- Freeradius-Users - lists.freeradius.org

NAS login class to RADIUS authenticated ldap users
by Darrain Waters 25 Jun '17

25 Jun '17

Hello I need to map ldap authenticated (389directory) users to juniper nas local accounts that all have different access rights. I clearly run the ldap module, and do a group search to verify a user can access based on group. Is it possible to take the group the ldap module finds and map it to a same named account on the juniper nas ? I want to avoid using the remote user id on the juniper nas with the access class that I assign, and instead use the different accounts on the juniper nas which are different access levels: user-ro user-op user-su I have not messed with the git pulled 3.0.14 config files other than ldap, clients.conf and users file. See radiusd -X below for run info. In my users file I have: DEFAULT LDAP-Group == "admins", Auth-Type := Accept Junipers instructions are as follow, which I have tried: In this example a freeradius server is used (more info about freeradius at http://freeradius.org/) The following users are configured in the file /etc/freeradius/users on the freeradius server: tom Cleartext-Password := "tom123" Service-Type = Login-User, Juniper-Local-User-Name := "readonly-users", jerry Cleartext-Password := "jerry123" Service-Type = Login-User, Juniper-Local-User-Name := "super-users", The VSA (vendor specific attribute) "Juniper-Local-User-Name" is used here. This VSA is already present in file /usr/share/freeradius/dictionary.juniper by default and does not need to be configured. On the radius server in file /etc/freeradius/clients.conf the radius secret and client IP address (in this case 0/0, so any IP address) is configured like this example: client 0/0 { secret = juniper shortname = JUNOS-devices } Thank you FreeRADIUS Version 3.0.14 Copyright (C) 1999-2017 The FreeRADIUS server project and contributors There is NO warranty; not even for MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE You may redistribute copies of FreeRADIUS under the terms of the GNU General Public License For more information about these matters, see the file named COPYRIGHT Starting - reading configuration files ... including dictionary file /usr/local/share/freeradius/dictionary including dictionary file /usr/local/share/freeradius/dictionary.dhcp including dictionary file /usr/local/share/freeradius/dictionary.vqp including dictionary file /etc/raddb/dictionary including configuration file /etc/raddb/radiusd.conf including configuration file /etc/raddb/proxy.conf including configuration file /etc/raddb/clients.conf including files in directory /etc/raddb/mods-enabled/ including configuration file /etc/raddb/mods-enabled/passwd including configuration file /etc/raddb/mods-enabled/echo including configuration file /etc/raddb/mods-enabled/cache_eap including configuration file /etc/raddb/mods-enabled/soh including configuration file /etc/raddb/mods-enabled/files including configuration file /etc/raddb/mods-enabled/dynamic_clients including configuration file /etc/raddb/mods-enabled/sradutmp including configuration file /etc/raddb/mods-enabled/realm including configuration file /etc/raddb/mods-enabled/always including configuration file /etc/raddb/mods-enabled/attr_filter including configuration file /etc/raddb/mods-enabled/ntlm_auth including configuration file /etc/raddb/mods-enabled/dhcp including configuration file /etc/raddb/mods-enabled/linelog including configuration file /etc/raddb/mods-enabled/radutmp including configuration file /etc/raddb/mods-enabled/utf8 including configuration file /etc/raddb/mods-enabled/detail.log including configuration file /etc/raddb/mods-enabled/unpack including configuration file /etc/raddb/mods-enabled/expr including configuration file /etc/raddb/mods-enabled/chap including configuration file /etc/raddb/mods-enabled/date including configuration file /etc/raddb/mods-enabled/eap including configuration file /etc/raddb/mods-enabled/logintime including configuration file /etc/raddb/mods-enabled/ldap including configuration file /etc/raddb/mods-enabled/pap including configuration file /etc/raddb/mods-enabled/replicate including configuration file /etc/raddb/mods-enabled/digest including configuration file /etc/raddb/mods-enabled/preprocess including configuration file /etc/raddb/mods-enabled/mschap including configuration file /etc/raddb/mods-enabled/exec including configuration file /etc/raddb/mods-enabled/detail including configuration file /etc/raddb/mods-enabled/unix including configuration file /etc/raddb/mods-enabled/expiration including files in directory /etc/raddb/policy.d/ including configuration file /etc/raddb/policy.d/abfab-tr including configuration file /etc/raddb/policy.d/operator-name including configuration file /etc/raddb/policy.d/debug including configuration file /etc/raddb/policy.d/accounting including configuration file /etc/raddb/policy.d/moonshot-targeted-ids including configuration file /etc/raddb/policy.d/filter including configuration file /etc/raddb/policy.d/dhcp including configuration file /etc/raddb/policy.d/eap including configuration file /etc/raddb/policy.d/canonicalization including configuration file /etc/raddb/policy.d/cui including configuration file /etc/raddb/policy.d/control including files in directory /etc/raddb/sites-enabled/ including configuration file /etc/raddb/sites-enabled/inner-tunnel including configuration file /etc/raddb/sites-enabled/default main { security { allow_core_dumps = no } name = "radiusd" prefix = "/usr/local" localstatedir = "/usr/local/var" logdir = "/var/log" run_dir = "/usr/local/var/run/radiusd" } main { name = "radiusd" prefix = "/usr/local" localstatedir = "/usr/local/var" sbindir = "/usr/local/sbin" logdir = "/var/log" run_dir = "/usr/local/var/run/radiusd" libdir = "/usr/local/lib" radacctdir = "/var/log/radacct" hostname_lookups = no max_request_time = 30 cleanup_delay = 5 max_requests = 16384 pidfile = "/usr/local/var/run/radiusd/radiusd.pid" checkrad = "/usr/local/sbin/checkrad" debug_level = 0 proxy_requests = yes log { stripped_names = no auth = no auth_badpass = no auth_goodpass = no colourise = yes msg_denied = "You are already logged in - access denied" } resources { } security { max_attributes = 200 reject_delay = 1.000000 status_server = yes } } radiusd: #### Loading Realms and Home Servers #### proxy server { retry_delay = 5 retry_count = 3 default_fallback = no dead_time = 120 wake_all_if_all_dead = no } home_server localhost { ipaddr = 127.0.0.1 port = 1812 type = "auth" secret = <<< secret >>> response_window = 20.000000 response_timeouts = 1 max_outstanding = 65536 zombie_period = 40 status_check = "status-server" ping_interval = 30 check_interval = 30 check_timeout = 4 num_answers_to_alive = 3 revive_interval = 120 limit { max_connections = 16 max_requests = 0 lifetime = 0 idle_timeout = 0 } coa { irt = 2 mrt = 16 mrc = 5 mrd = 30 } } home_server_pool my_auth_failover { type = fail-over home_server = localhost } realm example.com { auth_pool = my_auth_failover } realm LOCAL { } radiusd: #### Loading Clients #### client localhost { ipaddr = 127.0.0.1 require_message_authenticator = no secret = <<< secret >>> nas_type = "other" proto = "*" limit { max_connections = 16 lifetime = 0 idle_timeout = 30 } } client scinet-login-node { ipaddr = 10.1.4.46 require_message_authenticator = no secret = <<< secret >>> nas_type = "other" limit { max_connections = 16 lifetime = 0 idle_timeout = 30 } } client mx480-nal-g04-1 { ipaddr = 10.10.0.10 require_message_authenticator = no secret = <<< secret >>> nas_type = "juniper" limit { max_connections = 16 lifetime = 0 idle_timeout = 30 } } client mx480-Albany-3036 { ipaddr = 10.50.0.11 require_message_authenticator = no secret = <<< secret >>> nas_type = "juniper" limit { max_connections = 16 lifetime = 0 idle_timeout = 30 } } client QFX5100-ALB-NWF1-IDF-1 { ipaddr = 10.0.60.1 require_message_authenticator = no secret = <<< secret >>> limit { max_connections = 16 lifetime = 0 idle_timeout = 30 } } client QFX5100-ALB-Rm3034-1 { ipaddr = 10.0.66.1 require_message_authenticator = no secret = <<< secret >>> nas_type = "juniper" limit { max_connections = 16 lifetime = 0 idle_timeout = 30 } } client mx960-ames-core1 { ipaddr = 10.10.0.11 require_message_authenticator = no secret = <<< secret >>> limit { max_connections = 16 lifetime = 0 idle_timeout = 30 } } client mlxe16-CC-131-1 { ipaddr = 10.20.0.11 require_message_authenticator = no secret = <<< secret >>> nas_type = "other" limit { max_connections = 16 lifetime = 0 idle_timeout = 30 } } client mlx8e-SV-07 { ipaddr = 10.30.0.11 require_message_authenticator = no secret = <<< secret >>> nas_type = "other" limit { max_connections = 16 lifetime = 0 idle_timeout = 30 } } client mlxe16-ftc-3020-1 { ipaddr = 10.40.0.11 require_message_authenticator = no secret = <<< secret >>> nas_type = "other" limit { max_connections = 16 lifetime = 0 idle_timeout = 30 } } client SRX550-FTC-SCInet-Rm3020-1 { ipaddr = 10.150.0.2 require_message_authenticator = no secret = <<< secret >>> nas_type = "juniper" limit { max_connections = 16 lifetime = 0 idle_timeout = 30 } } Debugger not attached # Creating Auth-Type = mschap # Creating Auth-Type = eap # Creating Auth-Type = PAP # Creating Auth-Type = CHAP # Creating Auth-Type = MS-CHAP # Creating Auth-Type = digest radiusd: #### Instantiating modules #### modules { # Loaded module rlm_passwd # Loading module "etc_passwd" from file /etc/raddb/mods-enabled/passwd passwd etc_passwd { filename = "/etc/passwd" format = "*User-Name:Crypt-Password:" delimiter = ":" ignore_nislike = no ignore_empty = yes allow_multiple_keys = no hash_size = 100 } # Loaded module rlm_exec # Loading module "echo" from file /etc/raddb/mods-enabled/echo exec echo { wait = yes program = "/bin/echo %{User-Name}" input_pairs = "request" output_pairs = "reply" shell_escape = yes } # Loaded module rlm_cache # Loading module "cache_eap" from file /etc/raddb/mods-enabled/cache_eap cache cache_eap { driver = "rlm_cache_rbtree" key = "%{%{control:State}:-%{%{reply:State}:-%{State}}}" ttl = 15 max_entries = 0 epoch = 0 add_stats = no } # Loaded module rlm_soh # Loading module "soh" from file /etc/raddb/mods-enabled/soh soh { dhcp = yes } # Loaded module rlm_files # Loading module "files" from file /etc/raddb/mods-enabled/files files { filename = "/etc/raddb/mods-config/files/authorize" acctusersfile = "/etc/raddb/mods-config/files/accounting" preproxy_usersfile = "/etc/raddb/mods-config/files/pre-proxy" } # Loaded module rlm_dynamic_clients # Loading module "dynamic_clients" from file /etc/raddb/mods-enabled/dynamic_clients # Loaded module rlm_radutmp # Loading module "sradutmp" from file /etc/raddb/mods-enabled/sradutmp radutmp sradutmp { filename = "/var/log/sradutmp" username = "%{User-Name}" case_sensitive = yes check_with_nas = yes permissions = 420 caller_id = no } # Loaded module rlm_realm # Loading module "IPASS" from file /etc/raddb/mods-enabled/realm realm IPASS { format = "prefix" delimiter = "/" ignore_default = no ignore_null = no } # Loading module "suffix" from file /etc/raddb/mods-enabled/realm realm suffix { format = "suffix" delimiter = "@" ignore_default = no ignore_null = no } # Loading module "realmpercent" from file /etc/raddb/mods-enabled/realm realm realmpercent { format = "suffix" delimiter = "%" ignore_default = no ignore_null = no } # Loading module "ntdomain" from file /etc/raddb/mods-enabled/realm realm ntdomain { format = "prefix" delimiter = "\\" ignore_default = no ignore_null = no } # Loaded module rlm_always # Loading module "reject" from file /etc/raddb/mods-enabled/always always reject { rcode = "reject" simulcount = 0 mpp = no } # Loading module "fail" from file /etc/raddb/mods-enabled/always always fail { rcode = "fail" simulcount = 0 mpp = no } # Loading module "ok" from file /etc/raddb/mods-enabled/always always ok { rcode = "ok" simulcount = 0 mpp = no } # Loading module "handled" from file /etc/raddb/mods-enabled/always always handled { rcode = "handled" simulcount = 0 mpp = no } # Loading module "invalid" from file /etc/raddb/mods-enabled/always always invalid { rcode = "invalid" simulcount = 0 mpp = no } # Loading module "userlock" from file /etc/raddb/mods-enabled/always always userlock { rcode = "userlock" simulcount = 0 mpp = no } # Loading module "notfound" from file /etc/raddb/mods-enabled/always always notfound { rcode = "notfound" simulcount = 0 mpp = no } # Loading module "noop" from file /etc/raddb/mods-enabled/always always noop { rcode = "noop" simulcount = 0 mpp = no } # Loading module "updated" from file /etc/raddb/mods-enabled/always always updated { rcode = "updated" simulcount = 0 mpp = no } # Loaded module rlm_attr_filter # Loading module "attr_filter.post-proxy" from file /etc/raddb/mods-enabled/attr_filter attr_filter attr_filter.post-proxy { filename = "/etc/raddb/mods-config/attr_filter/post-proxy" key = "%{Realm}" relaxed = no } # Loading module "attr_filter.pre-proxy" from file /etc/raddb/mods-enabled/attr_filter attr_filter attr_filter.pre-proxy { filename = "/etc/raddb/mods-config/attr_filter/pre-proxy" key = "%{Realm}" relaxed = no } # Loading module "attr_filter.access_reject" from file /etc/raddb/mods-enabled/attr_filter attr_filter attr_filter.access_reject { filename = "/etc/raddb/mods-config/attr_filter/access_reject" key = "%{User-Name}" relaxed = no } # Loading module "attr_filter.access_challenge" from file /etc/raddb/mods-enabled/attr_filter attr_filter attr_filter.access_challenge { filename = "/etc/raddb/mods-config/attr_filter/access_challenge" key = "%{User-Name}" relaxed = no } # Loading module "attr_filter.accounting_response" from file /etc/raddb/mods-enabled/attr_filter attr_filter attr_filter.accounting_response { filename = "/etc/raddb/mods-config/attr_filter/accounting_response" key = "%{User-Name}" relaxed = no } # Loading module "ntlm_auth" from file /etc/raddb/mods-enabled/ntlm_auth exec ntlm_auth { wait = yes program = "/path/to/ntlm_auth --request-nt-key --domain=MYDOMAIN --username=%{mschap:User-Name} --password=%{User-Password}" shell_escape = yes } # Loaded module rlm_dhcp # Loading module "dhcp" from file /etc/raddb/mods-enabled/dhcp # Loaded module rlm_linelog # Loading module "linelog" from file /etc/raddb/mods-enabled/linelog linelog { filename = "/var/log/linelog" escape_filenames = no syslog_severity = "info" permissions = 384 format = "This is a log message for %{User-Name}" reference = "messages.%{%{reply:Packet-Type}:-default}" } # Loading module "log_accounting" from file /etc/raddb/mods-enabled/linelog linelog log_accounting { filename = "/var/log/linelog-accounting" escape_filenames = no syslog_severity = "info" permissions = 384 format = "" reference = "Accounting-Request.%{%{Acct-Status-Type}:-unknown}" } # Loading module "radutmp" from file /etc/raddb/mods-enabled/radutmp radutmp { filename = "/var/log/radutmp" username = "%{User-Name}" case_sensitive = yes check_with_nas = yes permissions = 384 caller_id = yes } # Loaded module rlm_utf8 # Loading module "utf8" from file /etc/raddb/mods-enabled/utf8 # Loaded module rlm_detail # Loading module "auth_log" from file /etc/raddb/mods-enabled/detail.log detail auth_log { filename = "/var/log/radacct/%{%{Packet-Src-IP-Address}:-%{Packet-Src-IPv6-Address}}/auth-detail-%Y%m%d" header = "%t" permissions = 384 locking = no escape_filenames = no log_packet_header = no } # Loading module "reply_log" from file /etc/raddb/mods-enabled/detail.log detail reply_log { filename = "/var/log/radacct/%{%{Packet-Src-IP-Address}:-%{Packet-Src-IPv6-Address}}/reply-detail-%Y%m%d" header = "%t" permissions = 384 locking = no escape_filenames = no log_packet_header = no } # Loading module "pre_proxy_log" from file /etc/raddb/mods-enabled/detail.log detail pre_proxy_log { filename = "/var/log/radacct/%{%{Packet-Src-IP-Address}:-%{Packet-Src-IPv6-Address}}/pre-proxy-detail-%Y%m%d" header = "%t" permissions = 384 locking = no escape_filenames = no log_packet_header = no } # Loading module "post_proxy_log" from file /etc/raddb/mods-enabled/detail.log detail post_proxy_log { filename = "/var/log/radacct/%{%{Packet-Src-IP-Address}:-%{Packet-Src-IPv6-Address}}/post-proxy-detail-%Y%m%d" header = "%t" permissions = 384 locking = no escape_filenames = no log_packet_header = no } # Loaded module rlm_unpack # Loading module "unpack" from file /etc/raddb/mods-enabled/unpack # Loaded module rlm_expr # Loading module "expr" from file /etc/raddb/mods-enabled/expr expr { safe_characters = "@abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ0123456789.-_: /äéöüàâæçèéêëîïôœùûüaÿÄÉÖÜßÀÂÆÇÈÉÊËÎÏÔŒÙÛÜŸ" } # Loaded module rlm_chap # Loading module "chap" from file /etc/raddb/mods-enabled/chap # Loaded module rlm_date # Loading module "date" from file /etc/raddb/mods-enabled/date date { format = "%b %e %Y %H:%M:%S %Z" utc = no } # Loaded module rlm_eap # Loading module "eap" from file /etc/raddb/mods-enabled/eap eap { default_eap_type = "md5" timer_expire = 60 ignore_unknown_eap_types = no cisco_accounting_username_bug = no max_sessions = 16384 } # Loaded module rlm_logintime # Loading module "logintime" from file /etc/raddb/mods-enabled/logintime logintime { minimum_timeout = 60 } # Loaded module rlm_ldap # Loading module "ldap" from file /etc/raddb/mods-enabled/ldap ldap { server = "10.1.0.9" identity = "cn=Directory Manager" password = <<< secret >>> sasl { } user { scope = "sub" access_positive = yes sasl { } } group { filter = "(objectClass=posixGroup)" scope = "sub" name_attribute = "cn" membership_attribute = "memberOf" membership_filter = "(memberof=%{control:Ldap-UserDn})(&(objectClass=GroupOfUniqueNames)(uniquemember=%{control:Ldap-UserDn}))" cacheable_name = no cacheable_dn = no } client { filter = "(objectClass=radiusClient)" scope = "sub" base_dn = "cn=users,cn=accounts,dc=scinet,dc=ars,dc=usda,dc=gov" } profile { } options { ldap_debug = 40 chase_referrals = yes rebind = yes net_timeout = 1 res_timeout = 10 srv_timelimit = 3 idle = 60 probes = 3 interval = 3 } tls { start_tls = no } } Creating attribute LDAP-Group # Loaded module rlm_pap # Loading module "pap" from file /etc/raddb/mods-enabled/pap pap { normalise = yes } # Loaded module rlm_replicate # Loading module "replicate" from file /etc/raddb/mods-enabled/replicate # Loaded module rlm_digest # Loading module "digest" from file /etc/raddb/mods-enabled/digest # Loaded module rlm_preprocess # Loading module "preprocess" from file /etc/raddb/mods-enabled/preprocess preprocess { huntgroups = "/etc/raddb/mods-config/preprocess/huntgroups" hints = "/etc/raddb/mods-config/preprocess/hints" with_ascend_hack = no ascend_channels_per_line = 23 with_ntdomain_hack = no with_specialix_jetstream_hack = no with_cisco_vsa_hack = no with_alvarion_vsa_hack = no } # Loaded module rlm_mschap # Loading module "mschap" from file /etc/raddb/mods-enabled/mschap mschap { use_mppe = yes require_encryption = no require_strong = no with_ntdomain_hack = yes passchange { } allow_retry = yes winbind_retry_with_normalised_username = no } # Loading module "exec" from file /etc/raddb/mods-enabled/exec exec { wait = no input_pairs = "request" shell_escape = yes timeout = 10 } # Loading module "detail" from file /etc/raddb/mods-enabled/detail detail { filename = "/var/log/radacct/%{%{Packet-Src-IP-Address}:-%{Packet-Src-IPv6-Address}}/detail-%Y%m%d" header = "%t" permissions = 384 locking = no escape_filenames = no log_packet_header = no } # Loaded module rlm_unix # Loading module "unix" from file /etc/raddb/mods-enabled/unix unix { radwtmp = "/var/log/radwtmp" } Creating attribute Unix-Group # Loaded module rlm_expiration # Loading module "expiration" from file /etc/raddb/mods-enabled/expiration instantiate { } # Instantiating module "etc_passwd" from file /etc/raddb/mods-enabled/passwd rlm_passwd: nfields: 3 keyfield 0(User-Name) listable: no # Instantiating module "cache_eap" from file /etc/raddb/mods-enabled/cache_eap rlm_cache (cache_eap): Driver rlm_cache_rbtree (module rlm_cache_rbtree) loaded and linked # Instantiating module "files" from file /etc/raddb/mods-enabled/files reading pairlist file /etc/raddb/mods-config/files/authorize reading pairlist file /etc/raddb/mods-config/files/accounting reading pairlist file /etc/raddb/mods-config/files/pre-proxy # Instantiating module "IPASS" from file /etc/raddb/mods-enabled/realm # Instantiating module "suffix" from file /etc/raddb/mods-enabled/realm # Instantiating module "realmpercent" from file /etc/raddb/mods-enabled/realm # Instantiating module "ntdomain" from file /etc/raddb/mods-enabled/realm # Instantiating module "reject" from file /etc/raddb/mods-enabled/always # Instantiating module "fail" from file /etc/raddb/mods-enabled/always # Instantiating module "ok" from file /etc/raddb/mods-enabled/always # Instantiating module "handled" from file /etc/raddb/mods-enabled/always # Instantiating module "invalid" from file /etc/raddb/mods-enabled/always # Instantiating module "userlock" from file /etc/raddb/mods-enabled/always # Instantiating module "notfound" from file /etc/raddb/mods-enabled/always # Instantiating module "noop" from file /etc/raddb/mods-enabled/always # Instantiating module "updated" from file /etc/raddb/mods-enabled/always # Instantiating module "attr_filter.post-proxy" from file /etc/raddb/mods-enabled/attr_filter reading pairlist file /etc/raddb/mods-config/attr_filter/post-proxy # Instantiating module "attr_filter.pre-proxy" from file /etc/raddb/mods-enabled/attr_filter reading pairlist file /etc/raddb/mods-config/attr_filter/pre-proxy # Instantiating module "attr_filter.access_reject" from file /etc/raddb/mods-enabled/attr_filter reading pairlist file /etc/raddb/mods-config/attr_filter/access_reject [/etc/raddb/mods-config/attr_filter/access_reject]:11 Check item "FreeRADIUS-Response-Delay" found in filter list for realm "DEFAULT". [/etc/raddb/mods-config/attr_filter/access_reject]:11 Check item "FreeRADIUS-Response-Delay-USec" found in filter list for realm "DEFAULT". # Instantiating module "attr_filter.access_challenge" from file /etc/raddb/mods-enabled/attr_filter reading pairlist file /etc/raddb/mods-config/attr_filter/access_challenge # Instantiating module "attr_filter.accounting_response" from file /etc/raddb/mods-enabled/attr_filter reading pairlist file /etc/raddb/mods-config/attr_filter/accounting_response # Instantiating module "linelog" from file /etc/raddb/mods-enabled/linelog # Instantiating module "log_accounting" from file /etc/raddb/mods-enabled/linelog # Instantiating module "auth_log" from file /etc/raddb/mods-enabled/detail.log rlm_detail (auth_log): 'User-Password' suppressed, will not appear in detail output # Instantiating module "reply_log" from file /etc/raddb/mods-enabled/detail.log # Instantiating module "pre_proxy_log" from file /etc/raddb/mods-enabled/detail.log # Instantiating module "post_proxy_log" from file /etc/raddb/mods-enabled/detail.log # Instantiating module "eap" from file /etc/raddb/mods-enabled/eap # Linked to sub-module rlm_eap_md5 # Linked to sub-module rlm_eap_leap # Linked to sub-module rlm_eap_gtc gtc { challenge = "Password: " auth_type = "PAP" } # Linked to sub-module rlm_eap_tls tls { tls = "tls-common" } tls-config tls-common { verify_depth = 0 ca_path = "/etc/raddb/certs" pem_file_type = yes private_key_file = "/etc/raddb/certs/server.pem" certificate_file = "/etc/raddb/certs/server.pem" ca_file = "/etc/raddb/certs/ca.pem" private_key_password = <<< secret >>> dh_file = "/etc/raddb/certs/dh" fragment_size = 1024 include_length = yes auto_chain = yes check_crl = no check_all_crl = no cipher_list = "DEFAULT" cipher_server_preference = no ecdh_curve = "prime256v1" cache { enable = no lifetime = 24 max_entries = 255 } verify { skip_if_ocsp_ok = no } ocsp { enable = no override_cert_url = yes url = "http://127.0.0.1/ocsp/" use_nonce = yes timeout = 0 softfail = no } } # Linked to sub-module rlm_eap_ttls ttls { tls = "tls-common" default_eap_type = "md5" copy_request_to_tunnel = no use_tunneled_reply = no virtual_server = "inner-tunnel" include_length = yes require_client_cert = no } tls: Using cached TLS configuration from previous invocation # Linked to sub-module rlm_eap_peap peap { tls = "tls-common" default_eap_type = "mschapv2" copy_request_to_tunnel = no use_tunneled_reply = no proxy_tunneled_request_as_eap = yes virtual_server = "inner-tunnel" soh = no require_client_cert = no } tls: Using cached TLS configuration from previous invocation # Linked to sub-module rlm_eap_mschapv2 mschapv2 { with_ntdomain_hack = no send_error = no } # Instantiating module "logintime" from file /etc/raddb/mods-enabled/logintime # Instantiating module "ldap" from file /etc/raddb/mods-enabled/ldap rlm_ldap: libldap vendor: OpenLDAP, version: 20440 accounting { reference = "%{tolower:type.%{Acct-Status-Type}}" } post-auth { reference = "." } rlm_ldap (ldap): Initialising connection pool pool { start = 5 min = 3 max = 32 spare = 10 uses = 0 lifetime = 0 cleanup_interval = 30 idle_timeout = 60 retry_delay = 30 spread = no } rlm_ldap (ldap): Opening additional connection (0), 1 of 32 pending slots used rlm_ldap (ldap): Connecting to ldap://10.1.0.9:389 rlm_ldap (ldap): Waiting for bind result... rlm_ldap (ldap): Bind successful rlm_ldap (ldap): Opening additional connection (1), 1 of 31 pending slots used rlm_ldap (ldap): Connecting to ldap://10.1.0.9:389 rlm_ldap (ldap): Waiting for bind result... rlm_ldap (ldap): Bind successful rlm_ldap (ldap): Opening additional connection (2), 1 of 30 pending slots used rlm_ldap (ldap): Connecting to ldap://10.1.0.9:389 rlm_ldap (ldap): Waiting for bind result... rlm_ldap (ldap): Bind successful rlm_ldap (ldap): Opening additional connection (3), 1 of 29 pending slots used rlm_ldap (ldap): Connecting to ldap://10.1.0.9:389 rlm_ldap (ldap): Waiting for bind result... rlm_ldap (ldap): Bind successful rlm_ldap (ldap): Opening additional connection (4), 1 of 28 pending slots used rlm_ldap (ldap): Connecting to ldap://10.1.0.9:389 rlm_ldap (ldap): Waiting for bind result... rlm_ldap (ldap): Bind successful # Instantiating module "pap" from file /etc/raddb/mods-enabled/pap # Instantiating module "preprocess" from file /etc/raddb/mods-enabled/preprocess reading pairlist file /etc/raddb/mods-config/preprocess/huntgroups reading pairlist file /etc/raddb/mods-config/preprocess/hints # Instantiating module "mschap" from file /etc/raddb/mods-enabled/mschap rlm_mschap (mschap): using internal authentication # Instantiating module "detail" from file /etc/raddb/mods-enabled/detail # Instantiating module "expiration" from file /etc/raddb/mods-enabled/expiration } # modules radiusd: #### Loading Virtual Servers #### server { # from file /etc/raddb/radiusd.conf } # server server inner-tunnel { # from file /etc/raddb/sites-enabled/inner-tunnel # Loading authenticate {...} # Loading authorize {...} Ignoring "sql" (see raddb/mods-available/README.rst) # Loading session {...} # Loading post-proxy {...} # Loading post-auth {...} # Skipping contents of 'if' as it is always 'false' -- /etc/raddb/sites-enabled/inner-tunnel:331 } # server inner-tunnel server default { # from file /etc/raddb/sites-enabled/default # Loading authenticate {...} # Loading authorize {...} # Loading preacct {...} # Loading accounting {...} # Loading post-proxy {...} # Loading post-auth {...} } # server default radiusd: #### Opening IP addresses and Ports #### listen { type = "auth" ipaddr = 127.0.0.1 port = 18120 } listen { type = "auth" ipaddr = 10.1.0.150 port = 0 limit { max_connections = 16 lifetime = 0 idle_timeout = 60 } } listen { type = "acct" ipaddr = 10.1.0.150 port = 0 limit { max_connections = 16 lifetime = 0 idle_timeout = 30 } } Listening on auth address 127.0.0.1 port 18120 bound to server inner-tunnel Listening on auth address 10.1.0.150 port 1812 bound to server default Listening on acct address 10.1.0.150 port 1813 bound to server default Listening on proxy address * port 51049 Ready to process requests 1) Received Access-Request Id 70 from 10.10.0.10:51639 to 10.1.0.150:1812 length 112 (1) User-Name = "darrain.waters-admin" (1) User-Password = "*" (1) NAS-Identifier = "mx480-nal-g04-1" (1) Calling-Station-Id = "10.99.99.10" (1) NAS-IP-Address = 192.168.0.1 (1) # Executing section authorize from file /etc/raddb/sites-enabled/default (1) authorize { (1) policy filter_username { (1) if (&User-Name) { (1) if (&User-Name) -> TRUE (1) if (&User-Name) { (1) if (&User-Name =~ / /) { (1) if (&User-Name =~ / /) -> FALSE (1) if (&User-Name =~ /@[^@]*@/ ) { (1) if (&User-Name =~ /@[^@]*@/ ) -> FALSE (1) if (&User-Name =~ /\.\./ ) { (1) if (&User-Name =~ /\.\./ ) -> FALSE (1) if ((&User-Name =~ /@/) && (&User-Name !~ /(a)(.+)\.(.+)$/)) { (1) if ((&User-Name =~ /@/) && (&User-Name !~ /(a)(.+)\.(.+)$/)) -> FALSE (1) if (&User-Name =~ /\.$/) { (1) if (&User-Name =~ /\.$/) -> FALSE (1) if (&User-Name =~ /(a)\./) { (1) if (&User-Name =~ /(a)\./) -> FALSE (1) } # if (&User-Name) = notfound (1) } # policy filter_username = notfound (1) [preprocess] = ok (1) auth_log: EXPAND /var/log/radacct/%{%{Packet-Src-IP-Address}:-%{Packet-Src-IPv6-Address}}/auth-detail-%Y%m%d (1) auth_log: --> /var/log/radacct/10.10.0.10/auth-detail-20170624 (1) auth_log: /var/log/radacct/%{%{Packet-Src-IP-Address}:-%{Packet-Src-IPv6-Address}}/auth-detail-%Y%m%d expands to /var/log/radacct/10.10.0.10/auth-detail-20170624 (1) auth_log: EXPAND %t (1) auth_log: --> Sat Jun 24 16:46:10 2017 (1) [auth_log] = ok (1) [chap] = noop (1) [mschap] = noop (1) [digest] = noop (1) suffix: Checking for suffix after "@" (1) suffix: No '@' in User-Name = "darrain.waters-admin", looking up realm NULL (1) suffix: No such realm "NULL" (1) [suffix] = noop (1) eap: No EAP-Message, not doing EAP (1) [eap] = noop rlm_ldap (ldap): Closing connection (2): Hit idle_timeout, was idle for 79 seconds rlm_ldap (ldap): Closing connection (3): Hit idle_timeout, was idle for 79 seconds rlm_ldap (ldap): Closing connection (4): Hit idle_timeout, was idle for 79 seconds rlm_ldap (ldap): Reserved connection (0) (1) ldap: EXPAND (uid=%{%{Stripped-User-Name}:-%{User-Name}}) (1) ldap: --> (uid=darrain.waters-admin) (1) ldap: Performing search in "cn=users,cn=accounts,dc=scinet,dc=ars,dc=usda,dc=gov" with filter "(uid=darrain.waters-admin)", scope "sub" (1) ldap: Waiting for search result... (1) ldap: User object found at DN "uid=darrain.waters-admin,cn=users,cn=accounts,dc=scinet,dc=ars,dc=usda,dc=gov" (1) ldap: Processing user attributes (1) ldap: control:Password-With-Header += '{SSHA}xOm2VtJIOjqbxdDvam0B27+oqrLsRiBxfVZyaw==' rlm_ldap (ldap): Released connection (0) Need 7 more connections to reach 10 spares rlm_ldap (ldap): Opening additional connection (6), 1 of 29 pending slots used rlm_ldap (ldap): Connecting to ldap://10.1.0.9:389 rlm_ldap (ldap): Waiting for bind result... rlm_ldap (ldap): Bind successful (1) [ldap] = updated (1) files: Searching for user in group "admins" rlm_ldap (ldap): Reserved connection (5) (1) files: Using user DN from request "uid=darrain.waters-admin,cn=users,cn=accounts,dc=scinet,dc=ars,dc=usda,dc=gov" (1) files: Checking for user in group objects (1) files: EXPAND (&(cn=admins)(objectClass=posixGroup)(memberof=%{control:Ldap-UserDn})(&(objectClass=GroupOfUniqueNames)(uniquemember=%{control:Ldap-UserDn}))) (1) files: --> (&(cn=admins)(objectClass=posixGroup)(memberof=uid\3ddarrain.waters-admin\2ccn\3dusers\2ccn\3daccounts\2cdc\3dscinet\2cdc\3dars\2cdc\3dusda\2cdc\3dgov)(&(objectClass=GroupOfUniqueNames)(uniquemember=uid\3ddarrain.waters-admin\2ccn\3dusers\2ccn\3daccounts\2cdc\3dscinet\2cdc\3dars\2cdc\3dusda\2cdc\3dgov))) (1) files: Performing search in "cn=users,cn=accounts,dc=scinet,dc=ars,dc=usda,dc=gov" with filter "(&(cn=admins)(objectClass=posixGroup)(memberof=uid\3ddarrain.waters-admin\2ccn\3dusers\2ccn\3daccounts\2cdc\3dscinet\2cdc\3dars\2cdc\3dusda\2cdc\3dgov)(&(objectClass=GroupOfUniqueNames)(uniquemember=uid\3ddarrain.waters-admin\2ccn\3dusers\2ccn\3daccounts\2cdc\3dscinet\2cdc\3dars\2cdc\3dusda\2cdc\3dgov)))", scope "sub" (1) files: Waiting for search result... (1) files: Search returned no results (1) files: Checking user object's memberOf attributes (1) files: Performing unfiltered search in "uid=darrain.waters-admin,cn=users,cn=accounts,dc=scinet,dc=ars,dc=usda,dc=gov", scope "base" (1) files: Waiting for search result... (1) files: Processing memberOf value "cn=admins,cn=groups,cn=accounts,dc=scinet,dc=ars,dc=usda,dc=gov" as a DN (1) files: Resolving group DN "cn=admins,cn=groups,cn=accounts,dc=scinet,dc=ars,dc=usda,dc=gov" to group name (1) files: Performing unfiltered search in "cn=admins,cn=groups,cn=accounts,dc=scinet,dc=ars,dc=usda,dc=gov", scope "base" (1) files: Waiting for search result... (1) files: Group DN "cn=admins,cn=groups,cn=accounts,dc=scinet,dc=ars,dc=usda,dc=gov" resolves to name "admins" (1) files: User found in group "admins". Comparison between membership: name (resolved from DN "cn=admins,cn=groups,cn=accounts,dc=scinet,dc=ars,dc=usda,dc=gov"), check: name rlm_ldap (ldap): Released connection (5) (1) files: users: Matched entry DEFAULT at line 72 (1) [files] = ok (1) [expiration] = noop (1) [logintime] = noop (1) pap: Converted: &control:Password-With-Header -> &control:SSHA1-Password (1) pap: Removing &control:Password-With-Header (1) pap: Normalizing SSHA1-Password from base64 encoding, 40 bytes -> 28 bytes (1) pap: WARNING: Auth-Type already set. Not setting to PAP (1) [pap] = noop (1) } # authorize = updated (1) Found Auth-Type = Accept (1) Auth-Type = Accept, accepting the user (1) # Executing section post-auth from file /etc/raddb/sites-enabled/default (1) post-auth { (1) update { (1) No attributes updated (1) } # update = noop (1) [exec] = noop (1) policy remove_reply_message_if_eap { (1) if (&reply:EAP-Message && &reply:Reply-Message) { (1) if (&reply:EAP-Message && &reply:Reply-Message) -> FALSE (1) else { (1) [noop] = noop (1) } # else = noop (1) } # policy remove_reply_message_if_eap = noop (1) } # post-auth = noop (1) Sent Access-Accept Id 70 from 10.1.0.150:1812 to 10.10.0.10:51639 length 0 (1) Finished request Waking up in 4.9 seconds. (1) Cleaning up request packet ID 70 with timestamp +79

2 4

debug logging
by Andrew Meyer 25 Jun '17

25 Jun '17

Is there a way to always log in debug mode?

2 1

setting up users
by Andrew Meyer 24 Jun '17

24 Jun '17

I need some help setting up users. Here is what I have in my config: Untitled - Modern Paste | | | Untitled - Modern Paste | | |

1 1

radmin not working
by Andrew Meyer 22 Jun '17

22 Jun '17

Hi I am running CentOS 7.3 with the latest FreeRADIUS available. I am having trouble getting radmin working getting the following error when trying to run it. [root@asm-rancid01 ~]# radmin -f /etc/raddb/sites-enabled/control-socketradmin: Failed connecting to /etc/raddb/sites-enabled/control-socket: Too many levels of symbolic links[root@asm-rancid01 ~]# radminradmin: Could not find control socket in /etc/raddb/radiusd.conf [root@asm-rancid01 ~]# cd /etc/raddb/sites-enabled/[root@asm-rancid01 sites-enabled]# ls -latotal 4drwxr-x---. 2 root radiusd 63 Jun 22 10:42 .drwxr-xr-x. 9 root radiusd 4096 Jun 22 10:41 ..lrwxrwxrwx. 1 root root 14 Jun 22 10:42 control-socket -> control-socketlrwxrwxrwx. 1 root radiusd 26 Jun 17 17:56 default -> ../sites-available/defaultlrwxrwxrwx. 1 root radiusd 31 Jun 17 17:56 inner-tunnel -> ../sites-available/inner-tunnel[root@asm-rancid01 sites-enabled]# Radiusd start and I see no errors in the logs. sudo cat /etc/raddb/sites-available/control-socket |grep "^[^#;]"listen { # # Listen on the control socket. #type = control # # Socket location. # # This file is created with the server's uid and gid. # It's permissions are r/w for that user and group, and # no permissions for "other" users. These permissions form # minimal security, and should not be relied on. # socket = ${run_dir}/${name}.sock # # The following two parameters perform authentication and # authorization of connections to the control socket. # # If not set, then ANYONE can connect to the control socket, # and have complete control over the server. This is likely # not what you want. # # One, or both, of "uid" and "gid" should be set. If set, the # corresponding value is checked. Unauthorized users result # in an error message in the log file, and the connection is # closed. # # # Name of user that is allowed to connect to the control socket. # uid = radius # # Name of group that is allowed to connect to the control socket. # gid = radius # # Access mode. # # This can be used to give *some* administrators access to # monitor the system, but not to change it. # # ro = read only access (default) # rw = read/write access. # mode = rw}

2 2

Re: understanding NAS and accounting packets
by Yusuf Siddiqui 22 Jun '17

22 Jun '17

Hi Saurabh You don't require a third party NAS server. Your Dlink is enough to work like a NAS or you can make your local radius server machine a NAS. Yes,you configure your wireless security using radius authentication and configure the client credential on the page,that's it. Regards Yusuf On 21-Jun-2017 3:21 am, "Saurabh Shandilya" <saurabhshandilya.1991(a)gmail.com> wrote: On Wed, Jun 21, 2017 at 3:02 AM, Alan DeKok <aland(a)deployingradius.com> wrote: > On Jun 20, 2017, at 5:23 PM, Saurabh Shandilya < > saurabhshandilya.1991(a)gmail.com> wrote: > > Now how to know about my NAS, as far as i know, its a very simple router > > Dlink 850l Hardware Version A1, Firmware 1.12WW. > > I mean what is the measuring axis for this to know about the kind of NAS > I > > have and what all features it support ? > > Ask the NAS vendor. > > There are a 1000 companies selling NAS equipment. Each company has 1000 > products and/or firmware revisions. > > We can't keep track of them all. > > Ask the NAS vendor for documentation on how their equipment works. > > Indeed Alan, I didn't mean to put that way to show you people that you should do any such sort of thing. All I meant was just to know about if at all, there exists any such method(a call or functionality in the deivce itself) that can tell on request if it supports these functions or not. Anyway I understand your point and will search it out with my vendor. Thanks > Alan DeKok. > > > - > List info/subscribe/unsubscribe? See http://www.freeradius.org/ > list/users.html > -- Regards, saurabh shandilya www.embedded4fun.com https://in.linkedin.com/in/shandilyasaurabh - List info/subscribe/unsubscribe? See http://www.freeradius.org/ list/users.html

1 0

Counter attribute Daily-Session-Time MUST be integer64
by akash＠arrownet.com.np 21 Jun '17

21 Jun '17

I am getting following issue. rlm_sql (sql): Driver rlm_sql_mysql (module rlm_sql_mysql) loaded and linked Creating attribute SQL-Group # Loaded module rlm_sqlcounter # Loading module "dailycounter" from file /etc/raddb/mods-enabled/sqlcounter sqlcounter dailycounter { sql_module_instance = "sql" key = "User-Name" query = "SELECT SUM(acctsessiontime - GREATEST((%%b - UNIX_TIMESTAMP(acctstarttime)), 0)) FROM radacct WHERE username = '%{User-Name}' AND UNIX_TIMESTAMP(acctstarttime) + acctsessiontime > '%%b'" reset = "daily" counter_name = "Daily-Session-Time" check_name = "Max-Daily-Session" reply_name = "Session-Timeout" } /etc/raddb/mods-enabled/sqlcounter[41]: Counter attribute Daily-Session-Time MUST be integer64 /etc/raddb/mods-enabled/sqlcounter[41]: Instantiation failed for module "dailycounter"

2 1

Random crash after upgrading to 3.0.14 from 3.0.13
by Burn Zero 21 Jun '17

21 Jun '17

Hi, OS: CentOS Linux release 7.2.1511 (Core) 64 bit Openssl version: OpenSSL 1.0.2k I recently tried to upgrade to version 3.0.14 from 3.0.13. I uninstalled the 3.0.13 version rpm's and used 3.0.14 rpms. freeradius-3.0.14-2.1.x86_64.rpm freeradius-ldap-3.0.14-2.1.x86_64.rpm freeradius-utils-3.0.14-2.1.x86_64.rpm freeradius-config-3.0.14-2.1.x86_64.rpm I then copied the backed up raddb config files from 3.0.13 to new installation dir and restarted radius server. But then it got crashed randomly. Here's the debug log: *** Error in `radiusd': double free or corruption (!prev): 0x0000000000f33d60 *** ======= Backtrace: ========= /lib64/libc.so.6(+0x7c503)[0x7fe7937b0503] /lib64/libcrypto.so.10(CRYPTO_free+0x1d)[0x7fe794f0e7ad] /lib64/libssl.so.10(ssl_get_prev_session+0xd6)[0x7fe794c7fb66] /lib64/libssl.so.10(ssl3_get_client_hello+0x227)[0x7fe794c54bc7] /lib64/libssl.so.10(ssl3_accept+0x95d)[0x7fe794c5980d] /lib64/libssl.so.10(ssl23_accept+0x1c8)[0x7fe794c67478] /lib64/libssl.so.10(ssl23_read+0x32)[0x7fe794c68612] radiusd(tls_handshake_recv+0xa2)[0x4404d2] /usr/lib64/freeradius/libfreeradius-eap.so(eaptls_process+0x901)[0x7fe7952950a1] /usr/lib64/freeradius/rlm_eap_tls.so(+0xdee)[0x7fe78ab88dee] /usr/lib64/freeradius/rlm_eap.so(+0x3812)[0x7fe78e874812] /usr/lib64/freeradius/rlm_eap.so(eap_method_select+0x2d3)[0x7fe78e874d33] /usr/lib64/freeradius/rlm_eap.so(+0x2b26)[0x7fe78e873b26] radiusd[0x426d3e] radiusd[0x425e69] radiusd[0x42604e] radiusd(modcall+0x56)[0x427266] radiusd(indexed_modcall+0xad)[0x421e7d] radiusd(rad_authenticate+0x7ce)[0x4112ce] radiusd[0x4353c2] radiusd[0x431344] radiusd(request_receive+0x2a1)[0x432ad1] radiusd[0x41ca5e] radiusd[0x42f94e] /usr/lib64/freeradius/libfreeradius-radius.so(fr_event_loop+0x345)[0x7fe7954c57c5] radiusd(main+0x756)[0x40fdc6] /lib64/libc.so.6(__libc_start_main+0xf5)[0x7fe793755b35] radiusd[0x41012a] ======= Memory map: ======== 00400000-00464000 r-xp 00000000 fd:00 531162 /usr/sbin/radiusd 00663000-00666000 r--p 00063000 fd:00 531162 /usr/sbin/radiusd 00666000-0066a000 rw-p 00066000 fd:00 531162 /usr/sbin/radiusd 0066a000-0066c000 rw-p 00000000 00:00 0 008d6000-01050000 rw-p 00000000 00:00 0 [heap] 7fe784000000-7fe784021000 rw-p 00000000 00:00 0 7fe784021000-7fe788000000 ---p 00000000 00:00 0 7fe78a577000-7fe78a579000 r-xp 00000000 fd:00 920239 /usr/lib64/freeradius/rlm_cache_rbtree.so 7fe78a579000-7fe78a779000 ---p 00002000 fd:00 920239 /usr/lib64/freeradius/rlm_cache_rbtree.so 7fe78a779000-7fe78a77a000 r--p 00002000 fd:00 920239 /usr/lib64/freeradius/rlm_cache_rbtree.so 7fe78a77a000-7fe78a77b000 rw-p 00003000 fd:00 920239 /usr/lib64/freeradius/rlm_cache_rbtree.so 7fe78a77b000-7fe78a77f000 r-xp 00000000 fd:00 920253 /usr/lib64/freeradius/rlm_eap_mschapv2.so 7fe78a77f000-7fe78a97e000 ---p 00004000 fd:00 920253 /usr/lib64/freeradius/rlm_eap_mschapv2.soAborted Does any one know what this mean? Thank you.

2 1

understanding NAS and accounting packets
by Saurabh Shandilya 20 Jun '17

20 Jun '17

Hi all, I am using freeradius server on my AWS. Freeradius version : 2.2.8 on 64bit system installed it via package manager. I have tried to go through a few times over the online present materials for freeradius but still I am not able to wrap my head around NAS. Here is my picture & current understanding: *Wireless AP* : D link 850l ; WPA-enterprise is only on 5 GHz band. The router firmware gives me this flexibility to put different security provisions on 2.4 and 5.0 GHz spectrum. AWS instance : *freeradius* server running. radtest output is correct as I can see by username and password being authenticated by access-accept response. 1. One of my node i.e laptop/mobile phone tries to connect to my wireless access point at 5.0 GHz. 2. I recieve packets at my freeradius server as I see it by running with -X swtich. 3. Successfull authentication is done and my device is connected. The problem arises for me when there occurs no accounting packets, the radacct table is empty all along. As what I think I understand by reading materails over internet, it seems like NAS sends this which I probably was considering my router to be. Is my d-link 850l is NAS? or I am getting it all wrong? There are no accounting packets, I checked it with radsniff. I am attaching a very big output response from my free-radius output. Initial few attempts are done while I tried connecting from my android phone to wireless AP with wrong credentials. Line number 1890 is when I sent request with correct credentials. Also, attaching my default file under sites-enabled/. I understand that I am here asking two things but I guess thats how I come to know about the problem. Let me know if any other outputs or logs are required. -- Regards, saurabh shandilya www.embedded4fun.com https://in.linkedin.com/in/shandilyasaurabh

3 6

Do-Over: Post-Auth-Type Accept vs Post-Auth-Type Reject 3.0.14
by Wussler, Doug 20 Jun '17

20 Jun '17

First, allow me to preface my inquiry by saying that we have been using FreeRADIUS for at least 5 years now. It does a fantastic job for us and we very much appreciate having access to this excellent application and to this extremely responsive listserv. We are grateful and send our thanks to all contributors. Now, to my inquiry: In “radiusd.conf” the “log {}” section defines radius log processing. In particular, “msg_goodpass” and “msg_badpass” allow you to add arbitrary info to your log records through the expansion of custom variables. Our config looks like this: log { destination = files file = ${logdir}/radius.log auth = yes msg_goodpass = "%{SSID} %{Aruba-Location-Id} %{Aruba-AP-Group} %{Aruba-Device-Type} %{reply:VLAN}" msg_badpass = "%{SSID} %{Aruba-Location-Id} %{Aruba-AP-Group} %{Aruba-Device-Type}" } Here is the relevant debug from a successful PEAP-MSChapV2 authentication. Note that the “Post-Auth” processing takes place BEFORE the log record is expanded and written. (9) # Executing section post-auth from file /usr/local/etc/raddb/sites-enabled/fsu-1812 (9) post-auth { (9) if ( session-state:Cached-Session-Policy ) { (9) if ( session-state:Cached-Session-Policy ) -> FALSE (9) policy fsu-policy { (9) if ( &Client-Shortname =~ /City/ ) { (9) EXPAND &Client-Shortname (9) --> CL (9) if ( &Client-Shortname =~ /City/ ) -> FALSE (9) else { (9) update { (9) &reply:Aruba-User-Vlan := &reply:VLAN -> 8 (9) } # update = noop (9) } # else = noop (9) if ( !&SSID ) { (9) if ( !&SSID ) -> TRUE (9) if ( !&SSID ) { (9) if ( &Aruba-Essid-Name ) { (9) if ( &Aruba-Essid-Name ) -> TRUE (9) if ( &Aruba-Essid-Name ) { (9) update { (9) &SSID := &Aruba-Essid-Name -> 'FSU' (9) } # update = noop (9) } # if ( &Aruba-Essid-Name ) = noop (9) ... skipping elsif: Preceding "if" was taken (9) ... skipping elsif: Preceding "if" was taken (9) ... skipping elsif: Preceding "if" was taken (9) ... skipping else: Preceding "if" was taken (9) } # if ( !&SSID ) = noop (9) } # policy fsu-policy = noop (9) } # post-auth = noop (9) EXPAND %{SSID} %{Aruba-Location-Id} %{Aruba-AP-Group} %{Aruba-Device-Type} %{reply:VLAN} (9) --> FSU wg-wireless.fsu.edu Sha iPhone 8 (9) Login OK: [dw] (from client CL port 0 cli Bbbbbbbbbbb FSU wg-wireless.fsu.edu Sha iPhone 8 (9) Sent Access-Accept Id 85 from 128.186.10.10:1812 to 128.186.11.11:34005 length 0 Here is the relevant debug from an unsuccessful auth. Note that the Post-Auth-Type Reject processing takes place AFTER the log record is expanded and written: (8) Failed to authenticate the user (8) EXPAND %{SSID} %{Aruba-Location-Id} %{Aruba-AP-Group} %{Aruba-Device-Type} (8) --> wg-wireless.fsu.edu Sha iPhone (8) Login incorrect (eap_peap: The users session was previously rejected: returning reject (again.)): [dw] (from client CL port 0 cli Bbbbbbbbbbbb) wg-wireless.fsu.edu Sha iPhone (8) Using Post-Auth-Type Reject (8) # Executing group from file /usr/local/etc/raddb/sites-enabled/fsu-1812 (8) Post-Auth-Type REJECT { (8) policy fsu-policy { (8) if ( !&SSID ) { (8) if ( !&SSID ) -> TRUE (8) if ( !&SSID ) { (8) if ( &Aruba-Essid-Name ) { (8) if ( &Aruba-Essid-Name ) -> TRUE (8) if ( &Aruba-Essid-Name ) { (8) update { (8) &SSID := &Aruba-Essid-Name -> 'FSU' (8) } # update = noop (8) } # if ( &Aruba-Essid-Name ) = noop (8) ... skipping elsif: Preceding "if" was taken (8) ... skipping elsif: Preceding "if" was taken (8) ... skipping elsif: Preceding "if" was taken (8) ... skipping else: Preceding "if" was taken (8) } # if ( !&SSID ) = noop (8) } # policy fsu-policy = noop (8) attr_filter.access_reject: EXPAND %{User-Name} (8) attr_filter.access_reject: --> dw (8) attr_filter.access_reject: Matched entry DEFAULT at line 17 (8) [attr_filter.access_reject] = updated (8) } # Post-Auth-Type REJECT = updated (8) Delaying response for 1.000000 seconds Waking up in 0.3 seconds. Waking up in 0.6 seconds. (8) Sending delayed response (8) Sent Access-Reject Id 95 from 128.186.10.10:1812 to 128.186.11.11:34005 length 44 Is there some reason why we would want Post-Auth Accept to run BEFORE log processing but Post-Auth-Type Reject to run AFTER log processing? It seems like we would want our Post-Auth processing to occur in the same sequence relative to expanding and writing the log record no matter whether we get an Accept or a Reject. Doug Wussler Florida State University

4 3

Freeradius acct_unique module unavailable in OpenWrt
by Boudraa Cheikh 20 Jun '17

20 Jun '17

Hi, I'm running Openwrt CHAOS CALMER (15.05.1, r48532) on my linksys WRT1900AC V1 (mamba - mvebu platform). I have installed freeradius server version 2.2.8, i'm facing troubles with the acct unique session id which is all the time empty: rlm_sql_mysql: MYSQL check_error: 1062 received [sql] Couldn't insert SQL accounting STOP record - Duplicate entry '' for key 'acctuniqueid' rlm_sql_mysql: MYSQL check_error: 1062 received rlm_sql_mysql: Cannot store result rlm_sql_mysql: MySQL error 'Duplicate entry '' for key 'acctuniqueid'' rlm_sql (sql): Released sql socket id: 9 ++[sql] = fail +} # group accounting = fail Finished request 21. Cleaning up request 21 ID 5 with timestamp +1271 Going to the next request Ready to process requests. Reading the freeradius mailing list it seems that the only solution is to use the "acct_unique" module which is not available for download using the opkg install tool from OpenWrt console. I beg any one who have this package (ipk already compiled for the mvebu platform) or he have the OpenWrt build system and he can cross compile this module to help me sort my issue by helping me to get this module for my platform. Any other alternative solutions to sort out this problem using shell scripting call from the freeradius daemon are welcome Kind regards

4 3