- Freeradius-Users - lists.freeradius.org

RADZAP - Empty Location
by Aurélio de Souza Ribeiro Neto 02 Mar '17

02 Mar '17

Dear Alan or Everyone, I had a problem in my checkrad, and some users are in radwho with an "Empty Location", like this example: Login Name What TTY When From Location eudantasal eudantasalves PPP >999 Tue 12:53 172.20.43.2 eudantasal eudantasalves PPP >999 Tue 13:16 172.20.43.2 187.120.XXX.XXX eudantasal eudantasalves PPP >999 Wed 13:30 172.20.43.2 187.120.XXX.XXX So, if I try to radzap "eudantasalves" I got an error: radclient:: failed to get value radclient: Nothing to send. Running "radwho -r -i" for this user, I have: eudantasalves,8180329f,PPP,S15741799,Tue 12:53,172.20.43.2, eudantasalves,81805b36,PPP,S15752644,Tue 13:16,172.20.43.2,187.120.XXX.XXX eudantasalves,81807c32,PPP,S15761221,Wed 13:35,172.20.43.2,187.120.XXX.XXX How can I zap this user? Thanks Aurélio

2 3

freeradius 3.1 sqlcounter[41]: Attribute Daily-Session-Time already defined with different flags
by mpajarin plexus 01 Mar '17

01 Mar '17

Im running freeradius 3.1.0 version, on Centos and on debug -X get an error like this: # Loaded module "rlm_sqlcounter" # Loading module "dailycounter" from file /etc/raddb/mods-enabled/ sqlcounter sqlcounter dailycounter { sql_module_instance = "sql" query = "SELECT SUM(acctsessiontime - GREATEST((%%b - UNIX_TIMESTAMP(acctstarttime)), 0)) FROM radacct WHERE username = '%{&User-Name}' AND UNIX_TIMESTAMP(acctstarttime) + acctsessiontime > '%%b'" reset = "daily" } /etc/raddb/mods-enabled/sqlcounter[41]: Failed defining counter attribute: Attribute Daily-Session-Time already defined with different flags /etc/raddb/mods-enabled/sqlcounter[41]: Instantiation failed for module "dailycounter" Really i dont have any modification on the default config: radiusd -X -d /etc/raddb FreeRADIUS Version 3.1.0 Copyright (C) 1999-2016 The FreeRADIUS server project and contributors There is NO warranty; not even for MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE You may redistribute copies of FreeRADIUS under the terms of the GNU General Public License For more information about these matters, see the file named COPYRIGHT Starting - reading configuration files ... including dictionary file /usr/local/freeradius/share/freeradius/dictionary including dictionary file /usr/local/freeradius/share/ freeradius/dictionary.dhcp including dictionary file /usr/local/freeradius/share/ freeradius/dictionary.vqp including dictionary file /etc/raddb/dictionary including configuration file /etc/raddb/radiusd.conf including configuration file /etc/raddb/proxy.conf including configuration file /etc/raddb/clients.conf including files in directory /etc/raddb/mods-enabled/ including configuration file /etc/raddb/mods-enabled/replicate including configuration file /etc/raddb/mods-enabled/sql including configuration file /etc/raddb/mods-config/sql/driver/mysql including configuration file /etc/raddb/mods-config/sql/ main/mysql/queries.conf including configuration file /etc/raddb/mods-enabled/expr including configuration file /etc/raddb/mods-enabled/logintime including configuration file /etc/raddb/mods-enabled/eap_inner including configuration file /etc/raddb/mods-enabled/ntlm_auth including configuration file /etc/raddb/mods-enabled/pap including configuration file /etc/raddb/mods-enabled/sqlcounter including configuration file /etc/raddb/mods-config/sql/ counter/mysql/dailycounter.conf including configuration file /etc/raddb/mods-config/sql/ counter/mysql/monthlycounter.conf including configuration file /etc/raddb/mods-config/sql/ counter/mysql/noresetcounter.conf including configuration file /etc/raddb/mods-config/sql/ counter/mysql/expire_on_login.conf including configuration file /etc/raddb/mods-enabled/passwd including configuration file /etc/raddb/mods-enabled/cache_eap including configuration file /etc/raddb/mods-enabled/linelog including configuration file /etc/raddb/mods-enabled/unix including configuration file /etc/raddb/mods-enabled/radutmp including configuration file /etc/raddb/mods-enabled/attr_filter including configuration file /etc/raddb/mods-enabled/preprocess including configuration file /etc/raddb/mods-enabled/dhcp including configuration file /etc/raddb/mods-enabled/digest including configuration file /etc/raddb/mods-enabled/detail.log including configuration file /etc/raddb/mods-enabled/mschap including configuration file /etc/raddb/mods-enabled/unpack including configuration file /etc/raddb/mods-enabled/soh including configuration file /etc/raddb/mods-enabled/files including configuration file /etc/raddb/mods-enabled/exec including configuration file /etc/raddb/mods-enabled/sradutmp including configuration file /etc/raddb/mods-enabled/detail including configuration file /etc/raddb/mods-enabled/expiration including configuration file /etc/raddb/mods-enabled/chap including configuration file /etc/raddb/mods-enabled/always including configuration file /etc/raddb/mods-enabled/realm including configuration file /etc/raddb/mods-enabled/eap including configuration file /etc/raddb/mods-enabled/utf8 including configuration file /etc/raddb/mods-enabled/dynamic_clients including configuration file /etc/raddb/mods-enabled/echo including files in directory /etc/raddb/policy.d/ including configuration file /etc/raddb/policy.d/abfab-tr including configuration file /etc/raddb/policy.d/operator-name including configuration file /etc/raddb/policy.d/accounting including configuration file /etc/raddb/policy.d/filter including configuration file /etc/raddb/policy.d/vendor including configuration file /etc/raddb/policy.d/dhcp including configuration file /etc/raddb/policy.d/cui including configuration file /etc/raddb/policy.d/canonicalization including configuration file /etc/raddb/policy.d/control including configuration file /etc/raddb/policy.d/eap including configuration file /etc/raddb/policy.d/debug including files in directory /etc/raddb/sites-enabled/ including configuration file /etc/raddb/sites-enabled/default including configuration file /etc/raddb/sites-enabled/inner-tunnel main { security { allow_core_dumps = no } name = "radiusd" prefix = "/usr/local/freeradius" localstatedir = "/usr/local/freeradius/var" logdir = "/usr/local/freeradius/var/log/radius" run_dir = "/usr/local/freeradius/var/run/radiusd" } main { name = "radiusd" prefix = "/usr/local/freeradius" localstatedir = "/usr/local/freeradius/var" sbindir = "/usr/local/freeradius/sbin" logdir = "/usr/local/freeradius/var/log/radius" run_dir = "/usr/local/freeradius/var/run/radiusd" libdir = "/usr/local/freeradius/lib" radacctdir = "/usr/local/freeradius/var/log/radius/radacct" hostname_lookups = no max_request_time = 30 cleanup_delay = 5 continuation_timeout = 15 max_requests = 16384 pidfile = "/usr/local/freeradius/var/run/radiusd/radiusd.pid" checkrad = "/usr/local/freeradius/sbin/checkrad" debug_level = 0 proxy_requests = yes log { stripped_names = no auth = no auth_badpass = no auth_goodpass = no colourise = yes msg_denied = "You are already logged in - access denied" } resources { } security { max_attributes = 200 reject_delay = 1.000000 status_server = yes allow_vulnerable_openssl = "no" } } radiusd: #### Loading Realms and Home Servers #### proxy server { retry_delay = 5 retry_count = 3 default_fallback = no dynamic = no dead_time = 120 wake_all_if_all_dead = no } home_server localhost { ipaddr = 127.0.0.1 port = 1812 type = "auth" secret = <<< secret >>> response_window = 20.000000 response_timeouts = 1 max_outstanding = 65536 zombie_period = 40 status_check = "status-server" ping_interval = 30 check_interval = 30 check_timeout = 4 num_answers_to_alive = 3 revive_interval = 120 limit { max_connections = 16 max_requests = 0 lifetime = 0 idle_timeout = 0 } coa { irt = 2 mrt = 16 mrc = 5 mrd = 30 } } home_server_pool my_auth_failover { type = fail-over home_server = localhost } realm example.com { auth_pool = my_auth_failover } realm LOCAL { } radiusd: #### Loading Clients #### client localhost { ipaddr = 127.0.0.1 require_message_authenticator = no secret = <<< secret >>> nas_type = "other" proto = "*" limit { max_connections = 16 lifetime = 0 idle_timeout = 30 } } client localhost_ipv6 { ipv6addr = ::1 require_message_authenticator = no secret = <<< secret >>> limit { max_connections = 16 lifetime = 0 idle_timeout = 30 } } Debugger not attached thread pool { start_servers = 5 max_servers = 32 min_spare_servers = 3 max_spare_servers = 10 max_requests_per_server = 0 cleanup_delay = 5 max_queue_size = 65536 queue_priority = "default" auto_limit_acct = no } listen { type = "auth" ipaddr = * port = 0 recv_buff = 0 limit { max_connections = 16 lifetime = 0 idle_timeout = 30 } } listen { type = "acct" ipaddr = * port = 0 recv_buff = 0 limit { max_connections = 16 lifetime = 0 idle_timeout = 30 } } listen { type = "auth" ipv6addr = :: port = 0 recv_buff = 0 limit { max_connections = 16 lifetime = 0 idle_timeout = 30 } } listen { type = "acct" ipv6addr = :: port = 0 recv_buff = 0 limit { max_connections = 16 lifetime = 0 idle_timeout = 30 } } # Creating Auth-Type = PAP # Creating Auth-Type = CHAP # Creating Auth-Type = MS-CHAP # Creating Auth-Type = eap # Creating Auth-Type = digest listen { type = "auth" ipaddr = 127.0.0.1 port = 18120 recv_buff = 0 } radiusd: #### Loading modules #### modules { # Loaded module "rlm_replicate" # Loading module "replicate" from file /etc/raddb/mods-enabled/replicate # Loaded module "rlm_sql" # Loading module "sql" from file /etc/raddb/mods-enabled/sql sql { driver = "rlm_sql_mysql" server = "localhost" port = 3306 login = "radius" password = <<< secret >>> radius_db = "radius" read_groups = yes read_profiles = yes read_clients = no delete_stale_sessions = yes sql_user_name = "%{User-Name}" group_attribute = "sql-sql-Group" default_user_profile = "" client_query = "SELECT id, nasname, shortname, type, secret, server FROM nas" authorize_check_query = "SELECT id, username, attribute, value, op FROM radcheck WHERE username = '%{SQL-User-Name}' ORDER BY id" authorize_reply_query = "SELECT id, username, attribute, value, op FROM radreply WHERE username = '%{SQL-User-Name}' ORDER BY id" authorize_group_check_query = "SELECT id, groupname, attribute, Value, op FROM radgroupcheck WHERE groupname = '%{sql-sql-Group}' ORDER BY id" authorize_group_reply_query = "SELECT id, groupname, attribute, value, op FROM radgroupreply WHERE groupname = '%{sql-sql-Group}' ORDER BY id" group_membership_query = "SELECT groupname FROM radusergroup WHERE username = '%{SQL-User-Name}' ORDER BY priority" simul_count_query = "SELECT COUNT(*) FROM radacct WHERE username = '%{SQL-User-Name}' AND acctstoptime IS NULL" simul_verify_query = "SELECT radacctid, acctsessionid, username, nasipaddress, nasportid, framedipaddress, callingstationid, framedprotocol FROM radacct WHERE username = '%{SQL-User-Name}' AND acctstoptime IS NULL" safe_characters = "@abcdefghijklmnopqrstuvwxyzABCD EFGHIJKLMNOPQRSTUVWXYZ0123456789.-_: /" accounting { reference = "%{tolower:type.%{Acct-Status-Type}.query}" type { accounting-on { query = "UPDATE radacct SET acctstoptime = FROM_UNIXTIME(%{integer:Event-Timestamp}), acctsessiontime = '%{integer:Event-Timestamp}' - UNIX_TIMESTAMP(acctstarttime), acctterminatecause = '%{%{Acct-Terminate-Cause}:-NAS-Reboot}' WHERE acctstoptime IS NULL AND nasipaddress = '%{NAS-IP-Address}' AND acctstarttime <= FROM_UNIXTIME(%{integer:Event-Timestamp})" } accounting-off { query = "UPDATE radacct SET acctstoptime = FROM_UNIXTIME(%{integer:Event-Timestamp}), acctsessiontime = '%{integer:Event-Timestamp}' - UNIX_TIMESTAMP(acctstarttime), acctterminatecause = '%{%{Acct-Terminate-Cause}:-NAS-Reboot}' WHERE acctstoptime IS NULL AND nasipaddress = '%{NAS-IP-Address}' AND acctstarttime <= FROM_UNIXTIME(%{integer:Event-Timestamp})" } start { query = "INSERT INTO radacct (acctsessionid, acctuniqueid, username, realm, nasipaddress, nasportid, nasporttype, acctstarttime, acctupdatetime, acctstoptime, acctsessiontime, acctauthentic, connectinfo_start, connectinfo_stop, acctinputoctets, acctoutputoctets, calledstationid, callingstationid, acctterminatecause, servicetype, framedprotocol, framedipaddress) VALUES ('%{Acct-Session-Id}', '%{Acct-Unique-Session-Id}', '%{SQL-User-Name}', '%{Realm}', '%{NAS-IP-Address}', '%{%{NAS-Port-ID}:-%{NAS-Port}}', '%{NAS-Port-Type}', FROM_UNIXTIME(%{integer:Event-Timestamp}), FROM_UNIXTIME(%{integer:Event-Timestamp}), NULL, '0', '%{Acct-Authentic}', '%{Connect-Info}', '', '0', '0', '%{Called-Station-Id}', '%{Calling-Station-Id}', '', '%{Service-Type}', '%{Framed-Protocol}', '%{Framed-IP-Address}')" query = "UPDATE radacct SET acctstarttime = FROM_UNIXTIME(%{integer:Event-Timestamp}), acctupdatetime = FROM_UNIXTIME(%{integer:Event-Timestamp}), connectinfo_start = '%{Connect-Info}' WHERE AcctUniqueId = '%{Acct-Unique-Session-Id}'" } interim-update { query = "UPDATE radacct SET acctupdatetime = (@acctupdatetime_old:=acctupdatetime), acctupdatetime = FROM_UNIXTIME(%{integer:Event-Timestamp}), acctinterval = %{integer:Event-Timestamp} - UNIX_TIMESTAMP(@acctupdatetime_old), framedipaddress = '%{Framed-IP-Address}', acctsessiontime = %{%{Acct-Session-Time}:-NULL}, acctinputoctets = '%{%{Acct-Input-Gigawords}:-0}' << 32 | '%{%{Acct-Input-Octets}:-0}', acctoutputoctets = '%{%{Acct-Output-Gigawords}:-0}' << 32 | '%{%{Acct-Output-Octets}:-0}' WHERE AcctUniqueId = '%{Acct-Unique-Session-Id}'" query = "INSERT INTO radacct (acctsessionid, acctuniqueid, username, realm, nasipaddress, nasportid, nasporttype, acctstarttime, acctupdatetime, acctstoptime, acctsessiontime, acctauthentic, connectinfo_start, connectinfo_stop, acctinputoctets, acctoutputoctets, calledstationid, callingstationid, acctterminatecause, servicetype, framedprotocol, framedipaddress) VALUES ('%{Acct-Session-Id}', '%{Acct-Unique-Session-Id}', '%{SQL-User-Name}', '%{Realm}', '%{NAS-IP-Address}', '%{%{NAS-Port-ID}:-%{NAS-Port}}', '%{NAS-Port-Type}', FROM_UNIXTIME(%{integer:Event-Timestamp} - %{%{Acct-Session-Time}:-0}), FROM_UNIXTIME(%{integer:Event-Timestamp}), NULL, %{%{Acct-Session-Time}:-NULL}, '%{Acct-Authentic}', '%{Connect-Info}', '', '%{%{Acct-Input-Gigawords}:-0}' << 32 | '%{%{Acct-Input-Octets}:-0}', '%{%{Acct-Output-Gigawords}:-0}' << 32 | '%{%{Acct-Output-Octets}:-0}', '%{Called-Station-Id}', '%{Calling-Station-Id}', '', '%{Service-Type}', '%{Framed-Protocol}', '%{Framed-IP-Address}')" } stop { query = "UPDATE radacct SET acctstoptime = FROM_UNIXTIME(%{integer:Event-Timestamp}), acctsessiontime = %{%{Acct-Session-Time}:-NULL}, acctinputoctets= '%{%{Acct-Input-Gigawords}:-0}' << 32 | '%{%{Acct-Input-Octets}:-0}', acctoutputoctets = '%{%{Acct-Output-Gigawords}:-0}' << 32 | '%{%{Acct-Output-Octets}:-0}', acctterminatecause = '%{Acct-Terminate-Cause}', connectinfo_stop = '%{Connect-Info}' WHERE AcctUniqueId = '%{Acct-Unique-Session-Id}'" query = "INSERT INTO radacct (acctsessionid, acctuniqueid, username, realm, nasipaddress, nasportid, nasporttype, acctstarttime, acctupdatetime, acctstoptime, acctsessiontime, acctauthentic, connectinfo_start, connectinfo_stop, acctinputoctets, acctoutputoctets, calledstationid, callingstationid, acctterminatecause, servicetype, framedprotocol, framedipaddress) VALUES ('%{Acct-Session-Id}', '%{Acct-Unique-Session-Id}', '%{SQL-User-Name}', '%{Realm}', '%{NAS-IP-Address}', '%{%{NAS-Port-ID}:-%{NAS-Port}}', '%{NAS-Port-Type}', FROM_UNIXTIME(%{integer:Event-Timestamp} - %{%{Acct-Session-Time}:-0}), FROM_UNIXTIME(%{integer:Event-Timestamp}), FROM_UNIXTIME(%{integer:Event-Timestamp}), %{%{Acct-Session-Time}:-NULL}, '%{Acct-Authentic}', '', '%{Connect-Info}', '%{%{Acct-Input-Gigawords}:-0}' << 32 | '%{%{Acct-Input-Octets}:-0}', '%{%{Acct-Output-Gigawords}:-0}' << 32 | '%{%{Acct-Output-Octets}:-0}', '%{Called-Station-Id}', '%{Calling-Station-Id}', '%{Acct-Terminate-Cause}', '%{Service-Type}', '%{Framed-Protocol}', '%{Framed-IP-Address}')" } } } post-auth { reference = ".query" query = "INSERT INTO radpostauth (username, pass, reply, authdate) VALUES ( '%{SQL-User-Name}', '%{%{User-Password}:-%{Chap-Password}}', '%{reply:Packet-Type}', '%S')" } } rlm_sql (sql) - Driver rlm_sql_mysql (module rlm_sql_mysql) loaded and linked Creating attribute sql-sql-Group # Loaded module "rlm_expr" # Loading module "expr" from file /etc/raddb/mods-enabled/expr expr { safe_characters = "@abcdefghijklmnopqrstuvwxyzABCD EFGHIJKLMNOPQRSTUVWXYZ0123456789.-_: /äéöüàâæçèéêëîïôœùûüaÿÄÉÖÜßÀÂÆÇ ÈÉÊËÎÏÔŒÙÛÜŸ" } # Loaded module "rlm_logintime" # Loading module "logintime" from file /etc/raddb/mods-enabled/logintime logintime { minimum_timeout = 60 } # Loaded module "rlm_eap" # Loading module "inner-eap" from file /etc/raddb/mods-enabled/eap_inner eap inner-eap { default_eap_type = "mschapv2" ignore_unknown_eap_types = no cisco_accounting_username_bug = no } # Linked to sub-module rlm_eap_md5 # Linked to sub-module rlm_eap_gtc gtc { challenge = "Password: " auth_type = "PAP" } # Linked to sub-module rlm_eap_mschapv2 mschapv2 { with_ntdomain_hack = no send_error = no } rlm_eap (inner-eap) - Ignoring EAP method tls because we don't have OpenSSL support # Loaded module "rlm_exec" # Loading module "ntlm_auth" from file /etc/raddb/mods-enabled/ntlm_auth exec ntlm_auth { wait = yes program = "/path/to/ntlm_auth --request-nt-key --domain=MYDOMAIN --username=%{mschap:User-Name} --password=%{User-Password}" shell_escape = yes } # Loaded module "rlm_pap" # Loading module "pap" from file /etc/raddb/mods-enabled/pap pap { normalise = yes } # Loaded module "rlm_sqlcounter" # Loading module "dailycounter" from file /etc/raddb/mods-enabled/ sqlcounter sqlcounter dailycounter { sql_module_instance = "sql" query = "SELECT SUM(acctsessiontime - GREATEST((%%b - UNIX_TIMESTAMP(acctstarttime)), 0)) FROM radacct WHERE username = '%{&User-Name}' AND UNIX_TIMESTAMP(acctstarttime) + acctsessiontime > '%%b'" reset = "daily" } /etc/raddb/mods-enabled/sqlcounter[41]: Failed defining counter attribute: Attribute Daily-Session-Time already defined with different flags /etc/raddb/mods-enabled/sqlcounter[41]: Instantiation failed for module "dailycounter" Some idea? Thanks

2 1

sending Filter-Id to another accounting server - need help
by Eby Mani 01 Mar '17

01 Mar '17

Hi, How do i configure freeradius to send user based Filter-Id to an accounting server?. Each user will have different Filter-Id value, users without any Filter-Id string will be denied access on the another NAS(listen only). I have the following in post-auth section of sites-enabled/default update reply { Filter-Id = "%{sql:SELECT `value` FROM `radreply` WHERE `username`='%{User-Name}';} } Freeradius is sending Filter-Id back to the user connected NAS, but not to the accounting server(another NAS, listen only). To which section should i add the update reply{} section in copy-acct-to-home-server file ? or is there a special command to include Filter-Id ?. Thanks, Eby

2 1

MD5 Auth Failure With Local User
by Martin, Jeremy 26 Feb '17

26 Feb '17

Hello, I am currently freeradius as a potential server and in doing so I am attempting to authenticate some devices using 802.1x that only support md5. From what I can tell this should be one of the most simplest tasks using freereadius but have as of yet have been successful in doing so. The setup could not be much simpler, there is a user in the users file and a client in the client configuration file. The request hits the server but is being rejected and from the debug output I am unable to determine why. I have reviewed most of the postings on the list serve and read just about all of the documents on the wiki and other sites and everything, unless I am missing something, is configured as documented. I am including the debug output and my users, if someone could please point me in the right direction I would be greatly appreciative. The version is 2.2.8 is a fresh and clean install from a debian 16.xx version that I just installed for this test, the only files modified are the users and clients files as the rest of the configuration files seem to indicate that eap with md5 is enabled and configured. Jeremy A009ED03287E Cleartext-Password := "1123481321" Service-Type = Framed-User, Framed-Protocol = PPP, Service-Type = Framed-User, Tunnel-Medium-Type = 6, Tunnel-Type = VLAN, Tunnel-Private-Group-ID = "U:140" Debug output freeradius: FreeRADIUS Version 2.2.8, for host x86_64-pc-linux-gnu, built on Apr 5 2016 at 13:40:43 Copyright (C) 1999-2015 The FreeRADIUS server project and contributors. There is NO warranty; not even for MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. You may redistribute copies of FreeRADIUS under the terms of the GNU General Public License. For more information about these matters, see the file named COPYRIGHT. Starting - reading configuration files ... including configuration file /etc/freeradius/radiusd.conf including configuration file /etc/freeradius/proxy.conf including configuration file /etc/freeradius/clients.conf including files in directory /etc/freeradius/modules/ including configuration file /etc/freeradius/modules/detail including configuration file /etc/freeradius/modules/files including configuration file /etc/freeradius/modules/wimax including configuration file /etc/freeradius/modules/checkval including configuration file /etc/freeradius/modules/attr_rewrite including configuration file /etc/freeradius/modules/logintime including configuration file /etc/freeradius/modules/detail.example.com including configuration file /etc/freeradius/modules/ippool including configuration file /etc/freeradius/modules/ldap including configuration file /etc/freeradius/modules/counter including configuration file /etc/freeradius/modules/radrelay including configuration file /etc/freeradius/modules/acct_unique including configuration file /etc/freeradius/modules/expiration including configuration file /etc/freeradius/modules/dhcp_sqlippool including configuration file /etc/freeradius/modules/realm including configuration file /etc/freeradius/modules/unix including configuration file /etc/freeradius/modules/perl including configuration file /etc/freeradius/modules/smsotp including configuration file /etc/freeradius/modules/echo including configuration file /etc/freeradius/modules/expr including configuration file /etc/freeradius/modules/pap including configuration file /etc/freeradius/modules/smbpasswd including configuration file /etc/freeradius/modules/detail.log including configuration file /etc/freeradius/modules/etc_group including configuration file /etc/freeradius/modules/ntlm_auth including configuration file /etc/freeradius/modules/inner-eap including configuration file /etc/freeradius/modules/exec including configuration file /etc/freeradius/modules/mac2vlan including configuration file /etc/freeradius/modules/rediswho including configuration file /etc/freeradius/modules/replicate including configuration file /etc/freeradius/modules/attr_filter including configuration file /etc/freeradius/modules/sqlcounter_expire_on_login including configuration file /etc/freeradius/modules/cache including configuration file /etc/freeradius/modules/opendirectory including configuration file /etc/freeradius/modules/mschap including configuration file /etc/freeradius/modules/linelog including configuration file /etc/freeradius/modules/chap including configuration file /etc/freeradius/modules/digest including configuration file /etc/freeradius/modules/passwd including configuration file /etc/freeradius/modules/sql_log including configuration file /etc/freeradius/modules/krb5 including configuration file /etc/freeradius/modules/sradutmp including configuration file /etc/freeradius/modules/preprocess including configuration file /etc/freeradius/modules/mac2ip including configuration file /etc/freeradius/modules/pam including configuration file /etc/freeradius/modules/policy including configuration file /etc/freeradius/modules/soh including configuration file /etc/freeradius/modules/always including configuration file /etc/freeradius/modules/otp including configuration file /etc/freeradius/modules/cui including configuration file /etc/freeradius/modules/dynamic_clients including configuration file /etc/freeradius/modules/redis including configuration file /etc/freeradius/modules/radutmp including configuration file /etc/freeradius/eap.conf including configuration file /etc/freeradius/policy.conf including files in directory /etc/freeradius/sites-enabled/ including configuration file /etc/freeradius/sites-enabled/inner-tunnel including configuration file /etc/freeradius/sites-enabled/default main { user = "freerad" group = "freerad" allow_core_dumps = no } including dictionary file /etc/freeradius/dictionary main { name = "freeradius" prefix = "/usr" localstatedir = "/var" sbindir = "/usr/sbin" logdir = "/var/log/freeradius" run_dir = "/var/run/freeradius" libdir = "/usr/lib/freeradius" radacctdir = "/var/log/freeradius/radacct" hostname_lookups = no max_request_time = 30 cleanup_delay = 5 max_requests = 1024 pidfile = "/var/run/freeradius/freeradius.pid" checkrad = "/usr/sbin/checkrad" debug_level = 0 proxy_requests = yes log { stripped_names = no auth = no auth_badpass = no auth_goodpass = no } security { max_attributes = 200 reject_delay = 1 status_server = yes allow_vulnerable_openssl = no } } radiusd: #### Loading Realms and Home Servers #### proxy server { retry_delay = 5 retry_count = 3 default_fallback = no dead_time = 120 wake_all_if_all_dead = no } home_server localhost { ipaddr = 127.0.0.1 port = 1812 type = "auth" secret = "testing123" response_window = 20 max_outstanding = 65536 require_message_authenticator = yes zombie_period = 40 status_check = "status-server" ping_interval = 30 check_interval = 30 num_answers_to_alive = 3 num_pings_to_alive = 3 revive_interval = 120 status_check_timeout = 4 coa { irt = 2 mrt = 16 mrc = 5 mrd = 30 } } home_server_pool my_auth_failover { type = fail-over home_server = localhost } realm example.com { auth_pool = my_auth_failover } realm LOCAL { } radiusd: #### Loading Clients #### client localhost { ipaddr = 127.0.0.1 require_message_authenticator = no secret = "testing123" nastype = "other" } client 10.40.10.215 { require_message_authenticator = no secret = "supersecret" } radiusd: #### Instantiating modules #### instantiate { Module: Linked to module rlm_exec Module: Instantiating module "exec" from file /etc/freeradius/modules/exec exec { wait = no input_pairs = "request" shell_escape = yes timeout = 10 } Module: Linked to module rlm_expr Module: Instantiating module "expr" from file /etc/freeradius/modules/expr Module: Linked to module rlm_expiration Module: Instantiating module "expiration" from file /etc/freeradius/modules/expiration expiration { reply-message = "Password Has Expired " } Module: Linked to module rlm_logintime Module: Instantiating module "logintime" from file /etc/freeradius/modules/logintime logintime { reply-message = "You are calling outside your allowed timespan " minimum-timeout = 60 } } radiusd: #### Loading Virtual Servers #### server { # from file /etc/freeradius/radiusd.conf modules { Module: Creating Auth-Type = digest Module: Checking authenticate {...} for more modules to load Module: Linked to module rlm_pap Module: Instantiating module "pap" from file /etc/freeradius/modules/pap pap { encryption_scheme = "auto" auto_header = no } Module: Linked to module rlm_chap Module: Instantiating module "chap" from file /etc/freeradius/modules/chap Module: Linked to module rlm_mschap Module: Instantiating module "mschap" from file /etc/freeradius/modules/mschap mschap { use_mppe = yes require_encryption = no require_strong = no with_ntdomain_hack = no allow_retry = yes } Module: Linked to module rlm_digest Module: Instantiating module "digest" from file /etc/freeradius/modules/digest Module: Linked to module rlm_unix Module: Instantiating module "unix" from file /etc/freeradius/modules/unix unix { radwtmp = "/var/log/freeradius/radwtmp" } Module: Linked to module rlm_eap Module: Instantiating module "eap" from file /etc/freeradius/eap.conf eap { default_eap_type = "md5" timer_expire = 60 ignore_unknown_eap_types = no cisco_accounting_username_bug = no max_sessions = 1024 } Module: Linked to sub-module rlm_eap_md5 Module: Instantiating eap-md5 Module: Linked to sub-module rlm_eap_leap Module: Instantiating eap-leap Module: Linked to sub-module rlm_eap_gtc Module: Instantiating eap-gtc gtc { challenge = "Password: " auth_type = "PAP" } Module: Linked to sub-module rlm_eap_tls Module: Instantiating eap-tls tls { rsa_key_exchange = no dh_key_exchange = yes rsa_key_length = 512 dh_key_length = 512 verify_depth = 0 CA_path = "/etc/freeradius/certs" pem_file_type = yes private_key_file = "/etc/freeradius/certs/server.key" certificate_file = "/etc/freeradius/certs/server.pem" CA_file = "/etc/freeradius/certs/ca.pem" private_key_password = "whatever" dh_file = "/etc/freeradius/certs/dh" random_file = "/dev/urandom" fragment_size = 1024 include_length = yes check_crl = no check_all_crl = no cipher_list = "DEFAULT" make_cert_command = "/etc/freeradius/certs/bootstrap" ecdh_curve = "prime256v1" cache { enable = no lifetime = 24 max_entries = 255 } verify { } ocsp { enable = no override_cert_url = yes url = "http://127.0.0.1/ocsp/" use_nonce = yes timeout = 0 softfail = no } } Module: Linked to sub-module rlm_eap_ttls Module: Instantiating eap-ttls ttls { default_eap_type = "md5" copy_request_to_tunnel = no use_tunneled_reply = no virtual_server = "inner-tunnel" include_length = yes } Module: Linked to sub-module rlm_eap_peap Module: Instantiating eap-peap peap { default_eap_type = "mschapv2" copy_request_to_tunnel = no use_tunneled_reply = no proxy_tunneled_request_as_eap = yes virtual_server = "inner-tunnel" soh = no } Module: Linked to sub-module rlm_eap_mschapv2 Module: Instantiating eap-mschapv2 mschapv2 { with_ntdomain_hack = no send_error = no } Module: Checking authorize {...} for more modules to load Module: Linked to module rlm_preprocess Module: Instantiating module "preprocess" from file /etc/freeradius/modules/preprocess preprocess { huntgroups = "/etc/freeradius/huntgroups" hints = "/etc/freeradius/hints" with_ascend_hack = no ascend_channels_per_line = 23 with_ntdomain_hack = no with_specialix_jetstream_hack = no with_cisco_vsa_hack = no with_alvarion_vsa_hack = no } reading pairlist file /etc/freeradius/huntgroups reading pairlist file /etc/freeradius/hints Module: Linked to module rlm_realm Module: Instantiating module "suffix" from file /etc/freeradius/modules/realm realm suffix { format = "suffix" delimiter = "@" ignore_default = no ignore_null = no } Module: Linked to module rlm_files Module: Instantiating module "files" from file /etc/freeradius/modules/files files { usersfile = "/etc/freeradius/users" acctusersfile = "/etc/freeradius/acct_users" preproxy_usersfile = "/etc/freeradius/preproxy_users" compat = "no" } reading pairlist file /etc/freeradius/users reading pairlist file /etc/freeradius/acct_users reading pairlist file /etc/freeradius/preproxy_users Module: Checking preacct {...} for more modules to load Module: Linked to module rlm_acct_unique Module: Instantiating module "acct_unique" from file /etc/freeradius/modules/acct_unique acct_unique { key = "User-Name, Acct-Session-Id, NAS-IP-Address, NAS-Identifier, NAS-Port" } Module: Checking accounting {...} for more modules to load Module: Linked to module rlm_detail Module: Instantiating module "detail" from file /etc/freeradius/modules/detail detail { detailfile = "/var/log/freeradius/radacct/%{%{Packet-Src-IP-Address}:-%{Packet-Src-IPv6-Address}}/detail-%Y%m%d" header = "%t" detailperm = 384 dirperm = 493 locking = no log_packet_header = no escape_filenames = no } Module: Linked to module rlm_attr_filter Module: Instantiating module "attr_filter.accounting_response" from file /etc/freeradius/modules/attr_filter attr_filter attr_filter.accounting_response { attrsfile = "/etc/freeradius/attrs.accounting_response" key = "%{User-Name}" relaxed = no } reading pairlist file /etc/freeradius/attrs.accounting_response Module: Checking session {...} for more modules to load Module: Linked to module rlm_radutmp Module: Instantiating module "radutmp" from file /etc/freeradius/modules/radutmp radutmp { filename = "/var/log/freeradius/radutmp" username = "%{User-Name}" case_sensitive = yes check_with_nas = yes perm = 384 callerid = yes } Module: Checking post-proxy {...} for more modules to load Module: Checking post-auth {...} for more modules to load Module: Instantiating module "attr_filter.access_reject" from file /etc/freeradius/modules/attr_filter attr_filter attr_filter.access_reject { attrsfile = "/etc/freeradius/attrs.access_reject" key = "%{User-Name}" relaxed = no } reading pairlist file /etc/freeradius/attrs.access_reject } # modules } # server server inner-tunnel { # from file /etc/freeradius/sites-enabled/inner-tunnel modules { Module: Checking authenticate {...} for more modules to load Module: Checking authorize {...} for more modules to load Module: Checking session {...} for more modules to load Module: Checking post-proxy {...} for more modules to load Module: Checking post-auth {...} for more modules to load } # modules } # server radiusd: #### Opening IP addresses and Ports #### listen { type = "auth" ipaddr = * port = 0 } listen { type = "acct" ipaddr = * port = 0 } listen { type = "auth" ipaddr = 127.0.0.1 port = 18120 } ... adding new socket proxy address * port 45349 Listening on authentication address * port 1812 Listening on accounting address * port 1813 Listening on authentication address 127.0.0.1 port 18120 as server inner-tunnel Listening on proxy address * port 1814 Ready to process requests. rad_recv: Access-Request packet from host 10.40.10.215 port 1362, id=119, length=140 User-Name = "A009ED03287E" Service-Type = Framed-User Framed-MTU = 1500 NAS-IP-Address = 10.40.10.215 NAS-Port-Type = Ethernet NAS-Port = 21 NAS-Port-Id = "1/1/21" NAS-Identifier = "MH-SW-CLW1" Calling-Station-Id = "A0-09-ED-03-28-7E" EAP-Message = 0x0201001101413030394544303332383745 Message-Authenticator = 0x525aed178402b6b2751f095ee64ab3ae # Executing section authorize from file /etc/freeradius/sites-enabled/default +group authorize { ++[preprocess] = ok ++[chap] = noop ++[mschap] = noop ++[digest] = noop [suffix] No '@' in User-Name = "A009ED03287E", looking up realm NULL [suffix] No such realm "NULL" ++[suffix] = noop [eap] EAP packet type response id 1 length 17 [eap] No EAP Start, assuming it's an on-going EAP conversation ++[eap] = updated [files] users: Matched entry A009ED03287E at line 1 ++[files] = ok ++[expiration] = noop ++[logintime] = noop [pap] WARNING: Auth-Type already set. Not setting to PAP ++[pap] = noop +} # group authorize = updated Found Auth-Type = EAP # Executing group from file /etc/freeradius/sites-enabled/default +group authenticate { [eap] EAP Identity [eap] processing type md5 rlm_eap_md5: Issuing Challenge ++[eap] = handled +} # group authenticate = handled Sending Access-Challenge of id 119 to 10.40.10.215 port 1362 Service-Type = Framed-User Framed-Protocol = PPP Tunnel-Medium-Type:0 = IEEE-802 Tunnel-Type:0 = VLAN Tunnel-Private-Group-Id:0 = "U:140" EAP-Message = 0x01020016041015bc1390ad75a179fb619b942c7243e1 Message-Authenticator = 0x00000000000000000000000000000000 State = 0x83b7aef283b5aacb6f9cfdec6ddd3f8e Finished request 0. Going to the next request Waking up in 4.9 seconds. rad_recv: Access-Request packet from host 10.40.10.215 port 1362, id=120, length=163 User-Name = "A009ED03287E" Service-Type = Framed-User Framed-MTU = 1500 NAS-IP-Address = 10.40.10.215 NAS-Port-Type = Ethernet NAS-Port = 21 NAS-Port-Id = "1/1/21" NAS-Identifier = "MH-SW-CLW1" Calling-Station-Id = "A0-09-ED-03-28-7E" State = 0x83b7aef283b5aacb6f9cfdec6ddd3f8e EAP-Message = 0x02020016041027406b254adbbe1a933b9f0a3eb249f4 Message-Authenticator = 0xe787e7ed108939823a95e2b5d8e3db55 # Executing section authorize from file /etc/freeradius/sites-enabled/default +group authorize { ++[preprocess] = ok ++[chap] = noop ++[mschap] = noop ++[digest] = noop [suffix] No '@' in User-Name = "A009ED03287E", looking up realm NULL [suffix] No such realm "NULL" ++[suffix] = noop [eap] EAP packet type response id 2 length 22 [eap] No EAP Start, assuming it's an on-going EAP conversation ++[eap] = updated [files] users: Matched entry A009ED03287E at line 1 ++[files] = ok ++[expiration] = noop ++[logintime] = noop [pap] WARNING: Auth-Type already set. Not setting to PAP ++[pap] = noop +} # group authorize = updated Found Auth-Type = EAP # Executing group from file /etc/freeradius/sites-enabled/default +group authenticate { [eap] Request found, released from the list [eap] EAP/md5 [eap] processing type md5 [eap] Freeing handler ++[eap] = reject +} # group authenticate = reject Failed to authenticate the user. Using Post-Auth-Type Reject # Executing group from file /etc/freeradius/sites-enabled/default +group REJECT { [eap] Reply already contained an EAP-Message, not inserting EAP-Failure ++[eap] = noop [attr_filter.access_reject] expand: %{User-Name} -> A009ED03287E attr_filter: Matched entry DEFAULT at line 11 ++[attr_filter.access_reject] = updated +} # group REJECT = updated Delaying reject of request 1 for 1 seconds Going to the next request Waking up in 0.9 seconds. Sending delayed reject for request 1 Sending Access-Reject of id 120 to 10.40.10.215 port 1362 EAP-Message = 0x04020004 Message-Authenticator = 0x00000000000000000000000000000000 Waking up in 3.9 seconds. Cleaning up request 0 ID 119 with timestamp +16 Waking up in 1.0 seconds. Cleaning up request 1 ID 120 with timestamp +16 Ready to process requests.

2 1

Accounting on 2 tables
by Ahmed Munir 24 Feb '17

24 Feb '17

Hi, I would like to know is it possible to setup more than 1 tables for accounting? As by default radacct table is used. The reason I'm asking as need to setup accounting on different tables for Asterisk and OpenSIPs. Please advise and share the supported document. -- Regards, Ahmed Munir Chohan

2 1

Using radtest on port 1645
by Brett Glasson 23 Feb '17

23 Feb '17

Hi all I have a question regarding freeradius (specifically radtest) which I'm hoping somebody can shed some light on. I have configured a new radius server to replace one of our ancient legacy production systems which is currently running: FreeRADIUS Version 1.1.7, for host i386-portbld-freebsd6.2, built on Dec 2 2008 at 00:30:57. Considering the age of this system it will not be a surprise to learn that radiusd is currently listening on port 1645. I wish to replicate that behaviour on the replacement server. Consequently I have built a replacement like so: FreeRADIUS Version 2.2.6, for host x86_64-redhat-linux-gnu, built on Sep 22 2015 at 15:27:25 When I configure the server using the default port 1812 everything works fine when testing via radtest (on a remote host): # radtest test testpass 1.2.3.4 1812 testing123 Sending Access-Request of id 95 to 1.2.3.4 port 1812 User-Name = "test" User-Password = "testpass" NAS-IP-Address = 2.3.4.5 NAS-Port = 1812 Message-Authenticator = 0x00000000000000000000000000000000 rad_recv: Access-Accept packet from host 1.2.3.4 port 1812, id=95, length=20 However, I do have a problem when trying to TEST authenticate when the server is using port 1645 using radtest on any system that is not ancient. I have tried radtest using port 1645 from the following systems; CentOS 6 - FAIL Ubuntu 16.04 - FAIL FreeBSD 10 - FAIL FreeBSD 6 - OK So radtest works on port 1645 from the vintage FreeBSD 6 machine but from all the other, newer systems I get the same result: radtest test testpass 1.2.3.9.4 1645 testing123 Sending Access-Request of id 160 to 1.2.3.4 port 1812 User-Name = "test" User-Password = "testpass" NAS-IP-Address = 2.3.4.5 NAS-Port = 1645 Message-Authenticator = 0x00000000000000000000000000000000 rad_recv: Access-Accept packet from host 1.2.3.4 port 1812, id=160, length=20 Note the part where radtest has ignored the provided port 1645 and has gone ahead and used 1812 anyway, although the NAS-Port is (correctly shown as being 1645 later on. In fact if I revert the radius server back to port 1812 and issue the same radtest command (using port 1645) it still works, even though the server is on port 1812. (The FreeBSD 6 machine fails as expected) Then, while looking about on google I noticed various radtest examples which use 0, or 10 for the port, some of which explicitly state that it doesn't actually matter what you put in that "port" field at all. So I tried putting random numbers in and indeed it worked when the server is on port 1812 no matter what port number I provided. This would appear to be a bug in radtest that has been around for quite some time (because CentOS 6 is hardly a spring chicken either) Either that or support for user provided ports has been removed from radtest altogether but I can't find any release notes online or any other references that suggest this. I was going to submit a bug report but the "Report a bug" link to http://bugs.freeradius.org/ as displayed on the freeradius download site appears to be broken. Also, I am not 100% sure that it is a bug anyway. If the ability to choose a port other than 1812 has been removed from radtest then it would be kind of nice if that was documented somewhere that is easy to find. It's not a showstopper for me but it would be nice to understand what is going on anyway. Anyway, if you have gotten this far then thanks for reading. Cheers Brett

3 4

Active Directory and Calling-Station-Id
by Ethariel 23 Feb '17

23 Feb '17

Thks a lot. I indeed think I don't really get the difference between := and ==. I've read several examples and doc but not so sure. I think the last entry (with the reject) is what is missing in my conf to prevent AD authentication when the CLI is not correct. I'll try asap and let you know. I can't access the site for a few days, but I'll return here with the conclusions.

2 2

Help Interpreting Supplicant Failure
by Matthew West 23 Feb '17

23 Feb '17

Hello FR List, Running into an issue interpreting FR output from an authentication attempt with a Windows7 domain-connected supplicant. Moving from a lab environment to a production one. The lab version of this setup works with both a Macintosh and Windows7 non-domain connected supplicant. Want to do EAP-TLS only AAA, but am seeing what looks to be use of username instead of a certificate. I'm not familiar with using domain-connected Win7 supplicants and may be misunderstanding the FR debug output. I'm happy to troubleshoot further, but want to make sure I'm understanding what's actually happening. Can someone help me interpret this output? Including only request in which a reject happens. If more is needed, I'm happy to include more information. Environment: * CentOS 7.3 * FR 3.0.4 Reject information (domain name changed): Received Access-Request Id 148 from 10.xx.4.205:1645 to 10.xx.130.253:1812 length 274 User-Name = 'ACME\\philip' Service-Type = Framed-User Framed-MTU = 1500 Called-Station-Id = '00-1B-D5-46-78-EF' Calling-Station-Id = '5C-26-0A-77-B4-CA' EAP-Message = 0x0208006b190017030100603bb7e79c335675f679b1688e85c39720460f055dc0ba7e96eb1c7e7b7b365a9f43bc1e142d183ac41cdf5b08ed8f1566a5f0faf5ac9c121ad26c8e4adbe2e881615e62072569e415039ea28c5a2bba997d67fd9f6d8618850b54b7ec9d01af6e Message-Authenticator = 0x354e667dc313ae3f2c001a1cb013eecb NAS-Port-Type = Ethernet NAS-Port = 50248 NAS-Port-Id = 'GigabitEthernet2/48' State = 0x2021716b262968d531eefb122cb3a198 NAS-IP-Address = 10.xx.4.205 (7) Received Access-Request packet from host 10.xx.4.205 port 1645, id=148, length=274 (7) User-Name = 'ACME\\philip' (7) Service-Type = Framed-User (7) Framed-MTU = 1500 (7) Called-Station-Id = '00-1B-D5-46-78-EF' (7) Calling-Station-Id = '5C-26-0A-77-B4-CA' (7) EAP-Message = 0x0208006b190017030100603bb7e79c335675f679b1688e85c39720460f055dc0ba7e96eb1c7e7b7b365a9f43bc1e142d183ac41cdf5b08ed8f1566a5f0faf5ac9c121ad26c8e4adbe2e881615e62072569e415039ea28c5a2bba997d67fd9f6d8618850b54b7ec9d01af6e (7) Message-Authenticator = 0x354e667dc313ae3f2c001a1cb013eecb (7) NAS-Port-Type = Ethernet (7) NAS-Port = 50248 (7) NAS-Port-Id = 'GigabitEthernet2/48' (7) State = 0x2021716b262968d531eefb122cb3a198 (7) NAS-IP-Address = 10.xx.4.205 (7) # Executing section authorize from file /etc/raddb/sites-enabled/default (7) authorize { (7) filter_username filter_username { (7) if (!&User-Name) (7) if (!&User-Name) -> FALSE (7) if (&User-Name =~ / /) (7) if (&User-Name =~ / /) -> FALSE (7) if (&User-Name =~ /@.*@/ ) (7) if (&User-Name =~ /@.*@/ ) -> FALSE (7) if (&User-Name =~ /\\.\\./ ) (7) if (&User-Name =~ /\\.\\./ ) -> FALSE (7) if ((&User-Name =~ /@/) && (&User-Name !~ /(a)(.+)\\.(.+)$/)) (7) if ((&User-Name =~ /@/) && (&User-Name !~ /(a)(.+)\\.(.+)$/)) -> FALSE (7) if (&User-Name =~ /\\.$/) (7) if (&User-Name =~ /\\.$/) -> FALSE (7) if (&User-Name =~ /(a)\\./) (7) if (&User-Name =~ /(a)\\./) -> FALSE (7) } # filter_username filter_username = notfound (7) [preprocess] = ok (7) [digest] = noop (7) suffix : Checking for suffix after "@" (7) suffix : No '@' in User-Name = "ACME\philip", looking up realm NULL (7) suffix : No such realm "NULL" (7) [suffix] = noop (7) eap : Peer sent code Response (2) ID 8 length 107 (7) eap : Continuing tunnel setup (7) [eap] = ok (7) } # authorize = ok (7) Found Auth-Type = EAP (7) # Executing group from file /etc/raddb/sites-enabled/default (7) authenticate { (7) eap : Expiring EAP session with state 0xf281125af2890830 (7) eap : Finished EAP session with state 0x2021716b262968d5 (7) eap : Previous EAP request found for state 0x2021716b262968d5, released from the list (7) eap : Peer sent method PEAP (25) (7) eap : EAP PEAP (25) (7) eap : Calling eap_peap to process EAP data (7) eap_peap : processing EAP-TLS (7) eap_peap : eaptls_verify returned 7 (7) eap_peap : Done initial handshake (7) eap_peap : eaptls_process returned 7 (7) eap_peap : FR_TLS_OK (7) eap_peap : Session established. Decoding tunneled attributes (7) eap_peap : Peap state phase2 (7) eap_peap : EAP type MSCHAPv2 (26) (7) eap_peap : Got tunneled request EAP-Message = 0x0208004b1a020800463191e6b09be07b605fda54036913080947000000000000000092ef9f3797c75a4e63bf6778433b6dbf51c612d8ef5824c0005941414e41544543485c7068696c6970 server default { (7) eap_peap : Setting User-Name to ACME\philip Sending tunneled request EAP-Message = 0x0208004b1a020800463191e6b09be07b605fda54036913080947000000000000000092ef9f3797c75a4e63bf6778433b6dbf51c612d8ef5824c0005941414e41544543485c7068696c6970 FreeRADIUS-Proxied-To = 127.0.0.1 User-Name = 'ACME\\philip' State = 0xf281125af2890830f60662494a0c8653 server inner-tunnel { (7) server inner-tunnel { (7) Request: EAP-Message = 0x0208004b1a020800463191e6b09be07b605fda54036913080947000000000000000092ef9f3797c75a4e63bf6778433b6dbf51c612d8ef5824c0005941414e41544543485c7068696c6970 FreeRADIUS-Proxied-To = 127.0.0.1 User-Name = 'ACME\\philip' State = 0xf281125af2890830f60662494a0c8653 (7) # Executing section authorize from file /etc/raddb/sites-enabled/inner-tunnel (7) authorize { (7) suffix : Checking for suffix after "@" (7) suffix : No '@' in User-Name = "ACME\philip", looking up realm NULL (7) suffix : No such realm "NULL" (7) [suffix] = noop (7) update control { (7) Proxy-To-Realm := 'LOCAL' (7) } # update control = noop (7) eap : Peer sent code Response (2) ID 8 length 75 (7) eap : No EAP Start, assuming it's an on-going EAP conversation (7) [eap] = updated (7) [files] = noop (7) [expiration] = noop (7) [logintime] = noop (7) } # authorize = updated (7) Found Auth-Type = EAP (7) # Executing group from file /etc/raddb/sites-enabled/inner-tunnel (7) authenticate { (7) eap : Expiring EAP session with state 0xf281125af2890830 (7) eap : Finished EAP session with state 0xf281125af2890830 (7) eap : Previous EAP request found for state 0xf281125af2890830, released from the list (7) eap : Peer sent method MSCHAPv2 (26) (7) eap : EAP MSCHAPv2 (26) (7) eap : Calling eap_mschapv2 to process EAP data (7) eap_mschapv2 : # Executing group from file /etc/raddb/sites-enabled/inner-tunnel (7) eap : Freeing handler (7) [eap] = reject (7) } # authenticate = reject (7) Failed to authenticate the user (7) Using Post-Auth-Type Reject (7) # Executing group from file /etc/raddb/sites-enabled/inner-tunnel (7) Post-Auth-Type REJECT { (7) attr_filter.access_reject : EXPAND %{User-Name} (7) attr_filter.access_reject : --> ACME\\philip (7) attr_filter.access_reject : Matched entry DEFAULT at line 11 (7) [attr_filter.access_reject] = updated (7) } # Post-Auth-Type REJECT = updated (7) Reply: EAP-Message = 0x04080004 Message-Authenticator = 0x00000000000000000000000000000000 (7) } # server inner-tunnel } # server inner-tunnel (7) eap_peap : Got tunneled reply code 3 EAP-Message = 0x04080004 Message-Authenticator = 0x00000000000000000000000000000000 (7) eap_peap : Got tunneled reply RADIUS code 3 EAP-Message = 0x04080004 Message-Authenticator = 0x00000000000000000000000000000000 (7) eap_peap : Tunneled authentication was rejected (7) eap_peap : FAILURE (7) eap : New EAP session, adding 'State' attribute to reply 0x2021716b272868d5 (7) [eap] = handled (7) } # authenticate = handled (7) Sending Access-Challenge packet to host 10.xx.4.205 port 1645, id=148, length=0 (7) EAP-Message = 0x0109002b19001703010020a23fbc7b14012abe52ab4685295adca8dc32be35b9ffc8351c010143b44f8e2f (7) Message-Authenticator = 0x00000000000000000000000000000000 (7) State = 0x2021716b272868d531eefb122cb3a198 Sending Access-Challenge Id 148 from 10.xx.130.253:1812 to 10.xx.4.205:1645 EAP-Message = 0x0109002b19001703010020a23fbc7b14012abe52ab4685295adca8dc32be35b9ffc8351c010143b44f8e2f Message-Authenticator = 0x00000000000000000000000000000000 State = 0x2021716b272868d531eefb122cb3a198 (7) Finished request Thank you, Matthew

2 3

Salted auth mechanism
by Abdul Basit 22 Feb '17

22 Feb '17

Hi team, I am using freeradius for sip register authentication through digest::md5 using perl. I want to use salted algorithm for sip register authentication. Can you share some pointers that can guide about the supported methods for the solution? Regards Abdul Basit

2 1

Reducing DNS lookups
by David Hartburn 21 Feb '17

21 Feb '17

Hi, For our LDAP queries, we have specified the forest DNS name as the LDAP server, so that we achieve via DNS a random distribution of queries against our AD servers. Previously we had hammered the first server on the list. This has kept our AD guys happy, but we have noticed that at busy times our FR servers are doing over 100 DNS queries per second, for the same thing. I can not spot anything in the FreeRADIUS config files, but is there any way to reduce the number of DNS lookups? We are running 3.0.12 on RHEL7. Outside of FreeRADIUS, we could either make sure each server has a different /etc/hosts file, which is not ideal, or implementing local DNS caching seems to be the more sensible way to go. Are there any other alternatives other people are using? Yours Dave Hartburn

8 9