- Freeradius-Users - lists.freeradius.org

Freeradius + Cisco Anyconnect group policy
by Pico Aeterna 12 Oct '16

12 Oct '16

reeradius + Cisco Anyconnect group policy Greetings, I recently just deployed a freeradius server to authenticate our Cisco Anyconnect VPN users against pam/google's OTP. My configs are in place and everything is working fine however recently we've taken on a few contractors that I would like to restrict to a specific tunnel-group/split-tunnel. I dont mind creating SSH accounts for them just as long as they have the correct split-tunnel/group policy assigned. Currently my test user can log into both tunnel-groups. Currently in users.conf my auth default type is "DEFAULT Auth-Type := PAM" Can this be done via /etc/group + pam or do I need to add these users to users.conf and then apply the attributes "ASA-Group-Policy" and "ASA-IPsec-Split-Tunnel-List" to them? Should I see the policy/tunnel-group name being sent from my ASA to my radius server? This is currently what I see via raddb -XXX when I connect using either tunnel-group. Received Accounting-Request Id 174 from x.x.x.x:1026 to x.x.x.x:1813 length 135 User-Name = 'username' NAS-Port = 122380288 Service-Type = Framed-User Framed-Protocol = PPP Framed-IP-Address = x.x.x.x Called-Station-Id = 'x.x.x.x' Calling-Station-Id = 'x.x.x.x' Acct-Status-Type = Start Acct-Delay-Time = 2 Acct-Session-Id = 'B5F00188' Acct-Authentic = RADIUS NAS-Port-Type = Virtual Tunnel-Client-Endpoint:0 = 'x.x.x.x' NAS-IP-Address = x.x.x.x Does anyone currently have this implemented or a sample config I can review, or am I going about it in the wrong way? radiusd: FreeRADIUS Version 3.0.4, for host x86_64-redhat-linux-gnu, built on Mar 5 2015 at 23:41:36

2 1

Re: FRS-3.0.4 Questions about radiusd.conf
by John Kristoff 12 Oct '16

12 Oct '16

On Wed, 12 Oct 2016 15:16:07 +0000 Mark Williams <martialstudy(a)hotmail.com> wrote: > I have some questions about the max_queue_size and > max_requests_per_server which can be set in radiusd.conf . > Max_queue_size is commented out by default; does that mean the > default is infinity? According to the documentation here: <http://networkradius.com/doc/current/raddb/radiusd.html> The default is 65536. > Also, what are the thoughts of the community on > max_requests_per_server? Do most of you leave that value at 0 > (=infinity) or set it to some value and force the server to reset > resources every so often? Inline comments suggest it's not normally > needed. It should be fine to leave at the default as I believe most installations do. I suppose it might be a defensive mechanism if you're afraid of running into a potential leak, but I think you may more likely suffer some performance-related penalty when or if it has to spend time clean restarting threads. It should be safe and is probably best to leave at the default of zero unless you have a really good, specific reason to change it. John

1 0

FRS-3.0.4 Questions about radiusd.conf
by Mark Williams 12 Oct '16

12 Oct '16

I have some questions about the max_queue_size and max_requests_per_server which can be set in radiusd.conf . Max_queue_size is commented out by default; does that mean the default is infinity? Also, what are the thoughts of the community on max_requests_per_server? Do most of you leave that value at 0 (=infinity) or set it to some value and force the server to reset resources every so often? Inline comments suggest it's not normally needed.

1 0

radiusd halts when LDAP bind fails.
by Scott McLane Gardner 12 Oct '16

12 Oct '16

Hi list. I am trying to troubleshoot my radiusd occasionally halts when failing to bind with the LDAP server. I would prefer it to maybe wait a minute and restart rather than halting. Is this usual behavior? The wiki for rlm_ldap says: set the uses, lifetime and idle_timeout settings in the pool section of the LDAP module to zero But I have already set this value. I realize this means the server can't contact the LDAP server to do the auth, but I would prefer the service to be more resilient if possible. Preferably without having to do some cron or nagios scripting magic. (I'm open to it, but I wonder if there's a native handler for this?) Usually LDAP and radiusd are fine even very shortly after halting. https://directory.uark.edu/people/sgardne Senior Network Engineer University of Arkansas, ITS-NET

7 9

External, non-RADIUS databases
by J Kephart 11 Oct '16

11 Oct '16

I have two different FR deployments, one running a MySQL database, the other Postgres. Those are working as they should. The requirement we have is that, on each of them, we need to be able to connect a captive portal server so that we can query a non-radius database for a specific boolean value that will determine whether or not radius will execute a set of instructions. Is the process for this as simple as defining the main (radius) instance, and then a second instance for the external database (e.g., sql sqlinstance1 { ... }, sql sqlinstance2 { ... }), with the appropriate connection information for both, and then changing the sql stuff in auth... and accounting sections to use sqlinstance1 for radius queries, and sqlinstance2 for the external database? If I'm reading the docs on rlm_mysql correctly, I'm thinking it is, but I just want to confirm it, as we've not done anything beyond a basic deployment as yet. Thanks for any advice! Jim

3 5

Problems with CA using PEAP/TTLS
by dump＠gmx.info 11 Oct '16

11 Oct '16

Dear list. I'm using freeradius 2.2.5 on debian for authentication of wireless access. The problem is that authenticating clients (I'm using PEAP/TTLS) works only if the CA-certificate is ignored by the client side. When trying to authenticate the clients using the CA in Network-Manager the authentication fails. The server certificate of freeradius is correctly signed and the public CA is selected at the clients (linux using Network-Manager). Is there a possibility to catch the server certificate on the client side after the transfer to the client. And then checking this server certificate signature against the locally installed CA-certificate by hand? For example using tcpdump? Many thanks in advance Jens

3 2

multiotp web service on CentOS 7 and Apache
by Skrebetz, Pete 11 Oct '16

11 Oct '16

The documentation for how to configure the webserver so that it's not only displaying multiotp.webserver.php but actually working through to the backend is pretty sparse. Has anyone else set this up on Linux? I copied the entire multiotp directory to /var/www/html, but the web front end never seemed to actually add users. Thanks, Pete

1 0

Cisco IP Phone 802.1x EAP-TLS troubles
by Ryan 11 Oct '16

11 Oct '16

Hello, I'm running freeRADIUS v3.0.8. My first goal is just to get all our Cisco phones authorized. I want freeRADIUS to accept all phones based on the certificate presented by the supplicant. The phones should present Cisco's manufacturer-installed-certificate, and Cisco provides the CA certs for download, which I have done. I put the Cisco CA certs into /etc/freeradius/certs, changed eap config to use ca_path instead of ca_file, but I still get this: ------------------------- (4) eap: Peer s0ent method TLS (13) (4) eap: EAP TLS (13) (4) eap: Calling eap_tls to process EAP data (4) eap_tls: Authenticate (4) eap_tls: processing EAP-TLS (4) eap_tls: TLS Length 1235 (4) eap_tls: Length Included (4) eap_tls: eaptls_verify returned 11 (4) eap_tls: <<< Unknown TLS version [length 0005] (4) eap_tls: <<< TLS 1.2 [length 0343] (4) eap_tls: TLS Verify creating certificate attributes (4) eap_tls: TLS-Client-Cert-Serial := '06' (4) eap_tls: TLS-Client-Cert-Expiration := '211008171647Z' (4) eap_tls: TLS-Client-Cert-Subject := '/serialNumber=PID:CP-8841 SN:FCH20098MSK/C=US/O=Texana Center/OU=Building E/CN=CP-8841-SEP00CCFC4A9AD3' (4) eap_tls: TLS-Client-Cert-Issuer := '/C=US/O=Texana Center/OU=Building E/CN=CAPF-38b5f828/ST=Texas/L=4910 Airport Ave.' (4) eap_tls: TLS-Client-Cert-Common-Name := 'CP-8841-SEP00CCFC4A9AD3' (4) eap_tls: ERROR: SSL says error 20 : unable to get local issuer certificate (4) eap_tls: >>> Unknown TLS version [length 0005] (4) eap_tls: >>> TLS 1.2 [length 0002] (4) eap_tls: ERROR: TLS Alert write:fatal:unknown CA tls: TLS_accept: Error in error (4) eap_tls: ERROR: SSL says: error:14089086:SSL routines:ssl3_get_client_certificate:certificate verify failed SSL: SSL_read failed in a system call (-1), TLS session fails. TLS receive handshake failed during operation (4) eap_tls: eaptls_process returned 4 (4) eap: ERROR: Failed continuing EAP TLS (13) session. EAP sub-module failed (4) eap: Failed in EAP select (4) [eap] = invalid (4) } # authenticate = invalid (4) Failed to authenticate the user (4) Using Post-Auth-Type Reject -------------------------------- I'm a total noob at PKI and I can't figure out what I'm doing wrong. Is this even possible to do? -Ryan

3 2

Attributes from users File not added to Proxy Response
by Dr. Karl-Heinz Pape 11 Oct '16

11 Oct '16

Hello! I am running FreeRADIUS Version 2.2.8 (the latest version available for my current Ubuntu set-up). The FreeRADIUS acts as a proxy and forwards the request to another RADIUS. The answer is received and the information in the user file seems to be processed (which can be seen from the double Auth-Type listed in the debug output, and yes, I removed the Auth-Type from the users file and it still does not work). Now the additional attributes from the users file are NOT added to the response of the FreeRADIUS to the NAS. With an earlier version of FreeRADIUS these attributes had been added, as I can see from old Wireshark dumps of the RADIUS communication. The Context-Name = dsl would be required by the RedBack NAS to find the correct context! Am I missing something? Thanks in advance Karl-Heinz Here is the entry in the users file: DEFAULT Realm == "alice-voip.de" Session-Timeout = 86400, Framed-MTU = 1492, Context-Name = dsl And here the debug output: root@dnsrad1:/etc/freeradius# freeradius -X freeradius: FreeRADIUS Version 2.2.8, for host x86_64-pc-linux-gnu, built on Apr 5 2016 at 13:40:43 Copyright (C) 1999-2015 The FreeRADIUS server project and contributors. ..... radiusd: #### Loading Realms and Home Servers #### proxy server { retry_delay = 5 retry_count = 3 default_fallback = no dead_time = 120 wake_all_if_all_dead = no } home_server localhost { ipaddr = 127.0.0.1 port = 1812 type = "auth" secret = "testing123" response_window = 20 max_outstanding = 65536 require_message_authenticator = yes zombie_period = 40 status_check = "status-server" ping_interval = 30 check_interval = 30 num_answers_to_alive = 3 num_pings_to_alive = 3 revive_interval = 120 status_check_timeout = 4 coa { irt = 2 mrt = 16 mrc = 5 mrd = 30 } } realm alice-voip.de { nostrip authhost = www.xxx.yyy.zzz:1812 secret = testing123 } ..... home_server_pool my_auth_failover { type = fail-over home_server = localhost } realm example.com { auth_pool = my_auth_failover } realm LOCAL { } radiusd: #### Loading Clients #### client localhost { ipaddr = 127.0.0.1 require_message_authenticator = no secret = "testing123" nastype = "other" } client www.xxx.yyy.zzz { require_message_authenticator = no secret = "testing123" nastype = "other" } radiusd: #### Instantiating modules #### instantiate { Module: Linked to module rlm_exec Module: Instantiating module "exec" from file /etc/freeradius/modules/exec exec { wait = no input_pairs = "request" shell_escape = yes timeout = 10 } Module: Linked to module rlm_expr Module: Instantiating module "expr" from file /etc/freeradius/modules/expr Module: Linked to module rlm_expiration Module: Instantiating module "expiration" from file /etc/freeradius/modules/expiration expiration { reply-message = "Password Has Expired " } Module: Linked to module rlm_logintime Module: Instantiating module "logintime" from file /etc/freeradius/modules/logintime logintime { reply-message = "You are calling outside your allowed timespan " minimum-timeout = 60 } } radiusd: #### Loading Virtual Servers #### server { # from file /etc/freeradius/radiusd.conf modules { Module: Creating Auth-Type = digest Module: Checking authenticate {...} for more modules to load Module: Linked to module rlm_pap Module: Instantiating module "pap" from file /etc/freeradius/modules/pap pap { encryption_scheme = "auto" auto_header = no } Module: Linked to module rlm_chap Module: Instantiating module "chap" from file /etc/freeradius/modules/chap Module: Linked to module rlm_mschap Module: Instantiating module "mschap" from file /etc/freeradius/modules/mschap mschap { use_mppe = yes require_encryption = no require_strong = no with_ntdomain_hack = no allow_retry = yes } Module: Linked to module rlm_digest Module: Instantiating module "digest" from file /etc/freeradius/modules/digest Module: Linked to module rlm_unix Module: Instantiating module "unix" from file /etc/freeradius/modules/unix unix { radwtmp = "/var/log/freeradius/radwtmp" } Module: Linked to module rlm_eap Module: Instantiating module "eap" from file /etc/freeradius/eap.conf eap { default_eap_type = "md5" timer_expire = 60 ignore_unknown_eap_types = no cisco_accounting_username_bug = no max_sessions = 1024 } Module: Linked to sub-module rlm_eap_md5 Module: Instantiating eap-md5 Module: Linked to sub-module rlm_eap_leap Module: Instantiating eap-leap Module: Linked to sub-module rlm_eap_gtc Module: Instantiating eap-gtc gtc { challenge = "Password: " auth_type = "PAP" } Module: Linked to sub-module rlm_eap_tls Module: Instantiating eap-tls tls { rsa_key_exchange = no dh_key_exchange = yes rsa_key_length = 512 dh_key_length = 512 verify_depth = 0 CA_path = "/etc/freeradius/certs" pem_file_type = yes private_key_file = "/etc/freeradius/certs/server.key" certificate_file = "/etc/freeradius/certs/server.pem" CA_file = "/etc/freeradius/certs/ca.pem" private_key_password = "whatever" dh_file = "/etc/freeradius/certs/dh" random_file = "/dev/urandom" fragment_size = 1024 include_length = yes check_crl = no check_all_crl = no cipher_list = "DEFAULT" make_cert_command = "/etc/freeradius/certs/bootstrap" ecdh_curve = "prime256v1" cache { enable = no lifetime = 24 max_entries = 255 } verify { } ocsp { enable = no override_cert_url = yes url = "http://127.0.0.1/ocsp/" use_nonce = yes timeout = 0 softfail = no } } Module: Linked to sub-module rlm_eap_ttls Module: Instantiating eap-ttls ttls { default_eap_type = "md5" copy_request_to_tunnel = no use_tunneled_reply = no virtual_server = "inner-tunnel" include_length = yes } Module: Linked to sub-module rlm_eap_peap Module: Instantiating eap-peap peap { default_eap_type = "mschapv2" copy_request_to_tunnel = no use_tunneled_reply = no proxy_tunneled_request_as_eap = yes virtual_server = "inner-tunnel" soh = no } Module: Linked to sub-module rlm_eap_mschapv2 Module: Instantiating eap-mschapv2 mschapv2 { with_ntdomain_hack = no send_error = no } Module: Checking authorize {...} for more modules to load Module: Linked to module rlm_preprocess Module: Instantiating module "preprocess" from file /etc/freeradius/modules/preprocess preprocess { huntgroups = "/etc/freeradius/huntgroups" hints = "/etc/freeradius/hints" with_ascend_hack = no ascend_channels_per_line = 23 with_ntdomain_hack = no with_specialix_jetstream_hack = no with_cisco_vsa_hack = no with_alvarion_vsa_hack = no } reading pairlist file /etc/freeradius/huntgroups reading pairlist file /etc/freeradius/hints Module: Linked to module rlm_realm Module: Instantiating module "suffix" from file /etc/freeradius/modules/realm realm suffix { format = "suffix" delimiter = "@" ignore_default = no ignore_null = no } Module: Linked to module rlm_files Module: Instantiating module "files" from file /etc/freeradius/modules/files files { usersfile = "/etc/freeradius/users" acctusersfile = "/etc/freeradius/acct_users" preproxy_usersfile = "/etc/freeradius/preproxy_users" compat = "no" } reading pairlist file /etc/freeradius/users ----- ----- reading pairlist file /etc/freeradius/acct_users reading pairlist file /etc/freeradius/preproxy_users Module: Checking preacct {...} for more modules to load Module: Linked to module rlm_acct_unique Module: Instantiating module "acct_unique" from file /etc/freeradius/modules/acct_unique acct_unique { key = "User-Name, Acct-Session-Id, NAS-IP-Address, NAS-Identifier, NAS-Port" } Module: Checking accounting {...} for more modules to load Module: Linked to module rlm_detail Module: Instantiating module "detail" from file /etc/freeradius/modules/detail detail { detailfile = "/var/log/freeradius/radacct/%{%{Packet-Src-IP-Address}:-%{Packet-Src-I Pv6-Address}}/detail-%Y%m%d" header = "%t" detailperm = 384 dirperm = 493 locking = no log_packet_header = no escape_filenames = no } Module: Linked to module rlm_attr_filter Module: Instantiating module "attr_filter.accounting_response" from file /etc/freeradius/modules/attr_filter attr_filter attr_filter.accounting_response { attrsfile = "/etc/freeradius/attrs.accounting_response" key = "%{User-Name}" relaxed = no } reading pairlist file /etc/freeradius/attrs.accounting_response Module: Checking session {...} for more modules to load Module: Linked to module rlm_radutmp Module: Instantiating module "radutmp" from file /etc/freeradius/modules/radutmp radutmp { filename = "/var/log/freeradius/radutmp" username = "%{User-Name}" case_sensitive = yes check_with_nas = yes perm = 384 callerid = yes } Module: Checking post-proxy {...} for more modules to load Module: Checking post-auth {...} for more modules to load Module: Instantiating module "attr_filter.access_reject" from file /etc/freeradius/modules/attr_filter attr_filter attr_filter.access_reject { attrsfile = "/etc/freeradius/attrs.access_reject" key = "%{User-Name}" relaxed = no } reading pairlist file /etc/freeradius/attrs.access_reject } # modules } # server server inner-tunnel { # from file /etc/freeradius/sites-enabled/inner-tunnel modules { Module: Checking authenticate {...} for more modules to load Module: Checking authorize {...} for more modules to load Module: Checking session {...} for more modules to load Module: Checking post-proxy {...} for more modules to load Module: Checking post-auth {...} for more modules to load } # modules } # server radiusd: #### Opening IP addresses and Ports #### listen { type = "auth" ipaddr = * port = 0 } listen { type = "acct" ipaddr = * port = 0 } listen { type = "auth" ipaddr = 127.0.0.1 port = 18120 } ... adding new socket proxy address * port 56616 Listening on authentication address * port 1812 Listening on accounting address * port 1813 Listening on authentication address 127.0.0.1 port 18120 as server inner-tunnel Listening on proxy address * port 1814 Ready to process requests. ..... Waking up in 4.9 seconds. rad_recv: Access-Request packet from host www.xxx.yyy.zzz port 1812, id=72, length=304 User-Name = "1905462460-001C28(a)alice-voip.de" User-Password = "1234567820" Service-Type = Framed-User Framed-Protocol = PPP NAS-Identifier = "BRRB-0262-03-01" NAS-Port = 301996733 NAS-Real-Port = 301991893 NAS-Port-Type = Virtual NAS-Port-Id = "1/2 vlan-id 2005 pppoe 6845" Medium-Type = DSL Mac-Addr = "00-1c-28-18-66-b6" Connect-Info = "outer-tag" Platform-Type = SE-400 OS-Version = "6.1.3.4p2" Agent-Circuit-Id = 0x454448552d303236322d30332d30312061746d2030302f353a312e3335 ADSL-Agent-Circuit-Id = "EDHU-0262-03-01 atm 00/5:1.35" # Executing section authorize from file /etc/freeradius/sites-enabled/default +group authorize { ++[preprocess] = ok ++[chap] = noop ++[mschap] = noop ++[digest] = noop [suffix] Looking up realm "alice-voip.de" for User-Name = "1905462460-001C28(a)alice-voip.de" [suffix] Found realm "alice-voip.de" [suffix] Adding Realm = "alice-voip.de" [suffix] Proxying request from user 1905462460-001C28 to realm alice-voip.de [suffix] Preparing to proxy authentication request to realm "alice-voip.de" ++[suffix] = updated [eap] No EAP-Message, not doing EAP ++[eap] = noop [files] users: Matched entry DEFAULT at line 219 ++[files] = ok ++[expiration] = noop ++[logintime] = noop ++[pap] = noop +} # group authorize = updated WARNING: Empty pre-proxy section. Using default return values. Sending Access-Request of id 133 to www.xxx.yyy.zzz port 1812 User-Name = "1905462460-001C28(a)alice-voip.de" User-Password = "1234567820" Service-Type = Framed-User Framed-Protocol = PPP NAS-Identifier = "BRRB-0262-03-01" NAS-Port = 301996733 NAS-Real-Port = 301991893 NAS-Port-Type = Virtual NAS-Port-Id = "1/2 vlan-id 2005 pppoe 6845" Medium-Type = DSL Mac-Addr = "00-1c-28-18-66-b6" Connect-Info = "outer-tag" Platform-Type = SE-400 OS-Version = "6.1.3.4p2" Agent-Circuit-Id = 0x454448552d303236322d30332d30312061746d2030302f353a312e3335 ADSL-Agent-Circuit-Id = "EDHU-0262-03-01 atm 00/5:1.35" NAS-IP-Address = www.xxx.yyy.zzz Proxy-State = 0x3732 Proxying request 7 to home server www.xxx.yyy.zzz port 1812 Sending Access-Request of id 133 to www.xxx.yyy.zzz port 1812 User-Name = "1905462460-001C28(a)alice-voip.de" User-Password = "1234567820" Service-Type = Framed-User Framed-Protocol = PPP NAS-Identifier = "BRRB-0262-03-01" NAS-Port = 301996733 NAS-Real-Port = 301991893 NAS-Port-Type = Virtual NAS-Port-Id = "1/2 vlan-id 2005 pppoe 6845" Medium-Type = DSL Mac-Addr = "00-1c-28-18-66-b6" Connect-Info = "outer-tag" Platform-Type = SE-400 OS-Version = "6.1.3.4p2" Agent-Circuit-Id = 0x454448552d303236322d30332d30312061746d2030302f353a312e3335 ADSL-Agent-Circuit-Id = "EDHU-0262-03-01 atm 00/5:1.35" NAS-IP-Address = www.xxx.yyy.zzz Proxy-State = 0x3732 Going to the next request Waking up in 0.9 seconds. rad_recv: Access-Accept packet from host www.xxx.yyy.zzz port 1812, id=133, length=274 Tunnel-Type:1 = L2TP Tunnel-Client-Auth-Id:1 = "hn_alice_voip" Tunnel-Assignment-Id:1 = "hn_alice_voip" Attr-69 = 0x01555555555555555555555555555555 Tunnel-Preference:1 = 1 Tunnel-Medium-Type:1 = IPv4 Tunnel-Server-Endpoint:1 = "www.xxx.yyy.zzz" Tunnel-Type:2 = L2TP Tunnel-Client-Auth-Id:2 = "hn_alice_voip" Tunnel-Assignment-Id:2 = "hn_alice_voip" Attr-69 = 0x02555555555555555555555555555555 Tunnel-Preference:2 = 2 Tunnel-Medium-Type:2 = IPv4 Tunnel-Server-Endpoint:2 = "www.xxx.yyy.zzy" Tunnel-Type:3 = L2TP Tunnel-Client-Auth-Id:3 = "hn_alice_voip" Tunnel-Assignment-Id:3 = "hn_alice_voip" Attr-69 = 0x03555555555555555555555555555555 Tunnel-Preference:3 = 3 Tunnel-Medium-Type:3 = IPv4 Tunnel-Server-Endpoint:3 = "www.xxx.yyy.zzx" Proxy-State = 0x3732 # Executing section post-proxy from file /etc/freeradius/sites-enabled/default +group post-proxy { [eap] No pre-existing handler found ++[eap] = noop +} # group post-proxy = noop Found Auth-Type = Accept Found Auth-Type = Accept Warning: Found 2 auth-types on request for user '1905462460-001C28(a)alice-voip.de' Auth-Type = Accept, accepting the user Login OK: [1905462460-001C28(a)alice-voip.de/1234567820] (from client www.xxx.yyy.zzz port 301996733) # Executing section post-auth from file /etc/freeradius/sites-enabled/default +group post-auth { ++[exec] = noop +} # group post-auth = noop Sending Access-Accept of id 72 to www.xxx.yyy.zzz port 1812 Tunnel-Type:1 = L2TP Tunnel-Client-Auth-Id:1 = "hn_alice_voip" Tunnel-Assignment-Id:1 = "hn_alice_voip" Attr-69 = 0x01555555555555555555555555555555 Tunnel-Preference:1 = 1 Tunnel-Medium-Type:1 = IPv4 Tunnel-Server-Endpoint:1 = "www.xxx.yyy.zzz" Tunnel-Type:2 = L2TP Tunnel-Client-Auth-Id:2 = "hn_alice_voip" Tunnel-Assignment-Id:2 = "hn_alice_voip" Attr-69 = 0x02555555555555555555555555555555 Tunnel-Preference:2 = 2 Tunnel-Medium-Type:2 = IPv4 Tunnel-Server-Endpoint:2 = "www.xxx.yyy.zzy" Tunnel-Type:3 = L2TP Tunnel-Client-Auth-Id:3 = "hn_alice_voip" Tunnel-Assignment-Id:3 = "hn_alice_voip" Attr-69 = 0x03555555555555555555555555555555 Tunnel-Preference:3 = 3 Tunnel-Medium-Type:3 = IPv4 Tunnel-Server-Endpoint:3 = "www.xxx.yyy.zzx" Finished request 7. Going to the next request Waking up in 3.8 seconds. ^C root@dnsrad1:/etc/freeradius# ================ end of debug output =================

1 0

Multiple python modules
by Rob Johnson [rbj] 10 Oct '16

10 Oct '16

Version 3.0.11 on Debian Jessie, HI, I am having an odd problem by which the service will not start using "service freeradius start" but will start and run ok if kicking off from the shell using "freeradius" or "freeradius -X". I am not getting any obvious errors from journalctl -xn: -- Logs begin at Fri 2016-10-07 13:09:38 BST, end at Mon 2016-10-10 10:28:57 BST. -- Oct 10 10:28:57 radius1.aber.ac.uk freeradius[24798]: rlm_ldap (nonbis): Initialising connection pool Oct 10 10:28:57 radius1.aber.ac.uk freeradius[24798]: Ignoring "sql" (see raddb/mods-available/README.rst) Oct 10 10:28:57 radius1.aber.ac.uk freeradius[24798]: radiusd: #### Skipping IP addresses and Ports #### Oct 10 10:28:57 radius1.aber.ac.uk freeradius[24798]: Configuration appears to be OK Oct 10 10:28:57 radius1.aber.ac.uk freeradius[24798]: rlm_ldap (bis): Removing connection pool Oct 10 10:28:57 radius1.aber.ac.uk freeradius[24798]: rlm_ldap (cisco): Removing connection pool Oct 10 10:28:57 radius1.aber.ac.uk freeradius[24798]: rlm_ldap (nonbis): Removing connection pool Oct 10 10:28:57 radius1.aber.ac.uk systemd[1]: freeradius.service: control process exited, code=killed status=11 Oct 10 10:28:57 radius1.aber.ac.uk systemd[1]: Failed to start FreeRADIUS multi-protocol policy server. -- Subject: Unit freeradius.service has failed -- Defined-By: systemd -- Support: http://lists.freedesktop.org/mailman/listinfo/systemd-devel -- -- Unit freeradius.service has failed. -- -- The result is failed. Oct 10 10:28:57 radius1.aber.ac.uk systemd[1]: Unit freeradius.service entered failed state. I have linked this to having more than one python module in operation, if I remove the 2nd python module, then all is good when using service freeradius start. If I have the module in a separate file, it still fails to start the service. When running using freeradius -X, the 2nd module works as expected. This is my python module config file: python aberpython { module = vlans python_path = ${modconfdir}/${.:name}:/usr/lib/python2.7/:/usr/local/lib/python2.7/dist-packages/ mod_instantiate = ${.module} # func_instantiate = instantiate mod_detach = ${.module} # func_detach = instantiate mod_authorize = ${.module} func_authorize = authorize mod_authenticate = ${.module} # func_authenticate = authenticate mod_preacct = ${.module} # func_preacct = preacct mod_accounting = ${.module} func_accounting = accounting mod_checksimul = ${.module} # func_checksimul = checksimul mod_pre_proxy = ${.module} # func_pre_proxy = pre_proxy mod_post_proxy = ${.module} # func_post_proxy = post_proxy mod_post_auth = ${.module} func_post_auth = post_auth mod_recv_coa = ${.module} # func_recv_coa = recv_coa mod_send_coa = ${.module} # func_send_coa = send_coa } python pythonfail { module = logfailedauth mod_instantiate = ${.module} # func_instantiate = instantiate mod_detach = ${.module} # func_detach = instantiate # mod_authorize = ${.module} # func_authorize = authorize # mod_authenticate = ${.module} # func_authenticate = authenticate mod_preacct = ${.module} # func_preacct = preacct mod_accounting = ${.module} # func_accounting = accounting mod_post_auth = ${.module} func_post_auth = post_auth mod_recv_coa = ${.module} # func_recv_coa = recv_coa mod_send_coa = ${.module} # func_send_coa = send_coa } Any ideas? Cheers, Rob

3 2