Freeradius-Users
Threads by month
- ----- 2026 -----
- September
- August
- July
- June
- May
- April
- March
- February
- January
- ----- 2025 -----
- December
- November
- October
- September
- August
- July
- June
- May
- April
- March
- February
- January
- ----- 2024 -----
- December
- November
- October
- September
- August
- July
- June
- May
- April
- March
- February
- January
- ----- 2023 -----
- December
- November
- October
- September
- August
- July
- June
- May
- April
- March
- February
- January
- ----- 2022 -----
- December
- November
- October
- September
- August
- July
- June
- May
- April
- March
- February
- January
- ----- 2021 -----
- December
- November
- October
- September
- August
- July
- June
- May
- April
- March
- February
- January
- ----- 2020 -----
- December
- November
- October
- September
- August
- July
- June
- May
- April
- March
- February
- January
- ----- 2019 -----
- December
- November
- October
- September
- August
- July
- June
- May
- April
- March
- February
- January
- ----- 2018 -----
- December
- November
- October
- September
- August
- July
- June
- May
- April
- March
- February
- January
- ----- 2017 -----
- December
- November
- October
- September
- August
- July
- June
- May
- April
- March
- February
- January
- ----- 2016 -----
- December
- November
- October
- September
- August
- July
- June
- May
- April
- March
- February
- January
- ----- 2015 -----
- December
- November
- October
- September
- August
- July
- June
- May
- April
- March
- February
- January
- ----- 2014 -----
- December
- November
- October
- September
- August
- July
- June
- May
- April
- March
- February
- January
- ----- 2013 -----
- December
- November
- October
- September
- August
- July
- June
- May
- April
- March
- February
- January
- ----- 2012 -----
- December
- November
- October
- September
- August
- July
- June
- May
- April
- March
- February
- January
- ----- 2011 -----
- December
- November
- October
- September
- August
- July
- June
- May
- April
- March
- February
- January
- ----- 2010 -----
- December
- November
- October
- September
- August
- July
- June
- May
- April
- March
- February
- January
- ----- 2009 -----
- December
- November
- October
- September
- August
- July
- June
- May
- April
- March
- February
- January
- ----- 2008 -----
- December
- November
- October
- September
- August
- July
- June
- May
- April
- March
- February
- January
- ----- 2007 -----
- December
- November
- October
- September
- August
- July
- June
- May
- April
- March
- February
- January
- ----- 2006 -----
- December
- November
- October
- September
- August
- July
- June
- May
- April
- March
- February
- January
- ----- 2005 -----
- December
- November
- October
- September
- August
- July
- June
- May
- 27050 discussions
Hi Alan,
I did some debugging and code hits src/lib/value.c:585 and returns -1. This is confusing because we set the attribute name to Attr-26.
case PW_TYPE_VSA:
fr_strerror_printf("Must use 'Attr-26 = ...' instead of 'Vendor-Specific = ...'");
return -1;
-Najam
On Aug 22, 2017, at 6:17 PM, Siddiqui Najam <Najam.Siddiqui(a)gemalto.com> wrote:
>
> Thanks for the response Alan.
>
> I have a backend server that can return any VSA, and the attribute is returned as a hex string. so I have to handle this dynamically.
>
> In version 2.X this was working fine. However, with 3.X (rlm_python) I am having this issue.
> It should work. What's the full debug output for it?
Wed Aug 23 00:44:09 2017 : Debug: (0) Received Access-Request Id 24 from 192.168.99.1:58796 to 172.17.0.5:1812 length 48
Wed Aug 23 00:44:09 2017 : Debug: (0) User-Name = "testuser"
Wed Aug 23 00:44:09 2017 : Debug: (0) User-Password = "testpassword"
Wed Aug 23 00:44:09 2017 : Debug: (0) session-state: No State attribute Wed Aug 23 00:44:09 2017 : Debug: (0) # Executing section authorize from file /etc/raddb/sites-enabled/default
Wed Aug 23 00:44:09 2017 : Debug: (0) authorize {
Wed Aug 23 00:44:09 2017 : Debug: (0) modsingle[authorize]: calling preprocess (rlm_preprocess)
Wed Aug 23 00:44:09 2017 : Debug: (0) modsingle[authorize]: returned from preprocess (rlm_preprocess)
Wed Aug 23 00:44:09 2017 : Debug: (0) [preprocess] = ok
Wed Aug 23 00:44:09 2017 : Debug: (0) modsingle[authorize]: calling agent_mod (rlm_python)
Wed Aug 23 00:44:09 2017 : Debug: (0) agent_mod: Initialised new thread state 0x563921b35680 Wed Aug 23 00:44:09 2017 : Debug: (0) agent_mod: Using thread state 0x563921b35680 Wed Aug 23 00:44:09 2017 : Debug: authorize - 'config:Auth-Type' = 'agent'
Wed Aug 23 00:44:09 2017 : Debug: (0) agent_mod: ::: FROM 1 TO 0 MAX 1 Wed Aug 23 00:44:09 2017 : Debug: (0) agent_mod: ::: Examining Auth-Type Wed Aug 23 00:44:09 2017 : Debug: (0) agent_mod: ::: APPENDING Auth-Type FROM 0 TO 0 Wed Aug 23 00:44:09 2017 : Debug: (0) agent_mod: ::: TO in 0 out 0
Wed Aug 23 00:44:09 2017 : Debug: (0) modsingle[authorize]: returned from agent_mod (rlm_python)
Wed Aug 23 00:44:09 2017 : Debug: (0) [agent_mod] = ok
Wed Aug 23 00:44:09 2017 : Debug: (0) modsingle[authorize]: calling chap (rlm_chap)
Wed Aug 23 00:44:09 2017 : Debug: (0) modsingle[authorize]: returned from chap (rlm_chap)
Wed Aug 23 00:44:09 2017 : Debug: (0) [chap] = noop
Wed Aug 23 00:44:09 2017 : Debug: (0) modsingle[authorize]: calling mschap (rlm_mschap)
Wed Aug 23 00:44:09 2017 : Debug: (0) modsingle[authorize]: returned from mschap (rlm_mschap)
Wed Aug 23 00:44:09 2017 : Debug: (0) [mschap] = noop
Wed Aug 23 00:44:09 2017 : Debug: (0) modsingle[authorize]: calling digest (rlm_digest)
Wed Aug 23 00:44:09 2017 : Debug: (0) modsingle[authorize]: returned from digest (rlm_digest)
Wed Aug 23 00:44:09 2017 : Debug: (0) [digest] = noop
Wed Aug 23 00:44:09 2017 : Debug: (0) modsingle[authorize]: calling suffix (rlm_realm)
Wed Aug 23 00:44:09 2017 : Debug: (0) suffix: Checking for suffix after "@"
Wed Aug 23 00:44:09 2017 : Debug: (0) suffix: No '@' in User-Name = "testuser", looking up realm NULL Wed Aug 23 00:44:09 2017 : Debug: (0) suffix: No such realm "NULL"
Wed Aug 23 00:44:09 2017 : Debug: (0) modsingle[authorize]: returned from suffix (rlm_realm)
Wed Aug 23 00:44:09 2017 : Debug: (0) [suffix] = noop
Wed Aug 23 00:44:09 2017 : Debug: (0) modsingle[authorize]: calling files (rlm_files)
Wed Aug 23 00:44:09 2017 : Debug: ^[Rr][Oo][Oo][Tt]$ Wed Aug 23 00:44:09 2017 : Debug: Parsed xlat tree:
Wed Aug 23 00:44:09 2017 : Debug: literal --> ^[Rr][Oo][Oo][Tt]$ Wed Aug 23 00:44:09 2017 : Debug: (0) files: EXPAND ^[Rr][Oo][Oo][Tt]$
Wed Aug 23 00:44:09 2017 : Debug: (0) files: --> ^[Rr][Oo][Oo][Tt]$
Wed Aug 23 00:44:09 2017 : Debug: No matches Wed Aug 23 00:44:09 2017 : Debug: Adding 33 matches
Wed Aug 23 00:44:09 2017 : Debug: (0) modsingle[authorize]: returned from files (rlm_files)
Wed Aug 23 00:44:09 2017 : Debug: (0) [files] = noop
Wed Aug 23 00:44:09 2017 : Debug: (0) modsingle[authorize]: calling expiration (rlm_expiration)
Wed Aug 23 00:44:09 2017 : Debug: (0) modsingle[authorize]: returned from expiration (rlm_expiration)
Wed Aug 23 00:44:09 2017 : Debug: (0) [expiration] = noop
Wed Aug 23 00:44:09 2017 : Debug: (0) modsingle[authorize]: calling logintime (rlm_logintime)
Wed Aug 23 00:44:09 2017 : Debug: (0) modsingle[authorize]: returned from logintime (rlm_logintime)
Wed Aug 23 00:44:09 2017 : Debug: (0) [logintime] = noop
Wed Aug 23 00:44:09 2017 : Debug: (0) modsingle[authorize]: calling pap (rlm_pap)
Wed Aug 23 00:44:09 2017 : WARNING: (0) pap: No "known good" password found for the user. Not setting Auth-Type Wed Aug 23 00:44:09 2017 : WARNING: (0) pap: Authentication will fail unless a "known good" password is available
Wed Aug 23 00:44:09 2017 : Debug: (0) modsingle[authorize]: returned from pap (rlm_pap)
Wed Aug 23 00:44:09 2017 : Debug: (0) [pap] = noop
Wed Aug 23 00:44:09 2017 : Debug: (0) } # authorize = ok
Wed Aug 23 00:44:09 2017 : Debug: (0) Found Auth-Type = agent Wed Aug 23 00:44:09 2017 : Debug: (0) # Executing group from file /etc/raddb/sites-enabled/default
Wed Aug 23 00:44:09 2017 : Debug: (0) Auth-Type agent {
Wed Aug 23 00:44:09 2017 : Debug: (0) modsingle[authenticate]: calling agent_mod (rlm_python)
Wed Aug 23 00:44:09 2017 : Debug: (0) agent_mod: Using thread state 0x563921b35680 Wed Aug 23 00:44:11 2017 : Debug: authenticate - Failed: 'reply:Attr-26' = '0x00000009010f54657374417474726962757465'
Wed Aug 23 00:44:11 2017 : Debug: (0) agent_mod: ::: FROM 1 TO 0 MAX 1 Wed Aug 23 00:44:11 2017 : Debug: (0) agent_mod: ::: Examining Vendor-Specific Wed Aug 23 00:44:11 2017 : Debug: (0) agent_mod: ::: APPENDING Vendor-Specific FROM 0 TO 0 Wed Aug 23 00:44:11 2017 : Debug: (0) agent_mod: ::: TO in 0 out 0 Wed Aug 23 00:44:11 2017 : Debug: authenticate - 'config:Auth-Type' = 'agent'
Wed Aug 23 00:44:11 2017 : Debug: (0) agent_mod: ::: FROM 1 TO 1 MAX 2 Wed Aug 23 00:44:11 2017 : Debug: (0) agent_mod: ::: Examining Auth-Type Wed Aug 23 00:44:11 2017 : Debug: (0) agent_mod: ::: TO in 1 out 1 Wed Aug 23 00:44:11 2017 : Debug: (0) agent_mod: ::: to[0] = Auth-Type
Wed Aug 23 00:44:11 2017 : Debug: (0) modsingle[authenticate]: returned from agent_mod (rlm_python)
Wed Aug 23 00:44:11 2017 : Debug: (0) [agent_mod] = ok
Wed Aug 23 00:44:11 2017 : Debug: (0) } # Auth-Type agent = ok
Wed Aug 23 00:44:11 2017 : Debug: (0) # Executing section post-auth from file /etc/raddb/sites-enabled/default
Wed Aug 23 00:44:11 2017 : Debug: (0) post-auth {
Wed Aug 23 00:44:11 2017 : Debug: (0) modsingle[post-auth]: calling exec (rlm_exec)
Wed Aug 23 00:44:11 2017 : Debug: (0) modsingle[post-auth]: returned from exec (rlm_exec)
Wed Aug 23 00:44:11 2017 : Debug: (0) [exec] = noop
Wed Aug 23 00:44:11 2017 : Debug: (0) } # post-auth = noop
Wed Aug 23 00:44:11 2017 : Auth: (0) Login OK: [testuser] (from client Radius Local port 0) Wed Aug 23 00:44:11 2017 : Debug: (0) Sent Access-Accept Id 24 from 172.17.0.5:1812 to 192.168.99.1:58796 length 0 SOFT ASSERT FAILED src/lib/value.c[1872]: 0
Wed Aug 23 00:44:11 2017 : Debug: (0) Vendor-Specific =
Wed Aug 23 00:44:11 2017 : Debug: (0) Finished request Wed Aug 23 00:44:11 2017 : Debug: Waking up in 4.9 seconds.
Wed Aug 23 00:44:16 2017 : Debug: (0) Cleaning up request packet ID 24 with timestamp +7 Wed Aug 23 00:44:16 2017 : Info: Ready to process requests
>And is the hex string well-formed? i.e. is it correct for the Cisco VSA?
Yes.
The response from freeradius server version 2.2.0:
Sending Access-Accept of id 25 to 192.168.56.1 port 55685
Attr-26 = 0x00000009010f54657374417474726962757465
In the test client (radtest) the response is:
rad_recv: Access-Accept packet from host 127.0.0.1 port 1812, id=204, length=53
Framed-Protocol = PPP
Framed-Compression = Van-Jacobson-TCP-IP
Cisco-AVPair = "TestAttribute"
Alan DeKok.
-
List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html
________________________________
This message and any attachments are intended solely for the addressees and may contain confidential information. Any unauthorized use or disclosure, either whole or partial, is prohibited.
E-mails are susceptible to alteration. Our company shall not be liable for the message if altered, changed or falsified. If you are not the intended recipient of this message, please delete it and notify the sender.
Although all reasonable efforts have been made to keep this transmission free from viruses, the sender will not be liable for damages caused by a transmitted virus.
2
1
-----Original Message-----
From: Freeradius-Users [mailto:freeradius-users-bounces+najam.siddiqui=gemalto.com@lists.freeradius.org] On Behalf Of Alan DeKok
Sent: Tuesday, August 22, 2017 6:11 PM
To: FreeRadius users mailing list <freeradius-users(a)lists.freeradius.org>
Subject: [+SPAM+]: Re: [+SPAM+]: Re: Returning Vendor Specific Attribute in radius reply
On Aug 22, 2017, at 6:17 PM, Siddiqui Najam <Najam.Siddiqui(a)gemalto.com> wrote:
>
> Thanks for the response Alan.
>
> I have a backend server that can return any VSA, and the attribute is returned as a hex string. so I have to handle this dynamically.
>
> In version 2.X this was working fine. However, with 3.X (rlm_python) I am having this issue.
> It should work. What's the full debug output for it?
Wed Aug 23 00:44:09 2017 : Debug: (0) Received Access-Request Id 24 from 192.168.99.1:58796 to 172.17.0.5:1812 length 48
Wed Aug 23 00:44:09 2017 : Debug: (0) User-Name = "testuser"
Wed Aug 23 00:44:09 2017 : Debug: (0) User-Password = "testpassword"
Wed Aug 23 00:44:09 2017 : Debug: (0) session-state: No State attribute
Wed Aug 23 00:44:09 2017 : Debug: (0) # Executing section authorize from file /etc/raddb/sites-enabled/default
Wed Aug 23 00:44:09 2017 : Debug: (0) authorize {
Wed Aug 23 00:44:09 2017 : Debug: (0) modsingle[authorize]: calling preprocess (rlm_preprocess)
Wed Aug 23 00:44:09 2017 : Debug: (0) modsingle[authorize]: returned from preprocess (rlm_preprocess)
Wed Aug 23 00:44:09 2017 : Debug: (0) [preprocess] = ok
Wed Aug 23 00:44:09 2017 : Debug: (0) modsingle[authorize]: calling agent_mod (rlm_python)
Wed Aug 23 00:44:09 2017 : Debug: (0) agent_mod: Initialised new thread state 0x563921b35680
Wed Aug 23 00:44:09 2017 : Debug: (0) agent_mod: Using thread state 0x563921b35680
Wed Aug 23 00:44:09 2017 : Debug: authorize - 'config:Auth-Type' = 'agent'
Wed Aug 23 00:44:09 2017 : Debug: (0) agent_mod: ::: FROM 1 TO 0 MAX 1
Wed Aug 23 00:44:09 2017 : Debug: (0) agent_mod: ::: Examining Auth-Type
Wed Aug 23 00:44:09 2017 : Debug: (0) agent_mod: ::: APPENDING Auth-Type FROM 0 TO 0
Wed Aug 23 00:44:09 2017 : Debug: (0) agent_mod: ::: TO in 0 out 0
Wed Aug 23 00:44:09 2017 : Debug: (0) modsingle[authorize]: returned from agent_mod (rlm_python)
Wed Aug 23 00:44:09 2017 : Debug: (0) [agent_mod] = ok
Wed Aug 23 00:44:09 2017 : Debug: (0) modsingle[authorize]: calling chap (rlm_chap)
Wed Aug 23 00:44:09 2017 : Debug: (0) modsingle[authorize]: returned from chap (rlm_chap)
Wed Aug 23 00:44:09 2017 : Debug: (0) [chap] = noop
Wed Aug 23 00:44:09 2017 : Debug: (0) modsingle[authorize]: calling mschap (rlm_mschap)
Wed Aug 23 00:44:09 2017 : Debug: (0) modsingle[authorize]: returned from mschap (rlm_mschap)
Wed Aug 23 00:44:09 2017 : Debug: (0) [mschap] = noop
Wed Aug 23 00:44:09 2017 : Debug: (0) modsingle[authorize]: calling digest (rlm_digest)
Wed Aug 23 00:44:09 2017 : Debug: (0) modsingle[authorize]: returned from digest (rlm_digest)
Wed Aug 23 00:44:09 2017 : Debug: (0) [digest] = noop
Wed Aug 23 00:44:09 2017 : Debug: (0) modsingle[authorize]: calling suffix (rlm_realm)
Wed Aug 23 00:44:09 2017 : Debug: (0) suffix: Checking for suffix after "@"
Wed Aug 23 00:44:09 2017 : Debug: (0) suffix: No '@' in User-Name = "testuser", looking up realm NULL
Wed Aug 23 00:44:09 2017 : Debug: (0) suffix: No such realm "NULL"
Wed Aug 23 00:44:09 2017 : Debug: (0) modsingle[authorize]: returned from suffix (rlm_realm)
Wed Aug 23 00:44:09 2017 : Debug: (0) [suffix] = noop
Wed Aug 23 00:44:09 2017 : Debug: (0) modsingle[authorize]: calling files (rlm_files)
Wed Aug 23 00:44:09 2017 : Debug: ^[Rr][Oo][Oo][Tt]$
Wed Aug 23 00:44:09 2017 : Debug: Parsed xlat tree:
Wed Aug 23 00:44:09 2017 : Debug: literal --> ^[Rr][Oo][Oo][Tt]$
Wed Aug 23 00:44:09 2017 : Debug: (0) files: EXPAND ^[Rr][Oo][Oo][Tt]$
Wed Aug 23 00:44:09 2017 : Debug: (0) files: --> ^[Rr][Oo][Oo][Tt]$
Wed Aug 23 00:44:09 2017 : Debug: No matches
Wed Aug 23 00:44:09 2017 : Debug: Adding 33 matches
Wed Aug 23 00:44:09 2017 : Debug: (0) modsingle[authorize]: returned from files (rlm_files)
Wed Aug 23 00:44:09 2017 : Debug: (0) [files] = noop
Wed Aug 23 00:44:09 2017 : Debug: (0) modsingle[authorize]: calling expiration (rlm_expiration)
Wed Aug 23 00:44:09 2017 : Debug: (0) modsingle[authorize]: returned from expiration (rlm_expiration)
Wed Aug 23 00:44:09 2017 : Debug: (0) [expiration] = noop
Wed Aug 23 00:44:09 2017 : Debug: (0) modsingle[authorize]: calling logintime (rlm_logintime)
Wed Aug 23 00:44:09 2017 : Debug: (0) modsingle[authorize]: returned from logintime (rlm_logintime)
Wed Aug 23 00:44:09 2017 : Debug: (0) [logintime] = noop
Wed Aug 23 00:44:09 2017 : Debug: (0) modsingle[authorize]: calling pap (rlm_pap)
Wed Aug 23 00:44:09 2017 : WARNING: (0) pap: No "known good" password found for the user. Not setting Auth-Type
Wed Aug 23 00:44:09 2017 : WARNING: (0) pap: Authentication will fail unless a "known good" password is available
Wed Aug 23 00:44:09 2017 : Debug: (0) modsingle[authorize]: returned from pap (rlm_pap)
Wed Aug 23 00:44:09 2017 : Debug: (0) [pap] = noop
Wed Aug 23 00:44:09 2017 : Debug: (0) } # authorize = ok
Wed Aug 23 00:44:09 2017 : Debug: (0) Found Auth-Type = agent
Wed Aug 23 00:44:09 2017 : Debug: (0) # Executing group from file /etc/raddb/sites-enabled/default
Wed Aug 23 00:44:09 2017 : Debug: (0) Auth-Type agent {
Wed Aug 23 00:44:09 2017 : Debug: (0) modsingle[authenticate]: calling agent_mod (rlm_python)
Wed Aug 23 00:44:09 2017 : Debug: (0) agent_mod: Using thread state 0x563921b35680
Wed Aug 23 00:44:11 2017 : Debug: authenticate - Failed: 'reply:Attr-26' = '0x00000009010f54657374417474726962757465'
Wed Aug 23 00:44:11 2017 : Debug: (0) agent_mod: ::: FROM 1 TO 0 MAX 1
Wed Aug 23 00:44:11 2017 : Debug: (0) agent_mod: ::: Examining Vendor-Specific
Wed Aug 23 00:44:11 2017 : Debug: (0) agent_mod: ::: APPENDING Vendor-Specific FROM 0 TO 0
Wed Aug 23 00:44:11 2017 : Debug: (0) agent_mod: ::: TO in 0 out 0
Wed Aug 23 00:44:11 2017 : Debug: authenticate - 'config:Auth-Type' = 'agent'
Wed Aug 23 00:44:11 2017 : Debug: (0) agent_mod: ::: FROM 1 TO 1 MAX 2
Wed Aug 23 00:44:11 2017 : Debug: (0) agent_mod: ::: Examining Auth-Type
Wed Aug 23 00:44:11 2017 : Debug: (0) agent_mod: ::: TO in 1 out 1
Wed Aug 23 00:44:11 2017 : Debug: (0) agent_mod: ::: to[0] = Auth-Type
Wed Aug 23 00:44:11 2017 : Debug: (0) modsingle[authenticate]: returned from agent_mod (rlm_python)
Wed Aug 23 00:44:11 2017 : Debug: (0) [agent_mod] = ok
Wed Aug 23 00:44:11 2017 : Debug: (0) } # Auth-Type agent = ok
Wed Aug 23 00:44:11 2017 : Debug: (0) # Executing section post-auth from file /etc/raddb/sites-enabled/default
Wed Aug 23 00:44:11 2017 : Debug: (0) post-auth {
Wed Aug 23 00:44:11 2017 : Debug: (0) modsingle[post-auth]: calling exec (rlm_exec)
Wed Aug 23 00:44:11 2017 : Debug: (0) modsingle[post-auth]: returned from exec (rlm_exec)
Wed Aug 23 00:44:11 2017 : Debug: (0) [exec] = noop
Wed Aug 23 00:44:11 2017 : Debug: (0) } # post-auth = noop
Wed Aug 23 00:44:11 2017 : Auth: (0) Login OK: [testuser] (from client Radius Local port 0)
Wed Aug 23 00:44:11 2017 : Debug: (0) Sent Access-Accept Id 24 from 172.17.0.5:1812 to 192.168.99.1:58796 length 0
SOFT ASSERT FAILED src/lib/value.c[1872]: 0
Wed Aug 23 00:44:11 2017 : Debug: (0) Vendor-Specific =
Wed Aug 23 00:44:11 2017 : Debug: (0) Finished request
Wed Aug 23 00:44:11 2017 : Debug: Waking up in 4.9 seconds.
Wed Aug 23 00:44:16 2017 : Debug: (0) Cleaning up request packet ID 24 with timestamp +7
Wed Aug 23 00:44:16 2017 : Info: Ready to process requests
>And is the hex string well-formed? i.e. is it correct for the Cisco VSA?
Yes.
The response from freeradius server version 2.2.0:
Sending Access-Accept of id 25 to 192.168.56.1 port 55685
Attr-26 = 0x00000009010f54657374417474726962757465
In the test client (radtest) the response is:
rad_recv: Access-Accept packet from host 127.0.0.1 port 1812, id=204, length=53
Framed-Protocol = PPP
Framed-Compression = Van-Jacobson-TCP-IP
Cisco-AVPair = "TestAttribute"
Alan DeKok.
-
List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html
________________________________
This message and any attachments are intended solely for the addressees and may contain confidential information. Any unauthorized use or disclosure, either whole or partial, is prohibited.
E-mails are susceptible to alteration. Our company shall not be liable for the message if altered, changed or falsified. If you are not the intended recipient of this message, please delete it and notify the sender.
Although all reasonable efforts have been made to keep this transmission free from viruses, the sender will not be liable for damages caused by a transmitted virus.
1
0
FreeRADIUS Version 3.0.13
Getting
(0) ERROR: No Auth-Type found: rejecting the user via Post-Auth-Type = Reject
in debug output. The server does not appear to be trying krb5 authentication.
In sites-enabled/default ---------
authenticate {
#
# User Kerberos to authenticate
#
Auth-Type Kerberos {
krb5
}
In mods-enabled/krb5 --------------
krb5 {
keytab = /etc/raddb-checkpoint/radius_auth.keytab
service_principal = "radius_auth"
In mods-config/files/authorize --------------
DEFAULT Auth-Type = Kerberos
User-Service-Type = Login-User,
Login-Service = Rlogin
Debug output: ------------------
FreeRADIUS Version 3.0.13
Copyright (C) 1999-2017 The FreeRADIUS server project and contributors
There is NO warranty; not even for MERCHANTABILITY or FITNESS FOR A
PARTICULAR PURPOSE
You may redistribute copies of FreeRADIUS under the terms of the
GNU General Public License
For more information about these matters, see the file named COPYRIGHT
Starting - reading configuration files ...
including dictionary file /usr/share/freeradius/dictionary
including dictionary file /usr/share/freeradius/dictionary.dhcp
including dictionary file /usr/share/freeradius/dictionary.vqp
including dictionary file /etc/raddb-checkpoint/dictionary
including configuration file /etc/raddb-checkpoint/radiusd.conf
including configuration file /etc/raddb-checkpoint/proxy.conf
including configuration file /etc/raddb-checkpoint/clients.conf
including files in directory /etc/raddb-checkpoint/mods-enabled/
including configuration file /etc/raddb-checkpoint/mods-enabled/utf8
including configuration file /etc/raddb-checkpoint/mods-enabled/unpack
including configuration file /etc/raddb-checkpoint/mods-enabled/unix
including configuration file /etc/raddb-checkpoint/mods-enabled/sradutmp
including configuration file /etc/raddb-checkpoint/mods-enabled/soh
including configuration file /etc/raddb-checkpoint/mods-enabled/replicate
including configuration file /etc/raddb-checkpoint/mods-enabled/realm
including configuration file /etc/raddb-checkpoint/mods-enabled/radutmp
including configuration file /etc/raddb-checkpoint/mods-enabled/preprocess
including configuration file /etc/raddb-checkpoint/mods-enabled/passwd
including configuration file /etc/raddb-checkpoint/mods-enabled/pap
including configuration file /etc/raddb-checkpoint/mods-enabled/ntlm_auth
including configuration file /etc/raddb-checkpoint/mods-enabled/mschap
including configuration file /etc/raddb-checkpoint/mods-enabled/logintime
including configuration file /etc/raddb-checkpoint/mods-enabled/linelog
including configuration file /etc/raddb-checkpoint/mods-enabled/files
including configuration file /etc/raddb-checkpoint/mods-enabled/expr
including configuration file /etc/raddb-checkpoint/mods-enabled/expiration
including configuration file /etc/raddb-checkpoint/mods-enabled/exec
including configuration file /etc/raddb-checkpoint/mods-enabled/echo
including configuration file /etc/raddb-checkpoint/mods-enabled/eap
including configuration file /etc/raddb-checkpoint/mods-enabled/dynamic_clients
including configuration file /etc/raddb-checkpoint/mods-enabled/digest
including configuration file /etc/raddb-checkpoint/mods-enabled/dhcp
including configuration file /etc/raddb-checkpoint/mods-enabled/detail.log
including configuration file /etc/raddb-checkpoint/mods-enabled/detail
including configuration file /etc/raddb-checkpoint/mods-enabled/date
including configuration file /etc/raddb-checkpoint/mods-enabled/chap
including configuration file /etc/raddb-checkpoint/mods-enabled/cache_eap
including configuration file /etc/raddb-checkpoint/mods-enabled/attr_filter
including configuration file /etc/raddb-checkpoint/mods-enabled/always
including configuration file /etc/raddb-checkpoint/mods-enabled/krb5
including files in directory /etc/raddb-checkpoint/policy.d/
including configuration file /etc/raddb-checkpoint/policy.d/accounting
including configuration file /etc/raddb-checkpoint/policy.d/canonicalization
including configuration file /etc/raddb-checkpoint/policy.d/control
including configuration file /etc/raddb-checkpoint/policy.d/cui
including configuration file /etc/raddb-checkpoint/policy.d/debug
including configuration file /etc/raddb-checkpoint/policy.d/dhcp
including configuration file /etc/raddb-checkpoint/policy.d/eap
including configuration file /etc/raddb-checkpoint/policy.d/filter
including configuration file /etc/raddb-checkpoint/policy.d/operator-name
including files in directory /etc/raddb-checkpoint/sites-enabled/
including configuration file /etc/raddb-checkpoint/sites-enabled/inner-tunnel
including configuration file /etc/raddb-checkpoint/sites-enabled/default
main {
security {
user = "radiusd"
group = "radiusd"
allow_core_dumps = no
}
name = "radiusd"
prefix = "/usr"
localstatedir = "/var"
logdir = "/var/log/radius"
run_dir = "/var/run/radiusd"
}
main {
name = "radiusd"
prefix = "/usr"
localstatedir = "/var"
sbindir = "/usr/sbin"
logdir = "/var/log/radius"
run_dir = "/var/run/radiusd"
libdir = "/usr/lib64/freeradius"
radacctdir = "/var/log/radius/radacct"
hostname_lookups = no
max_request_time = 30
cleanup_delay = 5
max_requests = 16384
pidfile = "/var/run/radiusd/radiusd.pid"
checkrad = "/usr/sbin/checkrad"
debug_level = 0
proxy_requests = yes
log {
stripped_names = no
auth = no
auth_badpass = no
auth_goodpass = no
colourise = yes
msg_denied = "You are already logged in - access denied"
}
resources {
}
security {
max_attributes = 200
reject_delay = 1.000000
status_server = yes
}
}
radiusd: #### Loading Realms and Home Servers ####
proxy server {
retry_delay = 5
retry_count = 3
default_fallback = no
dead_time = 120
wake_all_if_all_dead = no
}
home_server localhost {
ipaddr = 127.0.0.1
port = 1812
type = "auth"
secret = <<< secret >>>
response_window = 20.000000
response_timeouts = 1
max_outstanding = 65536
zombie_period = 40
status_check = "status-server"
ping_interval = 30
check_interval = 30
check_timeout = 4
num_answers_to_alive = 3
revive_interval = 120
limit {
max_connections = 16
max_requests = 0
lifetime = 0
idle_timeout = 0
}
coa {
irt = 2
mrt = 16
mrc = 5
mrd = 30
}
}
home_server_pool my_auth_failover {
type = fail-over
home_server = localhost
}
realm example.com {
auth_pool = my_auth_failover
}
realm LOCAL {
}
radiusd: #### Loading Clients ####
client localhost {
ipaddr = 127.0.0.1
require_message_authenticator = no
secret = <<< secret >>>
nas_type = "other"
proto = "*"
limit {
max_connections = 16
lifetime = 0
idle_timeout = 30
}
}
client netscalers {
ipv4addr = 129.219.12.129/26
require_message_authenticator = no
secret = <<< secret >>>
limit {
max_connections = 16
lifetime = 0
idle_timeout = 30
}
}
client test {
ipv4addr = 10.120.3.175
require_message_authenticator = no
secret = <<< secret >>>
limit {
max_connections = 16
lifetime = 0
idle_timeout = 30
}
}
Debugger not attached
# Creating Auth-Type = mschap
# Creating Auth-Type = eap
# Creating Auth-Type = Kerberos
# Creating Auth-Type = PAP
# Creating Auth-Type = CHAP
# Creating Auth-Type = MS-CHAP
# Creating Auth-Type = digest
radiusd: #### Instantiating modules ####
modules {
# Loaded module rlm_utf8
# Loading module "utf8" from file /etc/raddb-checkpoint/mods-enabled/utf8
# Loaded module rlm_unpack
# Loading module "unpack" from file /etc/raddb-checkpoint/mods-enabled/unpack
# Loaded module rlm_unix
# Loading module "unix" from file /etc/raddb-checkpoint/mods-enabled/unix
unix {
radwtmp = "/var/log/radius/radwtmp"
}
Creating attribute Unix-Group
# Loaded module rlm_radutmp
# Loading module "sradutmp" from file /etc/raddb-checkpoint/mods-enabled/sradutmp
radutmp sradutmp {
filename = "/var/log/radius/sradutmp"
username = "%{User-Name}"
case_sensitive = yes
check_with_nas = yes
permissions = 420
caller_id = no
}
# Loaded module rlm_soh
# Loading module "soh" from file /etc/raddb-checkpoint/mods-enabled/soh
soh {
dhcp = yes
}
# Loaded module rlm_replicate
# Loading module "replicate" from file /etc/raddb-checkpoint/mods-enabled/replicate
# Loaded module rlm_realm
# Loading module "IPASS" from file /etc/raddb-checkpoint/mods-enabled/realm
realm IPASS {
format = "prefix"
delimiter = "/"
ignore_default = no
ignore_null = no
}
# Loading module "suffix" from file /etc/raddb-checkpoint/mods-enabled/realm
realm suffix {
format = "suffix"
delimiter = "@"
ignore_default = no
ignore_null = no
}
# Loading module "realmpercent" from file /etc/raddb-checkpoint/mods-enabled/realm
realm realmpercent {
format = "suffix"
delimiter = "%"
ignore_default = no
ignore_null = no
}
# Loading module "ntdomain" from file /etc/raddb-checkpoint/mods-enabled/realm
realm ntdomain {
format = "prefix"
delimiter = "\\"
ignore_default = no
ignore_null = no
}
# Loading module "radutmp" from file /etc/raddb-checkpoint/mods-enabled/radutmp
radutmp {
filename = "/var/log/radius/radutmp"
username = "%{User-Name}"
case_sensitive = yes
check_with_nas = yes
permissions = 384
caller_id = yes
}
# Loaded module rlm_preprocess
# Loading module "preprocess" from file /etc/raddb-checkpoint/mods-enabled/preprocess
preprocess {
huntgroups = "/etc/raddb-checkpoint/mods-config/preprocess/huntgroups"
hints = "/etc/raddb-checkpoint/mods-config/preprocess/hints"
with_ascend_hack = no
ascend_channels_per_line = 23
with_ntdomain_hack = no
with_specialix_jetstream_hack = no
with_cisco_vsa_hack = no
with_alvarion_vsa_hack = no
}
# Loaded module rlm_passwd
# Loading module "etc_passwd" from file /etc/raddb-checkpoint/mods-enabled/passwd
passwd etc_passwd {
filename = "/etc/passwd"
format = "*User-Name:Crypt-Password:"
delimiter = ":"
ignore_nislike = no
ignore_empty = yes
allow_multiple_keys = no
hash_size = 100
}
# Loaded module rlm_pap
# Loading module "pap" from file /etc/raddb-checkpoint/mods-enabled/pap
pap {
normalise = yes
}
# Loaded module rlm_exec
# Loading module "ntlm_auth" from file /etc/raddb-checkpoint/mods-enabled/ntlm_auth
exec ntlm_auth {
wait = yes
program = "/path/to/ntlm_auth --request-nt-key --domain=MYDOMAIN --username=%{mschap:User-Name} --password=%{User-Password}"
shell_escape = yes
}
# Loaded module rlm_mschap
# Loading module "mschap" from file /etc/raddb-checkpoint/mods-enabled/mschap
mschap {
use_mppe = yes
require_encryption = no
require_strong = no
with_ntdomain_hack = yes
passchange {
}
allow_retry = yes
winbind_retry_with_normalised_username = no
}
# Loaded module rlm_logintime
# Loading module "logintime" from file /etc/raddb-checkpoint/mods-enabled/logintime
logintime {
minimum_timeout = 60
}
# Loaded module rlm_linelog
# Loading module "linelog" from file /etc/raddb-checkpoint/mods-enabled/linelog
linelog {
filename = "/var/log/radius/linelog"
escape_filenames = no
syslog_severity = "info"
permissions = 384
format = "This is a log message for %{User-Name}"
reference = "messages.%{%{reply:Packet-Type}:-default}"
}
# Loading module "log_accounting" from file /etc/raddb-checkpoint/mods-enabled/linelog
linelog log_accounting {
filename = "/var/log/radius/linelog-accounting"
escape_filenames = no
syslog_severity = "info"
permissions = 384
format = ""
reference = "Accounting-Request.%{%{Acct-Status-Type}:-unknown}"
}
# Loaded module rlm_files
# Loading module "files" from file /etc/raddb-checkpoint/mods-enabled/files
files {
filename = "/etc/raddb-checkpoint/mods-config/files/authorize"
usersfile = "/etc/raddb-checkpoint/mods-config/files/authorize"
acctusersfile = "/etc/raddb-checkpoint/mods-config/files/accounting"
preproxy_usersfile = "/etc/raddb-checkpoint/mods-config/files/pre-proxy"
}
# Loaded module rlm_expr
# Loading module "expr" from file /etc/raddb-checkpoint/mods-enabled/expr
expr {
safe_characters = "@abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ0123456789.-_: /äéöüà âæçèéêëîïôÅùûüaÿÃ
ÃÃÃÃÃÃÃÃÃÃÃÃÃÃÃÅÃß"
}
# Loaded module rlm_expiration
# Loading module "expiration" from file /etc/raddb-checkpoint/mods-enabled/expiration
# Loading module "exec" from file /etc/raddb-checkpoint/mods-enabled/exec
exec {
wait = no
input_pairs = "request"
shell_escape = yes
timeout = 10
}
# Loading module "echo" from file /etc/raddb-checkpoint/mods-enabled/echo
exec echo {
wait = yes
program = "/bin/echo %{User-Name}"
input_pairs = "request"
output_pairs = "reply"
shell_escape = yes
}
# Loaded module rlm_eap
# Loading module "eap" from file /etc/raddb-checkpoint/mods-enabled/eap
eap {
default_eap_type = "md5"
timer_expire = 60
ignore_unknown_eap_types = no
cisco_accounting_username_bug = no
max_sessions = 16384
}
# Loaded module rlm_dynamic_clients
# Loading module "dynamic_clients" from file /etc/raddb-checkpoint/mods-enabled/dynamic_clients
# Loaded module rlm_digest
# Loading module "digest" from file /etc/raddb-checkpoint/mods-enabled/digest
# Loaded module rlm_dhcp
# Loading module "dhcp" from file /etc/raddb-checkpoint/mods-enabled/dhcp
# Loaded module rlm_detail
# Loading module "auth_log" from file /etc/raddb-checkpoint/mods-enabled/detail.log
detail auth_log {
filename = "/var/log/radius/radacct/%{%{Packet-Src-IP-Address}:-%{Packet-Src-IPv6-Address}}/auth-detail-%Y%m%d"
header = "%t"
permissions = 384
locking = no
escape_filenames = no
log_packet_header = no
}
# Loading module "reply_log" from file /etc/raddb-checkpoint/mods-enabled/detail.log
detail reply_log {
filename = "/var/log/radius/radacct/%{%{Packet-Src-IP-Address}:-%{Packet-Src-IPv6-Address}}/reply-detail-%Y%m%d"
header = "%t"
permissions = 384
locking = no
escape_filenames = no
log_packet_header = no
}
# Loading module "pre_proxy_log" from file /etc/raddb-checkpoint/mods-enabled/detail.log
detail pre_proxy_log {
filename = "/var/log/radius/radacct/%{%{Packet-Src-IP-Address}:-%{Packet-Src-IPv6-Address}}/pre-proxy-detail-%Y%m%d"
header = "%t"
permissions = 384
locking = no
escape_filenames = no
log_packet_header = no
}
# Loading module "post_proxy_log" from file /etc/raddb-checkpoint/mods-enabled/detail.log
detail post_proxy_log {
filename = "/var/log/radius/radacct/%{%{Packet-Src-IP-Address}:-%{Packet-Src-IPv6-Address}}/post-proxy-detail-%Y%m%d"
header = "%t"
permissions = 384
locking = no
escape_filenames = no
log_packet_header = no
}
# Loading module "detail" from file /etc/raddb-checkpoint/mods-enabled/detail
detail {
filename = "/var/log/radius/radacct/%{%{Packet-Src-IP-Address}:-%{Packet-Src-IPv6-Address}}/detail-%Y%m%d"
header = "%t"
permissions = 384
locking = no
escape_filenames = no
log_packet_header = no
}
# Loaded module rlm_date
# Loading module "date" from file /etc/raddb-checkpoint/mods-enabled/date
date {
format = "%b %e %Y %H:%M:%S %Z"
}
# Loaded module rlm_chap
# Loading module "chap" from file /etc/raddb-checkpoint/mods-enabled/chap
# Loaded module rlm_cache
# Loading module "cache_eap" from file /etc/raddb-checkpoint/mods-enabled/cache_eap
cache cache_eap {
driver = "rlm_cache_rbtree"
key = "%{%{control:State}:-%{%{reply:State}:-%{State}}}"
ttl = 15
max_entries = 0
epoch = 0
add_stats = no
}
# Loaded module rlm_attr_filter
# Loading module "attr_filter.post-proxy" from file /etc/raddb-checkpoint/mods-enabled/attr_filter
attr_filter attr_filter.post-proxy {
filename = "/etc/raddb-checkpoint/mods-config/attr_filter/post-proxy"
key = "%{Realm}"
relaxed = no
}
# Loading module "attr_filter.pre-proxy" from file /etc/raddb-checkpoint/mods-enabled/attr_filter
attr_filter attr_filter.pre-proxy {
filename = "/etc/raddb-checkpoint/mods-config/attr_filter/pre-proxy"
key = "%{Realm}"
relaxed = no
}
# Loading module "attr_filter.access_reject" from file /etc/raddb-checkpoint/mods-enabled/attr_filter
attr_filter attr_filter.access_reject {
filename = "/etc/raddb-checkpoint/mods-config/attr_filter/access_reject"
key = "%{User-Name}"
relaxed = no
}
# Loading module "attr_filter.access_challenge" from file /etc/raddb-checkpoint/mods-enabled/attr_filter
attr_filter attr_filter.access_challenge {
filename = "/etc/raddb-checkpoint/mods-config/attr_filter/access_challenge"
key = "%{User-Name}"
relaxed = no
}
# Loading module "attr_filter.accounting_response" from file /etc/raddb-checkpoint/mods-enabled/attr_filter
attr_filter attr_filter.accounting_response {
filename = "/etc/raddb-checkpoint/mods-config/attr_filter/accounting_response"
key = "%{User-Name}"
relaxed = no
}
# Loaded module rlm_always
# Loading module "reject" from file /etc/raddb-checkpoint/mods-enabled/always
always reject {
rcode = "reject"
simulcount = 0
mpp = no
}
# Loading module "fail" from file /etc/raddb-checkpoint/mods-enabled/always
always fail {
rcode = "fail"
simulcount = 0
mpp = no
}
# Loading module "ok" from file /etc/raddb-checkpoint/mods-enabled/always
always ok {
rcode = "ok"
simulcount = 0
mpp = no
}
# Loading module "handled" from file /etc/raddb-checkpoint/mods-enabled/always
always handled {
rcode = "handled"
simulcount = 0
mpp = no
}
# Loading module "invalid" from file /etc/raddb-checkpoint/mods-enabled/always
always invalid {
rcode = "invalid"
simulcount = 0
mpp = no
}
# Loading module "userlock" from file /etc/raddb-checkpoint/mods-enabled/always
always userlock {
rcode = "userlock"
simulcount = 0
mpp = no
}
# Loading module "notfound" from file /etc/raddb-checkpoint/mods-enabled/always
always notfound {
rcode = "notfound"
simulcount = 0
mpp = no
}
# Loading module "noop" from file /etc/raddb-checkpoint/mods-enabled/always
always noop {
rcode = "noop"
simulcount = 0
mpp = no
}
# Loading module "updated" from file /etc/raddb-checkpoint/mods-enabled/always
always updated {
rcode = "updated"
simulcount = 0
mpp = no
}
# Loaded module rlm_krb5
# Loading module "krb5" from file /etc/raddb-checkpoint/mods-enabled/krb5
krb5 {
keytab = "/etc/raddb-checkpoint/radius_auth.keytab"
service_principal = "radius_auth"
}
instantiate {
}
# Instantiating module "IPASS" from file /etc/raddb-checkpoint/mods-enabled/realm
# Instantiating module "suffix" from file /etc/raddb-checkpoint/mods-enabled/realm
# Instantiating module "realmpercent" from file /etc/raddb-checkpoint/mods-enabled/realm
# Instantiating module "ntdomain" from file /etc/raddb-checkpoint/mods-enabled/realm
# Instantiating module "preprocess" from file /etc/raddb-checkpoint/mods-enabled/preprocess
reading pairlist file /etc/raddb-checkpoint/mods-config/preprocess/huntgroups
reading pairlist file /etc/raddb-checkpoint/mods-config/preprocess/hints
# Instantiating module "etc_passwd" from file /etc/raddb-checkpoint/mods-enabled/passwd
rlm_passwd: nfields: 3 keyfield 0(User-Name) listable: no
# Instantiating module "pap" from file /etc/raddb-checkpoint/mods-enabled/pap
# Instantiating module "mschap" from file /etc/raddb-checkpoint/mods-enabled/mschap
rlm_mschap (mschap): using internal authentication
# Instantiating module "logintime" from file /etc/raddb-checkpoint/mods-enabled/logintime
# Instantiating module "linelog" from file /etc/raddb-checkpoint/mods-enabled/linelog
# Instantiating module "log_accounting" from file /etc/raddb-checkpoint/mods-enabled/linelog
# Instantiating module "files" from file /etc/raddb-checkpoint/mods-enabled/files
reading pairlist file /etc/raddb-checkpoint/mods-config/files/authorize
reading pairlist file /etc/raddb-checkpoint/mods-config/files/authorize
reading pairlist file /etc/raddb-checkpoint/mods-config/files/accounting
reading pairlist file /etc/raddb-checkpoint/mods-config/files/pre-proxy
# Instantiating module "expiration" from file /etc/raddb-checkpoint/mods-enabled/expiration
# Instantiating module "eap" from file /etc/raddb-checkpoint/mods-enabled/eap
# Linked to sub-module rlm_eap_md5
# Linked to sub-module rlm_eap_leap
# Linked to sub-module rlm_eap_gtc
gtc {
challenge = "Password: "
auth_type = "PAP"
}
# Linked to sub-module rlm_eap_tls
tls {
tls = "tls-common"
}
tls-config tls-common {
verify_depth = 0
ca_path = "/etc/raddb-checkpoint/certs"
pem_file_type = yes
private_key_file = "/etc/raddb-checkpoint/certs/server.pem"
certificate_file = "/etc/raddb-checkpoint/certs/server.pem"
ca_file = "/etc/raddb-checkpoint/certs/ca.pem"
private_key_password = <<< secret >>>
dh_file = "/etc/raddb-checkpoint/certs/dh"
fragment_size = 1024
include_length = yes
auto_chain = yes
check_crl = no
check_all_crl = no
cipher_list = "DEFAULT"
cipher_server_preference = no
ecdh_curve = "prime256v1"
cache {
enable = no
lifetime = 24
max_entries = 255
}
verify {
skip_if_ocsp_ok = no
}
ocsp {
enable = no
override_cert_url = yes
url = "http://127.0.0.1/ocsp/"
use_nonce = yes
timeout = 0
softfail = no
}
}
# Linked to sub-module rlm_eap_ttls
ttls {
tls = "tls-common"
default_eap_type = "md5"
copy_request_to_tunnel = no
use_tunneled_reply = no
virtual_server = "inner-tunnel"
include_length = yes
require_client_cert = no
}
tls: Using cached TLS configuration from previous invocation
# Linked to sub-module rlm_eap_peap
peap {
tls = "tls-common"
default_eap_type = "mschapv2"
copy_request_to_tunnel = no
use_tunneled_reply = no
proxy_tunneled_request_as_eap = yes
virtual_server = "inner-tunnel"
soh = no
require_client_cert = no
}
tls: Using cached TLS configuration from previous invocation
# Linked to sub-module rlm_eap_mschapv2
mschapv2 {
with_ntdomain_hack = no
send_error = no
}
# Instantiating module "auth_log" from file /etc/raddb-checkpoint/mods-enabled/detail.log
rlm_detail (auth_log): 'User-Password' suppressed, will not appear in detail output
# Instantiating module "reply_log" from file /etc/raddb-checkpoint/mods-enabled/detail.log
# Instantiating module "pre_proxy_log" from file /etc/raddb-checkpoint/mods-enabled/detail.log
# Instantiating module "post_proxy_log" from file /etc/raddb-checkpoint/mods-enabled/detail.log
# Instantiating module "detail" from file /etc/raddb-checkpoint/mods-enabled/detail
# Instantiating module "cache_eap" from file /etc/raddb-checkpoint/mods-enabled/cache_eap
rlm_cache (cache_eap): Driver rlm_cache_rbtree (module rlm_cache_rbtree) loaded and linked
# Instantiating module "attr_filter.post-proxy" from file /etc/raddb-checkpoint/mods-enabled/attr_filter
reading pairlist file /etc/raddb-checkpoint/mods-config/attr_filter/post-proxy
# Instantiating module "attr_filter.pre-proxy" from file /etc/raddb-checkpoint/mods-enabled/attr_filter
reading pairlist file /etc/raddb-checkpoint/mods-config/attr_filter/pre-proxy
# Instantiating module "attr_filter.access_reject" from file /etc/raddb-checkpoint/mods-enabled/attr_filter
reading pairlist file /etc/raddb-checkpoint/mods-config/attr_filter/access_reject
[/etc/raddb-checkpoint/mods-config/attr_filter/access_reject]:11 Check item "FreeRADIUS-Response-Delay" found in filter list for realm "DEFAULT".
[/etc/raddb-checkpoint/mods-config/attr_filter/access_reject]:11 Check item "FreeRADIUS-Response-Delay-USec" found in filter list for realm "DEFAULT".
# Instantiating module "attr_filter.access_challenge" from file /etc/raddb-checkpoint/mods-enabled/attr_filter
reading pairlist file /etc/raddb-checkpoint/mods-config/attr_filter/access_challenge
# Instantiating module "attr_filter.accounting_response" from file /etc/raddb-checkpoint/mods-enabled/attr_filter
reading pairlist file /etc/raddb-checkpoint/mods-config/attr_filter/accounting_response
# Instantiating module "reject" from file /etc/raddb-checkpoint/mods-enabled/always
# Instantiating module "fail" from file /etc/raddb-checkpoint/mods-enabled/always
# Instantiating module "ok" from file /etc/raddb-checkpoint/mods-enabled/always
# Instantiating module "handled" from file /etc/raddb-checkpoint/mods-enabled/always
# Instantiating module "invalid" from file /etc/raddb-checkpoint/mods-enabled/always
# Instantiating module "userlock" from file /etc/raddb-checkpoint/mods-enabled/always
# Instantiating module "notfound" from file /etc/raddb-checkpoint/mods-enabled/always
# Instantiating module "noop" from file /etc/raddb-checkpoint/mods-enabled/always
# Instantiating module "updated" from file /etc/raddb-checkpoint/mods-enabled/always
# Instantiating module "krb5" from file /etc/raddb-checkpoint/mods-enabled/krb5
Using MIT Kerberos library
rlm_krb5 (krb5): Using service principal "radius_auth/radiusawsw@"
rlm_krb5 (krb5): Using keytab "FILE:/etc/raddb-checkpoint/radius_auth.keytab"
rlm_krb5 (krb5): Initialising connection pool
pool {
start = 5
min = 3
max = 32
spare = 10
uses = 0
lifetime = 0
cleanup_interval = 30
idle_timeout = 0
retry_delay = 1
spread = no
}
rlm_krb5 (krb5): Opening additional connection (0), 1 of 32 pending slots used
rlm_krb5 (krb5): Opening additional connection (1), 1 of 31 pending slots used
rlm_krb5 (krb5): Opening additional connection (2), 1 of 30 pending slots used
rlm_krb5 (krb5): Opening additional connection (3), 1 of 29 pending slots used
rlm_krb5 (krb5): Opening additional connection (4), 1 of 28 pending slots used
} # modules
radiusd: #### Loading Virtual Servers ####
server { # from file /etc/raddb-checkpoint/radiusd.conf
} # server
server inner-tunnel { # from file /etc/raddb-checkpoint/sites-enabled/inner-tunnel
# Loading authenticate {...}
# Loading authorize {...}
Ignoring "sql" (see raddb/mods-available/README.rst)
Ignoring "ldap" (see raddb/mods-available/README.rst)
# Loading session {...}
# Loading post-proxy {...}
# Loading post-auth {...}
# Skipping contents of 'if' as it is always 'false' -- /etc/raddb-checkpoint/sites-enabled/inner-tunnel:338
} # server inner-tunnel
server default { # from file /etc/raddb-checkpoint/sites-enabled/default
# Loading authenticate {...}
# Loading authorize {...}
# Loading preacct {...}
# Loading accounting {...}
# Loading post-proxy {...}
# Loading post-auth {...}
} # server default
radiusd: #### Opening IP addresses and Ports ####
Listening on auth address 10.120.3.175 port 1645
Listening on acct address 10.120.3.175 port 1646
Listening on proxy address * port 59986
Ready to process requests
(0) Received Access-Request Id 6 from 129.219.12.155:44940 to 10.120.3.175:1645 length 50
(0) User-Name = "User"
(0) User-Password = "Pwd"
(0) NAS-IP-Address = 129.219.12.155
(0) ERROR: No Auth-Type found: rejecting the user via Post-Auth-Type = Reject
(0) Failed to authenticate the user
(0) Using Post-Auth-Type Reject
(0) Post-Auth-Type sub-section not found. Ignoring.
(0) Delaying response for 1.000000 seconds
Waking up in 0.3 seconds.
Waking up in 0.6 seconds.
(0) Sending delayed response
(0) Sent Access-Reject Id 6 from 10.120.3.175:1645 to 129.219.12.155:44940 length 20
Waking up in 3.9 seconds.
(0) Cleaning up request packet ID 6 with timestamp +120
Ready to process requests
2
1
Hi,
I am trying to return a Cisco vendor specific attribute from a python module by adding it to the reply tuple as:
(Attr-26, '0x00000009010f54657374417474726962757465')
But I am getting the following error in the logs:
Debug: authenticate - Failed: 'reply:Attr-26' '0x00000009010f54657374417474726962757465'
Any ideas, how I can add VSA to the reply tuple from the python module?
Thanks and Regards
Najam
________________________________
This message and any attachments are intended solely for the addressees and may contain confidential information. Any unauthorized use or disclosure, either whole or partial, is prohibited.
E-mails are susceptible to alteration. Our company shall not be liable for the message if altered, changed or falsified. If you are not the intended recipient of this message, please delete it and notify the sender.
Although all reasonable efforts have been made to keep this transmission free from viruses, the sender will not be liable for damages caused by a transmitted virus.
2
3
Hi ,
Is it possible to log user auth where the request got rejected because
of eap session timeout using linelog?
TIA
Arnab
2
3
Same offer here. Initial thought is handling of some attribute. Best thing
to do is ensure you're calling attribute filter for all packets destined to
NPS to strip them down to bare essentials (ie the minimum EAP contents for
NPS to do its job with no other attrs present). I assume you're sending the
EAP onward to NPS and not terminating EAP on FR and only sending inner Auth
to NPS?
alan
On 18 Aug 2017 12:37 am, "John Horne" <john.horne(a)plymouth.ac.uk> wrote:
Hello,
We have 2 CentOS 7 servers which act solely as RADIUS proxy servers using
PEAP.
They proxy to backend Microsoft NPS servers. The servers proxy local
(wireless)
users (to NPS), visiting eduroam users (to NRPS) and our own (eduroam) users
(to NPS) who are visting external sites. The eduroam users are proxied
to/from
the UK national proxy servers (NRPS). Both local radius servers ran the
freeradius 3.0.4 CentOS package. This all worked well.
However, I have updated freeradius to 3.0.15 (locally built RPM) on one of
the
servers. Whilst the local and visiting eduroam users are authenticating
correctly, the majority of our own eduroam users authenticating to us via
the
NRPS servers now fail. The radius log shows (for example):
==========
Thu Aug 17 23:16:20 2017 : ERROR: (7299) ERROR: Failing proxied request for
user "abc(a)students.plymouth.ac.uk", due to lack of any response from home
server 141.163.xxx.yyy port 1812
Thu Aug 17 23:16:20 2017 : Auth: (7299) Login incorrect (Home Server failed
to
respond): [abc(a)students.plymouth.ac.uk] (from client NRPS-0 port 13 cli
FC-FC-
48-FF-AA-DD) SSID: eduroam
Thu Aug 17 23:16:20 2017 : Auth: (7299) Login incorrect (Failing proxied
request for user "abc(a)students.plymouth.ac.uk", due to lack of any response
from home server 141.163.xxx.yyy port 1812): [abc(a)students.plymouth.ac.uk]
(from client NRPS-0 port 13 cli FC-FC-48-DD-AA-DD) SSID: eduroam
==========
For the NRPS clients this occurs nearly 100% of the time. For some reason an
occassional user will authenticate successfully. I have captured the debug
output for a user who authenticated successfully on the 3.0.4 server, but
then
failed to authenticate on the 3.0.15 server. Although the last packet sent
seemed acceptable, with no reply from the MS NPS server it is difficult to
know
what happened next.
A little googling seemed to indicate that MS NPS is known for just dropping
packets rather than rejecting them or even logging them. I asked the
sysadmin
of the NPS servers if the logs showed anything, but he said not. The servers
themselves were not under any particular load, so that was not a reason to
drop
the packets.
Although the freeradius config files have had to be modified a little bit
due
to differences between 3.0.4 and 3.0.15, they are basically the same.
I tried downgrading to an RHEL 7 beta RPM of freeradius 3.0.13, but we got
the
same timeout problem. I have now gone back to 3.0.4, and the problem has
gone.
I am a bit stumped with this. My first thought was that we had changed
something to cause the MS NPS servers to drop the packets. Filtering seemed
possible as I gather if NPS is sent a packet with unrecognised radius
attributes then it is likely to drop it. However, the filtering is the same
between 3.0.4 and 3.0.15. I have also gone through the changelog from 3.0.5
to
3.0.15, but could not find anything obvious (to me) that might explain this.
My thoughts are that perhaps some core part of freeradius has been modified
such that it is now causing NPS (for us) a problem. We could start to work
through the versions from 3.0.5 upwards to see at what version we hit the
problem, and then look further at the commits for that version.
However, before that I thought I would ask here if anyone has any thoughts
about this? Has anyone had a similar problem?
Thanks,
John.
--
John Horne | Senior Operations Analyst | Technology and Information Services
University of Plymouth | Drake Circus | Plymouth | Devon | PL4 8AA | UK
________________________________
[http://www.plymouth.ac.uk/images/email_footer.gif]<http:
//www.plymouth.ac.uk/worldclass>
This email and any files with it are confidential and intended solely for
the use of the recipient to whom it is addressed. If you are not the
intended recipient then copying, distribution or other use of the
information contained is strictly prohibited and you should not rely on it.
If you have received this email in error please let the sender know
immediately and delete it from your system(s). Internet emails are not
necessarily secure. While we take every care, Plymouth University accepts
no responsibility for viruses and it is your responsibility to scan emails
and their attachments. Plymouth University does not accept responsibility
for any changes made after it was sent. Nothing in this email or its
attachments constitutes an order for goods or services unless accompanied
by an official order form.
-
List info/subscribe/unsubscribe? See http://www.freeradius.org/
list/users.html
4
4
Forgive me if this is an obvious thing...I've been looking at the
documentation and it just isn't clicking for me. I need to send the
Framed-IP-Address and the Service-Type attributes in the Access-Reply. In
my post-auth section of my default file I've added update reply {
Service-Type = "Framed-User" }. How do I specify the Framed-IP-Address?
This value will be returned from a SQL query, if there is no value default
to 255.255.255.254.
2
1
Hi All,
I'm running Ubuntu 16.04 LTS, Samba 4.3.11 and Freeradius 3.0.15.
I'm having trouble using mschap when authenticating against my AD using
ntlm_auth. Testing with wbinfo or ntlm_auth from the command line works.
Running NTLM_AUTH trough freeradius (configured by myself, which just
calls ntlm_auth staight), works fine:
radtest dirk MyPaSsWord localhost 0 testing123
Ouput:
(2) Found Auth-Type = NTLM_AUTH
(2) # Executing group from file /etc/freeradius/sites-enabled/default
(2) Auth-Type NTLM_AUTH {
(2) ntlm_auth: Executing: /usr/bin/ntlm_auth --request-nt-key
--domain=PROACTIVE --username=%{mschap:User-Name}
--password=%{User-Password}:
(2) ntlm_auth: EXPAND --username=%{mschap:User-Name}
(2) ntlm_auth: --> --username=dirk
(2) ntlm_auth: EXPAND --password=%{User-Password}
(2) ntlm_auth: --> --password=MyPaSsWord
(2) ntlm_auth: Program returned code (0) and output 'NT_STATUS_OK:
Success (0x0)'
(2) ntlm_auth: Program executed successfully
(2) [ntlm_auth] = ok
(2) } # Auth-Type NTLM_AUTH = ok
But when running:
radtest -t mschap dirk MyPaSsWord localhost 0 testing123
I get:
(0) Found Auth-Type = mschap
(0) # Executing group from file /etc/freeradius/sites-enabled/default
(0) authenticate {
(0) mschap: Client is using MS-CHAPv1 with NT-Password
(0) mschap: Executing: /usr/bin/ntlm_auth --request-nt-key
--domain=PROACTIVE --username=%{mschap:User-Name}
--challenge=%{%{mschap:Challenge}:-00}
--nt-response=%{%{mschap:NT-Response}:-00}:
(0) mschap: EXPAND --username=%{mschap:User-Name}
(0) mschap: --> --username=dirk
(0) mschap: mschap1: a2
(0) mschap: EXPAND --challenge=%{%{mschap:Challenge}:-00}
(0) mschap: --> --challenge=a2ecd01e5bdf0ef6
(0) mschap: EXPAND --nt-response=%{%{mschap:NT-Response}:-00}
(0) mschap: -->
--nt-response=28c30e8ce6d1a2ecd6877be94a654d6336afa03527aace03
(0) mschap: ERROR: Program returned code (1) and output 'Logon failure
(0xc000006d)'
(0) mschap: External script failed
(0) mschap: ERROR: External script says: Logon failure (0xc000006d)
(0) mschap: ERROR: MS-CHAP2-Response is incorrect
(0) [mschap] = reject
I'm really puzzled here... I had this working on an Ubuntu 12.04 /
freeradius 2.x setup, but I'm really stuck now.
Any help or hints are highly appreciated. Thank you in advance, kind
regards,
Dirk
2
3
Hi everyone,
I already success create 802.1x wireless authentication using freeradius
and ldap, i did a test to every device that i have (iphone and laptop
running windows 10 can connect to 802.1x wireless) but when i try to
conenct on laptop running windows 7 there's "TLS Alert read:fatal:unknown
CA" error. I already re-create the root CA (i did this following
documentation
http://deployingradius.com/documents/configuration/certificates.html)
import it to the client, and ensure every detail of the certificate. Is
there any bug with windows 7 or something? any kind of help would be
appreciated. Thankyou (ca.cnf and server.cnf attached)
Radius log :
(0) Received Access-Request Id 60 from 172.30.254.3:49431 to
172.29.164.218:1812 length 267
(0) User-Name = "gpler"
(0) Chargeable-User-Identity = 0x03
(0) Location-Capable = Civix-Location
(0) Calling-Station-Id = "6c-71-d9-a9-5e-65"
(0) Called-Station-Id = "58-ac-78-ee-8a-20:802.1x"
(0) NAS-Port = 1
(0) Cisco-AVPair = "audit-session-id=03fe1eac0003fe3fa18e9759"
(0) Acct-Session-Id = "59978ea1/6c:71:d9:a9:5e:65/71057"
(0) NAS-IP-Address = 172.30.xxx.x
(0) NAS-Identifier = "IPB-WLC-5520"
(0) Airespace-Wlan-Id = 69
(0) Service-Type = Framed-User
(0) Framed-MTU = 1300
(0) NAS-Port-Type = Wireless-802.11
(0) Tunnel-Type:0 = VLAN
(0) Tunnel-Medium-Type:0 = IEEE-802
(0) Tunnel-Private-Group-Id:0 = "255"
(0) EAP-Message = 0x0202000a0167706c6572
(0) Message-Authenticator = 0x107b01b20e515d3a076209dea9af2966
(0) # Executing section authorize from file
/etc/freeradius/3.0/sites-enabled/default
(0) authorize {
(0) policy filter_username {
(0) if (&User-Name) {
(0) if (&User-Name) -> TRUE
(0) if (&User-Name) {
(0) if (&User-Name =~ /@[^@]*@/ ) {
(0) if (&User-Name =~ /@[^@]*@/ ) -> FALSE
(0) if (&User-Name =~ /\.\./ ) {
(0) if (&User-Name =~ /\.\./ ) -> FALSE
(0) if ((&User-Name =~ /@/) && (&User-Name !~ /(a)(.+)\.(.+)$/)) {
(0) if ((&User-Name =~ /@/) && (&User-Name !~ /(a)(.+)\.(.+)$/)) ->
FALSE
(0) if (&User-Name =~ /\.$/) {
(0) if (&User-Name =~ /\.$/) -> FALSE
(0) if (&User-Name =~ /(a)\./) {
(0) if (&User-Name =~ /(a)\./) -> FALSE
(0) } # if (&User-Name) = notfound
(0) } # policy filter_username = notfound
(0) [preprocess] = ok
(0) [chap] = noop
(0) [mschap] = noop
(0) [digest] = noop
(0) suffix: Checking for suffix after "@"
(0) suffix: No '@' in User-Name = "gpler", looking up realm NULL
(0) suffix: No such realm "NULL"
(0) [suffix] = noop
(0) eap: Peer sent EAP Response (code 2) ID 2 length 10
(0) eap: EAP-Identity reply, returning 'ok' so we can short-circuit the
rest of authorize
(0) [eap] = ok
(0) } # authorize = ok
(0) Found Auth-Type = eap
(0) # Executing group from file /etc/freeradius/3.0/sites-enabled/default
(0) authenticate {
(0) eap: Peer sent packet with method EAP Identity (1)
(0) eap: Calling submodule eap_peap to process data
(0) eap_peap: Initiating new EAP-TLS session
(0) eap_peap: [eaptls start] = request
(0) eap: Sending EAP Request (code 1) ID 3 length 6
(0) eap: EAP session adding &reply:State = 0x68d16d7c68d27498
(0) [eap] = handled
(0) } # authenticate = handled
(0) Using Post-Auth-Type Challenge
(0) Post-Auth-Type sub-section not found. Ignoring.
(0) # Executing group from file /etc/freeradius/3.0/sites-enabled/default
(0) Sent Access-Challenge Id 60 from 172.29.164.218:1812 to
172.30.xxx.x:49431 length 0
(0) EAP-Message = 0x010300061920
(0) Message-Authenticator = 0x00000000000000000000000000000000
(0) State = 0x68d16d7c68d27498a8bfbed341c368c9
(0) Finished request
Waking up in 4.9 seconds.
(1) Received Access-Request Id 61 from 172.30.254.3:49431 to
172.29.164.218:1812 length 380
(1) User-Name = "gpler"
(1) Chargeable-User-Identity = 0x03
(1) Location-Capable = Civix-Location
(1) Calling-Station-Id = "6c-71-d9-a9-5e-65"
(1) Called-Station-Id = "58-ac-78-ee-8a-20:802.1x"
(1) NAS-Port = 1
(1) Cisco-AVPair = "audit-session-id=03fe1eac0003fe3fa18e9759"
(1) Acct-Session-Id = "59978ea1/6c:71:d9:a9:5e:65/71057"
(1) NAS-IP-Address = 172.30.xxx.x
(1) NAS-Identifier = "IPB-WLC-5520"
(1) Airespace-Wlan-Id = 69
(1) Service-Type = Framed-User
(1) Framed-MTU = 1300
(1) NAS-Port-Type = Wireless-802.11
(1) Tunnel-Type:0 = VLAN
(1) Tunnel-Medium-Type:0 = IEEE-802
(1) Tunnel-Private-Group-Id:0 = "255"
(1) EAP-Message =
0x0203006919800000005f160301005a01000056030159978e892bc0cea1314b3076e48c1432d22b3a1f575d2bd9ef5eadcd1efab780000018002f00350005000ac013c014c009c00a003200380013000401000015ff01000100000a0006000400170018000b00020100
(1) State = 0x68d16d7c68d27498a8bfbed341c368c9
(1) Message-Authenticator = 0x9e55b07936045ad7e26084813251454b
(1) session-state: No cached attributes
(1) # Executing section authorize from file
/etc/freeradius/3.0/sites-enabled/default
(1) authorize {
(1) policy filter_username {
(1) if (&User-Name) {
(1) if (&User-Name) -> TRUE
(1) if (&User-Name) {
(1) if (&User-Name =~ /@[^@]*@/ ) {
(1) if (&User-Name =~ /@[^@]*@/ ) -> FALSE
(1) if (&User-Name =~ /\.\./ ) {
(1) if (&User-Name =~ /\.\./ ) -> FALSE
(1) if ((&User-Name =~ /@/) && (&User-Name !~ /(a)(.+)\.(.+)$/)) {
(1) if ((&User-Name =~ /@/) && (&User-Name !~ /(a)(.+)\.(.+)$/)) ->
FALSE
(1) if (&User-Name =~ /\.$/) {
(1) if (&User-Name =~ /\.$/) -> FALSE
(1) if (&User-Name =~ /(a)\./) {
(1) if (&User-Name =~ /(a)\./) -> FALSE
(1) } # if (&User-Name) = notfound
(1) } # policy filter_username = notfound
(1) [preprocess] = ok
(1) [chap] = noop
(1) [mschap] = noop
(1) [digest] = noop
(1) suffix: Checking for suffix after "@"
(1) suffix: No '@' in User-Name = "gpler", looking up realm NULL
(1) suffix: No such realm "NULL"
(1) [suffix] = noop
(1) eap: Peer sent EAP Response (code 2) ID 3 length 105
(1) eap: Continuing tunnel setup
(1) [eap] = ok
(1) } # authorize = ok
(1) Found Auth-Type = eap
(1) # Executing group from file /etc/freeradius/3.0/sites-enabled/default
(1) authenticate {
(1) eap: Expiring EAP session with state 0x68d16d7c68d27498
(1) eap: Finished EAP session with state 0x68d16d7c68d27498
(1) eap: Previous EAP request found for state 0x68d16d7c68d27498, released
from the list
(1) eap: Peer sent packet with method EAP PEAP (25)
(1) eap: Calling submodule eap_peap to process data
(1) eap_peap: Continuing EAP-TLS
(1) eap_peap: Peer indicated complete TLS record size will be 95 bytes
(1) eap_peap: Got complete TLS record (95 bytes)
(1) eap_peap: [eaptls verify] = length included
(1) eap_peap: (other): before/accept initialization
(1) eap_peap: TLS_accept: before/accept initialization
(1) eap_peap: <<< recv TLS 1.0 Handshake [length 005a], ClientHello
(1) eap_peap: TLS_accept: unknown state
(1) eap_peap: >>> send TLS 1.0 Handshake [length 0031], ServerHello
(1) eap_peap: TLS_accept: unknown state
(1) eap_peap: >>> send TLS 1.0 Handshake [length 02c0], Certificate
(1) eap_peap: TLS_accept: unknown state
(1) eap_peap: >>> send TLS 1.0 Handshake [length 0004], ServerHelloDone
(1) eap_peap: TLS_accept: unknown state
(1) eap_peap: TLS_accept: unknown state
(1) eap_peap: TLS_accept: unknown state
(1) eap_peap: TLS_accept: Need to read more data: unknown state
(1) eap_peap: TLS_accept: Need to read more data: unknown state
(1) eap_peap: In SSL Handshake Phase
(1) eap_peap: In SSL Accept mode
(1) eap_peap: [eaptls process] = handled
(1) eap: Sending EAP Request (code 1) ID 4 length 778
(1) eap: EAP session adding &reply:State = 0x68d16d7c69d57498
(1) [eap] = handled
(1) } # authenticate = handled
(1) Using Post-Auth-Type Challenge
(1) Post-Auth-Type sub-section not found. Ignoring.
(1) # Executing group from file /etc/freeradius/3.0/sites-enabled/default
(1) Sent Access-Challenge Id 61 from 172.29.164.218:1812 to
172.30.xxx.x:49431 length 0
(1) EAP-Message =
0x0104030a190016030100310200002d03016e22346727c2b7bfd58d3b5bd06acbc17fa96d02f7937abfe946a411c305079800002f000005ff0100010016030102c00b0002bc0002b90002b6308202b23082019aa003020102020900e889295aaea3149d300d06092a864886f70d01010b05003011310f30
(1) Message-Authenticator = 0x00000000000000000000000000000000
(1) State = 0x68d16d7c69d57498a8bfbed341c368c9
(1) Finished request
Waking up in 4.9 seconds.
(2) Received Access-Request Id 62 from 172.30.xxx.x:49431 to
172.29.164.218:1812 length 292
(2) User-Name = "gpler"
(2) Chargeable-User-Identity = 0x03
(2) Location-Capable = Civix-Location
(2) Calling-Station-Id = "6c-71-d9-a9-5e-65"
(2) Called-Station-Id = "58-ac-78-ee-8a-20:802.1x"
(2) NAS-Port = 1
(2) Cisco-AVPair = "audit-session-id=03fe1eac0003fe3fa18e9759"
(2) Acct-Session-Id = "59978ea1/6c:71:d9:a9:5e:65/71057"
(2) NAS-IP-Address = 172.30.xxx.x
(2) NAS-Identifier = "IPB-WLC-5520"
(2) Airespace-Wlan-Id = 69
(2) Service-Type = Framed-User
(2) Framed-MTU = 1300
(2) NAS-Port-Type = Wireless-802.11
(2) Tunnel-Type:0 = VLAN
(2) Tunnel-Medium-Type:0 = IEEE-802
(2) Tunnel-Private-Group-Id:0 = "255"
(2) EAP-Message = 0x0204001119800000000715030100020230
(2) State = 0x68d16d7c69d57498a8bfbed341c368c9
(2) Message-Authenticator = 0xfd97ab9dc41ef3ae771c43ad2daa9331
(2) session-state: No cached attributes
(2) # Executing section authorize from file
/etc/freeradius/3.0/sites-enabled/default
(2) authorize {
(2) policy filter_username {
(2) if (&User-Name) {
(2) if (&User-Name) -> TRUE
(2) if (&User-Name) {
(2) if (&User-Name =~ /@[^@]*@/ ) {
(2) if (&User-Name =~ /@[^@]*@/ ) -> FALSE
(2) if (&User-Name =~ /\.\./ ) {
(2) if (&User-Name =~ /\.\./ ) -> FALSE
(2) if ((&User-Name =~ /@/) && (&User-Name !~ /(a)(.+)\.(.+)$/)) {
(2) if ((&User-Name =~ /@/) && (&User-Name !~ /(a)(.+)\.(.+)$/)) ->
FALSE
(2) if (&User-Name =~ /\.$/) {
(2) if (&User-Name =~ /\.$/) -> FALSE
(2) if (&User-Name =~ /(a)\./) {
(2) if (&User-Name =~ /(a)\./) -> FALSE
(2) } # if (&User-Name) = notfound
(2) } # policy filter_username = notfound
(2) [preprocess] = ok
(2) [chap] = noop
(2) [mschap] = noop
(2) [digest] = noop
(2) suffix: Checking for suffix after "@"
(2) suffix: No '@' in User-Name = "gpler", looking up realm NULL
(2) suffix: No such realm "NULL"
(2) [suffix] = noop
(2) eap: Peer sent EAP Response (code 2) ID 4 length 17
(2) eap: Continuing tunnel setup
(2) [eap] = ok
(2) } # authorize = ok
(2) Found Auth-Type = eap
(2) # Executing group from file /etc/freeradius/3.0/sites-enabled/default
(2) authenticate {
(2) eap: Expiring EAP session with state 0x68d16d7c69d57498
(2) eap: Finished EAP session with state 0x68d16d7c69d57498
(2) eap: Previous EAP request found for state 0x68d16d7c69d57498, released
from the list
(2) eap: Peer sent packet with method EAP PEAP (25)
(2) eap: Calling submodule eap_peap to process data
(2) eap_peap: Continuing EAP-TLS
(2) eap_peap: Peer indicated complete TLS record size will be 7 bytes
(2) eap_peap: Got complete TLS record (7 bytes)
(2) eap_peap: [eaptls verify] = length included
(2) eap_peap: <<< recv TLS 1.0 Alert [length 0002], fatal unknown_ca
*(2) eap_peap: ERROR: TLS Alert read:fatal:unknown CA*
*(2) eap_peap: ERROR: TLS_accept: Failed in unknown state*
*(2) eap_peap: ERROR: Failed in __FUNCTION__ (SSL_read)*
*(2) eap_peap: ERROR: error:14094418:SSL routines:ssl3_read_bytes:tlsv1
alert unknown ca*
*(2) eap_peap: ERROR: error:140940E5:SSL routines:ssl3_read_bytes:ssl
handshake failure*
*(2) eap_peap: ERROR: System call (I/O) error (-1)*
*(2) eap_peap: ERROR: TLS receive handshake failed during operation*
*(2) eap_peap: ERROR: [eaptls process] = fail*
*(2) eap: ERROR: Failed continuing EAP PEAP (25) session. EAP sub-module
failed*
(2) eap: Sending EAP Failure (code 4) ID 4 length 4
(2) eap: Failed in EAP select
(2) [eap] = invalid
(2) } # authenticate = invalid
(2) Failed to authenticate the user
(2) Using Post-Auth-Type Reject
(2) # Executing group from file /etc/freeradius/3.0/sites-enabled/default
(2) Post-Auth-Type REJECT {
(2) attr_filter.access_reject: EXPAND %{User-Name}
(2) attr_filter.access_reject: --> gpler
(2) attr_filter.access_reject: Matched entry DEFAULT at line 11
(2) [attr_filter.access_reject] = updated
(2) [eap] = noop
(2) policy remove_reply_message_if_eap {
(2) if (&reply:EAP-Message && &reply:Reply-Message) {
(2) if (&reply:EAP-Message && &reply:Reply-Message) -> FALSE
(2) else {
(2) [noop] = noop
(2) } # else = noop
(2) } # policy remove_reply_message_if_eap = noop
(2) } # Post-Auth-Type REJECT = updated
(2) Delaying response for 1.000000 seconds
Waking up in 0.3 seconds.
Waking up in 0.6 seconds.
(2) Sending delayed response
(2) Sent Access-Reject Id 62 from 172.29.164.218:1812 to 172.30.xxx.x:49431
length 44
(2) EAP-Message = 0x04040004
(2) Message-Authenticator = 0x00000000000000000000000000000000
Waking up in 3.9 seconds.
(0) Cleaning up request packet ID 60 with timestamp +628
(1) Cleaning up request packet ID 61 with timestamp +628
(2) Cleaning up request packet ID 62 with timestamp +628
5
7
Hi All,
I have set up a lab with 2 virtual boxes. One machine acts as freeRadius
server and openldap server(backend). The other as radius client.
I configured Radius server, modules for Ldap, openLdap server and
everything is fine. I tested authenticating user in openLDAP server which
also is good.
radtest to localhost from the server throws error.
*radius.log output:*
Sun Aug 20 13:31:25 2017 : Info: rlm_sql (sql): Connected new DB handle, #31
Sun Aug 20 13:31:25 2017 : Info: Loaded virtual server <default>
Sun Aug 20 13:31:25 2017 : Info: Loaded virtual server inner-tunnel
Sun Aug 20 13:31:25 2017 : Info: Ready to process requests.
Sun Aug 20 13:36:30 2017 : Error: [ldap] cn=Manager,dc=example,dc=com
bind to radserv.example.com:389 failed Server is unwilling to perform
Sun Aug 20 13:36:30 2017 : Error: [ldap] (re)connection attempt failed
Sun Aug 20 14:03:23 2017 : Error: [ldap] cn=Manager,dc=example,dc=com
bind to radserv.example.com:389 failed Server is unwilling to perform
Sun Aug 20 14:03:23 2017 : Error: [ldap] (re)connection attempt failed
[image: Inline image 1]
*Here is the radiusd output*
[root@radserv tmp]# radiusd -X
radiusd: FreeRADIUS Version 2.2.6, for host i386-redhat-linux-gnu, built on
Jul 18 2017 at 12:07:53
Copyright (C) 1999-2013 The FreeRADIUS server project and contributors.
There is NO warranty; not even for MERCHANTABILITY or FITNESS FOR A
PARTICULAR PURPOSE.
You may redistribute copies of FreeRADIUS under the terms of the
GNU General Public License.
For more information about these matters, see the file named COPYRIGHT.
Starting - reading configuration files ...
including configuration file /etc/raddb/radiusd.conf
including configuration file /etc/raddb/proxy.conf
including configuration file /etc/raddb/clients.conf
including files in directory /etc/raddb/modules/
including configuration file /etc/raddb/modules/cui
including configuration file /etc/raddb/modules/radutmp
including configuration file /etc/raddb/modules/dhcp_sqlippool
including configuration file /etc/raddb/modules/ldap
including configuration file /etc/raddb/modules/redis
including configuration file /etc/raddb/modules/sql_log
including configuration file /etc/raddb/modules/acct_unique
including configuration file /etc/raddb/modules/smsotp
including configuration file /etc/raddb/modules/detail.log
including configuration file /etc/raddb/modules/checkval
including configuration file /etc/raddb/modules/ippool
including configuration file /etc/raddb/modules/perl
including configuration file /etc/raddb/modules/chap
including configuration file /etc/raddb/modules/echo
including configuration file /etc/raddb/modules/pap
including configuration file /etc/raddb/modules/attr_filter
including configuration file /etc/raddb/modules/policy
including configuration file /etc/raddb/modules/linelog
including configuration file /etc/raddb/modules/mschap
including configuration file /etc/raddb/modules/unix
including configuration file /etc/raddb/modules/attr_rewrite
including configuration file /etc/raddb/modules/cache
including configuration file /etc/raddb/modules/expr
including configuration file /etc/raddb/modules/mac2vlan
including configuration file /etc/raddb/modules/files
including configuration file /etc/raddb/modules/opendirectory
including configuration file /etc/raddb/modules/smbpasswd
including configuration file /etc/raddb/modules/inner-eap
including configuration file /etc/raddb/modules/passwd
including configuration file /etc/raddb/modules/sqlcounter_expire_on_login
including configuration file /etc/raddb/modules/dynamic_clients
including configuration file /etc/raddb/modules/detail.example.com
including configuration file /etc/raddb/modules/rediswho
including configuration file /etc/raddb/modules/preprocess
including configuration file /etc/raddb/modules/logintime
including configuration file /etc/raddb/modules/realm
including configuration file /etc/raddb/modules/detail
including configuration file /etc/raddb/modules/sradutmp
including configuration file /etc/raddb/modules/expiration
including configuration file /etc/raddb/modules/mac2ip
including configuration file /etc/raddb/modules/ntlm_auth
including configuration file /etc/raddb/modules/wimax
including configuration file /etc/raddb/modules/replicate
including configuration file /etc/raddb/modules/exec
including configuration file /etc/raddb/modules/digest
including configuration file /etc/raddb/modules/soh
including configuration file /etc/raddb/modules/etc_group
including configuration file /etc/raddb/modules/otp
including configuration file /etc/raddb/modules/radrelay
including configuration file /etc/raddb/modules/always
including configuration file /etc/raddb/modules/pam
including configuration file /etc/raddb/modules/counter
including configuration file /etc/raddb/eap.conf
including configuration file /etc/raddb/sql.conf
including configuration file /etc/raddb/sql/mysql/dialup.conf
including configuration file /etc/raddb/policy.conf
including files in directory /etc/raddb/sites-enabled/
including configuration file /etc/raddb/sites-enabled/inner-tunnel
including configuration file /etc/raddb/sites-enabled/default
including configuration file /etc/raddb/sites-enabled/control-socket
main {
user = "radiusd"
group = "radiusd"
allow_core_dumps = no
}
including dictionary file /etc/raddb/dictionary
main {
name = "radiusd"
prefix = "/usr"
localstatedir = "/var"
sbindir = "/usr/sbin"
logdir = "/var/log/radius"
run_dir = "/var/run/radiusd"
libdir = "/usr/lib/freeradius"
radacctdir = "/var/log/radius/radacct"
hostname_lookups = no
max_request_time = 30
cleanup_delay = 5
max_requests = 1024
pidfile = "/var/run/radiusd/radiusd.pid"
checkrad = "/usr/sbin/checkrad"
debug_level = 0
proxy_requests = yes
log {
stripped_names = no
auth = no
auth_badpass = no
auth_goodpass = no
}
security {
max_attributes = 200
reject_delay = 1
status_server = yes
}
}
radiusd: #### Loading Realms and Home Servers ####
proxy server {
retry_delay = 5
retry_count = 3
default_fallback = no
dead_time = 120
wake_all_if_all_dead = no
}
home_server localhost {
ipaddr = 127.0.0.1
port = 1812
type = "auth"
secret = "testing123"
response_window = 20.000000
response_timeouts = 1
max_outstanding = 65536
require_message_authenticator = yes
zombie_period = 40
status_check = "status-server"
ping_interval = 30
check_interval = 30
num_answers_to_alive = 3
num_pings_to_alive = 3
revive_interval = 120
status_check_timeout = 4
coa {
irt = 2
mrt = 16
mrc = 5
mrd = 30
}
}
home_server_pool my_auth_failover {
type = fail-over
home_server = localhost
}
realm example.com {
auth_pool = my_auth_failover
}
realm LOCAL {
}
radiusd: #### Loading Clients ####
client localhost {
ipaddr = 127.0.0.1
require_message_authenticator = no
secret = "radsecret123"
nastype = "other"
}
client 192.168.126.129 {
ipaddr = 192.168.126.129
require_message_authenticator = no
secret = "othersecret123"
}
radiusd: #### Instantiating modules ####
instantiate {
Module: Linked to module rlm_exec
Module: Instantiating module "exec" from file /etc/raddb/modules/exec
exec {
wait = no
input_pairs = "request"
shell_escape = yes
timeout = 10
}
Module: Linked to module rlm_expr
Module: Instantiating module "expr" from file /etc/raddb/modules/expr
Module: Linked to module rlm_expiration
Module: Instantiating module "expiration" from file
/etc/raddb/modules/expiration
expiration {
reply-message = "Password Has Expired "
}
Module: Linked to module rlm_logintime
Module: Instantiating module "logintime" from file
/etc/raddb/modules/logintime
logintime {
reply-message = "You are calling outside your allowed timespan "
minimum-timeout = 60
}
}
radiusd: #### Loading Virtual Servers ####
server { # from file ?
modules {
Module: Creating Auth-Type = digest
Module: Creating Auth-Type = LDAP
Module: Creating Post-Auth-Type = REJECT
Module: Checking authenticate {...} for more modules to load
Module: Linked to module rlm_pap
Module: Instantiating module "pap" from file /etc/raddb/modules/pap
pap {
encryption_scheme = "auto"
auto_header = no
}
Module: Linked to module rlm_chap
Module: Instantiating module "chap" from file /etc/raddb/modules/chap
Module: Linked to module rlm_mschap
Module: Instantiating module "mschap" from file /etc/raddb/modules/mschap
mschap {
use_mppe = yes
require_encryption = no
require_strong = no
with_ntdomain_hack = no
allow_retry = yes
}
Module: Linked to module rlm_digest
Module: Instantiating module "digest" from file /etc/raddb/modules/digest
Module: Linked to module rlm_unix
Module: Instantiating module "unix" from file /etc/raddb/modules/unix
unix {
radwtmp = "/var/log/radius/radwtmp"
}
Module: Linked to module rlm_ldap
Module: Instantiating module "ldap" from file /etc/raddb/modules/ldap
ldap {
server = "radserv.example.com"
port = 389
password = ""
expect_password = yes
identity = "cn=Manager,dc=example,dc=com"
net_timeout = 1
timeout = 4
timelimit = 5
max_uses = 0
tls_mode = no
start_tls = no
tls_require_cert = "allow"
tls {
start_tls = no
require_cert = "allow"
}
basedn = "dc=example,dc=com"
filter = "(uid=%{%{Stripped-User-Name}:-%{User-Name}})"
base_filter = "(objectclass=radiusprofile)"
auto_header = no
access_attr_used_for_allow = yes
groupname_attribute = "cn"
groupmembership_filter =
"(|(&(objectClass=GroupOfNames)(member=%{Ldap-UserDn}))(&(objectClass=GroupOfUniqueNames)(uniquemember=%{Ldap-UserDn})))"
dictionary_mapping = "/etc/raddb/ldap.attrmap"
ldap_debug = 0
ldap_connections_number = 5
compare_check_items = no
do_xlat = yes
set_auth_type = yes
keepalive {
idle = 60
probes = 3
interval = 3
}
}
rlm_ldap: Registering ldap_groupcmp for Ldap-Group
rlm_ldap: Registering ldap_xlat with xlat_name ldap
rlm_ldap: reading ldap<->radius mappings from file /etc/raddb/ldap.attrmap
rlm_ldap: LDAP radiusCheckItem mapped to RADIUS $GENERIC$
rlm_ldap: LDAP radiusReplyItem mapped to RADIUS $GENERIC$
rlm_ldap: LDAP radiusAuthType mapped to RADIUS Auth-Type
rlm_ldap: LDAP radiusSimultaneousUse mapped to RADIUS Simultaneous-Use
rlm_ldap: LDAP radiusCalledStationId mapped to RADIUS Called-Station-Id
rlm_ldap: LDAP radiusCallingStationId mapped to RADIUS Calling-Station-Id
rlm_ldap: LDAP lmPassword mapped to RADIUS LM-Password
rlm_ldap: LDAP ntPassword mapped to RADIUS NT-Password
rlm_ldap: LDAP sambaLmPassword mapped to RADIUS LM-Password
rlm_ldap: LDAP sambaNtPassword mapped to RADIUS NT-Password
rlm_ldap: LDAP dBCSPwd mapped to RADIUS LM-Password
rlm_ldap: LDAP userPassword mapped to RADIUS Password-With-Header
rlm_ldap: LDAP acctFlags mapped to RADIUS SMB-Account-CTRL-TEXT
rlm_ldap: LDAP radiusExpiration mapped to RADIUS Expiration
rlm_ldap: LDAP radiusNASIpAddress mapped to RADIUS NAS-IP-Address
rlm_ldap: LDAP userPassword mapped to RADIUS User-Password
rlm_ldap: LDAP radiusServiceType mapped to RADIUS Service-Type
rlm_ldap: LDAP radiusFramedProtocol mapped to RADIUS Framed-Protocol
rlm_ldap: LDAP radiusFramedIPAddress mapped to RADIUS Framed-IP-Address
rlm_ldap: LDAP radiusFramedIPNetmask mapped to RADIUS Framed-IP-Netmask
rlm_ldap: LDAP radiusFramedRoute mapped to RADIUS Framed-Route
rlm_ldap: LDAP radiusFramedRouting mapped to RADIUS Framed-Routing
rlm_ldap: LDAP radiusFilterId mapped to RADIUS Filter-Id
rlm_ldap: LDAP radiusFramedMTU mapped to RADIUS Framed-MTU
rlm_ldap: LDAP radiusFramedCompression mapped to RADIUS Framed-Compression
rlm_ldap: LDAP radiusLoginIPHost mapped to RADIUS Login-IP-Host
rlm_ldap: LDAP radiusLoginService mapped to RADIUS Login-Service
rlm_ldap: LDAP radiusLoginTCPPort mapped to RADIUS Login-TCP-Port
rlm_ldap: LDAP radiusCallbackNumber mapped to RADIUS Callback-Number
rlm_ldap: LDAP radiusCallbackId mapped to RADIUS Callback-Id
rlm_ldap: LDAP radiusFramedIPXNetwork mapped to RADIUS Framed-IPX-Network
rlm_ldap: LDAP radiusClass mapped to RADIUS Class
rlm_ldap: LDAP radiusSessionTimeout mapped to RADIUS Session-Timeout
rlm_ldap: LDAP radiusIdleTimeout mapped to RADIUS Idle-Timeout
rlm_ldap: LDAP radiusTerminationAction mapped to RADIUS Termination-Action
rlm_ldap: LDAP radiusLoginLATService mapped to RADIUS Login-LAT-Service
rlm_ldap: LDAP radiusLoginLATNode mapped to RADIUS Login-LAT-Node
rlm_ldap: LDAP radiusLoginLATGroup mapped to RADIUS Login-LAT-Group
rlm_ldap: LDAP radiusFramedAppleTalkLink mapped to RADIUS
Framed-AppleTalk-Link
rlm_ldap: LDAP radiusFramedAppleTalkNetwork mapped to RADIUS
Framed-AppleTalk-Network
rlm_ldap: LDAP radiusFramedAppleTalkZone mapped to RADIUS
Framed-AppleTalk-Zone
rlm_ldap: LDAP radiusPortLimit mapped to RADIUS Port-Limit
rlm_ldap: LDAP radiusLoginLATPort mapped to RADIUS Login-LAT-Port
rlm_ldap: LDAP radiusReplyMessage mapped to RADIUS Reply-Message
rlm_ldap: LDAP radiusTunnelType mapped to RADIUS Tunnel-Type
rlm_ldap: LDAP radiusTunnelMediumType mapped to RADIUS Tunnel-Medium-Type
rlm_ldap: LDAP radiusTunnelPrivateGroupId mapped to RADIUS
Tunnel-Private-Group-Id
conns: 0x1693650
Module: Linked to module rlm_eap
Module: Instantiating module "eap" from file /etc/raddb/eap.conf
eap {
default_eap_type = "md5"
timer_expire = 60
ignore_unknown_eap_types = no
cisco_accounting_username_bug = no
max_sessions = 1024
}
Module: Linked to sub-module rlm_eap_md5
Module: Instantiating eap-md5
Module: Linked to sub-module rlm_eap_leap
Module: Instantiating eap-leap
Module: Linked to sub-module rlm_eap_gtc
Module: Instantiating eap-gtc
gtc {
challenge = "Password: "
auth_type = "PAP"
}
Module: Linked to sub-module rlm_eap_tls
Module: Instantiating eap-tls
tls {
rsa_key_exchange = no
dh_key_exchange = yes
rsa_key_length = 512
dh_key_length = 512
verify_depth = 0
CA_path = "/etc/raddb/certs"
pem_file_type = yes
private_key_file = "/etc/raddb/certs/server.pem"
certificate_file = "/etc/raddb/certs/server.pem"
CA_file = "/etc/raddb/certs/ca.pem"
private_key_password = "whatever"
dh_file = "/etc/raddb/certs/dh"
fragment_size = 1024
include_length = yes
check_crl = no
cipher_list = "DEFAULT"
ecdh_curve = "prime256v1"
cache {
enable = no
lifetime = 24
max_entries = 255
}
verify {
}
ocsp {
enable = no
override_cert_url = yes
url = "http://127.0.0.1/ocsp/"
use_nonce = yes
timeout = 0
softfail = no
}
}
Module: Linked to sub-module rlm_eap_ttls
Module: Instantiating eap-ttls
ttls {
default_eap_type = "md5"
copy_request_to_tunnel = no
use_tunneled_reply = no
virtual_server = "inner-tunnel"
include_length = yes
}
Module: Linked to sub-module rlm_eap_peap
Module: Instantiating eap-peap
peap {
default_eap_type = "mschapv2"
copy_request_to_tunnel = no
use_tunneled_reply = no
proxy_tunneled_request_as_eap = yes
virtual_server = "inner-tunnel"
soh = no
}
Module: Linked to sub-module rlm_eap_mschapv2
Module: Instantiating eap-mschapv2
mschapv2 {
with_ntdomain_hack = no
send_error = no
}
Module: Checking authorize {...} for more modules to load
Module: Linked to module rlm_preprocess
Module: Instantiating module "preprocess" from file
/etc/raddb/modules/preprocess
preprocess {
huntgroups = "/etc/raddb/huntgroups"
hints = "/etc/raddb/hints"
with_ascend_hack = no
ascend_channels_per_line = 23
with_ntdomain_hack = no
with_specialix_jetstream_hack = no
with_cisco_vsa_hack = no
with_alvarion_vsa_hack = no
}
reading pairlist file /etc/raddb/huntgroups
reading pairlist file /etc/raddb/hints
Module: Linked to module rlm_realm
Module: Instantiating module "suffix" from file /etc/raddb/modules/realm
realm suffix {
format = "suffix"
delimiter = "@"
ignore_default = no
ignore_null = no
}
Module: Linked to module rlm_files
Module: Instantiating module "files" from file /etc/raddb/modules/files
files {
usersfile = "/etc/raddb/users"
acctusersfile = "/etc/raddb/acct_users"
preproxy_usersfile = "/etc/raddb/preproxy_users"
compat = "no"
}
reading pairlist file /etc/raddb/users
reading pairlist file /etc/raddb/acct_users
reading pairlist file /etc/raddb/preproxy_users
Module: Checking preacct {...} for more modules to load
Module: Linked to module rlm_acct_unique
Module: Instantiating module "acct_unique" from file
/etc/raddb/modules/acct_unique
acct_unique {
key = "User-Name, Acct-Session-Id, NAS-IP-Address, NAS-Identifier,
NAS-Port"
}
Module: Checking accounting {...} for more modules to load
Module: Linked to module rlm_detail
Module: Instantiating module "detail" from file /etc/raddb/modules/detail
detail {
detailfile =
"/var/log/radius/radacct/%{%{Packet-Src-IP-Address}:-%{Packet-Src-IPv6-Address}}/detail-%Y%m%d"
header = "%t"
detailperm = 384
dirperm = 493
locking = no
log_packet_header = no
}
Module: Linked to module rlm_sql
Module: Instantiating module "sql" from file /etc/raddb/sql.conf
sql {
driver = "rlm_sql_mysql"
server = "localhost"
port = ""
login = "radius"
password = "radpass"
radius_db = "radius"
read_groups = yes
sqltrace = no
sqltracefile = "/var/log/radius/sqltrace.sql"
readclients = no
deletestalesessions = yes
num_sql_socks = 32
lifetime = 0
max_queries = 0
sql_user_name = "%{User-Name}"
default_user_profile = ""
nas_query = "SELECT id, nasname, shortname, type, secret, server FROM nas"
authorize_check_query = "SELECT id, username, attribute, value, op
FROM radcheck WHERE username = '%{SQL-User-Name}'
ORDER BY id"
authorize_reply_query = "SELECT id, username, attribute, value, op
FROM radreply WHERE username = '%{SQL-User-Name}'
ORDER BY id"
authorize_group_check_query = "SELECT id, groupname, attribute,
Value, op FROM radgroupcheck WHERE groupname =
'%{Sql-Group}' ORDER BY id"
authorize_group_reply_query = "SELECT id, groupname, attribute,
value, op FROM radgroupreply WHERE groupname =
'%{Sql-Group}' ORDER BY id"
accounting_onoff_query = " UPDATE radacct SET
acctstoptime = '%S', acctsessiontime =
unix_timestamp('%S') -
unix_timestamp(acctstarttime), acctterminatecause =
'%{Acct-Terminate-Cause}', acctstopdelay =
%{%{Acct-Delay-Time}:-0} WHERE acctstoptime IS NULL
AND nasipaddress = '%{NAS-IP-Address}' AND acctstarttime
<= '%S'"
accounting_update_query = " UPDATE radacct SET
framedipaddress = '%{Framed-IP-Address}',
acctsessiontime = '%{%{Acct-Session-Time}:-0}',
acctinputoctets = '%{%{Acct-Input-Gigawords}:-0}' << 32 |
'%{%{Acct-Input-Octets}:-0}',
acctoutputoctets = '%{%{Acct-Output-Gigawords}:-0}' << 32 |
'%{%{Acct-Output-Octets}:-0}' WHERE
acctsessionid = '%{Acct-Session-Id}' AND username =
'%{SQL-User-Name}' AND nasipaddress = '%{NAS-IP-Address}'"
accounting_update_query_alt = " INSERT INTO radacct
(acctsessionid, acctuniqueid, username, realm,
nasipaddress, nasportid, nasporttype,
acctstarttime, acctsessiontime, acctauthentic,
connectinfo_start, acctinputoctets, acctoutputoctets,
calledstationid, callingstationid, servicetype,
framedprotocol, framedipaddress, acctstartdelay,
xascendsessionsvrkey) VALUES ('%{Acct-Session-Id}',
'%{Acct-Unique-Session-Id}', '%{SQL-User-Name}',
'%{Realm}', '%{NAS-IP-Address}', '%{NAS-Port}',
'%{NAS-Port-Type}', DATE_SUB('%S',
INTERVAL (%{%{Acct-Session-Time}:-0} +
%{%{Acct-Delay-Time}:-0}) SECOND),
'%{%{Acct-Session-Time}:-0}', '%{Acct-Authentic}', '',
'%{%{Acct-Input-Gigawords}:-0}' << 32 |
'%{%{Acct-Input-Octets}:-0}',
'%{%{Acct-Output-Gigawords}:-0}' << 32 |
'%{%{Acct-Output-Octets}:-0}', '%{Called-Station-Id}',
'%{Calling-Station-Id}', '%{Service-Type}',
'%{Framed-Protocol}', '%{Framed-IP-Address}',
'0', '%{X-Ascend-Session-Svr-Key}')"
accounting_start_query = " INSERT INTO radacct
(acctsessionid, acctuniqueid, username, realm,
nasipaddress, nasportid, nasporttype,
acctstarttime, acctstoptime, acctsessiontime,
acctauthentic, connectinfo_start, connectinfo_stop,
acctinputoctets, acctoutputoctets, calledstationid,
callingstationid, acctterminatecause, servicetype,
framedprotocol, framedipaddress, acctstartdelay,
acctstopdelay, xascendsessionsvrkey) VALUES
('%{Acct-Session-Id}', '%{Acct-Unique-Session-Id}',
'%{SQL-User-Name}', '%{Realm}', '%{NAS-IP-Address}',
'%{NAS-Port}', '%{NAS-Port-Type}', '%S', NULL,
'0', '%{Acct-Authentic}', '%{Connect-Info}', '', '0', '0',
'%{Called-Station-Id}', '%{Calling-Station-Id}', '',
'%{Service-Type}', '%{Framed-Protocol}', '%{Framed-IP-Address}',
'%{%{Acct-Delay-Time}:-0}', '0', '%{X-Ascend-Session-Svr-Key}')"
accounting_start_query_alt = " UPDATE radacct SET
acctstarttime = '%S', acctstartdelay =
'%{%{Acct-Delay-Time}:-0}', connectinfo_start =
'%{Connect-Info}' WHERE acctsessionid = '%{Acct-Session-Id}'
AND username = '%{SQL-User-Name}' AND nasipaddress
= '%{NAS-IP-Address}'"
accounting_stop_query = " UPDATE radacct SET
acctstoptime = '%S', acctsessiontime =
'%{%{Acct-Session-Time}:-0}', acctinputoctets =
'%{%{Acct-Input-Gigawords}:-0}' << 32 |
'%{%{Acct-Input-Octets}:-0}', acctoutputoctets =
'%{%{Acct-Output-Gigawords}:-0}' << 32 |
'%{%{Acct-Output-Octets}:-0}', acctterminatecause =
'%{Acct-Terminate-Cause}', acctstopdelay =
'%{%{Acct-Delay-Time}:-0}', connectinfo_stop =
'%{Connect-Info}' WHERE acctsessionid = '%{Acct-Session-Id}'
AND username = '%{SQL-User-Name}' AND
nasipaddress = '%{NAS-IP-Address}'"
accounting_stop_query_alt = " INSERT INTO radacct
(acctsessionid, acctuniqueid, username, realm, nasipaddress,
nasportid, nasporttype, acctstarttime, acctstoptime,
acctsessiontime, acctauthentic, connectinfo_start,
connectinfo_stop, acctinputoctets, acctoutputoctets,
calledstationid, callingstationid, acctterminatecause,
servicetype, framedprotocol, framedipaddress, acctstartdelay,
acctstopdelay) VALUES ('%{Acct-Session-Id}',
'%{Acct-Unique-Session-Id}', '%{SQL-User-Name}',
'%{Realm}', '%{NAS-IP-Address}', '%{NAS-Port}',
'%{NAS-Port-Type}', DATE_SUB('%S', INTERVAL
(%{%{Acct-Session-Time}:-0} + %{%{Acct-Delay-Time}:-0})
SECOND), '%S', '%{%{Acct-Session-Time}:-0}',
'%{Acct-Authentic}', '', '%{Connect-Info}',
'%{%{Acct-Input-Gigawords}:-0}' << 32 |
'%{%{Acct-Input-Octets}:-0}',
'%{%{Acct-Output-Gigawords}:-0}' << 32 |
'%{%{Acct-Output-Octets}:-0}', '%{Called-Station-Id}',
'%{Calling-Station-Id}', '%{Acct-Terminate-Cause}',
'%{Service-Type}', '%{Framed-Protocol}', '%{Framed-IP-Address}',
'0', '%{%{Acct-Delay-Time}:-0}')"
group_membership_query = "SELECT groupname FROM radusergroup
WHERE username = '%{SQL-User-Name}' ORDER BY priority"
connect_failure_retry_delay = 60
simul_count_query = ""
simul_verify_query = "SELECT radacctid, acctsessionid, username,
nasipaddress, nasportid, framedipaddress,
callingstationid, framedprotocol
FROM radacct WHERE username =
'%{SQL-User-Name}' AND acctstoptime IS NULL"
postauth_query = "INSERT INTO radpostauth
(username, pass, reply, authdate) VALUES (
'%{User-Name}',
'%{%{User-Password}:-%{Chap-Password}}',
'%{reply:Packet-Type}', '%S')"
safe-characters =
"@abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ0123456789.-_: /"
}
rlm_sql (sql): Driver rlm_sql_mysql (module rlm_sql_mysql) loaded and linked
rlm_sql (sql): Attempting to connect to radius@localhost:/radius
rlm_sql (sql): starting 0
rlm_sql (sql): Attempting to connect rlm_sql_mysql #0
rlm_sql_mysql: Starting connect to MySQL server for #0
rlm_sql (sql): Connected new DB handle, #0
rlm_sql (sql): starting 1
rlm_sql (sql): Attempting to connect rlm_sql_mysql #1
rlm_sql_mysql: Starting connect to MySQL server for #1
rlm_sql (sql): Connected new DB handle, #1
rlm_sql (sql): starting 2
rlm_sql (sql): Attempting to connect rlm_sql_mysql #2
rlm_sql_mysql: Starting connect to MySQL server for #2
rlm_sql (sql): Connected new DB handle, #2
rlm_sql (sql): starting 3
rlm_sql (sql): Attempting to connect rlm_sql_mysql #3
rlm_sql_mysql: Starting connect to MySQL server for #3
rlm_sql (sql): Connected new DB handle, #3
rlm_sql (sql): starting 4
rlm_sql (sql): Attempting to connect rlm_sql_mysql #4
rlm_sql_mysql: Starting connect to MySQL server for #4
rlm_sql (sql): Connected new DB handle, #4
rlm_sql (sql): starting 5
rlm_sql (sql): Attempting to connect rlm_sql_mysql #5
rlm_sql_mysql: Starting connect to MySQL server for #5
rlm_sql (sql): Connected new DB handle, #5
rlm_sql (sql): starting 6
rlm_sql (sql): Attempting to connect rlm_sql_mysql #6
rlm_sql_mysql: Starting connect to MySQL server for #6
rlm_sql (sql): Connected new DB handle, #6
rlm_sql (sql): starting 7
rlm_sql (sql): Attempting to connect rlm_sql_mysql #7
rlm_sql_mysql: Starting connect to MySQL server for #7
rlm_sql (sql): Connected new DB handle, #7
rlm_sql (sql): starting 8
rlm_sql (sql): Attempting to connect rlm_sql_mysql #8
rlm_sql_mysql: Starting connect to MySQL server for #8
rlm_sql (sql): Connected new DB handle, #8
rlm_sql (sql): starting 9
rlm_sql (sql): Attempting to connect rlm_sql_mysql #9
rlm_sql_mysql: Starting connect to MySQL server for #9
rlm_sql (sql): Connected new DB handle, #9
rlm_sql (sql): starting 10
rlm_sql (sql): Attempting to connect rlm_sql_mysql #10
rlm_sql_mysql: Starting connect to MySQL server for #10
rlm_sql (sql): Connected new DB handle, #10
rlm_sql (sql): starting 11
rlm_sql (sql): Attempting to connect rlm_sql_mysql #11
rlm_sql_mysql: Starting connect to MySQL server for #11
rlm_sql (sql): Connected new DB handle, #11
rlm_sql (sql): starting 12
rlm_sql (sql): Attempting to connect rlm_sql_mysql #12
rlm_sql_mysql: Starting connect to MySQL server for #12
rlm_sql (sql): Connected new DB handle, #12
rlm_sql (sql): starting 13
rlm_sql (sql): Attempting to connect rlm_sql_mysql #13
rlm_sql_mysql: Starting connect to MySQL server for #13
rlm_sql (sql): Connected new DB handle, #13
rlm_sql (sql): starting 14
rlm_sql (sql): Attempting to connect rlm_sql_mysql #14
rlm_sql_mysql: Starting connect to MySQL server for #14
rlm_sql (sql): Connected new DB handle, #14
rlm_sql (sql): starting 15
rlm_sql (sql): Attempting to connect rlm_sql_mysql #15
rlm_sql_mysql: Starting connect to MySQL server for #15
rlm_sql (sql): Connected new DB handle, #15
rlm_sql (sql): starting 16
rlm_sql (sql): Attempting to connect rlm_sql_mysql #16
rlm_sql_mysql: Starting connect to MySQL server for #16
rlm_sql (sql): Connected new DB handle, #16
rlm_sql (sql): starting 17
rlm_sql (sql): Attempting to connect rlm_sql_mysql #17
rlm_sql_mysql: Starting connect to MySQL server for #17
rlm_sql (sql): Connected new DB handle, #17
rlm_sql (sql): starting 18
rlm_sql (sql): Attempting to connect rlm_sql_mysql #18
rlm_sql_mysql: Starting connect to MySQL server for #18
rlm_sql (sql): Connected new DB handle, #18
rlm_sql (sql): starting 19
rlm_sql (sql): Attempting to connect rlm_sql_mysql #19
rlm_sql_mysql: Starting connect to MySQL server for #19
rlm_sql (sql): Connected new DB handle, #19
rlm_sql (sql): starting 20
rlm_sql (sql): Attempting to connect rlm_sql_mysql #20
rlm_sql_mysql: Starting connect to MySQL server for #20
rlm_sql (sql): Connected new DB handle, #20
rlm_sql (sql): starting 21
rlm_sql (sql): Attempting to connect rlm_sql_mysql #21
rlm_sql_mysql: Starting connect to MySQL server for #21
rlm_sql (sql): Connected new DB handle, #21
rlm_sql (sql): starting 22
rlm_sql (sql): Attempting to connect rlm_sql_mysql #22
rlm_sql_mysql: Starting connect to MySQL server for #22
rlm_sql (sql): Connected new DB handle, #22
rlm_sql (sql): starting 23
rlm_sql (sql): Attempting to connect rlm_sql_mysql #23
rlm_sql_mysql: Starting connect to MySQL server for #23
rlm_sql (sql): Connected new DB handle, #23
rlm_sql (sql): starting 24
rlm_sql (sql): Attempting to connect rlm_sql_mysql #24
rlm_sql_mysql: Starting connect to MySQL server for #24
rlm_sql (sql): Connected new DB handle, #24
rlm_sql (sql): starting 25
rlm_sql (sql): Attempting to connect rlm_sql_mysql #25
rlm_sql_mysql: Starting connect to MySQL server for #25
rlm_sql (sql): Connected new DB handle, #25
rlm_sql (sql): starting 26
rlm_sql (sql): Attempting to connect rlm_sql_mysql #26
rlm_sql_mysql: Starting connect to MySQL server for #26
rlm_sql (sql): Connected new DB handle, #26
rlm_sql (sql): starting 27
rlm_sql (sql): Attempting to connect rlm_sql_mysql #27
rlm_sql_mysql: Starting connect to MySQL server for #27
rlm_sql (sql): Connected new DB handle, #27
rlm_sql (sql): starting 28
rlm_sql (sql): Attempting to connect rlm_sql_mysql #28
rlm_sql_mysql: Starting connect to MySQL server for #28
rlm_sql (sql): Connected new DB handle, #28
rlm_sql (sql): starting 29
rlm_sql (sql): Attempting to connect rlm_sql_mysql #29
rlm_sql_mysql: Starting connect to MySQL server for #29
rlm_sql (sql): Connected new DB handle, #29
rlm_sql (sql): starting 30
rlm_sql (sql): Attempting to connect rlm_sql_mysql #30
rlm_sql_mysql: Starting connect to MySQL server for #30
rlm_sql (sql): Connected new DB handle, #30
rlm_sql (sql): starting 31
rlm_sql (sql): Attempting to connect rlm_sql_mysql #31
rlm_sql_mysql: Starting connect to MySQL server for #31
rlm_sql (sql): Connected new DB handle, #31
Module: Linked to module rlm_attr_filter
Module: Instantiating module "attr_filter.accounting_response" from file
/etc/raddb/modules/attr_filter
attr_filter attr_filter.accounting_response {
attrsfile = "/etc/raddb/attrs.accounting_response"
key = "%{User-Name}"
relaxed = no
}
reading pairlist file /etc/raddb/attrs.accounting_response
Module: Checking session {...} for more modules to load
Module: Linked to module rlm_radutmp
Module: Instantiating module "radutmp" from file /etc/raddb/modules/radutmp
radutmp {
filename = "/var/log/radius/radutmp"
username = "%{User-Name}"
case_sensitive = yes
check_with_nas = yes
perm = 384
callerid = yes
}
Module: Checking post-proxy {...} for more modules to load
Module: Checking post-auth {...} for more modules to load
Module: Instantiating module "attr_filter.access_reject" from file
/etc/raddb/modules/attr_filter
attr_filter attr_filter.access_reject {
attrsfile = "/etc/raddb/attrs.access_reject"
key = "%{User-Name}"
relaxed = no
}
reading pairlist file /etc/raddb/attrs.access_reject
} # modules
} # server
server inner-tunnel { # from file /etc/raddb/sites-enabled/inner-tunnel
modules {
Module: Checking authenticate {...} for more modules to load
Module: Checking authorize {...} for more modules to load
Module: Checking session {...} for more modules to load
Module: Checking post-proxy {...} for more modules to load
Module: Checking post-auth {...} for more modules to load
} # modules
} # server
radiusd: #### Opening IP addresses and Ports ####
listen {
type = "auth"
ipaddr = *
port = 0
Failed binding to authentication address * port 1812: Address already in
use
/etc/raddb/radiusd.conf[273]: Error binding to port for 0.0.0.0 port 1812
[root@radserv tmp]#
*ldap module Configuration:*
[root@radserv modules]# cat ldap
# -*- text -*-
#
# $Id: d13892634e4a8458c942ce170f59f98521dce500 $
# Lightweight Directory Access Protocol (LDAP)
#
# This module definition allows you to use LDAP for
# authorization and authentication.
#
# See raddb/sites-available/default for reference to the
# ldap module in the authorize and authenticate sections.
#
# However, LDAP can be used for authentication ONLY when the
# Access-Request packet contains a clear-text User-Password
# attribute. LDAP authentication will NOT work for any other
# authentication method.
#
# This means that LDAP servers don't understand EAP. If you
# force "Auth-Type = LDAP", and then send the server a
# request containing EAP authentication, then authentication
# WILL NOT WORK.
#
# The solution is to use the default configuration, which does
# work.
#
# Setting "Auth-Type = LDAP" is ALMOST ALWAYS WRONG. We
# really can't emphasize this enough.
#
ldap {
#
# Note that this needs to match the name in the LDAP
# server certificate, if you're using ldaps.
server = "radserv.example.com"
identity = "cn=Manager,dc=example,dc=com"
#password = mypass
basedn = "dc=example,dc=com"
filter = "(uid=%{%{Stripped-User-Name}:-%{User-Name}})"
base_filter = "(objectclass=radiusprofile)"
# How many connections to keep open to the LDAP server.
# This saves time over opening a new LDAP socket for
# every authentication request.
ldap_connections_number = 5
# How many times the connection can be used before
# being re-established. This is useful for things
# like load balancers, which may exhibit sticky
# behaviour without it. (0) is unlimited.
max_uses = 0
# Port to connect on, defaults to 389. Setting this to
# 636 will enable LDAPS if start_tls (see below) is not
# able to be used.
#port = 389
# seconds to wait for LDAP query to finish. default: 20
timeout = 4
# seconds LDAP server has to process the query (server-side
# time limit). default: 20
#
# LDAP_OPT_TIMELIMIT is set to this value.
timelimit = 5
#
# seconds to wait for response of the server. (network
# failures) default: 10
#
# LDAP_OPT_NETWORK_TIMEOUT is set to this value.
net_timeout = 1
#
# This subsection configures the tls related items
# that control how FreeRADIUS connects to an LDAP
# server. It contains all of the "tls_*" configuration
# entries used in older versions of FreeRADIUS. Those
# configuration entries can still be used, but we recommend
# using these.
#
tls {
# Set this to 'yes' to use TLS encrypted connections
# to the LDAP database by using the StartTLS extended
# operation.
#
# The StartTLS operation is supposed to be
# used with normal ldap connections instead of
# using ldaps (port 636) connections
start_tls = no
# cacertfile = /path/to/cacert.pem
# cacertdir = /path/to/ca/dir/
# certfile = /path/to/radius.crt
# keyfile = /path/to/radius.key
# randfile = /path/to/rnd
# Certificate Verification requirements. Can be:
# "never" (don't even bother trying)
# "allow" (try, but don't fail if the cerificate
# can't be verified)
# "demand" (fail if the certificate doesn't verify.)
#
# The default is "allow"
# require_cert = "demand"
}
# default_profile = "cn=radprofile,ou=dialup,o=My Org,c=UA"
# profile_attribute = "radiusProfileDn"
# access_attr = "dialupAccess"
# Mapping of RADIUS dictionary attributes to LDAP
# directory attributes.
dictionary_mapping = ${confdir}/ldap.attrmap
# Set password_attribute = nspmPassword to get the
# user's password from a Novell eDirectory
# backend. This will work ONLY IF FreeRADIUS has been
# built with the --with-edir configure option.
#
# See also the following links:
#
# http://www.novell.com/coolsolutions/appnote/16745.html
#
https://secure-support.novell.com/KanisaPlatform/Publishing/558/3009668_f.S…
#
# Novell may require TLS encrypted sessions before returning
# the user's password.
#
# password_attribute = userPassword
# Un-comment the following to disable Novell
# eDirectory account policy check and intruder
# detection. This will work *only if* FreeRADIUS is
# configured to build with --with-edir option.
#
edir_account_policy_check = no
#
# Group membership checking. Disabled by default.
#
# groupname_attribute = cn
# groupmembership_filter =
"(|(&(objectClass=GroupOfNames)(member=%{control:Ldap-UserDn}))(&(objectClass=GroupOfUniqueNames)(uniquemember=%{control:Ldap-UserDn})))"
# groupmembership_attribute = radiusGroupName
# compare_check_items = yes
# do_xlat = yes
# access_attr_used_for_allow = yes
#
# The following two configuration items are for Active Directory
# compatibility. If you see the helpful "operations error"
# being returned to the LDAP module, uncomment the next
# two lines.
#
# chase_referrals = yes
# rebind = yes
#
# By default, if the packet contains a User-Password,
# and no other module is configured to handle the
# authentication, the LDAP module sets itself to do
# LDAP bind for authentication.
#
# THIS WILL ONLY WORK FOR PAP AUTHENTICATION.
#
# THIS WILL NOT WORK FOR CHAP, MS-CHAP, or 802.1x (EAP).
#
# You can disable this behavior by setting the following
# configuration entry to "no".
#
# allowed values: {no, yes}
# set_auth_type = yes
# ldap_debug: debug flag for LDAP SDK
# (see OpenLDAP documentation). Set this to enable
# huge amounts of LDAP debugging on the screen.
# You should only use this if you are an LDAP expert.
#
# default: 0x0000 (no debugging messages)
# Example:(LDAP_DEBUG_FILTER+LDAP_DEBUG_CONNS)
#ldap_debug = 0x0028
#
# Keepalive configuration. This MAY NOT be supported by your
# LDAP library. If these configuration entries appear in the
# output of "radiusd -X", then they are supported. Otherwise,
# they are unsupported, and changing them will do nothing.
#
keepalive {
# LDAP_OPT_X_KEEPALIVE_IDLE
idle = 60
# LDAP_OPT_X_KEEPALIVE_PROBES
probes = 3
# LDAP_OPT_X_KEEPALIVE_INTERVAL
interval = 3
}
}
[root@radserv modules]#
Am I missing something. Please let me know
Thanks,
Dhivya
2
1