- Freeradius-Users - lists.freeradius.org

Last call before 3.0.18
by Alan DeKok 18 Jan '19

18 Jan '19

Please check the v3.0.x branch. We've put some fixes in for the various CoA issues people have reported. We're planning on releasing 3.0.18 next week. Alan DeKok.

1 0

Return no answer to the client if proxied access request times out
by Gianni Costanzi 18 Jan '19

18 Jan '19

Hi, we're running Freeradius 3.0.13 (the most recent version available for our production environment running RedHat Enterprise 7.5) and we configured two home_server blocks in a pool to which we proxy Access requests for realm sas: home_server sas_tn_1 { type = auth+acct ipaddr = x.x.x.x port = 1812 secret = --SECRET-- require_message_authenticator = yes response_window = 20 revive_interval = 120 status_check = none } home_server sas_mi_1 { # auth+acct type handles auth requests on specified port and acct requests on port+1 type = auth+acct ipaddr = y.y.y.y port = 1812 secret = --SECRET-- require_message_authenticator = yes response_window = 20 revive_interval = 120 status_check = none } home_server_pool sas_pool_failover { type = fail-over home_server = sas_tn_1 home_server = sas_mi_1 } # SAS realm for OTP+Token access to routers realm sas { pool = sas_pool_failover } we did not configure no_response_fail parameter, so if I've understood well from the docs, Freeradius should not reply to the Access-Request of the client NAS if the proxied access request times out, right? What I see is an Access-Reject from Freeradius server after the response_window expires, why? What am I missing? Best regards, Gianni Costanzi

2 6

Authenticate iptv , smart tv(browser less devices) over freeradius
by mohamad buvaydanı 18 Jan '19

18 Jan '19

Hello every body . I am working on hotspot sysetm with mikrotik and freeradius, I can do AAA for all devices without problem , but I have problem when trying to authenticate smart tv with freeradius , these devices don’t have any internet browser so they can not redirect to captive portal login page , how can I make authentication for such these devices , Isearched a lot but without success ,are there any chanse to get this idea ?

2 1

Kerberos realm vs NT domain
by WAGHORN, Jason (NHS BORDERS) 18 Jan '19

18 Jan '19

Hello all, apologies for this - I'm having an issue where I have a single Kerberos realm (published as the RADIUS realm) but multiple AD containers behind that, within which the users sit. The RADIUS/Kerberos server is joined to the domain and authentication via ntlm_auth works for both containers (if one specifies the container explicitly) # ntlm_auth --username=testusera --domain=a.example.com Password: NT_STATUS_OK: The operation completed successfully. (0x0) # ntlm_auth --username=testuserb --domain=b.example.com Password: NT_STATUS_OK: The operation completed successfully. (0x0) # So: Kerberos/RADIUS realm = example.com; users are in containers a.example.com & b.example.com Can I use the krb5.conf to handle the users as "user(a)example.com" and automatically have it try both containers (i.e. a.example.com & b.example.com)? I'm surmising that I need to do this in the realms and/or domain_realm sections - but the documentation isn't making a whole lot of sense to me at this stage (could be related to a caffeine deficit) Thanks in advance Jason ******************************************************************************************************************** This message may contain confidential information. If you are not the intended recipient please inform the sender that you have received the message in error before deleting it. Please do not disclose, copy or distribute information in this e-mail or take any action in relation to its contents. To do so is strictly prohibited and may be unlawful. Thank you for your co-operation. NHSmail is the secure email and directory service available for all NHS staff in England and Scotland. NHSmail is approved for exchanging patient data and other sensitive information with NHSmail and other accredited email services. For more information and to find out how you can switch, https://portal.nhs.net/help/joiningnhsmail

3 5

PEAP error
by slnarayanan＠nitt.edu 18 Jan '19

18 Jan '19

Hai to all, We are using freeradius 3.0.13 version EAP=PEAP (MSCHAPV2)only in our network .Few day's back we configure the server.At the time mobile devices and windows 10 system are logged through our domain account.After two day's our mobile devices only login happen but windown 10 it is not logged .It is showing some TLS error.i have given the error below.We are not using any certificate(Server,Client) before and now also.i don't why the windows 10 system won't login. We don't want using and PAP or CHAP or MD5.We need only PEAP.If it is must for server certificate for using windows 10?or below windows 7? only required for certificate.Kindly suggest to me to resolve my issue. Error code: Fri Jan 18 14:36:47 2019 : Auth: (319) Login incorrect (eap_peap: TLS Alert read:fatal:access denied): [user/] (from client team4 port 608 cli C8-3A-35-C8-10-28) Fri Jan 18 14:36:47 2019 : ERROR: (319) eap_peap: ERROR: TLS Alert read:fatal:access denied Fri Jan 18 14:36:20 2019 : Auth: (246) Login incorrect (eap_peap: TLS Alert read:fatal:unknown CA): [host/AJIALAN.octa.edu/] (from client team4 port 607 cli C8-3A-35-C8-10-28) Fri Jan 18 14:36:20 2019 : ERROR: (246) eap_peap: ERROR: Failed in __FUNCTION__ (SSL_read) Fri Jan 18 14:36:20 2019 : ERROR: (246) eap_peap: ERROR: TLS_accept: Failed in SSLv3 read client key exchange A Fri Jan 18 14:36:20 2019 : ERROR: (246) eap_peap: ERROR: TLS Alert read:fatal:unknown CA Regards, S.Lakshmi narayanan

2 1

NTLM permission denied
by Luke Smith 17 Jan '19

17 Jan '19

I apologize if this is an easy answer, but I've been wracking my brain for a couple of days with this and just need another set of eyes. This is my first time building a radius so forgive any newbish remarks but I followed the AD Integration HOWTO posted. When I test on the new radius with the ntlm_auth command it works fine, but when I go to a device and try to login, I get the error "Failed to execute "ntlm_auth": Permission denied" Below is the entire radiusd -X logs. [root@radius ~]# ntlm_auth --request-nt-key --domain=colval --username=lukes Password: NT_STATUS_OK: The operation completed successfully. (0x0) [root@radius ~]# radiusd -X FreeRADIUS Version 3.0.13 Copyright (C) 1999-2017 The FreeRADIUS server project and contributors There is NO warranty; not even for MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE You may redistribute copies of FreeRADIUS under the terms of the GNU General Public License For more information about these matters, see the file named COPYRIGHT Starting - reading configuration files ... including dictionary file /usr/share/freeradius/dictionary including dictionary file /usr/share/freeradius/dictionary.dhcp including dictionary file /usr/share/freeradius/dictionary.vqp including dictionary file /etc/raddb/dictionary including configuration file /etc/raddb/radiusd.conf including configuration file /etc/raddb/proxy.conf including configuration file /etc/raddb/clients.conf including files in directory /etc/raddb/mods-enabled/ including configuration file /etc/raddb/mods-enabled/always including configuration file /etc/raddb/mods-enabled/attr_filter including configuration file /etc/raddb/mods-enabled/cache_eap including configuration file /etc/raddb/mods-enabled/chap including configuration file /etc/raddb/mods-enabled/date including configuration file /etc/raddb/mods-enabled/detail including configuration file /etc/raddb/mods-enabled/detail.log including configuration file /etc/raddb/mods-enabled/dhcp including configuration file /etc/raddb/mods-enabled/digest including configuration file /etc/raddb/mods-enabled/dynamic_clients including configuration file /etc/raddb/mods-enabled/eap including configuration file /etc/raddb/mods-enabled/echo including configuration file /etc/raddb/mods-enabled/exec including configuration file /etc/raddb/mods-enabled/expiration including configuration file /etc/raddb/mods-enabled/expr including configuration file /etc/raddb/mods-enabled/files including configuration file /etc/raddb/mods-enabled/linelog including configuration file /etc/raddb/mods-enabled/logintime including configuration file /etc/raddb/mods-enabled/mschap including configuration file /etc/raddb/mods-enabled/ntlm_auth including configuration file /etc/raddb/mods-enabled/pap including configuration file /etc/raddb/mods-enabled/passwd including configuration file /etc/raddb/mods-enabled/preprocess including configuration file /etc/raddb/mods-enabled/radutmp including configuration file /etc/raddb/mods-enabled/realm including configuration file /etc/raddb/mods-enabled/replicate including configuration file /etc/raddb/mods-enabled/soh including configuration file /etc/raddb/mods-enabled/sradutmp including configuration file /etc/raddb/mods-enabled/unix including configuration file /etc/raddb/mods-enabled/unpack including configuration file /etc/raddb/mods-enabled/utf8 including files in directory /etc/raddb/policy.d/ including configuration file /etc/raddb/policy.d/accounting including configuration file /etc/raddb/policy.d/canonicalization including configuration file /etc/raddb/policy.d/control including configuration file /etc/raddb/policy.d/cui including configuration file /etc/raddb/policy.d/debug including configuration file /etc/raddb/policy.d/dhcp including configuration file /etc/raddb/policy.d/eap including configuration file /etc/raddb/policy.d/filter including configuration file /etc/raddb/policy.d/operator-name including files in directory /etc/raddb/sites-enabled/ including configuration file /etc/raddb/sites-enabled/default including configuration file /etc/raddb/sites-enabled/inner-tunnel main { security { user = "radiusd" group = "radiusd" allow_core_dumps = no } name = "radiusd" prefix = "/usr" localstatedir = "/var" logdir = "/var/log/radius" run_dir = "/var/run/radiusd" } main { name = "radiusd" prefix = "/usr" localstatedir = "/var" sbindir = "/usr/sbin" logdir = "/var/log/radius" run_dir = "/var/run/radiusd" libdir = "/usr/lib64/freeradius" radacctdir = "/var/log/radius/radacct" hostname_lookups = no max_request_time = 30 cleanup_delay = 5 max_requests = 16384 pidfile = "/var/run/radiusd/radiusd.pid" checkrad = "/usr/sbin/checkrad" debug_level = 0 proxy_requests = yes log { stripped_names = no auth = no auth_badpass = no auth_goodpass = no colourise = yes msg_denied = "You are already logged in - access denied" } resources { } security { max_attributes = 200 reject_delay = 1.000000 status_server = yes } } radiusd: #### Loading Realms and Home Servers #### proxy server { retry_delay = 5 retry_count = 3 default_fallback = no dead_time = 120 wake_all_if_all_dead = no } home_server localhost { ipaddr = 127.0.0.1 port = 1812 type = "auth" secret = <<< secret >>> response_window = 20.000000 response_timeouts = 1 max_outstanding = 65536 zombie_period = 40 status_check = "status-server" ping_interval = 30 check_interval = 30 check_timeout = 4 num_answers_to_alive = 3 revive_interval = 120 limit { max_connections = 16 max_requests = 0 lifetime = 0 idle_timeout = 0 } coa { irt = 2 mrt = 16 mrc = 5 mrd = 30 } } home_server_pool my_auth_failover { type = fail-over home_server = localhost } realm example.com { auth_pool = my_auth_failover } realm LOCAL { } radiusd: #### Loading Clients #### client localhost { ipaddr = 127.0.0.1 require_message_authenticator = no secret = <<< secret >>> shortname = "localhost" nas_type = "other" proto = "*" limit { max_connections = 16 lifetime = 0 idle_timeout = 30 } } client lab { ipaddr = 66.220.139.158 require_message_authenticator = no secret = <<< secret >>> limit { max_connections = 16 lifetime = 0 idle_timeout = 30 } } client localhost_ipv6 { ipv6addr = ::1 require_message_authenticator = no secret = <<< secret >>> limit { max_connections = 16 lifetime = 0 idle_timeout = 30 } } Debugger not attached # Creating Auth-Type = mschap # Creating Auth-Type = digest # Creating Auth-Type = eap # Creating Auth-Type = PAP # Creating Auth-Type = CHAP # Creating Auth-Type = MS-CHAP radiusd: #### Instantiating modules #### modules { # Loaded module rlm_always # Loading module "reject" from file /etc/raddb/mods-enabled/always always reject { rcode = "reject" simulcount = 0 mpp = no } # Loading module "fail" from file /etc/raddb/mods-enabled/always always fail { rcode = "fail" simulcount = 0 mpp = no } # Loading module "ok" from file /etc/raddb/mods-enabled/always always ok { rcode = "ok" simulcount = 0 mpp = no } # Loading module "handled" from file /etc/raddb/mods-enabled/always always handled { rcode = "handled" simulcount = 0 mpp = no } # Loading module "invalid" from file /etc/raddb/mods-enabled/always always invalid { rcode = "invalid" simulcount = 0 mpp = no } # Loading module "userlock" from file /etc/raddb/mods-enabled/always always userlock { rcode = "userlock" simulcount = 0 mpp = no } # Loading module "notfound" from file /etc/raddb/mods-enabled/always always notfound { rcode = "notfound" simulcount = 0 mpp = no } # Loading module "noop" from file /etc/raddb/mods-enabled/always always noop { rcode = "noop" simulcount = 0 mpp = no } # Loading module "updated" from file /etc/raddb/mods-enabled/always always updated { rcode = "updated" simulcount = 0 mpp = no } # Loaded module rlm_attr_filter # Loading module "attr_filter.post-proxy" from file /etc/raddb/mods-enabled/attr_filter attr_filter attr_filter.post-proxy { filename = "/etc/raddb/mods-config/attr_filter/post-proxy" key = "%{Realm}" relaxed = no } # Loading module "attr_filter.pre-proxy" from file /etc/raddb/mods-enabled/attr_filter attr_filter attr_filter.pre-proxy { filename = "/etc/raddb/mods-config/attr_filter/pre-proxy" key = "%{Realm}" relaxed = no } # Loading module "attr_filter.access_reject" from file /etc/raddb/mods-enabled/attr_filter attr_filter attr_filter.access_reject { filename = "/etc/raddb/mods-config/attr_filter/access_reject" key = "%{User-Name}" relaxed = no } # Loading module "attr_filter.access_challenge" from file /etc/raddb/mods-enabled/attr_filter attr_filter attr_filter.access_challenge { filename = "/etc/raddb/mods-config/attr_filter/access_challenge" key = "%{User-Name}" relaxed = no } # Loading module "attr_filter.accounting_response" from file /etc/raddb/mods-enabled/attr_filter attr_filter attr_filter.accounting_response { filename = "/etc/raddb/mods-config/attr_filter/accounting_response" key = "%{User-Name}" relaxed = no } # Loaded module rlm_cache # Loading module "cache_eap" from file /etc/raddb/mods-enabled/cache_eap cache cache_eap { driver = "rlm_cache_rbtree" key = "%{%{control:State}:-%{%{reply:State}:-%{State}}}" ttl = 15 max_entries = 0 epoch = 0 add_stats = no } # Loaded module rlm_chap # Loading module "chap" from file /etc/raddb/mods-enabled/chap # Loaded module rlm_date # Loading module "date" from file /etc/raddb/mods-enabled/date date { format = "%b %e %Y %H:%M:%S %Z" } # Loaded module rlm_detail # Loading module "detail" from file /etc/raddb/mods-enabled/detail detail { filename = "/var/log/radius/radacct/%{%{Packet-Src-IP-Address}:-%{Packet-Src-IPv6-Address}}/detail-%Y%m%d" header = "%t" permissions = 384 locking = no escape_filenames = no log_packet_header = no } # Loading module "auth_log" from file /etc/raddb/mods-enabled/detail.log detail auth_log { filename = "/var/log/radius/radacct/%{%{Packet-Src-IP-Address}:-%{Packet-Src-IPv6-Address}}/auth-detail-%Y%m%d" header = "%t" permissions = 384 locking = no escape_filenames = no log_packet_header = no } # Loading module "reply_log" from file /etc/raddb/mods-enabled/detail.log detail reply_log { filename = "/var/log/radius/radacct/%{%{Packet-Src-IP-Address}:-%{Packet-Src-IPv6-Address}}/reply-detail-%Y%m%d" header = "%t" permissions = 384 locking = no escape_filenames = no log_packet_header = no } # Loading module "pre_proxy_log" from file /etc/raddb/mods-enabled/detail.log detail pre_proxy_log { filename = "/var/log/radius/radacct/%{%{Packet-Src-IP-Address}:-%{Packet-Src-IPv6-Address}}/pre-proxy-detail-%Y%m%d" header = "%t" permissions = 384 locking = no escape_filenames = no log_packet_header = no } # Loading module "post_proxy_log" from file /etc/raddb/mods-enabled/detail.log detail post_proxy_log { filename = "/var/log/radius/radacct/%{%{Packet-Src-IP-Address}:-%{Packet-Src-IPv6-Address}}/post-proxy-detail-%Y%m%d" header = "%t" permissions = 384 locking = no escape_filenames = no log_packet_header = no } # Loaded module rlm_dhcp # Loading module "dhcp" from file /etc/raddb/mods-enabled/dhcp # Loaded module rlm_digest # Loading module "digest" from file /etc/raddb/mods-enabled/digest # Loaded module rlm_dynamic_clients # Loading module "dynamic_clients" from file /etc/raddb/mods-enabled/dynamic_clients # Loaded module rlm_eap # Loading module "eap" from file /etc/raddb/mods-enabled/eap eap { default_eap_type = "peap" timer_expire = 60 ignore_unknown_eap_types = no cisco_accounting_username_bug = no max_sessions = 16384 } # Loaded module rlm_exec # Loading module "echo" from file /etc/raddb/mods-enabled/echo exec echo { wait = yes program = "/bin/echo %{User-Name}" input_pairs = "request" output_pairs = "reply" shell_escape = yes } # Loading module "exec" from file /etc/raddb/mods-enabled/exec exec { wait = no input_pairs = "request" shell_escape = yes timeout = 10 } # Loaded module rlm_expiration # Loading module "expiration" from file /etc/raddb/mods-enabled/expiration # Loaded module rlm_expr # Loading module "expr" from file /etc/raddb/mods-enabled/expr expr { safe_characters = "@abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ0123456789.-_: /äéöüàâæçèéêëîïôœùûüaÿÄÉÖÜßÀÂÆÇÈÉÊËÎÏÔŒÙÛÜŸ" } # Loaded module rlm_files # Loading module "files" from file /etc/raddb/mods-enabled/files files { filename = "/etc/raddb/mods-config/files/authorize" acctusersfile = "/etc/raddb/mods-config/files/accounting" preproxy_usersfile = "/etc/raddb/mods-config/files/pre-proxy" } # Loaded module rlm_linelog # Loading module "linelog" from file /etc/raddb/mods-enabled/linelog linelog { filename = "/var/log/radius/linelog" escape_filenames = no syslog_severity = "info" permissions = 384 format = "This is a log message for %{User-Name}" reference = "messages.%{%{reply:Packet-Type}:-default}" } # Loading module "log_accounting" from file /etc/raddb/mods-enabled/linelog linelog log_accounting { filename = "/var/log/radius/linelog-accounting" escape_filenames = no syslog_severity = "info" permissions = 384 format = "" reference = "Accounting-Request.%{%{Acct-Status-Type}:-unknown}" } # Loaded module rlm_logintime # Loading module "logintime" from file /etc/raddb/mods-enabled/logintime logintime { minimum_timeout = 60 } # Loaded module rlm_mschap # Loading module "mschap" from file /etc/raddb/mods-enabled/mschap mschap { use_mppe = yes require_encryption = no require_strong = no with_ntdomain_hack = yes ntlm_auth = "ntlm_auth --request-nt-key --username=%{%{Stripped-User-Name}:-%{%{User-Name}:-None}} --challenge=%{%{mschap:Challenge}:-00} --nt-response=%{%{mschap:NT-Response}:-00}" ntlm_auth_timeout = 10 passchange { } allow_retry = yes winbind_retry_with_normalised_username = no } # Loading module "ntlm_auth" from file /etc/raddb/mods-enabled/ntlm_auth exec ntlm_auth { wait = yes program = "/path/to/ntlm_auth --request-nt-key --domain=MYDOMAIN --username=%{mschap:User-Name} --password=%{User-Password}" shell_escape = yes } # Loaded module rlm_pap # Loading module "pap" from file /etc/raddb/mods-enabled/pap pap { normalise = yes } # Loaded module rlm_passwd # Loading module "etc_passwd" from file /etc/raddb/mods-enabled/passwd passwd etc_passwd { filename = "/etc/passwd" format = "*User-Name:Crypt-Password:" delimiter = ":" ignore_nislike = no ignore_empty = yes allow_multiple_keys = no hash_size = 100 } # Loaded module rlm_preprocess # Loading module "preprocess" from file /etc/raddb/mods-enabled/preprocess preprocess { huntgroups = "/etc/raddb/mods-config/preprocess/huntgroups" hints = "/etc/raddb/mods-config/preprocess/hints" with_ascend_hack = no ascend_channels_per_line = 23 with_ntdomain_hack = no with_specialix_jetstream_hack = no with_cisco_vsa_hack = no with_alvarion_vsa_hack = no } # Loaded module rlm_radutmp # Loading module "radutmp" from file /etc/raddb/mods-enabled/radutmp radutmp { filename = "/var/log/radius/radutmp" username = "%{User-Name}" case_sensitive = yes check_with_nas = yes permissions = 384 caller_id = yes } # Loaded module rlm_realm # Loading module "IPASS" from file /etc/raddb/mods-enabled/realm realm IPASS { format = "prefix" delimiter = "/" ignore_default = no ignore_null = no } # Loading module "suffix" from file /etc/raddb/mods-enabled/realm realm suffix { format = "suffix" delimiter = "@" ignore_default = no ignore_null = no } # Loading module "realmpercent" from file /etc/raddb/mods-enabled/realm realm realmpercent { format = "suffix" delimiter = "%" ignore_default = no ignore_null = no } # Loading module "ntdomain" from file /etc/raddb/mods-enabled/realm realm ntdomain { format = "prefix" delimiter = "\\" ignore_default = no ignore_null = no } # Loaded module rlm_replicate # Loading module "replicate" from file /etc/raddb/mods-enabled/replicate # Loaded module rlm_soh # Loading module "soh" from file /etc/raddb/mods-enabled/soh soh { dhcp = yes } # Loading module "sradutmp" from file /etc/raddb/mods-enabled/sradutmp radutmp sradutmp { filename = "/var/log/radius/sradutmp" username = "%{User-Name}" case_sensitive = yes check_with_nas = yes permissions = 420 caller_id = no } # Loaded module rlm_unix # Loading module "unix" from file /etc/raddb/mods-enabled/unix unix { radwtmp = "/var/log/radius/radwtmp" } Creating attribute Unix-Group # Loaded module rlm_unpack # Loading module "unpack" from file /etc/raddb/mods-enabled/unpack # Loaded module rlm_utf8 # Loading module "utf8" from file /etc/raddb/mods-enabled/utf8 instantiate { } # Instantiating module "reject" from file /etc/raddb/mods-enabled/always # Instantiating module "fail" from file /etc/raddb/mods-enabled/always # Instantiating module "ok" from file /etc/raddb/mods-enabled/always # Instantiating module "handled" from file /etc/raddb/mods-enabled/always # Instantiating module "invalid" from file /etc/raddb/mods-enabled/always # Instantiating module "userlock" from file /etc/raddb/mods-enabled/always # Instantiating module "notfound" from file /etc/raddb/mods-enabled/always # Instantiating module "noop" from file /etc/raddb/mods-enabled/always # Instantiating module "updated" from file /etc/raddb/mods-enabled/always # Instantiating module "attr_filter.post-proxy" from file /etc/raddb/mods-enabled/attr_filter reading pairlist file /etc/raddb/mods-config/attr_filter/post-proxy # Instantiating module "attr_filter.pre-proxy" from file /etc/raddb/mods-enabled/attr_filter reading pairlist file /etc/raddb/mods-config/attr_filter/pre-proxy # Instantiating module "attr_filter.access_reject" from file /etc/raddb/mods-enabled/attr_filter reading pairlist file /etc/raddb/mods-config/attr_filter/access_reject [/etc/raddb/mods-config/attr_filter/access_reject]:11 Check item "FreeRADIUS-Response-Delay" found in filter list for realm "DEFAULT". [/etc/raddb/mods-config/attr_filter/access_reject]:11 Check item "FreeRADIUS-Response-Delay-USec" found in filter list for realm "DEFAULT". # Instantiating module "attr_filter.access_challenge" from file /etc/raddb/mods-enabled/attr_filter reading pairlist file /etc/raddb/mods-config/attr_filter/access_challenge # Instantiating module "attr_filter.accounting_response" from file /etc/raddb/mods-enabled/attr_filter reading pairlist file /etc/raddb/mods-config/attr_filter/accounting_response # Instantiating module "cache_eap" from file /etc/raddb/mods-enabled/cache_eap rlm_cache (cache_eap): Driver rlm_cache_rbtree (module rlm_cache_rbtree) loaded and linked # Instantiating module "detail" from file /etc/raddb/mods-enabled/detail # Instantiating module "auth_log" from file /etc/raddb/mods-enabled/detail.log rlm_detail (auth_log): 'User-Password' suppressed, will not appear in detail output # Instantiating module "reply_log" from file /etc/raddb/mods-enabled/detail.log # Instantiating module "pre_proxy_log" from file /etc/raddb/mods-enabled/detail.log # Instantiating module "post_proxy_log" from file /etc/raddb/mods-enabled/detail.log # Instantiating module "eap" from file /etc/raddb/mods-enabled/eap # Linked to sub-module rlm_eap_md5 # Linked to sub-module rlm_eap_leap # Linked to sub-module rlm_eap_gtc gtc { challenge = "Password: " auth_type = "PAP" } # Linked to sub-module rlm_eap_tls tls { tls = "tls-common" } tls-config tls-common { verify_depth = 0 ca_path = "/etc/raddb/certs" pem_file_type = yes private_key_file = "/etc/raddb/certs/server.pem" certificate_file = "/etc/raddb/certs/server.pem" ca_file = "/etc/raddb/certs/ca.pem" private_key_password = <<< secret >>> dh_file = "/etc/raddb/certs/dh" random_file = "/dev/urandom" fragment_size = 1024 include_length = yes auto_chain = yes check_crl = no check_all_crl = no cipher_list = "DEFAULT" cipher_server_preference = no ecdh_curve = "prime256v1" cache { enable = no lifetime = 24 max_entries = 255 } verify { skip_if_ocsp_ok = no } ocsp { enable = no override_cert_url = yes url = "http://127.0.0.1/ocsp/" use_nonce = yes timeout = 0 softfail = no } } # Linked to sub-module rlm_eap_ttls ttls { tls = "tls-common" default_eap_type = "md5" copy_request_to_tunnel = no use_tunneled_reply = no virtual_server = "inner-tunnel" include_length = yes require_client_cert = no } tls: Using cached TLS configuration from previous invocation # Linked to sub-module rlm_eap_peap peap { tls = "tls-common" default_eap_type = "mschapv2" copy_request_to_tunnel = no use_tunneled_reply = no proxy_tunneled_request_as_eap = yes virtual_server = "inner-tunnel" soh = no require_client_cert = no } tls: Using cached TLS configuration from previous invocation # Linked to sub-module rlm_eap_mschapv2 mschapv2 { with_ntdomain_hack = no send_error = no } # Instantiating module "expiration" from file /etc/raddb/mods-enabled/expiration # Instantiating module "files" from file /etc/raddb/mods-enabled/files reading pairlist file /etc/raddb/mods-config/files/authorize reading pairlist file /etc/raddb/mods-config/files/accounting reading pairlist file /etc/raddb/mods-config/files/pre-proxy # Instantiating module "linelog" from file /etc/raddb/mods-enabled/linelog # Instantiating module "log_accounting" from file /etc/raddb/mods-enabled/linelog # Instantiating module "logintime" from file /etc/raddb/mods-enabled/logintime # Instantiating module "mschap" from file /etc/raddb/mods-enabled/mschap rlm_mschap (mschap): authenticating by calling 'ntlm_auth' # Instantiating module "pap" from file /etc/raddb/mods-enabled/pap # Instantiating module "etc_passwd" from file /etc/raddb/mods-enabled/passwd rlm_passwd: nfields: 3 keyfield 0(User-Name) listable: no # Instantiating module "preprocess" from file /etc/raddb/mods-enabled/preprocess reading pairlist file /etc/raddb/mods-config/preprocess/huntgroups reading pairlist file /etc/raddb/mods-config/preprocess/hints # Instantiating module "IPASS" from file /etc/raddb/mods-enabled/realm # Instantiating module "suffix" from file /etc/raddb/mods-enabled/realm # Instantiating module "realmpercent" from file /etc/raddb/mods-enabled/realm # Instantiating module "ntdomain" from file /etc/raddb/mods-enabled/realm } # modules radiusd: #### Loading Virtual Servers #### server { # from file /etc/raddb/radiusd.conf } # server server default { # from file /etc/raddb/sites-enabled/default # Loading authenticate {...} # Loading authorize {...} Ignoring "sql" (see raddb/mods-available/README.rst) Ignoring "ldap" (see raddb/mods-available/README.rst) # Loading preacct {...} # Loading accounting {...} # Loading post-proxy {...} # Loading post-auth {...} } # server default server inner-tunnel { # from file /etc/raddb/sites-enabled/inner-tunnel # Loading authenticate {...} # Loading authorize {...} # Loading session {...} # Loading post-proxy {...} # Loading post-auth {...} # Skipping contents of 'if' as it is always 'false' -- /etc/raddb/sites-enabled/inner-tunnel:330 } # server inner-tunnel radiusd: #### Opening IP addresses and Ports #### listen { type = "auth" ipaddr = * port = 0 limit { max_connections = 16 lifetime = 0 idle_timeout = 30 } } listen { type = "acct" ipaddr = * port = 0 limit { max_connections = 16 lifetime = 0 idle_timeout = 30 } } listen { type = "auth" ipv6addr = :: port = 0 limit { max_connections = 16 lifetime = 0 idle_timeout = 30 } } listen { type = "acct" ipv6addr = :: port = 0 limit { max_connections = 16 lifetime = 0 idle_timeout = 30 } } listen { type = "auth" ipaddr = 127.0.0.1 port = 18120 } Listening on auth address * port 1812 bound to server default Listening on acct address * port 1813 bound to server default Listening on auth address :: port 1812 bound to server default Listening on acct address :: port 1813 bound to server default Listening on auth address 127.0.0.1 port 18120 bound to server inner-tunnel Listening on proxy address * port 34863 Listening on proxy address :: port 45407 Ready to process requests (0) Received Access-Request Id 46 from 66.220.139.158:58804 to 192.168.8.107:1812 length 146 (0) Service-Type = Login-User (0) User-Name = "lukes" (0) MS-CHAP-Challenge = 0xd215511251cb4df7162fb24289916e3b (0) MS-CHAP2-Response = 0x0000bbd7955ff8acdef18b84865af0ec5f260000000000000000f587ebb2cfdf439761592d0d9d6c55ffa06ff89de25b0c25 (0) Calling-Station-Id = "66.220.128.18" (0) NAS-Identifier = "RouterOS" (0) NAS-IP-Address = 66.220.139.158 (0) # Executing section authorize from file /etc/raddb/sites-enabled/default (0) authorize { (0) policy filter_username { (0) if (&User-Name) { (0) if (&User-Name) -> TRUE (0) if (&User-Name) { (0) if (&User-Name =~ / /) { (0) if (&User-Name =~ / /) -> FALSE (0) if (&User-Name =~ /@[^@]*@/ ) { (0) if (&User-Name =~ /@[^@]*@/ ) -> FALSE (0) if (&User-Name =~ /\.\./ ) { (0) if (&User-Name =~ /\.\./ ) -> FALSE (0) if ((&User-Name =~ /@/) && (&User-Name !~ /(a)(.+)\.(.+)$/)) { (0) if ((&User-Name =~ /@/) && (&User-Name !~ /(a)(.+)\.(.+)$/)) -> FALSE (0) if (&User-Name =~ /\.$/) { (0) if (&User-Name =~ /\.$/) -> FALSE (0) if (&User-Name =~ /(a)\./) { (0) if (&User-Name =~ /(a)\./) -> FALSE (0) } # if (&User-Name) = notfound (0) } # policy filter_username = notfound (0) [preprocess] = ok (0) [chap] = noop (0) mschap: Found MS-CHAP attributes. Setting 'Auth-Type = mschap' (0) [mschap] = ok (0) [digest] = noop (0) suffix: Checking for suffix after "@" (0) suffix: No '@' in User-Name = "lukes", looking up realm NULL (0) suffix: No such realm "NULL" (0) [suffix] = noop (0) eap: No EAP-Message, not doing EAP (0) [eap] = noop (0) [files] = noop (0) [expiration] = noop (0) [logintime] = noop (0) pap: WARNING: No "known good" password found for the user. Not setting Auth-Type (0) pap: WARNING: Authentication will fail unless a "known good" password is available (0) [pap] = noop (0) } # authorize = ok (0) Found Auth-Type = mschap (0) # Executing group from file /etc/raddb/sites-enabled/default (0) authenticate { (0) mschap: Creating challenge hash with username: lukes (0) mschap: Client is using MS-CHAPv2 (0) mschap: Executing: ntlm_auth --request-nt-key --username=%{%{Stripped-User-Name}:-%{%{User-Name}:-None}} --challenge=%{%{mschap:Challenge}:-00} --nt-response=%{%{mschap:NT-Response}:-00}: (0) mschap: EXPAND --username=%{%{Stripped-User-Name}:-%{%{User-Name}:-None}} (0) mschap: --> --username=lukes (0) mschap: Creating challenge hash with username: lukes (0) mschap: EXPAND --challenge=%{%{mschap:Challenge}:-00} (0) mschap: --> --challenge=431e6363c1e6ad78 (0) mschap: EXPAND --nt-response=%{%{mschap:NT-Response}:-00} (0) mschap: --> --nt-response=f587ebb2cfdf439761592d0d9d6c55ffa06ff89de25b0c25 (0) mschap: ERROR: Program returned code (2) and output 'Failed to execute "ntlm_auth": Permission denied' (0) mschap: External script failed (0) mschap: ERROR: External script says: Failed to execute "ntlm_auth": Permission denied (0) mschap: ERROR: MS-CHAP2-Response is incorrect (0) [mschap] = reject (0) } # authenticate = reject (0) Failed to authenticate the user (0) Using Post-Auth-Type Reject (0) # Executing group from file /etc/raddb/sites-enabled/default (0) Post-Auth-Type REJECT { (0) attr_filter.access_reject: EXPAND %{User-Name} (0) attr_filter.access_reject: --> lukes (0) attr_filter.access_reject: Matched entry DEFAULT at line 11 (0) [attr_filter.access_reject] = updated (0) [eap] = noop (0) policy remove_reply_message_if_eap { (0) if (&reply:EAP-Message && &reply:Reply-Message) { (0) if (&reply:EAP-Message && &reply:Reply-Message) -> FALSE (0) else { (0) [noop] = noop (0) } # else = noop (0) } # policy remove_reply_message_if_eap = noop (0) } # Post-Auth-Type REJECT = updated (0) Delaying response for 1.000000 seconds Waking up in 0.3 seconds. (0) (0) Discarding duplicate request from client lab port 58804 - ID: 46 due to delayed response Waking up in 0.6 seconds. (0) (0) Discarding duplicate request from client lab port 58804 - ID: 46 due to delayed response Waking up in 0.4 seconds. (0) Sending delayed response (0) Sent Access-Reject Id 46 from 192.168.8.107:1812 to 66.220.139.158:58804 length 101 (0) MS-CHAP-Error = "\000E=691 R=1 C=261d7709d3461a23eaef3f02487a760a V=3 M=Authentication failed" Waking up in 3.9 seconds. (0) Cleaning up request packet ID 46 with timestamp +3 Ready to process requests Confidentiality Notice: The information herein transmitted or attached is intended only for the person or entity to which this e-mail is addressed and may contain confidential and/or legally privileged material. Any review, retransmission, dissemination, other use of, or taking of any action in reliance upon this information by persons or entities other than the intended recipient is prohibited. If you have received this in error, please contact the sender immediately and delete the material from any and all computers, servers, and e-mail programs. Any views or opinions presented are solely those of the author and do not necessarily represent those of the company.

3 2

How to calculate CUI manually
by Fekete Tamás 17 Jan '19

17 Jan '19

Hello! I use Freeradius 3.0.13 and to be able to search back any peoples identity who made anything illegal, I would like to make a script which creates CUI for all of the usernames exisiting in the DB and compare it with the user who is suspicious made something bad. For this, I found the algorithm which calculates the CUI for users in /etc/raddb/policy.d/cui Chargeable-User-Identity := "%{sha1:${policy.cui_hash_key}%{tolower:%{User-Name}%{%{outer.request:Operator-Name}:-}}}" Than, I put the strings after each other with no space on my debian linux and gave it to sha1sum, but the CUI calculated by Freeradius and calculated with sha1sum seems quite different. My command was: echo "<mystringwhichisnotrevealed>" | sha1sum Code with sha1sum: baf4d4546ed4665e4d5e141bc9e8e728a7a934ab Code with Freeradius: 0x38393465333261356361356239306362353834323337323435363634373735386531393266613933 Can you help me fixing my calculation or process?

3 3

Help: On setting up freeradius proxy server on v 3.17
by shivu prasad 16 Jan '19

16 Jan '19

Hi, I am trying to set up the proxy server for load-balance, Here It was trying Creating 1 radius as proxy server with below proxy configuration(proxy.config). ## proxy server { default_fallback = no } home_server localhost { type = auth ipaddr = 127.0.0.1 port = 1812 secret = testing123 response_window = 20 zombie_period = 40 revive_interval = 120 # Allowed values: none, status-server, request status_check = status-server check_interval = 30 check_timeout = 4 num_answers_to_alive = 3 max_outstanding = 65536 coa { irt = 2 mrt = 16 mrc = 5 mrd = 30 } # limit { max_connections = 16 max_requests = 0 lifetime = 0 idle_timeout = 0 } } home_server server01 { type = auth ipaddr = 10.x.y.z port = 1812 secret = testing123 } home_server_pool my_auth_failover { type = fail-over home_server = server01 } realm example.com { auth_pool = my_auth_failover } realm LOCAL { # If we do not specify a server pool, the realm is LOCAL, and # requests are not proxied to it. } # # This realm is for requests which don't have an explicit realm # prefix or suffix. User names like "bob" will match this one. # realm NULL { auth_pool = my_auth_failover } realm DEFAULT { auth_pool = my_auth_failover } realm "~(.*\.)*example\.net$" { auth_pool = my_auth_failover } Later I am setting up one * home_server = server01* Here I am using default *proxy*.*config* file. I started server and send auth request *the request is going to server01 with below error * *Ignoring request to auth address * port 1812 bound to server default from unknown client 10.X.Y.Z port 21473 proto udp* I thought we may need to add the client entry and added the proxy server as client in home_server = server01 my creating entry in client.config *client my,.hostname { ipaddr = 10.x.x.x secret = testing123 shortname = twick}* still getting same error. What may be I am missing ? adding radiusd -X debug logs below FreeRADIUS Version 3.0.17 Copyright (C) 1999-2017 The FreeRADIUS server project and contributors There is NO warranty; not even for MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE You may redistribute copies of FreeRADIUS under the terms of the GNU General Public License For more information about these matters, see the file named COPYRIGHT Starting - reading configuration files ... including dictionary file /usr/local/freeradius-server-3.0.17/share/freeradius/dictionary including dictionary file /usr/local/freeradius-server-3.0.17/share/freeradius/dictionary.dhcp including dictionary file /usr/local/freeradius-server-3.0.17/share/freeradius/dictionary.vqp including dictionary file /usr/local/freeradius-server-3.0.17/etc/raddb/dictionary including configuration file /usr/local/freeradius-server-3.0.17/etc/raddb/radiusd.conf including configuration file /usr/local/freeradius-server-3.0.17/etc/raddb/proxy.conf including configuration file /usr/local/freeradius-server-3.0.17/etc/raddb/clients.conf including files in directory /usr/local/freeradius-server-3.0.17/etc/raddb/mods-enabled/ including configuration file /usr/local/freeradius-server-3.0.17/etc/raddb/mods-enabled/echo including configuration file /usr/local/freeradius-server-3.0.17/etc/raddb/mods-enabled/logintime including configuration file /usr/local/freeradius-server-3.0.17/etc/raddb/mods-enabled/replicate including configuration file /usr/local/freeradius-server-3.0.17/etc/raddb/mods-enabled/passwd including configuration file /usr/local/freeradius-server-3.0.17/etc/raddb/mods-enabled/expr including configuration file /usr/local/freeradius-server-3.0.17/etc/raddb/mods-enabled/files including configuration file /usr/local/freeradius-server-3.0.17/etc/raddb/mods-enabled/eap including configuration file /usr/local/freeradius-server-3.0.17/etc/raddb/mods-enabled/ntlm_auth including configuration file /usr/local/freeradius-server-3.0.17/etc/raddb/mods-enabled/linelog including configuration file /usr/local/freeradius-server-3.0.17/etc/raddb/mods-enabled/idcs including configuration file /usr/local/freeradius-server-3.0.17/etc/raddb/mods-enabled/unix including configuration file /usr/local/freeradius-server-3.0.17/etc/raddb/mods-enabled/detail including configuration file /usr/local/freeradius-server-3.0.17/etc/raddb/mods-enabled/detail.log including configuration file /usr/local/freeradius-server-3.0.17/etc/raddb/mods-enabled/pap including configuration file /usr/local/freeradius-server-3.0.17/etc/raddb/mods-enabled/soh including configuration file /usr/local/freeradius-server-3.0.17/etc/raddb/mods-enabled/expiration including configuration file /usr/local/freeradius-server-3.0.17/etc/raddb/mods-enabled/cache_eap including configuration file /usr/local/freeradius-server-3.0.17/etc/raddb/mods-enabled/digest including configuration file /usr/local/freeradius-server-3.0.17/etc/raddb/mods-enabled/unpack including configuration file /usr/local/freeradius-server-3.0.17/etc/raddb/mods-enabled/mschap including configuration file /usr/local/freeradius-server-3.0.17/etc/raddb/mods-enabled/date including configuration file /usr/local/freeradius-server-3.0.17/etc/raddb/mods-enabled/dynamic_clients including configuration file /usr/local/freeradius-server-3.0.17/etc/raddb/mods-enabled/radutmp including configuration file /usr/local/freeradius-server-3.0.17/etc/raddb/mods-enabled/always including configuration file /usr/local/freeradius-server-3.0.17/etc/raddb/mods-enabled/attr_filter including configuration file /usr/local/freeradius-server-3.0.17/etc/raddb/mods-enabled/chap including configuration file /usr/local/freeradius-server-3.0.17/etc/raddb/mods-enabled/realm including configuration file /usr/local/freeradius-server-3.0.17/etc/raddb/mods-enabled/utf8 including configuration file /usr/local/freeradius-server-3.0.17/etc/raddb/mods-enabled/sradutmp including configuration file /usr/local/freeradius-server-3.0.17/etc/raddb/mods-enabled/exec including configuration file /usr/local/freeradius-server-3.0.17/etc/raddb/mods-enabled/preprocess including files in directory /usr/local/freeradius-server-3.0.17/etc/raddb/policy.d/ including configuration file /usr/local/freeradius-server-3.0.17/etc/raddb/policy.d/canonicalization including configuration file /usr/local/freeradius-server-3.0.17/etc/raddb/policy.d/debug including configuration file /usr/local/freeradius-server-3.0.17/etc/raddb/policy.d/eap including configuration file /usr/local/freeradius-server-3.0.17/etc/raddb/policy.d/abfab-tr including configuration file /usr/local/freeradius-server-3.0.17/etc/raddb/policy.d/cui including configuration file /usr/local/freeradius-server-3.0.17/etc/raddb/policy.d/moonshot-targeted-ids including configuration file /usr/local/freeradius-server-3.0.17/etc/raddb/policy.d/filter including configuration file /usr/local/freeradius-server-3.0.17/etc/raddb/policy.d/control including configuration file /usr/local/freeradius-server-3.0.17/etc/raddb/policy.d/operator-name including configuration file /usr/local/freeradius-server-3.0.17/etc/raddb/policy.d/accounting including configuration file /usr/local/freeradius-server-3.0.17/etc/raddb/policy.d/dhcp including files in directory /usr/local/freeradius-server-3.0.17/etc/raddb/sites-enabled/ including configuration file /usr/local/freeradius-server-3.0.17/etc/raddb/sites-enabled/inner-tunnel including configuration file /usr/local/freeradius-server-3.0.17/etc/raddb/sites-enabled/default main { security { allow_core_dumps = no } name = "radiusd" prefix = "/usr/local/freeradius-server-3.0.17" localstatedir = "/usr/local/freeradius-server-3.0.17/var" logdir = "/usr/local/freeradius-server-3.0.17/var/log/radius" run_dir = "/usr/local/freeradius-server-3.0.17/var/run/radiusd" } main { name = "radiusd" prefix = "/usr/local/freeradius-server-3.0.17" localstatedir = "/usr/local/freeradius-server-3.0.17/var" sbindir = "/usr/local/freeradius-server-3.0.17/sbin" logdir = "/usr/local/freeradius-server-3.0.17/var/log/radius" run_dir = "/usr/local/freeradius-server-3.0.17/var/run/radiusd" libdir = "/usr/local/freeradius-server-3.0.17/lib" radacctdir = "/usr/local/freeradius-server-3.0.17/var/log/radius/radacct" hostname_lookups = no max_request_time = 30 cleanup_delay = 5 max_requests = 16384 pidfile = "/usr/local/freeradius-server-3.0.17/var/run/radiusd/radiusd.pid" checkrad = "/usr/local/freeradius-server-3.0.17/sbin/checkrad" debug_level = 0 proxy_requests = yes log { stripped_names = no auth = no auth_badpass = no auth_goodpass = no colourise = yes msg_denied = "You are already logged in - access denied" } resources { } security { max_attributes = 200 reject_delay = 1.000000 status_server = yes allow_vulnerable_openssl = "CVE-2016-6304" } } radiusd: #### Loading Realms and Home Servers #### proxy server { retry_delay = 5 retry_count = 3 default_fallback = no dead_time = 120 wake_all_if_all_dead = no } home_server localhost { ipaddr = 127.0.0.1 port = 1812 type = "auth" secret = <<< secret >>> response_window = 20.000000 response_timeouts = 1 max_outstanding = 65536 zombie_period = 40 status_check = "status-server" ping_interval = 30 check_interval = 30 check_timeout = 4 num_answers_to_alive = 3 revive_interval = 120 limit { max_connections = 16 max_requests = 0 lifetime = 0 idle_timeout = 0 } coa { irt = 2 mrt = 16 mrc = 5 mrd = 30 } } home_server server01 { ipaddr = x.y.z port = 1812 type = "auth" secret = <<< secret >>> response_window = 30.000000 response_timeouts = 1 max_outstanding = 65536 zombie_period = 40 status_check = "none" ping_interval = 30 check_timeout = 4 num_answers_to_alive = 3 revive_interval = 300 limit { max_connections = 16 max_requests = 0 lifetime = 0 idle_timeout = 0 } coa { irt = 2 mrt = 16 mrc = 5 mrd = 30 } } home_server_pool my_auth_failover { type = fail-over home_server = server01 } realm example.com { auth_pool = my_auth_failover } realm LOCAL { } realm NULL { auth_pool = my_auth_failover } realm DEFAULT { auth_pool = my_auth_failover } realm ~(.*\.)*example\.net$ { auth_pool = my_auth_failover } radiusd: #### Loading Clients #### client localhost { ipaddr = 127.0.0.1 require_message_authenticator = no secret = <<< secret >>> nas_type = "other" proto = "*" limit { max_connections = 16 lifetime = 0 idle_timeout = 30 } } client localhost_ipv6 { ipv6addr = ::1 require_message_authenticator = no secret = <<< secret >>> limit { max_connections = 16 lifetime = 0 idle_timeout = 30 } } client den02kyf.us.oracle.com { ipaddr = m.n.k require_message_authenticator = no secret = <<< secret >>> shortname = "twick" limit { max_connections = 16 lifetime = 0 idle_timeout = 30 } } client mymac.us.oracle.com { ipaddr = require_message_authenticator = no secret = <<< secret >>> limit { max_connections = 16 lifetime = 0 idle_timeout = 30 } } client mymac.home.us.oracle.com { ipaddr = require_message_authenticator = no secret = <<< secret >>> limit { max_connections = 16 lifetime = 0 idle_timeout = 30 } } Debugger not attached # Creating Auth-Type = mschap # Creating Auth-Type = eap # Creating Auth-Type = PAP # Creating Auth-Type = CHAP # Creating Auth-Type = MS-CHAP # Creating Auth-Type = idcs # Creating Auth-Type = digest radiusd: #### Instantiating modules #### modules { # Loaded module rlm_exec # Loading module "echo" from file /usr/local/freeradius-server-3.0.17/etc/raddb/mods-enabled/echo exec echo { wait = yes program = "/bin/echo %{User-Name}" input_pairs = "request" output_pairs = "reply" shell_escape = yes } # Loaded module rlm_logintime # Loading module "logintime" from file /usr/local/freeradius-server-3.0.17/etc/raddb/mods-enabled/logintime logintime { minimum_timeout = 60 } # Loaded module rlm_replicate # Loading module "replicate" from file /usr/local/freeradius-server-3.0.17/etc/raddb/mods-enabled/replicate # Loaded module rlm_passwd # Loading module "etc_passwd" from file /usr/local/freeradius-server-3.0.17/etc/raddb/mods-enabled/passwd passwd etc_passwd { filename = "/etc/passwd" format = "*User-Name:Crypt-Password:" delimiter = ":" ignore_nislike = no ignore_empty = yes allow_multiple_keys = no hash_size = 100 } # Loaded module rlm_expr # Loading module "expr" from file /usr/local/freeradius-server-3.0.17/etc/raddb/mods-enabled/expr expr { safe_characters = "@abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ0123456789.-_: /äéöüàâæçèéêëîïô\u0153ùûüaÿÄÉÖÜßÀÂÆÇÈÉÊËÎÏÔ\u0152ÙÛÜ\u0178" } # Loaded module rlm_files # Loading module "files" from file /usr/local/freeradius-server-3.0.17/etc/raddb/mods-enabled/files files { filename = "/usr/local/freeradius-server-3.0.17/etc/raddb/mods-config/files/authorize" acctusersfile = "/usr/local/freeradius-server-3.0.17/etc/raddb/mods-config/files/accounting" preproxy_usersfile = "/usr/local/freeradius-server-3.0.17/etc/raddb/mods-config/files/pre-proxy" } # Loaded module rlm_eap # Loading module "eap" from file /usr/local/freeradius-server-3.0.17/etc/raddb/mods-enabled/eap eap { default_eap_type = "md5" timer_expire = 60 ignore_unknown_eap_types = no cisco_accounting_username_bug = no max_sessions = 16384 } # Loading module "ntlm_auth" from file /usr/local/freeradius-server-3.0.17/etc/raddb/mods-enabled/ntlm_auth exec ntlm_auth { wait = yes program = "/path/to/ntlm_auth --request-nt-key --domain=MYDOMAIN --username=%{mschap:User-Name} --password=%{User-Password}" shell_escape = yes } # Loaded module rlm_linelog # Loading module "linelog" from file /usr/local/freeradius-server-3.0.17/etc/raddb/mods-enabled/linelog linelog { filename = "/usr/local/freeradius-server-3.0.17/var/log/radius/linelog" escape_filenames = no syslog_severity = "info" permissions = 384 format = "This is a log message for %{User-Name}" reference = "messages.%{%{reply:Packet-Type}:-default}" } # Loading module "log_accounting" from file /usr/local/freeradius-server-3.0.17/etc/raddb/mods-enabled/linelog linelog log_accounting { filename = "/usr/local/freeradius-server-3.0.17/var/log/radius/linelog-accounting" escape_filenames = no syslog_severity = "info" permissions = 384 format = "" reference = "Accounting-Request.%{%{Acct-Status-Type}:-unknown}" } # Loaded module rlm_idcs # Loading module "idcs" from file /usr/local/freeradius-server-3.0.17/etc/raddb/mods-enabled/idcs idcs { idcs_server_url = "https://tenant1.identity.internal.oracle.com:8943" wallet_location = "/scratch/shivap/shivap_Code" scopes = "urn:opc:idm:__myscopes__" connect_timeout = 70.000000 } # Loaded module rlm_unix # Loading module "unix" from file /usr/local/freeradius-server-3.0.17/etc/raddb/mods-enabled/unix unix { radwtmp = "/usr/local/freeradius-server-3.0.17/var/log/radius/radwtmp" } Creating attribute Unix-Group # Loaded module rlm_detail # Loading module "detail" from file /usr/local/freeradius-server-3.0.17/etc/raddb/mods-enabled/detail detail { filename = "/usr/local/freeradius-server-3.0.17/var/log/radius/radacct/%{%{Packet-Src-IP-Address}:-%{Packet-Src-IPv6-Address}}/detail-%Y%m%d" header = "%t" permissions = 384 locking = no escape_filenames = no log_packet_header = no } # Loading module "auth_log" from file /usr/local/freeradius-server-3.0.17/etc/raddb/mods-enabled/detail.log detail auth_log { filename = "/usr/local/freeradius-server-3.0.17/var/log/radius/radacct/%{%{Packet-Src-IP-Address}:-%{Packet-Src-IPv6-Address}}/auth-detail-%Y%m%d" header = "%t" permissions = 384 locking = no escape_filenames = no log_packet_header = no } # Loading module "reply_log" from file /usr/local/freeradius-server-3.0.17/etc/raddb/mods-enabled/detail.log detail reply_log { filename = "/usr/local/freeradius-server-3.0.17/var/log/radius/radacct/%{%{Packet-Src-IP-Address}:-%{Packet-Src-IPv6-Address}}/reply-detail-%Y%m%d" header = "%t" permissions = 384 locking = no escape_filenames = no log_packet_header = no } # Loading module "pre_proxy_log" from file /usr/local/freeradius-server-3.0.17/etc/raddb/mods-enabled/detail.log detail pre_proxy_log { filename = "/usr/local/freeradius-server-3.0.17/var/log/radius/radacct/%{%{Packet-Src-IP-Address}:-%{Packet-Src-IPv6-Address}}/pre-proxy-detail-%Y%m%d" header = "%t" permissions = 384 locking = no escape_filenames = no log_packet_header = no } # Loading module "post_proxy_log" from file /usr/local/freeradius-server-3.0.17/etc/raddb/mods-enabled/detail.log detail post_proxy_log { filename = "/usr/local/freeradius-server-3.0.17/var/log/radius/radacct/%{%{Packet-Src-IP-Address}:-%{Packet-Src-IPv6-Address}}/post-proxy-detail-%Y%m%d" header = "%t" permissions = 384 locking = no escape_filenames = no log_packet_header = no } # Loaded module rlm_pap # Loading module "pap" from file /usr/local/freeradius-server-3.0.17/etc/raddb/mods-enabled/pap pap { normalise = yes } # Loaded module rlm_soh # Loading module "soh" from file /usr/local/freeradius-server-3.0.17/etc/raddb/mods-enabled/soh soh { dhcp = yes } # Loaded module rlm_expiration # Loading module "expiration" from file /usr/local/freeradius-server-3.0.17/etc/raddb/mods-enabled/expiration # Loaded module rlm_cache # Loading module "cache_eap" from file /usr/local/freeradius-server-3.0.17/etc/raddb/mods-enabled/cache_eap cache cache_eap { driver = "rlm_cache_rbtree" key = "%{%{control:State}:-%{%{reply:State}:-%{State}}}" ttl = 15 max_entries = 0 epoch = 0 add_stats = no } # Loaded module rlm_digest # Loading module "digest" from file /usr/local/freeradius-server-3.0.17/etc/raddb/mods-enabled/digest # Loaded module rlm_unpack # Loading module "unpack" from file /usr/local/freeradius-server-3.0.17/etc/raddb/mods-enabled/unpack # Loaded module rlm_mschap # Loading module "mschap" from file /usr/local/freeradius-server-3.0.17/etc/raddb/mods-enabled/mschap mschap { use_mppe = yes require_encryption = no require_strong = no with_ntdomain_hack = yes passchange { } allow_retry = yes winbind_retry_with_normalised_username = no } # Loaded module rlm_date # Loading module "date" from file /usr/local/freeradius-server-3.0.17/etc/raddb/mods-enabled/date date { format = "%b %e %Y %H:%M:%S %Z" utc = no } # Loaded module rlm_dynamic_clients # Loading module "dynamic_clients" from file /usr/local/freeradius-server-3.0.17/etc/raddb/mods-enabled/dynamic_clients # Loaded module rlm_radutmp # Loading module "radutmp" from file /usr/local/freeradius-server-3.0.17/etc/raddb/mods-enabled/radutmp radutmp { filename = "/usr/local/freeradius-server-3.0.17/var/log/radius/radutmp" username = "%{User-Name}" case_sensitive = yes check_with_nas = yes permissions = 384 caller_id = yes } # Loaded module rlm_always # Loading module "reject" from file /usr/local/freeradius-server-3.0.17/etc/raddb/mods-enabled/always always reject { rcode = "reject" simulcount = 0 mpp = no } # Loading module "fail" from file /usr/local/freeradius-server-3.0.17/etc/raddb/mods-enabled/always always fail { rcode = "fail" simulcount = 0 mpp = no } # Loading module "ok" from file /usr/local/freeradius-server-3.0.17/etc/raddb/mods-enabled/always always ok { rcode = "ok" simulcount = 0 mpp = no } # Loading module "handled" from file /usr/local/freeradius-server-3.0.17/etc/raddb/mods-enabled/always always handled { rcode = "handled" simulcount = 0 mpp = no } # Loading module "invalid" from file /usr/local/freeradius-server-3.0.17/etc/raddb/mods-enabled/always always invalid { rcode = "invalid" simulcount = 0 mpp = no } # Loading module "userlock" from file /usr/local/freeradius-server-3.0.17/etc/raddb/mods-enabled/always always userlock { rcode = "userlock" simulcount = 0 mpp = no } # Loading module "notfound" from file /usr/local/freeradius-server-3.0.17/etc/raddb/mods-enabled/always always notfound { rcode = "notfound" simulcount = 0 mpp = no } # Loading module "noop" from file /usr/local/freeradius-server-3.0.17/etc/raddb/mods-enabled/always always noop { rcode = "noop" simulcount = 0 mpp = no } # Loading module "updated" from file /usr/local/freeradius-server-3.0.17/etc/raddb/mods-enabled/always always updated { rcode = "updated" simulcount = 0 mpp = no } # Loaded module rlm_attr_filter # Loading module "attr_filter.post-proxy" from file /usr/local/freeradius-server-3.0.17/etc/raddb/mods-enabled/attr_filter attr_filter attr_filter.post-proxy { filename = "/usr/local/freeradius-server-3.0.17/etc/raddb/mods-config/attr_filter/post-proxy" key = "%{Realm}" relaxed = no } # Loading module "attr_filter.pre-proxy" from file /usr/local/freeradius-server-3.0.17/etc/raddb/mods-enabled/attr_filter attr_filter attr_filter.pre-proxy { filename = "/usr/local/freeradius-server-3.0.17/etc/raddb/mods-config/attr_filter/pre-proxy" key = "%{Realm}" relaxed = no } # Loading module "attr_filter.access_reject" from file /usr/local/freeradius-server-3.0.17/etc/raddb/mods-enabled/attr_filter attr_filter attr_filter.access_reject { filename = "/usr/local/freeradius-server-3.0.17/etc/raddb/mods-config/attr_filter/access_reject" key = "%{User-Name}" relaxed = no } # Loading module "attr_filter.access_challenge" from file /usr/local/freeradius-server-3.0.17/etc/raddb/mods-enabled/attr_filter attr_filter attr_filter.access_challenge { filename = "/usr/local/freeradius-server-3.0.17/etc/raddb/mods-config/attr_filter/access_challenge" key = "%{User-Name}" relaxed = no } # Loading module "attr_filter.accounting_response" from file /usr/local/freeradius-server-3.0.17/etc/raddb/mods-enabled/attr_filter attr_filter attr_filter.accounting_response { filename = "/usr/local/freeradius-server-3.0.17/etc/raddb/mods-config/attr_filter/accounting_response" key = "%{User-Name}" relaxed = no } # Loaded module rlm_chap # Loading module "chap" from file /usr/local/freeradius-server-3.0.17/etc/raddb/mods-enabled/chap # Loaded module rlm_realm # Loading module "IPASS" from file /usr/local/freeradius-server-3.0.17/etc/raddb/mods-enabled/realm realm IPASS { format = "prefix" delimiter = "/" ignore_default = no ignore_null = no } # Loading module "suffix" from file /usr/local/freeradius-server-3.0.17/etc/raddb/mods-enabled/realm realm suffix { format = "suffix" delimiter = "@" ignore_default = no ignore_null = no } # Loading module "realmpercent" from file /usr/local/freeradius-server-3.0.17/etc/raddb/mods-enabled/realm realm realmpercent { format = "suffix" delimiter = "%" ignore_default = no ignore_null = no } # Loading module "ntdomain" from file /usr/local/freeradius-server-3.0.17/etc/raddb/mods-enabled/realm realm ntdomain { format = "prefix" delimiter = "\\" ignore_default = no ignore_null = no } # Loaded module rlm_utf8 # Loading module "utf8" from file /usr/local/freeradius-server-3.0.17/etc/raddb/mods-enabled/utf8 # Loading module "sradutmp" from file /usr/local/freeradius-server-3.0.17/etc/raddb/mods-enabled/sradutmp radutmp sradutmp { filename = "/usr/local/freeradius-server-3.0.17/var/log/radius/sradutmp" username = "%{User-Name}" case_sensitive = yes check_with_nas = yes permissions = 420 caller_id = no } # Loading module "exec" from file /usr/local/freeradius-server-3.0.17/etc/raddb/mods-enabled/exec exec { wait = no input_pairs = "request" shell_escape = yes timeout = 10 } # Loaded module rlm_preprocess # Loading module "preprocess" from file /usr/local/freeradius-server-3.0.17/etc/raddb/mods-enabled/preprocess preprocess { huntgroups = "/usr/local/freeradius-server-3.0.17/etc/raddb/mods-config/preprocess/huntgroups" hints = "/usr/local/freeradius-server-3.0.17/etc/raddb/mods-config/preprocess/hints" with_ascend_hack = no ascend_channels_per_line = 23 with_ntdomain_hack = no with_specialix_jetstream_hack = no with_cisco_vsa_hack = no with_alvarion_vsa_hack = no } instantiate { } # Instantiating module "logintime" from file /usr/local/freeradius-server-3.0.17/etc/raddb/mods-enabled/logintime # Instantiating module "etc_passwd" from file /usr/local/freeradius-server-3.0.17/etc/raddb/mods-enabled/passwd rlm_passwd: nfields: 3 keyfield 0(User-Name) listable: no # Instantiating module "files" from file /usr/local/freeradius-server-3.0.17/etc/raddb/mods-enabled/files reading pairlist file /usr/local/freeradius-server-3.0.17/etc/raddb/mods-config/files/authorize reading pairlist file /usr/local/freeradius-server-3.0.17/etc/raddb/mods-config/files/accounting reading pairlist file /usr/local/freeradius-server-3.0.17/etc/raddb/mods-config/files/pre-proxy # Instantiating module "eap" from file /usr/local/freeradius-server-3.0.17/etc/raddb/mods-enabled/eap # Linked to sub-module rlm_eap_md5 # Linked to sub-module rlm_eap_leap # Linked to sub-module rlm_eap_gtc gtc { challenge = "Password: " auth_type = "PAP" } # Linked to sub-module rlm_eap_tls tls { tls = "tls-common" } tls-config tls-common { verify_depth = 0 ca_path = "/usr/local/freeradius-server-3.0.17/etc/raddb/certs" pem_file_type = yes private_key_file = "/usr/local/freeradius-server-3.0.17/etc/raddb/certs/server.pem" certificate_file = "/usr/local/freeradius-server-3.0.17/etc/raddb/certs/server.pem" ca_file = "/usr/local/freeradius-server-3.0.17/etc/raddb/certs/ca.pem" private_key_password = <<< secret >>> dh_file = "/usr/local/freeradius-server-3.0.17/etc/raddb/certs/dh" fragment_size = 1024 include_length = yes auto_chain = yes check_crl = no check_all_crl = no cipher_list = "DEFAULT" cipher_server_preference = no ecdh_curve = "prime256v1" tls_max_version = "" tls_min_version = "1.0" cache { enable = no lifetime = 24 max_entries = 255 } verify { skip_if_ocsp_ok = no } ocsp { enable = no override_cert_url = yes url = "http://127.0.0.1/ocsp/" use_nonce = yes timeout = 0 softfail = no } } # Linked to sub-module rlm_eap_ttls ttls { tls = "tls-common" default_eap_type = "md5" copy_request_to_tunnel = no use_tunneled_reply = no virtual_server = "inner-tunnel" include_length = yes require_client_cert = no } tls: Using cached TLS configuration from previous invocation # Linked to sub-module rlm_eap_peap peap { tls = "tls-common" default_eap_type = "mschapv2" copy_request_to_tunnel = no use_tunneled_reply = no proxy_tunneled_request_as_eap = yes virtual_server = "inner-tunnel" soh = no require_client_cert = no } tls: Using cached TLS configuration from previous invocation # Linked to sub-module rlm_eap_mschapv2 mschapv2 { with_ntdomain_hack = no send_error = no } # Instantiating module "linelog" from file /usr/local/freeradius-server-3.0.17/etc/raddb/mods-enabled/linelog # Instantiating module "log_accounting" from file /usr/local/freeradius-server-3.0.17/etc/raddb/mods-enabled/linelog # Instantiating module "idcs" from file /usr/local/freeradius-server-3.0.17/etc/raddb/mods-enabled/idcs ----------------------Entered mod_instantiate------------------------- -------------------- idcs_server_url[https://tenant1.identity.internal.oracle.com:8943 ]------------------------- ----------------------End mod_instantiate------------------------- # Instantiating module "detail" from file /usr/local/freeradius-server-3.0.17/etc/raddb/mods-enabled/detail # Instantiating module "auth_log" from file /usr/local/freeradius-server-3.0.17/etc/raddb/mods-enabled/detail.log rlm_detail (auth_log): 'User-Password' suppressed, will not appear in detail output # Instantiating module "reply_log" from file /usr/local/freeradius-server-3.0.17/etc/raddb/mods-enabled/detail.log # Instantiating module "pre_proxy_log" from file /usr/local/freeradius-server-3.0.17/etc/raddb/mods-enabled/detail.log # Instantiating module "post_proxy_log" from file /usr/local/freeradius-server-3.0.17/etc/raddb/mods-enabled/detail.log # Instantiating module "pap" from file /usr/local/freeradius-server-3.0.17/etc/raddb/mods-enabled/pap # Instantiating module "expiration" from file /usr/local/freeradius-server-3.0.17/etc/raddb/mods-enabled/expiration # Instantiating module "cache_eap" from file /usr/local/freeradius-server-3.0.17/etc/raddb/mods-enabled/cache_eap rlm_cache (cache_eap): Driver rlm_cache_rbtree (module rlm_cache_rbtree) loaded and linked # Instantiating module "mschap" from file /usr/local/freeradius-server-3.0.17/etc/raddb/mods-enabled/mschap rlm_mschap (mschap): using internal authentication # Instantiating module "reject" from file /usr/local/freeradius-server-3.0.17/etc/raddb/mods-enabled/always # Instantiating module "fail" from file /usr/local/freeradius-server-3.0.17/etc/raddb/mods-enabled/always # Instantiating module "ok" from file /usr/local/freeradius-server-3.0.17/etc/raddb/mods-enabled/always # Instantiating module "handled" from file /usr/local/freeradius-server-3.0.17/etc/raddb/mods-enabled/always # Instantiating module "invalid" from file /usr/local/freeradius-server-3.0.17/etc/raddb/mods-enabled/always # Instantiating module "userlock" from file /usr/local/freeradius-server-3.0.17/etc/raddb/mods-enabled/always # Instantiating module "notfound" from file /usr/local/freeradius-server-3.0.17/etc/raddb/mods-enabled/always # Instantiating module "noop" from file /usr/local/freeradius-server-3.0.17/etc/raddb/mods-enabled/always # Instantiating module "updated" from file /usr/local/freeradius-server-3.0.17/etc/raddb/mods-enabled/always # Instantiating module "attr_filter.post-proxy" from file /usr/local/freeradius-server-3.0.17/etc/raddb/mods-enabled/attr_filter reading pairlist file /usr/local/freeradius-server-3.0.17/etc/raddb/mods-config/attr_filter/post-proxy # Instantiating module "attr_filter.pre-proxy" from file /usr/local/freeradius-server-3.0.17/etc/raddb/mods-enabled/attr_filter reading pairlist file /usr/local/freeradius-server-3.0.17/etc/raddb/mods-config/attr_filter/pre-proxy # Instantiating module "attr_filter.access_reject" from file /usr/local/freeradius-server-3.0.17/etc/raddb/mods-enabled/attr_filter reading pairlist file /usr/local/freeradius-server-3.0.17/etc/raddb/mods-config/attr_filter/access_reject [/usr/local/freeradius-server-3.0.17/etc/raddb/mods-config/attr_filter/access_reject]:11 Check item "FreeRADIUS-Response-Delay" found in filter list for realm "DEFAULT". [/usr/local/freeradius-server-3.0.17/etc/raddb/mods-config/attr_filter/access_reject]:11 Check item "FreeRADIUS-Response-Delay-USec" found in filter list for realm "DEFAULT". # Instantiating module "attr_filter.access_challenge" from file /usr/local/freeradius-server-3.0.17/etc/raddb/mods-enabled/attr_filter reading pairlist file /usr/local/freeradius-server-3.0.17/etc/raddb/mods-config/attr_filter/access_challenge # Instantiating module "attr_filter.accounting_response" from file /usr/local/freeradius-server-3.0.17/etc/raddb/mods-enabled/attr_filter reading pairlist file /usr/local/freeradius-server-3.0.17/etc/raddb/mods-config/attr_filter/accounting_response # Instantiating module "IPASS" from file /usr/local/freeradius-server-3.0.17/etc/raddb/mods-enabled/realm # Instantiating module "suffix" from file /usr/local/freeradius-server-3.0.17/etc/raddb/mods-enabled/realm # Instantiating module "realmpercent" from file /usr/local/freeradius-server-3.0.17/etc/raddb/mods-enabled/realm # Instantiating module "ntdomain" from file /usr/local/freeradius-server-3.0.17/etc/raddb/mods-enabled/realm # Instantiating module "preprocess" from file /usr/local/freeradius-server-3.0.17/etc/raddb/mods-enabled/preprocess reading pairlist file /usr/local/freeradius-server-3.0.17/etc/raddb/mods-config/preprocess/huntgroups reading pairlist file /usr/local/freeradius-server-3.0.17/etc/raddb/mods-config/preprocess/hints } # modules radiusd: #### Loading Virtual Servers #### server { # from file /usr/local/freeradius-server-3.0.17/etc/raddb/radiusd.conf } # server server inner-tunnel { # from file /usr/local/freeradius-server-3.0.17/etc/raddb/sites-enabled/inner-tunnel # Loading authenticate {...} # Loading authorize {...} Ignoring "sql" (see raddb/mods-available/README.rst) Ignoring "ldap" (see raddb/mods-available/README.rst) # Loading session {...} # Loading post-proxy {...} # Loading post-auth {...} # Skipping contents of 'if' as it is always 'false' -- /usr/local/freeradius-server-3.0.17/etc/raddb/sites-enabled/inner-tunnel:331 } # server inner-tunnel server default { # from file /usr/local/freeradius-server-3.0.17/etc/raddb/sites-enabled/default # Loading authenticate {...} # Loading authorize {...} # Loading preacct {...} # Loading accounting {...} # Loading post-proxy {...} # Loading post-auth {...} } # server default radiusd: #### Opening IP addresses and Ports #### listen { type = "auth" ipaddr = 127.0.0.1 port = 18120 } listen { type = "auth" ipaddr = * port = 0 limit { max_connections = 16 lifetime = 0 idle_timeout = 30 } } listen { type = "acct" ipaddr = * port = 0 limit { max_connections = 16 lifetime = 0 idle_timeout = 30 } } listen { type = "auth" ipv6addr = :: port = 0 limit { max_connections = 16 lifetime = 0 idle_timeout = 30 } } listen { type = "acct" ipv6addr = :: port = 0 limit { max_connections = 16 lifetime = 0 idle_timeout = 30 } } Listening on auth address 127.0.0.1 port 18120 bound to server inner-tunnel Listening on auth address * port 1812 bound to server default Listening on acct address * port 1813 bound to server default Listening on auth address :: port 1812 bound to server default Listening on acct address :: port 1813 bound to server default Listening on proxy address * port 56091 Listening on proxy address :: port 26194 Ready to process requests (0) Received Access-Request Id 19 from x.y.z:27461 to x.y.z:1812 length 50 (0) User-Name = "TESTRADIUS" (0) User-Password = "testradi" (0) # Executing section authorize from file /usr/local/freeradius-server-3.0.17/etc/raddb/sites-enabled/default (0) authorize { (0) policy filter_username { (0) if (&User-Name) { (0) if (&User-Name) -> TRUE (0) if (&User-Name) { (0) if (&User-Name =~ / /) { (0) if (&User-Name =~ / /) -> FALSE (0) if (&User-Name =~ /@[^@]*@/ ) { (0) if (&User-Name =~ /@[^@]*@/ ) -> FALSE (0) if (&User-Name =~ /\.\./ ) { (0) if (&User-Name =~ /\.\./ ) -> FALSE (0) if ((&User-Name =~ /@/) && (&User-Name !~ /(a)(.+)\.(.+)$/)) { (0) if ((&User-Name =~ /@/) && (&User-Name !~ /(a)(.+)\.(.+)$/)) -> FALSE (0) if (&User-Name =~ /\.$/) { (0) if (&User-Name =~ /\.$/) -> FALSE (0) if (&User-Name =~ /(a)\./) { (0) if (&User-Name =~ /(a)\./) -> FALSE (0) } # if (&User-Name) = notfound (0) } # policy filter_username = notfound <-------------------------------------Authorize using idcs module------------------------------------------------> (0) [idcs] = ok (0) if (ok) { (0) if (ok) -> TRUE (0) if (ok) { (0) update control { (0) Auth-Type := idcs (0) } # update control = noop (0) } # if (ok) = noop (0) [preprocess] = ok (0) [chap] = noop (0) [mschap] = noop (0) [digest] = noop (0) suffix: Checking for suffix after "@" (0) suffix: No '@' in User-Name = "TESTRADIUS", looking up realm NULL (0) suffix: Found realm "NULL" (0) suffix: Adding Stripped-User-Name = "TESTRADIUS" (0) suffix: Adding Realm = "NULL" (0) suffix: Proxying request from user TESTRADIUS to realm NULL (0) suffix: Preparing to proxy authentication request to realm "NULL" (0) [suffix] = updated (0) eap: No EAP-Message, not doing EAP (0) [eap] = noop (0) [files] = noop (0) [expiration] = noop (0) [logintime] = noop (0) [pap] = noop (0) } # authorize = updated (0) Starting proxy to home server x.y.z port 1812 (0) Proxying request to home server x.y.z port 1812 timeout 30.000000 (0) Sent Access-Request Id 161 from 0.0.0.0:56091 to x.y.z:1812 length 84 (0) User-Name = "TESTRADIUS" (0) User-Password = "testradi" (0) Event-Timestamp = "Jan 16 2019 07:33:30 PST" (0) NAS-IP-Address = x.y.zx.y.z (0) Message-Authenticator := 0x00 (0) Proxy-State = 0x3139 Waking up in 0.3 seconds. (0) Expecting proxy response no later than 29.666797 seconds from now Waking up in 29.6 seconds. (0) Sending duplicate proxied request to home server x.y.z port 1812 - ID: 161 (0) Sent Access-Request Id 161 from 0.0.0.0:56091 to x.y.z:1812 length 84 (0) User-Name = "TESTRADIUS" (0) User-Password = "testradi" (0) Event-Timestamp = "Jan 16 2019 07:33:30 PST" (0) NAS-IP-Address = x.y.z (0) Message-Authenticator := 0x00 (0) Proxy-State = 0x3139 Waking up in 4.9 seconds. (0) Expecting proxy response no later than 24.995070 seconds from now Waking up in 24.9 seconds. (0) Sending duplicate proxied request to home server 10.x.y.z port 1812 - ID: 161 (0) Sent Access-Request Id 161 from 0.0.0.0:56091 to 1x.y.z.100:1812 length 84 (0) User-Name = "TESTRADIUS" (0) User-Password = "testradi" (0) Event-Timestamp = "Jan 16 2019 07:33:30 PST" (0) NAS-IP-Address = 10.90.14.70 (0) Message-Authenticator := 0x00 (0) Proxy-State = 0x3139 Waking up in 7.6 seconds. (0) Expecting proxy response no later than 22.338341 seconds from now Waking up in 22.3 seconds. (0) No proxy response, giving up on request and marking it done Marking home server x.y.z port 1812 as zombie (it has not responded in 30.000000 seconds). (0) ERROR: Failing proxied request for user "TESTRADIUS", due to lack of any response from home server 10.y.z.100 port 1812 (0) Clearing existing &reply: attributes (0) Found Post-Proxy-Type Fail-Authentication (0) Post-Proxy-Type sub-section not found. Ignoring. (0) # Executing group from file /usr/local/freeradius-server-3.0.17/etc/raddb/sites-enabled/default (0) There was no response configured: rejecting request (0) Using Post-Auth-Type Reject (0) # Executing group from file /usr/local/freeradius-server-3.0.17/etc/raddb/sites-enabled/default (0) Post-Auth-Type REJECT { (0) attr_filter.access_reject: EXPAND %{User-Name} (0) attr_filter.access_reject: --> TESTRADIUS (0) attr_filter.access_reject: Matched entry DEFAULT at line 11 (0) [attr_filter.access_reject] = updated (0) [eap] = noop (0) policy remove_reply_message_if_eap { (0) if (&reply:EAP-Message && &reply:Reply-Message) { (0) if (&reply:EAP-Message && &reply:Reply-Message) -> FALSE (0) else { (0) [noop] = noop (0) } # else = noop (0) } # policy remove_reply_message_if_eap = noop (0) } # Post-Auth-Type REJECT = updated (0) Sent Access-Reject Id 19 from x.y.z:1812 to x.y.z:27461 length 0 (0) Finished request Waking up in 4.9 seconds. (0) Cleaning up request packet ID 19 with timestamp +249 Waking up in 24.9 seconds. PING: Zombie period is over for home server server01 Marking home server 10.x.y.1 port 1812 as dead. PING: Reviving home server server01 in 300 seconds Waking up in 299.9 seconds. *Thanks,* *Shivaprasad*

2 1

Accounting information
by slnarayanan＠nitt.edu 16 Jan '19

16 Jan '19

Hai, Can you please tell me the Accounting section configuration list.We are trying to configure radius client information to our firewall but server connectivity is done but the user information not send the freeradius server to our firewall.Can you please suggest this setting. Regards, S.Lakshmi narayanan

2 1

Re: LDAP service unavailability behaviour
by Matthew Newton 15 Jan '19

15 Jan '19

Please keep replies on-list. On Tue, 2019-01-15 at 09:23 +0200, Алексей Морозенко wrote: > Do you mean module with faulty LDAP server or we are talking about > all 3 modules? See the documentation in the ldap module file as to what the "start" option does. Then decide which modules you want to set it to 0 for. Probably all of them, but it's up to you. -- Matthew

2 1