- Freeradius-Users - lists.freeradius.org

Where is FreeRADIUS project PGP signing key?
by mattg＠assembly.state.ny.us 26 Sep '17

26 Sep '17

As suggested by the subject, I can't seem to find the public key to verify the latest source downloads. Alan's used to be under http://freeradius.org/pgp/ but doesn't appear to be now. No apparent mention on rest of site, either. TIA!

2 1

authentication fails because of the realm isn't stripped
by hans.bornemann＠tu-dortmund.de 26 Sep '17

26 Sep '17

Hi, the authentication fails because of the realm isn't stripped. the man page says: "by default the realm is stripped ..." proxy.conf: #### just testing telesec ####### realm telesec { authhost = LOCAL secret = blabla } Debug: Tue Sep 26 08:33:47 2017 : Debug: (1) User-Name = "hans@telesec" Tue Sep 26 08:33:47 2017 : Debug: (1) User-Password = "Itmc2628" Tue Sep 26 08:33:47 2017 : Debug: (1) session-state: No State attribute Tue Sep 26 08:33:47 2017 : Debug: (1) # Executing section authorize from file /etc/freeradius/sites-enabled/default Tue Sep 26 08:33:47 2017 : Debug: (1) authorize { Tue Sep 26 08:33:47 2017 : Debug: (1) policy filter_username { Tue Sep 26 08:33:47 2017 : Debug: (1) if (&User-Name) { Tue Sep 26 08:33:47 2017 : Debug: (1) if (&User-Name) -> TRUE Tue Sep 26 08:33:47 2017 : Debug: (1) if (&User-Name) { Tue Sep 26 08:33:47 2017 : Debug: (1) if (&User-Name =~ / /) { Tue Sep 26 08:33:47 2017 : Debug: (1) if (&User-Name =~ / /) -> FALSE Tue Sep 26 08:33:47 2017 : Debug: (1) if (&User-Name =~ /@[^@]*@/ ) { Tue Sep 26 08:33:47 2017 : Debug: (1) if (&User-Name =~ /@[^@]*@/ ) -> FALSE Tue Sep 26 08:33:47 2017 : Debug: (1) if (&User-Name =~ /\.\./ ) { Tue Sep 26 08:33:47 2017 : Debug: (1) if (&User-Name =~ /\.\./ ) -> FALSE Tue Sep 26 08:33:47 2017 : Debug: (1) if (&User-Name =~ /\.$/) { Tue Sep 26 08:33:47 2017 : Debug: (1) if (&User-Name =~ /\.$/) -> FALSE Tue Sep 26 08:33:47 2017 : Debug: (1) if (&User-Name =~ /(a)\./) { Tue Sep 26 08:33:47 2017 : Debug: (1) if (&User-Name =~ /(a)\./) -> FALSE Tue Sep 26 08:33:47 2017 : Debug: (1) } # if (&User-Name) = notfound Tue Sep 26 08:33:47 2017 : Debug: (1) } # policy filter_username = notfound Tue Sep 26 08:33:47 2017 : Debug: (1) modsingle[authorize]: calling preprocess (rlm_preprocess) Tue Sep 26 08:33:47 2017 : Debug: (1) modsingle[authorize]: returned from preprocess (rlm_preprocess) Tue Sep 26 08:33:47 2017 : Debug: (1) [preprocess] = ok Tue Sep 26 08:33:47 2017 : Debug: (1) modsingle[authorize]: calling chap (rlm_chap) Tue Sep 26 08:33:47 2017 : Debug: (1) modsingle[authorize]: returned from chap (rlm_chap) Tue Sep 26 08:33:47 2017 : Debug: (1) [chap] = noop Tue Sep 26 08:33:47 2017 : Debug: (1) modsingle[authorize]: calling mschap (rlm_mschap) Tue Sep 26 08:33:47 2017 : Debug: (1) modsingle[authorize]: returned from mschap (rlm_mschap) Tue Sep 26 08:33:47 2017 : Debug: (1) [mschap] = noop Tue Sep 26 08:33:47 2017 : Debug: (1) modsingle[authorize]: calling digest (rlm_digest) Tue Sep 26 08:33:47 2017 : Debug: (1) modsingle[authorize]: returned from digest (rlm_digest) Tue Sep 26 08:33:47 2017 : Debug: (1) [digest] = noop Tue Sep 26 08:33:47 2017 : Debug: (1) modsingle[authorize]: calling suffix (rlm_realm) Tue Sep 26 08:33:47 2017 : Debug: (1) suffix: Checking for suffix after "@" Tue Sep 26 08:33:47 2017 : Debug: (1) suffix: Looking up realm "telesec" for User-Name = "hans@telesec" Tue Sep 26 08:33:47 2017 : Debug: (1) suffix: Found realm "telesec" Tue Sep 26 08:33:47 2017 : Debug: (1) suffix: Adding Stripped-User-Name = "hans" Tue Sep 26 08:33:47 2017 : Debug: (1) suffix: Adding Realm = "telesec" Tue Sep 26 08:33:47 2017 : Debug: (1) suffix: Authentication realm is LOCAL Tue Sep 26 08:33:47 2017 : Debug: (1) modsingle[authorize]: returned from suffix (rlm_realm) Tue Sep 26 08:33:47 2017 : Debug: (1) [suffix] = ok Tue Sep 26 08:33:47 2017 : Debug: (1) modsingle[authorize]: calling eap (rlm_eap) Tue Sep 26 08:33:47 2017 : Debug: (1) eap: No EAP-Message, not doing EAP Tue Sep 26 08:33:47 2017 : Debug: (1) modsingle[authorize]: returned from eap (rlm_eap) Tue Sep 26 08:33:47 2017 : Debug: (1) [eap] = noop Tue Sep 26 08:33:47 2017 : Debug: (1) modsingle[authorize]: calling files (rlm_files) Tue Sep 26 08:33:47 2017 : Debug: (1) modsingle[authorize]: returned from files (rlm_files) Tue Sep 26 08:33:47 2017 : Debug: (1) [files] = noop Tue Sep 26 08:33:47 2017 : Debug: (1) modsingle[authorize]: calling sql (rlm_sql) Tue Sep 26 08:33:47 2017 : Debug: %{User-Name} Tue Sep 26 08:33:47 2017 : Debug: Parsed xlat tree: Tue Sep 26 08:33:47 2017 : Debug: attribute --> User-Name Tue Sep 26 08:33:47 2017 : Debug: (1) sql: EXPAND %{User-Name} Tue Sep 26 08:33:47 2017 : Debug: (1) sql: --> hans@telesec Tue Sep 26 08:33:47 2017 : Debug: (1) sql: SQL-User-Name set to 'hans@telesec' Tue Sep 26 08:33:47 2017 : Info: rlm_sql (sql): Closing connection (1): Hit idle_timeout, was idle for 733 seconds Tue Sep 26 08:33:47 2017 : Debug: rlm_sql_mysql: Socket destructor called, closing socket Hans Bornemann Abteilung Datanet Technische Universität Dortmund ITMC Otto-Hahn-Str. 12 44227 Dortmund Tel.: +49 231-755 2132 hans.bornemann(a)tu-dortmund.de www.itmc.tu-dortmund.de Wichtiger Hinweis: Die Information in dieser E-Mail ist vertraulich. Sie ist ausschließlich für den Adressaten bestimmt. Sollten Sie nicht der für diese E-Mail bestimmte Adressat sein, unterrichten Sie bitte den Absender und vernichten Sie diese Mail. Vielen Dank. Unbeschadet der Korrespondenz per E-Mail, sind unsere Erklärungen ausschließlich final rechtsverbindlich, wenn sie in herkömmlicher Schriftform (mit eigenhändiger Unterschrift) oder durch Übermittlung eines solchen Schriftstücks per Telefax erfolgen. Important note: The information included in this e-mail is confidential. It is solely intended for the recipient. If you are not the intended recipient of this e-mail please contact the sender and delete this message. Thank you. Without prejudice of e-mail correspondence, our statements are only legally binding when they are made in the conventional written form (with personal signature) or when such documents are sent by fax.

2 1

Re: Radius not giving VLAN after reconnect
by Alan Buxey 25 Sep '17

25 Sep '17

Don't disable as that will have a big impact on performance. Instead config the server so the cache is useful and works Anonymous IDs? Not a problem as that's all part of the spec... In systems like eduroam you get to see the real ID of the user in the inner tunnel (where you make the vlan decision) , you don't get to see the real ID of visitors, that's privacy alan On 25 Sep 2017 9:40 pm, "Matthew Pulis" <mpulis(a)gmail.com> wrote: Dear Alan Thanks for your suggestion. Indeed cache was on. I disabled it by enable = no in /etc/freeradius/mods-enabled/eap Anywhere else I need to disable it? On another note, are those anonymous connections something which should worry me please? Pasting the log of me trying to connect from another client. First time it connects it goes to VLAN 11 and second as you can see it goes haywire. Thanks Waking up in 4.9 seconds. (96) Received Access-Request Id 240 from 192.168.100.109:39092 to 192.168.100.201:1812 length 317 (96) User-Name = "anonymous" (96) NAS-IP-Address = 10.0.148.255 (96) NAS-Identifier = "802aa849cbfe" (96) NAS-Port = 0 (96) Called-Station-Id = "80-2A-A8-4A-CB-FE:SeminaryWiFi" (96) Calling-Station-Id = "08-11-96-10-3E-14" (96) Framed-MTU = 1400 (96) NAS-Port-Type = Wireless-802.11 (96) Connect-Info = "CONNECT 0Mbps 802.11b" (96) EAP-Message = 0x0280008815800000007e16030300461000004241044cb275f6fcf633ed 05fe8ff5ca6954298c28f0eca0d5f52a17fd3967828032bb591f8de9f740 fbc3503f15d22a1ee987f063ecf29b4ec20ab6df6a37b6eecc0514030300 0101160303002800000000000000004efd211e798f718ea73a96b4ead59e (96) State = 0x66755a3e65f54f6d39985201a18178d8 (96) Message-Authenticator = 0x901592ede88efe274c6142b8f017adb2 (96) session-state: No cached attributes (96) # Executing section authorize from file /etc/freeradius/sites-enabled/default (96) authorize { (96) policy filter_username { (96) if (&User-Name) { (96) if (&User-Name) -> TRUE (96) if (&User-Name) { (96) if (&User-Name =~ /@[^@]*@/ ) { (96) if (&User-Name =~ /@[^@]*@/ ) -> FALSE (96) if (&User-Name =~ /\.\./ ) { (96) if (&User-Name =~ /\.\./ ) -> FALSE (96) if ((&User-Name =~ /@/) && (&User-Name !~ /(a)(.+)\.(.+)$/)) { (96) if ((&User-Name =~ /@/) && (&User-Name !~ /(a)(.+)\.(.+)$/)) -> FALSE (96) if (&User-Name =~ /\.$/) { (96) if (&User-Name =~ /\.$/) -> FALSE (96) if (&User-Name =~ /(a)\./) { (96) if (&User-Name =~ /(a)\./) -> FALSE (96) } # if (&User-Name) = notfound (96) } # policy filter_username = notfound (96) [preprocess] = ok (96) [chap] = noop (96) [mschap] = noop (96) ntdomain: Checking for prefix before "\" (96) ntdomain: No '\' in User-Name = "anonymous", looking up realm NULL (96) ntdomain: No such realm "NULL" (96) [ntdomain] = noop (96) eap: Peer sent EAP Response (code 2) ID 128 length 136 (96) eap: Continuing tunnel setup (96) [eap] = ok (96) } # authorize = ok (96) Found Auth-Type = eap (96) # Executing group from file /etc/freeradius/sites-enabled/default (96) authenticate { (96) eap: Expiring EAP session with state 0x66755a3e65f54f6d (96) eap: Finished EAP session with state 0x66755a3e65f54f6d (96) eap: Previous EAP request found for state 0x66755a3e65f54f6d, released from the list (96) eap: Peer sent packet with method EAP TTLS (21) (96) eap: Calling submodule eap_ttls to process data (96) eap_ttls: Authenticate (96) eap_ttls: Continuing EAP-TLS (96) eap_ttls: Peer indicated complete TLS record size will be 126 bytes (96) eap_ttls: Got complete TLS record (126 bytes) (96) eap_ttls: [eaptls verify] = length included (96) eap_ttls: <<< recv TLS 1.2 [length 0046] (96) eap_ttls: TLS_accept: unknown state (96) eap_ttls: TLS_accept: unknown state (96) eap_ttls: <<< recv TLS 1.2 [length 0001] (96) eap_ttls: <<< recv TLS 1.2 [length 0010] (96) eap_ttls: TLS_accept: unknown state (96) eap_ttls: >>> send TLS 1.2 [length 0001] (96) eap_ttls: TLS_accept: unknown state (96) eap_ttls: >>> send TLS 1.2 [length 0010] (96) eap_ttls: TLS_accept: unknown state (96) eap_ttls: TLS_accept: unknown state (96) eap_ttls: (other): SSL negotiation finished successfully (96) eap_ttls: SSL Connection Established (96) eap_ttls: [eaptls process] = handled (96) eap: Sending EAP Request (code 1) ID 129 length 61 (96) eap: EAP session adding &reply:State = 0x66755a3e62f44f6d (96) [eap] = handled (96) } # authenticate = handled (96) Using Post-Auth-Type Challenge (96) Post-Auth-Type sub-section not found. Ignoring. (96) # Executing group from file /etc/freeradius/sites-enabled/default (96) Sent Access-Challenge Id 240 from 192.168.100.201:1812 to 192.168.100.109:39092 length 0 (96) EAP-Message = 0x0181003d15800000003314030300010116030300280e51a3e7a6798a4b 990b4ebfbbb4c12533451c5335012189ffca366de94f2c3d4e489f3a5be84620 (96) Message-Authenticator = 0x00000000000000000000000000000000 (96) State = 0x66755a3e62f44f6d39985201a18178d8 (96) Finished request Waking up in 4.9 seconds. (97) Received Access-Request Id 241 from 192.168.100.109:39092 to 192.168.100.201:1812 length 244 (97) User-Name = "anonymous" (97) NAS-IP-Address = 10.0.148.255 (97) NAS-Identifier = "802aa849cbfe" (97) NAS-Port = 0 (97) Called-Station-Id = "80-2A-A8-4A-CB-FE:SeminaryWiFi" (97) Calling-Station-Id = "08-11-96-10-3E-14" (97) Framed-MTU = 1400 (97) NAS-Port-Type = Wireless-802.11 (97) Connect-Info = "CONNECT 0Mbps 802.11b" (97) EAP-Message = 0x0281003f15800000003517030300300000000000000001f4e09b67e72f f9aa43f89f7257edbfa01cdd7ee13e6cda560d9c10100aa501139e1e87b046a845d7 (97) State = 0x66755a3e62f44f6d39985201a18178d8 (97) Message-Authenticator = 0x829057918936a78bb34ff9798347607c (97) session-state: No cached attributes (97) # Executing section authorize from file /etc/freeradius/sites-enabled/default (97) authorize { (97) policy filter_username { (97) if (&User-Name) { (97) if (&User-Name) -> TRUE (97) if (&User-Name) { (97) if (&User-Name =~ /@[^@]*@/ ) { (97) if (&User-Name =~ /@[^@]*@/ ) -> FALSE (97) if (&User-Name =~ /\.\./ ) { (97) if (&User-Name =~ /\.\./ ) -> FALSE (97) if ((&User-Name =~ /@/) && (&User-Name !~ /(a)(.+)\.(.+)$/)) { (97) if ((&User-Name =~ /@/) && (&User-Name !~ /(a)(.+)\.(.+)$/)) -> FALSE (97) if (&User-Name =~ /\.$/) { (97) if (&User-Name =~ /\.$/) -> FALSE (97) if (&User-Name =~ /(a)\./) { (97) if (&User-Name =~ /(a)\./) -> FALSE (97) } # if (&User-Name) = notfound (97) } # policy filter_username = notfound (97) [preprocess] = ok (97) [chap] = noop (97) [mschap] = noop (97) ntdomain: Checking for prefix before "\" (97) ntdomain: No '\' in User-Name = "anonymous", looking up realm NULL (97) ntdomain: No such realm "NULL" (97) [ntdomain] = noop (97) eap: Peer sent EAP Response (code 2) ID 129 length 63 (97) eap: Continuing tunnel setup (97) [eap] = ok (97) } # authorize = ok (97) Found Auth-Type = eap (97) # Executing group from file /etc/freeradius/sites-enabled/default (97) authenticate { (97) eap: Expiring EAP session with state 0x66755a3e62f44f6d (97) eap: Finished EAP session with state 0x66755a3e62f44f6d (97) eap: Previous EAP request found for state 0x66755a3e62f44f6d, released from the list (97) eap: Peer sent packet with method EAP TTLS (21) (97) eap: Calling submodule eap_ttls to process data (97) eap_ttls: Authenticate (97) eap_ttls: Continuing EAP-TLS (97) eap_ttls: Peer indicated complete TLS record size will be 53 bytes (97) eap_ttls: Got complete TLS record (53 bytes) (97) eap_ttls: [eaptls verify] = length included (97) eap_ttls: [eaptls process] = ok (97) eap_ttls: Session established. Proceeding to decode tunneled attributes (97) eap_ttls: Got tunneled request (97) eap_ttls: User-Name = "abc" (97) eap_ttls: User-Password = "abcd" (97) eap_ttls: FreeRADIUS-Proxied-To = 127.0.0.1 (97) eap_ttls: Sending tunneled request (97) Virtual server inner-tunnel received request (97) User-Name = "abc" (97) User-Password = "abcd" (97) FreeRADIUS-Proxied-To = 127.0.0.1 (97) server inner-tunnel { (97) # Executing section authorize from file /etc/freeradius/sites-enabled/inner-tunnel (97) authorize { (97) policy filter_username { (97) if (&User-Name) { (97) if (&User-Name) -> TRUE (97) if (&User-Name) { (97) if (&User-Name =~ /@[^@]*@/ ) { (97) if (&User-Name =~ /@[^@]*@/ ) -> FALSE (97) if (&User-Name =~ /\.\./ ) { (97) if (&User-Name =~ /\.\./ ) -> FALSE (97) if ((&User-Name =~ /@/) && (&User-Name !~ /(a)(.+)\.(.+)$/)) { (97) if ((&User-Name =~ /@/) && (&User-Name !~ /(a)(.+)\.(.+)$/)) -> FALSE (97) if (&User-Name =~ /\.$/) { (97) if (&User-Name =~ /\.$/) -> FALSE (97) if (&User-Name =~ /(a)\./) { (97) if (&User-Name =~ /(a)\./) -> FALSE (97) } # if (&User-Name) = notfound (97) } # policy filter_username = notfound (97) [chap] = noop (97) [mschap] = noop (97) ntdomain: Checking for prefix before "\" (97) ntdomain: No '\' in User-Name = "abc", looking up realm NULL (97) ntdomain: No such realm "NULL" (97) [ntdomain] = noop (97) update control { (97) &Proxy-To-Realm := LOCAL (97) } # update control = noop (97) eap: No EAP-Message, not doing EAP (97) [eap] = noop (97) [files] = noop rlm_ldap (ldap): Closing connection (17): Hit idle_timeout, was idle for 240 seconds rlm_ldap (ldap): You probably need to lower "min" rlm_ldap (ldap): Closing connection (18): Hit idle_timeout, was idle for 240 seconds rlm_ldap (ldap): You probably need to lower "min" rlm_ldap (ldap): 0 of 0 connections in use. You may need to increase "spare" rlm_ldap (ldap): Opening additional connection (19), 1 of 32 pending slots used rlm_ldap (ldap): Connecting to ldap://localhost:389 rlm_ldap (ldap): Waiting for bind result... rlm_ldap (ldap): Bind successful rlm_ldap (ldap): Reserved connection (19) (97) ldap: EXPAND (cn=%{%{Stripped-User-Name}:-%{User-Name}}) (97) ldap: --> (cn=abc) (97) ldap: Performing search in "ou=SeminaryOU,dc=seminary,dc=local" with filter "(cn=abc)", scope "sub" (97) ldap: Waiting for search result... (97) ldap: User object found at DN "cn=abc,cn=Seminarians,ou=SeminaryOU,dc=seminary,dc=local" (97) ldap: Processing user attributes (97) ldap: control:Password-With-Header += '{ssha}dYlL9kdAZTjsDzkBHYg5bEJ6J+w6tm5V4pSR+A==' (97) ldap: control:Password-With-Header += 'abcd' rlm_ldap (ldap): Released connection (19) Need 2 more connections to reach min connections (3) rlm_ldap (ldap): Opening additional connection (20), 1 of 31 pending slots used rlm_ldap (ldap): Connecting to ldap://localhost:389 rlm_ldap (ldap): Waiting for bind result... rlm_ldap (ldap): Bind successful (97) [ldap] = updated rlm_ldap (adldap): Closing connection (16): Hit idle_timeout, was idle for 240 seconds rlm_ldap (adldap): You probably need to lower "min" rlm_ldap (adldap): Closing connection (17): Hit idle_timeout, was idle for 240 seconds rlm_ldap (adldap): You probably need to lower "min" rlm_ldap (adldap): 0 of 0 connections in use. You may need to increase "spare" rlm_ldap (adldap): Opening additional connection (18), 1 of 32 pending slots used rlm_ldap (adldap): Connecting to ldap://localhost:389 rlm_ldap (adldap): Waiting for bind result... rlm_ldap (adldap): Bind successful rlm_ldap (adldap): Reserved connection (18) (97) adldap: EXPAND (cn=%{%{Stripped-User-Name}:-%{User-Name}}) (97) adldap: --> (cn=abc) (97) adldap: Performing search in "ou=School,dc=seminary,dc=ad" with filter "(cn=abc)", scope "sub" (97) adldap: Waiting for search result... (97) adldap: The specified DN wasn't found (97) adldap: Search returned no results rlm_ldap (adldap): Released connection (18) Need 2 more connections to reach min connections (3) rlm_ldap (adldap): Opening additional connection (19), 1 of 31 pending slots used rlm_ldap (adldap): Connecting to ldap://localhost:389 rlm_ldap (adldap): Waiting for bind result... rlm_ldap (adldap): Bind successful (97) [adldap] = notfound (97) [expiration] = noop (97) [logintime] = noop (97) pap: Converted: &control:Password-With-Header -> &control:SSHA1-Password (97) pap: Removing &control:Password-With-Header (97) pap: No {...} in Password-With-Header, re-writing to Cleartext-Password (97) pap: Removing &control:Password-With-Header (97) pap: Normalizing SSHA1-Password from base64 encoding, 40 bytes -> 28 bytes (97) [pap] = updated (97) } # authorize = updated (97) Found Auth-Type = PAP (97) # Executing group from file /etc/freeradius/sites-enabled/inner-tunnel (97) Auth-Type PAP { (97) pap: Login attempt with password (97) pap: Comparing with "known-good" SSHA-Password (97) pap: User authenticated successfully (97) [pap] = ok (97) } # Auth-Type PAP = ok (97) # Executing section post-auth from file /etc/freeradius/sites-enabled/inner-tunnel (97) post-auth { (97) ldap: EXPAND . (97) ldap: --> . (97) ldap: EXPAND Authenticated at %S (97) ldap: --> Authenticated at 2017-09-25 22:21:49 rlm_ldap (ldap): Reserved connection (19) (97) ldap: Using user DN from request "cn=abc,cn=Seminarians,ou=SeminaryOU,dc=seminary,dc=local" (97) ldap: Modifying object with DN "cn=abc,cn=Seminarians,ou=SeminaryOU,dc=seminary,dc=local" (97) ldap: Waiting for modify result... rlm_ldap (ldap): Released connection (19) (97) [ldap] = ok (97) } # post-auth = ok (97) } # server inner-tunnel (97) Virtual server sending reply (97) eap_ttls: Got tunneled Access-Accept (97) eap: Sending EAP Success (code 3) ID 129 length 4 (97) eap: Freeing handler (97) [eap] = ok (97) } # authenticate = ok (97) # Executing section post-auth from file /etc/freeradius/sites-enabled/default (97) post-auth { (97) update { (97) No attributes updated (97) } # update = noop (97) if (Ldap-Group == "cn=Teachers,ou=School,dc=seminary,dc=ad") { (97) Searching for user in group "cn=Teachers,ou=School,dc=seminary,dc=ad" rlm_ldap (ldap): Reserved connection (20) (97) EXPAND (cn=%{%{Stripped-User-Name}:-%{User-Name}}) (97) --> (cn=anonymous) (97) Performing search in "ou=SeminaryOU,dc=seminary,dc=local" with filter "(cn=anonymous)", scope "sub" (97) Waiting for search result... (97) Search returned no results rlm_ldap (ldap): Released connection (20) (97) if (Ldap-Group == "cn=Teachers,ou=School,dc=seminary,dc=ad") -> FALSE (97) if (Ldap-Group == "cn=SeminaryAdmin,ou=SeminaryOU,dc=seminary,dc=local") { (97) Searching for user in group "cn=SeminaryAdmin,ou=SeminaryOU,dc=seminary,dc=local" rlm_ldap (ldap): Reserved connection (19) (97) EXPAND (cn=%{%{Stripped-User-Name}:-%{User-Name}}) (97) --> (cn=anonymous) (97) Performing search in "ou=SeminaryOU,dc=seminary,dc=local" with filter "(cn=anonymous)", scope "sub" (97) Waiting for search result... (97) Search returned no results rlm_ldap (ldap): Released connection (19) (97) if (Ldap-Group == "cn=SeminaryAdmin,ou=SeminaryOU,dc=seminary,dc=local") -> FALSE (97) if (Ldap-Group == "cn=Formators,ou=SeminaryOU,dc=seminary,dc=local") { (97) Searching for user in group "cn=Formators,ou=SeminaryOU,dc=seminary,dc=local" rlm_ldap (ldap): Reserved connection (20) (97) EXPAND (cn=%{%{Stripped-User-Name}:-%{User-Name}}) (97) --> (cn=anonymous) (97) Performing search in "ou=SeminaryOU,dc=seminary,dc=local" with filter "(cn=anonymous)", scope "sub" (97) Waiting for search result... (97) Search returned no results rlm_ldap (ldap): Released connection (20) (97) if (Ldap-Group == "cn=Formators,ou=SeminaryOU,dc=seminary,dc=local") -> FALSE (97) if (Ldap-Group == "cn=Seminarians,ou=SeminaryOU,dc=seminary,dc=local") { (97) Searching for user in group "cn=Seminarians,ou=SeminaryOU,dc=seminary,dc=local" rlm_ldap (ldap): Reserved connection (19) (97) EXPAND (cn=%{%{Stripped-User-Name}:-%{User-Name}}) (97) --> (cn=anonymous) (97) Performing search in "ou=SeminaryOU,dc=seminary,dc=local" with filter "(cn=anonymous)", scope "sub" (97) Waiting for search result... (97) Search returned no results rlm_ldap (ldap): Released connection (19) (97) if (Ldap-Group == "cn=Seminarians,ou=SeminaryOU,dc=seminary,dc=local") -> FALSE (97) if (Ldap-Group == "cn=Staff,ou=SeminaryOU,dc=seminary,dc=local") { (97) Searching for user in group "cn=Staff,ou=SeminaryOU,dc=seminary,dc=local" rlm_ldap (ldap): Reserved connection (20) (97) EXPAND (cn=%{%{Stripped-User-Name}:-%{User-Name}}) (97) --> (cn=anonymous) (97) Performing search in "ou=SeminaryOU,dc=seminary,dc=local" with filter "(cn=anonymous)", scope "sub" (97) Waiting for search result... (97) Search returned no results rlm_ldap (ldap): Released connection (20) (97) if (Ldap-Group == "cn=Staff,ou=SeminaryOU,dc=seminary,dc=local") -> FALSE (97) if (Ldap-Group == "cn=School,ou=SeminaryOU,dc=seminary,dc=local") { (97) Searching for user in group "cn=School,ou=SeminaryOU,dc=seminary,dc=local" rlm_ldap (ldap): Reserved connection (19) (97) EXPAND (cn=%{%{Stripped-User-Name}:-%{User-Name}}) (97) --> (cn=anonymous) (97) Performing search in "ou=SeminaryOU,dc=seminary,dc=local" with filter "(cn=anonymous)", scope "sub" (97) Waiting for search result... (97) Search returned no results rlm_ldap (ldap): Released connection (19) (97) if (Ldap-Group == "cn=School,ou=SeminaryOU,dc=seminary,dc=local") -> FALSE (97) ldap: EXPAND . (97) ldap: --> . (97) ldap: EXPAND Authenticated at %S (97) ldap: --> Authenticated at 2017-09-25 22:21:49 rlm_ldap (ldap): Reserved connection (20) (97) ldap: EXPAND (cn=%{%{Stripped-User-Name}:-%{User-Name}}) (97) ldap: --> (cn=anonymous) (97) ldap: Performing search in "ou=SeminaryOU,dc=seminary,dc=local" with filter "(cn=anonymous)", scope "sub" (97) ldap: Waiting for search result... (97) ldap: Search returned no results rlm_ldap (ldap): Released connection (20) (97) [ldap] = notfound (97) [exec] = noop (97) policy remove_reply_message_if_eap { (97) if (&reply:EAP-Message && &reply:Reply-Message) { (97) if (&reply:EAP-Message && &reply:Reply-Message) -> FALSE (97) else { (97) [noop] = noop (97) } # else = noop (97) } # policy remove_reply_message_if_eap = noop (97) } # post-auth = noop (97) Sent Access-Accept Id 241 from 192.168.100.201:1812 to 192.168.100.109:39092 length 0 (97) MS-MPPE-Recv-Key = 0x95225afb6e71050f5c7671c0bf4f4dba41a04c22193da51689b298ddd7d8512b (97) MS-MPPE-Send-Key = 0x77ab817b4619d5edf30293d205ed2d9f78ad3316cfb18cd600f338b6dcd99d94 (97) EAP-Message = 0x03810004 (97) Message-Authenticator = 0x00000000000000000000000000000000 (97) User-Name = "anonymous" (97) Finished request Waking up in 4.8 seconds. (93) Cleaning up request packet ID 237 with timestamp +610 (94) Cleaning up request packet ID 238 with timestamp +610 (95) Cleaning up request packet ID 239 with timestamp +610 (96) Cleaning up request packet ID 240 with timestamp +610 (97) Cleaning up request packet ID 241 with timestamp +610 Waking up in 5.8 seconds. (98) Received Accounting-Request Id 242 from 192.168.100.109:38125 to 192.168.100.201:1813 length 174 (98) Acct-Session-Id = "00000012-000000ED" (98) Acct-Status-Type = Start (98) Acct-Authentic = RADIUS (98) User-Name = "anonymous" (98) NAS-IP-Address = 10.0.148.255 (98) Framed-IP-Address = 192.168.100.36 (98) NAS-Identifier = "802aa849cbfe" (98) NAS-Port = 0 (98) Called-Station-Id = "80-2A-A8-4A-CB-FE:SeminaryWiFi" (98) Calling-Station-Id = "08-11-96-10-3E-14" (98) NAS-Port-Type = Wireless-802.11 (98) Connect-Info = "CONNECT 0Mbps 802.11b" (98) # Executing section preacct from file /etc/freeradius/sites-enabled/default (98) preacct { (98) [preprocess] = ok (98) policy acct_unique { (98) update request { (98) &Tmp-String-9 := "ai:" (98) } # update request = noop (98) if (("%{hex:&Class}" =~ /^%{hex:&Tmp-String-9}/) && ("%{string:&Class}" =~ /^ai:([0-9a-f]{32})/i)) { (98) EXPAND %{hex:&Class} (98) --> (98) EXPAND ^%{hex:&Tmp-String-9} (98) --> ^61693a (98) if (("%{hex:&Class}" =~ /^%{hex:&Tmp-String-9}/) && ("%{string:&Class}" =~ /^ai:([0-9a-f]{32})/i)) -> FALSE (98) else { (98) update request { (98) EXPAND %{md5:%{User-Name},%{Acct-Session-ID},%{%{NAS-IPv6- Address}:-%{NAS-IP-Address}},%{NAS-Identifier},%{NAS-Port-ID},%{NAS-Port}} (98) --> f6e43b70ba6c919feabc2c5ea73ddbe2 (98) &Acct-Unique-Session-Id := f6e43b70ba6c919feabc2c5ea73ddbe2 (98) } # update request = noop (98) } # else = noop (98) } # policy acct_unique = noop (98) suffix: Checking for suffix after "@" (98) suffix: No '@' in User-Name = "anonymous", looking up realm NULL (98) suffix: No such realm "NULL" (98) [suffix] = noop (98) [files] = noop (98) } # preacct = ok (98) # Executing section accounting from file /etc/freeradius/sites-enabled/default (98) accounting { (98) detail: EXPAND /var/log/freeradius/radacct/%{%{Packet-Src-IP-Address}:-%{ Packet-Src-IPv6-Address}}/detail-%Y%m%d (98) detail: --> /var/log/freeradius/radacct/ 192.168.100.109/detail-20170925 (98) detail: /var/log/freeradius/radacct/%{%{Packet-Src-IP-Address}:-%{ Packet-Src-IPv6-Address}}/detail-%Y%m%d expands to /var/log/freeradius/radacct/192.168.100.109/detail-20170925 (98) detail: EXPAND %t (98) detail: --> Mon Sep 25 22:21:59 2017 (98) [detail] = ok (98) [unix] = ok (98) [exec] = noop (98) attr_filter.accounting_response: EXPAND %{User-Name} (98) attr_filter.accounting_response: --> anonymous (98) attr_filter.accounting_response: Matched entry DEFAULT at line 12 (98) [attr_filter.accounting_response] = updated (98) } # accounting = updated (98) Sent Accounting-Response Id 242 from 192.168.100.201:1813 to 192.168.100.109:38125 length 0 (98) Finished request (98) Cleaning up request packet ID 242 with timestamp +620 Waking up in 0.8 seconds. -- Hi Sounds like you've got the EAP caching enabled but are not populating the vlan number you are returning in the cache object thus the next re-auth uses cache but has no vlan value to reply with so you get the default vlan. alan - List info/subscribe/unsubscribe? See http://www.freeradius.org/ list/users.html

1 0

L2TP and LNS queries
by Clive Allen 25 Sep '17

25 Sep '17

Hi, I am currently trying to setup and configure a freeRADIUS box that will authenticate customers being forwarded from a Juniper device (MX240). We are using standard, included package of mySQL (MariaDB). I am currently stiuck at this point as I have configured Cisco NAS via Clients.conf anf proxy.conf but that was for Eduroam. Is it very similar with Juniper? Waht are the atrributes? Has anyone achieved this before? Thanks Clive

1 0

Minimal Exec Example
by Sky 25 Sep '17

25 Sep '17

hi there, im stuck in configure a simple "exec" solution. my site config looks like this: //================ START ================ authorize{ # exec update control { Auth-Type := `/usr/bin/php -f /foo/bar/baz.php --username '%{User-Name}' --password '%{User-Password}' --ip '%{Client-IP-Address}'` } } //================ END ================ so this works fine, i get the params and can handle this request. my php-script std-out response looks like this: //================ START ================ Accept WISPr-Bandwidth-Max-Up = xxx WISPr-Bandwidth-Max-Down = xxx WISPr-Redirection-URL = http://google.com //================ END ================ to test this configure, i try with CLI: //================ START ================ $ radtest foo bar localhost 0 testing123 Sending Access-Request of id 145 to 127.0.0.1 port 1812 User-Name = "foo" User-Password = "bar" NAS-IP-Address = 127.0.1.1 NAS-Port = 0 Message-Authenticator = 0x00000000000000000000000000000000 rad_recv: Access-Accept packet from host 127.0.0.1 port 1812, id=145, length=20 //================ END ================ but i cant see any additinal response attributes, so what sould i do? any suggestions? Greez & thx, volker...

4 6

Re: Minimal Exec Example
by Peter Lambrechtsen 24 Sep '17

24 Sep '17

Or if you really need some really special logic write it in Perl as there is a very stable module to do exactly that. The Python module is also there but can be more problematic if you have external dependencies and is less forgiving. The perl code I wrote gets called millions of times a day without an issue. On 23/09/2017 04:33, "Alan Buxey" <alan.buxey(a)gmail.com> wrote: You're not using exec. You are making some syntax up. Create a module copies from exec example. Put your stuff into it, give it a suitable ID/name and call that name in your configured instead of exec What's the PHP script doing though? Often things are far better off being done natively alan On 22 Sep 2017 2:44 pm, "Sky" <skydiablo(a)gmx.net> wrote: > hi there, > > im stuck in configure a simple "exec" solution. my site config looks > like this: > > //================ START ================ > authorize{ > # exec > update control { > Auth-Type := `/usr/bin/php -f /foo/bar/baz.php --username > '%{User-Name}' --password '%{User-Password}' --ip '%{Client-IP-Address}'` > } > } > //================ END ================ > > so this works fine, i get the params and can handle this request. my > php-script std-out response looks like this: > > //================ START ================ > Accept > WISPr-Bandwidth-Max-Up = xxx > WISPr-Bandwidth-Max-Down = xxx > WISPr-Redirection-URL = http://google.com > //================ END ================ > > to test this configure, i try with CLI: > > //================ START ================ > $ radtest foo bar localhost 0 testing123 > Sending Access-Request of id 145 to 127.0.0.1 port 1812 > User-Name = "foo" > User-Password = "bar" > NAS-IP-Address = 127.0.1.1 > NAS-Port = 0 > Message-Authenticator = 0x00000000000000000000000000000000 > rad_recv: Access-Accept packet from host 127.0.0.1 port 1812, id=145, > length=20 > //================ END ================ > > but i cant see any additinal response attributes, so what sould i do? > any suggestions? > > Greez & thx, volker... > > - > List info/subscribe/unsubscribe? See http://www.freeradius.org/list > /users.html - List info/subscribe/unsubscribe? See http://www.freeradius.org/ list/users.html

2 1

Fwd: eap-fast: using eap-fast-mschapv2 in anonymous tunnel
by Isaac Boukris 23 Sep '17

23 Sep '17

Hi Alan, On Sat, Sep 23, 2017 at 4:47 AM, Alan DeKok <aland(a)deployingradius.com> wrote: > On Sep 22, 2017, at 9:05 PM, Isaac Boukris <iboukris(a)gmail.com> wrote: >> I've been trying to test eap-fast unauthenticated provisioning (RFC >> 5422), and was getting mschap errors, for which I think I found a fix >> - see attached patch (v3.0x). >> >> With this patch, the mschap authentication stage succeeds using >> eapol_test and a tunnel-pac is provisioned (while the first eapol >> exchange ends with reject as allowed by the RFC, the subsequent >> authentication successes using the newly provisioned pac). > > That looks good, thanks. Thanks! >> I also tried out the v4.0x branch but encountered some other issues. >> First had to add a cast to float when comparing with tls_max_version >> (inst->tls_conf->tls_max_version > (float) 1.1), as otherwise: >> float x = 1.1; if (x > 1.1) yields true for some reason. > > Floats are notorious for that kind of thing... To me this seem insane. See attached patch with some more casting, including the actual one, preventing tlsv1.1 with eap-fast, in rlm_eap_fast.c file. >> Then however, I get a crash which I can't figure so far - logs with >> back-trace attached. > > That's a straightforward infinite recursion. I've pushed a fix. That stopped the crash. However eap-fast still fails for no obvious reason and sometimes the server exits on assertion fail - see attached log. Regards.

2 5

Class Attribute Missing for Anonymous Users
by Selahattin Cilek 23 Sep '17

23 Sep '17

I use FreeRADIUS 3.0.15 and for some strange reason, the Unifi APs refuse to append the Class attribute for those users that use anonymous identity. Here are 4 accounting packets that were generated by the same UAP for the same user. When she does not use anonymous identity, we see the Class attribute. But when she *does* use anonymous identity, the Class attribute goes missing: Thu Sep 21 22:04:09 2017 Acct-Session-Id = "59C40101-0000000F" Acct-Status-Type = Start Acct-Authentic = RADIUS *User-Name = "53110080806"* NAS-Identifier = "802aa8b0fab9" NAS-Port = 0 Called-Station-Id = "80-2A-A8-B1-FA-B9:DAMLA.NET" *Calling-Station-Id = "6C-71-D9-2E-61-29"* NAS-Port-Type = Wireless-802.11 Connect-Info = "CONNECT 0Mbps 802.11b" *Class = 0x3533313130303830383036* NAS-IP-Address = 192.168.0.26 Event-Timestamp = "Sep 21 2017 22:04:09 +03" Timestamp = 1506020649 Thu Sep 21 22:05:06 2017 Acct-Session-Id = "59C40101-0000000F" Acct-Status-Type = Stop Acct-Authentic = RADIUS *User-Name = "53110080806"* NAS-Identifier = "802aa8b0fab9" NAS-Port = 0 Called-Station-Id = "80-2A-A8-B1-FA-B9:DAMLA.NET" *Calling-Station-Id = "6C-71-D9-2E-61-29"* NAS-Port-Type = Wireless-802.11 Connect-Info = "CONNECT 0Mbps 802.11b" *Class = 0x3533313130303830383036* Acct-Session-Time = 58 Acct-Input-Packets = 445 Acct-Output-Packets = 228 Acct-Input-Octets = 88637 Acct-Output-Octets = 16859 Event-Timestamp = "Sep 21 2017 22:04:45 +03" Acct-Terminate-Cause = User-Request NAS-IP-Address = 192.168.0.26 Timestamp = 1506020706 Thu Sep 21 22:06:02 2017 Acct-Session-Id = "59C40101-00000010" Acct-Status-Type = Start Acct-Authentic = RADIUS *User-Name = "anonymous"* NAS-Identifier = "802aa8b0fab9" NAS-Port = 0 Called-Station-Id = "80-2A-A8-B1-FA-B9:DAMLA.NET" *Calling-Station-Id = "6C-71-D9-2E-61-29"* NAS-Port-Type = Wireless-802.11 Connect-Info = "CONNECT 0Mbps 802.11b" NAS-IP-Address = 192.168.0.26 Event-Timestamp = "Sep 21 2017 22:06:02 +03" Timestamp = 1506020762 Thu Sep 21 22:18:37 2017 Acct-Session-Id = "59C40101-00000010" Acct-Status-Type = Stop Acct-Authentic = RADIUS *User-Name = "anonymous"* NAS-Identifier = "802aa8b0fab9" NAS-Port = 0 Called-Station-Id = "80-2A-A8-B1-FA-B9:DAMLA.NET" *Calling-Station-Id = "6C-71-D9-2E-61-29"* NAS-Port-Type = Wireless-802.11 Connect-Info = "CONNECT 0Mbps 802.11b" Acct-Session-Time = 755 Acct-Input-Packets = 827 Acct-Output-Packets = 401 Acct-Input-Octets = 109567 Acct-Output-Octets = 28858 Event-Timestamp = "Sep 21 2017 22:18:15 +03" Acct-Terminate-Cause = User-Request NAS-IP-Address = 192.168.0.26 Timestamp = 1506021517 I think the UAP is trying to protect the user's privacy and I hate that. I will definitely get in touch with Ubnt and ask them to change this behaviour. But is there anything I can do on the FreeRADIUS server to make sure that the Class attribute is present in all accounting packets? --- This email has been checked for viruses by Avast antivirus software. https://www.avast.com/antivirus

2 6

SQL module not instantiating
by mustafa mujahid 23 Sep '17

23 Sep '17

Hello, I realize that FRv 2.x is EOL. I wanted to install to see the difference between debug output just out of curiosity. I have installed it a number of times in the past but I'm facing a peculiar issue this time around. The sql module is loaded but wont instantiate when I start the server. I have an OracleDB that I want to connect with and have built the server from source including all oracle lib and install/home directories with ./configure. I have attached the install log as well. Any help would be greatly appreciated. [root@radtestfsd ~]# /usr/local/radius/sbin/radiusd -X radiusd: FreeRADIUS Version 2.2.9, for host x86_64-unknown-linux-gnu, built on Sep 22 2017 at 14:25:00 Copyright (C) 1999-2015 The FreeRADIUS server project and contributors. There is NO warranty; not even for MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. You may redistribute copies of FreeRADIUS under the terms of the GNU General Public License. For more information about these matters, see the file named COPYRIGHT. Starting - reading configuration files ... including configuration file /etc/raddb/radiusd.conf including configuration file /etc/raddb/proxy.conf including configuration file /etc/raddb/clients.conf including files in directory /etc/raddb/modules/ including configuration file /etc/raddb/modules/unix including configuration file /etc/raddb/modules/redis including configuration file /etc/raddb/modules/logintime including configuration file /etc/raddb/modules/policy including configuration file /etc/raddb/modules/counter including configuration file /etc/raddb/modules/krb5 including configuration file /etc/raddb/modules/sqlcounter_expire_on_login including configuration file /etc/raddb/modules/expiration including configuration file /etc/raddb/modules/ippool including configuration file /etc/raddb/modules/expr including configuration file /etc/raddb/modules/files including configuration file /etc/raddb/modules/preprocess including configuration file /etc/raddb/modules/radutmp including configuration file /etc/raddb/modules/inner-eap including configuration file /etc/raddb/modules/chap including configuration file /etc/raddb/modules/sql_log including configuration file /etc/raddb/modules/opendirectory including configuration file /etc/raddb/modules/attr_rewrite including configuration file /etc/raddb/modules/passwd including configuration file /etc/raddb/modules/detail.log including configuration file /etc/raddb/modules/cui including configuration file /etc/raddb/modules/dhcp_sqlippool including configuration file /etc/raddb/sql/mysql/ippool-dhcp.conf including configuration file /etc/raddb/modules/smsotp including configuration file /etc/raddb/modules/acct_unique including configuration file /etc/raddb/modules/ntlm_auth including configuration file /etc/raddb/modules/dynamic_clients including configuration file /etc/raddb/modules/wimax including configuration file /etc/raddb/modules/cache including configuration file /etc/raddb/modules/mac2ip including configuration file /etc/raddb/modules/checkval including configuration file /etc/raddb/modules/soh including configuration file /etc/raddb/modules/radrelay including configuration file /etc/raddb/modules/always including configuration file /etc/raddb/modules/pap including configuration file /etc/raddb/modules/digest including configuration file /etc/raddb/modules/mschap including configuration file /etc/raddb/modules/linelog including configuration file /etc/raddb/modules/perl including configuration file /etc/raddb/modules/ldap including configuration file /etc/raddb/modules/sradutmp including configuration file /etc/raddb/modules/etc_group including configuration file /etc/raddb/modules/mac2vlan including configuration file /etc/raddb/modules/realm including configuration file /etc/raddb/modules/echo including configuration file /etc/raddb/modules/detail.example.com including configuration file /etc/raddb/modules/replicate including configuration file /etc/raddb/modules/rediswho including configuration file /etc/raddb/modules/detail including configuration file /etc/raddb/modules/attr_filter including configuration file /etc/raddb/modules/smbpasswd including configuration file /etc/raddb/modules/pam including configuration file /etc/raddb/modules/otp including configuration file /etc/raddb/modules/exec including configuration file /etc/raddb/eap.conf including configuration file /etc/raddb/sql.conf including configuration file /etc/raddb/sql/mysql/dialup.conf including configuration file /etc/raddb/policy.conf including files in directory /etc/raddb/sites-enabled/ including configuration file /etc/raddb/sites-enabled/default including configuration file /etc/raddb/sites-enabled/control-socket including configuration file /etc/raddb/sites-enabled/inner-tunnel main { allow_core_dumps = no } including dictionary file /etc/raddb/dictionary main { name = "radiusd" prefix = "/usr/local/radius" localstatedir = "/var/log/radius" sbindir = "/usr/local/radius/sbin" logdir = "/var/log/radius/log/radius" run_dir = "/var/log/radius/run/radiusd" libdir = "/usr/local/radius/lib" radacctdir = "/var/log/radius/log/radius/radacct" hostname_lookups = no max_request_time = 30 cleanup_delay = 5 max_requests = 1024 pidfile = "/var/log/radius/run/radiusd/radiusd.pid" checkrad = "/usr/local/radius/sbin/checkrad" debug_level = 0 proxy_requests = yes log { stripped_names = no auth = no auth_badpass = no auth_goodpass = no } security { max_attributes = 200 reject_delay = 1 status_server = yes allow_vulnerable_openssl = yes } } radiusd: #### Loading Realms and Home Servers #### proxy server { retry_delay = 5 retry_count = 3 default_fallback = no dead_time = 120 wake_all_if_all_dead = no } home_server localhost { ipaddr = 127.0.0.1 port = 1812 type = "auth" secret = "testing123" response_window = 20 max_outstanding = 65536 require_message_authenticator = yes zombie_period = 40 status_check = "status-server" ping_interval = 30 check_interval = 30 num_answers_to_alive = 3 num_pings_to_alive = 3 revive_interval = 120 status_check_timeout = 4 coa { irt = 2 mrt = 16 mrc = 5 mrd = 30 } } home_server_pool my_auth_failover { type = fail-over home_server = localhost } realm example.com { auth_pool = my_auth_failover } realm LOCAL { } radiusd: #### Loading Clients #### client localhost { ipaddr = 127.0.0.1 require_message_authenticator = no secret = "testing123" nastype = "other" } radiusd: #### Instantiating modules #### instantiate { Module: Linked to module rlm_exec Module: Instantiating module "exec" from file /etc/raddb/modules/exec exec { wait = no input_pairs = "request" shell_escape = yes timeout = 10 } Module: Linked to module rlm_expr Module: Instantiating module "expr" from file /etc/raddb/modules/expr Module: Linked to module rlm_expiration Module: Instantiating module "expiration" from file /etc/raddb/modules/expiration expiration { reply-message = "Password Has Expired " } Module: Linked to module rlm_logintime Module: Instantiating module "logintime" from file /etc/raddb/modules/logintime logintime { reply-message = "You are calling outside your allowed timespan " minimum-timeout = 60 } } radiusd: #### Loading Virtual Servers #### server { # from file /etc/raddb/radiusd.conf modules { Module: Creating Auth-Type = digest Module: Checking authenticate {...} for more modules to load Module: Linked to module rlm_pap Module: Instantiating module "pap" from file /etc/raddb/modules/pap pap { encryption_scheme = "auto" auto_header = no } Module: Linked to module rlm_chap Module: Instantiating module "chap" from file /etc/raddb/modules/chap Module: Linked to module rlm_mschap Module: Instantiating module "mschap" from file /etc/raddb/modules/mschap mschap { use_mppe = yes require_encryption = no require_strong = no with_ntdomain_hack = no allow_retry = yes } Module: Linked to module rlm_digest Module: Instantiating module "digest" from file /etc/raddb/modules/digest Module: Linked to module rlm_unix Module: Instantiating module "unix" from file /etc/raddb/modules/unix unix { radwtmp = "/var/log/radius/log/radius/radwtmp" } Module: Linked to module rlm_eap Module: Instantiating module "eap" from file /etc/raddb/eap.conf eap { default_eap_type = "md5" timer_expire = 60 ignore_unknown_eap_types = no cisco_accounting_username_bug = no max_sessions = 1024 } Module: Linked to sub-module rlm_eap_md5 Module: Instantiating eap-md5 Module: Linked to sub-module rlm_eap_leap Module: Instantiating eap-leap Module: Linked to sub-module rlm_eap_gtc Module: Instantiating eap-gtc gtc { challenge = "Password: " auth_type = "PAP" } Module: Linked to sub-module rlm_eap_tls Module: Instantiating eap-tls tls { rsa_key_exchange = no dh_key_exchange = yes rsa_key_length = 512 dh_key_length = 512 verify_depth = 0 CA_path = "/etc/raddb/certs" pem_file_type = yes private_key_file = "/etc/raddb/certs/server.pem" certificate_file = "/etc/raddb/certs/server.pem" CA_file = "/etc/raddb/certs/ca.pem" private_key_password = "whatever" dh_file = "/etc/raddb/certs/dh" fragment_size = 1024 include_length = yes check_crl = no check_all_crl = no cipher_list = "DEFAULT" make_cert_command = "/etc/raddb/certs/bootstrap" ecdh_curve = "prime256v1" cache { enable = no lifetime = 24 max_entries = 255 } verify { } ocsp { enable = no override_cert_url = yes url = "http://127.0.0.1/ocsp/"<http://127.0.0.1/ocsp/> use_nonce = yes timeout = 0 softfail = no } } Module: Linked to sub-module rlm_eap_ttls Module: Instantiating eap-ttls ttls { default_eap_type = "md5" copy_request_to_tunnel = no use_tunneled_reply = no virtual_server = "inner-tunnel" include_length = yes } Module: Linked to sub-module rlm_eap_peap Module: Instantiating eap-peap peap { default_eap_type = "mschapv2" copy_request_to_tunnel = no use_tunneled_reply = no proxy_tunneled_request_as_eap = yes virtual_server = "inner-tunnel" soh = no } Module: Linked to sub-module rlm_eap_mschapv2 Module: Instantiating eap-mschapv2 mschapv2 { with_ntdomain_hack = no send_error = no } Module: Checking authorize {...} for more modules to load Module: Linked to module rlm_preprocess Module: Instantiating module "preprocess" from file /etc/raddb/modules/preprocess preprocess { huntgroups = "/etc/raddb/huntgroups" hints = "/etc/raddb/hints" with_ascend_hack = no ascend_channels_per_line = 23 with_ntdomain_hack = no with_specialix_jetstream_hack = no with_cisco_vsa_hack = no with_alvarion_vsa_hack = no } reading pairlist file /etc/raddb/huntgroups reading pairlist file /etc/raddb/hints Module: Linked to module rlm_realm Module: Instantiating module "suffix" from file /etc/raddb/modules/realm realm suffix { format = "suffix" delimiter = "@" ignore_default = no ignore_null = no } Module: Linked to module rlm_files Module: Instantiating module "files" from file /etc/raddb/modules/files files { usersfile = "/etc/raddb/users" acctusersfile = "/etc/raddb/acct_users" preproxy_usersfile = "/etc/raddb/preproxy_users" compat = "no" } reading pairlist file /etc/raddb/users reading pairlist file /etc/raddb/acct_users reading pairlist file /etc/raddb/preproxy_users Module: Checking preacct {...} for more modules to load Module: Linked to module rlm_acct_unique Module: Instantiating module "acct_unique" from file /etc/raddb/modules/acct_unique acct_unique { key = "User-Name, Acct-Session-Id, NAS-IP-Address, NAS-Identifier, NAS-Port" } Module: Checking accounting {...} for more modules to load Module: Linked to module rlm_detail Module: Instantiating module "detail" from file /etc/raddb/modules/detail detail { detailfile = "/var/log/radius/log/radius/radacct/%{%{Packet-Src-IP-Address}:-%{Packet-Src-IPv6-Address}}/detail-%Y%m%d" header = "%t" detailperm = 384 dirperm = 493 locking = no log_packet_header = no escape_filenames = no } Module: Linked to module rlm_attr_filter Module: Instantiating module "attr_filter.accounting_response" from file /etc/raddb/modules/attr_filter attr_filter attr_filter.accounting_response { attrsfile = "/etc/raddb/attrs.accounting_response" key = "%{User-Name}" relaxed = no } reading pairlist file /etc/raddb/attrs.accounting_response Module: Checking session {...} for more modules to load Module: Linked to module rlm_radutmp Module: Instantiating module "radutmp" from file /etc/raddb/modules/radutmp radutmp { filename = "/var/log/radius/log/radius/radutmp" username = "%{User-Name}" case_sensitive = yes check_with_nas = yes perm = 384 callerid = yes } Module: Checking post-proxy {...} for more modules to load Module: Checking post-auth {...} for more modules to load Module: Instantiating module "attr_filter.access_reject" from file /etc/raddb/modules/attr_filter attr_filter attr_filter.access_reject { attrsfile = "/etc/raddb/attrs.access_reject" key = "%{User-Name}" relaxed = no } reading pairlist file /etc/raddb/attrs.access_reject } # modules } # server server inner-tunnel { # from file /etc/raddb/sites-enabled/inner-tunnel modules { Module: Checking authenticate {...} for more modules to load Module: Checking authorize {...} for more modules to load Module: Checking session {...} for more modules to load Module: Checking post-proxy {...} for more modules to load Module: Checking post-auth {...} for more modules to load } # modules } # server radiusd: #### Opening IP addresses and Ports #### listen { type = "auth" ipaddr = * port = 0 } listen { type = "acct" ipaddr = * port = 0 } listen { type = "control" listen { socket = "/var/log/radius/run/radiusd/radiusd.sock" } } listen { type = "auth" ipaddr = 127.0.0.1 port = 18120 } ... adding new socket proxy address * port 16336 Listening on authentication address * port 1812 Listening on accounting address * port 1813 Listening on command file /var/log/radius/run/radiusd/radiusd.sock Listening on authentication address 127.0.0.1 port 18120 as server inner-tunnel Listening on proxy address * port 1814 Ready to process requests.

2 2

Re: Bind radius client requests to a database
by Alan Buxey 23 Sep '17

23 Sep '17

They have to have the right secret to be able to talk. If not there request is discarded anyway as it cannot be parsed NAS-Identifier , called station ID or some other configurable (?) Attribute could be used alan

3 3