- Freeradius-Users - lists.freeradius.org

Browser and Device information
by Safiullah Tariq 25 Jul '17

25 Jul '17

Dear All, I hope you are doing great. I want to know that when as user is authenticated via freeradius, is there a possibility that I can also get the clients device's type, browser information and other sort of info along with it. If yes, can anyone please point me - I will do my best to move in that direction. Regards, Safiullah Tariq PRIVILEGED AND CONFIDENTIAL INFORMATION: This e-mail and attachments, if any, may contain confidential and/or proprietary information. Please be advised that the unauthorized use or disclosure of the information is strictly prohibited. The information herein is intended only for use by the intended recipient(s) named above. If you have received this transmission in error, please notify the sender immediately and permanently delete the e-mail and any copies, printouts or attachments thereof.

4 4

Questions pam_radius and accounting logs
by Junk XL 24 Jul '17

24 Jul '17

I am trying to utilize the pam_radius client (1.4.0) on several RHEL 6 servers for authentication and accounting with ssh and sudo, against a Cisco ACS (ver 5.5) The authentication works as expected for both, however i am not seeing what i would expect in the accounting. My first question is, is there a setting that i am missing that enables pam_radius to send the full accounting back to the ACS? I do see the start/stop packets, however i only ever see the "sudo" issued as a NAS identifier, and never anything else. ==== output from /var/log/messages Jul 24 10:04:00 secutil sshd[6148]: Accepted password for test_user from XXX.XXX.XXX.XXX port 53291 ssh2 Jul 24 10:04:00 secutil sshd[6148]: error: ssh_selinux_setup_pty: security_compute_relabel: Invalid argument Jul 24 10:04:24 secutil sudo: pam_radius_auth: Got user name test_user Jul 24 10:04:24 secutil sudo: pam_radius_auth: ignore last_pass, force_prompt set Jul 24 10:04:29 secutil sudo: pam_radius_auth: Sending RADIUS request code 1 Jul 24 10:04:29 secutil sudo: pam_radius_auth: DEBUG: getservbyname(radius, udp) returned 0x7f3b816089a0. Jul 24 10:04:29 secutil sudo: pam_radius_auth: Got RADIUS response code 2 Jul 24 10:04:29 secutil sudo: pam_radius_auth: authentication succeeded Jul 24 10:04:29 secutil sudo: test_user : TTY=pts/1 ; PWD=/home/test_user ; USER=root ; COMMAND=/bin/cat /etc/named.conf ==== output from ACS Start Accounting Details : Diagnostics Details ACS Configuration Changes Logged At : Jul 24,17 10:04:29.336 AM ACS Time : Jul 24,17 10:04:29.313 AM ACS Server : scrubbed User Name : root Failure Reason : Identity Store : Identity Group : Network Device Name : Linux_Servers Network Device Group : Device Type:All Device Types, Location:All Locations Service Selection Rule Name : Access Service : Security Group : AD Domain : Authorization Profile: MAC Address : Endpoint IP Address : NAS IP Address : scrubbed NAS Port : 6171 NAS Port Id: NAS Identifier : sudo Account Status Type : Start Account Session Id : 00006171 Account MultiSession Id : Audit Session Id : ACS Session Id : scrubbed/230060300/66963046 Account Authentic : RADIUS Account Terminate Cause : Terminate Action : Account Interim Intervals : Account Delay Time : Account Session Time : Account Input Octets : Account Output Octets : Account Input Packets : Account Output Packets : Account Tunnel Connection : Account Tunnel Packet Lost : Session Timeout : Idle Timeout : Event Timestamp : Service Type : Response Time : 1 Class : Framed Protocol : Tunnel Details : Cisco H323 : Cisco SSG : Cisco-AvPairs : Other Attributes : ACSVersion=acs-5.5.0.46-B.723 ConfigVersionId=200 NAS-Port-Type=Virtual Device IP Address=scrubbed Audit Session Key root:sudo:6171 Steps Received RADIUS Accounting-Request RADIUS created a new session Evaluating Service Selection Policy Matched rule Selected Access Service - Accounting start was received for non-existing session. Returned RADIUS Accounting-Response ==== output from ACS Stop Accounting Details : Diagnostics Details ACS Configuration Changes Logged At : Jul 24,17 10:04:29.336 AM ACS Time : Jul 24,17 10:04:29.320 AM ACS Server : scrubbed User Name : root Failure Reason : Identity Store : Identity Group : Network Device Name : Linux_Servers Network Device Group : Device Type:All Device Types, Location:All Locations Service Selection Rule Name : Access Service : Security Group : AD Domain : Authorization Profile: MAC Address : Endpoint IP Address : NAS IP Address : scrubbed NAS Port : 6171 NAS Port Id: NAS Identifier : sudo Account Status Type : Stop Account Session Id : 00006171 Account MultiSession Id : Audit Session Id : ACS Session Id : scrubbed/230060300/66963047 Account Authentic : RADIUS Account Terminate Cause : Terminate Action : Account Interim Intervals : Account Delay Time : Account Session Time : 0 Account Input Octets : Account Output Octets : Account Input Packets : Account Output Packets : Account Tunnel Connection : Account Tunnel Packet Lost : Session Timeout : Idle Timeout : Event Timestamp : Service Type : Response Time : 1 Class : Framed Protocol : Tunnel Details : Cisco H323 : Cisco SSG : Cisco-AvPairs : Other Attributes : ACSVersion=acs-5.5.0.46-B.723 ConfigVersionId=200 NAS-Port-Type=Virtual Device IP Address=scrubbed Audit Session Key root:sudo:6171 Received RADIUS Accounting-Request RADIUS created a new session Evaluating Service Selection Policy Matched rule Selected Access Service - Audit session was not found. Returned RADIUS Accounting-Response ==== /etc/pam.d/sshd auth sufficient pam_radius_auth.so debug account sufficient pam_radius_auth.so debug session sufficient pam_radius_auth.so debug #auth include tacacs auth required pam_sepermit.so auth include password-auth #account include tacacs account required pam_nologin.so account include password-auth password include password-auth # pam_selinux.so close should be the first session rule #session include tacacs session required pam_selinux.so close session required pam_loginuid.so # pam_selinux.so open should only be followed by sessions to be executed in the user context session required pam_selinux.so open env_params session required pam_namespace.so session optional pam_keyinit.so force revoke session include password-auth ==== /etc/pam.d/sudo auth sufficient pam_radius_auth.so debug account sufficient pam_radius_auth.so debug session sufficient pam_radius_auth.so debug auth include system-auth account include system-auth password include system-auth session optional pam_keyinit.so revoke session required pam_limits.so /etc/raddb/server (scrubbed) XXX.XXX.XXX.XXX test 3 Am i just incorrect in my assumptions on what i think i should be seeing with the accounting? I know with other devices, I can see the full accounting commands issued, but i do not know if that is a limitation with Linux and pam_radius, or if i have something set incorrectly. Thanks in advance, GR

2 2

Re: LDAP group authentication
by Jake L. 23 Jul '17

23 Jul '17

Thanks again Bogdan and sorry for my long delay on this. If you or anyone else can assist in our question below that would be awesome. Just getting back to it with my co-workers and we are running into the following issue. We've set it up using your examples below, but it says it's unable to find the user via ldap. When we disable checking via the "memberOf" method, it is able to find the user. The part I may have wrong is the commented out section inside of the ldap stanza underneath 'update'. However, anything I uncommented there failed to work. Any thoughts? Here are our tests and setups: If anyone has any suggestions, please let me know (or if you need more details!). Much thanks!! Testing using radtest (on the same machine running radiusd -X): [root@radius-server ~]# radtest "intopstest" 'testing123' localhost 2 'secret' Sending Access-Request Id 139 from 0.0.0.0:45099 to 127.0.0.1:1812 User-Name = 'intopstest' User-Password = 'testing123' NAS-IP-Address = 100.64.67.30 NAS-Port = 2 Message-Authenticator = 0x00 Received Access-Reject Id 139 from 127.0.0.1:1812 to 127.0.0.1:45099 length 20 (0) -: Expected Access-Accept got Access-Reject LOG ERROR using radiusd -X: (snipped for readability) (0) ldap : EXPAND (|(&(uid=%{%{Stripped-User-Name}:-%{User-Name}})(memberOf=cn=netops_radius,cn=groups,cn=accounts,dc=example,dc=com))) (0) ldap : --> (|(&(uid=intopstest)(memberOf=cn=netops_radius,cn=groups,cn=accounts,dc=example,dc=com))) (0) ldap : EXPAND cn=users,cn=accounts,dc=example,dc=com (0) ldap : --> cn=users,cn=accounts,dc=example,dc=com (0) ldap : Performing search in 'cn=users,cn=accounts,dc=example,dc=com' with filter '(|(&(uid=intopstest)(memberOf=cn=netops_radius,cn=groups,cn=accounts,dc=example,dc=com)))', scope 'sub' (0) ldap : Waiting for search result... (0) ldap : Search returned no results rlm_ldap (ldap): Released connection (4) (0) [ldap] = notfound (0) if ((ok || updated) && User-Password) (0) if ((ok || updated) && User-Password) -> FALSE (0) [expiration] = noop (0) [logintime] = noop (0) ERROR: No Auth-Type found: rejecting the user via Post-Auth-Type = Reject (0) Failed to authenticate the user /etc/radiusd/mods-available/ldap: (snipped for readability) ldap { server = "ldap.lxi.example.com" port = 389 identity = "uid=svc_ovirt,cn=users,cn=accounts,dc=example,dc=com" password = "password" base_dn = "cn=users,cn=accounts,dc=example,dc=com" rad_group = "cn=netops_radius,cn=groups,cn=accounts,dc=example,dc=com" sasl { } update { control:Password-With-Header += 'userPassword' # control:NT-Password := 'ntPassword' # reply:Reply-Message := 'radiusReplyMessage' # reply:Tunnel-Type := 'radiusTunnelType' # reply:Tunnel-Medium-Type := 'radiusTunnelMediumType' # reply:Tunnel-Private-Group-ID := 'radiusTunnelPrivategroupId' # control: += 'radiusCheckAttributes' # reply: += 'radiusReplyAttributes' } user { base_dn = "${..base_dn}" filter = "(|(&(uid=%{%{Stripped-User-Name}:-%{User-Name}})(memberOf=${..rad_group})))" sasl { } # Search scope, may be 'base', 'one', sub' or 'children' scope = 'sub' } group { base_dn = "${..base_dn}" filter = "(objectClass=posixGroup)" memberUid=%{%{Stripped-User-Name}:-%{User-Name}}))" } ..... Thank you, Jake -------------------------------------------- On Wed, 6/28/17, Bogdan Rudas via Freeradius-Users <freeradius-users(a)lists.freeradius.org> wrote: Subject: Re: LDAP group authentication To: "FreeRadius users mailing list" <freeradius-users(a)lists.freeradius.org> Date: Wednesday, June 28, 2017, 3:23 AM Hi, Something like this: ldap { server = 'ldap.int' identity = 'cn=raidus-ro,ou=users,dc=company,dc=int' password = '12345' base_dn = 'ou=users,dc=company,dc=int' ldapgroup = 'cn=WiFi,ou=group,dc=company,dc=int' sasl { } update { control:Password-With-Header += 'userPassword' control: += 'radiusControlAttribute' request: += 'radiusRequestAttribute' reply: += 'radiusReplyAttribute' } user { base_dn = "${..base_dn}" filter = "(|(&(uid=%{%{Stripped-User-Name}:-%{User-Name}})(memberOf=${..ldapgroup})))" sasl { } } ...... cut here... On Tue, Jun 27, 2017 at 6:53 PM, Jake L. <jake_homs(a)yahoo.com> wrote: > Hi Bogdan, > Thank you for the information. This looks like a good method for us as > well. Are you setting up the 'ldapgroup' inside the group section of the > ldap module? If so, can you show me the stanza you're using? Thank you! > > > On Tuesday, June 27, 2017 1:20 AM, Bogdan Rudas via Freeradius-Users < > freeradius-users(a)lists.freeradius.org> wrote: > > > Hi Jake, > > We are useing *memberOf* in filter of "user { }" section in > */etc/freeradius/mods-available/ldap* > > user { > base_dn = "${..base_dn}" > > filter = > "(|(&(uid=%{%{Stripped-User-Name}:-%{User-Name}})( > memberOf=${..ldapgroup})))" > > sasl { > } > } > > I suspect FreeIPA have similar attribute for reverse group membership > lookups. > > On Tue, Jun 27, 2017 at 1:36 AM, Jake L. via Freeradius-Users < > freeradius-users(a)lists.freeradius.org> wrote: > > > Hello - I successfully got our Freeradius server to authenticate against > > our FreeIPA LDAP environment, allowing user access. Currently, all users > in > > here will be granted successful access. However, I'm having trouble > trying > > to identify what to setup to get only a single group in our FreeIPA > > environment allowed to authenticate while all other groups are denied. > In a > > nutshell, I want to only allow the "network-team" group authenticated > > access via the Freeradius server, and any/all other groups to be denied. > In > > my wiki and google searches, I've found reference to > "group_authorization", > > but I can't find that module in the policy.d or mods-available folder. > > Also, I've seen the reference to huntgroups, but only when queried > against > > SQL, which shouldn't be needed in my case. Can anyone point me in the > right > > direction to get this working? > > TL;DR = Need info on setting up Freeradius authentication to LDAP only > for > > a specific group, denying all other groups. > > Thank you!Jake > > - > > List info/subscribe/unsubscribe? See http://www.freeradius.org/ > > list/users.html > > > > > -- > Bogdan Rudas > Director of IT offshore > Exadel Inc. > http://www.exadel.com/ > E-mail: brudas(a)exadel.com > Skype ID: bogdan.rudas > > -- > > > CONFIDENTIALITY NOTICE: This email and files attached to it are > confidential. If you are not the intended recipient you are hereby > notified > that using, copying, distributing or taking any action in reliance on the > contents of this information is strictly prohibited. If you have received > this email in error please notify the sender and delete this email. > > - > List info/subscribe/unsubscribe? See http://www.freeradius.org/ > list/users.html > > > -- Bogdan Rudas Director of IT offshore Exadel Inc. http://www.exadel.com/ E-mail: brudas(a)exadel.com Skype ID: bogdan.rudas -- CONFIDENTIALITY NOTICE: This email and files attached to it are confidential. If you are not the intended recipient you are hereby notified that using, copying, distributing or taking any action in reliance on the contents of this information is strictly prohibited. If you have received this email in error please notify the sender and delete this email. - List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html

3 2

How freeradius responds in json format to the request to authorize
by Fiorella De Luca 23 Jul '17

23 Jul '17

Hello! I am a new Freeradius user. I'm participating in the Google Summer Code and I'm working on an OpenWISP project regarding the creation of a freeradius web interface. This app Django-freeradius will be a web interface to a manage freeradius database using a Django Rest framework . I I installed FreeRADIUS Version 3.0.12 on Ubuntu. I am using rlm_rest So I can configure freeradius to delegate some or all of its operations (authorization, authentication, accounting, mail order) to a REST API. But I can not understand how freeradius responds in json format to the request to authorize . I tried to accept the user with Auth-Type: = Accept And for the user to refuse: Auth-Type: = Reject but it does not work. If anyone could give me an explanation I'll be more than happy. Thank you!

3 2

Attr-26.135.22.100?
by Stefan Paetow 21 Jul '17

21 Jul '17

Hi Alan, Arran, After an upgrade to FR 3.0.15 on a test system, I suddenly have an unknown attribute 'Attr-26.135.22.100' in the debug output. It appears that EAP-Channel-Binding-Message is no longer recognised as such in the debug output? When I downgrade to 3.0.14 the issue persists, but when I drop back to 3.0.10 it recovers itself to say 'EAP-Channel-Binding-Message' in the debug output... Can someone else reproduce this with 3.0.15? I know this doesn't affect operations, but... it's irksome? *puzzled face* With Regards Stefan Paetow Moonshot Industry & Research Liaison Coordinator t: +44 (0)1235 822 125 gpg: 0x3FCE5142 xmpp: stefanp(a)jabber.dev.ja.net skype: stefan.paetow.janet jisc.ac.uk Jisc is a registered charity (number 1149740) and a company limited by guarantee which is registered in England under Company No. 5747339, VAT No. GB 197 0632 86. Jisc’s registered office is: One Castlepark, Tower Hill, Bristol, BS2 0JA. T 0203 697 5800.

2 4

Radsec config query
by Alex Sharaz 21 Jul '17

21 Jul '17

Been playing with RADSEC (FR3.0.15) and having gt stuff working thought I'd tidy up my config files so ... sites-enabled/tls has the following structure listen { ... clients = radsec limit { ... } tls { <my radse tls config> } } //end of listen clients radsec { .... } home_server tls .... home_server_pool ... realm ..... having sorted out the tls {..} section, I added a tls { $include our_tls/ } to my radiusd.conf file and copied the contents of my original tls section into /usr/local/etc/freeradius/our_tls/prodn2 as shown below prodn2 { <all tls config setting from original sites-enabled/tls file tls section> } In sites-enabled/tls I then replaced tls { .. } with tls = ${tls.prodn2} FR fails to start up with error Fri Jul 21 10:19:24 2017 : Error: /usr/local/etc/freeradius/sites-enabled/tls[87]: Client does not have the same TLS configuration as the listener Fri Jul 21 10:19:24 2017 : Error: /usr/local/etc/freeradius/sites-enabled/tls[7]: Failed to load clients for this listen section but all I've done is move the tls{..} contents into radiusd.conf tls {prodn2 {...}} and added a tls=${tls.prodn2} statement.

3 4

TCP - FR3 client/server connection timeout
by Edelberto Franco 21 Jul '17

21 Jul '17

With TCP/TLS I have a curious comportment Imagine this scenario: # server : port case (1) FR3:33001 -> radsecproxy:2083 case (2) radsecproxy: 44001 -> FR3:2083 For case (1) FR3 is the client, and radsecproxy is the server. Case (2) shows FR3 as a server of radsecproxy for TCP/TLS connections. In case (1) FR3 TCP connection always keeps ESTABLISHED with radsecproxy, but in case (2) FR3 closes its connection with radsecproxy (client) after less than 1 minute (sending a FIN, normal...). So, is it possible to set FR3 to don't send FIN and close the TCP connection with radsecproxy client? Thank you, --E

2 3

Missing groupname in radacct table
by Antonio Silva 21 Jul '17

21 Jul '17

Hi all, I've set the account query to include the groupname in radacct table but it expand the %{SQL-Group} to empty... any idea what i'm doing wrong? You can check the full configuration used for accounting in https://pastebin.com/dnEQRwUf But in resume i do: INSERT INTO ${....acct_table1} \ (${...column_list}) \ VALUES \ ('%{Acct-Session-Id}', \ '%{Acct-Unique-Session-Id}', \ '%{SQL-User-Name}', \ '%{SQL-Group}', \ '%{Realm}', \ ... In the log when authentication is done is see the group been set... But it inserts the groupname empty... (0) sql: Executing select query: SELECT groupname FROM radusergroup WHERE username = 'MyUSER' ORDER BY priority (0) sql: User found in the group table (0) sql: EXPAND SELECT id, groupname, attribute, Value, op FROM radgroupcheck WHERE groupname = '%{SQL-Group}' ORDER BY id (0) sql: --> SELECT id, groupname, attribute, Value, op FROM radgroupcheck WHERE groupname = 'group2' ORDER BY id (0) sql: Executing select query: SELECT id, groupname, attribute, Value, op FROM radgroupcheck WHERE groupname = 'group2' ORDER BY id (0) sql: Group "group2": Conditional check items matched (0) sql: Group "group2": Merging assignment check items (0) sql: Simultaneous-Use := 100 (0) sql: EXPAND SELECT id, groupname, attribute, value, op FROM radgroupreply WHERE groupname = '%{SQL-Group}' ORDER BY id (0) sql: --> SELECT id, groupname, attribute, value, op FROM radgroupreply WHERE groupname = 'group2' ORDER BY id (0) sql: Executing select query: SELECT id, groupname, attribute, value, op FROM radgroupreply WHERE groupname = 'group2' ORDER BY id (0) sql: Group "group2": Merging reply items ... (1) sql: EXPAND INSERT INTO radacct (acctsessionid, acctuniqueid, username, groupname, realm, nasipaddress, nasportid, nasporttype, acctstarttime, acctupdatetime, acctstoptime, acctsessiontime, acctauthentic, connectinfo_start, connectinfo_stop, acctinputoctets, acctoutputoctets, calledstationid, callingstationid, acctterminatecause, servicetype, framedprotocol, framedipaddress) VALUES ('%{Acct-Session-Id}', '%{Acct-Unique-Session-Id}', '%{SQL-User-Name}', '%{SQL-Group}', '%{Realm}', '%{NAS-IP-Address}', '%{%{NAS-Port-ID}:-%{NAS-Port}}', '%{NAS-Port-Type}', FROM_UNIXTIME(%{integer:Event-Timestamp}), FROM_UNIXTIME(%{integer:Event-Timestamp}), NULL, '0', '%{Acct-Authentic}', '%{Connect-Info}', '', '0', '0', '%{Called-Station-Id}', '%{Calling-Station-Id}', '', '%{Service-Type}', '%{Framed-Protocol}', '%{Framed-IP-Address}') (1) sql: --> INSERT INTO radacct (acctsessionid, acctuniqueid, username, groupname, realm, nasipaddress, nasportid, nasporttype, acctstarttime, acctupdatetime, acctstoptime, acctsessiontime, acctauthentic, connectinfo_start, connectinfo_stop, acctinputoctets, acctoutputoctets, calledstationid, callingstationid, acctterminatecause, servicetype, framedprotocol, framedipaddress) VALUES ('5971E477290A00', '3a3680e379da33a7ad1c8436a1f049ed', 'MyUSER', '', '', '127.0.1.1', '0', 'Async', FROM_UNIXTIME(1500636279), FROM_UNIXTIME(1500636279), NULL, '0', 'RADIUS', '', '', '0', '0', 'L2TP:telework_sol1', '', '', 'Framed-User', 'PPP', '192.168.10.200') (1) sql: Executing query: INSERT INTO radacct (acctsessionid, acctuniqueid, username, groupname, realm, nasipaddress, nasportid, nasporttype, acctstarttime, acctupdatetime, acctstoptime, acctsessiontime, acctauthentic, connectinfo_start, connectinfo_stop, acctinputoctets, acctoutputoctets, calledstationid, callingstationid, acctterminatecause, servicetype, framedprotocol, framedipaddress) VALUES ('5971E477290A00', '3a3680e379da33a7ad1c8436a1f049ed', 'MyUSER', '', '', '127.0.1.1', '0', 'Async', FROM_UNIXTIME(1500636279), FROM_UNIXTIME(1500636279), NULL, '0', 'RADIUS', '', '', '0', '0', 'L2TP:telework_sol1', '', '', 'Framed-User', 'PPP', '192.168.10.200') -- Saludos / Regards / Cumprimentos, António silva

2 2

Rotating detail files.
by Alex Sharaz 21 Jul '17

21 Jul '17

FR 3.0.14 Ubuntu 16.04 I'm creating a detail file which is used by an agent to upload contents into our logstash. detail detail-filebeat{ filename = /var/spool/freeradius/detail-filebeat escape_filenames = no permissions = 0600 # group = ${security.group} header = "%t" locking = yes suppress { User-Password } detail-fileberat invoked in both default and inner-tunnel sites Logrotate configured as /var/spool/freeradius/detail-filebeat { rotate 1 postrotate /bin/kill -HUP `cat /var/run/freeradius/freeradius.pid` endscript } Problem is that although logrotate rotates the file, freeradius isn't writing to the newly created file. A FR restart sorts it out but I'd rather not restart the server every day. I'm using radmin on another server to reread files periodically, might I be able to persuade FR to write to the new file via radadmin ? Rgds Alex

2 2

MySQL DB and /n in Cisco-AVPair problem
by Andy Smith 20 Jul '17

20 Jul '17

Hi everyone, we are attempting to migrate a system from FreeRadius 1.x to 3.x and we have an issue with our Cisco network devices. Basically authentication fails. Stepping back a bit and doing some testing with NTRadPing everything looks ok, except for one small detail. With both the 1.x and 3.x systems we get "response: Access-Accept" and a load of details such as Service-Type, Tunnel-Password etc. However I see differences for non printing characters such as "/n". So for the Cisco-AVPair in the output in NTRadPing I see on 1.x: lcp:interface-config=ip unnumbered loopback 2003\n But on 3.x I see: lcp:interface-config=ip unnumbered loopback 2003\0x0a The output from 1.x is exactly how the data is entered and displays direct in MySQL. I've tried double escaping the "\" but it doesn't make any difference. I see that 0x0a is the ASCII encoding for \n, has something changed in FreeRadius WRT this? Or perhaps its an issue at the MySQL level? I also note the output for the Tunnel-Password displays differently between 1.x and 3.x. I'm testing this on FreeBSD 11.0 and FreeRadius 3.0.14 and MySQL 8.0 (although I've previously encountered this issue with 5.x), thanks, Andy.

3 8