- Freeradius-Users - lists.freeradius.org

Change username for MSCHAPv2
by Gabriele Verzeletti 03 Jul '17

03 Jul '17

Hello, I have a freeradius 3.0.10-1.1 running on openSUSE leap. I need to authenticate users for WiFi access WPA2 Enterprise, using PEAP and MSCHAPv2 against Active directory. User account are identified by userPrinciplaName, but ntlm_auth is not able to authenticate using this attribute, it looks into samAccountName. With an external script I'm able to performa a query on active directory and retrieve the samAccountName, but if I update the attribute User-Name using authorize { update request { User-Name := `/path/to/my/script '%{User-Name}'` } .. .. .. I have an error in the log (0) # Executing group from file /etc/raddb/sites-enabled/default (0) authenticate { (0) eap: Identity does not match User-Name, setting from EAP Identity (0) eap: Failed in handler (0) [eap] = invalid (0) } # authenticate = invalid Is there any way to perform this account translation before send request to EAP ? Thanks to all Gab

3 7

Cannot authorize users other than default "John Doe"
by Brian Hogans 02 Jul '17

02 Jul '17

Im using free radius version 2.2.5 with daloradius on a raspberry pi model B as my server and I’m trying to authenticate users on my smartphones and PCs. When I use the “John Doe” pass= hello I am able to log on. But any other users I add on daloradius will not authenticate. They WILL authenticate on freeradius using radtest, but not when I actually try to log in on my smartphone. This seems like a strange issue to have and I can’t figure it out. Also i am using a netgear WNDR4500v2 with dd wrt as my NAS. I’m wondering if that is the issue. I’m using WPA2 enterprise with AES encryption for wifi. freeradius: FreeRADIUS Version 2.2.5, for host arm-unknown-linux-gnueabihf, built on Oct 25 2014 at 07:04:01 Copyright (C) 1999-2013 The FreeRADIUS server project and contributors. There is NO warranty; not even for MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. You may redistribute copies of FreeRADIUS under the terms of the GNU General Public License. For more information about these matters, see the file named COPYRIGHT. Starting - reading configuration files ... including configuration file /etc/freeradius/radiusd.conf including configuration file /etc/freeradius/proxy.conf including configuration file /etc/freeradius/clients.conf including files in directory /etc/freeradius/modules/ including configuration file /etc/freeradius/modules/detail including configuration file /etc/freeradius/modules/opendirectory including configuration file /etc/freeradius/modules/ippool including configuration file /etc/freeradius/modules/checkval including configuration file /etc/freeradius/modules/expr including configuration file /etc/freeradius/modules/chap including configuration file /etc/freeradius/modules/pap including configuration file /etc/freeradius/modules/realm including configuration file /etc/freeradius/modules/unix including configuration file /etc/freeradius/modules/attr_rewrite including configuration file /etc/freeradius/modules/files including configuration file /etc/freeradius/modules/expiration including configuration file /etc/freeradius/modules/linelog including configuration file /etc/freeradius/modules/mschap including configuration file /etc/freeradius/modules/detail.example.com including configuration file /etc/freeradius/modules/rediswho including configuration file /etc/freeradius/modules/digest including configuration file /etc/freeradius/modules/sql_log including configuration file /etc/freeradius/modules/exec including configuration file /etc/freeradius/modules/smbpasswd including configuration file /etc/freeradius/modules/smsotp including configuration file /etc/freeradius/modules/dynamic_clients including configuration file /etc/freeradius/modules/policy including configuration file /etc/freeradius/modules/replicate including configuration file /etc/freeradius/modules/sqlcounter_expire_on_login including configuration file /etc/freeradius/modules/perl including configuration file /etc/freeradius/modules/dhcp_sqlippool including configuration file /etc/freeradius/modules/cache including configuration file /etc/freeradius/modules/wimax including configuration file /etc/freeradius/modules/logintime including configuration file /etc/freeradius/modules/always including configuration file /etc/freeradius/modules/otp including configuration file /etc/freeradius/modules/radutmp including configuration file /etc/freeradius/modules/ldap including configuration file /etc/freeradius/modules/soh including configuration file /etc/freeradius/modules/radrelay including configuration file /etc/freeradius/modules/mac2ip including configuration file /etc/freeradius/modules/mac2vlan including configuration file /etc/freeradius/modules/sradutmp including configuration file /etc/freeradius/modules/passwd including configuration file /etc/freeradius/modules/inner-eap including configuration file /etc/freeradius/modules/ntlm_auth including configuration file /etc/freeradius/modules/redis including configuration file /etc/freeradius/modules/krb5 including configuration file /etc/freeradius/modules/counter including configuration file /etc/freeradius/modules/preprocess including configuration file /etc/freeradius/modules/detail.log including configuration file /etc/freeradius/modules/etc_group including configuration file /etc/freeradius/modules/pam including configuration file /etc/freeradius/modules/echo including configuration file /etc/freeradius/modules/acct_unique including configuration file /etc/freeradius/modules/attr_filter including configuration file /etc/freeradius/modules/cui including configuration file /etc/freeradius/eap.conf including configuration file /etc/freeradius/sql.conf including configuration file /etc/freeradius/sql/mysql/dialup.conf including configuration file /etc/freeradius/sql/mysql/counter.conf including configuration file /etc/freeradius/policy.conf including files in directory /etc/freeradius/sites-enabled/ including configuration file /etc/freeradius/sites-enabled/default including configuration file /etc/freeradius/sites-enabled/inner-tunnel main { user = "freerad" group = "freerad" allow_core_dumps = no } including dictionary file /etc/freeradius/dictionary main { name = "freeradius" prefix = "/usr" localstatedir = "/var" sbindir = "/usr/sbin" logdir = "/var/log/freeradius" run_dir = "/var/run/freeradius" libdir = "/usr/lib/freeradius" radacctdir = "/var/log/freeradius/radacct" hostname_lookups = no max_request_time = 30 cleanup_delay = 5 max_requests = 1024 pidfile = "/var/run/freeradius/freeradius.pid" checkrad = "/usr/sbin/checkrad" debug_level = 0 proxy_requests = yes log { stripped_names = no auth = no auth_badpass = no auth_goodpass = no } security { max_attributes = 200 reject_delay = 1 status_server = yes allow_vulnerable_openssl = no } } radiusd: #### Loading Realms and Home Servers #### proxy server { retry_delay = 5 retry_count = 3 default_fallback = no dead_time = 120 wake_all_if_all_dead = no } home_server localhost { ipaddr = 127.0.0.1 port = 1812 type = "auth" secret = "testing123" response_window = 20 max_outstanding = 65536 require_message_authenticator = yes zombie_period = 40 status_check = "status-server" ping_interval = 30 check_interval = 30 num_answers_to_alive = 3 num_pings_to_alive = 3 revive_interval = 120 status_check_timeout = 4 coa { irt = 2 mrt = 16 mrc = 5 mrd = 30 } } home_server_pool my_auth_failover { type = fail-over home_server = localhost } realm example.com { auth_pool = my_auth_failover } realm LOCAL { } radiusd: #### Loading Clients #### client localhost { ipaddr = 127.0.0.1 require_message_authenticator = no secret = "testing123" nastype = "other" } client 192.168.0.0/16 { require_message_authenticator = no secret = "testing123" shortname = "home" } radiusd: #### Instantiating modules #### instantiate { Module: Linked to module rlm_exec Module: Instantiating module "exec" from file /etc/freeradius/modules/exec exec { wait = no input_pairs = "request" shell_escape = yes timeout = 10 } Module: Linked to module rlm_expr Module: Instantiating module "expr" from file /etc/freeradius/modules/expr Module: Linked to module rlm_expiration Module: Instantiating module "expiration" from file /etc/freeradius/modules/expiration expiration { reply-message = "Password Has Expired " } Module: Linked to module rlm_logintime Module: Instantiating module "logintime" from file /etc/freeradius/modules/logintime logintime { reply-message = "You are calling outside your allowed timespan " minimum-timeout = 60 } } radiusd: #### Loading Virtual Servers #### server { # from file /etc/freeradius/radiusd.conf modules { Module: Creating Auth-Type = digest Module: Creating Post-Auth-Type = REJECT Module: Checking authenticate {...} for more modules to load Module: Linked to module rlm_pap Module: Instantiating module "pap" from file /etc/freeradius/modules/pap pap { encryption_scheme = "auto" auto_header = no } Module: Linked to module rlm_chap Module: Instantiating module "chap" from file /etc/freeradius/modules/chap Module: Linked to module rlm_mschap Module: Instantiating module "mschap" from file /etc/freeradius/modules/mschap mschap { use_mppe = yes require_encryption = no require_strong = no with_ntdomain_hack = no allow_retry = yes } Module: Linked to module rlm_digest Module: Instantiating module "digest" from file /etc/freeradius/modules/digest Module: Linked to module rlm_unix Module: Instantiating module "unix" from file /etc/freeradius/modules/unix unix { radwtmp = "/var/log/freeradius/radwtmp" } Module: Linked to module rlm_eap Module: Instantiating module "eap" from file /etc/freeradius/eap.conf eap { default_eap_type = "md5" timer_expire = 60 ignore_unknown_eap_types = no cisco_accounting_username_bug = no max_sessions = 1024 } Module: Linked to sub-module rlm_eap_md5 Module: Instantiating eap-md5 Module: Linked to sub-module rlm_eap_leap Module: Instantiating eap-leap Module: Linked to sub-module rlm_eap_gtc Module: Instantiating eap-gtc gtc { challenge = "Password: " auth_type = "PAP" } Module: Linked to sub-module rlm_eap_tls Module: Instantiating eap-tls tls { rsa_key_exchange = no dh_key_exchange = yes rsa_key_length = 512 dh_key_length = 512 verify_depth = 0 CA_path = "/etc/freeradius/certs" pem_file_type = yes private_key_file = "/etc/freeradius/certs/server.key" certificate_file = "/etc/freeradius/certs/server.pem" CA_file = "/etc/freeradius/certs/ca.pem" private_key_password = "whatever" dh_file = "/etc/freeradius/certs/dh" random_file = "/dev/urandom" fragment_size = 1024 include_length = yes check_crl = no cipher_list = "DEFAULT" make_cert_command = "/etc/freeradius/certs/bootstrap" ecdh_curve = "prime256v1" cache { enable = no lifetime = 24 max_entries = 255 } verify { } ocsp { enable = no override_cert_url = yes url = "http://127.0.0.1/ocsp/" use_nonce = yes timeout = 0 softfail = no } } Module: Linked to sub-module rlm_eap_ttls Module: Instantiating eap-ttls ttls { default_eap_type = "md5" copy_request_to_tunnel = no use_tunneled_reply = no virtual_server = "inner-tunnel" include_length = yes } Module: Linked to sub-module rlm_eap_peap Module: Instantiating eap-peap peap { default_eap_type = "mschapv2" copy_request_to_tunnel = no use_tunneled_reply = no proxy_tunneled_request_as_eap = yes virtual_server = "inner-tunnel" soh = no } Module: Linked to sub-module rlm_eap_mschapv2 Module: Instantiating eap-mschapv2 mschapv2 { with_ntdomain_hack = no send_error = no } Module: Checking authorize {...} for more modules to load Module: Linked to module rlm_preprocess Module: Instantiating module "preprocess" from file /etc/freeradius/modules/preprocess preprocess { huntgroups = "/etc/freeradius/huntgroups" hints = "/etc/freeradius/hints" with_ascend_hack = no ascend_channels_per_line = 23 with_ntdomain_hack = no with_specialix_jetstream_hack = no with_cisco_vsa_hack = no with_alvarion_vsa_hack = no } reading pairlist file /etc/freeradius/huntgroups reading pairlist file /etc/freeradius/hints Module: Linked to module rlm_realm Module: Instantiating module "suffix" from file /etc/freeradius/modules/realm realm suffix { format = "suffix" delimiter = "@" ignore_default = no ignore_null = no } Module: Linked to module rlm_sql Module: Instantiating module "sql" from file /etc/freeradius/sql.conf sql { driver = "rlm_sql_mysql" server = "localhost" port = "" login = "radiususer" password = "radiuspass" radius_db = "radiusdb" read_groups = yes sqltrace = no sqltracefile = "/var/log/freeradius/sqltrace.sql" readclients = no deletestalesessions = yes num_sql_socks = 32 lifetime = 0 max_queries = 0 sql_user_name = "%{User-Name}" default_user_profile = "" nas_query = "SELECT id, nasname, shortname, type, secret, server FROM nas" authorize_check_query = "SELECT id, username, attribute, value, op FROM radcheck WHERE username = '%{SQL-User-Name}' ORDER BY id" authorize_reply_query = "SELECT id, username, attribute, value, op FROM radreply WHERE username = '%{SQL-User-Name}' ORDER BY id" authorize_group_check_query = "SELECT id, groupname, attribute, Value, op FROM radgroupcheck WHERE groupname = '%{Sql-Group}' ORDER BY id" authorize_group_reply_query = "SELECT id, groupname, attribute, value, op FROM radgroupreply WHERE groupname = '%{Sql-Group}' ORDER BY id" accounting_onoff_query = " UPDATE radacct SET acctstoptime = '%S', acctsessiontime = unix_timestamp('%S') - unix_timestamp(acctstarttime), acctterminatecause = '%{Acct-Terminate-Cause}', acctstopdelay = %{%{Acct-Delay-Time}:-0} WHERE acctstoptime IS NULL AND nasipaddress = '%{NAS-IP-Address}' AND acctstarttime <= '%S'" accounting_update_query = " UPDATE radacct SET framedipaddress = '%{Framed-IP-Address}', acctsessiontime = '%{Acct-Session-Time}', acctinputoctets = '%{%{Acct-Input-Gigawords}:-0}' << 32 | '%{%{Acct-Input-Octets}:-0}', acctoutputoctets = '%{%{Acct-Output-Gigawords}:-0}' << 32 | '%{%{Acct-Output-Octets}:-0}' WHERE acctsessionid = '%{Acct-Session-Id}' AND username = '%{SQL-User-Name}' AND nasipaddress = '%{NAS-IP-Address}'" accounting_update_query_alt = " INSERT INTO radacct (acctsessionid, acctuniqueid, username, realm, nasipaddress, nasportid, nasporttype, acctstarttime, acctsessiontime, acctauthentic, connectinfo_start, acctinputoctets, acctoutputoctets, calledstationid, callingstationid, servicetype, framedprotocol, framedipaddress, acctstartdelay, xascendsessionsvrkey) VALUES ('%{Acct-Session-Id}', '%{Acct-Unique-Session-Id}', '%{SQL-User-Name}', '%{Realm}', '%{NAS-IP-Address}', '%{NAS-Port}', '%{NAS-Port-Type}', DATE_SUB('%S', INTERVAL (%{%{Acct-Session-Time}:-0} + %{%{Acct-Delay-Time}:-0}) SECOND), '%{Acct-Session-Time}', '%{Acct-Authentic}', '', '%{%{Acct-Input-Gigawords}:-0}' << 32 | '%{%{Acct-Input-Octets}:-0}', '%{%{Acct-Output-Gigawords}:-0}' << 32 | '%{%{Acct-Output-Octets}:-0}', '%{Called-Station-Id}', '%{Calling-Station-Id}', '%{Service-Type}', '%{Framed-Protocol}', '%{Framed-IP-Address}', '0', '%{X-Ascend-Session-Svr-Key}')" accounting_start_query = " INSERT INTO radacct (acctsessionid, acctuniqueid, username, realm, nasipaddress, nasportid, nasporttype, acctstarttime, acctstoptime, acctsessiontime, acctauthentic, connectinfo_start, connectinfo_stop, acctinputoctets, acctoutputoctets, calledstationid, callingstationid, acctterminatecause, servicetype, framedprotocol, framedipaddress, acctstartdelay, acctstopdelay, xascendsessionsvrkey) VALUES ('%{Acct-Session-Id}', '%{Acct-Unique-Session-Id}', '%{SQL-User-Name}', '%{Realm}', '%{NAS-IP-Address}', '%{NAS-Port}', '%{NAS-Port-Type}', '%S', NULL, '0', '%{Acct-Authentic}', '%{Connect-Info}', '', '0', '0', '%{Called-Station-Id}', '%{Calling-Station-Id}', '', '%{Service-Type}', '%{Framed-Protocol}', '%{Framed-IP-Address}', '%{%{Acct-Delay-Time}:-0}', '0', '%{X-Ascend-Session-Svr-Key}')" accounting_start_query_alt = " UPDATE radacct SET acctstarttime = '%S', acctstartdelay = '%{%{Acct-Delay-Time}:-0}', connectinfo_start = '%{Connect-Info}' WHERE acctsessionid = '%{Acct-Session-Id}' AND username = '%{SQL-User-Name}' AND nasipaddress = '%{NAS-IP-Address}'" accounting_stop_query = " UPDATE radacct SET acctstoptime = '%S', acctsessiontime = '%{Acct-Session-Time}', acctinputoctets = '%{%{Acct-Input-Gigawords}:-0}' << 32 | '%{%{Acct-Input-Octets}:-0}', acctoutputoctets = '%{%{Acct-Output-Gigawords}:-0}' << 32 | '%{%{Acct-Output-Octets}:-0}', acctterminatecause = '%{Acct-Terminate-Cause}', acctstopdelay = '%{%{Acct-Delay-Time}:-0}', connectinfo_stop = '%{Connect-Info}' WHERE acctsessionid = '%{Acct-Session-Id}' AND username = '%{SQL-User-Name}' AND nasipaddress = '%{NAS-IP-Address}'" accounting_stop_query_alt = " INSERT INTO radacct (acctsessionid, acctuniqueid, username, realm, nasipaddress, nasportid, nasporttype, acctstarttime, acctstoptime, acctsessiontime, acctauthentic, connectinfo_start, connectinfo_stop, acctinputoctets, acctoutputoctets, calledstationid, callingstationid, acctterminatecause, servicetype, framedprotocol, framedipaddress, acctstartdelay, acctstopdelay) VALUES ('%{Acct-Session-Id}', '%{Acct-Unique-Session-Id}', '%{SQL-User-Name}', '%{Realm}', '%{NAS-IP-Address}', '%{NAS-Port}', '%{NAS-Port-Type}', DATE_SUB('%S', INTERVAL (%{%{Acct-Session-Time}:-0} + %{%{Acct-Delay-Time}:-0}) SECOND), '%S', '%{Acct-Session-Time}', '%{Acct-Authentic}', '', '%{Connect-Info}', '%{%{Acct-Input-Gigawords}:-0}' << 32 | '%{%{Acct-Input-Octets}:-0}', '%{%{Acct-Output-Gigawords}:-0}' << 32 | '%{%{Acct-Output-Octets}:-0}', '%{Called-Station-Id}', '%{Calling-Station-Id}', '%{Acct-Terminate-Cause}', '%{Service-Type}', '%{Framed-Protocol}', '%{Framed-IP-Address}', '0', '%{%{Acct-Delay-Time}:-0}')" group_membership_query = "SELECT groupname FROM radusergroup WHERE username = '%{SQL-User-Name}' ORDER BY priority" connect_failure_retry_delay = 60 simul_count_query = "" simul_verify_query = "SELECT radacctid, acctsessionid, username, nasipaddress, nasportid, framedipaddress, callingstationid, framedprotocol FROM radacct WHERE username = '%{SQL-User-Name}' AND acctstoptime IS NULL" postauth_query = "INSERT INTO radpostauth (username, pass, reply, authdate) VALUES ( '%{User-Name}', '%{%{User-Password}:-%{Chap-Password}}', '%{reply:Packet-Type}', '%S')" safe-characters = "@abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ0123456789.-_: /" } rlm_sql (sql): Driver rlm_sql_mysql (module rlm_sql_mysql) loaded and linked rlm_sql (sql): Attempting to connect to radiususer@localhost:/radiusdb rlm_sql (sql): starting 0 rlm_sql (sql): Attempting to connect rlm_sql_mysql #0 rlm_sql_mysql: Starting connect to MySQL server for #0 rlm_sql (sql): Connected new DB handle, #0 rlm_sql (sql): starting 1 rlm_sql (sql): Attempting to connect rlm_sql_mysql #1 rlm_sql_mysql: Starting connect to MySQL server for #1 rlm_sql (sql): Connected new DB handle, #1 rlm_sql (sql): starting 2 rlm_sql (sql): Attempting to connect rlm_sql_mysql #2 rlm_sql_mysql: Starting connect to MySQL server for #2 rlm_sql (sql): Connected new DB handle, #2 rlm_sql (sql): starting 3 rlm_sql (sql): Attempting to connect rlm_sql_mysql #3 rlm_sql_mysql: Starting connect to MySQL server for #3 rlm_sql (sql): Connected new DB handle, #3 rlm_sql (sql): starting 4 rlm_sql (sql): Attempting to connect rlm_sql_mysql #4 rlm_sql_mysql: Starting connect to MySQL server for #4 rlm_sql (sql): Connected new DB handle, #4 rlm_sql (sql): starting 5 rlm_sql (sql): Attempting to connect rlm_sql_mysql #5 rlm_sql_mysql: Starting connect to MySQL server for #5 rlm_sql (sql): Connected new DB handle, #5 rlm_sql (sql): starting 6 rlm_sql (sql): Attempting to connect rlm_sql_mysql #6 rlm_sql_mysql: Starting connect to MySQL server for #6 rlm_sql (sql): Connected new DB handle, #6 rlm_sql (sql): starting 7 rlm_sql (sql): Attempting to connect rlm_sql_mysql #7 rlm_sql_mysql: Starting connect to MySQL server for #7 rlm_sql (sql): Connected new DB handle, #7 rlm_sql (sql): starting 8 rlm_sql (sql): Attempting to connect rlm_sql_mysql #8 rlm_sql_mysql: Starting connect to MySQL server for #8 rlm_sql (sql): Connected new DB handle, #8 rlm_sql (sql): starting 9 rlm_sql (sql): Attempting to connect rlm_sql_mysql #9 rlm_sql_mysql: Starting connect to MySQL server for #9 rlm_sql (sql): Connected new DB handle, #9 rlm_sql (sql): starting 10 rlm_sql (sql): Attempting to connect rlm_sql_mysql #10 rlm_sql_mysql: Starting connect to MySQL server for #10 rlm_sql (sql): Connected new DB handle, #10 rlm_sql (sql): starting 11 rlm_sql (sql): Attempting to connect rlm_sql_mysql #11 rlm_sql_mysql: Starting connect to MySQL server for #11 rlm_sql (sql): Connected new DB handle, #11 rlm_sql (sql): starting 12 rlm_sql (sql): Attempting to connect rlm_sql_mysql #12 rlm_sql_mysql: Starting connect to MySQL server for #12 rlm_sql (sql): Connected new DB handle, #12 rlm_sql (sql): starting 13 rlm_sql (sql): Attempting to connect rlm_sql_mysql #13 rlm_sql_mysql: Starting connect to MySQL server for #13 rlm_sql (sql): Connected new DB handle, #13 rlm_sql (sql): starting 14 rlm_sql (sql): Attempting to connect rlm_sql_mysql #14 rlm_sql_mysql: Starting connect to MySQL server for #14 rlm_sql (sql): Connected new DB handle, #14 rlm_sql (sql): starting 15 rlm_sql (sql): Attempting to connect rlm_sql_mysql #15 rlm_sql_mysql: Starting connect to MySQL server for #15 rlm_sql (sql): Connected new DB handle, #15 rlm_sql (sql): starting 16 rlm_sql (sql): Attempting to connect rlm_sql_mysql #16 rlm_sql_mysql: Starting connect to MySQL server for #16 rlm_sql (sql): Connected new DB handle, #16 rlm_sql (sql): starting 17 rlm_sql (sql): Attempting to connect rlm_sql_mysql #17 rlm_sql_mysql: Starting connect to MySQL server for #17 rlm_sql (sql): Connected new DB handle, #17 rlm_sql (sql): starting 18 rlm_sql (sql): Attempting to connect rlm_sql_mysql #18 rlm_sql_mysql: Starting connect to MySQL server for #18 rlm_sql (sql): Connected new DB handle, #18 rlm_sql (sql): starting 19 rlm_sql (sql): Attempting to connect rlm_sql_mysql #19 rlm_sql_mysql: Starting connect to MySQL server for #19 rlm_sql (sql): Connected new DB handle, #19 rlm_sql (sql): starting 20 rlm_sql (sql): Attempting to connect rlm_sql_mysql #20 rlm_sql_mysql: Starting connect to MySQL server for #20 rlm_sql (sql): Connected new DB handle, #20 rlm_sql (sql): starting 21 rlm_sql (sql): Attempting to connect rlm_sql_mysql #21 rlm_sql_mysql: Starting connect to MySQL server for #21 rlm_sql (sql): Connected new DB handle, #21 rlm_sql (sql): starting 22 rlm_sql (sql): Attempting to connect rlm_sql_mysql #22 rlm_sql_mysql: Starting connect to MySQL server for #22 rlm_sql (sql): Connected new DB handle, #22 rlm_sql (sql): starting 23 rlm_sql (sql): Attempting to connect rlm_sql_mysql #23 rlm_sql_mysql: Starting connect to MySQL server for #23 rlm_sql (sql): Connected new DB handle, #23 rlm_sql (sql): starting 24 rlm_sql (sql): Attempting to connect rlm_sql_mysql #24 rlm_sql_mysql: Starting connect to MySQL server for #24 rlm_sql (sql): Connected new DB handle, #24 rlm_sql (sql): starting 25 rlm_sql (sql): Attempting to connect rlm_sql_mysql #25 rlm_sql_mysql: Starting connect to MySQL server for #25 rlm_sql (sql): Connected new DB handle, #25 rlm_sql (sql): starting 26 rlm_sql (sql): Attempting to connect rlm_sql_mysql #26 rlm_sql_mysql: Starting connect to MySQL server for #26 rlm_sql (sql): Connected new DB handle, #26 rlm_sql (sql): starting 27 rlm_sql (sql): Attempting to connect rlm_sql_mysql #27 rlm_sql_mysql: Starting connect to MySQL server for #27 rlm_sql (sql): Connected new DB handle, #27 rlm_sql (sql): starting 28 rlm_sql (sql): Attempting to connect rlm_sql_mysql #28 rlm_sql_mysql: Starting connect to MySQL server for #28 rlm_sql (sql): Connected new DB handle, #28 rlm_sql (sql): starting 29 rlm_sql (sql): Attempting to connect rlm_sql_mysql #29 rlm_sql_mysql: Starting connect to MySQL server for #29 rlm_sql (sql): Connected new DB handle, #29 rlm_sql (sql): starting 30 rlm_sql (sql): Attempting to connect rlm_sql_mysql #30 rlm_sql_mysql: Starting connect to MySQL server for #30 rlm_sql (sql): Connected new DB handle, #30 rlm_sql (sql): starting 31 rlm_sql (sql): Attempting to connect rlm_sql_mysql #31 rlm_sql_mysql: Starting connect to MySQL server for #31 rlm_sql (sql): Connected new DB handle, #31 Module: Checking preacct {...} for more modules to load Module: Linked to module rlm_acct_unique Module: Instantiating module "acct_unique" from file /etc/freeradius/modules/acct_unique acct_unique { key = "User-Name, Acct-Session-Id, NAS-IP-Address, NAS-Identifier, NAS-Port" } Module: Linked to module rlm_files Module: Instantiating module "files" from file /etc/freeradius/modules/files files { usersfile = "/etc/freeradius/users" acctusersfile = "/etc/freeradius/acct_users" preproxy_usersfile = "/etc/freeradius/preproxy_users" compat = "no" } reading pairlist file /etc/freeradius/users reading pairlist file /etc/freeradius/acct_users reading pairlist file /etc/freeradius/preproxy_users Module: Checking accounting {...} for more modules to load Module: Linked to module rlm_detail Module: Instantiating module "detail" from file /etc/freeradius/modules/detail detail { detailfile = "/var/log/freeradius/radacct/%{%{Packet-Src-IP-Address}:-%{Packet-Src-IPv6-Address}}/detail-%Y%m%d" header = "%t" detailperm = 384 dirperm = 493 locking = no log_packet_header = no } Module: Linked to module rlm_attr_filter Module: Instantiating module "attr_filter.accounting_response" from file /etc/freeradius/modules/attr_filter attr_filter attr_filter.accounting_response { attrsfile = "/etc/freeradius/attrs.accounting_response" key = "%{User-Name}" relaxed = no } reading pairlist file /etc/freeradius/attrs.accounting_response Module: Checking session {...} for more modules to load Module: Linked to module rlm_radutmp Module: Instantiating module "radutmp" from file /etc/freeradius/modules/radutmp radutmp { filename = "/var/log/freeradius/radutmp" username = "%{User-Name}" case_sensitive = yes check_with_nas = yes perm = 384 callerid = yes } Module: Checking post-proxy {...} for more modules to load Module: Checking post-auth {...} for more modules to load Module: Instantiating module "attr_filter.access_reject" from file /etc/freeradius/modules/attr_filter attr_filter attr_filter.access_reject { attrsfile = "/etc/freeradius/attrs.access_reject" key = "%{User-Name}" relaxed = no } reading pairlist file /etc/freeradius/attrs.access_reject } # modules } # server server inner-tunnel { # from file /etc/freeradius/sites-enabled/inner-tunnel modules { Module: Checking authenticate {...} for more modules to load Module: Checking authorize {...} for more modules to load Module: Checking session {...} for more modules to load Module: Checking post-proxy {...} for more modules to load Module: Checking post-auth {...} for more modules to load } # modules } # server radiusd: #### Opening IP addresses and Ports #### listen { type = "auth" ipaddr = * port = 0 } listen { type = "acct" ipaddr = * port = 0 } listen { type = "auth" ipaddr = 127.0.0.1 port = 18120 } ... adding new socket proxy address * port 44987 Listening on authentication address * port 1812 Listening on accounting address * port 1813 Listening on authentication address 127.0.0.1 port 18120 as server inner-tunnel Listening on proxy address * port 1814 Ready to process requests. _________________________________________________________________________ root@radiuspi:/home/pi# radtest "test" test123 localhost 0 testing123 Sending Access-Request of id 62 to 127.0.0.1 port 1812 User-Name = "test" User-Password = "test123" NAS-IP-Address = 127.0.1.1 NAS-Port = 0 Message-Authenticator = 0x00000000000000000000000000000000 rad_recv: Access-Accept packet from host 127.0.0.1 port 1812, id=62, length=20

2 12

getting access-reject not sure why
by Andrew Meyer 30 Jun '17

30 Jun '17

So I decided to blow away my FreeRADIUS v3 setup to authenticate from my cisco devices. I am doing this for documentation purposes. I am currently running CentOS 7.3. Here is what I have in my users file: test1 Cleartext-Password := "hello" Service-Type = Administrative-User, Auth-Type := Accept, Reply-Message := "Hello, %{User-Name}", Cisco-AVPair = "shell:roles=network-admin", Cisco-AVPair = "shell:priv-lvl=15" Here is my clients config: clients network-equipment { ipaddr = 10.150.1.0/24 secret = Infotech5! nas_type = cisco shortname = network-equipment } clients linux-servers { ipaddr = 10.150.10.0/24 secret = Infotech5! proto = * nas_type = other shortname = linux-servers } Everything else is default. Here is the debug output log: Ready to process requests Waking up in 0.3 seconds. (1) Received Access-Request packet from host 10.150.1.213 port 1645, id=11, length=98 (1) User-Name = 'test1' (1) Reply-Message = 'Password: ' (1) User-Password = '\305ɥ\273\306\335\026\257l{\033)z\017\343o' (1) NAS-Port = 1 (1) NAS-Port-Type = Virtual (1) Calling-Station-Id = '10.150.1.250' (1) NAS-IP-Address = 10.150.1.213 (1) NAS-Identifier = 'ASMCAP1' (1) # Executing section authorize from file /etc/raddb/sites-enabled/default (1) # Executing group from file /etc/raddb/sites-enabled/default (1) pap : Login attempt with password (1) ERROR: pap : Cleartext password does not match "known good" password (1) pap : Passwords don't match (1) # Executing group from file /etc/raddb/sites-enabled/default Waking up in 0.6 seconds. (1) Sending Access-Reject packet to host 10.150.1.213 port 1645, id=11, length=0 (1) Reply-Message = 'Hello, test1' Waking up in 3.9 seconds. Ready to process requests Waking up in 0.3 seconds. (2) Received Access-Request packet from host 10.150.1.213 port 1645, id=11, length=98 (2) User-Name = 'test1' (2) Reply-Message = 'Password: ' (2) User-Password = '\305ɥ\273\306\335\026\257l{\033)z\017\343o' (2) NAS-Port = 1 (2) NAS-Port-Type = Virtual (2) Calling-Station-Id = '10.150.1.250' (2) NAS-IP-Address = 10.150.1.213 (2) NAS-Identifier = 'ASMCAP1' (2) # Executing section authorize from file /etc/raddb/sites-enabled/default (2) # Executing group from file /etc/raddb/sites-enabled/default (2) pap : Login attempt with password (2) ERROR: pap : Cleartext password does not match "known good" password (2) pap : Passwords don't match (2) # Executing group from file /etc/raddb/sites-enabled/default Waking up in 0.6 seconds. (2) Sending Access-Reject packet to host 10.150.1.213 port 1645, id=11, length=0 (2) Reply-Message = 'Hello, test1' Waking up in 3.9 seconds. I don't understand why i'm getting a denied packet.

4 12

Linux PAM Authentication failed: Non-Local users
by Anand Neeli 30 Jun '17

30 Jun '17

Hello, I'm sure my query might have already been discussed. But couldnt search the mailing list. Can anyone please show pointers or answer this? I'm trying to perform Radius based authentication of any guest user using Linux PAM module 1.0 As radius client, pam_radius-1.3.17 plugin is used and freeradius server is used as Radius Server. I have performed the Radius client and server configurations according to the guidelines. I added the radius entry in /etc/pam.d/sshd: #%PAM-1.0 auth sufficient /lib/security/pam_radius_auth.so debug While i am trying of perform authentication of users, following are the outcomes depending upon user (trying to login) is locally configured or not. Users are trying to log-in via ssh. Both Users A and B are configured in Radius Server 1. If user A (locally configured in Linux M/C) tries to login, then Linux PAM gets the user/password information and send it to radius server. Radius Server authenticates the user/password in its database and sends successful acknowledgement to linux m/c. User is allowed to login. 2. If user B (not configured in Linux M/C) login, then Authentication is being rejected by Radius Server. Radius Server logs are showing that password in either malformed/incorrect ********************************************************************************************************************************************************************************************************************* Radius Server Logs: rad_recv: Access-Request packet from host 127.0.0.1:27138, id=117, length=91 User-Name = "abcd" User-Password = "\010\n\INCORRECT" NAS-IP-Address = 172.21.142.4 NAS-Identifier = "linux" NAS-Port = 26113 NAS-Port-Type = Virtual Service-Type = Authenticate-Only Calling-Station-Id = "172.21.142.140" Processing the authorize section of radiusd.conf modcall: entering group authorize for request 0 modcall[authorize]: module "preprocess" returns ok for request 0 modcall[authorize]: module "chap" returns noop for request 0 modcall[authorize]: module "mschap" returns noop for request 0 rlm_realm: No '@' in User-Name = "abcd", looking up realm NULL rlm_realm: No such realm "NULL" modcall[authorize]: module "suffix" returns noop for request 0 rlm_eap: No EAP-Message, not doing EAP modcall[authorize]: module "eap" returns noop for request 0 modcall[authorize]: module "files" returns notfound for request 0 modcall: group authorize returns ok for request 0 auth: No authenticate method (Auth-Type) configuration found for the request: Rejecting the user auth: Failed to validate the user. Login incorrect: [abcd/\010\n\INCORRECT] (from client localhost port 26113 cli 172.21.142.140) WARNING: Unprintable characters in the password. ? Double-check the shared secret on the server and the NAS! ********************************************************************************************************************************************************************************************************************* SSHD Logs: May 27 13:14:07 localho sshd[26113]: debug1: PAM: initializing for "abcd" May 27 13:14:07 localho sshd[26113]: debug1: PAM: setting PAM_RHOST to "172.21.142.140" May 27 13:14:07 localho sshd[26113]: debug1: PAM: setting PAM_TTY to "ssh" May 27 13:14:09 localho sshd[26113]: pam_radius_auth: Got user name abcd May 27 13:14:09 localho sshd[26113]: pam_radius_auth: Sending RADIUS request code 1 May 27 13:14:09 localho sshd[26113]: pam_radius_auth: DEBUG: getservbyname(radius, udp) returned -1768845152. May 27 13:14:10 localho sshd[26113]: pam_radius_auth: RADIUS server 127.0.0.1 failed to respond May 27 13:14:10 localho sshd[26113]: pam_radius_auth: All RADIUS servers failed to respond. May 27 13:14:10 localho sshd[26113]: pam_radius_auth: authentication failed May 27 13:14:10 localho sshd(pam_unix)[26113]: check pass; user unknown May 27 13:14:10 localho sshd(pam_unix)[26113]: authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=172.21.142.140 May 27 13:14:13 localho sshd[26113]: debug1: PAM: password authentication failed for an illegal user: Authentication failure May 27 13:14:13 localho sshd[26113]: Failed password for invalid user abcd from ::ffff:172.21.142.140 port 36124 ssh2 ********************************************************************************************************************************************************************************************************************* After reading through couple of forums, i got the hint this is the way PAM works. Linux PAM has restriction to have user-id configured locally on Linux M/C for successful Radius Authentication But if we have the case of thousands of guest users, then it is not possible to add every user in machine itself. I am willing to know: 1. Is this is the way how PAM works. Is this limitation is present in PAM 2. I am using Linux PAM 1.0. Is there any patch/fix available in higher version of PAM? 3. Is there any way to overcome this issue by using some other libpam-radius-auth plugin. Though i do not think it is Radius client plugin issue. It will be really helpful if you can help/suggest me in this regards. Regards, Anand Neeli

2 5

LDAPS problem while migrating from 2 to 3
by Olivier 30 Jun '17

30 Jun '17

Hi, I have a working environment based on FreeRadius 2.2 and OpenLDAP 2.4. It binds to the LDAP server on ldaps://ldap.cs.ait.ac.th/ I am trying to upgrade to FreeRadius (3.0.14) and if I can bind to ldap://..., I cannot bind to ldaps://... Thu Jun 29 13:12:38 2017 : Debug: # Instantiating module "ldap_firewall" from file /usr/local/etc/raddb/mods-enabled/ldap Thu Jun 29 13:12:38 2017 : Info: rlm_ldap: libldap vendor: OpenLDAP, version: 20441 Thu Jun 29 13:12:38 2017 : Debug: rlm_ldap (ldap_firewall): Couldn't find configuration for accounting, will return NOOP for calls from this section Thu Jun 29 13:12:38 2017 : Debug: rlm_ldap (ldap_firewall): Couldn't find configuration for post-auth, will return NOOP for calls from this section Thu Jun 29 13:12:38 2017 : Debug: LDAP server string: ldaps://ldap.cs.ait.ac.th:636 Thu Jun 29 13:12:38 2017 : Debug: rlm_ldap (ldap_firewall): Using local pool section Thu Jun 29 13:12:38 2017 : Debug: rlm_ldap (ldap_firewall): No pool reference found for config item "ldap_firewall.pool" Thu Jun 29 13:12:38 2017 : Debug: rlm_ldap (ldap_firewall): Initialising connection pool ... Thu Jun 29 13:12:38 2017 : Info: rlm_ldap (ldap_firewall): Opening additional connection (0), 1 of 32 pending slots used Thu Jun 29 13:12:38 2017 : Debug: rlm_ldap (ldap_firewall): Connecting to ldaps://ldap.cs.ait.ac.th:636 Thu Jun 29 13:12:38 2017 : Debug: rlm_ldap (ldap_firewall): New libldap handle 0x28e5c1e0 Thu Jun 29 13:12:38 2017 : Error: rlm_ldap (ldap_firewall): Bind with (anonymous) to ldaps://ldap.cs.ait.ac.th:636 failed: Can't contact LDAP server Thu Jun 29 13:12:38 2017 : Debug: rlm_ldap: Closing libldap handle 0x28e5c1e0 Thu Jun 29 13:12:38 2017 : Error: rlm_ldap (ldap_firewall): Opening connection failed (0) Thu Jun 29 13:12:38 2017 : Debug: rlm_ldap (ldap_firewall): Removing connection pool Thu Jun 29 13:12:38 2017 : Error: /usr/local/etc/raddb/mods-enabled/ldap[1]: Instantiation failed for module "ldap_firewall" What could I be missing? I found a reference about OpenLDAP being compiled with NSS, but being on FreeBSD, I am pretty sure that both OpenLDAP and FreeRadius us openssl. TIA, Olivier --

3 4

add attribute when proxying
by denis 29 Jun '17

29 Jun '17

Hello, I have setup made according to robust proxy accounting guide. Now I need freeradius to add Tmp-String-1 attribute to each Access-Request sent to proxy. I tried using policy conf and ulang in robust-proxy-accounting config, but request sent to proxy is still unmodified One of log examples (just for curiosity i'm trying update both - proxy-request and request: (0) server home.mycompany.com { (0) # Executing section pre-proxy from file /etc/freeradius/sites-enabled/robust-proxy-accounting (0) pre-proxy { (0) policy add-attribute { (0) update request { (0) Tmp-String-1 := 1111111 (0) } # update request = noop (0) update proxy-request { (0) Tmp-String-1 := 1111111 (0) } # update proxy-request = noop (0) } # policy add-attribute = noop (0) policy debug_proxy_request { (0) if ("%{debug_attr:proxy-request:}" == '') { (0) Attributes matching "proxy-request:" (0) &proxy-request:User-Name = username (0) &proxy-request:User-Password = password (0) &proxy-request:NAS-Identifier = nasid (0) &proxy-request:Framed-Protocol = PPP (0) &proxy-request:Service-Type = Framed-User (0) &proxy-request:Event-Timestamp = Jun 29 2017 13:51:01 UTC (0) &proxy-request:NAS-IP-Address = 185.7.90.32 (0) &proxy-request:Message-Authenticator := 0x00 (0) &proxy-request:Proxy-State = 0x313636 (0) &proxy-request:Tmp-String-1 := 1111111 (0) EXPAND %{debug_attr:proxy-request:} (0) --> (0) if ("%{debug_attr:proxy-request:}" == '') -> TRUE (0) if ("%{debug_attr:proxy-request:}" == '') { (0) [noop] = noop (0) } # if ("%{debug_attr:proxy-request:}" == '') = noop (0) } # policy debug_proxy_request = noop (0) } # pre-proxy = noop (0) } (0) Proxying request to home server 138.7.90.9 port 1812 timeout 30.000000 (0) Sent Access-Request Id 19 from 0.0.0.0:30848 to 138.7.90.9:1812 length 101 (0) User-Name = "username" (0) User-Password = "password" (0) NAS-Identifier = "nasid" (0) Framed-Protocol = PPP (0) Service-Type = Framed-User (0) Event-Timestamp = "Jun 29 2017 13:51:01 UTC" (0) NAS-IP-Address = 185.7.90.32 (0) Message-Authenticator := 0x00 (0) Proxy-State = 0x313636 Waking up in 0.3 seconds. As you see proxied request is unchaged, while debug output above states attribute was added. For example if in same way I modify existing attribute - this will work fine, i.e Framed-Protocol will be sent to proxy with value I set. update proxy-request { Framed-Protocol := 11111 } But I need new attr added, and now I'm completely out of ideas how to achieve this. Already read lots of mailing archives, unlang doc and etc - still do not understand how attribute can be added. So if someone has any idea - please point me to correct doc/direction. freeradius 3.0.12 -- Denis

2 3

How to avoid EAP-TLS login on commercial CA's?
by Ramon Escriba 29 Jun '17

29 Jun '17

Hello FreeRadius masters, We're planning to use EAP-TTLS with a commercial certificate on freeradius-3.0.4. We do not want any "client certificate" signed by this commercial big CA to log in. Of course, I saw the warning: /etc/raddb/mod-enabled/eap # Note that you should NOT use a globally known CA here! # e.g. using a Verisign cert as a "known CA" means that # ANYONE who has a certificate signed by them can # authenticate via EAP-TLS! This is likely not what you want. But, there's any simple way to forbid globally any CA 'valid client certificate', a part of not using the commercial CA?? Regards.

4 5

Freeradius as a loadbalancer - logging dropped accounting requests
by Aleš Rygl 29 Jun '17

29 Jun '17

Hello, I am running several instances of Freeradius 3.0.13 on a single machine and one of them acts as a load balancer distributing just accounting request among four home servers listening on loopback on different ports: thread pool { start_servers = 64 max_servers = 1500 min_spare_servers = 50 max_spare_servers = 80 max_requests_per_server = 0 auto_limit_acct = no } realm NULL { acct_pool = DRACO_acct_pool nostrip } realm DEFAULT { acct_pool = DRACO_acct_pool nostrip } home_server_pool DRACO_acct_pool { type = keyed-balance home_server = rzt-gc-01 home_server = rzt-gc-02 home_server = rzt-gc-03 home_server = rzt-gc-04 } home_server rzt-gc-01 { type = acct ipaddr = 127.0.0.1 port = 2814 secret = testing123 response_window = 20 zombie_period = 40 revive_interval = 120 status_check = status-server check_interval = 10 check_timeout = 4 num_answers_to_alive = 3 coa { irt = 2 mrt = 16 mrc = 5 mrd = 30 } limit { max_connections = 16 max_requests = 0 lifetime = 0 idle_timeout = 0 } } ... and so on. The load is quite heavy - about 3.5k req/s. Balancing works fine, the key is Calling-Station-ID (MSISDN). What I can see is that there are some dropped packets in the stats: # echo "stats client acct" | radmin -d /etc/freeradius_lb/ radmin> stats client acct requests 39511449 responses 39508797 dup 0 invalid 0 malformed 0 bad_authenticator 0 dropped 1584 unknown_types 0 last_packet 1498477859 elapsed.1us 0 elapsed.10us 0 elapsed.100us 33765867 elapsed.1ms 5742921 elapsed.10ms 9 elapsed.100ms 0 elapsed.1s 0 elapsed.10s 0 radmin> The homeservers have no performance issues: # echo "stats client acct" | radmin -d /etc/freeradius_04/ radmin> stats client acct requests 159032334 responses 159030646 dup 21 invalid 0 malformed 0 bad_authenticator 0 dropped 21 unknown_types 0 last_packet 1498478023 elapsed.1us 0 elapsed.10us 0 elapsed.100us 158795858 elapsed.1ms 234786 elapsed.10ms 2 elapsed.100ms 0 elapsed.1s 0 elapsed.10s 0 radmin> Is there a way how to indetify the reason why are some req. dropped? I.e. logging such requestest? LB there is no lack of CPU or memory on the server, no drops in the UDP stack.. Thanks Ales

2 7

Delegated-IPv6-Prefix & sqlippool
by maxime.gerges＠ariane.network 29 Jun '17

29 Jun '17

Hello folks, I am currently checking for the possibility of using the sqlippool module to assign dynamically delegated IPv6 Prefixes. I found out that there is an option in the module to activate the IPv6 support and start assigning IPv6 address as well as traditional IPv4, but this option is only handling the creation of reply attribute 'Framed-IPv6-Prefix'. From the module's code on github, I also confirm that sqlippool doesn't seem to be ready to handle Delegated-IPv6-Prefix attribute. Does anybody know if this option might be interesting to be integrated in the code ? Is there any plan to add such option ? For information we are currently assigning Delegated IPv6 prefixes to customer thanks to an entry per customer in the radreply table and are copying the job of the sqlippool in an algorithm outside of the radius server. We do have a pool of available prefixes in an external database - when a customer subscribes we are picking up a prefix and populate it in the radreply - when the customer unsubscribe we are deleting the radreply entry and make the prefix available again in our external database. Many thanks for your replies. Maxime.

3 4

FR3.x - EAP proxy - EAP-TLS to MS NPS trouble
by Kylián Martin 29 Jun '17

29 Jun '17

Hi to everybody, I use freeradius for mac authentication bypass and as proxy for EAP. Specifically, an EAP-TLS that is routed to one of the MS NPS servers. I run the production environment on debian8 and FreeRadius 2.2.5, where everything works as it should. There is a problem I can not solve on the FreeRadius 3.0.12 (deb9) test server. After forwarding the access-request to the AD server, the request is not processed on the MS NPS server (w2012r2): Reason Code: 3 Reason: The RADIUS Request message that the Network Policy Server received from the network access server was malformed. NPS discards this request and does not respond. When I look at access-request with wireshark, I do not see any problem. (Message-authenticator is different from that sent by the client and which sends FreeRadius to NPS and Proxy-State added.) The same configuration with FR2.2.5 is parsed on NPS and is responded. Is there something I've overlooked when migrating to FR3? Is anyone running a similar configuration? I am doing something wrong? Thank you for any help Log: (2) Received Access-Request Id 27 from 192.168.59.80:1645 to 172.31.12.100:1812 length 340 (2) User-Name = "host/NB106484.example-edu.cz" (2) Service-Type = Framed-User (2) Framed-MTU = 1500 (2) Called-Station-Id = "28-34-A2-F0-7F-83" (2) Calling-Station-Id = "28-92-4A-25-56-CC" (2) EAP-Message = 0x020200710d800000006716030100620100005e03015953650a19b07c0ab643096685c9141950ad6c79abf54fa72736f856abd72b9900001cc014c013003900330035002fc00ac00900380032000a00130005000401000019000a0006000400170018000b0002010000170000ff01000100 (2) Message-Authenticator = 0xbfcf629e3a34b88c37d824ec7358e314 (2) NAS-Port-Type = Ethernet (2) NAS-Port = 50003 (2) NAS-Port-Id = "FastEthernet0/3" (2) State = 0x540106e70000013700011700fe800000000000002114a20fdc26eb140000000448ff01e5 (2) NAS-IP-Address = 192.168.59.80 (2) NAS-Identifier = "d4-cat2960-sw-132-2.net.sitmp.cz" (2) session-state: No cached attributes (2) # Executing section authorize from file /etc/freeradius/3.0/sites-enabled/default (2) authorize { rlm_sql (sql): Reserved connection (0) rlm_sql (sql): Released connection (0) (2) [sql] = notfound (2) if (!EAP-Message) { (2) if (!EAP-Message) -> FALSE (2) else { (2) if ("%{User-Name}" =~ /\.example-edu\.cz$/) { (2) EXPAND %{User-Name} (2) --> host/NB106484.example-edu.cz (2) if ("%{User-Name}" =~ /\.example-edu\.cz$/) -> TRUE (2) if ("%{User-Name}" =~ /\.example-edu\.cz$/) { (2) update control { (2) Proxy-To-Realm := 'EXAMPLE-EDU' (2) } # update control = noop (2) } # if ("%{User-Name}" =~ /\.example-edu\.cz$/) = noop (2) ... skipping elsif: Preceding "if" was taken (2) ... skipping elsif: Preceding "if" was taken (2) ... skipping else: Preceding "if" was taken (2) eap: Request is supposed to be proxied to Realm EXAMPLE-EDU. Not doing EAP. (2) [eap] = noop (2) } # else = noop (2) } # authorize = noop (2) Starting proxy to home server 172.31.12.14 port 1812 (2) Proxying request to home server 172.31.12.14 port 1812 timeout 20.000000 (2) Sent Access-Request Id 243 from 0.0.0.0:59582 to 172.31.12.14:1812 length 342 (2) User-Name = "host/NB106484.example-edu.cz" (2) Service-Type = Framed-User (2) Framed-MTU = 1500 (2) Called-Station-Id = "28-34-A2-F0-7F-83" (2) Calling-Station-Id = "28-92-4A-25-56-CC" (2) EAP-Message = 0x020200710d800000006716030100620100005e03015953650a19b07c0ab643096685c9141950ad6c79abf54fa72736f856abd72b9900001cc014c013003900330035002fc00ac00900380032000a00130005000401000019000a0006000400170018000b0002010000170000ff01000100 (2) Message-Authenticator = 0xbfcf629e3a34b88c37d824ec7358e314 (2) NAS-Port-Type = Ethernet (2) NAS-Port = 50003 (2) NAS-Port-Id = "FastEthernet0/3" (2) State = 0x540106e70000013700011700fe800000000000002114a20fdc26eb140000000448ff01e5 (2) NAS-IP-Address = 192.168.59.80 (2) NAS-Identifier = "d4-cat2960-sw-132-2.net.example.cz" (2) Proxy-State = 0x3237 Waking up in 0.3 seconds. (2) Expecting proxy response no later than 19.671053 seconds from now NPS receives (and discards for unknown reason): RADIUS Protocol Code: Access-Request (1) Packet identifier: 0xf3 (243) Length: 342 Authenticator: 0e4c4171a7c216d63ea6c394e98175bd Attribute Value Pairs AVP: l=28 t=User-Name(1): host/NB106484.plzen-edu.cz AVP: l=6 t=Service-Type(6): Framed(2) AVP: l=6 t=Framed-MTU(12): 1500 AVP: l=19 t=Called-Station-Id(30): 28-34-A2-F0-7F-83 AVP: l=19 t=Calling-Station-Id(31): 28-92-4A-25-56-CC AVP: l=115 t=EAP-Message(79) Last Segment[1] AVP Type: 79 AVP Length: 115 EAP fragment: 020200710d800000006716030100620100005e0301595365... Extensible Authentication Protocol AVP: l=18 t=Message-Authenticator(80): b2b9f1cf1e3ab216e63a949451ba2c69 AVP: l=6 t=NAS-Port-Type(61): Ethernet(15) AVP: l=6 t=NAS-Port(5): 50003 AVP: l=17 t=NAS-Port-Id(87): FastEthernet0/3 AVP: l=38 t=State(24): 540106e70000013700011700fe800000000000002114a20f... AVP: l=6 t=NAS-IP-Address(4): 192.168.59.80 AVP: l=34 t=NAS-Identifier(32): d4-cat2960-sw-132-2.net.sitmp.cz AVP: l=4 t=Proxy-State(33): 3237

3 4