- Freeradius-Users - lists.freeradius.org

allow_expired_crl
by Jonathan Gazeley 02 Oct '17

02 Oct '17

Hi folks, I maintain a Puppet module which manages FreeRADIUS deployments[1]. A user has opened a feature request asking me to add support for the undocumented boolean "allow_expired_crl"[2]. While I like to be as helpful as I can be when improving my module, is it really a good idea to use undocumented features, and to appear to encourage others to do so? Is use of this setting supported in any way? [1] https://github.com/djjudas21/puppet-freeradius [2] https://github.com/FreeRADIUS/freeradius-server/search?utf8=%E2%9C%93&q=all… Thanks, Jonathan

2 1

Freeradius issues related with DMZ firewall
by Ramon Escriba 02 Oct '17

02 Oct '17

Hi Experts, I have a 'funny' problem with my freeradius 3.0.4 and our Aruba controller. I am testing a freeradius with 802.1x (EAP-MSCHAPv2: WPA2-Ent+AES+PEAP) configuration that works pretty well when both, radius & Aruba, are in our internal network. So works fine with Mac,Win7,Android,iphone, etc The problem came when we moved the Machine to DMZ (Pfsense fw). Lots of small problems (dns's, hosts,etc) raised and were solved. I used the eapol_test successfully on an internal linux that connects successfully to de radius in DMZ, so I went ahead. But when we do the same Mac,Win7,Android,etc WiFIi connection tests with the radius in DMZ, the authentication fails (see radius -X log below). To test if it was a Firewall issues, UDP/TCP ports are fully open between radius(DMZ) & Aruba(internal), in both ways. We opened dmz radius to the internal DNS, I used a Firewall catch all rule to get any ipv4+6 that goes missing by the Firewall rules, but nothing shows up. I tried to Wireshark the Wifi connection from the client win7 without success. Well, I hope someone else had a similar problem and could share the solution, or any clue. Logs of the failing connection ( Win7 -> Aruba ->radius DMZ) , maybe you can see something strange: 10.10.10.10: Aruba 84.84.84.84: Radius at DMZ Received Access-Request Id 111 from 10.10.10.10:32866 to 84.84.84.84:1812 length 205 User-Name = 'test(a)acme.com' NAS-IP-Address = 10.10.10.10 NAS-Port = 0 NAS-Identifier = '10.10.10.10' NAS-Port-Type = Wireless-802.11 Calling-Station-Id = 'A4C494Exxxxx' Called-Station-Id = '000B866xxxxx' Service-Type = Login-User Framed-MTU = 1100 EAP-Message = 0x0xx400xxxxxx146xxxxxxxxxxxc673 Aruba-Essid-Name = 'TEST_SSID' Aruba-Location-Id = 'AP1' Aruba-AP-Group = 'default' Message-Authenticator = 0xbxxx268xxxxxxxxxxxxc10f08dae88 (0) Received Access-Request packet from host 10.10.10.10 port 32866, id=111, length=205 (0) User-Name = 'test(a)acme.com' (0) NAS-IP-Address = 10.10.10.10 (0) NAS-Port = 0 (0) NAS-Identifier = '10.10.10.10' (0) NAS-Port-Type = Wireless-802.11 (0) Calling-Station-Id = 'A4C494XXXXXX' (0) Called-Station-Id = ''000B86xxxxxx' (0) Service-Type = Login-User (0) Framed-MTU = 1100 (0) EAP-Message = 0x02040019017465xxxxxxxxxxxx4063656c6c732e6573 (0) Aruba-Essid-Name = 'TEST_SSID' (0) Aruba-Location-Id = 'AP1' (0) Aruba-AP-Group = 'default' (0) Message-Authenticator = 0xb268fe2779551dxxxxxxxxxxxx08dae88 (0) # Executing section authorize from file /etc/raddb/sites-enabled/default (0) authorize { (0) filter_username filter_username { (0) if (!&User-Name) (0) if (!&User-Name) -> FALSE (0) if (&User-Name =~ / /) (0) if (&User-Name =~ / /) -> FALSE (0) if (&User-Name =~ /@.*@/ ) (0) if (&User-Name =~ /@.*@/ ) -> FALSE (0) if (&User-Name =~ /\\.\\./ ) (0) if (&User-Name =~ /\\.\\./ ) -> FALSE (0) if ((&User-Name =~ /@/) && (&User-Name !~ /(a)(.+)\\.(.+)$/)) (0) if ((&User-Name =~ /@/) && (&User-Name !~ /(a)(.+)\\.(.+)$/)) -> FALSE (0) if (&User-Name =~ /\\.$/) (0) if (&User-Name =~ /\\.$/) -> FALSE (0) if (&User-Name =~ /(a)\\./) (0) if (&User-Name =~ /(a)\\./) -> FALSE (0) } # filter_username filter_username = notfound (0) [preprocess] = ok (0) auth_log : EXPAND /var/log/radius/radacct/%{%{Packet-Src-IP-Address}:-%{Packet-Src-IPv6-Addres s}}/auth-detail-%Y%m%d (0) auth_log : --> /var/log/radius/radacct/10.10.10.10/auth-detail-20170929 (0) auth_log : /var/log/radius/radacct/%{%{Packet-Src-IP-Address}:-%{Packet-Src-IPv6-Addres s}}/auth-detail-%Y%m%d expands to /var/log/radius/radacct/10.10.10.10/auth-detail-20170929 (0) auth_log : EXPAND %t (0) auth_log : --> Fri Sep 29 16:42:40 2017 (0) [auth_log] = ok (0) [mschap] = noop (0) suffix : Checking for suffix after "@" (0) suffix : Looking up realm "acme.com" for User-Name = "test(a)acme.com" (0) suffix : Found realm "acme.com" (0) suffix : Adding Realm = "acme.com" (0) suffix : Authentication realm is LOCAL (0) [suffix] = ok (0) eap : Peer sent code Response (2) ID 4 length 25 (0) eap : EAP-Identity reply, returning 'ok' so we can short-circuit the rest of authorize (0) [eap] = ok (0) } # authorize = ok (0) Found Auth-Type = EAP (0) # Executing group from file /etc/raddb/sites-enabled/default (0) authenticate { (0) eap : Peer sent method Identity (1) (0) eap : Calling eap_peap to process EAP data (0) eap_peap : Flushing SSL sessions (of #0) (0) eap_peap : Initiate (0) eap_peap : Start returned 1 (0) eap : New EAP session, adding 'State' attribute to reply 0x7317e1da7312f877 (0) [eap] = handled (0) } # authenticate = handled (0) Sending Access-Challenge packet to host 10.10.10.10 port 32866, id=111, length=0 (0) EAP-Message = 0x010500061920 (0) Message-Authenticator = 0x00000000000000000000000000000000 (0) State = 0x7317e1da7312f877fca7b6e2bbfa846d Sending Access-Challenge Id 111 from 84.84.84.84:1812 to 10.10.10.10:32866 EAP-Message = 0x010500061920 Message-Authenticator = 0x00000000000000000000000000000000 State = 0x7317e1da7312f877fca7b6e2bbfa846d (0) Finished request Waking up in 0.3 seconds. Waking up in 6.6 seconds. Received Access-Request Id 111 from 10.10.10.10:32866 to 84.84.84.84:1812 length 205 Sending Access-Challenge Id 111 from 84.84.84.84:1812 to 10.10.10.10:32866 Waking up in 999993.0 seconds. Received Access-Request Id 111 from 10.10.10.10:32866 to 84.84.84.84:1812 length 205 Sending Access-Challenge Id 111 from 84.84.84.84:1812 to 10.10.10.10:32866 Waking up in 1999986.0 seconds. Received Access-Request Id 111 from 10.10.10.10:32866 to 84.84.84.84:1812 length 205 Sending Access-Challenge Id 111 from 84.84.84.84:1812 to 10.10.10.10:32866 Waking up in 3999977.0 seconds.

2 1

I want change reply-message for all users
by تعلم البرمجة 02 Oct '17

02 Oct '17

hello iam using freeradius 3.0.11 and i want change reply message Hello $(user-name) for All clients I am using sql i can change when reject but when accept I cant Sorry For My English

3 9

ERROR: ^ Invalid variable expansion 3.0.11
by تعلم البرمجة 01 Oct '17

01 Oct '17

Hello , I am Using freeradius 3.0.11 and send attributes to php page and get this error Executing: /usr/bin/php5 /var/www/html/new/set_idle_timeout.php %{User-Name} %{User-Password} %{Framed-IP-Address} %(Calling-Station-Id) 7 : (0) EXPAND %{User-Name} (0) --> 12 (0) EXPAND %{User-Password} (0) --> (0) EXPAND %{Framed-IP-Address} (0) --> 10.40.47.250 (0) ERROR: %(Calling-Station-Id) (0) ERROR: ^ Invalid variable expansion Sorry If my english is bad

3 4

add attribute FreeRADIUS-Client-NAS-Type in req accounting?
by Dmitry Yashin 01 Oct '17

01 Oct '17

hi, how i can add attribute FreeRADIUS-Client-NAS-Type in accounting, i load &FreeRADIUS-Client-NAS-Type = "%{sql: SELECT type FROM nas WHERE host = '%{Packet-Src-IP-Address}'}" from dynamic_clients , and in preacct { update request { &Acct-Unique-Session-Id := "%{md5:%{User-Name},%{Acct-Session-ID},%{%{NAS-IPv6-Address}:-%{NAS-IP-Address}},%{NAS-Identifier},%{NAS-Port-ID},%{NAS-Port}}" &FreeRADIUS-Client-NAS-Type := &control:FreeRADIUS-Client-NAS-Type } } accounting { # ok rest } but in post on rest not see FreeRADIUS-Client-NAS-Type in log Thu Sep 28 21:40:30 2017 : Debug: (324) # Executing section preacct from file /etc/raddb/radiusd.conf Thu Sep 28 21:40:30 2017 : Debug: (324) preacct { Thu Sep 28 21:40:30 2017 : Debug: (324) update request { Thu Sep 28 21:40:30 2017 : Debug: (324) EXPAND %{md5:%{User-Name},%{Acct-Session-ID},%{%{NAS-IPv6-Address}:-%{NAS-IP-Address}},%{NAS-Identifier},%{NAS-Port-ID},%{NAS-Port}} Thu Sep 28 21:40:30 2017 : Debug: (324) --> 9f7d7ee63b81739f567f5703597b1556 Thu Sep 28 21:40:30 2017 : Debug: (324) &Acct-Unique-Session-Id := 9f7d7ee63b81739f567f5703597b1556 Thu Sep 28 21:40:30 2017 : Debug: (324) No attributes updated Thu Sep 28 21:40:30 2017 : Debug: (324) No attributes updated Thu Sep 28 21:40:30 2017 : Debug: (324) No attributes updated Thu Sep 28 21:40:30 2017 : Debug: (324) } # update request = noop Thu Sep 28 21:40:30 2017 : Debug: (324) } # preacct = noop Thu Sep 28 21:40:30 2017 : Debug: (324) # Executing section accounting from file /etc/raddb/radiusd.conf Thu Sep 28 21:40:30 2017 : Debug: (324) accounting { Thu Sep 28 21:40:30 2017 : Debug: (324) modsingle[accounting]: calling rest (rlm_rest)

2 3

rlm_sql_postgresql: 42804: DATATYPE MISMATCH
by Igor Sousa 29 Sep '17

29 Sep '17

Hi everyone, I configured my freeradius (3.0.15) to do authenticating and authorization, it has been working well. When I've tried to configure it to accounting using postgresql database, freeradius doesn't register accounting in database because occurs the fatal error below: *(17) sql: rlm_sql_postgresql: ERROR: column "acctstarttime" is of type timestamp with time zone but expression is of type integer* *(17) sql: rlm_sql_postgresql: LINE 1: ...1ac', '<user-name>', '', '<nas-ip>', '', '', (1506692296...* *(17) sql: rlm_sql_postgresql: ^* *(17) sql: rlm_sql_postgresql: HINT: **You will need to rewrite or cast the expression**.* *(17) sql: SQL query returned: need alt query* *(17) sql: No additional queries configured* *rlm_sql (sql): Released connection (2)* I understand that occurs because rlm_sql_postgresql is waiting for a timestamp, but received a integer. I see that debug gives me a hint "*You will need to rewrite or cast the expression" *. This modifications should do in mods-config/sql/main/postgresql/queries.conf? How do I do it? I'm a newbie about accounting configuration. PS: Freeradius connects to database correctely. *Connected to database 'radius' on 'localhost' server version 90413, protocol version 3, backend PID 22463 * Thanks for your attention, -- Igor Sousa

2 6

LDAP Module Error
by Bhagwat, Shrikant 29 Sep '17

29 Sep '17

# Loaded module rlm_unix # Loading module "unix" from file /usr/local/etc/raddb/mods-enabled/unix unix { radwtmp = "/usr/local/var/log/radius/radwtmp" } Creating attribute Unix-Group # Loaded module rlm_unpack # Loading module "unpack" from file /usr/local/etc/raddb/mods-enabled/unpack # Loaded module rlm_utf8 # Loading module "utf8" from file /usr/local/etc/raddb/mods-enabled/utf8 /usr/local/etc/raddb/mods-enabled/ldap[8]: Failed to link to module 'rlm_ldap': /usr/local/lib/rlm_ldap.so: cannot open shared object file: No such file or directory Following procedure was followed to install Freeradius 3.x on Suse Linux Ent Server SP2. Downloaded the tarball file 2. SIMPLE INSTALLATION ---------------------- If you do not need to modify the default configuration, then take the following steps to build and install the server:: $ ./configure $ make $ make install Enabled the ldap module Started above error ********************************************************** Electronic Mail is not secure, may not be read every day, and should not be used for urgent or sensitive issues

2 1

Unlang and variables
by Ti Ti 29 Sep '17

29 Sep '17

Hello, I'm using unlang to discriminate the database to use as described in the code below. Is there a method to use variables so avoid the redundant check of NAS-Id? Thanks server rad { listen { ipaddr = * port = 1812 type = auth } listen { ipaddr = * port = 1813 type = acct } authorize { if (&NAS-Identifier =~ /test/i) { db1 } if (&NAS-Identifier =~ /test2/i) { db2 } } accounting { if (&NAS-Identifier =~ /test/i) { db1 } if (&NAS-Identifier =~ /test2/i) { db2 } } session { if (&NAS-Identifier =~ /test/i) { db1 } if (&NAS-Identifier =~ /test2/i) { db2 } } }

2 11

monitor an eap session in a production environment with a lot of devices
by Marco Santantonio 29 Sep '17

29 Sep '17

Hi all, I wanted to ask how to monitor an eap session in a production environment with a lot of devices. Have you developed a method or a best practice that helps in those cases? Analyzing freeradius debug, in addition to the state attribute, there is some internal variable to see if a package is part of an ongoing session, it's a retransmitted or duplicated packet, or is it the beginning of a new session? The standard log what does it say about it? many thanks! Marco -- **************************************** Marco Santantonio Direzione Sistemi Informativi, Portale, E-learning Sezione Fonia, VoIP e WiFi www.unito.it ****************************************

3 6

Failing proxied request for user, due to lack of any response from home server EDUROAM
by Marco Santantonio 29 Sep '17

29 Sep '17

Hello, I'm writing for a 802.1x authentication problem with eduroam. In our infrastructure we have two proxy-radius (freeradius 3.0.12 on debian stretch) which then turn the access-requests for our realm to internal freeradius servers. >From a log analysis I see: Wed Sep 27 16:07:15 2017: Proxy: (10) Marking home server 192.84.145.15 port 1812 alive where 192.84.145.15 = eduroam NRPS server Then I see a series of Wed Sep 27 16:10:20 2017: ERROR: (14613) ERROR: Failing proxied request for user "user@realm" due to lack of response from home server 192.84.145.15 port 1812 And I see some authentication that goes fine and others do not. Since we have experienced some difficulties connecting our users from outside, how can I debug this type of problem? Can it be a configuration error or a timeout problem? Many thanks! clients.conf # RADIUS.GARR.NET client radius.garr.net { ipaddr = 192.84.145.15 secret = xxx virtual_server = eduroam } # RADIUS2.GARR.NET client radius2.garr.net { ipaddr = 193.206.158.71 secret = xxx virtual_server = eduroam } proxy.conf wifi-rad-pool it's our internal radius authentication pool # SERVER home_server radius.garr.net { type = auth ipaddr = 192.84.145.15 port = 1812 secret = xxx require_message_authenticator = yes status_check = status-server } home_server radius2.garr.net { type = auth ipaddr = 193.206.158.71 port = 1812 secret = xxx require_message_authenticator = yes status_check = status-server } # POOL home_server_pool eduroam_pool { type = fail-over home_server = radius.garr.net home_server = radius2.garr.net virtual_server = eduroam } ## REALM realm NULL { auth_pool = wifi-rad-pool nostrip } realm "unito.it" { auth_pool = wifi-rad-pool nostrip } realm "edu.unito.it" { auth_pool = wifi-rad-pool nostrip } realm "~(.*)\.unito\.it$" { auth_pool = wifi-rad-pool nostrip } realm DEFAULT { auth_pool = eduroam_pool nostrip } eduroam virtual-server server eduroam { # Authorization authorize { filter_username rewrite_calling_station_id preprocess suffix } # Authentication authenticate { eap } # Post-Authentication post-auth { exec proxy-linelog Post-Auth-Type REJECT { attr_filter.access_reject proxy-linelog } } # Pre-Proxy pre-proxy { attr_filter.pre-proxy # pre_proxy_log } # Post-proxy post-proxy { attr_filter.post-proxy eap # post_proxy_log } } root@radius-02:~# freeradius -XC FreeRADIUS Version 3.0.12 Copyright (C) 1999-2016 The FreeRADIUS server project and contributors There is NO warranty; not even for MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE You may redistribute copies of FreeRADIUS under the terms of the GNU General Public License For more information about these matters, see the file named COPYRIGHT Starting - reading configuration files ... including dictionary file /usr/share/freeradius/dictionary including dictionary file /usr/share/freeradius/dictionary.dhcp including dictionary file /usr/share/freeradius/dictionary.vqp including dictionary file /etc/freeradius/3.0/dictionary including configuration file /etc/freeradius/3.0/radiusd.conf including configuration file /etc/freeradius/3.0/proxy.conf including configuration file /etc/freeradius/3.0/clients.conf including files in directory /etc/freeradius/3.0/mods-enabled/ including configuration file /etc/freeradius/3.0/mods-enabled/replicate including configuration file /etc/freeradius/3.0/mods-enabled/eap including configuration file /etc/freeradius/3.0/mods-enabled/files including configuration file /etc/freeradius/3.0/mods-enabled/logintime including configuration file /etc/freeradius/3.0/mods-enabled/echo including configuration file /etc/freeradius/3.0/mods-enabled/expiration including configuration file /etc/freeradius/3.0/mods-enabled/exec including configuration file /etc/freeradius/3.0/mods-enabled/dynamic_clients including configuration file /etc/freeradius/3.0/mods-enabled/unpack including configuration file /etc/freeradius/3.0/mods-enabled/utf8 including configuration file /etc/freeradius/3.0/mods-enabled/always including configuration file /etc/freeradius/3.0/mods-enabled/attr_filter including configuration file /etc/freeradius/3.0/mods-enabled/pap including configuration file /etc/freeradius/3.0/mods-enabled/sradutmp including configuration file /etc/freeradius/3.0/mods-enabled/passwd including configuration file /etc/freeradius/3.0/mods-enabled/realm including configuration file /etc/freeradius/3.0/mods-enabled/preprocess including configuration file /etc/freeradius/3.0/mods-enabled/soh including configuration file /etc/freeradius/3.0/mods-enabled/linelog including configuration file /etc/freeradius/3.0/mods-enabled/detail.log including configuration file /etc/freeradius/3.0/mods-enabled/cache_eap including configuration file /etc/freeradius/3.0/mods-enabled/expr including configuration file /etc/freeradius/3.0/mods-enabled/chap including configuration file /etc/freeradius/3.0/mods-enabled/digest including configuration file /etc/freeradius/3.0/mods-enabled/ntlm_auth including configuration file /etc/freeradius/3.0/mods-enabled/detail including configuration file /etc/freeradius/3.0/mods-enabled/radutmp including configuration file /etc/freeradius/3.0/mods-enabled/mschap including configuration file /etc/freeradius/3.0/mods-enabled/unix including files in directory /etc/freeradius/3.0/policy.d/ including configuration file /etc/freeradius/3.0/policy.d/eap including configuration file /etc/freeradius/3.0/policy.d/abfab-tr including configuration file /etc/freeradius/3.0/policy.d/control including configuration file /etc/freeradius/3.0/policy.d/operator-name including configuration file /etc/freeradius/3.0/policy.d/accounting including configuration file /etc/freeradius/3.0/policy.d/cui including configuration file /etc/freeradius/3.0/policy.d/dhcp including configuration file /etc/freeradius/3.0/policy.d/debug including configuration file /etc/freeradius/3.0/policy.d/canonicalization including configuration file /etc/freeradius/3.0/policy.d/moonshot-targeted-ids including configuration file /etc/freeradius/3.0/policy.d/filter including files in directory /etc/freeradius/3.0/sites-enabled/ including configuration file /etc/freeradius/3.0/sites-enabled/status including configuration file /etc/freeradius/3.0/sites-enabled/default including configuration file /etc/freeradius/3.0/sites-enabled/control-socket including configuration file /etc/freeradius/3.0/sites-enabled/others including configuration file /etc/freeradius/3.0/sites-enabled/eduroam including configuration file /etc/freeradius/3.0/sites-enabled/inner-tunnel main { security { user = "freerad" group = "freerad" allow_core_dumps = no } name = "freeradius" prefix = "/usr" localstatedir = "/var" logdir = "/var/log/freeradius" run_dir = "/var/run/freeradius" } main { name = "freeradius" prefix = "/usr" localstatedir = "/var" sbindir = "/usr/sbin" logdir = "/var/log/freeradius" run_dir = "/var/run/freeradius" libdir = "/usr/lib/freeradius" radacctdir = "/var/log/freeradius/radacct" hostname_lookups = no max_request_time = 30 cleanup_delay = 5 max_requests = 16384 pidfile = "/var/run/freeradius/freeradius.pid" checkrad = "/usr/sbin/checkrad" debug_level = 0 proxy_requests = yes log { stripped_names = no auth = yes auth_badpass = no auth_goodpass = no colourise = yes msg_denied = "You are already logged in - access denied" } resources { } security { max_attributes = 200 reject_delay = 1.000000 status_server = yes } } radiusd: #### Loading Realms and Home Servers #### proxy server { retry_delay = 5 retry_count = 3 default_fallback = no dead_time = 120 wake_all_if_all_dead = no } home_server localhost { ipaddr = 127.0.0.1 port = 1812 type = "auth" secret = <<< secret >>> response_window = 20.000000 response_timeouts = 1 max_outstanding = 65536 zombie_period = 40 status_check = "status-server" ping_interval = 30 check_interval = 30 check_timeout = 4 num_answers_to_alive = 3 revive_interval = 300 limit { max_connections = 16 max_requests = 0 lifetime = 0 idle_timeout = 0 } coa { irt = 2 mrt = 16 mrc = 5 mrd = 30 } } home_server wifi-rad01 { ipaddr = 192.168.19.92 port = 1812 type = "auth" secret = <<< secret >>> response_window = 20.000000 response_timeouts = 1 max_outstanding = 65536 zombie_period = 40 status_check = "status-server" ping_interval = 30 check_interval = 30 check_timeout = 4 num_answers_to_alive = 3 revive_interval = 300 limit { max_connections = 16 max_requests = 0 lifetime = 0 idle_timeout = 0 } coa { irt = 2 mrt = 16 mrc = 5 mrd = 30 } } home_server wifi-rad02 { ipaddr = 192.168.19.93 port = 1812 type = "auth" secret = <<< secret >>> response_window = 20.000000 response_timeouts = 1 max_outstanding = 65536 zombie_period = 40 status_check = "status-server" ping_interval = 30 check_interval = 30 check_timeout = 4 num_answers_to_alive = 3 revive_interval = 300 limit { max_connections = 16 max_requests = 0 lifetime = 0 idle_timeout = 0 } coa { irt = 2 mrt = 16 mrc = 5 mrd = 30 } } home_server wifi-rad03 { ipaddr = 192.168.19.94 port = 1812 type = "auth" secret = <<< secret >>> response_window = 20.000000 response_timeouts = 1 max_outstanding = 65536 zombie_period = 40 status_check = "status-server" ping_interval = 30 check_interval = 30 check_timeout = 4 num_answers_to_alive = 3 revive_interval = 300 limit { max_connections = 16 max_requests = 0 lifetime = 0 idle_timeout = 0 } coa { irt = 2 mrt = 16 mrc = 5 mrd = 30 } } home_server wifi-rad04 { ipaddr = 192.168.19.95 port = 1812 type = "auth" secret = <<< secret >>> response_window = 20.000000 response_timeouts = 1 max_outstanding = 65536 zombie_period = 40 status_check = "status-server" ping_interval = 30 check_interval = 30 check_timeout = 4 num_answers_to_alive = 3 revive_interval = 300 limit { max_connections = 16 max_requests = 0 lifetime = 0 idle_timeout = 0 } coa { irt = 2 mrt = 16 mrc = 5 mrd = 30 } } home_server radius.garr.net { ipaddr = 192.84.145.15 port = 1812 type = "auth" secret = <<< secret >>> response_window = 30.000000 response_timeouts = 1 max_outstanding = 65536 zombie_period = 40 status_check = "status-server" ping_interval = 30 check_timeout = 4 num_answers_to_alive = 3 revive_interval = 300 limit { max_connections = 16 max_requests = 0 lifetime = 0 idle_timeout = 0 } coa { irt = 2 mrt = 16 mrc = 5 mrd = 30 } } home_server radius2.garr.net { ipaddr = 193.206.158.71 port = 1812 type = "auth" secret = <<< secret >>> response_window = 30.000000 response_timeouts = 1 max_outstanding = 65536 zombie_period = 40 status_check = "status-server" ping_interval = 30 check_timeout = 4 num_answers_to_alive = 3 revive_interval = 300 limit { max_connections = 16 max_requests = 0 lifetime = 0 idle_timeout = 0 } coa { irt = 2 mrt = 16 mrc = 5 mrd = 30 } } home_server_pool wifi-rad-pool { type = client-balance home_server = wifi-rad01 home_server = wifi-rad02 home_server = wifi-rad03 home_server = wifi-rad04 } realm NULL { auth_pool = wifi-rad-pool nostrip } realm unito.it { auth_pool = wifi-rad-pool nostrip } realm edu.unito.it { auth_pool = wifi-rad-pool nostrip } realm ~(.*)\.unito\.it$ { auth_pool = wifi-rad-pool nostrip } home_server_pool eduroam_pool { type = fail-over virtual_server = eduroam home_server = radius.garr.net home_server = radius2.garr.net } realm DEFAULT { auth_pool = eduroam_pool nostrip } radiusd: #### Loading Clients #### client localhost { ipaddr = 127.0.0.1 require_message_authenticator = no secret = <<< secret >>> limit { max_connections = 16 lifetime = 0 idle_timeout = 30 } } client wlc-lin { ipaddr = 172.31.254.253 require_message_authenticator = no secret = <<< secret >>> limit { max_connections = 16 lifetime = 0 idle_timeout = 30 } } client wlc-ste { ipaddr = 172.31.254.252 require_message_authenticator = no secret = <<< secret >>> limit { max_connections = 16 lifetime = 0 idle_timeout = 30 } } client wlc-fis { ipaddr = 172.31.254.251 require_message_authenticator = no secret = <<< secret >>> limit { max_connections = 16 lifetime = 0 idle_timeout = 30 } } client wlc-fis-02 { ipaddr = 172.31.254.250 require_message_authenticator = no secret = <<< secret >>> limit { max_connections = 16 lifetime = 0 idle_timeout = 30 } } client wlc-2504-fis { ipaddr = 130.192.155.203 require_message_authenticator = no secret = <<< secret >>> limit { max_connections = 16 lifetime = 0 idle_timeout = 30 } } client cisco-prime { ipaddr = 172.31.254.240 require_message_authenticator = no secret = <<< secret >>> limit { max_connections = 16 lifetime = 0 idle_timeout = 30 } } client kpi-server { ipaddr = 192.168.19.16 require_message_authenticator = no secret = <<< secret >>> limit { max_connections = 16 lifetime = 0 idle_timeout = 30 } } client vpn { ipaddr = 130.192.150.233 require_message_authenticator = no secret = <<< secret >>> virtual_server = "others" limit { max_connections = 16 lifetime = 0 idle_timeout = 30 } } client edisu { ipaddr = 130.192.108.4 require_message_authenticator = no secret = <<< secret >>> virtual_server = "others" limit { max_connections = 16 lifetime = 0 idle_timeout = 30 } } client radius.garr.net { ipaddr = 192.84.145.15 require_message_authenticator = no secret = <<< secret >>> virtual_server = "eduroam" limit { max_connections = 16 lifetime = 0 idle_timeout = 30 } } client radius2.garr.net { ipaddr = 193.206.158.71 require_message_authenticator = no secret = <<< secret >>> virtual_server = "eduroam" limit { max_connections = 16 lifetime = 0 idle_timeout = 30 } } Debugger not attached # Creating Autz-Type = Status-Server # Creating Auth-Type = eap # Creating Auth-Type = mschap # Creating Auth-Type = PAP # Creating Auth-Type = CHAP # Creating Auth-Type = MS-CHAP radiusd: #### Instantiating modules #### modules { # Loaded module rlm_replicate # Loading module "replicate" from file /etc/freeradius/3.0/mods-enabled/replicate # Loaded module rlm_eap # Loading module "eap" from file /etc/freeradius/3.0/mods-enabled/eap eap { default_eap_type = "md5" timer_expire = 60 ignore_unknown_eap_types = no cisco_accounting_username_bug = no max_sessions = 16384 } # Loaded module rlm_files # Loading module "files" from file /etc/freeradius/3.0/mods-enabled/files files { filename = "/etc/freeradius/3.0/mods-config/files/authorize" acctusersfile = "/etc/freeradius/3.0/mods-config/files/accounting" preproxy_usersfile = "/etc/freeradius/3.0/mods-config/files/pre-proxy" } # Loaded module rlm_logintime # Loading module "logintime" from file /etc/freeradius/3.0/mods-enabled/logintime logintime { minimum_timeout = 60 } # Loaded module rlm_exec # Loading module "echo" from file /etc/freeradius/3.0/mods-enabled/echo exec echo { wait = yes program = "/bin/echo %{User-Name}" input_pairs = "request" output_pairs = "reply" shell_escape = yes } # Loaded module rlm_expiration # Loading module "expiration" from file /etc/freeradius/3.0/mods-enabled/expiration # Loading module "exec" from file /etc/freeradius/3.0/mods-enabled/exec exec { wait = no input_pairs = "request" shell_escape = yes timeout = 10 } # Loaded module rlm_dynamic_clients # Loading module "dynamic_clients" from file /etc/freeradius/3.0/mods-enabled/dynamic_clients # Loaded module rlm_unpack # Loading module "unpack" from file /etc/freeradius/3.0/mods-enabled/unpack # Loaded module rlm_utf8 # Loading module "utf8" from file /etc/freeradius/3.0/mods-enabled/utf8 # Loaded module rlm_always # Loading module "reject" from file /etc/freeradius/3.0/mods-enabled/always always reject { rcode = "reject" simulcount = 0 mpp = no } # Loading module "fail" from file /etc/freeradius/3.0/mods-enabled/always always fail { rcode = "fail" simulcount = 0 mpp = no } # Loading module "ok" from file /etc/freeradius/3.0/mods-enabled/always always ok { rcode = "ok" simulcount = 0 mpp = no } # Loading module "handled" from file /etc/freeradius/3.0/mods-enabled/always always handled { rcode = "handled" simulcount = 0 mpp = no } # Loading module "invalid" from file /etc/freeradius/3.0/mods-enabled/always always invalid { rcode = "invalid" simulcount = 0 mpp = no } # Loading module "userlock" from file /etc/freeradius/3.0/mods-enabled/always always userlock { rcode = "userlock" simulcount = 0 mpp = no } # Loading module "notfound" from file /etc/freeradius/3.0/mods-enabled/always always notfound { rcode = "notfound" simulcount = 0 mpp = no } # Loading module "noop" from file /etc/freeradius/3.0/mods-enabled/always always noop { rcode = "noop" simulcount = 0 mpp = no } # Loading module "updated" from file /etc/freeradius/3.0/mods-enabled/always always updated { rcode = "updated" simulcount = 0 mpp = no } # Loaded module rlm_attr_filter # Loading module "attr_filter.post-proxy" from file /etc/freeradius/3.0/mods-enabled/attr_filter attr_filter attr_filter.post-proxy { filename = "/etc/freeradius/3.0/mods-config/attr_filter/post-proxy" key = "%{Realm}" relaxed = no } # Loading module "attr_filter.pre-proxy" from file /etc/freeradius/3.0/mods-enabled/attr_filter attr_filter attr_filter.pre-proxy { filename = "/etc/freeradius/3.0/mods-config/attr_filter/pre-proxy" key = "%{Realm}" relaxed = no } # Loading module "attr_filter.access_reject" from file /etc/freeradius/3.0/mods-enabled/attr_filter attr_filter attr_filter.access_reject { filename = "/etc/freeradius/3.0/mods-config/attr_filter/access_reject" key = "%{User-Name}" relaxed = no } # Loading module "attr_filter.access_challenge" from file /etc/freeradius/3.0/mods-enabled/attr_filter attr_filter attr_filter.access_challenge { filename = "/etc/freeradius/3.0/mods-config/attr_filter/access_challenge" key = "%{User-Name}" relaxed = no } # Loading module "attr_filter.accounting_response" from file /etc/freeradius/3.0/mods-enabled/attr_filter attr_filter attr_filter.accounting_response { filename = "/etc/freeradius/3.0/mods-config/attr_filter/accounting_response" key = "%{User-Name}" relaxed = no } # Loaded module rlm_pap # Loading module "pap" from file /etc/freeradius/3.0/mods-enabled/pap pap { normalise = yes } # Loaded module rlm_radutmp # Loading module "sradutmp" from file /etc/freeradius/3.0/mods-enabled/sradutmp radutmp sradutmp { filename = "/var/log/freeradius/sradutmp" username = "%{User-Name}" case_sensitive = yes check_with_nas = yes permissions = 420 caller_id = no } # Loaded module rlm_passwd # Loading module "etc_passwd" from file /etc/freeradius/3.0/mods-enabled/passwd passwd etc_passwd { filename = "/etc/passwd" format = "*User-Name:Crypt-Password:" delimiter = ":" ignore_nislike = no ignore_empty = yes allow_multiple_keys = no hash_size = 100 } # Loaded module rlm_realm # Loading module "IPASS" from file /etc/freeradius/3.0/mods-enabled/realm realm IPASS { format = "prefix" delimiter = "/" ignore_default = no ignore_null = no } # Loading module "suffix" from file /etc/freeradius/3.0/mods-enabled/realm realm suffix { format = "suffix" delimiter = "@" ignore_default = no ignore_null = no } # Loading module "realmpercent" from file /etc/freeradius/3.0/mods-enabled/realm realm realmpercent { format = "suffix" delimiter = "%" ignore_default = no ignore_null = no } # Loading module "ntdomain" from file /etc/freeradius/3.0/mods-enabled/realm realm ntdomain { format = "prefix" delimiter = "\\" ignore_default = no ignore_null = no } # Loaded module rlm_preprocess # Loading module "preprocess" from file /etc/freeradius/3.0/mods-enabled/preprocess preprocess { huntgroups = "/etc/freeradius/3.0/mods-config/preprocess/huntgroups" hints = "/etc/freeradius/3.0/mods-config/preprocess/hints" with_ascend_hack = no ascend_channels_per_line = 23 with_ntdomain_hack = no with_specialix_jetstream_hack = no with_cisco_vsa_hack = no with_alvarion_vsa_hack = no } # Loaded module rlm_soh # Loading module "soh" from file /etc/freeradius/3.0/mods-enabled/soh soh { dhcp = yes } # Loaded module rlm_linelog # Loading module "proxy-linelog" from file /etc/freeradius/3.0/mods-enabled/linelog linelog proxy-linelog { filename = "syslog" escape_filenames = no syslog_facility = "local0" syslog_severity = "info" permissions = 384 format = "This is a log message for %{User-Name}" reference = "custom.%{%{reply:Packet-Type}:-default}" } # Loaded module rlm_detail # Loading module "auth_log" from file /etc/freeradius/3.0/mods-enabled/detail.log detail auth_log { filename = "/var/log/freeradius/radacct/%{%{Packet-Src-IP-Address}:-%{Packet-Src-IPv6-Address}}/auth-detail-%Y%m%d" header = "%t" permissions = 384 locking = no escape_filenames = no log_packet_header = no } # Loading module "reply_log" from file /etc/freeradius/3.0/mods-enabled/detail.log detail reply_log { filename = "/var/log/freeradius/radacct/%{%{Packet-Src-IP-Address}:-%{Packet-Src-IPv6-Address}}/reply-detail-%Y%m%d" header = "%t" permissions = 384 locking = no escape_filenames = no log_packet_header = no } # Loading module "pre_proxy_log" from file /etc/freeradius/3.0/mods-enabled/detail.log detail pre_proxy_log { filename = "/var/log/freeradius/radacct/%{%{Packet-Src-IP-Address}:-%{Packet-Src-IPv6-Address}}/pre-proxy-detail-%Y%m%d" header = "%t" permissions = 384 locking = no escape_filenames = no log_packet_header = no } # Loading module "post_proxy_log" from file /etc/freeradius/3.0/mods-enabled/detail.log detail post_proxy_log { filename = "/var/log/freeradius/radacct/%{%{Packet-Src-IP-Address}:-%{Packet-Src-IPv6-Address}}/post-proxy-detail-%Y%m%d" header = "%t" permissions = 384 locking = no escape_filenames = no log_packet_header = no } # Loaded module rlm_cache # Loading module "cache_eap" from file /etc/freeradius/3.0/mods-enabled/cache_eap cache cache_eap { driver = "rlm_cache_rbtree" key = "%{%{control:State}:-%{%{reply:State}:-%{State}}}" ttl = 15 max_entries = 0 epoch = 0 add_stats = no } # Loaded module rlm_expr # Loading module "expr" from file /etc/freeradius/3.0/mods-enabled/expr expr { safe_characters = "@abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ0123456789.-_: /äéöüàâæçèéêëîïôœùûüaÿÄÉÖÜßÀÂÆÇÈÉÊËÎÏÔŒÙÛÜŸ" } # Loaded module rlm_chap # Loading module "chap" from file /etc/freeradius/3.0/mods-enabled/chap # Loaded module rlm_digest # Loading module "digest" from file /etc/freeradius/3.0/mods-enabled/digest # Loading module "ntlm_auth" from file /etc/freeradius/3.0/mods-enabled/ntlm_auth exec ntlm_auth { wait = yes program = "/path/to/ntlm_auth --request-nt-key --domain=MYDOMAIN --username=%{mschap:User-Name} --password=%{User-Password}" shell_escape = yes } # Loading module "detail" from file /etc/freeradius/3.0/mods-enabled/detail detail { filename = "/var/log/freeradius/radacct/%{%{Packet-Src-IP-Address}:-%{Packet-Src-IPv6-Address}}/detail-%Y%m%d" header = "%t" permissions = 384 locking = no escape_filenames = no log_packet_header = no } # Loading module "radutmp" from file /etc/freeradius/3.0/mods-enabled/radutmp radutmp { filename = "/var/log/freeradius/radutmp" username = "%{User-Name}" case_sensitive = yes check_with_nas = yes permissions = 384 caller_id = yes } # Loaded module rlm_mschap # Loading module "mschap" from file /etc/freeradius/3.0/mods-enabled/mschap mschap { use_mppe = yes require_encryption = no require_strong = no with_ntdomain_hack = yes passchange { } allow_retry = yes } # Loaded module rlm_unix # Loading module "unix" from file /etc/freeradius/3.0/mods-enabled/unix unix { radwtmp = "/var/log/freeradius/radwtmp" } Creating attribute Unix-Group instantiate { } # Instantiating module "eap" from file /etc/freeradius/3.0/mods-enabled/eap # Linked to sub-module rlm_eap_md5 # Linked to sub-module rlm_eap_leap # Linked to sub-module rlm_eap_gtc gtc { challenge = "Password: " auth_type = "PAP" } # Linked to sub-module rlm_eap_tls tls { tls = "tls-common" } tls-config tls-common { verify_depth = 0 ca_path = "/etc/freeradius/3.0/certs" pem_file_type = yes private_key_file = "/etc/ssl/private/ssl-cert-snakeoil.key" certificate_file = "/etc/ssl/certs/ssl-cert-snakeoil.pem" ca_file = "/etc/ssl/certs/ca-certificates.crt" private_key_password = <<< secret >>> dh_file = "/etc/freeradius/3.0/certs/dh" fragment_size = 1024 include_length = yes auto_chain = yes check_crl = no check_all_crl = no cipher_list = "DEFAULT" ecdh_curve = "prime256v1" cache { enable = yes lifetime = 24 max_entries = 255 } verify { skip_if_ocsp_ok = no } ocsp { enable = no override_cert_url = yes url = "http://127.0.0.1/ocsp/" use_nonce = yes timeout = 0 softfail = no } } # Linked to sub-module rlm_eap_ttls ttls { tls = "tls-common" default_eap_type = "md5" copy_request_to_tunnel = no use_tunneled_reply = no virtual_server = "inner-tunnel" include_length = yes require_client_cert = no } tls: Using cached TLS configuration from previous invocation # Linked to sub-module rlm_eap_peap peap { tls = "tls-common" default_eap_type = "mschapv2" copy_request_to_tunnel = no use_tunneled_reply = no proxy_tunneled_request_as_eap = yes virtual_server = "inner-tunnel" soh = no require_client_cert = no } tls: Using cached TLS configuration from previous invocation # Linked to sub-module rlm_eap_mschapv2 mschapv2 { with_ntdomain_hack = no send_error = no } # Instantiating module "files" from file /etc/freeradius/3.0/mods-enabled/files reading pairlist file /etc/freeradius/3.0/mods-config/files/authorize reading pairlist file /etc/freeradius/3.0/mods-config/files/accounting reading pairlist file /etc/freeradius/3.0/mods-config/files/pre-proxy # Instantiating module "logintime" from file /etc/freeradius/3.0/mods-enabled/logintime # Instantiating module "expiration" from file /etc/freeradius/3.0/mods-enabled/expiration # Instantiating module "reject" from file /etc/freeradius/3.0/mods-enabled/always # Instantiating module "fail" from file /etc/freeradius/3.0/mods-enabled/always # Instantiating module "ok" from file /etc/freeradius/3.0/mods-enabled/always # Instantiating module "handled" from file /etc/freeradius/3.0/mods-enabled/always # Instantiating module "invalid" from file /etc/freeradius/3.0/mods-enabled/always # Instantiating module "userlock" from file /etc/freeradius/3.0/mods-enabled/always # Instantiating module "notfound" from file /etc/freeradius/3.0/mods-enabled/always # Instantiating module "noop" from file /etc/freeradius/3.0/mods-enabled/always # Instantiating module "updated" from file /etc/freeradius/3.0/mods-enabled/always # Instantiating module "attr_filter.post-proxy" from file /etc/freeradius/3.0/mods-enabled/attr_filter reading pairlist file /etc/freeradius/3.0/mods-config/attr_filter/post-proxy # Instantiating module "attr_filter.pre-proxy" from file /etc/freeradius/3.0/mods-enabled/attr_filter reading pairlist file /etc/freeradius/3.0/mods-config/attr_filter/pre-proxy # Instantiating module "attr_filter.access_reject" from file /etc/freeradius/3.0/mods-enabled/attr_filter reading pairlist file /etc/freeradius/3.0/mods-config/attr_filter/access_reject [/etc/freeradius/3.0/mods-config/attr_filter/access_reject]:11 Check item "FreeRADIUS-Response-Delay" found in filter list for realm "DEFAULT". [/etc/freeradius/3.0/mods-config/attr_filter/access_reject]:11 Check item "FreeRADIUS-Response-Delay-USec" found in filter list for realm "DEFAULT". # Instantiating module "attr_filter.access_challenge" from file /etc/freeradius/3.0/mods-enabled/attr_filter reading pairlist file /etc/freeradius/3.0/mods-config/attr_filter/access_challenge # Instantiating module "attr_filter.accounting_response" from file /etc/freeradius/3.0/mods-enabled/attr_filter reading pairlist file /etc/freeradius/3.0/mods-config/attr_filter/accounting_response # Instantiating module "pap" from file /etc/freeradius/3.0/mods-enabled/pap # Instantiating module "etc_passwd" from file /etc/freeradius/3.0/mods-enabled/passwd rlm_passwd: nfields: 3 keyfield 0(User-Name) listable: no # Instantiating module "IPASS" from file /etc/freeradius/3.0/mods-enabled/realm # Instantiating module "suffix" from file /etc/freeradius/3.0/mods-enabled/realm # Instantiating module "realmpercent" from file /etc/freeradius/3.0/mods-enabled/realm # Instantiating module "ntdomain" from file /etc/freeradius/3.0/mods-enabled/realm # Instantiating module "preprocess" from file /etc/freeradius/3.0/mods-enabled/preprocess reading pairlist file /etc/freeradius/3.0/mods-config/preprocess/huntgroups reading pairlist file /etc/freeradius/3.0/mods-config/preprocess/hints # Instantiating module "proxy-linelog" from file /etc/freeradius/3.0/mods-enabled/linelog # Instantiating module "auth_log" from file /etc/freeradius/3.0/mods-enabled/detail.log rlm_detail (auth_log): 'User-Password' suppressed, will not appear in detail output # Instantiating module "reply_log" from file /etc/freeradius/3.0/mods-enabled/detail.log # Instantiating module "pre_proxy_log" from file /etc/freeradius/3.0/mods-enabled/detail.log # Instantiating module "post_proxy_log" from file /etc/freeradius/3.0/mods-enabled/detail.log # Instantiating module "cache_eap" from file /etc/freeradius/3.0/mods-enabled/cache_eap rlm_cache (cache_eap): Driver rlm_cache_rbtree (module rlm_cache_rbtree) loaded and linked # Instantiating module "detail" from file /etc/freeradius/3.0/mods-enabled/detail # Instantiating module "mschap" from file /etc/freeradius/3.0/mods-enabled/mschap rlm_mschap (mschap): using internal authentication } # modules radiusd: #### Loading Virtual Servers #### server { # from file /etc/freeradius/3.0/radiusd.conf } # server server status { # from file /etc/freeradius/3.0/sites-enabled/status # Loading authorize {...} } # server status server default { # from file /etc/freeradius/3.0/sites-enabled/default # Loading authenticate {...} # Loading authorize {...} # Loading post-proxy {...} # Loading post-auth {...} } # server default server others { # from file /etc/freeradius/3.0/sites-enabled/others # Loading authenticate {...} # Loading authorize {...} # Loading pre-proxy {...} # Loading post-proxy {...} # Loading post-auth {...} } # server others server eduroam { # from file /etc/freeradius/3.0/sites-enabled/eduroam # Loading authenticate {...} # Loading authorize {...} # Loading pre-proxy {...} # Loading post-proxy {...} # Loading post-auth {...} } # server eduroam server inner-tunnel { # from file /etc/freeradius/3.0/sites-enabled/inner-tunnel # Loading authenticate {...} # Loading authorize {...} Ignoring "sql" (see raddb/mods-available/README.rst) Ignoring "ldap" (see raddb/mods-available/README.rst) # Loading session {...} # Loading post-proxy {...} # Loading post-auth {...} } # server inner-tunnel radiusd: #### Skipping IP addresses and Ports #### listen { type = "control" } listen { type = "status" ipaddr = 127.0.0.1 port = 18121 } listen { type = "auth" ipaddr = * port = 0 limit { max_connections = 16 lifetime = 0 idle_timeout = 30 } } listen { type = "auth" ipaddr = 127.0.0.1 port = 18120 } Configuration appears to be OK root@radius-02:~# -- **************************************** Marco Santantonio Direzione Sistemi Informativi, Portale, E-learning Sezione Fonia, VoIP e WiFi www.unito.it ****************************************

3 4