- Freeradius-Users - lists.freeradius.org

Error: Discarding duplicate request from client
by Ceferli Asef 25 Aug '17

25 Aug '17

Hi Colleagues, I encountered such a problem. What are you think, What is the reason this error?: Error: Discarding duplicate request from client BRAS № port № - ID: № due to unfinished request № in component authorize module sql. Please help me to solve this problem. Best regards, Asaf Jafarli | System Administrator Aztelekom LLC Address: 187, Tbilisi str., AZ1122, Baku, Azerbaijan Mobile : +994517487671 <http://aztelekom.net/cabinet/assets/images/logos/logo.png>

2 1

About service down when the number of sessions exceeded
by Seiichirou Hiraoka 25 Aug '17

25 Aug '17

Hello. I use the following version with RHEL 7. # rpm -qa | grep freeradius freeradius-3.0.4-6.el7.x86_64 freeradius-utils-3.0.4-6.el7.x86_64 freeradius-mysql-3.0.4-6.el7.x86_64 We set max_sessions to the default 1024, and when there are many users, radiusd forcibly shut down after outputting the following message. - /var/log/radius/radius.log Tue Jun 13 15:06:01 2017 : Error: rlm_eap (EAP): Too many open sessions. Try increasing "max_sessions" in the EAP moduleconfiguration Increasing the value of max_sessions now works without problems. Here, I have a question. I think that an error message is output in the following part of the source code, Change not to accept requests, not forced shutdown Is there a way? freeradius-server-3.0.4/src/modules/rlm_eap/mem.c ----- ... Done: / * * We do not need this any more. * / If (status> 0) handler-> request = NULL; PTHREAD_MUTEX_UNLOCK (& (inst -> session_mutex)); If (status <= 0) { Pairfree (& state); If (status <0) { Static time_t last_logged = 0; If (last_logged <handler-> timestamp) { Last_logged = handler-> timestamp; ERROR ("rlm_eap (% s): Too many open sessions. Try increasing \" max_sessions \ "" "In the EAP module configuration", inst-> xlat_name); } } Else { ERROR ("rlm_eap (% s): Failed to store handler", inst-> xlat_name); } Return 0; } ----- Thank you.

2 2

Re: How best to map users to domain name for login
by yani＠ecoco.co.uk 24 Aug '17

24 Aug '17

On 24/08/17 17:23, Alan DeKok wrote: > On Aug 24, 2017, at 10:24 AM, yani(a)ecoco.co.uk wrote: >> radiusd -v >> radiusd: FreeRADIUS Version 3.0.4, for host x86_64-redhat-linux-gnu, built on Jan 17 2017 at 18:49:55 > I would suggest using 3.0.15. It has a lot of fixes over 3.0.4. > >> I want to be able to authenticate users to my email service and manage >> them according to the domain they belong to so fred(a)domaina.com is not >> the same as fred(a)domainb.com. But in both cases the first part is the >> login user name within the domain. > That's a pretty common requirement. Yep > >> I have looked at freeradius virtual servers - > Virtual servers are largely for separating functionality. i.e. WiFi rules in one virtual server, DSL rules in another, and VPN rules in a third virtual server. > >> and have considered >> using free radius realms dont see how either are actually the way forward - It seems >> that virtual servers will need a database system creating for every >> instance( am i actually correct here) > No. good suspected I was wrong, but needed confirmation. > >> and that realms are really for >> forwarding requests to other free radius servers - when all i need at >> the moment is a single server handling multiple domain based login >> groups. > Realms are often used for forwarding, but they don't need to be. > >> I understand from the documentation that I can create a local realm >> like this >> >> realm domaina.com { >> type= radius >> authhost= LOCAL >> accthost= LOCAL > Yes. > >> I suspect I'm on the right track here - but haven't figured out how to >> create users in the database/system that reflect this >> >> Please advise on the most appropriate way of configuring >> freeradius to achieve logins for multiple internet domains. > The bigger question is where are the users stored right now? What kind of database contains the name / password for each user? What is the schema used there? > > Once you know that, you just configure FreeRADIUS to query the database. It should be about 10 minutes work. > > I wouldn't suggest creating users via the default SQL schema. That's largely for ISP functionality, and will likely not work well for you. > > For enterprises we just recommend that FreeRADIUS look at the existing enterprise DB. > > i.e. you don't mangle your data to make FreeRADIUS happy. That's a lot of work. Instead, you configure 1-2 simple queries in FreeRADIUS, so that it pulls the correct information from your existing database. That's *much* easier. > > Alan DeKok. Thank you for the quick reply, I'm just a newbie with Freeradius, trying to understand its modus operandi :) I have come to the conclusion that I will need to modify the schema and change the way in which the db is queried after seeing the output below for a test user in the test domain domaina.com . I'm using a mysql back end at the moment. and this system is not live - still in development. ( I've wanted to get radius working for years and only just found the time.) I suppose it's really only adding a realm field to the radius.radcheckdb and using that in the subsequent queries. something like : EXPAND SELECT id, username, attribute, value, op FROM radcheck WHERE username = '%{SQL-User-Name}' and realm = {whatever_realm_is } ORDER BY id if this is what you mean by mangling the data then I'm still missing something - ie how to best relate users to realms/domains. Received Access-Request Id 25 from 10.64.4.111:36127 to 10.64.3.44:1812 length 86 User-Name = 'yani(a)domaina.com' User-Password = 'poppl' NAS-IP-Address = 127.0.1.1 NAS-Port = 0 Message-Authenticator = 0x552204bba16c70744eb4910adeb44f6f (11) Received Access-Request packet from host 10.64.4.111 port 36127, id=25, length=86 (11) User-Name = 'yani(a)domaina.com' (11) User-Password = 'poppl' (11) NAS-IP-Address = 127.0.1.1 (11) NAS-Port = 0 (11) Message-Authenticator = 0x552204bba16c70744eb4910adeb44f6f (11) # Executing section authorize from file /etc/raddb/sites-enabled/default (11) authorize { (11) filter_username filter_username { (11) if (!&User-Name) (11) if (!&User-Name) -> FALSE (11) if (&User-Name =~ / /) (11) if (&User-Name =~ / /) -> FALSE (11) if (&User-Name =~ /@.*@/ ) (11) if (&User-Name =~ /@.*@/ ) -> FALSE (11) if (&User-Name =~ /\\.\\./ ) (11) if (&User-Name =~ /\\.\\./ ) -> FALSE (11) if ((&User-Name =~ /@/) && (&User-Name !~ /(a)(.+)\\.(.+)$/)) (11) if ((&User-Name =~ /@/) && (&User-Name !~ /(a)(.+)\\.(.+)$/)) -> FALSE (11) if (&User-Name =~ /\\.$/) (11) if (&User-Name =~ /\\.$/) -> FALSE (11) if (&User-Name =~ /(a)\\./) (11) if (&User-Name =~ /(a)\\./) -> FALSE (11) } # filter_username filter_username = notfound (11) [preprocess] = ok (11) [chap] = noop (11) [mschap] = noop (11) [digest] = noop (11) suffix : Checking for suffix after "@" (11) suffix : Looking up realm "domaina.com" for User-Name = "yani(a)domaina.com" (11) suffix : Found realm "domaina.com" (11) suffix : Adding Stripped-User-Name = "yani" (11) suffix : Adding Realm = "domaina.com" (11) suffix : Authentication realm is LOCAL (11) [suffix] = ok (11) eap : No EAP-Message, not doing EAP (11) [eap] = noop (11) [files] = noop (11) sql : EXPAND %{User-Name} (11) sql : --> yani(a)domaina.com (11) sql : SQL-User-Name set to 'yani(a)domaina.com' rlm_sql (sql): Reserved connection (7) (11) sql : EXPAND SELECT id, username, attribute, value, op FROM radcheck WHERE username = '%{SQL-User-Name}' ORDER BY id (11) sql : --> SELECT id, username, attribute, value, op FROM radcheck WHERE username = 'yani(a)domaina.com' ORDER BY id rlm_sql (sql): Executing query: 'SELECT id, username, attribute, value, op FROM radcheck WHERE username = 'yani(a)domaina.com' ORDER BY id' (11) sql : User found in radcheck table (11) sql : Check items matched (11) sql : EXPAND SELECT id, username, attribute, value, op FROM radreply WHERE username = '%{SQL-User-Name}' ORDER BY id (11) sql : --> SELECT id, username, attribute, value, op FROM radreply WHERE username = 'yani(a)domaina.com' ORDER BY id rlm_sql (sql): Executing query: 'SELECT id, username, attribute, value, op FROM radreply WHERE username = 'yani(a)domaina.com' ORDER BY id' (11) sql : EXPAND SELECT groupname FROM radusergroup WHERE username = '%{SQL-User-Name}' ORDER BY priority (11) sql : --> SELECT groupname FROM radusergroup WHERE username = 'yani(a)domaina.com' ORDER BY priority rlm_sql (sql): Executing query: 'SELECT groupname FROM radusergroup WHERE username = 'yani(a)domaina.com' ORDER BY priority' (11) sql : User not found in any groups rlm_sql (sql): Released connection (7) rlm_sql (sql): 0 of 3 connections in use. Need more spares rlm_sql (sql): Opening additional connection (8) rlm_sql_mysql: Starting connect to MySQL server (11) [sql] = ok (11) [expiration] = noop (11) [logintime] = noop (11) [pap] = updated (11) } # authorize = updated (11) Found Auth-Type = PAP (11) # Executing group from file /etc/raddb/sites-enabled/default (11) Auth-Type PAP { (11) pap : Login attempt with password (11) pap : User authenticated successfully (11) [pap] = ok (11) } # Auth-Type PAP = ok (11) # Executing section post-auth from file /etc/raddb/sites-enabled/default (11) post-auth { (11) sql : EXPAND .query (11) sql : --> .query (11) sql : Using query template 'query' rlm_sql (sql): Reserved connection (8) (11) sql : EXPAND %{User-Name} (11) sql : --> yani(a)domaina.com (11) sql : SQL-User-Name set to 'yani(a)domaina.com' (11) sql : EXPAND INSERT INTO radpostauth (username, pass, reply, authdate) VALUES ( '%{SQL-User-Name}', '%{%{User-Password}:-%{Chap-Password}}', '%{reply:Packet-Type}', '%S') (11) sql : --> INSERT INTO radpostauth (username, pass, reply, authdate) VALUES ( 'yani(a)domaina.com', 'poppl', 'Access-Accept', '2017-08-24 17:23:57') rlm_sql (sql): Executing query: 'INSERT INTO radpostauth (username, pass, reply, authdate) VALUES ( 'yani(a)domaina.com', 'poppl', 'Access-Accept', '2017-08-24 17:23:57')' rlm_sql (sql): Released connection (8) (11) [sql] = ok (11) [exec] = noop (11) remove_reply_message_if_eap remove_reply_message_if_eap { (11) if (&reply:EAP-Message && &reply:Reply-Message) (11) if (&reply:EAP-Message && &reply:Reply-Message) -> FALSE (11) else else { (11) [noop] = noop (11) } # else else = noop (11) } # remove_reply_message_if_eap remove_reply_message_if_eap = noop (11) } # post-auth = ok (11) Sending Access-Accept packet to host 10.64.4.111 port 36127, id=25, length=0 Sending Access-Accept Id 25 from 10.64.3.44:1812 to 10.64.4.111:36127 (11) Finished request > > - > List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html

2 2

How best to map users to domain name for login
by yani＠ecoco.co.uk 24 Aug '17

24 Aug '17

radiusd -v radiusd: FreeRADIUS Version 3.0.4, for host x86_64-redhat-linux-gnu, built on Jan 17 2017 at 18:49:55 Hi. I've been reading the manuals to attempt to determine the best way to configure free radius for my requirements but can't decide which is the best route to follow. I want to be able to authenticate users to my email service and manage them according to the domain they belong to so fred(a)domaina.com is not the same as fred(a)domainb.com. But in both cases the first part is the login user name within the domain. I have configured all of the systems to work with the default radius configuration (Exim MTA Cyrus sasl and ssh logins working fine) and the mail server is correctly operating with virtual email domains (i.e fred(a)domaina.com is not the same as fred(a)domainb.com) I have looked at freeradius virtual servers - and have considered using free radius realms dont see how either are actually the way forward - It seems that virtual servers will need a database system creating for every instance( am i actually correct here) and that realms are really for forwarding requests to other free radius servers - when all i need at the moment is a single server handling multiple domain based login groups. I understand from the documentation that I can create a local realm like this realm domaina.com { type= radius authhost= LOCAL accthost= LOCAL I suspect I'm on the right track here - but haven't figured out how to create users in the database/system that reflect this Please advise on the most appropriate way of configuring freeradius to achieve logins for multiple internet domains. Yani

2 1

Re: Returning Vendor Specific Attribute in radius reply
by Siddiqui Najam 23 Aug '17

23 Aug '17

> Can you do a test for me? Go to src/modules/rlm_python/rlm_python.c, and find this code: if (tmpl_from_attr_str(&dst, s1, REQUEST_CURRENT, PAIR_LIST_REPLY, false, false) <= 0) { ERROR("%s - Failed to find attribute %s:%s", funcname, list_name, s1); continue; } >change the "false, false" to "true, false". Then re-build && re-install the server. I tested with the change. Still does not work. The change to true for allow_unknown did not make a difference because it is a known attribute. The issue seems to be that the type for 'Attr-26' is set to PW_TYPE_VSA (in tmpl_from_attr_substr) which later is rejected. -Najam ________________________________ This message and any attachments are intended solely for the addressees and may contain confidential information. Any unauthorized use or disclosure, either whole or partial, is prohibited. E-mails are susceptible to alteration. Our company shall not be liable for the message if altered, changed or falsified. If you are not the intended recipient of this message, please delete it and notify the sender. Although all reasonable efforts have been made to keep this transmission free from viruses, the sender will not be liable for damages caused by a transmitted virus.

1 0

Re: Returning Vendor Specific Attribute in radius reply
by Siddiqui Najam 23 Aug '17

23 Aug '17

I am running 3.0.15 $ radiusd -v radiusd: FreeRADIUS Version 3.0.15, for host x86_64-alpine-linux-musl, built on Jul 18 2017 at 09:03:14 FreeRADIUS Version 3.0.15 Copyright (C) 1999-2017 The FreeRADIUS server project and contributors There is NO warranty; not even for MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE You may redistribute copies of FreeRADIUS under the terms of the GNU General Public License For more information about these matters, see the file named COPYRIGHT -Najam -----Original Message----- From: Freeradius-Users [mailto:freeradius-users-bounces+najam.siddiqui=gemalto.com@lists.freeradius.org] On Behalf Of Alan DeKok Sent: Wednesday, August 23, 2017 6:27 AM To: FreeRadius users mailing list <freeradius-users(a)lists.freeradius.org> Subject: [+SPAM+]: Re: Returning Vendor Specific Attribute in radius reply On Aug 22, 2017, at 11:02 PM, Siddiqui Najam <Najam.Siddiqui(a)gemalto.com> wrote: > > Hi Alan, > > I did some debugging and code hits src/lib/value.c:585 and returns -1. This is confusing because we set the attribute name to Attr-26. Then you're running an older version of the server. Please use 3.0.15, which has this issue fixed. Alan DeKok. - List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html ________________________________ This message and any attachments are intended solely for the addressees and may contain confidential information. Any unauthorized use or disclosure, either whole or partial, is prohibited. E-mails are susceptible to alteration. Our company shall not be liable for the message if altered, changed or falsified. If you are not the intended recipient of this message, please delete it and notify the sender. Although all reasonable efforts have been made to keep this transmission free from viruses, the sender will not be liable for damages caused by a transmitted virus.

2 1

RE: Returning Vendor Specific Attribute in radius reply
by Siddiqui Najam 23 Aug '17

23 Aug '17

Hi Alan, I did some debugging and code hits src/lib/value.c:585 and returns -1. This is confusing because we set the attribute name to Attr-26. case PW_TYPE_VSA: fr_strerror_printf("Must use 'Attr-26 = ...' instead of 'Vendor-Specific = ...'"); return -1; -Najam On Aug 22, 2017, at 6:17 PM, Siddiqui Najam <Najam.Siddiqui(a)gemalto.com> wrote: > > Thanks for the response Alan. > > I have a backend server that can return any VSA, and the attribute is returned as a hex string. so I have to handle this dynamically. > > In version 2.X this was working fine. However, with 3.X (rlm_python) I am having this issue. > It should work. What's the full debug output for it? Wed Aug 23 00:44:09 2017 : Debug: (0) Received Access-Request Id 24 from 192.168.99.1:58796 to 172.17.0.5:1812 length 48 Wed Aug 23 00:44:09 2017 : Debug: (0) User-Name = "testuser" Wed Aug 23 00:44:09 2017 : Debug: (0) User-Password = "testpassword" Wed Aug 23 00:44:09 2017 : Debug: (0) session-state: No State attribute Wed Aug 23 00:44:09 2017 : Debug: (0) # Executing section authorize from file /etc/raddb/sites-enabled/default Wed Aug 23 00:44:09 2017 : Debug: (0) authorize { Wed Aug 23 00:44:09 2017 : Debug: (0) modsingle[authorize]: calling preprocess (rlm_preprocess) Wed Aug 23 00:44:09 2017 : Debug: (0) modsingle[authorize]: returned from preprocess (rlm_preprocess) Wed Aug 23 00:44:09 2017 : Debug: (0) [preprocess] = ok Wed Aug 23 00:44:09 2017 : Debug: (0) modsingle[authorize]: calling agent_mod (rlm_python) Wed Aug 23 00:44:09 2017 : Debug: (0) agent_mod: Initialised new thread state 0x563921b35680 Wed Aug 23 00:44:09 2017 : Debug: (0) agent_mod: Using thread state 0x563921b35680 Wed Aug 23 00:44:09 2017 : Debug: authorize - 'config:Auth-Type' = 'agent' Wed Aug 23 00:44:09 2017 : Debug: (0) agent_mod: ::: FROM 1 TO 0 MAX 1 Wed Aug 23 00:44:09 2017 : Debug: (0) agent_mod: ::: Examining Auth-Type Wed Aug 23 00:44:09 2017 : Debug: (0) agent_mod: ::: APPENDING Auth-Type FROM 0 TO 0 Wed Aug 23 00:44:09 2017 : Debug: (0) agent_mod: ::: TO in 0 out 0 Wed Aug 23 00:44:09 2017 : Debug: (0) modsingle[authorize]: returned from agent_mod (rlm_python) Wed Aug 23 00:44:09 2017 : Debug: (0) [agent_mod] = ok Wed Aug 23 00:44:09 2017 : Debug: (0) modsingle[authorize]: calling chap (rlm_chap) Wed Aug 23 00:44:09 2017 : Debug: (0) modsingle[authorize]: returned from chap (rlm_chap) Wed Aug 23 00:44:09 2017 : Debug: (0) [chap] = noop Wed Aug 23 00:44:09 2017 : Debug: (0) modsingle[authorize]: calling mschap (rlm_mschap) Wed Aug 23 00:44:09 2017 : Debug: (0) modsingle[authorize]: returned from mschap (rlm_mschap) Wed Aug 23 00:44:09 2017 : Debug: (0) [mschap] = noop Wed Aug 23 00:44:09 2017 : Debug: (0) modsingle[authorize]: calling digest (rlm_digest) Wed Aug 23 00:44:09 2017 : Debug: (0) modsingle[authorize]: returned from digest (rlm_digest) Wed Aug 23 00:44:09 2017 : Debug: (0) [digest] = noop Wed Aug 23 00:44:09 2017 : Debug: (0) modsingle[authorize]: calling suffix (rlm_realm) Wed Aug 23 00:44:09 2017 : Debug: (0) suffix: Checking for suffix after "@" Wed Aug 23 00:44:09 2017 : Debug: (0) suffix: No '@' in User-Name = "testuser", looking up realm NULL Wed Aug 23 00:44:09 2017 : Debug: (0) suffix: No such realm "NULL" Wed Aug 23 00:44:09 2017 : Debug: (0) modsingle[authorize]: returned from suffix (rlm_realm) Wed Aug 23 00:44:09 2017 : Debug: (0) [suffix] = noop Wed Aug 23 00:44:09 2017 : Debug: (0) modsingle[authorize]: calling files (rlm_files) Wed Aug 23 00:44:09 2017 : Debug: ^[Rr][Oo][Oo][Tt]$ Wed Aug 23 00:44:09 2017 : Debug: Parsed xlat tree: Wed Aug 23 00:44:09 2017 : Debug: literal --> ^[Rr][Oo][Oo][Tt]$ Wed Aug 23 00:44:09 2017 : Debug: (0) files: EXPAND ^[Rr][Oo][Oo][Tt]$ Wed Aug 23 00:44:09 2017 : Debug: (0) files: --> ^[Rr][Oo][Oo][Tt]$ Wed Aug 23 00:44:09 2017 : Debug: No matches Wed Aug 23 00:44:09 2017 : Debug: Adding 33 matches Wed Aug 23 00:44:09 2017 : Debug: (0) modsingle[authorize]: returned from files (rlm_files) Wed Aug 23 00:44:09 2017 : Debug: (0) [files] = noop Wed Aug 23 00:44:09 2017 : Debug: (0) modsingle[authorize]: calling expiration (rlm_expiration) Wed Aug 23 00:44:09 2017 : Debug: (0) modsingle[authorize]: returned from expiration (rlm_expiration) Wed Aug 23 00:44:09 2017 : Debug: (0) [expiration] = noop Wed Aug 23 00:44:09 2017 : Debug: (0) modsingle[authorize]: calling logintime (rlm_logintime) Wed Aug 23 00:44:09 2017 : Debug: (0) modsingle[authorize]: returned from logintime (rlm_logintime) Wed Aug 23 00:44:09 2017 : Debug: (0) [logintime] = noop Wed Aug 23 00:44:09 2017 : Debug: (0) modsingle[authorize]: calling pap (rlm_pap) Wed Aug 23 00:44:09 2017 : WARNING: (0) pap: No "known good" password found for the user. Not setting Auth-Type Wed Aug 23 00:44:09 2017 : WARNING: (0) pap: Authentication will fail unless a "known good" password is available Wed Aug 23 00:44:09 2017 : Debug: (0) modsingle[authorize]: returned from pap (rlm_pap) Wed Aug 23 00:44:09 2017 : Debug: (0) [pap] = noop Wed Aug 23 00:44:09 2017 : Debug: (0) } # authorize = ok Wed Aug 23 00:44:09 2017 : Debug: (0) Found Auth-Type = agent Wed Aug 23 00:44:09 2017 : Debug: (0) # Executing group from file /etc/raddb/sites-enabled/default Wed Aug 23 00:44:09 2017 : Debug: (0) Auth-Type agent { Wed Aug 23 00:44:09 2017 : Debug: (0) modsingle[authenticate]: calling agent_mod (rlm_python) Wed Aug 23 00:44:09 2017 : Debug: (0) agent_mod: Using thread state 0x563921b35680 Wed Aug 23 00:44:11 2017 : Debug: authenticate - Failed: 'reply:Attr-26' = '0x00000009010f54657374417474726962757465' Wed Aug 23 00:44:11 2017 : Debug: (0) agent_mod: ::: FROM 1 TO 0 MAX 1 Wed Aug 23 00:44:11 2017 : Debug: (0) agent_mod: ::: Examining Vendor-Specific Wed Aug 23 00:44:11 2017 : Debug: (0) agent_mod: ::: APPENDING Vendor-Specific FROM 0 TO 0 Wed Aug 23 00:44:11 2017 : Debug: (0) agent_mod: ::: TO in 0 out 0 Wed Aug 23 00:44:11 2017 : Debug: authenticate - 'config:Auth-Type' = 'agent' Wed Aug 23 00:44:11 2017 : Debug: (0) agent_mod: ::: FROM 1 TO 1 MAX 2 Wed Aug 23 00:44:11 2017 : Debug: (0) agent_mod: ::: Examining Auth-Type Wed Aug 23 00:44:11 2017 : Debug: (0) agent_mod: ::: TO in 1 out 1 Wed Aug 23 00:44:11 2017 : Debug: (0) agent_mod: ::: to[0] = Auth-Type Wed Aug 23 00:44:11 2017 : Debug: (0) modsingle[authenticate]: returned from agent_mod (rlm_python) Wed Aug 23 00:44:11 2017 : Debug: (0) [agent_mod] = ok Wed Aug 23 00:44:11 2017 : Debug: (0) } # Auth-Type agent = ok Wed Aug 23 00:44:11 2017 : Debug: (0) # Executing section post-auth from file /etc/raddb/sites-enabled/default Wed Aug 23 00:44:11 2017 : Debug: (0) post-auth { Wed Aug 23 00:44:11 2017 : Debug: (0) modsingle[post-auth]: calling exec (rlm_exec) Wed Aug 23 00:44:11 2017 : Debug: (0) modsingle[post-auth]: returned from exec (rlm_exec) Wed Aug 23 00:44:11 2017 : Debug: (0) [exec] = noop Wed Aug 23 00:44:11 2017 : Debug: (0) } # post-auth = noop Wed Aug 23 00:44:11 2017 : Auth: (0) Login OK: [testuser] (from client Radius Local port 0) Wed Aug 23 00:44:11 2017 : Debug: (0) Sent Access-Accept Id 24 from 172.17.0.5:1812 to 192.168.99.1:58796 length 0 SOFT ASSERT FAILED src/lib/value.c[1872]: 0 Wed Aug 23 00:44:11 2017 : Debug: (0) Vendor-Specific = Wed Aug 23 00:44:11 2017 : Debug: (0) Finished request Wed Aug 23 00:44:11 2017 : Debug: Waking up in 4.9 seconds. Wed Aug 23 00:44:16 2017 : Debug: (0) Cleaning up request packet ID 24 with timestamp +7 Wed Aug 23 00:44:16 2017 : Info: Ready to process requests >And is the hex string well-formed? i.e. is it correct for the Cisco VSA? Yes. The response from freeradius server version 2.2.0: Sending Access-Accept of id 25 to 192.168.56.1 port 55685 Attr-26 = 0x00000009010f54657374417474726962757465 In the test client (radtest) the response is: rad_recv: Access-Accept packet from host 127.0.0.1 port 1812, id=204, length=53 Framed-Protocol = PPP Framed-Compression = Van-Jacobson-TCP-IP Cisco-AVPair = "TestAttribute" Alan DeKok. - List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html ________________________________ This message and any attachments are intended solely for the addressees and may contain confidential information. Any unauthorized use or disclosure, either whole or partial, is prohibited. E-mails are susceptible to alteration. Our company shall not be liable for the message if altered, changed or falsified. If you are not the intended recipient of this message, please delete it and notify the sender. Although all reasonable efforts have been made to keep this transmission free from viruses, the sender will not be liable for damages caused by a transmitted virus.

2 1

Re: Returning Vendor Specific Attribute in radius reply
by Siddiqui Najam 23 Aug '17

23 Aug '17

-----Original Message----- From: Freeradius-Users [mailto:freeradius-users-bounces+najam.siddiqui=gemalto.com@lists.freeradius.org] On Behalf Of Alan DeKok Sent: Tuesday, August 22, 2017 6:11 PM To: FreeRadius users mailing list <freeradius-users(a)lists.freeradius.org> Subject: [+SPAM+]: Re: [+SPAM+]: Re: Returning Vendor Specific Attribute in radius reply On Aug 22, 2017, at 6:17 PM, Siddiqui Najam <Najam.Siddiqui(a)gemalto.com> wrote: > > Thanks for the response Alan. > > I have a backend server that can return any VSA, and the attribute is returned as a hex string. so I have to handle this dynamically. > > In version 2.X this was working fine. However, with 3.X (rlm_python) I am having this issue. > It should work. What's the full debug output for it? Wed Aug 23 00:44:09 2017 : Debug: (0) Received Access-Request Id 24 from 192.168.99.1:58796 to 172.17.0.5:1812 length 48 Wed Aug 23 00:44:09 2017 : Debug: (0) User-Name = "testuser" Wed Aug 23 00:44:09 2017 : Debug: (0) User-Password = "testpassword" Wed Aug 23 00:44:09 2017 : Debug: (0) session-state: No State attribute Wed Aug 23 00:44:09 2017 : Debug: (0) # Executing section authorize from file /etc/raddb/sites-enabled/default Wed Aug 23 00:44:09 2017 : Debug: (0) authorize { Wed Aug 23 00:44:09 2017 : Debug: (0) modsingle[authorize]: calling preprocess (rlm_preprocess) Wed Aug 23 00:44:09 2017 : Debug: (0) modsingle[authorize]: returned from preprocess (rlm_preprocess) Wed Aug 23 00:44:09 2017 : Debug: (0) [preprocess] = ok Wed Aug 23 00:44:09 2017 : Debug: (0) modsingle[authorize]: calling agent_mod (rlm_python) Wed Aug 23 00:44:09 2017 : Debug: (0) agent_mod: Initialised new thread state 0x563921b35680 Wed Aug 23 00:44:09 2017 : Debug: (0) agent_mod: Using thread state 0x563921b35680 Wed Aug 23 00:44:09 2017 : Debug: authorize - 'config:Auth-Type' = 'agent' Wed Aug 23 00:44:09 2017 : Debug: (0) agent_mod: ::: FROM 1 TO 0 MAX 1 Wed Aug 23 00:44:09 2017 : Debug: (0) agent_mod: ::: Examining Auth-Type Wed Aug 23 00:44:09 2017 : Debug: (0) agent_mod: ::: APPENDING Auth-Type FROM 0 TO 0 Wed Aug 23 00:44:09 2017 : Debug: (0) agent_mod: ::: TO in 0 out 0 Wed Aug 23 00:44:09 2017 : Debug: (0) modsingle[authorize]: returned from agent_mod (rlm_python) Wed Aug 23 00:44:09 2017 : Debug: (0) [agent_mod] = ok Wed Aug 23 00:44:09 2017 : Debug: (0) modsingle[authorize]: calling chap (rlm_chap) Wed Aug 23 00:44:09 2017 : Debug: (0) modsingle[authorize]: returned from chap (rlm_chap) Wed Aug 23 00:44:09 2017 : Debug: (0) [chap] = noop Wed Aug 23 00:44:09 2017 : Debug: (0) modsingle[authorize]: calling mschap (rlm_mschap) Wed Aug 23 00:44:09 2017 : Debug: (0) modsingle[authorize]: returned from mschap (rlm_mschap) Wed Aug 23 00:44:09 2017 : Debug: (0) [mschap] = noop Wed Aug 23 00:44:09 2017 : Debug: (0) modsingle[authorize]: calling digest (rlm_digest) Wed Aug 23 00:44:09 2017 : Debug: (0) modsingle[authorize]: returned from digest (rlm_digest) Wed Aug 23 00:44:09 2017 : Debug: (0) [digest] = noop Wed Aug 23 00:44:09 2017 : Debug: (0) modsingle[authorize]: calling suffix (rlm_realm) Wed Aug 23 00:44:09 2017 : Debug: (0) suffix: Checking for suffix after "@" Wed Aug 23 00:44:09 2017 : Debug: (0) suffix: No '@' in User-Name = "testuser", looking up realm NULL Wed Aug 23 00:44:09 2017 : Debug: (0) suffix: No such realm "NULL" Wed Aug 23 00:44:09 2017 : Debug: (0) modsingle[authorize]: returned from suffix (rlm_realm) Wed Aug 23 00:44:09 2017 : Debug: (0) [suffix] = noop Wed Aug 23 00:44:09 2017 : Debug: (0) modsingle[authorize]: calling files (rlm_files) Wed Aug 23 00:44:09 2017 : Debug: ^[Rr][Oo][Oo][Tt]$ Wed Aug 23 00:44:09 2017 : Debug: Parsed xlat tree: Wed Aug 23 00:44:09 2017 : Debug: literal --> ^[Rr][Oo][Oo][Tt]$ Wed Aug 23 00:44:09 2017 : Debug: (0) files: EXPAND ^[Rr][Oo][Oo][Tt]$ Wed Aug 23 00:44:09 2017 : Debug: (0) files: --> ^[Rr][Oo][Oo][Tt]$ Wed Aug 23 00:44:09 2017 : Debug: No matches Wed Aug 23 00:44:09 2017 : Debug: Adding 33 matches Wed Aug 23 00:44:09 2017 : Debug: (0) modsingle[authorize]: returned from files (rlm_files) Wed Aug 23 00:44:09 2017 : Debug: (0) [files] = noop Wed Aug 23 00:44:09 2017 : Debug: (0) modsingle[authorize]: calling expiration (rlm_expiration) Wed Aug 23 00:44:09 2017 : Debug: (0) modsingle[authorize]: returned from expiration (rlm_expiration) Wed Aug 23 00:44:09 2017 : Debug: (0) [expiration] = noop Wed Aug 23 00:44:09 2017 : Debug: (0) modsingle[authorize]: calling logintime (rlm_logintime) Wed Aug 23 00:44:09 2017 : Debug: (0) modsingle[authorize]: returned from logintime (rlm_logintime) Wed Aug 23 00:44:09 2017 : Debug: (0) [logintime] = noop Wed Aug 23 00:44:09 2017 : Debug: (0) modsingle[authorize]: calling pap (rlm_pap) Wed Aug 23 00:44:09 2017 : WARNING: (0) pap: No "known good" password found for the user. Not setting Auth-Type Wed Aug 23 00:44:09 2017 : WARNING: (0) pap: Authentication will fail unless a "known good" password is available Wed Aug 23 00:44:09 2017 : Debug: (0) modsingle[authorize]: returned from pap (rlm_pap) Wed Aug 23 00:44:09 2017 : Debug: (0) [pap] = noop Wed Aug 23 00:44:09 2017 : Debug: (0) } # authorize = ok Wed Aug 23 00:44:09 2017 : Debug: (0) Found Auth-Type = agent Wed Aug 23 00:44:09 2017 : Debug: (0) # Executing group from file /etc/raddb/sites-enabled/default Wed Aug 23 00:44:09 2017 : Debug: (0) Auth-Type agent { Wed Aug 23 00:44:09 2017 : Debug: (0) modsingle[authenticate]: calling agent_mod (rlm_python) Wed Aug 23 00:44:09 2017 : Debug: (0) agent_mod: Using thread state 0x563921b35680 Wed Aug 23 00:44:11 2017 : Debug: authenticate - Failed: 'reply:Attr-26' = '0x00000009010f54657374417474726962757465' Wed Aug 23 00:44:11 2017 : Debug: (0) agent_mod: ::: FROM 1 TO 0 MAX 1 Wed Aug 23 00:44:11 2017 : Debug: (0) agent_mod: ::: Examining Vendor-Specific Wed Aug 23 00:44:11 2017 : Debug: (0) agent_mod: ::: APPENDING Vendor-Specific FROM 0 TO 0 Wed Aug 23 00:44:11 2017 : Debug: (0) agent_mod: ::: TO in 0 out 0 Wed Aug 23 00:44:11 2017 : Debug: authenticate - 'config:Auth-Type' = 'agent' Wed Aug 23 00:44:11 2017 : Debug: (0) agent_mod: ::: FROM 1 TO 1 MAX 2 Wed Aug 23 00:44:11 2017 : Debug: (0) agent_mod: ::: Examining Auth-Type Wed Aug 23 00:44:11 2017 : Debug: (0) agent_mod: ::: TO in 1 out 1 Wed Aug 23 00:44:11 2017 : Debug: (0) agent_mod: ::: to[0] = Auth-Type Wed Aug 23 00:44:11 2017 : Debug: (0) modsingle[authenticate]: returned from agent_mod (rlm_python) Wed Aug 23 00:44:11 2017 : Debug: (0) [agent_mod] = ok Wed Aug 23 00:44:11 2017 : Debug: (0) } # Auth-Type agent = ok Wed Aug 23 00:44:11 2017 : Debug: (0) # Executing section post-auth from file /etc/raddb/sites-enabled/default Wed Aug 23 00:44:11 2017 : Debug: (0) post-auth { Wed Aug 23 00:44:11 2017 : Debug: (0) modsingle[post-auth]: calling exec (rlm_exec) Wed Aug 23 00:44:11 2017 : Debug: (0) modsingle[post-auth]: returned from exec (rlm_exec) Wed Aug 23 00:44:11 2017 : Debug: (0) [exec] = noop Wed Aug 23 00:44:11 2017 : Debug: (0) } # post-auth = noop Wed Aug 23 00:44:11 2017 : Auth: (0) Login OK: [testuser] (from client Radius Local port 0) Wed Aug 23 00:44:11 2017 : Debug: (0) Sent Access-Accept Id 24 from 172.17.0.5:1812 to 192.168.99.1:58796 length 0 SOFT ASSERT FAILED src/lib/value.c[1872]: 0 Wed Aug 23 00:44:11 2017 : Debug: (0) Vendor-Specific = Wed Aug 23 00:44:11 2017 : Debug: (0) Finished request Wed Aug 23 00:44:11 2017 : Debug: Waking up in 4.9 seconds. Wed Aug 23 00:44:16 2017 : Debug: (0) Cleaning up request packet ID 24 with timestamp +7 Wed Aug 23 00:44:16 2017 : Info: Ready to process requests >And is the hex string well-formed? i.e. is it correct for the Cisco VSA? Yes. The response from freeradius server version 2.2.0: Sending Access-Accept of id 25 to 192.168.56.1 port 55685 Attr-26 = 0x00000009010f54657374417474726962757465 In the test client (radtest) the response is: rad_recv: Access-Accept packet from host 127.0.0.1 port 1812, id=204, length=53 Framed-Protocol = PPP Framed-Compression = Van-Jacobson-TCP-IP Cisco-AVPair = "TestAttribute" Alan DeKok. - List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html ________________________________ This message and any attachments are intended solely for the addressees and may contain confidential information. Any unauthorized use or disclosure, either whole or partial, is prohibited. E-mails are susceptible to alteration. Our company shall not be liable for the message if altered, changed or falsified. If you are not the intended recipient of this message, please delete it and notify the sender. Although all reasonable efforts have been made to keep this transmission free from viruses, the sender will not be liable for damages caused by a transmitted virus.

1 0

krb5 authentication not working
by Greg Wilson 23 Aug '17

23 Aug '17

FreeRADIUS Version 3.0.13 Getting (0) ERROR: No Auth-Type found: rejecting the user via Post-Auth-Type = Reject in debug output. The server does not appear to be trying krb5 authentication. In sites-enabled/default --------- authenticate { # # User Kerberos to authenticate # Auth-Type Kerberos { krb5 } In mods-enabled/krb5 -------------- krb5 { keytab = /etc/raddb-checkpoint/radius_auth.keytab service_principal = "radius_auth" In mods-config/files/authorize -------------- DEFAULT Auth-Type = Kerberos User-Service-Type = Login-User, Login-Service = Rlogin Debug output: ------------------ FreeRADIUS Version 3.0.13 Copyright (C) 1999-2017 The FreeRADIUS server project and contributors There is NO warranty; not even for MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE You may redistribute copies of FreeRADIUS under the terms of the GNU General Public License For more information about these matters, see the file named COPYRIGHT Starting - reading configuration files ... including dictionary file /usr/share/freeradius/dictionary including dictionary file /usr/share/freeradius/dictionary.dhcp including dictionary file /usr/share/freeradius/dictionary.vqp including dictionary file /etc/raddb-checkpoint/dictionary including configuration file /etc/raddb-checkpoint/radiusd.conf including configuration file /etc/raddb-checkpoint/proxy.conf including configuration file /etc/raddb-checkpoint/clients.conf including files in directory /etc/raddb-checkpoint/mods-enabled/ including configuration file /etc/raddb-checkpoint/mods-enabled/utf8 including configuration file /etc/raddb-checkpoint/mods-enabled/unpack including configuration file /etc/raddb-checkpoint/mods-enabled/unix including configuration file /etc/raddb-checkpoint/mods-enabled/sradutmp including configuration file /etc/raddb-checkpoint/mods-enabled/soh including configuration file /etc/raddb-checkpoint/mods-enabled/replicate including configuration file /etc/raddb-checkpoint/mods-enabled/realm including configuration file /etc/raddb-checkpoint/mods-enabled/radutmp including configuration file /etc/raddb-checkpoint/mods-enabled/preprocess including configuration file /etc/raddb-checkpoint/mods-enabled/passwd including configuration file /etc/raddb-checkpoint/mods-enabled/pap including configuration file /etc/raddb-checkpoint/mods-enabled/ntlm_auth including configuration file /etc/raddb-checkpoint/mods-enabled/mschap including configuration file /etc/raddb-checkpoint/mods-enabled/logintime including configuration file /etc/raddb-checkpoint/mods-enabled/linelog including configuration file /etc/raddb-checkpoint/mods-enabled/files including configuration file /etc/raddb-checkpoint/mods-enabled/expr including configuration file /etc/raddb-checkpoint/mods-enabled/expiration including configuration file /etc/raddb-checkpoint/mods-enabled/exec including configuration file /etc/raddb-checkpoint/mods-enabled/echo including configuration file /etc/raddb-checkpoint/mods-enabled/eap including configuration file /etc/raddb-checkpoint/mods-enabled/dynamic_clients including configuration file /etc/raddb-checkpoint/mods-enabled/digest including configuration file /etc/raddb-checkpoint/mods-enabled/dhcp including configuration file /etc/raddb-checkpoint/mods-enabled/detail.log including configuration file /etc/raddb-checkpoint/mods-enabled/detail including configuration file /etc/raddb-checkpoint/mods-enabled/date including configuration file /etc/raddb-checkpoint/mods-enabled/chap including configuration file /etc/raddb-checkpoint/mods-enabled/cache_eap including configuration file /etc/raddb-checkpoint/mods-enabled/attr_filter including configuration file /etc/raddb-checkpoint/mods-enabled/always including configuration file /etc/raddb-checkpoint/mods-enabled/krb5 including files in directory /etc/raddb-checkpoint/policy.d/ including configuration file /etc/raddb-checkpoint/policy.d/accounting including configuration file /etc/raddb-checkpoint/policy.d/canonicalization including configuration file /etc/raddb-checkpoint/policy.d/control including configuration file /etc/raddb-checkpoint/policy.d/cui including configuration file /etc/raddb-checkpoint/policy.d/debug including configuration file /etc/raddb-checkpoint/policy.d/dhcp including configuration file /etc/raddb-checkpoint/policy.d/eap including configuration file /etc/raddb-checkpoint/policy.d/filter including configuration file /etc/raddb-checkpoint/policy.d/operator-name including files in directory /etc/raddb-checkpoint/sites-enabled/ including configuration file /etc/raddb-checkpoint/sites-enabled/inner-tunnel including configuration file /etc/raddb-checkpoint/sites-enabled/default main { security { user = "radiusd" group = "radiusd" allow_core_dumps = no } name = "radiusd" prefix = "/usr" localstatedir = "/var" logdir = "/var/log/radius" run_dir = "/var/run/radiusd" } main { name = "radiusd" prefix = "/usr" localstatedir = "/var" sbindir = "/usr/sbin" logdir = "/var/log/radius" run_dir = "/var/run/radiusd" libdir = "/usr/lib64/freeradius" radacctdir = "/var/log/radius/radacct" hostname_lookups = no max_request_time = 30 cleanup_delay = 5 max_requests = 16384 pidfile = "/var/run/radiusd/radiusd.pid" checkrad = "/usr/sbin/checkrad" debug_level = 0 proxy_requests = yes log { stripped_names = no auth = no auth_badpass = no auth_goodpass = no colourise = yes msg_denied = "You are already logged in - access denied" } resources { } security { max_attributes = 200 reject_delay = 1.000000 status_server = yes } } radiusd: #### Loading Realms and Home Servers #### proxy server { retry_delay = 5 retry_count = 3 default_fallback = no dead_time = 120 wake_all_if_all_dead = no } home_server localhost { ipaddr = 127.0.0.1 port = 1812 type = "auth" secret = <<< secret >>> response_window = 20.000000 response_timeouts = 1 max_outstanding = 65536 zombie_period = 40 status_check = "status-server" ping_interval = 30 check_interval = 30 check_timeout = 4 num_answers_to_alive = 3 revive_interval = 120 limit { max_connections = 16 max_requests = 0 lifetime = 0 idle_timeout = 0 } coa { irt = 2 mrt = 16 mrc = 5 mrd = 30 } } home_server_pool my_auth_failover { type = fail-over home_server = localhost } realm example.com { auth_pool = my_auth_failover } realm LOCAL { } radiusd: #### Loading Clients #### client localhost { ipaddr = 127.0.0.1 require_message_authenticator = no secret = <<< secret >>> nas_type = "other" proto = "*" limit { max_connections = 16 lifetime = 0 idle_timeout = 30 } } client netscalers { ipv4addr = 129.219.12.129/26 require_message_authenticator = no secret = <<< secret >>> limit { max_connections = 16 lifetime = 0 idle_timeout = 30 } } client test { ipv4addr = 10.120.3.175 require_message_authenticator = no secret = <<< secret >>> limit { max_connections = 16 lifetime = 0 idle_timeout = 30 } } Debugger not attached # Creating Auth-Type = mschap # Creating Auth-Type = eap # Creating Auth-Type = Kerberos # Creating Auth-Type = PAP # Creating Auth-Type = CHAP # Creating Auth-Type = MS-CHAP # Creating Auth-Type = digest radiusd: #### Instantiating modules #### modules { # Loaded module rlm_utf8 # Loading module "utf8" from file /etc/raddb-checkpoint/mods-enabled/utf8 # Loaded module rlm_unpack # Loading module "unpack" from file /etc/raddb-checkpoint/mods-enabled/unpack # Loaded module rlm_unix # Loading module "unix" from file /etc/raddb-checkpoint/mods-enabled/unix unix { radwtmp = "/var/log/radius/radwtmp" } Creating attribute Unix-Group # Loaded module rlm_radutmp # Loading module "sradutmp" from file /etc/raddb-checkpoint/mods-enabled/sradutmp radutmp sradutmp { filename = "/var/log/radius/sradutmp" username = "%{User-Name}" case_sensitive = yes check_with_nas = yes permissions = 420 caller_id = no } # Loaded module rlm_soh # Loading module "soh" from file /etc/raddb-checkpoint/mods-enabled/soh soh { dhcp = yes } # Loaded module rlm_replicate # Loading module "replicate" from file /etc/raddb-checkpoint/mods-enabled/replicate # Loaded module rlm_realm # Loading module "IPASS" from file /etc/raddb-checkpoint/mods-enabled/realm realm IPASS { format = "prefix" delimiter = "/" ignore_default = no ignore_null = no } # Loading module "suffix" from file /etc/raddb-checkpoint/mods-enabled/realm realm suffix { format = "suffix" delimiter = "@" ignore_default = no ignore_null = no } # Loading module "realmpercent" from file /etc/raddb-checkpoint/mods-enabled/realm realm realmpercent { format = "suffix" delimiter = "%" ignore_default = no ignore_null = no } # Loading module "ntdomain" from file /etc/raddb-checkpoint/mods-enabled/realm realm ntdomain { format = "prefix" delimiter = "\\" ignore_default = no ignore_null = no } # Loading module "radutmp" from file /etc/raddb-checkpoint/mods-enabled/radutmp radutmp { filename = "/var/log/radius/radutmp" username = "%{User-Name}" case_sensitive = yes check_with_nas = yes permissions = 384 caller_id = yes } # Loaded module rlm_preprocess # Loading module "preprocess" from file /etc/raddb-checkpoint/mods-enabled/preprocess preprocess { huntgroups = "/etc/raddb-checkpoint/mods-config/preprocess/huntgroups" hints = "/etc/raddb-checkpoint/mods-config/preprocess/hints" with_ascend_hack = no ascend_channels_per_line = 23 with_ntdomain_hack = no with_specialix_jetstream_hack = no with_cisco_vsa_hack = no with_alvarion_vsa_hack = no } # Loaded module rlm_passwd # Loading module "etc_passwd" from file /etc/raddb-checkpoint/mods-enabled/passwd passwd etc_passwd { filename = "/etc/passwd" format = "*User-Name:Crypt-Password:" delimiter = ":" ignore_nislike = no ignore_empty = yes allow_multiple_keys = no hash_size = 100 } # Loaded module rlm_pap # Loading module "pap" from file /etc/raddb-checkpoint/mods-enabled/pap pap { normalise = yes } # Loaded module rlm_exec # Loading module "ntlm_auth" from file /etc/raddb-checkpoint/mods-enabled/ntlm_auth exec ntlm_auth { wait = yes program = "/path/to/ntlm_auth --request-nt-key --domain=MYDOMAIN --username=%{mschap:User-Name} --password=%{User-Password}" shell_escape = yes } # Loaded module rlm_mschap # Loading module "mschap" from file /etc/raddb-checkpoint/mods-enabled/mschap mschap { use_mppe = yes require_encryption = no require_strong = no with_ntdomain_hack = yes passchange { } allow_retry = yes winbind_retry_with_normalised_username = no } # Loaded module rlm_logintime # Loading module "logintime" from file /etc/raddb-checkpoint/mods-enabled/logintime logintime { minimum_timeout = 60 } # Loaded module rlm_linelog # Loading module "linelog" from file /etc/raddb-checkpoint/mods-enabled/linelog linelog { filename = "/var/log/radius/linelog" escape_filenames = no syslog_severity = "info" permissions = 384 format = "This is a log message for %{User-Name}" reference = "messages.%{%{reply:Packet-Type}:-default}" } # Loading module "log_accounting" from file /etc/raddb-checkpoint/mods-enabled/linelog linelog log_accounting { filename = "/var/log/radius/linelog-accounting" escape_filenames = no syslog_severity = "info" permissions = 384 format = "" reference = "Accounting-Request.%{%{Acct-Status-Type}:-unknown}" } # Loaded module rlm_files # Loading module "files" from file /etc/raddb-checkpoint/mods-enabled/files files { filename = "/etc/raddb-checkpoint/mods-config/files/authorize" usersfile = "/etc/raddb-checkpoint/mods-config/files/authorize" acctusersfile = "/etc/raddb-checkpoint/mods-config/files/accounting" preproxy_usersfile = "/etc/raddb-checkpoint/mods-config/files/pre-proxy" } # Loaded module rlm_expr # Loading module "expr" from file /etc/raddb-checkpoint/mods-enabled/expr expr { safe_characters = "@abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ0123456789.-_: /Ã¤Ã©Ã¶Ã¼Ã Ã¢Ã¦Ã§Ã¨Ã©ÃªÃ«Ã®Ã¯Ã´ÅÃ¹Ã»Ã¼aÃ¿Ã ÃÃÃÃÃÃÃÃÃÃÃÃÃÃÃÅÃÃÅ¸" } # Loaded module rlm_expiration # Loading module "expiration" from file /etc/raddb-checkpoint/mods-enabled/expiration # Loading module "exec" from file /etc/raddb-checkpoint/mods-enabled/exec exec { wait = no input_pairs = "request" shell_escape = yes timeout = 10 } # Loading module "echo" from file /etc/raddb-checkpoint/mods-enabled/echo exec echo { wait = yes program = "/bin/echo %{User-Name}" input_pairs = "request" output_pairs = "reply" shell_escape = yes } # Loaded module rlm_eap # Loading module "eap" from file /etc/raddb-checkpoint/mods-enabled/eap eap { default_eap_type = "md5" timer_expire = 60 ignore_unknown_eap_types = no cisco_accounting_username_bug = no max_sessions = 16384 } # Loaded module rlm_dynamic_clients # Loading module "dynamic_clients" from file /etc/raddb-checkpoint/mods-enabled/dynamic_clients # Loaded module rlm_digest # Loading module "digest" from file /etc/raddb-checkpoint/mods-enabled/digest # Loaded module rlm_dhcp # Loading module "dhcp" from file /etc/raddb-checkpoint/mods-enabled/dhcp # Loaded module rlm_detail # Loading module "auth_log" from file /etc/raddb-checkpoint/mods-enabled/detail.log detail auth_log { filename = "/var/log/radius/radacct/%{%{Packet-Src-IP-Address}:-%{Packet-Src-IPv6-Address}}/auth-detail-%Y%m%d" header = "%t" permissions = 384 locking = no escape_filenames = no log_packet_header = no } # Loading module "reply_log" from file /etc/raddb-checkpoint/mods-enabled/detail.log detail reply_log { filename = "/var/log/radius/radacct/%{%{Packet-Src-IP-Address}:-%{Packet-Src-IPv6-Address}}/reply-detail-%Y%m%d" header = "%t" permissions = 384 locking = no escape_filenames = no log_packet_header = no } # Loading module "pre_proxy_log" from file /etc/raddb-checkpoint/mods-enabled/detail.log detail pre_proxy_log { filename = "/var/log/radius/radacct/%{%{Packet-Src-IP-Address}:-%{Packet-Src-IPv6-Address}}/pre-proxy-detail-%Y%m%d" header = "%t" permissions = 384 locking = no escape_filenames = no log_packet_header = no } # Loading module "post_proxy_log" from file /etc/raddb-checkpoint/mods-enabled/detail.log detail post_proxy_log { filename = "/var/log/radius/radacct/%{%{Packet-Src-IP-Address}:-%{Packet-Src-IPv6-Address}}/post-proxy-detail-%Y%m%d" header = "%t" permissions = 384 locking = no escape_filenames = no log_packet_header = no } # Loading module "detail" from file /etc/raddb-checkpoint/mods-enabled/detail detail { filename = "/var/log/radius/radacct/%{%{Packet-Src-IP-Address}:-%{Packet-Src-IPv6-Address}}/detail-%Y%m%d" header = "%t" permissions = 384 locking = no escape_filenames = no log_packet_header = no } # Loaded module rlm_date # Loading module "date" from file /etc/raddb-checkpoint/mods-enabled/date date { format = "%b %e %Y %H:%M:%S %Z" } # Loaded module rlm_chap # Loading module "chap" from file /etc/raddb-checkpoint/mods-enabled/chap # Loaded module rlm_cache # Loading module "cache_eap" from file /etc/raddb-checkpoint/mods-enabled/cache_eap cache cache_eap { driver = "rlm_cache_rbtree" key = "%{%{control:State}:-%{%{reply:State}:-%{State}}}" ttl = 15 max_entries = 0 epoch = 0 add_stats = no } # Loaded module rlm_attr_filter # Loading module "attr_filter.post-proxy" from file /etc/raddb-checkpoint/mods-enabled/attr_filter attr_filter attr_filter.post-proxy { filename = "/etc/raddb-checkpoint/mods-config/attr_filter/post-proxy" key = "%{Realm}" relaxed = no } # Loading module "attr_filter.pre-proxy" from file /etc/raddb-checkpoint/mods-enabled/attr_filter attr_filter attr_filter.pre-proxy { filename = "/etc/raddb-checkpoint/mods-config/attr_filter/pre-proxy" key = "%{Realm}" relaxed = no } # Loading module "attr_filter.access_reject" from file /etc/raddb-checkpoint/mods-enabled/attr_filter attr_filter attr_filter.access_reject { filename = "/etc/raddb-checkpoint/mods-config/attr_filter/access_reject" key = "%{User-Name}" relaxed = no } # Loading module "attr_filter.access_challenge" from file /etc/raddb-checkpoint/mods-enabled/attr_filter attr_filter attr_filter.access_challenge { filename = "/etc/raddb-checkpoint/mods-config/attr_filter/access_challenge" key = "%{User-Name}" relaxed = no } # Loading module "attr_filter.accounting_response" from file /etc/raddb-checkpoint/mods-enabled/attr_filter attr_filter attr_filter.accounting_response { filename = "/etc/raddb-checkpoint/mods-config/attr_filter/accounting_response" key = "%{User-Name}" relaxed = no } # Loaded module rlm_always # Loading module "reject" from file /etc/raddb-checkpoint/mods-enabled/always always reject { rcode = "reject" simulcount = 0 mpp = no } # Loading module "fail" from file /etc/raddb-checkpoint/mods-enabled/always always fail { rcode = "fail" simulcount = 0 mpp = no } # Loading module "ok" from file /etc/raddb-checkpoint/mods-enabled/always always ok { rcode = "ok" simulcount = 0 mpp = no } # Loading module "handled" from file /etc/raddb-checkpoint/mods-enabled/always always handled { rcode = "handled" simulcount = 0 mpp = no } # Loading module "invalid" from file /etc/raddb-checkpoint/mods-enabled/always always invalid { rcode = "invalid" simulcount = 0 mpp = no } # Loading module "userlock" from file /etc/raddb-checkpoint/mods-enabled/always always userlock { rcode = "userlock" simulcount = 0 mpp = no } # Loading module "notfound" from file /etc/raddb-checkpoint/mods-enabled/always always notfound { rcode = "notfound" simulcount = 0 mpp = no } # Loading module "noop" from file /etc/raddb-checkpoint/mods-enabled/always always noop { rcode = "noop" simulcount = 0 mpp = no } # Loading module "updated" from file /etc/raddb-checkpoint/mods-enabled/always always updated { rcode = "updated" simulcount = 0 mpp = no } # Loaded module rlm_krb5 # Loading module "krb5" from file /etc/raddb-checkpoint/mods-enabled/krb5 krb5 { keytab = "/etc/raddb-checkpoint/radius_auth.keytab" service_principal = "radius_auth" } instantiate { } # Instantiating module "IPASS" from file /etc/raddb-checkpoint/mods-enabled/realm # Instantiating module "suffix" from file /etc/raddb-checkpoint/mods-enabled/realm # Instantiating module "realmpercent" from file /etc/raddb-checkpoint/mods-enabled/realm # Instantiating module "ntdomain" from file /etc/raddb-checkpoint/mods-enabled/realm # Instantiating module "preprocess" from file /etc/raddb-checkpoint/mods-enabled/preprocess reading pairlist file /etc/raddb-checkpoint/mods-config/preprocess/huntgroups reading pairlist file /etc/raddb-checkpoint/mods-config/preprocess/hints # Instantiating module "etc_passwd" from file /etc/raddb-checkpoint/mods-enabled/passwd rlm_passwd: nfields: 3 keyfield 0(User-Name) listable: no # Instantiating module "pap" from file /etc/raddb-checkpoint/mods-enabled/pap # Instantiating module "mschap" from file /etc/raddb-checkpoint/mods-enabled/mschap rlm_mschap (mschap): using internal authentication # Instantiating module "logintime" from file /etc/raddb-checkpoint/mods-enabled/logintime # Instantiating module "linelog" from file /etc/raddb-checkpoint/mods-enabled/linelog # Instantiating module "log_accounting" from file /etc/raddb-checkpoint/mods-enabled/linelog # Instantiating module "files" from file /etc/raddb-checkpoint/mods-enabled/files reading pairlist file /etc/raddb-checkpoint/mods-config/files/authorize reading pairlist file /etc/raddb-checkpoint/mods-config/files/authorize reading pairlist file /etc/raddb-checkpoint/mods-config/files/accounting reading pairlist file /etc/raddb-checkpoint/mods-config/files/pre-proxy # Instantiating module "expiration" from file /etc/raddb-checkpoint/mods-enabled/expiration # Instantiating module "eap" from file /etc/raddb-checkpoint/mods-enabled/eap # Linked to sub-module rlm_eap_md5 # Linked to sub-module rlm_eap_leap # Linked to sub-module rlm_eap_gtc gtc { challenge = "Password: " auth_type = "PAP" } # Linked to sub-module rlm_eap_tls tls { tls = "tls-common" } tls-config tls-common { verify_depth = 0 ca_path = "/etc/raddb-checkpoint/certs" pem_file_type = yes private_key_file = "/etc/raddb-checkpoint/certs/server.pem" certificate_file = "/etc/raddb-checkpoint/certs/server.pem" ca_file = "/etc/raddb-checkpoint/certs/ca.pem" private_key_password = <<< secret >>> dh_file = "/etc/raddb-checkpoint/certs/dh" fragment_size = 1024 include_length = yes auto_chain = yes check_crl = no check_all_crl = no cipher_list = "DEFAULT" cipher_server_preference = no ecdh_curve = "prime256v1" cache { enable = no lifetime = 24 max_entries = 255 } verify { skip_if_ocsp_ok = no } ocsp { enable = no override_cert_url = yes url = "http://127.0.0.1/ocsp/" use_nonce = yes timeout = 0 softfail = no } } # Linked to sub-module rlm_eap_ttls ttls { tls = "tls-common" default_eap_type = "md5" copy_request_to_tunnel = no use_tunneled_reply = no virtual_server = "inner-tunnel" include_length = yes require_client_cert = no } tls: Using cached TLS configuration from previous invocation # Linked to sub-module rlm_eap_peap peap { tls = "tls-common" default_eap_type = "mschapv2" copy_request_to_tunnel = no use_tunneled_reply = no proxy_tunneled_request_as_eap = yes virtual_server = "inner-tunnel" soh = no require_client_cert = no } tls: Using cached TLS configuration from previous invocation # Linked to sub-module rlm_eap_mschapv2 mschapv2 { with_ntdomain_hack = no send_error = no } # Instantiating module "auth_log" from file /etc/raddb-checkpoint/mods-enabled/detail.log rlm_detail (auth_log): 'User-Password' suppressed, will not appear in detail output # Instantiating module "reply_log" from file /etc/raddb-checkpoint/mods-enabled/detail.log # Instantiating module "pre_proxy_log" from file /etc/raddb-checkpoint/mods-enabled/detail.log # Instantiating module "post_proxy_log" from file /etc/raddb-checkpoint/mods-enabled/detail.log # Instantiating module "detail" from file /etc/raddb-checkpoint/mods-enabled/detail # Instantiating module "cache_eap" from file /etc/raddb-checkpoint/mods-enabled/cache_eap rlm_cache (cache_eap): Driver rlm_cache_rbtree (module rlm_cache_rbtree) loaded and linked # Instantiating module "attr_filter.post-proxy" from file /etc/raddb-checkpoint/mods-enabled/attr_filter reading pairlist file /etc/raddb-checkpoint/mods-config/attr_filter/post-proxy # Instantiating module "attr_filter.pre-proxy" from file /etc/raddb-checkpoint/mods-enabled/attr_filter reading pairlist file /etc/raddb-checkpoint/mods-config/attr_filter/pre-proxy # Instantiating module "attr_filter.access_reject" from file /etc/raddb-checkpoint/mods-enabled/attr_filter reading pairlist file /etc/raddb-checkpoint/mods-config/attr_filter/access_reject [/etc/raddb-checkpoint/mods-config/attr_filter/access_reject]:11 Check item "FreeRADIUS-Response-Delay" found in filter list for realm "DEFAULT". [/etc/raddb-checkpoint/mods-config/attr_filter/access_reject]:11 Check item "FreeRADIUS-Response-Delay-USec" found in filter list for realm "DEFAULT". # Instantiating module "attr_filter.access_challenge" from file /etc/raddb-checkpoint/mods-enabled/attr_filter reading pairlist file /etc/raddb-checkpoint/mods-config/attr_filter/access_challenge # Instantiating module "attr_filter.accounting_response" from file /etc/raddb-checkpoint/mods-enabled/attr_filter reading pairlist file /etc/raddb-checkpoint/mods-config/attr_filter/accounting_response # Instantiating module "reject" from file /etc/raddb-checkpoint/mods-enabled/always # Instantiating module "fail" from file /etc/raddb-checkpoint/mods-enabled/always # Instantiating module "ok" from file /etc/raddb-checkpoint/mods-enabled/always # Instantiating module "handled" from file /etc/raddb-checkpoint/mods-enabled/always # Instantiating module "invalid" from file /etc/raddb-checkpoint/mods-enabled/always # Instantiating module "userlock" from file /etc/raddb-checkpoint/mods-enabled/always # Instantiating module "notfound" from file /etc/raddb-checkpoint/mods-enabled/always # Instantiating module "noop" from file /etc/raddb-checkpoint/mods-enabled/always # Instantiating module "updated" from file /etc/raddb-checkpoint/mods-enabled/always # Instantiating module "krb5" from file /etc/raddb-checkpoint/mods-enabled/krb5 Using MIT Kerberos library rlm_krb5 (krb5): Using service principal "radius_auth/radiusawsw@" rlm_krb5 (krb5): Using keytab "FILE:/etc/raddb-checkpoint/radius_auth.keytab" rlm_krb5 (krb5): Initialising connection pool pool { start = 5 min = 3 max = 32 spare = 10 uses = 0 lifetime = 0 cleanup_interval = 30 idle_timeout = 0 retry_delay = 1 spread = no } rlm_krb5 (krb5): Opening additional connection (0), 1 of 32 pending slots used rlm_krb5 (krb5): Opening additional connection (1), 1 of 31 pending slots used rlm_krb5 (krb5): Opening additional connection (2), 1 of 30 pending slots used rlm_krb5 (krb5): Opening additional connection (3), 1 of 29 pending slots used rlm_krb5 (krb5): Opening additional connection (4), 1 of 28 pending slots used } # modules radiusd: #### Loading Virtual Servers #### server { # from file /etc/raddb-checkpoint/radiusd.conf } # server server inner-tunnel { # from file /etc/raddb-checkpoint/sites-enabled/inner-tunnel # Loading authenticate {...} # Loading authorize {...} Ignoring "sql" (see raddb/mods-available/README.rst) Ignoring "ldap" (see raddb/mods-available/README.rst) # Loading session {...} # Loading post-proxy {...} # Loading post-auth {...} # Skipping contents of 'if' as it is always 'false' -- /etc/raddb-checkpoint/sites-enabled/inner-tunnel:338 } # server inner-tunnel server default { # from file /etc/raddb-checkpoint/sites-enabled/default # Loading authenticate {...} # Loading authorize {...} # Loading preacct {...} # Loading accounting {...} # Loading post-proxy {...} # Loading post-auth {...} } # server default radiusd: #### Opening IP addresses and Ports #### Listening on auth address 10.120.3.175 port 1645 Listening on acct address 10.120.3.175 port 1646 Listening on proxy address * port 59986 Ready to process requests (0) Received Access-Request Id 6 from 129.219.12.155:44940 to 10.120.3.175:1645 length 50 (0) User-Name = "User" (0) User-Password = "Pwd" (0) NAS-IP-Address = 129.219.12.155 (0) ERROR: No Auth-Type found: rejecting the user via Post-Auth-Type = Reject (0) Failed to authenticate the user (0) Using Post-Auth-Type Reject (0) Post-Auth-Type sub-section not found. Ignoring. (0) Delaying response for 1.000000 seconds Waking up in 0.3 seconds. Waking up in 0.6 seconds. (0) Sending delayed response (0) Sent Access-Reject Id 6 from 10.120.3.175:1645 to 129.219.12.155:44940 length 20 Waking up in 3.9 seconds. (0) Cleaning up request packet ID 6 with timestamp +120 Ready to process requests

2 1

Returning Vendor Specific Attribute in radius reply
by Siddiqui Najam 22 Aug '17

22 Aug '17

Hi, I am trying to return a Cisco vendor specific attribute from a python module by adding it to the reply tuple as: (Attr-26, '0x00000009010f54657374417474726962757465') But I am getting the following error in the logs: Debug: authenticate - Failed: 'reply:Attr-26' '0x00000009010f54657374417474726962757465' Any ideas, how I can add VSA to the reply tuple from the python module? Thanks and Regards Najam ________________________________ This message and any attachments are intended solely for the addressees and may contain confidential information. Any unauthorized use or disclosure, either whole or partial, is prohibited. E-mails are susceptible to alteration. Our company shall not be liable for the message if altered, changed or falsified. If you are not the intended recipient of this message, please delete it and notify the sender. Although all reasonable efforts have been made to keep this transmission free from viruses, the sender will not be liable for damages caused by a transmitted virus.

2 3