- Freeradius-Users - lists.freeradius.org

25 Sep '17

hi there, im stuck in configure a simple "exec" solution. my site config looks like this: //================ START ================ authorize{ # exec update control { Auth-Type := `/usr/bin/php -f /foo/bar/baz.php --username '%{User-Name}' --password '%{User-Password}' --ip '%{Client-IP-Address}'` } } //================ END ================ so this works fine, i get the params and can handle this request. my php-script std-out response looks like this: //================ START ================ Accept WISPr-Bandwidth-Max-Up = xxx WISPr-Bandwidth-Max-Down = xxx WISPr-Redirection-URL = http://google.com //================ END ================ to test this configure, i try with CLI: //================ START ================ $ radtest foo bar localhost 0 testing123 Sending Access-Request of id 145 to 127.0.0.1 port 1812 User-Name = "foo" User-Password = "bar" NAS-IP-Address = 127.0.1.1 NAS-Port = 0 Message-Authenticator = 0x00000000000000000000000000000000 rad_recv: Access-Accept packet from host 127.0.0.1 port 1812, id=145, length=20 //================ END ================ but i cant see any additinal response attributes, so what sould i do? any suggestions? Greez & thx, volker...

4 6

Re: Minimal Exec Example
by Peter Lambrechtsen 24 Sep '17

24 Sep '17

Or if you really need some really special logic write it in Perl as there is a very stable module to do exactly that. The Python module is also there but can be more problematic if you have external dependencies and is less forgiving. The perl code I wrote gets called millions of times a day without an issue. On 23/09/2017 04:33, "Alan Buxey" <alan.buxey(a)gmail.com> wrote: You're not using exec. You are making some syntax up. Create a module copies from exec example. Put your stuff into it, give it a suitable ID/name and call that name in your configured instead of exec What's the PHP script doing though? Often things are far better off being done natively alan On 22 Sep 2017 2:44 pm, "Sky" <skydiablo(a)gmx.net> wrote: > hi there, > > im stuck in configure a simple "exec" solution. my site config looks > like this: > > //================ START ================ > authorize{ > # exec > update control { > Auth-Type := `/usr/bin/php -f /foo/bar/baz.php --username > '%{User-Name}' --password '%{User-Password}' --ip '%{Client-IP-Address}'` > } > } > //================ END ================ > > so this works fine, i get the params and can handle this request. my > php-script std-out response looks like this: > > //================ START ================ > Accept > WISPr-Bandwidth-Max-Up = xxx > WISPr-Bandwidth-Max-Down = xxx > WISPr-Redirection-URL = http://google.com > //================ END ================ > > to test this configure, i try with CLI: > > //================ START ================ > $ radtest foo bar localhost 0 testing123 > Sending Access-Request of id 145 to 127.0.0.1 port 1812 > User-Name = "foo" > User-Password = "bar" > NAS-IP-Address = 127.0.1.1 > NAS-Port = 0 > Message-Authenticator = 0x00000000000000000000000000000000 > rad_recv: Access-Accept packet from host 127.0.0.1 port 1812, id=145, > length=20 > //================ END ================ > > but i cant see any additinal response attributes, so what sould i do? > any suggestions? > > Greez & thx, volker... > > - > List info/subscribe/unsubscribe? See http://www.freeradius.org/list > /users.html - List info/subscribe/unsubscribe? See http://www.freeradius.org/ list/users.html

2 1

Fwd: eap-fast: using eap-fast-mschapv2 in anonymous tunnel
by Isaac Boukris 23 Sep '17

23 Sep '17

Hi Alan, On Sat, Sep 23, 2017 at 4:47 AM, Alan DeKok <aland(a)deployingradius.com> wrote: > On Sep 22, 2017, at 9:05 PM, Isaac Boukris <iboukris(a)gmail.com> wrote: >> I've been trying to test eap-fast unauthenticated provisioning (RFC >> 5422), and was getting mschap errors, for which I think I found a fix >> - see attached patch (v3.0x). >> >> With this patch, the mschap authentication stage succeeds using >> eapol_test and a tunnel-pac is provisioned (while the first eapol >> exchange ends with reject as allowed by the RFC, the subsequent >> authentication successes using the newly provisioned pac). > > That looks good, thanks. Thanks! >> I also tried out the v4.0x branch but encountered some other issues. >> First had to add a cast to float when comparing with tls_max_version >> (inst->tls_conf->tls_max_version > (float) 1.1), as otherwise: >> float x = 1.1; if (x > 1.1) yields true for some reason. > > Floats are notorious for that kind of thing... To me this seem insane. See attached patch with some more casting, including the actual one, preventing tlsv1.1 with eap-fast, in rlm_eap_fast.c file. >> Then however, I get a crash which I can't figure so far - logs with >> back-trace attached. > > That's a straightforward infinite recursion. I've pushed a fix. That stopped the crash. However eap-fast still fails for no obvious reason and sometimes the server exits on assertion fail - see attached log. Regards.

2 5

Class Attribute Missing for Anonymous Users
by Selahattin Cilek 23 Sep '17

23 Sep '17

I use FreeRADIUS 3.0.15 and for some strange reason, the Unifi APs refuse to append the Class attribute for those users that use anonymous identity. Here are 4 accounting packets that were generated by the same UAP for the same user. When she does not use anonymous identity, we see the Class attribute. But when she *does* use anonymous identity, the Class attribute goes missing: Thu Sep 21 22:04:09 2017 Acct-Session-Id = "59C40101-0000000F" Acct-Status-Type = Start Acct-Authentic = RADIUS *User-Name = "53110080806"* NAS-Identifier = "802aa8b0fab9" NAS-Port = 0 Called-Station-Id = "80-2A-A8-B1-FA-B9:DAMLA.NET" *Calling-Station-Id = "6C-71-D9-2E-61-29"* NAS-Port-Type = Wireless-802.11 Connect-Info = "CONNECT 0Mbps 802.11b" *Class = 0x3533313130303830383036* NAS-IP-Address = 192.168.0.26 Event-Timestamp = "Sep 21 2017 22:04:09 +03" Timestamp = 1506020649 Thu Sep 21 22:05:06 2017 Acct-Session-Id = "59C40101-0000000F" Acct-Status-Type = Stop Acct-Authentic = RADIUS *User-Name = "53110080806"* NAS-Identifier = "802aa8b0fab9" NAS-Port = 0 Called-Station-Id = "80-2A-A8-B1-FA-B9:DAMLA.NET" *Calling-Station-Id = "6C-71-D9-2E-61-29"* NAS-Port-Type = Wireless-802.11 Connect-Info = "CONNECT 0Mbps 802.11b" *Class = 0x3533313130303830383036* Acct-Session-Time = 58 Acct-Input-Packets = 445 Acct-Output-Packets = 228 Acct-Input-Octets = 88637 Acct-Output-Octets = 16859 Event-Timestamp = "Sep 21 2017 22:04:45 +03" Acct-Terminate-Cause = User-Request NAS-IP-Address = 192.168.0.26 Timestamp = 1506020706 Thu Sep 21 22:06:02 2017 Acct-Session-Id = "59C40101-00000010" Acct-Status-Type = Start Acct-Authentic = RADIUS *User-Name = "anonymous"* NAS-Identifier = "802aa8b0fab9" NAS-Port = 0 Called-Station-Id = "80-2A-A8-B1-FA-B9:DAMLA.NET" *Calling-Station-Id = "6C-71-D9-2E-61-29"* NAS-Port-Type = Wireless-802.11 Connect-Info = "CONNECT 0Mbps 802.11b" NAS-IP-Address = 192.168.0.26 Event-Timestamp = "Sep 21 2017 22:06:02 +03" Timestamp = 1506020762 Thu Sep 21 22:18:37 2017 Acct-Session-Id = "59C40101-00000010" Acct-Status-Type = Stop Acct-Authentic = RADIUS *User-Name = "anonymous"* NAS-Identifier = "802aa8b0fab9" NAS-Port = 0 Called-Station-Id = "80-2A-A8-B1-FA-B9:DAMLA.NET" *Calling-Station-Id = "6C-71-D9-2E-61-29"* NAS-Port-Type = Wireless-802.11 Connect-Info = "CONNECT 0Mbps 802.11b" Acct-Session-Time = 755 Acct-Input-Packets = 827 Acct-Output-Packets = 401 Acct-Input-Octets = 109567 Acct-Output-Octets = 28858 Event-Timestamp = "Sep 21 2017 22:18:15 +03" Acct-Terminate-Cause = User-Request NAS-IP-Address = 192.168.0.26 Timestamp = 1506021517 I think the UAP is trying to protect the user's privacy and I hate that. I will definitely get in touch with Ubnt and ask them to change this behaviour. But is there anything I can do on the FreeRADIUS server to make sure that the Class attribute is present in all accounting packets? --- This email has been checked for viruses by Avast antivirus software. https://www.avast.com/antivirus

2 6

SQL module not instantiating
by mustafa mujahid 23 Sep '17

23 Sep '17

Hello, I realize that FRv 2.x is EOL. I wanted to install to see the difference between debug output just out of curiosity. I have installed it a number of times in the past but I'm facing a peculiar issue this time around. The sql module is loaded but wont instantiate when I start the server. I have an OracleDB that I want to connect with and have built the server from source including all oracle lib and install/home directories with ./configure. I have attached the install log as well. Any help would be greatly appreciated. [root@radtestfsd ~]# /usr/local/radius/sbin/radiusd -X radiusd: FreeRADIUS Version 2.2.9, for host x86_64-unknown-linux-gnu, built on Sep 22 2017 at 14:25:00 Copyright (C) 1999-2015 The FreeRADIUS server project and contributors. There is NO warranty; not even for MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. You may redistribute copies of FreeRADIUS under the terms of the GNU General Public License. For more information about these matters, see the file named COPYRIGHT. Starting - reading configuration files ... including configuration file /etc/raddb/radiusd.conf including configuration file /etc/raddb/proxy.conf including configuration file /etc/raddb/clients.conf including files in directory /etc/raddb/modules/ including configuration file /etc/raddb/modules/unix including configuration file /etc/raddb/modules/redis including configuration file /etc/raddb/modules/logintime including configuration file /etc/raddb/modules/policy including configuration file /etc/raddb/modules/counter including configuration file /etc/raddb/modules/krb5 including configuration file /etc/raddb/modules/sqlcounter_expire_on_login including configuration file /etc/raddb/modules/expiration including configuration file /etc/raddb/modules/ippool including configuration file /etc/raddb/modules/expr including configuration file /etc/raddb/modules/files including configuration file /etc/raddb/modules/preprocess including configuration file /etc/raddb/modules/radutmp including configuration file /etc/raddb/modules/inner-eap including configuration file /etc/raddb/modules/chap including configuration file /etc/raddb/modules/sql_log including configuration file /etc/raddb/modules/opendirectory including configuration file /etc/raddb/modules/attr_rewrite including configuration file /etc/raddb/modules/passwd including configuration file /etc/raddb/modules/detail.log including configuration file /etc/raddb/modules/cui including configuration file /etc/raddb/modules/dhcp_sqlippool including configuration file /etc/raddb/sql/mysql/ippool-dhcp.conf including configuration file /etc/raddb/modules/smsotp including configuration file /etc/raddb/modules/acct_unique including configuration file /etc/raddb/modules/ntlm_auth including configuration file /etc/raddb/modules/dynamic_clients including configuration file /etc/raddb/modules/wimax including configuration file /etc/raddb/modules/cache including configuration file /etc/raddb/modules/mac2ip including configuration file /etc/raddb/modules/checkval including configuration file /etc/raddb/modules/soh including configuration file /etc/raddb/modules/radrelay including configuration file /etc/raddb/modules/always including configuration file /etc/raddb/modules/pap including configuration file /etc/raddb/modules/digest including configuration file /etc/raddb/modules/mschap including configuration file /etc/raddb/modules/linelog including configuration file /etc/raddb/modules/perl including configuration file /etc/raddb/modules/ldap including configuration file /etc/raddb/modules/sradutmp including configuration file /etc/raddb/modules/etc_group including configuration file /etc/raddb/modules/mac2vlan including configuration file /etc/raddb/modules/realm including configuration file /etc/raddb/modules/echo including configuration file /etc/raddb/modules/detail.example.com including configuration file /etc/raddb/modules/replicate including configuration file /etc/raddb/modules/rediswho including configuration file /etc/raddb/modules/detail including configuration file /etc/raddb/modules/attr_filter including configuration file /etc/raddb/modules/smbpasswd including configuration file /etc/raddb/modules/pam including configuration file /etc/raddb/modules/otp including configuration file /etc/raddb/modules/exec including configuration file /etc/raddb/eap.conf including configuration file /etc/raddb/sql.conf including configuration file /etc/raddb/sql/mysql/dialup.conf including configuration file /etc/raddb/policy.conf including files in directory /etc/raddb/sites-enabled/ including configuration file /etc/raddb/sites-enabled/default including configuration file /etc/raddb/sites-enabled/control-socket including configuration file /etc/raddb/sites-enabled/inner-tunnel main { allow_core_dumps = no } including dictionary file /etc/raddb/dictionary main { name = "radiusd" prefix = "/usr/local/radius" localstatedir = "/var/log/radius" sbindir = "/usr/local/radius/sbin" logdir = "/var/log/radius/log/radius" run_dir = "/var/log/radius/run/radiusd" libdir = "/usr/local/radius/lib" radacctdir = "/var/log/radius/log/radius/radacct" hostname_lookups = no max_request_time = 30 cleanup_delay = 5 max_requests = 1024 pidfile = "/var/log/radius/run/radiusd/radiusd.pid" checkrad = "/usr/local/radius/sbin/checkrad" debug_level = 0 proxy_requests = yes log { stripped_names = no auth = no auth_badpass = no auth_goodpass = no } security { max_attributes = 200 reject_delay = 1 status_server = yes allow_vulnerable_openssl = yes } } radiusd: #### Loading Realms and Home Servers #### proxy server { retry_delay = 5 retry_count = 3 default_fallback = no dead_time = 120 wake_all_if_all_dead = no } home_server localhost { ipaddr = 127.0.0.1 port = 1812 type = "auth" secret = "testing123" response_window = 20 max_outstanding = 65536 require_message_authenticator = yes zombie_period = 40 status_check = "status-server" ping_interval = 30 check_interval = 30 num_answers_to_alive = 3 num_pings_to_alive = 3 revive_interval = 120 status_check_timeout = 4 coa { irt = 2 mrt = 16 mrc = 5 mrd = 30 } } home_server_pool my_auth_failover { type = fail-over home_server = localhost } realm example.com { auth_pool = my_auth_failover } realm LOCAL { } radiusd: #### Loading Clients #### client localhost { ipaddr = 127.0.0.1 require_message_authenticator = no secret = "testing123" nastype = "other" } radiusd: #### Instantiating modules #### instantiate { Module: Linked to module rlm_exec Module: Instantiating module "exec" from file /etc/raddb/modules/exec exec { wait = no input_pairs = "request" shell_escape = yes timeout = 10 } Module: Linked to module rlm_expr Module: Instantiating module "expr" from file /etc/raddb/modules/expr Module: Linked to module rlm_expiration Module: Instantiating module "expiration" from file /etc/raddb/modules/expiration expiration { reply-message = "Password Has Expired " } Module: Linked to module rlm_logintime Module: Instantiating module "logintime" from file /etc/raddb/modules/logintime logintime { reply-message = "You are calling outside your allowed timespan " minimum-timeout = 60 } } radiusd: #### Loading Virtual Servers #### server { # from file /etc/raddb/radiusd.conf modules { Module: Creating Auth-Type = digest Module: Checking authenticate {...} for more modules to load Module: Linked to module rlm_pap Module: Instantiating module "pap" from file /etc/raddb/modules/pap pap { encryption_scheme = "auto" auto_header = no } Module: Linked to module rlm_chap Module: Instantiating module "chap" from file /etc/raddb/modules/chap Module: Linked to module rlm_mschap Module: Instantiating module "mschap" from file /etc/raddb/modules/mschap mschap { use_mppe = yes require_encryption = no require_strong = no with_ntdomain_hack = no allow_retry = yes } Module: Linked to module rlm_digest Module: Instantiating module "digest" from file /etc/raddb/modules/digest Module: Linked to module rlm_unix Module: Instantiating module "unix" from file /etc/raddb/modules/unix unix { radwtmp = "/var/log/radius/log/radius/radwtmp" } Module: Linked to module rlm_eap Module: Instantiating module "eap" from file /etc/raddb/eap.conf eap { default_eap_type = "md5" timer_expire = 60 ignore_unknown_eap_types = no cisco_accounting_username_bug = no max_sessions = 1024 } Module: Linked to sub-module rlm_eap_md5 Module: Instantiating eap-md5 Module: Linked to sub-module rlm_eap_leap Module: Instantiating eap-leap Module: Linked to sub-module rlm_eap_gtc Module: Instantiating eap-gtc gtc { challenge = "Password: " auth_type = "PAP" } Module: Linked to sub-module rlm_eap_tls Module: Instantiating eap-tls tls { rsa_key_exchange = no dh_key_exchange = yes rsa_key_length = 512 dh_key_length = 512 verify_depth = 0 CA_path = "/etc/raddb/certs" pem_file_type = yes private_key_file = "/etc/raddb/certs/server.pem" certificate_file = "/etc/raddb/certs/server.pem" CA_file = "/etc/raddb/certs/ca.pem" private_key_password = "whatever" dh_file = "/etc/raddb/certs/dh" fragment_size = 1024 include_length = yes check_crl = no check_all_crl = no cipher_list = "DEFAULT" make_cert_command = "/etc/raddb/certs/bootstrap" ecdh_curve = "prime256v1" cache { enable = no lifetime = 24 max_entries = 255 } verify { } ocsp { enable = no override_cert_url = yes url = "http://127.0.0.1/ocsp/"<http://127.0.0.1/ocsp/> use_nonce = yes timeout = 0 softfail = no } } Module: Linked to sub-module rlm_eap_ttls Module: Instantiating eap-ttls ttls { default_eap_type = "md5" copy_request_to_tunnel = no use_tunneled_reply = no virtual_server = "inner-tunnel" include_length = yes } Module: Linked to sub-module rlm_eap_peap Module: Instantiating eap-peap peap { default_eap_type = "mschapv2" copy_request_to_tunnel = no use_tunneled_reply = no proxy_tunneled_request_as_eap = yes virtual_server = "inner-tunnel" soh = no } Module: Linked to sub-module rlm_eap_mschapv2 Module: Instantiating eap-mschapv2 mschapv2 { with_ntdomain_hack = no send_error = no } Module: Checking authorize {...} for more modules to load Module: Linked to module rlm_preprocess Module: Instantiating module "preprocess" from file /etc/raddb/modules/preprocess preprocess { huntgroups = "/etc/raddb/huntgroups" hints = "/etc/raddb/hints" with_ascend_hack = no ascend_channels_per_line = 23 with_ntdomain_hack = no with_specialix_jetstream_hack = no with_cisco_vsa_hack = no with_alvarion_vsa_hack = no } reading pairlist file /etc/raddb/huntgroups reading pairlist file /etc/raddb/hints Module: Linked to module rlm_realm Module: Instantiating module "suffix" from file /etc/raddb/modules/realm realm suffix { format = "suffix" delimiter = "@" ignore_default = no ignore_null = no } Module: Linked to module rlm_files Module: Instantiating module "files" from file /etc/raddb/modules/files files { usersfile = "/etc/raddb/users" acctusersfile = "/etc/raddb/acct_users" preproxy_usersfile = "/etc/raddb/preproxy_users" compat = "no" } reading pairlist file /etc/raddb/users reading pairlist file /etc/raddb/acct_users reading pairlist file /etc/raddb/preproxy_users Module: Checking preacct {...} for more modules to load Module: Linked to module rlm_acct_unique Module: Instantiating module "acct_unique" from file /etc/raddb/modules/acct_unique acct_unique { key = "User-Name, Acct-Session-Id, NAS-IP-Address, NAS-Identifier, NAS-Port" } Module: Checking accounting {...} for more modules to load Module: Linked to module rlm_detail Module: Instantiating module "detail" from file /etc/raddb/modules/detail detail { detailfile = "/var/log/radius/log/radius/radacct/%{%{Packet-Src-IP-Address}:-%{Packet-Src-IPv6-Address}}/detail-%Y%m%d" header = "%t" detailperm = 384 dirperm = 493 locking = no log_packet_header = no escape_filenames = no } Module: Linked to module rlm_attr_filter Module: Instantiating module "attr_filter.accounting_response" from file /etc/raddb/modules/attr_filter attr_filter attr_filter.accounting_response { attrsfile = "/etc/raddb/attrs.accounting_response" key = "%{User-Name}" relaxed = no } reading pairlist file /etc/raddb/attrs.accounting_response Module: Checking session {...} for more modules to load Module: Linked to module rlm_radutmp Module: Instantiating module "radutmp" from file /etc/raddb/modules/radutmp radutmp { filename = "/var/log/radius/log/radius/radutmp" username = "%{User-Name}" case_sensitive = yes check_with_nas = yes perm = 384 callerid = yes } Module: Checking post-proxy {...} for more modules to load Module: Checking post-auth {...} for more modules to load Module: Instantiating module "attr_filter.access_reject" from file /etc/raddb/modules/attr_filter attr_filter attr_filter.access_reject { attrsfile = "/etc/raddb/attrs.access_reject" key = "%{User-Name}" relaxed = no } reading pairlist file /etc/raddb/attrs.access_reject } # modules } # server server inner-tunnel { # from file /etc/raddb/sites-enabled/inner-tunnel modules { Module: Checking authenticate {...} for more modules to load Module: Checking authorize {...} for more modules to load Module: Checking session {...} for more modules to load Module: Checking post-proxy {...} for more modules to load Module: Checking post-auth {...} for more modules to load } # modules } # server radiusd: #### Opening IP addresses and Ports #### listen { type = "auth" ipaddr = * port = 0 } listen { type = "acct" ipaddr = * port = 0 } listen { type = "control" listen { socket = "/var/log/radius/run/radiusd/radiusd.sock" } } listen { type = "auth" ipaddr = 127.0.0.1 port = 18120 } ... adding new socket proxy address * port 16336 Listening on authentication address * port 1812 Listening on accounting address * port 1813 Listening on command file /var/log/radius/run/radiusd/radiusd.sock Listening on authentication address 127.0.0.1 port 18120 as server inner-tunnel Listening on proxy address * port 1814 Ready to process requests.

2 2

Re: Bind radius client requests to a database
by Alan Buxey 23 Sep '17

23 Sep '17

They have to have the right secret to be able to talk. If not there request is discarded anyway as it cannot be parsed NAS-Identifier , called station ID or some other configurable (?) Attribute could be used alan

3 3

eap-fast: using eap-fast-mschapv2 in anonymous tunnel
by Isaac Boukris 23 Sep '17

23 Sep '17

Hello all, I've been trying to test eap-fast unauthenticated provisioning (RFC 5422), and was getting mschap errors, for which I think I found a fix - see attached patch (v3.0x). With this patch, the mschap authentication stage succeeds using eapol_test and a tunnel-pac is provisioned (while the first eapol exchange ends with reject as allowed by the RFC, the subsequent authentication successes using the newly provisioned pac). My eapol_test config (my server config is almost untouched): network={ ssid="eap-fast-test" key_mgmt=WPA-EAP eap=FAST anonymous_identity="FAST-000102030405" identity="bob" password="hello" phase1="fast_provisioning=1" pac_file="/local/file" } I also tried out the v4.0x branch but encountered some other issues. First had to add a cast to float when comparing with tls_max_version (inst->tls_conf->tls_max_version > (float) 1.1), as otherwise: float x = 1.1; if (x > 1.1) yields true for some reason. Then however, I get a crash which I can't figure so far - logs with back-trace attached. Thanks, Isaac B.

2 1

Proxy CHAP into EAP session
by Jonathan 22 Sep '17

22 Sep '17

I'm looking for a way on how to proxy / recreate a session into an EAP session. STEPS 1 normal RADIUS session with CHAP password Received by RADIUS server1 2 RADIUS server1 converts/proxies it into a second RADIUS request but as an EAP session towards a RADIUS server2 which handles the full request. Any hints on how to do this? Can it even be done?

3 3

Fwd: Bind radius client requests to a database
by Ti Ti 22 Sep '17

22 Sep '17

HI've the following freeradius configuration that I use to bind radius clients to a specific db. The problem is that I use a virtual radius associated to every db and I would avoid this. Is that possible to have a single radius instance listening and forward the request to db using radius client password (eventually contained in the nas table)? server rad1 { listen { ipaddr = * port = 1820 type = auth } listen { ipaddr = * port = 1821 type = acct } authorize { db_rad_1 dailycounter_db_rad_1 noresetcounter_db_rad_1 preprocess chap mschap digest suffix eap { ok = return } files expiration logintime pap totalbytecounter_db_rad_1{ reject = 1 } if(reject){ update reply { Reply-Message := \"SESSION TERMINATED - YOUR TICKET IS EXPIRED\" } reject } } authenticate { Auth-Type PAP { pap } Auth-Type CHAP { chap } Auth-Type MS-CHAP { mschap } digest eap } preacct { preprocess acct_unique suffix files } accounting { db_rad_1 exec attr_filter.accounting_response } session { db_rad_1 } post-auth { exec Post-Auth-Type REJECT { db_rad_1 attr_filter.access_reject } } pre-proxy { } post-proxy { eap } } sql db_rad_1 { database = "mysql" driver = "rlm_sql_${database}" dialect = "mysql" server = "localhost" port = 3306 login = "test" password = "test" radius_db = "radius1" acct_table1 = "radacct" acct_table2 = "radacct" postauth_table = "radpostauth" authcheck_table = "radcheck" authreply_table = "radreply" groupcheck_table = "radgroupcheck" groupreply_table = "radgroupreply" usergroup_table = "radusergroup" delete_stale_sessions = yes sqltrace = no sqltracefile = ${logdir}/sqltrace.sql num_sql_socks = ${thread[pool].max_servers} connect_failure_retry_delay = 60 lifetime = 0 max_queries = 0 group_attribute = "${.:instance}-SQL-Group" read_clients = yes client_table = "nas" $INCLUDE ${modconfdir}/${.:name}/main/${dialect}/queries.conf }

3 9

Re: Terminate EAP-TTLS then proxy
by Alan Buxey 22 Sep '17

22 Sep '17

Change default EAP type md5 to ttls in your EAP module, that'll save a resend Next look at how you are handling realms in outer and inner. If only proxying ttls then comment out prefix/suffix from outer server. Finally, by default, there's a big safety switch in the inner tunnel to ensure things don't by default get their proxy changed in ttls , remove the proxy-to-realm statement (read the surrounding warning text) *or* update it to be relevant eg wrap it in unlang statement to only occur if the realm is not passpoint Ps having worked with passpoint myself I think I know what and why you are doing this ;) alan On 21 Sep 2017 11:27 pm, "Alan DeKok" <aland(a)deployingradius.com> wrote: On Sep 21, 2017, at 6:24 PM, <adrian.p.smith(a)bt.com> <adrian.p.smith(a)bt.com> wrote: > > Hi Alan, > > I proxy-to-realn LOCAL in the default server as I was advised to do this as part of the EAP-TTLS termination and Transfer to the inner-tunnel. > > Perhaps this is not needed? It's needed if you don't want to proxy the outer EAP session. > My aim is be able to terminate the EAP and then proxy the request to another server. Then edit the inner tunnel to delete the "Proxy-To-Realm = Local" attribute. Alan DeKok. - List info/subscribe/unsubscribe? See http://www.freeradius.org/ list/users.html

2 1