- Freeradius-Users - lists.freeradius.org

unlang, variable and SQL (freeradius 3.0.15)
by petr.linke＠seznam.cz 03 Oct '17

03 Oct '17

Hi, I try to store result from SQL into local variable to eliminate running same queries at time. I prepare following scenario: 1/ define new attribute (will be used for store the result from SQL) in the dictionary, attribute type is string (e.g. ATTRIBUTE SQLRESULT 3000 string) 2/ in inner tunnel post-auth section: update control { &SQLRESULT = "%{sql::SELECT count(*) from some_table where .. .}" } if ( %{integer:SQLRESULT} == some_value ) { ... } elsif ( %{integer:SQLRESULT} == other_value ) { ... } in debug I can see, that the SQL return some value, and the value is filled into attribute &SQLRESULT, but afterwards condition do not match (attribute has no value) (10) EXPAND %{sql:SELECT count(*) from table where username = '% {User-Name}' ... (10) --> 2 (10) &SQLRESULT = 2 (10) } # update control = noop (10) if ("%{integer:SQLRESULT}" == 2) { (10) EXPAND %{integer:SQLRESULT} (10) --> (10) if ("%{integer:SQLRESULT}" == 2) -> FALSE Maybe I do not fully understand unlang. Is possible to store the result from SQL in some variable, and afterward use this variable in some conditions? Thank you for any suggestion, Petr Linke

2 3

Class attribute in Reply message
by Umut Arus 03 Oct '17

03 Oct '17

Hello, I need to reply an deniedServices ldap variable in Class attribute for a controller. I added it "replyItem Class deniedServices +=" at ldap.attrmap file. and sites-available/default file includes it. But it override the Class value to empty. update reply { Class += "%{Reply-Message}" } Where it is wrong? FreeRADIUS Version 2.2.8 Output parts are: [peap] Setting User-Name to tayfund Sending tunneled request EAP-Message = 0x020900421a0209003d3167738a93d83ed76e5251bbbaa183542f0000000000000000008955f2389888dbc3771d940bc5c9ade688b2ec3b08e4f80074617966756e64 FreeRADIUS-Proxied-To = 127.0.0.1 User-Name = "tayfund" State = 0xb024cc1cb02dd66832d4a5f6f46a2d5f NAS-IP-Address = 10.200.0.2 NAS-Port = 0 NAS-Identifier = "10.200.0.5" NAS-Port-Type = Wireless-802.11 Calling-Station-Id = "748D08E39D7F" Called-Station-Id = "001A1E0015F0" Service-Type = Framed-User Framed-MTU = 1100 Aruba-Essid-Name = "SABANCIUNIV" Aruba-Location-Id = "BM_IT_NETSYS_7b:fe" Aruba-AP-Group = "BM_binasi" Aruba-Device-Type = "iPhone" server inner-tunnel { # Executing section authorize from file /etc/freeradius/sites-enabled/inner-tunnel +group authorize { ++[mschap] = noop [suffix] No '@' in User-Name = "tayfund", looking up realm NULL [suffix] No such realm "NULL" ++[suffix] = noop [eap] EAP packet type response id 9 length 66 [eap] No EAP Start, assuming it's an on-going EAP conversation ++[eap] = updated [ldap] performing user authorization for tayfund [ldap] expand: (uid=%{mschap:User-Name:-%{User-Name}}) -> (uid=tayfund) [ldap] expand: o=sabanciuniv.edu -> o=sabanciuniv.edu [ldap] ldap_get_conn: Checking Id: 0 [ldap] ldap_get_conn: Got Id: 0 [ldap] performing search in o=sabanciuniv.edu, with filter (uid=tayfund) [ldap] Added User-Password = 5F479EB90623041F464CD3F4B685C80A in check items [ldap] No default NMAS login sequence [ldap] looking for check items in directory... [ldap] userPassword -> Password-With-Header == "{SSHA}wM3CoVk5jYLVnHz8jyv6vHBlqv52bw==" [ldap] sambaNtPassword -> NT-Password == 0x3546343739454239303632333034314634363443443346344236383543383041 [ldap] sambaLmPassword -> LM-Password == 0x3836413243354632393945434139444343313745393630323543414633314130 [ldap] radiusAuthType -> Auth-Type == EAP [ldap] looking for reply items in directory... * [ldap] deniedServices -> Class += 0x7375636f75727365* [ldap] ou -> Operator-Name = "admin" [ldap] ou -> Operator-Name = "IT" [ldap] ldap_release_conn: Release Id: 0 ++[ldap] = ok +} # group authorize = updated Found Auth-Type = EAP !!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!! !!! Replacing User-Password in config items with Cleartext-Password. !!! !!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!! !!! Please update your configuration so that the "known good" !!! !!! clear text password is in Cleartext-Password, and not in User-Password. !!! !!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!! # Executing group from file /etc/freeradius/sites-enabled/inner-tunnel +group authenticate { [eap] Request found, released from the list [eap] EAP/mschapv2 [eap] processing type mschapv2 [mschapv2] # Executing group from file /etc/freeradius/sites-enabled/inner-tunnel [mschapv2] +group MS-CHAP { [mschap] Found LM-Password [mschap] Found NT-Password [mschap] Creating challenge hash with username: tayfund [mschap] Client is using MS-CHAPv2 for tayfund, we need NT-Password [mschap] adding MS-CHAPv2 MPPE keys ++[mschap] = ok ++update outer.request { expand: %{User-Name} -> tayfund ++} # update outer.request = noop ++update outer.reply { expand: %{User-Name} -> tayfund ++} # update outer.reply = noop +} # group MS-CHAP = ok MSCHAP Success ++[eap] = handled +} # group authenticate = handled } # server inner-tunnel [peap] Got tunneled reply code 11 Class += 0x7375636f75727365 Operator-Name = "admin" EAP-Message = 0x010a00331a0309002e533d38384136303239324543424441413244303139424145343031363537393336353637364246453633 Message-Authenticator = 0x00000000000000000000000000000000 State = 0xb024cc1cb12ed66832d4a5f6f46a2d5f [peap] Got tunneled reply RADIUS code Access-Challenge * Class += 0x7375636f75727365* Operator-Name = "admin" EAP-Message = 0x010a00331a0309002e533d38384136303239324543424441413244303139424145343031363537393336353637364246453633 Message-Authenticator = 0x00000000000000000000000000000000 State = 0xb024cc1cb12ed66832d4a5f6f46a2d5f [peap] Got tunneled Access-Challenge [peap] >>> Unknown TLS version [length 0005] ++[eap] = handled +} # group authenticate = handled Going to the next request rad_recv: Access-Request packet from host 10.200.0.5 port 52530, id=108, length=259 User-Name = "tayfund" NAS-IP-Address = 10.200.0.2 NAS-Port = 0 NAS-Identifier = "10.200.0.5" NAS-Port-Type = Wireless-802.11 Calling-Station-Id = "748D08E39D7F" Called-Station-Id = "001A1E0015F0" Service-Type = Framed-User Framed-MTU = 1100 EAP-Message = 0x020b002e190017030300239b010c14db2db49adb4087eaadbbbcf3628daf65188a552fdc7d8fbeb850ded62316e3 State = 0x0f5a59a0065140db3a8c7af8ad4bf4cc Aruba-Essid-Name = "SABANCIUNIV" Aruba-Location-Id = "BM_IT_NETSYS_7b:fe" Aruba-AP-Group = "BM_binasi" Aruba-Device-Type = "iPhone" Message-Authenticator = 0xa1cfe667210437f5f5eaf132bf431a90 # Executing section authorize from file /etc/freeradius/sites-enabled/default +group authorize { ++[preprocess] = ok ++[chap] = noop ++[mschap] = noop ++[digest] = noop [suffix] No '@' in User-Name = "tayfund", looking up realm NULL [suffix] No such realm "NULL" ++[suffix] = noop [eap] EAP packet type response id 11 length 46 [eap] Continuing tunnel setup. ++[eap] = ok +} # group authorize = ok Found Auth-Type = EAP # Executing group from file /etc/freeradius/sites-enabled/default +group authenticate { [eap] Request found, released from the list [eap] EAP/peap [eap] processing type peap [peap] processing EAP-TLS [peap] eaptls_verify returned 7 [peap] Done initial handshake [peap] <<< Unknown TLS version [length 0005] [peap] eaptls_process returned 7 [peap] EAPTLS_OK [peap] Session established. Decoding tunneled attributes. [peap] Peap state send tlv success [peap] Received EAP-TLV response. [peap] Success [eap] Freeing handler ++[eap] = ok +} # group authenticate = ok Login OK: [tayfund] (from client 10.200.0.0/24 port 0 cli 748D08E39D7F) # Executing section post-auth from file /etc/freeradius/sites-enabled/default +group post-auth { [reply_log] expand: %{Packet-Src-IP-Address} -> 10.200.0.5 [reply_log] expand: /var/log/freeradius/radacct/%{%{Packet-Src-IP-Address}:-%{Packet-Src-IPv6-Address}}/reply-detail-%Y%m%d -> /var/log/freeradius/radacct/10.200.0.5/reply-detail-20171003 [reply_log] /var/log/freeradius/radacct/%{%{Packet-Src-IP-Address}:-%{Packet-Src-IPv6-Address}}/reply-detail-%Y%m%d expands to /var/log/freeradius/radacct/10.200.0.5/reply-detail-20171003 [reply_log] expand: %t -> Tue Oct 3 12:06:11 2017 ++[reply_log] = ok ++[ldap] = noop ++[exec] = noop ++update reply { expand: %{Reply-Message} -> ++} # update reply = noop +} # group post-auth = ok Sending Access-Accept of id 108 to 10.200.0.5 port 52530 MS-MPPE-Recv-Key = 0xfc792d0aa5a1ff4c6e90676c80c47b799958fb603caf17dc11b68eeb182f922f MS-MPPE-Send-Key = 0x00176d351e6d75e96c0429fefa871f38022b851e2a897921fbc2ab0cc891ee5b EAP-Message = 0x030b0004 Message-Authenticator = 0x00000000000000000000000000000000 User-Name = "tayfund" Class = 0x Finished request 785. Going to the next request Cleaning up request 596 ID 154 with timestamp +11 Waking up in 0.1 seconds. rad_recv: Access-Request packet from host 10.200.0.5 port 52530, id=101, length=211 User-Name = "dbostan" NAS-IP-Address = 10.200.0.2 NAS-Port = 0 NAS-Identifier = "10.200.0.5" NAS-Port-Type = Wireless-802.11 Calling-Station-Id = "E0C767163B2F" Called-Station-Id = "001A1E0015F0" Service-Type = Framed-User Framed-MTU = 1100 EAP-Message = 0x020500061900 State = 0xf8fdecb8fbf8f57eaba961c2ded7fb6f Aruba-Essid-Name = "SABANCIUNIV" Aruba-Location-Id = "Yurt_A5_Kat1_AP4_60:6c" Aruba-AP-Group = "Yurt_Binasi" Message-Authenticator = 0xb071cd65a32ccfd350f5f7349f570df5 # Executing section authorize from file /etc/freeradius/sites-enabled/default +group authorize { ++[preprocess] = ok ++[chap] = noop ++[mschap] = noop ++[digest] = noop [suffix] No '@' in User-Name = "dbostan", looking up realm NULL [suffix] No such realm "NULL" ++[suffix] = noop [reply_log] expand: %{Packet-Src-IP-Address} -> 10.200.0.5 [reply_log] expand: /var/log/freeradius/radacct/%{%{Packet-Src-IP-Address}:-%{Packet-Src-IPv6-Address}}/reply-detail-%Y%m%d -> /var/log/freeradius/radacct/10.200.0.5/reply-detail-20171003 [reply_log] /var/log/freeradius/radacct/%{%{Packet-Src-IP-Address}:-%{Packet-Src-IPv6-Address}}/reply-detail-%Y%m%d expands to /var/log/freeradius/radacct/10.200.0.5/reply-detail-20171003 [reply_log] expand: %t -> Tue Oct 3 12:06:11 2017 ++[reply_log] = ok ++[ldap] = noop ++[exec] = noop ++update reply { * expand: %{Reply-Message} -> * ++} # update reply = noop +} # group post-auth = ok Sending Access-Accept of id 108 to 10.200.0.5 port 52530 MS-MPPE-Recv-Key = 0xfc792d0aa5a1ff4c6e90676c80c47b799958fb603caf17dc11b68eeb182f922f MS-MPPE-Send-Key = 0x00176d351e6d75e96c0429fefa871f38022b851e2a897921fbc2ab0cc891ee5b EAP-Message = 0x030b0004 Message-Authenticator = 0x00000000000000000000000000000000 User-Name = "tayfund" * Class = 0x* Finished request 785. Going to the next request Cleaning up request 596 ID 154 with timestamp +11 Waking up in 0.1 seconds. rad_recv: Access-Request packet from host 10.200.0.5 port 52530, id=101, length=211 User-Name = "dbostan" NAS-IP-Address = 10.200.0.2 NAS-Port = 0 NAS-Identifier = "10.200.0.5" NAS-Port-Type = Wireless-802.11 Calling-Station-Id = "E0C767163B2F" Called-Station-Id = "001A1E0015F0" Service-Type = Framed-User Framed-MTU = 1100 EAP-Message = 0x020500061900 State = 0xf8fdecb8fbf8f57eaba961c2ded7fb6f Aruba-Essid-Name = "SABANCIUNIV" Aruba-Location-Id = "Yurt_A5_Kat1_AP4_60:6c" Aruba-AP-Group = "Yurt_Binasi" Message-Authenticator = 0xb071cd65a32ccfd350f5f7349f570df5 # Executing section authorize from file /etc/freeradius/sites-enabled/default +group authorize { ++[preprocess] = ok ++[chap] = noop ++[mschap] = noop ++[digest] = noop [suffix] No '@' in User-Name = "dbostan", looking up realm NULL [suffix] No such realm "NULL" ++[suffix] = noop [eap] EAP packet type response id 5 length 6 [eap] Continuing tunnel setup. ++[eap] = ok +} # group authorize = ok Found Auth-Type = EAP # Executing group from file /etc/freeradius/sites-enabled/default +group authenticate { [eap] Request found, released from the list [eap] EAP/peap [eap] processing type peap [peap] processing EAP-TLS [peap] Received TLS ACK [peap] ACK handshake fragment handler [peap] eaptls_verify returned 1 [peap] eaptls_process returned 13 [peap] EAPTLS_HANDLED ++[eap] = handled +} # group authenticate = handled Sending Access-Challenge of id 101 to 10.200.0.5 port 52530 EAP-Message = 0x010601d31900b69aa50fb8b93f207dae4ab5b89ce41db6abe694a5c1c783addbf527870e046cd5ffdda05ded8752b72b1502ae39a66a74e9dac4e7bc4d341ea95c4d335f92092f88665d7797c71d7613a9d5e5f116091135d5acdb2471702c98560bd917b4d1e3512b5e75e8d5d0dc4f34edc2056680a1cbe633160301014b0c000147030017410475fb60921d74cf2365a6e0348d653613d6e5d1222e87ed4d9b572cb9402e0429049ec55655bf436673431b9c907c0181d6b68feeb9f350adc2dccee8f376d53d01005606850c2d8755fc048572396aaee257a555261ad7deaa9d4d1983db0ddc0b26679e7a3aeab13623ff652de806acd87337d63a EAP-Message = 0x55b131ca32435839495c0a854ab8507fdf5c7a420c64e3f205ef607f2df152265f4544b6b1a5673e05417a38f1e10b63c28438bda216249aff502a43efc8a154ce646da60df5da11d182a059f010c082389b4ad9f901113c159cfd4a0653583ea745983ba8ef9aae665699c04d3a9b642a33ba7bdb9d8960948823747e88e115f41d2114d4cb5f63aec906b7c53c45fb117bccf41276015597025d295aed742520a5bfd019b54e91c4986655fee8f7832ac166433b1f9897eb02f307bae930dc01b8cd0edd0d526d8bd201a8b416030100040e000000 Message-Authenticator = 0x00000000000000000000000000000000 State = 0xf8fdecb8fcfbf57eaba961c2ded7fb6f Finished request 786. thanks.. -- *Umut A* System Specialist Information Technology Sabancı University

2 1

Cannot use syslog
by Olivier 03 Oct '17

03 Oct '17

Hi, One last question. I would like to use syslog to log the activity of FreeRadius 3.0.15. My radius server is running chrooted and nothing shows in syslog despite I add a rule to log *.* in /var/log/all in syslog configuration. How FreeRadius is accessing syslog? Through the Unix socket (and then I need it in the chroot environment) of through the network stack? The server is FreeBSD. Thanks in advance, olivier --

2 3

Re: EAP request to FreeRADIUS 3 server backed by MariaDB has empty password
by Oliver Webb 02 Oct '17

02 Oct '17

Alan, I have now used your example to create a new version of "req.txt" and it is indeed now working: User-Name = "tu" Cleartext-Password = "testp2" NAS-IP-Address = 192.168.1.106 EAP-Code = Response EAP-Id = 210 EAP-Type-Identity = "tu" Message-Authenticator = 0 NAS-Port = 0 Thank you so much for your help. Kindest regards, Oliver

1 0

EAP request to FreeRADIUS 3 server backed by MariaDB has empty password
by Oliver Webb 02 Oct '17

02 Oct '17

Dear all, Apologies for the double email, I understand you have no obligation to help me, but I am struggling here. Last week I asked here about the following ServerFault question, I was kindly offered help but we were not able to resolve the issue. https://serverfault.com/q/871802/292782 I have included details and debug outputs in the linked question, if you need any more details I will happily gather them. I wonder if anyone would have the time to take a closer look in the hope that this can be resolved. Thank you, Oliver

2 4

cucm and ip phones
by Vacheslav 02 Oct '17

02 Oct '17

Peace, I configured my ip phones to use mab, but I read that with Radius it is possible to authenticate capable ip phones with tls. I searched the internet on how to do it but found almost nothing. Should I import the created self signed certificates from the freeradius server to the cucm? Or is that I have to export the cucm certificates to the cert directory of the freeradius server? Anyone has experience in configuring cucm with dot1x?

3 7

Configuring Authentication with Active Directory and TLS
by Tom Yard 02 Oct '17

02 Oct '17

Dear, finally I could put in work my Freeradius server following the "Configuring Authentication with Active Directory" tutorial from Alan Dekok, using NTLM_AUTH for MS-CHAP. But now I have the following question: in order to create a secure TLS channel to authenticate WiFi users with a valid TLS certificate, is the use of EAP mechanism and inner-tunnel file the right way for this ??? Special thanks, Tom Yard

2 1

allow_expired_crl
by Jonathan Gazeley 02 Oct '17

02 Oct '17

Hi folks, I maintain a Puppet module which manages FreeRADIUS deployments[1]. A user has opened a feature request asking me to add support for the undocumented boolean "allow_expired_crl"[2]. While I like to be as helpful as I can be when improving my module, is it really a good idea to use undocumented features, and to appear to encourage others to do so? Is use of this setting supported in any way? [1] https://github.com/djjudas21/puppet-freeradius [2] https://github.com/FreeRADIUS/freeradius-server/search?utf8=%E2%9C%93&q=all… Thanks, Jonathan

2 1

Freeradius issues related with DMZ firewall
by Ramon Escriba 02 Oct '17

02 Oct '17

Hi Experts, I have a 'funny' problem with my freeradius 3.0.4 and our Aruba controller. I am testing a freeradius with 802.1x (EAP-MSCHAPv2: WPA2-Ent+AES+PEAP) configuration that works pretty well when both, radius & Aruba, are in our internal network. So works fine with Mac,Win7,Android,iphone, etc The problem came when we moved the Machine to DMZ (Pfsense fw). Lots of small problems (dns's, hosts,etc) raised and were solved. I used the eapol_test successfully on an internal linux that connects successfully to de radius in DMZ, so I went ahead. But when we do the same Mac,Win7,Android,etc WiFIi connection tests with the radius in DMZ, the authentication fails (see radius -X log below). To test if it was a Firewall issues, UDP/TCP ports are fully open between radius(DMZ) & Aruba(internal), in both ways. We opened dmz radius to the internal DNS, I used a Firewall catch all rule to get any ipv4+6 that goes missing by the Firewall rules, but nothing shows up. I tried to Wireshark the Wifi connection from the client win7 without success. Well, I hope someone else had a similar problem and could share the solution, or any clue. Logs of the failing connection ( Win7 -> Aruba ->radius DMZ) , maybe you can see something strange: 10.10.10.10: Aruba 84.84.84.84: Radius at DMZ Received Access-Request Id 111 from 10.10.10.10:32866 to 84.84.84.84:1812 length 205 User-Name = 'test(a)acme.com' NAS-IP-Address = 10.10.10.10 NAS-Port = 0 NAS-Identifier = '10.10.10.10' NAS-Port-Type = Wireless-802.11 Calling-Station-Id = 'A4C494Exxxxx' Called-Station-Id = '000B866xxxxx' Service-Type = Login-User Framed-MTU = 1100 EAP-Message = 0x0xx400xxxxxx146xxxxxxxxxxxc673 Aruba-Essid-Name = 'TEST_SSID' Aruba-Location-Id = 'AP1' Aruba-AP-Group = 'default' Message-Authenticator = 0xbxxx268xxxxxxxxxxxxc10f08dae88 (0) Received Access-Request packet from host 10.10.10.10 port 32866, id=111, length=205 (0) User-Name = 'test(a)acme.com' (0) NAS-IP-Address = 10.10.10.10 (0) NAS-Port = 0 (0) NAS-Identifier = '10.10.10.10' (0) NAS-Port-Type = Wireless-802.11 (0) Calling-Station-Id = 'A4C494XXXXXX' (0) Called-Station-Id = ''000B86xxxxxx' (0) Service-Type = Login-User (0) Framed-MTU = 1100 (0) EAP-Message = 0x02040019017465xxxxxxxxxxxx4063656c6c732e6573 (0) Aruba-Essid-Name = 'TEST_SSID' (0) Aruba-Location-Id = 'AP1' (0) Aruba-AP-Group = 'default' (0) Message-Authenticator = 0xb268fe2779551dxxxxxxxxxxxx08dae88 (0) # Executing section authorize from file /etc/raddb/sites-enabled/default (0) authorize { (0) filter_username filter_username { (0) if (!&User-Name) (0) if (!&User-Name) -> FALSE (0) if (&User-Name =~ / /) (0) if (&User-Name =~ / /) -> FALSE (0) if (&User-Name =~ /@.*@/ ) (0) if (&User-Name =~ /@.*@/ ) -> FALSE (0) if (&User-Name =~ /\\.\\./ ) (0) if (&User-Name =~ /\\.\\./ ) -> FALSE (0) if ((&User-Name =~ /@/) && (&User-Name !~ /(a)(.+)\\.(.+)$/)) (0) if ((&User-Name =~ /@/) && (&User-Name !~ /(a)(.+)\\.(.+)$/)) -> FALSE (0) if (&User-Name =~ /\\.$/) (0) if (&User-Name =~ /\\.$/) -> FALSE (0) if (&User-Name =~ /(a)\\./) (0) if (&User-Name =~ /(a)\\./) -> FALSE (0) } # filter_username filter_username = notfound (0) [preprocess] = ok (0) auth_log : EXPAND /var/log/radius/radacct/%{%{Packet-Src-IP-Address}:-%{Packet-Src-IPv6-Addres s}}/auth-detail-%Y%m%d (0) auth_log : --> /var/log/radius/radacct/10.10.10.10/auth-detail-20170929 (0) auth_log : /var/log/radius/radacct/%{%{Packet-Src-IP-Address}:-%{Packet-Src-IPv6-Addres s}}/auth-detail-%Y%m%d expands to /var/log/radius/radacct/10.10.10.10/auth-detail-20170929 (0) auth_log : EXPAND %t (0) auth_log : --> Fri Sep 29 16:42:40 2017 (0) [auth_log] = ok (0) [mschap] = noop (0) suffix : Checking for suffix after "@" (0) suffix : Looking up realm "acme.com" for User-Name = "test(a)acme.com" (0) suffix : Found realm "acme.com" (0) suffix : Adding Realm = "acme.com" (0) suffix : Authentication realm is LOCAL (0) [suffix] = ok (0) eap : Peer sent code Response (2) ID 4 length 25 (0) eap : EAP-Identity reply, returning 'ok' so we can short-circuit the rest of authorize (0) [eap] = ok (0) } # authorize = ok (0) Found Auth-Type = EAP (0) # Executing group from file /etc/raddb/sites-enabled/default (0) authenticate { (0) eap : Peer sent method Identity (1) (0) eap : Calling eap_peap to process EAP data (0) eap_peap : Flushing SSL sessions (of #0) (0) eap_peap : Initiate (0) eap_peap : Start returned 1 (0) eap : New EAP session, adding 'State' attribute to reply 0x7317e1da7312f877 (0) [eap] = handled (0) } # authenticate = handled (0) Sending Access-Challenge packet to host 10.10.10.10 port 32866, id=111, length=0 (0) EAP-Message = 0x010500061920 (0) Message-Authenticator = 0x00000000000000000000000000000000 (0) State = 0x7317e1da7312f877fca7b6e2bbfa846d Sending Access-Challenge Id 111 from 84.84.84.84:1812 to 10.10.10.10:32866 EAP-Message = 0x010500061920 Message-Authenticator = 0x00000000000000000000000000000000 State = 0x7317e1da7312f877fca7b6e2bbfa846d (0) Finished request Waking up in 0.3 seconds. Waking up in 6.6 seconds. Received Access-Request Id 111 from 10.10.10.10:32866 to 84.84.84.84:1812 length 205 Sending Access-Challenge Id 111 from 84.84.84.84:1812 to 10.10.10.10:32866 Waking up in 999993.0 seconds. Received Access-Request Id 111 from 10.10.10.10:32866 to 84.84.84.84:1812 length 205 Sending Access-Challenge Id 111 from 84.84.84.84:1812 to 10.10.10.10:32866 Waking up in 1999986.0 seconds. Received Access-Request Id 111 from 10.10.10.10:32866 to 84.84.84.84:1812 length 205 Sending Access-Challenge Id 111 from 84.84.84.84:1812 to 10.10.10.10:32866 Waking up in 3999977.0 seconds.

2 1

I want change reply-message for all users
by تعلم البرمجة 02 Oct '17

02 Oct '17

hello iam using freeradius 3.0.11 and i want change reply message Hello $(user-name) for All clients I am using sql i can change when reject but when accept I cant Sorry For My English

3 9