- Freeradius-Users - lists.freeradius.org

Update on v4
by Alan DeKok 04 Jul '17

04 Jul '17

There have been a lot of changes to the v4.0.x branch in the last few weeks. I thought I'd take some time to give people updates as to what's happening, and what our plans are. As background, we've been working on re-designing the internals to remove RADIUS from the server core, and put it into a plug-in module. This change makes many things simpler. It lets DHCP change from a hack on top of RADIUS to a full-fledged protocol on par with RADIUS. It lets us add many more protocols, with much less effort than before. The changes mean that in the short term, the old-style "listen" sections go away, and are replaced with new-style "listen" sections. An unfortunate side-effect is that proxying is temporarily disabled, along with the "originate coa" functionality. The good news is that basic proxying is only a day or two effort away. And once that's done, the "originate coa" functionality become about 20 lines of "unlang" configuration. Where in v3, it was hundreds of lines of C code in the server core. Our tentative plan is to have an alpha release of v4 this year. We can then have official releases once we've made a bit more progress. Alan DeKok.

3 4

Two Auth-Types found but only one defined.
by Cooper, Tom 04 Jul '17

04 Jul '17

Hi All, I get this error when running freeradius in debug mode: (6) Found Auth-Type = ntlm_auth (6) Found Auth-Type = Accept (6) ERROR: Warning: Found 2 auth-types on request for user. (6) Auth-Type = Accept, accepting the user Auth-Type Accept is not defined anywhere. Also, when I test against radius using radclient it works fine, but when I test against it using an Azure client, for instance, it mangles the password completely. Installed version is freeradius-3.0.4-8.el7_3.x86_64 Regards, To read FirstRand Bank's Disclaimer for this email click on the following address or copy into your Internet browser: https://www.fnb.co.za/about-fnb/legal-matters/email-disclaimer.html If you are unable to access the Disclaimer, send a blank e-mail to firstrandbankdisclaimer(a)fnb.co.za and we will send you a copy of the Disclaimer.

2 1

load balanced freeradius
by Andrew Meyer 03 Jul '17

03 Jul '17

Is there a way to setup FreeRADIUS with HAProxy? I know that FreeRADIUS can do TCP. But is it worth it to set it up like this or just setup the mysql backend? Also can I do mysql backend with LDAP? Thank you!

3 3

Change username for MSCHAPv2
by Gabriele Verzeletti 03 Jul '17

03 Jul '17

Hello, I have a freeradius 3.0.10-1.1 running on openSUSE leap. I need to authenticate users for WiFi access WPA2 Enterprise, using PEAP and MSCHAPv2 against Active directory. User account are identified by userPrinciplaName, but ntlm_auth is not able to authenticate using this attribute, it looks into samAccountName. With an external script I'm able to performa a query on active directory and retrieve the samAccountName, but if I update the attribute User-Name using authorize { update request { User-Name := `/path/to/my/script '%{User-Name}'` } .. .. .. I have an error in the log (0) # Executing group from file /etc/raddb/sites-enabled/default (0) authenticate { (0) eap: Identity does not match User-Name, setting from EAP Identity (0) eap: Failed in handler (0) [eap] = invalid (0) } # authenticate = invalid Is there any way to perform this account translation before send request to EAP ? Thanks to all Gab

3 7

Cannot authorize users other than default "John Doe"
by Brian Hogans 02 Jul '17

02 Jul '17

Im using free radius version 2.2.5 with daloradius on a raspberry pi model B as my server and I’m trying to authenticate users on my smartphones and PCs. When I use the “John Doe” pass= hello I am able to log on. But any other users I add on daloradius will not authenticate. They WILL authenticate on freeradius using radtest, but not when I actually try to log in on my smartphone. This seems like a strange issue to have and I can’t figure it out. Also i am using a netgear WNDR4500v2 with dd wrt as my NAS. I’m wondering if that is the issue. I’m using WPA2 enterprise with AES encryption for wifi. freeradius: FreeRADIUS Version 2.2.5, for host arm-unknown-linux-gnueabihf, built on Oct 25 2014 at 07:04:01 Copyright (C) 1999-2013 The FreeRADIUS server project and contributors. There is NO warranty; not even for MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. You may redistribute copies of FreeRADIUS under the terms of the GNU General Public License. For more information about these matters, see the file named COPYRIGHT. Starting - reading configuration files ... including configuration file /etc/freeradius/radiusd.conf including configuration file /etc/freeradius/proxy.conf including configuration file /etc/freeradius/clients.conf including files in directory /etc/freeradius/modules/ including configuration file /etc/freeradius/modules/detail including configuration file /etc/freeradius/modules/opendirectory including configuration file /etc/freeradius/modules/ippool including configuration file /etc/freeradius/modules/checkval including configuration file /etc/freeradius/modules/expr including configuration file /etc/freeradius/modules/chap including configuration file /etc/freeradius/modules/pap including configuration file /etc/freeradius/modules/realm including configuration file /etc/freeradius/modules/unix including configuration file /etc/freeradius/modules/attr_rewrite including configuration file /etc/freeradius/modules/files including configuration file /etc/freeradius/modules/expiration including configuration file /etc/freeradius/modules/linelog including configuration file /etc/freeradius/modules/mschap including configuration file /etc/freeradius/modules/detail.example.com including configuration file /etc/freeradius/modules/rediswho including configuration file /etc/freeradius/modules/digest including configuration file /etc/freeradius/modules/sql_log including configuration file /etc/freeradius/modules/exec including configuration file /etc/freeradius/modules/smbpasswd including configuration file /etc/freeradius/modules/smsotp including configuration file /etc/freeradius/modules/dynamic_clients including configuration file /etc/freeradius/modules/policy including configuration file /etc/freeradius/modules/replicate including configuration file /etc/freeradius/modules/sqlcounter_expire_on_login including configuration file /etc/freeradius/modules/perl including configuration file /etc/freeradius/modules/dhcp_sqlippool including configuration file /etc/freeradius/modules/cache including configuration file /etc/freeradius/modules/wimax including configuration file /etc/freeradius/modules/logintime including configuration file /etc/freeradius/modules/always including configuration file /etc/freeradius/modules/otp including configuration file /etc/freeradius/modules/radutmp including configuration file /etc/freeradius/modules/ldap including configuration file /etc/freeradius/modules/soh including configuration file /etc/freeradius/modules/radrelay including configuration file /etc/freeradius/modules/mac2ip including configuration file /etc/freeradius/modules/mac2vlan including configuration file /etc/freeradius/modules/sradutmp including configuration file /etc/freeradius/modules/passwd including configuration file /etc/freeradius/modules/inner-eap including configuration file /etc/freeradius/modules/ntlm_auth including configuration file /etc/freeradius/modules/redis including configuration file /etc/freeradius/modules/krb5 including configuration file /etc/freeradius/modules/counter including configuration file /etc/freeradius/modules/preprocess including configuration file /etc/freeradius/modules/detail.log including configuration file /etc/freeradius/modules/etc_group including configuration file /etc/freeradius/modules/pam including configuration file /etc/freeradius/modules/echo including configuration file /etc/freeradius/modules/acct_unique including configuration file /etc/freeradius/modules/attr_filter including configuration file /etc/freeradius/modules/cui including configuration file /etc/freeradius/eap.conf including configuration file /etc/freeradius/sql.conf including configuration file /etc/freeradius/sql/mysql/dialup.conf including configuration file /etc/freeradius/sql/mysql/counter.conf including configuration file /etc/freeradius/policy.conf including files in directory /etc/freeradius/sites-enabled/ including configuration file /etc/freeradius/sites-enabled/default including configuration file /etc/freeradius/sites-enabled/inner-tunnel main { user = "freerad" group = "freerad" allow_core_dumps = no } including dictionary file /etc/freeradius/dictionary main { name = "freeradius" prefix = "/usr" localstatedir = "/var" sbindir = "/usr/sbin" logdir = "/var/log/freeradius" run_dir = "/var/run/freeradius" libdir = "/usr/lib/freeradius" radacctdir = "/var/log/freeradius/radacct" hostname_lookups = no max_request_time = 30 cleanup_delay = 5 max_requests = 1024 pidfile = "/var/run/freeradius/freeradius.pid" checkrad = "/usr/sbin/checkrad" debug_level = 0 proxy_requests = yes log { stripped_names = no auth = no auth_badpass = no auth_goodpass = no } security { max_attributes = 200 reject_delay = 1 status_server = yes allow_vulnerable_openssl = no } } radiusd: #### Loading Realms and Home Servers #### proxy server { retry_delay = 5 retry_count = 3 default_fallback = no dead_time = 120 wake_all_if_all_dead = no } home_server localhost { ipaddr = 127.0.0.1 port = 1812 type = "auth" secret = "testing123" response_window = 20 max_outstanding = 65536 require_message_authenticator = yes zombie_period = 40 status_check = "status-server" ping_interval = 30 check_interval = 30 num_answers_to_alive = 3 num_pings_to_alive = 3 revive_interval = 120 status_check_timeout = 4 coa { irt = 2 mrt = 16 mrc = 5 mrd = 30 } } home_server_pool my_auth_failover { type = fail-over home_server = localhost } realm example.com { auth_pool = my_auth_failover } realm LOCAL { } radiusd: #### Loading Clients #### client localhost { ipaddr = 127.0.0.1 require_message_authenticator = no secret = "testing123" nastype = "other" } client 192.168.0.0/16 { require_message_authenticator = no secret = "testing123" shortname = "home" } radiusd: #### Instantiating modules #### instantiate { Module: Linked to module rlm_exec Module: Instantiating module "exec" from file /etc/freeradius/modules/exec exec { wait = no input_pairs = "request" shell_escape = yes timeout = 10 } Module: Linked to module rlm_expr Module: Instantiating module "expr" from file /etc/freeradius/modules/expr Module: Linked to module rlm_expiration Module: Instantiating module "expiration" from file /etc/freeradius/modules/expiration expiration { reply-message = "Password Has Expired " } Module: Linked to module rlm_logintime Module: Instantiating module "logintime" from file /etc/freeradius/modules/logintime logintime { reply-message = "You are calling outside your allowed timespan " minimum-timeout = 60 } } radiusd: #### Loading Virtual Servers #### server { # from file /etc/freeradius/radiusd.conf modules { Module: Creating Auth-Type = digest Module: Creating Post-Auth-Type = REJECT Module: Checking authenticate {...} for more modules to load Module: Linked to module rlm_pap Module: Instantiating module "pap" from file /etc/freeradius/modules/pap pap { encryption_scheme = "auto" auto_header = no } Module: Linked to module rlm_chap Module: Instantiating module "chap" from file /etc/freeradius/modules/chap Module: Linked to module rlm_mschap Module: Instantiating module "mschap" from file /etc/freeradius/modules/mschap mschap { use_mppe = yes require_encryption = no require_strong = no with_ntdomain_hack = no allow_retry = yes } Module: Linked to module rlm_digest Module: Instantiating module "digest" from file /etc/freeradius/modules/digest Module: Linked to module rlm_unix Module: Instantiating module "unix" from file /etc/freeradius/modules/unix unix { radwtmp = "/var/log/freeradius/radwtmp" } Module: Linked to module rlm_eap Module: Instantiating module "eap" from file /etc/freeradius/eap.conf eap { default_eap_type = "md5" timer_expire = 60 ignore_unknown_eap_types = no cisco_accounting_username_bug = no max_sessions = 1024 } Module: Linked to sub-module rlm_eap_md5 Module: Instantiating eap-md5 Module: Linked to sub-module rlm_eap_leap Module: Instantiating eap-leap Module: Linked to sub-module rlm_eap_gtc Module: Instantiating eap-gtc gtc { challenge = "Password: " auth_type = "PAP" } Module: Linked to sub-module rlm_eap_tls Module: Instantiating eap-tls tls { rsa_key_exchange = no dh_key_exchange = yes rsa_key_length = 512 dh_key_length = 512 verify_depth = 0 CA_path = "/etc/freeradius/certs" pem_file_type = yes private_key_file = "/etc/freeradius/certs/server.key" certificate_file = "/etc/freeradius/certs/server.pem" CA_file = "/etc/freeradius/certs/ca.pem" private_key_password = "whatever" dh_file = "/etc/freeradius/certs/dh" random_file = "/dev/urandom" fragment_size = 1024 include_length = yes check_crl = no cipher_list = "DEFAULT" make_cert_command = "/etc/freeradius/certs/bootstrap" ecdh_curve = "prime256v1" cache { enable = no lifetime = 24 max_entries = 255 } verify { } ocsp { enable = no override_cert_url = yes url = "http://127.0.0.1/ocsp/" use_nonce = yes timeout = 0 softfail = no } } Module: Linked to sub-module rlm_eap_ttls Module: Instantiating eap-ttls ttls { default_eap_type = "md5" copy_request_to_tunnel = no use_tunneled_reply = no virtual_server = "inner-tunnel" include_length = yes } Module: Linked to sub-module rlm_eap_peap Module: Instantiating eap-peap peap { default_eap_type = "mschapv2" copy_request_to_tunnel = no use_tunneled_reply = no proxy_tunneled_request_as_eap = yes virtual_server = "inner-tunnel" soh = no } Module: Linked to sub-module rlm_eap_mschapv2 Module: Instantiating eap-mschapv2 mschapv2 { with_ntdomain_hack = no send_error = no } Module: Checking authorize {...} for more modules to load Module: Linked to module rlm_preprocess Module: Instantiating module "preprocess" from file /etc/freeradius/modules/preprocess preprocess { huntgroups = "/etc/freeradius/huntgroups" hints = "/etc/freeradius/hints" with_ascend_hack = no ascend_channels_per_line = 23 with_ntdomain_hack = no with_specialix_jetstream_hack = no with_cisco_vsa_hack = no with_alvarion_vsa_hack = no } reading pairlist file /etc/freeradius/huntgroups reading pairlist file /etc/freeradius/hints Module: Linked to module rlm_realm Module: Instantiating module "suffix" from file /etc/freeradius/modules/realm realm suffix { format = "suffix" delimiter = "@" ignore_default = no ignore_null = no } Module: Linked to module rlm_sql Module: Instantiating module "sql" from file /etc/freeradius/sql.conf sql { driver = "rlm_sql_mysql" server = "localhost" port = "" login = "radiususer" password = "radiuspass" radius_db = "radiusdb" read_groups = yes sqltrace = no sqltracefile = "/var/log/freeradius/sqltrace.sql" readclients = no deletestalesessions = yes num_sql_socks = 32 lifetime = 0 max_queries = 0 sql_user_name = "%{User-Name}" default_user_profile = "" nas_query = "SELECT id, nasname, shortname, type, secret, server FROM nas" authorize_check_query = "SELECT id, username, attribute, value, op FROM radcheck WHERE username = '%{SQL-User-Name}' ORDER BY id" authorize_reply_query = "SELECT id, username, attribute, value, op FROM radreply WHERE username = '%{SQL-User-Name}' ORDER BY id" authorize_group_check_query = "SELECT id, groupname, attribute, Value, op FROM radgroupcheck WHERE groupname = '%{Sql-Group}' ORDER BY id" authorize_group_reply_query = "SELECT id, groupname, attribute, value, op FROM radgroupreply WHERE groupname = '%{Sql-Group}' ORDER BY id" accounting_onoff_query = " UPDATE radacct SET acctstoptime = '%S', acctsessiontime = unix_timestamp('%S') - unix_timestamp(acctstarttime), acctterminatecause = '%{Acct-Terminate-Cause}', acctstopdelay = %{%{Acct-Delay-Time}:-0} WHERE acctstoptime IS NULL AND nasipaddress = '%{NAS-IP-Address}' AND acctstarttime <= '%S'" accounting_update_query = " UPDATE radacct SET framedipaddress = '%{Framed-IP-Address}', acctsessiontime = '%{Acct-Session-Time}', acctinputoctets = '%{%{Acct-Input-Gigawords}:-0}' << 32 | '%{%{Acct-Input-Octets}:-0}', acctoutputoctets = '%{%{Acct-Output-Gigawords}:-0}' << 32 | '%{%{Acct-Output-Octets}:-0}' WHERE acctsessionid = '%{Acct-Session-Id}' AND username = '%{SQL-User-Name}' AND nasipaddress = '%{NAS-IP-Address}'" accounting_update_query_alt = " INSERT INTO radacct (acctsessionid, acctuniqueid, username, realm, nasipaddress, nasportid, nasporttype, acctstarttime, acctsessiontime, acctauthentic, connectinfo_start, acctinputoctets, acctoutputoctets, calledstationid, callingstationid, servicetype, framedprotocol, framedipaddress, acctstartdelay, xascendsessionsvrkey) VALUES ('%{Acct-Session-Id}', '%{Acct-Unique-Session-Id}', '%{SQL-User-Name}', '%{Realm}', '%{NAS-IP-Address}', '%{NAS-Port}', '%{NAS-Port-Type}', DATE_SUB('%S', INTERVAL (%{%{Acct-Session-Time}:-0} + %{%{Acct-Delay-Time}:-0}) SECOND), '%{Acct-Session-Time}', '%{Acct-Authentic}', '', '%{%{Acct-Input-Gigawords}:-0}' << 32 | '%{%{Acct-Input-Octets}:-0}', '%{%{Acct-Output-Gigawords}:-0}' << 32 | '%{%{Acct-Output-Octets}:-0}', '%{Called-Station-Id}', '%{Calling-Station-Id}', '%{Service-Type}', '%{Framed-Protocol}', '%{Framed-IP-Address}', '0', '%{X-Ascend-Session-Svr-Key}')" accounting_start_query = " INSERT INTO radacct (acctsessionid, acctuniqueid, username, realm, nasipaddress, nasportid, nasporttype, acctstarttime, acctstoptime, acctsessiontime, acctauthentic, connectinfo_start, connectinfo_stop, acctinputoctets, acctoutputoctets, calledstationid, callingstationid, acctterminatecause, servicetype, framedprotocol, framedipaddress, acctstartdelay, acctstopdelay, xascendsessionsvrkey) VALUES ('%{Acct-Session-Id}', '%{Acct-Unique-Session-Id}', '%{SQL-User-Name}', '%{Realm}', '%{NAS-IP-Address}', '%{NAS-Port}', '%{NAS-Port-Type}', '%S', NULL, '0', '%{Acct-Authentic}', '%{Connect-Info}', '', '0', '0', '%{Called-Station-Id}', '%{Calling-Station-Id}', '', '%{Service-Type}', '%{Framed-Protocol}', '%{Framed-IP-Address}', '%{%{Acct-Delay-Time}:-0}', '0', '%{X-Ascend-Session-Svr-Key}')" accounting_start_query_alt = " UPDATE radacct SET acctstarttime = '%S', acctstartdelay = '%{%{Acct-Delay-Time}:-0}', connectinfo_start = '%{Connect-Info}' WHERE acctsessionid = '%{Acct-Session-Id}' AND username = '%{SQL-User-Name}' AND nasipaddress = '%{NAS-IP-Address}'" accounting_stop_query = " UPDATE radacct SET acctstoptime = '%S', acctsessiontime = '%{Acct-Session-Time}', acctinputoctets = '%{%{Acct-Input-Gigawords}:-0}' << 32 | '%{%{Acct-Input-Octets}:-0}', acctoutputoctets = '%{%{Acct-Output-Gigawords}:-0}' << 32 | '%{%{Acct-Output-Octets}:-0}', acctterminatecause = '%{Acct-Terminate-Cause}', acctstopdelay = '%{%{Acct-Delay-Time}:-0}', connectinfo_stop = '%{Connect-Info}' WHERE acctsessionid = '%{Acct-Session-Id}' AND username = '%{SQL-User-Name}' AND nasipaddress = '%{NAS-IP-Address}'" accounting_stop_query_alt = " INSERT INTO radacct (acctsessionid, acctuniqueid, username, realm, nasipaddress, nasportid, nasporttype, acctstarttime, acctstoptime, acctsessiontime, acctauthentic, connectinfo_start, connectinfo_stop, acctinputoctets, acctoutputoctets, calledstationid, callingstationid, acctterminatecause, servicetype, framedprotocol, framedipaddress, acctstartdelay, acctstopdelay) VALUES ('%{Acct-Session-Id}', '%{Acct-Unique-Session-Id}', '%{SQL-User-Name}', '%{Realm}', '%{NAS-IP-Address}', '%{NAS-Port}', '%{NAS-Port-Type}', DATE_SUB('%S', INTERVAL (%{%{Acct-Session-Time}:-0} + %{%{Acct-Delay-Time}:-0}) SECOND), '%S', '%{Acct-Session-Time}', '%{Acct-Authentic}', '', '%{Connect-Info}', '%{%{Acct-Input-Gigawords}:-0}' << 32 | '%{%{Acct-Input-Octets}:-0}', '%{%{Acct-Output-Gigawords}:-0}' << 32 | '%{%{Acct-Output-Octets}:-0}', '%{Called-Station-Id}', '%{Calling-Station-Id}', '%{Acct-Terminate-Cause}', '%{Service-Type}', '%{Framed-Protocol}', '%{Framed-IP-Address}', '0', '%{%{Acct-Delay-Time}:-0}')" group_membership_query = "SELECT groupname FROM radusergroup WHERE username = '%{SQL-User-Name}' ORDER BY priority" connect_failure_retry_delay = 60 simul_count_query = "" simul_verify_query = "SELECT radacctid, acctsessionid, username, nasipaddress, nasportid, framedipaddress, callingstationid, framedprotocol FROM radacct WHERE username = '%{SQL-User-Name}' AND acctstoptime IS NULL" postauth_query = "INSERT INTO radpostauth (username, pass, reply, authdate) VALUES ( '%{User-Name}', '%{%{User-Password}:-%{Chap-Password}}', '%{reply:Packet-Type}', '%S')" safe-characters = "@abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ0123456789.-_: /" } rlm_sql (sql): Driver rlm_sql_mysql (module rlm_sql_mysql) loaded and linked rlm_sql (sql): Attempting to connect to radiususer@localhost:/radiusdb rlm_sql (sql): starting 0 rlm_sql (sql): Attempting to connect rlm_sql_mysql #0 rlm_sql_mysql: Starting connect to MySQL server for #0 rlm_sql (sql): Connected new DB handle, #0 rlm_sql (sql): starting 1 rlm_sql (sql): Attempting to connect rlm_sql_mysql #1 rlm_sql_mysql: Starting connect to MySQL server for #1 rlm_sql (sql): Connected new DB handle, #1 rlm_sql (sql): starting 2 rlm_sql (sql): Attempting to connect rlm_sql_mysql #2 rlm_sql_mysql: Starting connect to MySQL server for #2 rlm_sql (sql): Connected new DB handle, #2 rlm_sql (sql): starting 3 rlm_sql (sql): Attempting to connect rlm_sql_mysql #3 rlm_sql_mysql: Starting connect to MySQL server for #3 rlm_sql (sql): Connected new DB handle, #3 rlm_sql (sql): starting 4 rlm_sql (sql): Attempting to connect rlm_sql_mysql #4 rlm_sql_mysql: Starting connect to MySQL server for #4 rlm_sql (sql): Connected new DB handle, #4 rlm_sql (sql): starting 5 rlm_sql (sql): Attempting to connect rlm_sql_mysql #5 rlm_sql_mysql: Starting connect to MySQL server for #5 rlm_sql (sql): Connected new DB handle, #5 rlm_sql (sql): starting 6 rlm_sql (sql): Attempting to connect rlm_sql_mysql #6 rlm_sql_mysql: Starting connect to MySQL server for #6 rlm_sql (sql): Connected new DB handle, #6 rlm_sql (sql): starting 7 rlm_sql (sql): Attempting to connect rlm_sql_mysql #7 rlm_sql_mysql: Starting connect to MySQL server for #7 rlm_sql (sql): Connected new DB handle, #7 rlm_sql (sql): starting 8 rlm_sql (sql): Attempting to connect rlm_sql_mysql #8 rlm_sql_mysql: Starting connect to MySQL server for #8 rlm_sql (sql): Connected new DB handle, #8 rlm_sql (sql): starting 9 rlm_sql (sql): Attempting to connect rlm_sql_mysql #9 rlm_sql_mysql: Starting connect to MySQL server for #9 rlm_sql (sql): Connected new DB handle, #9 rlm_sql (sql): starting 10 rlm_sql (sql): Attempting to connect rlm_sql_mysql #10 rlm_sql_mysql: Starting connect to MySQL server for #10 rlm_sql (sql): Connected new DB handle, #10 rlm_sql (sql): starting 11 rlm_sql (sql): Attempting to connect rlm_sql_mysql #11 rlm_sql_mysql: Starting connect to MySQL server for #11 rlm_sql (sql): Connected new DB handle, #11 rlm_sql (sql): starting 12 rlm_sql (sql): Attempting to connect rlm_sql_mysql #12 rlm_sql_mysql: Starting connect to MySQL server for #12 rlm_sql (sql): Connected new DB handle, #12 rlm_sql (sql): starting 13 rlm_sql (sql): Attempting to connect rlm_sql_mysql #13 rlm_sql_mysql: Starting connect to MySQL server for #13 rlm_sql (sql): Connected new DB handle, #13 rlm_sql (sql): starting 14 rlm_sql (sql): Attempting to connect rlm_sql_mysql #14 rlm_sql_mysql: Starting connect to MySQL server for #14 rlm_sql (sql): Connected new DB handle, #14 rlm_sql (sql): starting 15 rlm_sql (sql): Attempting to connect rlm_sql_mysql #15 rlm_sql_mysql: Starting connect to MySQL server for #15 rlm_sql (sql): Connected new DB handle, #15 rlm_sql (sql): starting 16 rlm_sql (sql): Attempting to connect rlm_sql_mysql #16 rlm_sql_mysql: Starting connect to MySQL server for #16 rlm_sql (sql): Connected new DB handle, #16 rlm_sql (sql): starting 17 rlm_sql (sql): Attempting to connect rlm_sql_mysql #17 rlm_sql_mysql: Starting connect to MySQL server for #17 rlm_sql (sql): Connected new DB handle, #17 rlm_sql (sql): starting 18 rlm_sql (sql): Attempting to connect rlm_sql_mysql #18 rlm_sql_mysql: Starting connect to MySQL server for #18 rlm_sql (sql): Connected new DB handle, #18 rlm_sql (sql): starting 19 rlm_sql (sql): Attempting to connect rlm_sql_mysql #19 rlm_sql_mysql: Starting connect to MySQL server for #19 rlm_sql (sql): Connected new DB handle, #19 rlm_sql (sql): starting 20 rlm_sql (sql): Attempting to connect rlm_sql_mysql #20 rlm_sql_mysql: Starting connect to MySQL server for #20 rlm_sql (sql): Connected new DB handle, #20 rlm_sql (sql): starting 21 rlm_sql (sql): Attempting to connect rlm_sql_mysql #21 rlm_sql_mysql: Starting connect to MySQL server for #21 rlm_sql (sql): Connected new DB handle, #21 rlm_sql (sql): starting 22 rlm_sql (sql): Attempting to connect rlm_sql_mysql #22 rlm_sql_mysql: Starting connect to MySQL server for #22 rlm_sql (sql): Connected new DB handle, #22 rlm_sql (sql): starting 23 rlm_sql (sql): Attempting to connect rlm_sql_mysql #23 rlm_sql_mysql: Starting connect to MySQL server for #23 rlm_sql (sql): Connected new DB handle, #23 rlm_sql (sql): starting 24 rlm_sql (sql): Attempting to connect rlm_sql_mysql #24 rlm_sql_mysql: Starting connect to MySQL server for #24 rlm_sql (sql): Connected new DB handle, #24 rlm_sql (sql): starting 25 rlm_sql (sql): Attempting to connect rlm_sql_mysql #25 rlm_sql_mysql: Starting connect to MySQL server for #25 rlm_sql (sql): Connected new DB handle, #25 rlm_sql (sql): starting 26 rlm_sql (sql): Attempting to connect rlm_sql_mysql #26 rlm_sql_mysql: Starting connect to MySQL server for #26 rlm_sql (sql): Connected new DB handle, #26 rlm_sql (sql): starting 27 rlm_sql (sql): Attempting to connect rlm_sql_mysql #27 rlm_sql_mysql: Starting connect to MySQL server for #27 rlm_sql (sql): Connected new DB handle, #27 rlm_sql (sql): starting 28 rlm_sql (sql): Attempting to connect rlm_sql_mysql #28 rlm_sql_mysql: Starting connect to MySQL server for #28 rlm_sql (sql): Connected new DB handle, #28 rlm_sql (sql): starting 29 rlm_sql (sql): Attempting to connect rlm_sql_mysql #29 rlm_sql_mysql: Starting connect to MySQL server for #29 rlm_sql (sql): Connected new DB handle, #29 rlm_sql (sql): starting 30 rlm_sql (sql): Attempting to connect rlm_sql_mysql #30 rlm_sql_mysql: Starting connect to MySQL server for #30 rlm_sql (sql): Connected new DB handle, #30 rlm_sql (sql): starting 31 rlm_sql (sql): Attempting to connect rlm_sql_mysql #31 rlm_sql_mysql: Starting connect to MySQL server for #31 rlm_sql (sql): Connected new DB handle, #31 Module: Checking preacct {...} for more modules to load Module: Linked to module rlm_acct_unique Module: Instantiating module "acct_unique" from file /etc/freeradius/modules/acct_unique acct_unique { key = "User-Name, Acct-Session-Id, NAS-IP-Address, NAS-Identifier, NAS-Port" } Module: Linked to module rlm_files Module: Instantiating module "files" from file /etc/freeradius/modules/files files { usersfile = "/etc/freeradius/users" acctusersfile = "/etc/freeradius/acct_users" preproxy_usersfile = "/etc/freeradius/preproxy_users" compat = "no" } reading pairlist file /etc/freeradius/users reading pairlist file /etc/freeradius/acct_users reading pairlist file /etc/freeradius/preproxy_users Module: Checking accounting {...} for more modules to load Module: Linked to module rlm_detail Module: Instantiating module "detail" from file /etc/freeradius/modules/detail detail { detailfile = "/var/log/freeradius/radacct/%{%{Packet-Src-IP-Address}:-%{Packet-Src-IPv6-Address}}/detail-%Y%m%d" header = "%t" detailperm = 384 dirperm = 493 locking = no log_packet_header = no } Module: Linked to module rlm_attr_filter Module: Instantiating module "attr_filter.accounting_response" from file /etc/freeradius/modules/attr_filter attr_filter attr_filter.accounting_response { attrsfile = "/etc/freeradius/attrs.accounting_response" key = "%{User-Name}" relaxed = no } reading pairlist file /etc/freeradius/attrs.accounting_response Module: Checking session {...} for more modules to load Module: Linked to module rlm_radutmp Module: Instantiating module "radutmp" from file /etc/freeradius/modules/radutmp radutmp { filename = "/var/log/freeradius/radutmp" username = "%{User-Name}" case_sensitive = yes check_with_nas = yes perm = 384 callerid = yes } Module: Checking post-proxy {...} for more modules to load Module: Checking post-auth {...} for more modules to load Module: Instantiating module "attr_filter.access_reject" from file /etc/freeradius/modules/attr_filter attr_filter attr_filter.access_reject { attrsfile = "/etc/freeradius/attrs.access_reject" key = "%{User-Name}" relaxed = no } reading pairlist file /etc/freeradius/attrs.access_reject } # modules } # server server inner-tunnel { # from file /etc/freeradius/sites-enabled/inner-tunnel modules { Module: Checking authenticate {...} for more modules to load Module: Checking authorize {...} for more modules to load Module: Checking session {...} for more modules to load Module: Checking post-proxy {...} for more modules to load Module: Checking post-auth {...} for more modules to load } # modules } # server radiusd: #### Opening IP addresses and Ports #### listen { type = "auth" ipaddr = * port = 0 } listen { type = "acct" ipaddr = * port = 0 } listen { type = "auth" ipaddr = 127.0.0.1 port = 18120 } ... adding new socket proxy address * port 44987 Listening on authentication address * port 1812 Listening on accounting address * port 1813 Listening on authentication address 127.0.0.1 port 18120 as server inner-tunnel Listening on proxy address * port 1814 Ready to process requests. _________________________________________________________________________ root@radiuspi:/home/pi# radtest "test" test123 localhost 0 testing123 Sending Access-Request of id 62 to 127.0.0.1 port 1812 User-Name = "test" User-Password = "test123" NAS-IP-Address = 127.0.1.1 NAS-Port = 0 Message-Authenticator = 0x00000000000000000000000000000000 rad_recv: Access-Accept packet from host 127.0.0.1 port 1812, id=62, length=20

2 12

getting access-reject not sure why
by Andrew Meyer 30 Jun '17

30 Jun '17

So I decided to blow away my FreeRADIUS v3 setup to authenticate from my cisco devices. I am doing this for documentation purposes. I am currently running CentOS 7.3. Here is what I have in my users file: test1 Cleartext-Password := "hello" Service-Type = Administrative-User, Auth-Type := Accept, Reply-Message := "Hello, %{User-Name}", Cisco-AVPair = "shell:roles=network-admin", Cisco-AVPair = "shell:priv-lvl=15" Here is my clients config: clients network-equipment { ipaddr = 10.150.1.0/24 secret = Infotech5! nas_type = cisco shortname = network-equipment } clients linux-servers { ipaddr = 10.150.10.0/24 secret = Infotech5! proto = * nas_type = other shortname = linux-servers } Everything else is default. Here is the debug output log: Ready to process requests Waking up in 0.3 seconds. (1) Received Access-Request packet from host 10.150.1.213 port 1645, id=11, length=98 (1) User-Name = 'test1' (1) Reply-Message = 'Password: ' (1) User-Password = '\305ɥ\273\306\335\026\257l{\033)z\017\343o' (1) NAS-Port = 1 (1) NAS-Port-Type = Virtual (1) Calling-Station-Id = '10.150.1.250' (1) NAS-IP-Address = 10.150.1.213 (1) NAS-Identifier = 'ASMCAP1' (1) # Executing section authorize from file /etc/raddb/sites-enabled/default (1) # Executing group from file /etc/raddb/sites-enabled/default (1) pap : Login attempt with password (1) ERROR: pap : Cleartext password does not match "known good" password (1) pap : Passwords don't match (1) # Executing group from file /etc/raddb/sites-enabled/default Waking up in 0.6 seconds. (1) Sending Access-Reject packet to host 10.150.1.213 port 1645, id=11, length=0 (1) Reply-Message = 'Hello, test1' Waking up in 3.9 seconds. Ready to process requests Waking up in 0.3 seconds. (2) Received Access-Request packet from host 10.150.1.213 port 1645, id=11, length=98 (2) User-Name = 'test1' (2) Reply-Message = 'Password: ' (2) User-Password = '\305ɥ\273\306\335\026\257l{\033)z\017\343o' (2) NAS-Port = 1 (2) NAS-Port-Type = Virtual (2) Calling-Station-Id = '10.150.1.250' (2) NAS-IP-Address = 10.150.1.213 (2) NAS-Identifier = 'ASMCAP1' (2) # Executing section authorize from file /etc/raddb/sites-enabled/default (2) # Executing group from file /etc/raddb/sites-enabled/default (2) pap : Login attempt with password (2) ERROR: pap : Cleartext password does not match "known good" password (2) pap : Passwords don't match (2) # Executing group from file /etc/raddb/sites-enabled/default Waking up in 0.6 seconds. (2) Sending Access-Reject packet to host 10.150.1.213 port 1645, id=11, length=0 (2) Reply-Message = 'Hello, test1' Waking up in 3.9 seconds. I don't understand why i'm getting a denied packet.

4 12

Linux PAM Authentication failed: Non-Local users
by Anand Neeli 30 Jun '17

30 Jun '17

Hello, I'm sure my query might have already been discussed. But couldnt search the mailing list. Can anyone please show pointers or answer this? I'm trying to perform Radius based authentication of any guest user using Linux PAM module 1.0 As radius client, pam_radius-1.3.17 plugin is used and freeradius server is used as Radius Server. I have performed the Radius client and server configurations according to the guidelines. I added the radius entry in /etc/pam.d/sshd: #%PAM-1.0 auth sufficient /lib/security/pam_radius_auth.so debug While i am trying of perform authentication of users, following are the outcomes depending upon user (trying to login) is locally configured or not. Users are trying to log-in via ssh. Both Users A and B are configured in Radius Server 1. If user A (locally configured in Linux M/C) tries to login, then Linux PAM gets the user/password information and send it to radius server. Radius Server authenticates the user/password in its database and sends successful acknowledgement to linux m/c. User is allowed to login. 2. If user B (not configured in Linux M/C) login, then Authentication is being rejected by Radius Server. Radius Server logs are showing that password in either malformed/incorrect ********************************************************************************************************************************************************************************************************************* Radius Server Logs: rad_recv: Access-Request packet from host 127.0.0.1:27138, id=117, length=91 User-Name = "abcd" User-Password = "\010\n\INCORRECT" NAS-IP-Address = 172.21.142.4 NAS-Identifier = "linux" NAS-Port = 26113 NAS-Port-Type = Virtual Service-Type = Authenticate-Only Calling-Station-Id = "172.21.142.140" Processing the authorize section of radiusd.conf modcall: entering group authorize for request 0 modcall[authorize]: module "preprocess" returns ok for request 0 modcall[authorize]: module "chap" returns noop for request 0 modcall[authorize]: module "mschap" returns noop for request 0 rlm_realm: No '@' in User-Name = "abcd", looking up realm NULL rlm_realm: No such realm "NULL" modcall[authorize]: module "suffix" returns noop for request 0 rlm_eap: No EAP-Message, not doing EAP modcall[authorize]: module "eap" returns noop for request 0 modcall[authorize]: module "files" returns notfound for request 0 modcall: group authorize returns ok for request 0 auth: No authenticate method (Auth-Type) configuration found for the request: Rejecting the user auth: Failed to validate the user. Login incorrect: [abcd/\010\n\INCORRECT] (from client localhost port 26113 cli 172.21.142.140) WARNING: Unprintable characters in the password. ? Double-check the shared secret on the server and the NAS! ********************************************************************************************************************************************************************************************************************* SSHD Logs: May 27 13:14:07 localho sshd[26113]: debug1: PAM: initializing for "abcd" May 27 13:14:07 localho sshd[26113]: debug1: PAM: setting PAM_RHOST to "172.21.142.140" May 27 13:14:07 localho sshd[26113]: debug1: PAM: setting PAM_TTY to "ssh" May 27 13:14:09 localho sshd[26113]: pam_radius_auth: Got user name abcd May 27 13:14:09 localho sshd[26113]: pam_radius_auth: Sending RADIUS request code 1 May 27 13:14:09 localho sshd[26113]: pam_radius_auth: DEBUG: getservbyname(radius, udp) returned -1768845152. May 27 13:14:10 localho sshd[26113]: pam_radius_auth: RADIUS server 127.0.0.1 failed to respond May 27 13:14:10 localho sshd[26113]: pam_radius_auth: All RADIUS servers failed to respond. May 27 13:14:10 localho sshd[26113]: pam_radius_auth: authentication failed May 27 13:14:10 localho sshd(pam_unix)[26113]: check pass; user unknown May 27 13:14:10 localho sshd(pam_unix)[26113]: authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=172.21.142.140 May 27 13:14:13 localho sshd[26113]: debug1: PAM: password authentication failed for an illegal user: Authentication failure May 27 13:14:13 localho sshd[26113]: Failed password for invalid user abcd from ::ffff:172.21.142.140 port 36124 ssh2 ********************************************************************************************************************************************************************************************************************* After reading through couple of forums, i got the hint this is the way PAM works. Linux PAM has restriction to have user-id configured locally on Linux M/C for successful Radius Authentication But if we have the case of thousands of guest users, then it is not possible to add every user in machine itself. I am willing to know: 1. Is this is the way how PAM works. Is this limitation is present in PAM 2. I am using Linux PAM 1.0. Is there any patch/fix available in higher version of PAM? 3. Is there any way to overcome this issue by using some other libpam-radius-auth plugin. Though i do not think it is Radius client plugin issue. It will be really helpful if you can help/suggest me in this regards. Regards, Anand Neeli

2 5

LDAPS problem while migrating from 2 to 3
by Olivier 30 Jun '17

30 Jun '17

Hi, I have a working environment based on FreeRadius 2.2 and OpenLDAP 2.4. It binds to the LDAP server on ldaps://ldap.cs.ait.ac.th/ I am trying to upgrade to FreeRadius (3.0.14) and if I can bind to ldap://..., I cannot bind to ldaps://... Thu Jun 29 13:12:38 2017 : Debug: # Instantiating module "ldap_firewall" from file /usr/local/etc/raddb/mods-enabled/ldap Thu Jun 29 13:12:38 2017 : Info: rlm_ldap: libldap vendor: OpenLDAP, version: 20441 Thu Jun 29 13:12:38 2017 : Debug: rlm_ldap (ldap_firewall): Couldn't find configuration for accounting, will return NOOP for calls from this section Thu Jun 29 13:12:38 2017 : Debug: rlm_ldap (ldap_firewall): Couldn't find configuration for post-auth, will return NOOP for calls from this section Thu Jun 29 13:12:38 2017 : Debug: LDAP server string: ldaps://ldap.cs.ait.ac.th:636 Thu Jun 29 13:12:38 2017 : Debug: rlm_ldap (ldap_firewall): Using local pool section Thu Jun 29 13:12:38 2017 : Debug: rlm_ldap (ldap_firewall): No pool reference found for config item "ldap_firewall.pool" Thu Jun 29 13:12:38 2017 : Debug: rlm_ldap (ldap_firewall): Initialising connection pool ... Thu Jun 29 13:12:38 2017 : Info: rlm_ldap (ldap_firewall): Opening additional connection (0), 1 of 32 pending slots used Thu Jun 29 13:12:38 2017 : Debug: rlm_ldap (ldap_firewall): Connecting to ldaps://ldap.cs.ait.ac.th:636 Thu Jun 29 13:12:38 2017 : Debug: rlm_ldap (ldap_firewall): New libldap handle 0x28e5c1e0 Thu Jun 29 13:12:38 2017 : Error: rlm_ldap (ldap_firewall): Bind with (anonymous) to ldaps://ldap.cs.ait.ac.th:636 failed: Can't contact LDAP server Thu Jun 29 13:12:38 2017 : Debug: rlm_ldap: Closing libldap handle 0x28e5c1e0 Thu Jun 29 13:12:38 2017 : Error: rlm_ldap (ldap_firewall): Opening connection failed (0) Thu Jun 29 13:12:38 2017 : Debug: rlm_ldap (ldap_firewall): Removing connection pool Thu Jun 29 13:12:38 2017 : Error: /usr/local/etc/raddb/mods-enabled/ldap[1]: Instantiation failed for module "ldap_firewall" What could I be missing? I found a reference about OpenLDAP being compiled with NSS, but being on FreeBSD, I am pretty sure that both OpenLDAP and FreeRadius us openssl. TIA, Olivier --

3 4

add attribute when proxying
by denis 29 Jun '17

29 Jun '17

Hello, I have setup made according to robust proxy accounting guide. Now I need freeradius to add Tmp-String-1 attribute to each Access-Request sent to proxy. I tried using policy conf and ulang in robust-proxy-accounting config, but request sent to proxy is still unmodified One of log examples (just for curiosity i'm trying update both - proxy-request and request: (0) server home.mycompany.com { (0) # Executing section pre-proxy from file /etc/freeradius/sites-enabled/robust-proxy-accounting (0) pre-proxy { (0) policy add-attribute { (0) update request { (0) Tmp-String-1 := 1111111 (0) } # update request = noop (0) update proxy-request { (0) Tmp-String-1 := 1111111 (0) } # update proxy-request = noop (0) } # policy add-attribute = noop (0) policy debug_proxy_request { (0) if ("%{debug_attr:proxy-request:}" == '') { (0) Attributes matching "proxy-request:" (0) &proxy-request:User-Name = username (0) &proxy-request:User-Password = password (0) &proxy-request:NAS-Identifier = nasid (0) &proxy-request:Framed-Protocol = PPP (0) &proxy-request:Service-Type = Framed-User (0) &proxy-request:Event-Timestamp = Jun 29 2017 13:51:01 UTC (0) &proxy-request:NAS-IP-Address = 185.7.90.32 (0) &proxy-request:Message-Authenticator := 0x00 (0) &proxy-request:Proxy-State = 0x313636 (0) &proxy-request:Tmp-String-1 := 1111111 (0) EXPAND %{debug_attr:proxy-request:} (0) --> (0) if ("%{debug_attr:proxy-request:}" == '') -> TRUE (0) if ("%{debug_attr:proxy-request:}" == '') { (0) [noop] = noop (0) } # if ("%{debug_attr:proxy-request:}" == '') = noop (0) } # policy debug_proxy_request = noop (0) } # pre-proxy = noop (0) } (0) Proxying request to home server 138.7.90.9 port 1812 timeout 30.000000 (0) Sent Access-Request Id 19 from 0.0.0.0:30848 to 138.7.90.9:1812 length 101 (0) User-Name = "username" (0) User-Password = "password" (0) NAS-Identifier = "nasid" (0) Framed-Protocol = PPP (0) Service-Type = Framed-User (0) Event-Timestamp = "Jun 29 2017 13:51:01 UTC" (0) NAS-IP-Address = 185.7.90.32 (0) Message-Authenticator := 0x00 (0) Proxy-State = 0x313636 Waking up in 0.3 seconds. As you see proxied request is unchaged, while debug output above states attribute was added. For example if in same way I modify existing attribute - this will work fine, i.e Framed-Protocol will be sent to proxy with value I set. update proxy-request { Framed-Protocol := 11111 } But I need new attr added, and now I'm completely out of ideas how to achieve this. Already read lots of mailing archives, unlang doc and etc - still do not understand how attribute can be added. So if someone has any idea - please point me to correct doc/direction. freeradius 3.0.12 -- Denis

2 3

How to avoid EAP-TLS login on commercial CA's?
by Ramon Escriba 29 Jun '17

29 Jun '17

Hello FreeRadius masters, We're planning to use EAP-TTLS with a commercial certificate on freeradius-3.0.4. We do not want any "client certificate" signed by this commercial big CA to log in. Of course, I saw the warning: /etc/raddb/mod-enabled/eap # Note that you should NOT use a globally known CA here! # e.g. using a Verisign cert as a "known CA" means that # ANYONE who has a certificate signed by them can # authenticate via EAP-TLS! This is likely not what you want. But, there's any simple way to forbid globally any CA 'valid client certificate', a part of not using the commercial CA?? Regards.

4 5