019 : Error: Errors reading /usr/local/freeradius/etc/raddb/mods-config/attr_filter/post-proxy /usr/local/freeradius/etc/raddb/mods-enabled/attr_filter[12]: Instantiation failed for module "attr_filter.post-proxy"

2 3

Will radiusd reload certificates on SIGHUP?
by Ian Pilcher 30 Jan '19

30 Jan '19

Assuming that the FreeRADIUS configuration files have not changed, will a SIGHUP make the server reload its certificates, keys, etc.? Or is a full restart required? Thanks! -- ======================================================================== Ian Pilcher arequipeno(a)gmail.com -------- "I grew up before Mark Zuckerberg invented friendship" -------- ========================================================================

2 1

FreeRadius - MSCHAPv2 always authenticate user (WPA2-EAP)
by Ben Tyson 30 Jan '19

30 Jan '19

REPOST FROM STACK EXCHANGE. Version of FreeRadius:Latest from Download Operating System: ARM (raspberry PI) or Linux (can be switched, as needed) I'm trying to create an open WPA2-EAP wireless network. Yes, I know that's a contradiction in terms, but bear with me. We need client separation, rather than authentication - so need the WPA2-EAP facilities, without authentication users. Windows 7 & 10 clients and DD-wrt as the wireless access point **Note the windows clients do not have admin rights, so I can't install client and CA certs on them** It is possible to tell FreeRadius to accept all, by using DEFAULT Auth-Type = Accept - however that just returns an authorised to the access point - and doesn't return a MSCHAPv2-Successful, so the client can connect to the network, but then doesn't get the correct response to continue, so keeps on trying to authenticate. Does anyone know if there is a way of forcing the MSCHAP module to return authorised (e.g. a debugging mode) - or would it be reasonable to strip the module, so that it always returns Successful. Any other thoughts, gratefully received, but note: anything that involves going hands on with the clients won't work. Thank you, apologies for failure in etiquette along the way.

2 1

Help on Getting Cleartext-Password attribute in my module
by shivu prasad 30 Jan '19

30 Jan '19

Hi All, In my module I want to restrict only Cleartext-Password passwords, and need reject(ignore) the other type of passwords request like mds sha and all. I am able to get only User-Password attribute not Cleartext-Password in mod_authorize I am checking for the vp->da->attr type I even try to extract cleartext_passord from request packet if not i check in request_config like below pass = fr_pair_find_by_num(request->packet->vps, PW_CLEARTEXT_PASSWORD, 0, TAG_ANY); password = fr_pair_find_by_num(request->config, PW_CLEARTEXT_PASSWORD, 0, TAG_ANY); But both the way I not able to get Cleartext-Password I verified sending the request in rad-client radtest bob hello localhost 0 testing123 Sent Access-Request Id 95 from 0.0.0.0:33290 to 127.0.0.1:1812 length 73 User-Name = "bob" User-Password = "hello" NAS-IP-Address = * NAS-Port = 0 Message-Authenticator = 0x00 Cleartext-Password = "hello" but in my module only User-Password = "hello" is coming User-Name = "bob" User-Password = "hello" NAS-IP-Address = 10.196.49.149 NAS-Port = 0 Message-Authenticator = 0x3ada3e00aafb8861cae40493d3d35421 I am not getting where the Cleartext-Password password geting terminated or do I need to add any config to update the User-Password to Cleartext-Password?. Regards, Shivaprasad

3 2