- Freeradius-Users - lists.freeradius.org

user defined in mysql table radcheck fails wtih "No "known good password", and radpostauth updated successfully but still empty
by Dustin S 22 Apr '16

22 Apr '16

Using freeradius 3 (even though most online help is for version 2) since this is the version that I first got "radtest" to work in. Running it in ubuntu 14.04.4 LTS. I entered a user "bob" into the "freeradius/users" file and radtest bob hello1 localhost 1812 testing1 works fine. I then entered "bobsql" into the database (after adding "sql" to all the places in freeradius/sites-available/default and adding the new mysql user login & database info to freeradius/mods-available/sql) | id | username | attribute | value | op | +----+----------+-----------+----------+----+ | 4 | bobsql | Password | hello1 | := | but the command radtest bobsql hello1 localhost 1812 testing1 gives the "freeradius -X" output: (23) pap: WARNING: No "known good" password found for the user. Not setting Auth-Type I removed and re-entered "bobsql" to make sure I didn't accidentally add non-visible characters to the username or password. The strange part is that it says it successfully logged the error to the "radpostauth" table: (23) sql: Executing query: INSERT INTO radpostauth (username, pass, reply, authdate) VALUES ( 'bobsql', 'hello1', 'Access-Reject', '2016-04-19 12:43:09') (23) sql: SQL query returned: success (23) sql: 1 record(s) updated But when I looked at this table it was still empty. I even logged in as "radius" and tested this command to make sure it wasn't being blocked by insufficient user permissions. Dustin p.s.: Here is the area of "freeradius -X" output around the problem area: (23) sql: --> SELECT id, username, attribute, value, op FROM radcheck WHERE username = 'bobsql' ORDER BY id (23) sql: Executing select query: SELECT id, username, attribute, value, op FROM radcheck WHERE username = 'bobsql' ORDER BY id rlm_sql (sql): Released connection (16) rlm_sql (sql): Need 1 more connections to reach 10 spares rlm_sql (sql): Opening additional connection (17), 1 of 30 pending slots used (23) [sql] = notfound (23) [expiration] = noop (23) [logintime] = noop (23) pap: WARNING: No "known good" password found for the user. Not setting Auth-Type (23) pap: WARNING: Authentication will fail unless a "known good" password is available (23) [pap] = noop (23) } # authorize = ok (23) ERROR: No Auth-Type found: rejecting the user via Post-Auth-Type = Reject (23) Failed to authenticate the user (23) Using Post-Auth-Type Reject (23) # Executing group from file /etc/freeradius/sites-enabled/default (23) Post-Auth-Type REJECT { (23) sql: EXPAND .query (23) sql: --> .query (23) sql: Using query template 'query' rlm_sql (sql): Reserved connection (15) (23) sql: EXPAND %{User-Name} (23) sql: --> bobsql (23) sql: SQL-User-Name set to 'bobsql' (23) sql: EXPAND INSERT INTO radpostauth (username, pass, reply, authdate) VALUES ( '%{SQL-User-Name}', '%{%{User-Password}:-%{Chap-Password}}', '%{reply:Packet-Type}', '%S') (23) sql: --> INSERT INTO radpostauth (username, pass, reply, authdate) VALUES ( 'bobsql', 'hello1', 'Access-Reject', '2016-04-19 12:43:09') (23) sql: Executing query: INSERT INTO radpostauth (username, pass, reply, authdate) VALUES ( 'bobsql', 'hello1', 'Access-Reject', '2016-04-19 12:43:09') (23) sql: SQL query returned: success (23) sql: 1 record(s) updated rlm_sql (sql): Released connection (15) (23) [sql] = ok Here's the entire output of "freeradius -X": (22) Cleaning up request packet ID 198 with timestamp +2275 Ready to process requests (23) Received Access-Request Id 40 from 127.0.0.1:41089 to 127.0.0.1:1812 length 76 (23) User-Name = "bobsql" (23) User-Password = "hello1" (23) NAS-IP-Address = 192.168.0.166 (23) NAS-Port = 1812 (23) Message-Authenticator = 0xa745b8c6f1030fe8a5914f73096859ae (23) # Executing section authorize from file /etc/freeradius/sites-enabled/default (23) authorize { (23) policy filter_username { (23) if (&User-Name) { (23) if (&User-Name) -> TRUE (23) if (&User-Name) { (23) if (&User-Name =~ / /) { (23) if (&User-Name =~ / /) -> FALSE (23) if (&User-Name =~ /@[^@]*@/ ) { (23) if (&User-Name =~ /@[^@]*@/ ) -> FALSE (23) if (&User-Name =~ /\.\./ ) { (23) if (&User-Name =~ /\.\./ ) -> FALSE (23) if ((&User-Name =~ /@/) && (&User-Name !~ /(a)(.+)\.(.+)$/)) { (23) if ((&User-Name =~ /@/) && (&User-Name !~ /(a)(.+)\.(.+)$/)) -> FALSE (23) if (&User-Name =~ /\.$/) { (23) if (&User-Name =~ /\.$/) -> FALSE (23) if (&User-Name =~ /(a)\./) { (23) if (&User-Name =~ /(a)\./) -> FALSE (23) } # if (&User-Name) = notfound (23) } # policy filter_username = notfound (23) [preprocess] = ok (23) [chap] = noop (23) [mschap] = noop (23) [digest] = noop (23) suffix: Checking for suffix after "@" (23) suffix: No '@' in User-Name = "bobsql", looking up realm NULL (23) suffix: No such realm "NULL" (23) [suffix] = noop (23) eap: No EAP-Message, not doing EAP (23) [eap] = noop (23) [files] = noop (23) sql: EXPAND %{User-Name} (23) sql: --> bobsql (23) sql: SQL-User-Name set to 'bobsql' rlm_sql (sql): Reserved connection (16) (23) sql: EXPAND SELECT id, username, attribute, value, op FROM radcheck WHERE username = '%{SQL-User-Name}' ORDER BY id (23) sql: --> SELECT id, username, attribute, value, op FROM radcheck WHERE username = 'bobsql' ORDER BY id (23) sql: Executing select query: SELECT id, username, attribute, value, op FROM radcheck WHERE username = 'bobsql' ORDER BY id rlm_sql (sql): Released connection (16) rlm_sql (sql): Need 1 more connections to reach 10 spares rlm_sql (sql): Opening additional connection (17), 1 of 30 pending slots used (23) [sql] = notfound (23) [expiration] = noop (23) [logintime] = noop (23) pap: WARNING: No "known good" password found for the user. Not setting Auth-Type (23) pap: WARNING: Authentication will fail unless a "known good" password is available (23) [pap] = noop (23) } # authorize = ok (23) ERROR: No Auth-Type found: rejecting the user via Post-Auth-Type = Reject (23) Failed to authenticate the user (23) Using Post-Auth-Type Reject (23) # Executing group from file /etc/freeradius/sites-enabled/default (23) Post-Auth-Type REJECT { (23) sql: EXPAND .query (23) sql: --> .query (23) sql: Using query template 'query' rlm_sql (sql): Reserved connection (15) (23) sql: EXPAND %{User-Name} (23) sql: --> bobsql (23) sql: SQL-User-Name set to 'bobsql' (23) sql: EXPAND INSERT INTO radpostauth (username, pass, reply, authdate) VALUES ( '%{SQL-User-Name}', '%{%{User-Password}:-%{Chap-Password}}', '%{reply:Packet-Type}', '%S') (23) sql: --> INSERT INTO radpostauth (username, pass, reply, authdate) VALUES ( 'bobsql', 'hello1', 'Access-Reject', '2016-04-19 12:43:09') (23) sql: Executing query: INSERT INTO radpostauth (username, pass, reply, authdate) VALUES ( 'bobsql', 'hello1', 'Access-Reject', '2016-04-19 12:43:09') (23) sql: SQL query returned: success (23) sql: 1 record(s) updated rlm_sql (sql): Released connection (15) (23) [sql] = ok (23) attr_filter.access_reject: EXPAND %{User-Name} (23) attr_filter.access_reject: --> bobsql (23) attr_filter.access_reject: Matched entry DEFAULT at line 11 (23) [attr_filter.access_reject] = updated (23) [eap] = noop (23) policy remove_reply_message_if_eap { (23) if (&reply:EAP-Message && &reply:Reply-Message) { (23) if (&reply:EAP-Message && &reply:Reply-Message) -> FALSE (23) else { (23) [noop] = noop (23) } # else = noop (23) } # policy remove_reply_message_if_eap = noop (23) } # Post-Auth-Type REJECT = updated (23) Delaying response for 1.000000 seconds Waking up in 0.6 seconds. Waking up in 0.3 seconds. (23) Sending delayed response (23) Sent Access-Reject Id 40 from 127.0.0.1:1812 to 127.0.0.1:41089 length 20 Waking up in 3.9 seconds. (23) Cleaning up request packet ID 40 with timestamp +2281

3 5

Correlating Access-Requests and Replys
by Christian Strauf 22 Apr '16

22 Apr '16

Hi all, we're trying to use an ELK stack (Elasticsearch, Logstash & Kibana) to monitor the performance of our FreeRADIUS 3.0.11 servers which rely on a number of external servers (database, directory etc.). We'd basically like to figure out the elapsed time between first Access-Request and the final Access-Accept (or Access-Reject for that matter). A prerequisite for this is that we can actually correlate Access-Requests and replies by the RADIUS server. I searched a little and found a post by Alan DeKok from 2012 on a very similar matter. The problem is that there's nothing much you can use to correlate an Access-Request reliably to the answers by the RADIUS server. Alan suggested adding a reply item to the reply: update reply { FreeRADIUS-Correlation-Id = "%{Packet-Src-IP-Address}-%{Packet-Src-Port}... } I like the idea (you can probably even update the original request with that FreeRADIUS-Correlation-Id before logging it), however, I need some help with the "..." part of the above config snippet. Src IP and src port unfortunately aren't unique enough (the same NAS sends all requests from the same source port). I looked through dictionary.freeradius.internal to find some suitable attribute that isn't part of the original request and that would add some uniqueness but I don't see anything useful. Do you guys happen to know a suitable way of creating such a FreeRADIUS-Correlationa-Id that's unique for an Access-Request-...-Access-Accept exchange? I'm not sure whether the NAS will also include the attribute in all its later request packets. Do you happen to know if this is the case? The approach with a correlation ID has one more disadvantage: according to RFC 2865, Access-Reject messages mustn't include such attributes. So this leaves us with the problem how to correlate rejects. This leads me to this question: FreeRADIUS obviously keeps track internally which reply correlates to which request. Is there any way to include some hint to this correlation via a FreeRADIUS-internal attribute which in turn could be logged in auth-detail or reply-detail files? Any help would be highly appreciated. Kind regards, Christian Strauf -- Dipl.-Math. Christian Strauf Clausthal University of Techn. E-Mail: strauf(a)rz.tu-clausthal.de Rechenzentrum Web: www.rz.tu-clausthal.de Erzstraße 51 Tel.: +49-5323-72-2086 Fax: -992086 D-38678 Clausthal-Zellerfeld

6 22

cross compilation of freeradius-server-3.0.10 fails at link of radeapclient, undefined references
by Aaron Wegner 22 Apr '16

22 Apr '16

When I start the build of FreeRADIUS it fails with an error because it can't execute jlibtool. If I use the native compiler rather than the cross compiler to build jlibtool the build proceeds. $ gcc scripts/jlibtool.c -o build/make/jlibtool However it breaks again when it tries to link build/bin/local/radeapclient (sorry my mail client is adding newlines to long single lines). LTIB> build/make/jlibtool --silent --mode=link gcc -o build/bin/local/radeapclient -rpath /spare1/aaron/0339/ltib/rpm/BUILD/freeradius-server-3.0.10/build/lib/local//.libs --shared -L/spare1/aaron/0339/ltib/rootfs/usr/lib -Wl,-rpath,/spare1/aaron/0339/ltib/rootfs/usr/lib build/objs/src/modules/rlm_eap/radeapclient.lo build/objs/src/main/files.lo build/objs/src/main/threads.lo build/objs/src/main/version.lo build/objs/src/main/cb.lo build/objs/src/main/tls.lo build/lib/local/libfreeradius-radius.la build/lib/local/libfreeradius-server.la build/lib/local/libfreeradius-eap.la -lcrypto -lssl -ltalloc -lpcre -lcap -lnsl -lresolv -ldl -lpthread -lcrypto -lssl However, if I change the command to the following it works. LTIB> gcc -o build/bin/local/radeapclient -Wl,-rpath /spare1/aaron/0339/ltib/rpm/BUILD/freeradius-server-3.0.10/build/lib/local//.libs --shared -L/spare1/aaron/0339/ltib/rootfs/usr/lib -Wl,-rpath,/spare1/aaron/0339/ltib/rootfs/usr/lib -L/spare1/aaron/0339/ltib/rpm/BUILD/freeradius-server-3.0.10/build/lib/local//.libs build/objs/src/modules/rlm_eap/radeapclient.o build/objs/src/main/files.o build/objs/src/main/threads.o build/objs/src/main/version.o build/objs/src/main/cb.o build/objs/src/main/tls.o -lfreeradius-radius -lfreeradius-server -lfreeradius-eap -lcrypto -lssl -ltalloc -lpcre -lcap -lnsl -lresolv -ldl -lpthread -lcrypto -lssl Now the build stops right away at the next link, build/bin/radeapclient. The problem is tedious to work around issuing calls to gcc because after that link it stops at: build/bin/local/smbencrypt build/bin/smbencrypt build/bin/local/dhcpclient build/bin/dhcpclient ...and so on. Don't know how may of these there are. I'm attaching the original failed command with the -Wl,--verbose flag added to the link to this email so that it's not formatted funny. Any help would be appreciated, I'm new to jlibtool and have no clue what's going on. The linker seems to be finding the shared objects and I check the shared objects for the undefined references it is complaining about and they seem to be in libfreeradius-radius.so, for instance: $ nm --defined-only -o build/lib/local//.libs/libfreeradius-radius.so | grep fr_pair_value_strcpy build/lib/local//.libs/libfreeradius-radius.so:000210ac T fr_pair_value_strcpy So I'm at a loss for why this link is failing. Thanks, Aaron

2 2

Tunnel-Password length not multiple of 16
by McWilliams, Rhys 22 Apr '16

22 Apr '16

Hi, I've been trying to migrate from FreeRADIUS ver 1.1.3 to ver 3.0.4. I've setup new servers running MariaDB and FreeRADIUS 3.0.4 and have left the ver 3 config as default as possible with just changing a few things like the listen port and the SQL database parameters, and of course clients.conf and huntgroup. All looks good at first glance and the radtest utility works and returns what is expected and the debug shows Access-Accept. But when I run a "test aaa group" from the Cisco router it returns a "User rejected" and the "debug radius" outputs the following. router#test aaa group vpn-dialin-auth-test user-name cisco new-code User rejected router# Apr 18 16:01:39 SAST: RADIUS/ENCODE(00000000):Orig. component type = Invalid Apr 18 16:01:39 SAST: RADIUS/ENCODE(00000000): dropping service type, "radius-server attribute 6 on-for-login-auth" is off Apr 18 16:01:39 SAST: RADIUS(00000000): Config NAS IP: 172.16.0.1 Apr 18 16:01:39 SAST: RADIUS(00000000): Config NAS IPv6: :: Apr 18 16:01:39 SAST: RADIUS(00000000): sending Apr 18 16:01:39 SAST: RADIUS/DECODE(00000000): There is no General DB. Want server details may not be specified Apr 18 16:01:39 SAST: RADIUS(00000000): Send Access-Request to 172.16.0.2:18122 id 1645/8, len 57 Apr 18 16:01:39 SAST: RADIUS: authenticator DC F4 D6 39 DF 63 68 B4 - 16 06 B4 62 A3 44 9F 06 Apr 18 16:01:39 SAST: RADIUS: User-Password [2] 18 * Apr 18 16:01:39 SAST: RADIUS: User-Name [1] 13 "user-name" Apr 18 16:01:39 SAST: RADIUS: NAS-IP-Address [4] 6 172.16.0.1 Apr 18 16:01:39 SAST: RADIUS(00000000): Sending a IPv4 Radius Packet Apr 18 16:01:39 SAST: RADIUS(00000000): Started 5 sec timeout Apr 18 16:01:39 SAST: RADIUS: Received from id 1645/8 172.16.0.2:18122, Access-Accept, len 154 Apr 18 16:01:39 SAST: RADIUS: authenticator 02 9B 45 F7 98 F7 3F AB - 98 54 71 59 F3 73 29 76 Apr 18 16:01:39 SAST: RADIUS: Service-Type [6] 6 Outbound [5] Apr 18 16:01:39 SAST: RADIUS: Tunnel-Type [64] 6 00:ESP [9] Apr 18 16:01:39 SAST: RADIUS: Tunnel-Password [69] 52 00:* Apr 18 16:01:39 SAST: RADIUS: Vendor, Cisco [26] 30 Apr 18 16:01:39 SAST: RADIUS: Cisco AVpair [1] 24 "ipsec:key-exchange=ike" Apr 18 16:01:39 SAST: RADIUS: Vendor, Cisco [26] 40 Apr 18 16:01:39 SAST: RADIUS: Cisco AVpair [1] 34 "ipsec:key-exchange=preshared-key" Apr 18 16:01:39 SAST: RADIUS/DECODE(00000000): There is no General DB. Reply server details may not be recorded router# Apr 18 16:01:39 SAST: RADIUS(00000000): Received from id 1645/8 Apr 18 16:01:39 SAST: RADIUS: Tunnel-Password length not multiple of 16 Apr 18 16:01:39 SAST: RADIUS/DECODE: decoder; FAIL Apr 18 16:01:39 SAST: RADIUS/DECODE: attribute Tunnel-Password; FAIL Apr 18 16:01:39 SAST: RADIUS/DECODE: parse response op decode; FAIL You can see the Cisco router has received an "Access-Accept" from the line "RADIUS: Received from id 1645/8 172.16.0.2:18122, Access-Accept, len 154" but the debug returns that last bit about the Tunnel-Password. If I run the same test against the current live aaa group, which wuthenticates against the ver 1.1.3 FreeRADIUS, it all works fine as it should being the live setup. router#test aaa group vpn-dialin-auth user-name cisco new-code User successfully authenticated USER ATTRIBUTES service-type 0 5 [Outbound] tunnel-type 0 9 [esp] tunnel-password 0 <hidden> key-exchange 0 "ike" key-exchange 0 "preshared-key" The aaa groups are identical except the radius server defined to authenticate against and all the other bits that Cisco references are setup for the test group too. I have done the changes in the database for ver 3 like this one - changing attribute from "Password" to "Cleartext-Password" and the op to be ":=" +----+-------------+--------------------+----+-------+ | id | UserName | Attribute | op | Value | +----+-------------+--------------------+----+-------+ | 33 | user-name | Cleartext-Password | := | cisco | +----+-------------+--------------------+----+-------+ As far as the RADIUS debug is concerned all was good and successful, but clearly Cisco thinks otherwise... Please could someone point me in the correct direct as I've spent a few days now searching for this "error" to no avail... Rhys McWilliams ---------------------------------------------------------------------- This message and any attachments are intended only for the use of the addressee and may contain information that is privileged and confidential. If the reader of the message is not the intended recipient or an authorized representative of the intended recipient, you are hereby notified that any dissemination of this communication is strictly prohibited. If you have received this communication in error, notify the sender immediately by return email and delete the message and any attachments from your system.

6 17

ram_sql module do not write sql requests into log file
by Laurent Bourqui 21 Apr '16

21 Apr '16

Dear All, I'm quite new to this mailing list and I hope my question will be asked allright and that I will not need to eat my keyboard in order to stop posting in this mailing list;-) I'm currently trying to make the rim_sql run as I want. It's doing quite OK, but I'm having trouble to use the logfile configuration parameter in the sql configuration. As far I understood, this would log every sql requests in the file given in this argument. Basically I would like to have all requests logged in ${logdir}/sqllog.sql, mainly for debugging purpose. Unfortunatelly this is not working at all, the attribute is configured but nothing is written in the log file. I have also tried to touch the file manually in order to have it configured with the correct rights. I'm using following environment: CentOS 7 FreeRadius 3.0.4 Postgresql 9.2.15 When starting the server in debugging mode, it tells me that the attribute is configured with he file I want the information to be written into: [root@dev radius]# radiusd -X radiusd: FreeRADIUS Version 3.0.4, for host x86_64-redhat-linux-gnu, built on Mar 5 2015 at 23:41:36 Copyright (C) 1999-2014 The FreeRADIUS server project and contributors There is NO warranty; not even for MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE You may redistribute copies of FreeRADIUS under the terms of the GNU General Public License For more information about these matters, see the file named COPYRIGHT Starting - reading configuration files ... including dictionary file /usr/share/freeradius/dictionary including dictionary file /usr/share/freeradius/dictionary.dhcp including dictionary file /usr/share/freeradius/dictionary.vqp including dictionary file /etc/raddb/dictionary including configuration file /etc/raddb/radiusd.conf including configuration file /etc/raddb/clients.conf including files in directory /etc/raddb/mods-enabled/ including configuration file /etc/raddb/mods-enabled/mschap including configuration file /etc/raddb/mods-enabled/eap including configuration file /etc/raddb/mods-enabled/expr including configuration file /etc/raddb/mods-enabled/unpack including configuration file /etc/raddb/mods-enabled/detail including configuration file /etc/raddb/mods-enabled/always including configuration file /etc/raddb/mods-enabled/detail.log including configuration file /etc/raddb/mods-enabled/attr_filter including configuration file /etc/raddb/mods-enabled/pap including configuration file /etc/raddb/mods-enabled/exec including configuration file /etc/raddb/mods-enabled/files including configuration file /etc/raddb/mods-enabled/chap including configuration file /etc/raddb/mods-enabled/preprocess including configuration file /etc/raddb/mods-enabled/sql including configuration file /etc/raddb/mods-config/sql/main/postgresql/queries.conf including files in directory /etc/raddb/policy.d/ including configuration file /etc/raddb/policy.d/accounting including configuration file /etc/raddb/policy.d/canonicalization including configuration file /etc/raddb/policy.d/control including configuration file /etc/raddb/policy.d/cui including configuration file /etc/raddb/policy.d/dhcp including configuration file /etc/raddb/policy.d/eap including configuration file /etc/raddb/policy.d/filter including configuration file /etc/raddb/policy.d/operator-name including configuration file /etc/raddb/policy.d/debug including files in directory /etc/raddb/sites-enabled/ including configuration file /etc/raddb/sites-enabled/default main { security { user = "radiusd" group = "radiusd" allow_core_dumps = no } } main { name = "radiusd" prefix = "/usr" localstatedir = "/var" sbindir = "/usr/sbin" logdir = "/var/log/radius" run_dir = "/var/run/radiusd" libdir = "/usr/lib64/freeradius" radacctdir = "/var/log/radius/radacct" hostname_lookups = yes max_request_time = 30 cleanup_delay = 5 max_requests = 256 pidfile = "/var/run/radiusd/radiusd.pid" checkrad = "/usr/sbin/checkrad" debug_level = 0 proxy_requests = no log { stripped_names = no auth = yes auth_badpass = yes auth_goodpass = no msg_badpass = "" msg_goodpass = "" colourise = yes msg_denied = "You are already logged in - access denied" } security { max_attributes = 200 reject_delay = 1 status_server = yes } } radiusd: #### Loading Realms and Home Servers #### radiusd: #### Loading Clients #### client localhost { ipaddr = 127.0.0.1 require_message_authenticator = no secret = <<< secret >>> nas_type = "other" proto = "*" limit { max_connections = 16 lifetime = 0 idle_timeout = 30 } } client aruba-vc { ipaddr = 192.168.55.9 require_message_authenticator = no secret = <<< secret >>> nas_type = "other" proto = "*" limit { max_connections = 16 lifetime = 0 idle_timeout = 30 } } radiusd: #### Instantiating modules #### instantiate { } modules { # Loaded module rlm_mschap # Instantiating module "mschap" from file /etc/raddb/mods-enabled/mschap mschap { use_mppe = yes require_encryption = yes require_strong = yes with_ntdomain_hack = yes passchange { } allow_retry = yes } # Loaded module rlm_eap # Instantiating module "eap" from file /etc/raddb/mods-enabled/eap eap { default_eap_type = "peap" timer_expire = 60 ignore_unknown_eap_types = no mod_accounting_username_bug = no max_sessions = 256 } # Linked to sub-module rlm_eap_md5 # Linked to sub-module rlm_eap_peap peap { tls = "tls-common" default_method = "mschapv2" copy_request_to_tunnel = yes use_tunneled_reply = yes proxy_tunneled_request_as_eap = no virtual_server = "inner-tunnel" soh = no require_client_cert = no } tls-config tls-common { rsa_key_exchange = no dh_key_exchange = yes rsa_key_length = 512 dh_key_length = 512 verify_depth = 0 ca_path = "/etc/raddb/certs" pem_file_type = yes private_key_file = "/etc/raddb/certs/server.pem" certificate_file = "/etc/raddb/certs/server.pem" ca_file = "/etc/raddb/certs/ca.pem" private_key_password = <<< secret >>> dh_file = "/etc/raddb/certs/dh" fragment_size = 1024 include_length = yes check_crl = no cipher_list = "DEFAULT" ecdh_curve = "prime256v1" cache { enable = yes lifetime = 24 max_entries = 255 } verify { } ocsp { enable = no override_cert_url = yes url = "http://127.0.0.1/ocsp/" use_nonce = yes timeout = 0 softfail = yes } } # Linked to sub-module rlm_eap_mschapv2 mschapv2 { with_ntdomain_hack = no send_error = no } # Loaded module rlm_expr # Instantiating module "expr" from file /etc/raddb/mods-enabled/expr expr { safe_characters = "@abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ0123456789.-_: /" } # Loaded module rlm_unpack # Instantiating module "unpack" from file /etc/raddb/mods-enabled/unpack # Loaded module rlm_detail # Instantiating module "detail" from file /etc/raddb/mods-enabled/detail detail { filename = "/var/log/radius/radacct/%{%{Packet-Src-IP-Address}:-%{Packet-Src-IPv6-Address}}/detail-%Y%m%d" header = "%t" permissions = 384 locking = no log_packet_header = no } # Loaded module rlm_always # Instantiating module "reject" from file /etc/raddb/mods-enabled/always always reject { rcode = "reject" simulcount = 0 mpp = no } # Instantiating module "fail" from file /etc/raddb/mods-enabled/always always fail { rcode = "fail" simulcount = 0 mpp = no } # Instantiating module "ok" from file /etc/raddb/mods-enabled/always always ok { rcode = "ok" simulcount = 0 mpp = no } # Instantiating module "handled" from file /etc/raddb/mods-enabled/always always handled { rcode = "handled" simulcount = 0 mpp = no } # Instantiating module "invalid" from file /etc/raddb/mods-enabled/always always invalid { rcode = "invalid" simulcount = 0 mpp = no } # Instantiating module "userlock" from file /etc/raddb/mods-enabled/always always userlock { rcode = "userlock" simulcount = 0 mpp = no } # Instantiating module "notfound" from file /etc/raddb/mods-enabled/always always notfound { rcode = "notfound" simulcount = 0 mpp = no } # Instantiating module "noop" from file /etc/raddb/mods-enabled/always always noop { rcode = "noop" simulcount = 0 mpp = no } # Instantiating module "updated" from file /etc/raddb/mods-enabled/always always updated { rcode = "updated" simulcount = 0 mpp = no } # Instantiating module "auth_log" from file /etc/raddb/mods-enabled/detail.log detail auth_log { filename = "/var/log/radius/radacct/%{%{Packet-Src-IP-Address}:-%{Packet-Src-IPv6-Address}}/auth-detail-%Y%m%d" header = "%t" permissions = 384 locking = no log_packet_header = no } rlm_detail (auth_log): 'User-Password' suppressed, will not appear in detail output # Instantiating module "reply_log" from file /etc/raddb/mods-enabled/detail.log detail reply_log { filename = "/var/log/radius/radacct/%{%{Packet-Src-IP-Address}:-%{Packet-Src-IPv6-Address}}/reply-detail-%Y%m%d" header = "%t" permissions = 384 locking = no log_packet_header = no } # Instantiating module "pre_proxy_log" from file /etc/raddb/mods-enabled/detail.log detail pre_proxy_log { filename = "/var/log/radius/radacct/%{%{Packet-Src-IP-Address}:-%{Packet-Src-IPv6-Address}}/pre-proxy-detail-%Y%m%d" header = "%t" permissions = 384 locking = no log_packet_header = no } # Instantiating module "post_proxy_log" from file /etc/raddb/mods-enabled/detail.log detail post_proxy_log { filename = "/var/log/radius/radacct/%{%{Packet-Src-IP-Address}:-%{Packet-Src-IPv6-Address}}/post-proxy-detail-%Y%m%d" header = "%t" permissions = 384 locking = no log_packet_header = no } # Loaded module rlm_attr_filter # Instantiating module "attr_filter.post-proxy" from file /etc/raddb/mods-enabled/attr_filter attr_filter attr_filter.post-proxy { filename = "/etc/raddb/mods-config/attr_filter/post-proxy" key = "%{Realm}" relaxed = no } reading pairlist file /etc/raddb/mods-config/attr_filter/post-proxy # Instantiating module "attr_filter.pre-proxy" from file /etc/raddb/mods-enabled/attr_filter attr_filter attr_filter.pre-proxy { filename = "/etc/raddb/mods-config/attr_filter/pre-proxy" key = "%{Realm}" relaxed = no } reading pairlist file /etc/raddb/mods-config/attr_filter/pre-proxy # Instantiating module "attr_filter.access_reject" from file /etc/raddb/mods-enabled/attr_filter attr_filter attr_filter.access_reject { filename = "/etc/raddb/mods-config/attr_filter/access_reject" key = "%{User-Name}" relaxed = no } reading pairlist file /etc/raddb/mods-config/attr_filter/access_reject # Instantiating module "attr_filter.access_challenge" from file /etc/raddb/mods-enabled/attr_filter attr_filter attr_filter.access_challenge { filename = "/etc/raddb/mods-config/attr_filter/access_challenge" key = "%{User-Name}" relaxed = no } reading pairlist file /etc/raddb/mods-config/attr_filter/access_challenge # Instantiating module "attr_filter.accounting_response" from file /etc/raddb/mods-enabled/attr_filter attr_filter attr_filter.accounting_response { filename = "/etc/raddb/mods-config/attr_filter/accounting_response" key = "%{User-Name}" relaxed = no } reading pairlist file /etc/raddb/mods-config/attr_filter/accounting_response # Loaded module rlm_pap # Instantiating module "pap" from file /etc/raddb/mods-enabled/pap pap { normalise = yes } # Loaded module rlm_exec # Instantiating module "exec" from file /etc/raddb/mods-enabled/exec exec { wait = no input_pairs = "request" shell_escape = yes timeout = 10 } # Loaded module rlm_files # Instantiating module "files" from file /etc/raddb/mods-enabled/files files { filename = "/etc/raddb/mods-config/files/authorize" usersfile = "/etc/raddb/mods-config/files/authorize" acctusersfile = "/etc/raddb/mods-config/files/accounting" preproxy_usersfile = "/etc/raddb/mods-config/files/pre-proxy" compat = "cistron" } reading pairlist file /etc/raddb/mods-config/files/authorize [/etc/raddb/mods-config/files/authorize]:1 Cistron compatibility checks for entry DEFAULT ... [/etc/raddb/mods-config/files/authorize]:5 Cistron compatibility checks for entry DEFAULT ... reading pairlist file /etc/raddb/mods-config/files/authorize [/etc/raddb/mods-config/files/authorize]:1 Cistron compatibility checks for entry DEFAULT ... [/etc/raddb/mods-config/files/authorize]:5 Cistron compatibility checks for entry DEFAULT ... reading pairlist file /etc/raddb/mods-config/files/accounting reading pairlist file /etc/raddb/mods-config/files/pre-proxy # Loaded module rlm_chap # Instantiating module "chap" from file /etc/raddb/mods-enabled/chap # Loaded module rlm_preprocess # Instantiating module "preprocess" from file /etc/raddb/mods-enabled/preprocess preprocess { huntgroups = "/etc/raddb/mods-config/preprocess/huntgroups" hints = "/etc/raddb/mods-config/preprocess/hints" with_ascend_hack = no ascend_channels_per_line = 23 with_ntdomain_hack = no with_specialix_jetstream_hack = no with_cisco_vsa_hack = no with_alvarion_vsa_hack = no } reading pairlist file /etc/raddb/mods-config/preprocess/huntgroups reading pairlist file /etc/raddb/mods-config/preprocess/hints # Loaded module rlm_sql # Instantiating module "sql" from file /etc/raddb/mods-enabled/sql sql { driver = "rlm_sql_postgresql" server = "localhost" port = "" login = "radius" password = <<< secret >>> radius_db = "radius" read_groups = no read_profiles = no read_clients = no delete_stale_sessions = yes sql_user_name = "%{User-Name}" logfile = "/var/log/radius/sqllog.sql" default_user_profile = "" client_query = "SELECT id, nasname, shortname, type, secret, server FROM nas" authorize_check_query = "SELECT id, UserName, Attribute, Value, Op FROM radcheck WHERE Username = '%{SQL-User-Name}' ORDER BY id" authorize_reply_query = "SELECT id, UserName, Attribute, Value, Op FROM radreply WHERE Username = '%{SQL-User-Name}' ORDER BY id" authorize_group_check_query = "SELECT id, GroupName, Attribute, Value, op FROM radgroupcheck WHERE GroupName = '%{Sql-Group}' ORDER BY id" authorize_group_reply_query = "SELECT id, GroupName, Attribute, Value, op FROM radgroupreply WHERE GroupName = '%{Sql-Group}' ORDER BY id" group_membership_query = "SELECT GroupName FROM radusergroup WHERE UserName='%{SQL-User-Name}' ORDER BY priority" simul_count_query = "" simul_verify_query = "" safe_characters = "@abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ0123456789.-_: /" } accounting { reference = "%{tolower:type.%{%{Acct-Status-Type}:-none}.query}" } post-auth { reference = ".query" } postgresql { send_application_name = yes } rlm_sql (sql): Driver rlm_sql_postgresql (module rlm_sql_postgresql) loaded and linked rlm_sql (sql): Attempting to connect to database "radius" rlm_sql (sql): Initialising connection pool pool { start = 5 min = 4 max = 32 spare = 3 uses = 0 lifetime = 0 cleanup_interval = 30 idle_timeout = 60 retry_delay = 1 spread = no } rlm_sql (sql): Opening additional connection (0) rlm_sql_postgresql: Connecting using parameters: dbname='radius' host='localhost' user='radius' password='durango' application_name='FreeRADIUS 3.0.4 - radiusd (sql)' Connected to database 'radius' on 'localhost' server version 90215, protocol version 3, backend PID 21150 rlm_sql (sql): Opening additional connection (1) rlm_sql_postgresql: Connecting using parameters: dbname='radius' host='localhost' user='radius' password='durango' application_name='FreeRADIUS 3.0.4 - radiusd (sql)' Connected to database 'radius' on 'localhost' server version 90215, protocol version 3, backend PID 21151 rlm_sql (sql): Opening additional connection (2) rlm_sql_postgresql: Connecting using parameters: dbname='radius' host='localhost' user='radius' password='durango' application_name='FreeRADIUS 3.0.4 - radiusd (sql)' Connected to database 'radius' on 'localhost' server version 90215, protocol version 3, backend PID 21152 rlm_sql (sql): Opening additional connection (3) rlm_sql_postgresql: Connecting using parameters: dbname='radius' host='localhost' user='radius' password='durango' application_name='FreeRADIUS 3.0.4 - radiusd (sql)' Connected to database 'radius' on 'localhost' server version 90215, protocol version 3, backend PID 21153 rlm_sql (sql): Opening additional connection (4) rlm_sql_postgresql: Connecting using parameters: dbname='radius' host='localhost' user='radius' password='durango' application_name='FreeRADIUS 3.0.4 - radiusd (sql)' Connected to database 'radius' on 'localhost' server version 90215, protocol version 3, backend PID 21154 } # modules radiusd: #### Loading Virtual Servers #### server { # from file /etc/raddb/radiusd.conf } # server server default { # from file /etc/raddb/sites-enabled/default # Loading authenticate {...} # Loading authorize {...} # Loading preacct {...} # Loading accounting {...} # Loading post-auth {...} } # server default radiusd: #### Opening IP addresses and Ports #### listen { type = "auth" ipaddr = * port = 1812 proto = "udp" } listen { type = "acct" ipaddr = * port = 1813 proto = "udp" } Listening on auth address * port 1812 as server default Listening on acct address * port 1813 as server default Ready to process requests Below my mods-enabled/sql config file root@dev raddb]# more mods-enabled/sql # -*- text -*- ## ## sql.conf -- SQL modules ## ## $Id: 29fb4b28e1b085d66415052dcdb5cc255392dcc3 $ sql { driver = "rlm_sql_postgresql" postgresql { send_application_name = yes } dialect = "postgresql" server = "localhost" login = "radius" password = "durango" radius_db = "radius" acct_table1 = "radacct" acct_table2 = "radacct" postauth_table = "radpostauth" authcheck_table = "radcheck" groupcheck_table = "radgroupcheck" authreply_table = "radreply" groupreply_table = "radgroupreply" usergroup_table = "radusergroup" read_groups = no read_profiles = no delete_stale_sessions = yes logfile = ${logdir}/sqllog.sql pool { start = 5 min = 4 max = ${thread[pool].max_servers} spare = 3 uses = 0 lifetime = 0 idle_timeout = 60 } read_clients = no client_table = "nas" # Read database-specific queries $INCLUDE ${modconfdir}/${.:name}/main/${dialect}/queries.conf } And the file I'm trying to log into: root@dev radius]# ls -la /var/log/radius/ total 60 drwx------. 3 radiusd radiusd 4096 Mar 27 16:46 . drwxr-xr-x. 7 root root 4096 Mar 27 03:17 .. drwx------. 3 radiusd radiusd 22 Dec 10 22:09 radacct -rw-r-----. 1 radiusd radiusd 22020 Mar 27 16:37 radius.log -rw-r-----. 1 radiusd radiusd 17339 Dec 23 22:06 radius.log-20160101.gz -rw-r-----. 1 radiusd radiusd 185 Jan 1 03:23 radius.log-20160201.gz -rw-r-----. 1 radiusd radiusd 2151 Feb 4 15:37 radius.log-20160301 -rw-r--r-- 1 radiusd radiusd 0 Mar 27 16:46 sqllog.sql Exists but keep being empty.... Is there something I haven't understood with this logfile configuration ? Many thanks in advance for your help. Best Regards Laurent

3 4

FreeRADIUS no longer authenticating domain clients following spplication of RHEL5 package updates yesterday morning
by Jeremy Hill 21 Apr '16

21 Apr '16

Hi, Yesterday the following package updates were applied to our main RHEL5 FreeRADIUS server after which it was successfully rebooted: Apr 19 07:10:01 Updated: samba-client-3.0.33-3.41.el5_11.i386 Apr 19 07:10:00 Updated: 30:bind-utils-9.3.6-25.P1.el5_11.8.i386 Apr 19 07:10:00 Updated: samba-3.0.33-3.41.el5_11.i386 Apr 19 07:09:58 Updated: samba-common-3.0.33-3.41.el5_11.i386 Apr 19 07:09:58 Updated: libsmbclient-3.0.33-3.41.el5_11.i386 Apr 19 07:09:57 Installed: kernel-2.6.18-409.el5.i686 Apr 19 07:09:49 Updated: tzdata-2016c-1.el5.i386 Apr 19 07:09:47 Updated: redhat-release-5Server-5.11.0.3.i386 Apr 19 07:09:46 Updated: 30:bind-libs-9.3.6-25.P1.el5_11.8.i386 Following the reboot, the radius.log file is full of entries such as the following and no local clients are able to authenticate via this server: Wed Apr 20 16:04:26 2016 : Auth: Login incorrect: [lixc1(a)bathspa.ac.uk] (from client roaming1.ja.net port 0 cli B0-9F-BA-C5-EE-C0) Wed Apr 20 16:04:26 2016 : Error: rlm_eap: No EAP session matching the State variable. Wed Apr 20 16:04:20 2016 : Auth: Login incorrect: [222394(a)bathspa.ac.uk] (from client roaming0.ja.net port 13 cli f0-c1-f1-b0-82-01) Wed Apr 20 16:04:20 2016 : Error: rlm_eap: No EAP session matching the State variable. Wed Apr 20 16:04:14 2016 : Auth: Login incorrect: [305657(a)bathspa.ac.uk] (from client roaming1.ja.net port 13 cli 30-19-66-47-a3-f6) Wed Apr 20 16:04:14 2016 : Error: rlm_eap: No EAP session matching the State variable. Wed Apr 20 16:04:09 2016 : Auth: Login incorrect: [305268(a)bathspa.ac.uk] (from client roaming0.ja.net port 0 cli e0-c7-67-32-a1-32) Wed Apr 20 16:04:09 2016 : Error: rlm_eap: No EAP session matching the State variable. Wed Apr 20 16:04:01 2016 : Auth: Login incorrect: [222394(a)bathspa.ac.uk] (from client roaming0.ja.net port 13 cli f0-c1-f1-b0-82-01) Wed Apr 20 16:04:01 2016 : Error: rlm_eap: No EAP session matching the State variable. Wed Apr 20 16:04:01 2016 : Auth: Login incorrect: [305657(a)bathspa.ac.uk] (from client roaming1.ja.net port 13 cli 30-19-66-47-a3-f6) Wed Apr 20 16:04:01 2016 : Error: rlm_eap: No EAP session matching the State variable. Wed Apr 20 16:03:56 2016 : Auth: Login incorrect: [222394(a)bathspa.ac.uk] (from client roaming0.ja.net port 13 cli f0-c1-f1-b0-82-01) Wed Apr 20 16:03:56 2016 : Error: rlm_eap: No EAP session matching the State variable. Wed Apr 20 16:03:56 2016 : Auth: Login incorrect: [306757(a)bathspa.ac.uk] (from client roaming0.ja.net port 0 cli f0-db-f8-bf-dd-22) Wed Apr 20 16:03:56 2016 : Error: rlm_eap: No EAP session matching the State variable. Wed Apr 20 16:03:42 2016 : Auth: Login incorrect: [303331(a)bathspa.ac.uk] (from client roaming1.ja.net port 0 cli AC293A4C57DB) Wed Apr 20 16:03:42 2016 : Error: rlm_eap: No EAP session matching the State variable. Wed Apr 20 16:03:40 2016 : Auth: Login incorrect: [266114(a)bathspa.ac.uk] (from client roaming0.ja.net port 0 cli ec-1f-72-e8-95-f6) Wed Apr 20 16:03:40 2016 : Error: rlm_eap: No EAP session matching the State variable. Wed Apr 20 16:03:39 2016 : Auth: Login incorrect: [273213(a)bathspa.ac.uk] (from client roaming0.ja.net port 0 cli 8C3AE3979A3D) Wed Apr 20 16:03:39 2016 : Error: rlm_eap: No EAP session matching the State variable. Wed Apr 20 16:03:37 2016 : Info: Ready to process requests. Wed Apr 20 16:03:37 2016 : Info: ... adding new socket proxy address * port 36236 Wed Apr 20 16:03:37 2016 : Info: ... adding new socket proxy address * port 45657 Wed Apr 20 16:03:37 2016 : Info: ... adding new socket proxy address * port 57014 Wed Apr 20 16:03:37 2016 : Info: ... adding new socket proxy address * port 44335 Wed Apr 20 16:03:37 2016 : Info: ... adding new socket proxy address * port 49723 Wed Apr 20 16:03:37 2016 : Info: ... adding new socket proxy address * port 39639 Wed Apr 20 16:03:37 2016 : Info: ... adding new socket proxy address * port 36555 Wed Apr 20 16:03:37 2016 : Info: Loaded virtual server eduroam-inner-tunnel Wed Apr 20 16:03:37 2016 : Info: Loaded virtual server inner-tunnel Wed Apr 20 16:03:37 2016 : Info: Loaded virtual server bathspa Wed Apr 20 16:03:37 2016 : Info: Loaded virtual server eduroam Wed Apr 20 16:03:37 2016 : Auth: rlm_krb5: krb5_init ok Wed Apr 20 16:03:37 2016 : Info: Loaded virtual server <default> Oddly, the results from a: "lsof -i tcp -nP | grep winbindd" does not show any LDAP connections over port 389 to our active directory either: winbindd 4535 root 23u IPv4 16513 0t0 TCP 172.19.0.123:56635-> 172.19.0.73:445 (ESTABLISHED) We would expect to find the following: winbindd 4221 root 23u IPv4 34419318 0t0 TCP 172.19.0.124:36502->1 72.19.0.73:389 (ESTABLISHED) winbindd 4221 root 24u IPv4 8106940 0t0 TCP 172.19.0.124:50653->1 72.19.0.107:445 (ESTABLISHED) Closer inspection of the attached debug log with a search term of: warning turns up: Cleaning up request 2 ID 253 with timestamp +2 WARNING: !!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!! WARNING: !! EAP session for state 0xdc342b61de3b32a7 did not finish! WARNING: !! Please read http://wiki.freeradius.org/Certificate_Compatibility WARNING: !!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!! Ready to process requests. To my knowledge our certificate is valid until 2018 so am not sure how to proceed, any help gratefully received. Cheers, *Jeremy HillLead Server Analyst (Windows)Bath Spa UniversityT: +44 (0)1225 875637Visit www.bathspa.ac.uk <http://www.bathspa.ac.uk/>Join us on: Facebook <http://www.facebook.com/bath.spa.university>| Twitter <https://twitter.com/#!/BathSpaUni>| YouTube <http://www.youtube.com/BathSpaUniversity>| LinkedIn <http://www.linkedin.com/company/bath-spa-university>Newton Park, Bath, BA2 9BNThink before you printDisclaimerIf you have received this message in error, please notify us and remove it from your system. Any views or opinions expressed in personal emails are solely those of the author and do not necessarily represent those of Bath Spa University. Neither Bath Spa University nor the sender accepts any responsibility for viruses and it is your responsibility to scan this email and any attachments for viruses.*

3 3

Monitoring connectivity to authentication
by Lovaas,Steven 20 Apr '16

20 Apr '16

Hello, all Planning an upgrade from 2.2.x to 3.x this summer, but I wanted to start tracking some statistics now so I have evidence of any performance change when we make the move. I've enabled the status server, and can query it with radclient for some good information on auth and proxy traffic. I also enabled the average response time for proxied requests, via the "historic_average_window" statement in home servers. Both of these are working great. Is there a similar capability to monitor statistics (ideally including response time) for FreeRADIUS interactions with an AD back end? Thanks, Steve Lovaas Colorado State University

4 4

openwrt, freeradius,
by Mildok 20 Apr '16

20 Apr '16

My English not well... So Im sorry. OpenWrt Chaos Calmer 15.05 freeradius 2.2.8-2 Installed: freeradius2 - 2.2.8-2 freeradius2-common - 2.2.8-2 freeradius2-democerts - 2.2.8-2 freeradius2-mod-always - 2.2.8-2 freeradius2-mod-chap - 2.2.8-2 freeradius2-mod-eap - 2.2.8-2 freeradius2-mod-eap-md5 - 2.2.8-2 freeradius2-mod-eap-mschapv2 - 2.2.8-2 freeradius2-mod-eap-peap - 2.2.8-2 freeradius2-mod-eap-tls - 2.2.8-2 freeradius2-mod-eap-ttls - 2.2.8-2 freeradius2-mod-exec - 2.2.8-2 freeradius2-mod-expr - 2.2.8-2 freeradius2-mod-files - 2.2.8-2 freeradius2-mod-mschap - 2.2.8-2 freeradius2-mod-pap - 2.2.8-2 freeradius2-mod-radutmp - 2.2.8-2 freeradius2-mod-realm - 2.2.8-2 freeradius2-utils - 2.2.8-2 IP-addres radius-server: 192.168.1.4 Wifi name: Openwrt Model: TL-WR842ND, ver 2.0 IP-addres wifi station: 192.168.1.1 Wifi name: ROSTELECOM_8804B Model: GPT-2542GNAUC ca.pem add to "Trusted Root Centers" at computer. I got ca.pem, from freeradius2-democerts. Problem: when I connect to "Openwrt" all good. But if I connect to "ROSTELECOM_8804B". I got nothing after "Sending Access-Challenge of id 0 to 192.168.1.1". I fast read http://wiki.freeradius.org/guide/Certificate_Compatibility , but not deep into well, becouse I think certs from " freeradius2-democerts" is good. Am I right? By the way, even if I tried did my own certs - I got it error too. Do own certs like that: openssl genrsa -des3 -out ca.key 2048 openssl req -new -x509 -days 3650 -key ca.key -out ca.pem openssl genrsa -des3 -out server.key 2048 openssl req -new -key server.key -out server.csr openssl x509 -req -days 3650 -in server.csr -CA ca.pem -CAkey ca.key -set_serial 01 -out server.pem Maybe GPT-2542GNAUC doesnt work properly? root@OpenWrt:/etc/freeradius2/certs# radiusd -XX Tue Apr 19 16:22:20 2016 : Info: radiusd: FreeRADIUS Version 2.2.8, for host mips-openwrt-linux-gnu, built on Jan 4 2016 at 09:40:51 Tue Apr 19 16:22:20 2016 : Debug: Server was built with: Tue Apr 19 16:22:20 2016 : Debug: accounting Tue Apr 19 16:22:20 2016 : Debug: authentication Tue Apr 19 16:22:20 2016 : Debug: WITH_DHCP Tue Apr 19 16:22:20 2016 : Debug: WITH_VMPS Tue Apr 19 16:22:20 2016 : Debug: Server core libs: Tue Apr 19 16:22:20 2016 : Debug: ssl: OpenSSL 1.0.2g 1 Mar 2016 Tue Apr 19 16:22:20 2016 : Info: Copyright (C) 1999-2015 The FreeRADIUS server project and contributors. Tue Apr 19 16:22:20 2016 : Info: There is NO warranty; not even for MERCHANTABILITY or FITNESS FOR A Tue Apr 19 16:22:20 2016 : Info: PARTICULAR PURPOSE. Tue Apr 19 16:22:20 2016 : Info: You may redistribute copies of FreeRADIUS under the terms of the Tue Apr 19 16:22:20 2016 : Info: GNU General Public License. Tue Apr 19 16:22:20 2016 : Info: For more information about these matters, see the file named COPYRIGHT. Tue Apr 19 16:22:20 2016 : Info: Starting - reading configuration files ... Tue Apr 19 16:22:20 2016 : Debug: including configuration file /etc/freeradius2/radiusd.conf Tue Apr 19 16:22:20 2016 : Debug: including configuration file /etc/freeradius2/clients.conf Tue Apr 19 16:22:20 2016 : Debug: including files in directory /etc/freeradius2/modules/ Tue Apr 19 16:22:20 2016 : Debug: including configuration file /etc/freeradius2/modules/pap Tue Apr 19 16:22:20 2016 : Debug: including configuration file /etc/freeradius2/modules/chap Tue Apr 19 16:22:20 2016 : Debug: including configuration file /etc/freeradius2/modules/echo Tue Apr 19 16:22:20 2016 : Debug: including configuration file /etc/freeradius2/modules/exec Tue Apr 19 16:22:20 2016 : Debug: including configuration file /etc/freeradius2/modules/expr Tue Apr 19 16:22:20 2016 : Debug: including configuration file /etc/freeradius2/modules/radutmp Tue Apr 19 16:22:20 2016 : Debug: including configuration file /etc/freeradius2/modules/files Tue Apr 19 16:22:20 2016 : Debug: including configuration file /etc/freeradius2/modules/realm Tue Apr 19 16:22:20 2016 : Debug: including configuration file /etc/freeradius2/modules/sradutmp Tue Apr 19 16:22:20 2016 : Debug: including configuration file /etc/freeradius2/modules/inner-eap Tue Apr 19 16:22:20 2016 : Debug: including configuration file /etc/freeradius2/modules/always Tue Apr 19 16:22:20 2016 : Debug: including configuration file /etc/freeradius2/modules/mschap Tue Apr 19 16:22:20 2016 : Debug: including configuration file /etc/freeradius2/eap.conf Tue Apr 19 16:22:20 2016 : Debug: including configuration file /etc/freeradius2/policy.conf Tue Apr 19 16:22:20 2016 : Debug: including files in directory /etc/freeradius2/sites/ Tue Apr 19 16:22:20 2016 : Debug: including configuration file /etc/freeradius2/sites/default Tue Apr 19 16:22:20 2016 : Debug: main { Tue Apr 19 16:22:20 2016 : Debug: allow_core_dumps = no Tue Apr 19 16:22:20 2016 : Debug: } Tue Apr 19 16:22:20 2016 : Debug: including dictionary file /etc/freeradius2/dictionary Tue Apr 19 16:22:20 2016 : Debug: main { Tue Apr 19 16:22:20 2016 : Debug: name = "radiusd" Tue Apr 19 16:22:20 2016 : Debug: prefix = "/usr" Tue Apr 19 16:22:20 2016 : Debug: localstatedir = "/var" Tue Apr 19 16:22:20 2016 : Debug: sbindir = "/usr/sbin" Tue Apr 19 16:22:20 2016 : Debug: logdir = "/var/log" Tue Apr 19 16:22:20 2016 : Debug: run_dir = "/var/run" Tue Apr 19 16:22:20 2016 : Debug: libdir = "/usr/lib/freeradius2" Tue Apr 19 16:22:20 2016 : Debug: radacctdir = "/var/db/radacct" Tue Apr 19 16:22:20 2016 : Debug: hostname_lookups = no Tue Apr 19 16:22:20 2016 : Debug: max_request_time = 30 Tue Apr 19 16:22:20 2016 : Debug: cleanup_delay = 5 Tue Apr 19 16:22:20 2016 : Debug: max_requests = 1024 Tue Apr 19 16:22:20 2016 : Debug: pidfile = "/var/run/radiusd.pid" Tue Apr 19 16:22:20 2016 : Debug: checkrad = "/usr/sbin/checkrad" Tue Apr 19 16:22:20 2016 : Debug: debug_level = 0 Tue Apr 19 16:22:20 2016 : Debug: proxy_requests = no Tue Apr 19 16:22:20 2016 : Debug: log { Tue Apr 19 16:22:20 2016 : Debug: stripped_names = no Tue Apr 19 16:22:20 2016 : Debug: auth = no Tue Apr 19 16:22:20 2016 : Debug: auth_badpass = no Tue Apr 19 16:22:20 2016 : Debug: auth_goodpass = no Tue Apr 19 16:22:20 2016 : Debug: } Tue Apr 19 16:22:20 2016 : Debug: security { Tue Apr 19 16:22:20 2016 : Debug: max_attributes = 200 Tue Apr 19 16:22:20 2016 : Debug: reject_delay = 1 Tue Apr 19 16:22:20 2016 : Debug: status_server = yes Tue Apr 19 16:22:20 2016 : Debug: } Tue Apr 19 16:22:20 2016 : Debug: } Tue Apr 19 16:22:20 2016 : Debug: radiusd: #### Loading Realms and Home Servers #### Tue Apr 19 16:22:20 2016 : Debug: radiusd: #### Loading Clients #### Tue Apr 19 16:22:20 2016 : Debug: client localhost { Tue Apr 19 16:22:20 2016 : Debug: ipaddr = 127.0.0.1 Tue Apr 19 16:22:20 2016 : Debug: require_message_authenticator = no Tue Apr 19 16:22:20 2016 : Debug: secret = "AccessDeniedRADIUS1" Tue Apr 19 16:22:20 2016 : Debug: } Tue Apr 19 16:22:20 2016 : Debug: client radiusServ { Tue Apr 19 16:22:20 2016 : Debug: ipaddr = 192.168.1.4 Tue Apr 19 16:22:20 2016 : Debug: require_message_authenticator = yes Tue Apr 19 16:22:20 2016 : Debug: secret = "AccessDeniedRADIUS1" Tue Apr 19 16:22:20 2016 : Debug: nastype = "other" Tue Apr 19 16:22:20 2016 : Debug: } Tue Apr 19 16:22:20 2016 : Debug: client 192.168.1.1 { Tue Apr 19 16:22:20 2016 : Debug: ipaddr = 192.168.1.1 Tue Apr 19 16:22:20 2016 : Debug: require_message_authenticator = yes Tue Apr 19 16:22:20 2016 : Debug: secret = "AccessDeniedRADIUS1" Tue Apr 19 16:22:20 2016 : Debug: } Tue Apr 19 16:22:20 2016 : Debug: radiusd: #### Instantiating modules #### Tue Apr 19 16:22:20 2016 : Debug: instantiate { Tue Apr 19 16:22:20 2016 : Debug: (Loaded rlm_expr, checking if it's valid) Tue Apr 19 16:22:20 2016 : Debug: Module: Linked to module rlm_expr Tue Apr 19 16:22:20 2016 : Debug: Module: Instantiating module "expr" from file /etc/freeradius2/modules/expr Tue Apr 19 16:22:20 2016 : Debug: } Tue Apr 19 16:22:20 2016 : Debug: radiusd: #### Loading Virtual Servers #### Tue Apr 19 16:22:20 2016 : Debug: server { # from file /etc/freeradius2/radiusd.conf Tue Apr 19 16:22:20 2016 : Debug: modules { Tue Apr 19 16:22:20 2016 : Debug: Module: Checking authenticate {...} for more modules to load Tue Apr 19 16:22:20 2016 : Debug: (Loaded rlm_pap, checking if it's valid) Tue Apr 19 16:22:20 2016 : Debug: Module: Linked to module rlm_pap Tue Apr 19 16:22:20 2016 : Debug: Module: Instantiating module "pap" from file /etc/freeradius2/modules/pap Tue Apr 19 16:22:20 2016 : Debug: pap { Tue Apr 19 16:22:20 2016 : Debug: encryption_scheme = "auto" Tue Apr 19 16:22:20 2016 : Debug: auto_header = yes Tue Apr 19 16:22:20 2016 : Debug: } Tue Apr 19 16:22:20 2016 : Debug: (Loaded rlm_chap, checking if it's valid) Tue Apr 19 16:22:20 2016 : Debug: Module: Linked to module rlm_chap Tue Apr 19 16:22:20 2016 : Debug: Module: Instantiating module "chap" from file /etc/freeradius2/modules/chap Tue Apr 19 16:22:20 2016 : Debug: (Loaded rlm_mschap, checking if it's valid) Tue Apr 19 16:22:20 2016 : Debug: Module: Linked to module rlm_mschap Tue Apr 19 16:22:20 2016 : Debug: Module: Instantiating module "mschap" from file /etc/freeradius2/modules/mschap Tue Apr 19 16:22:20 2016 : Debug: mschap { Tue Apr 19 16:22:20 2016 : Debug: use_mppe = yes Tue Apr 19 16:22:20 2016 : Debug: require_encryption = no Tue Apr 19 16:22:20 2016 : Debug: require_strong = no Tue Apr 19 16:22:20 2016 : Debug: with_ntdomain_hack = no Tue Apr 19 16:22:20 2016 : Debug: allow_retry = yes Tue Apr 19 16:22:20 2016 : Debug: } Tue Apr 19 16:22:20 2016 : Debug: (Loaded rlm_eap, checking if it's valid) Tue Apr 19 16:22:20 2016 : Debug: Module: Linked to module rlm_eap Tue Apr 19 16:22:20 2016 : Debug: Module: Instantiating module "eap" from file /etc/freeradius2/eap.conf Tue Apr 19 16:22:20 2016 : Debug: eap { Tue Apr 19 16:22:20 2016 : Debug: default_eap_type = "peap" Tue Apr 19 16:22:20 2016 : Debug: timer_expire = 60 Tue Apr 19 16:22:20 2016 : Debug: ignore_unknown_eap_types = no Tue Apr 19 16:22:20 2016 : Debug: cisco_accounting_username_bug = no Tue Apr 19 16:22:20 2016 : Debug: max_sessions = 1024 Tue Apr 19 16:22:20 2016 : Debug: } Tue Apr 19 16:22:20 2016 : Debug: Module: Linked to sub-module rlm_eap_tls Tue Apr 19 16:22:20 2016 : Debug: Module: Instantiating eap-tls Tue Apr 19 16:22:20 2016 : Debug: tls { Tue Apr 19 16:22:20 2016 : Debug: rsa_key_exchange = no Tue Apr 19 16:22:20 2016 : Debug: dh_key_exchange = yes Tue Apr 19 16:22:20 2016 : Debug: rsa_key_length = 512 Tue Apr 19 16:22:20 2016 : Debug: dh_key_length = 512 Tue Apr 19 16:22:20 2016 : Debug: verify_depth = 0 Tue Apr 19 16:22:20 2016 : Debug: CA_path = "/etc/freeradius2/certs" Tue Apr 19 16:22:20 2016 : Debug: pem_file_type = yes Tue Apr 19 16:22:20 2016 : Debug: private_key_file = "/etc/freeradius2/certs/server.pem" Tue Apr 19 16:22:20 2016 : Debug: certificate_file = "/etc/freeradius2/certs/server.pem" Tue Apr 19 16:22:20 2016 : Debug: CA_file = "/etc/freeradius2/certs/ca.pem" Tue Apr 19 16:22:20 2016 : Debug: private_key_password = "whatever" Tue Apr 19 16:22:20 2016 : Debug: dh_file = "/etc/freeradius2/certs/dh" Tue Apr 19 16:22:20 2016 : Debug: fragment_size = 1024 Tue Apr 19 16:22:20 2016 : Debug: include_length = yes Tue Apr 19 16:22:20 2016 : Debug: check_crl = no Tue Apr 19 16:22:20 2016 : Debug: check_all_crl = no Tue Apr 19 16:22:20 2016 : Debug: cipher_list = "DEFAULT" Tue Apr 19 16:22:20 2016 : Debug: ecdh_curve = "prime256v1" Tue Apr 19 16:22:20 2016 : Debug: verify { Tue Apr 19 16:22:20 2016 : Debug: } Tue Apr 19 16:22:20 2016 : Debug: ocsp { Tue Apr 19 16:22:20 2016 : Debug: enable = no Tue Apr 19 16:22:20 2016 : Debug: override_cert_url = yes Tue Apr 19 16:22:20 2016 : Debug: url = " http://127.0.0.1/ocsp/ " Tue Apr 19 16:22:20 2016 : Debug: use_nonce = yes Tue Apr 19 16:22:20 2016 : Debug: timeout = 0 Tue Apr 19 16:22:20 2016 : Debug: softfail = no Tue Apr 19 16:22:20 2016 : Debug: } Tue Apr 19 16:22:20 2016 : Debug: } Tue Apr 19 16:22:20 2016 : Debug: Module: Linked to sub-module rlm_eap_ttls Tue Apr 19 16:22:20 2016 : Debug: Module: Instantiating eap-ttls Tue Apr 19 16:22:20 2016 : Debug: ttls { Tue Apr 19 16:22:20 2016 : Debug: default_eap_type = "md5" Tue Apr 19 16:22:20 2016 : Debug: copy_request_to_tunnel = yes Tue Apr 19 16:22:20 2016 : Debug: use_tunneled_reply = yes Tue Apr 19 16:22:20 2016 : Debug: include_length = yes Tue Apr 19 16:22:20 2016 : Debug: } Tue Apr 19 16:22:20 2016 : Debug: Module: Linked to sub-module rlm_eap_peap Tue Apr 19 16:22:20 2016 : Debug: Module: Instantiating eap-peap Tue Apr 19 16:22:20 2016 : Debug: peap { Tue Apr 19 16:22:20 2016 : Debug: default_eap_type = "mschapv2" Tue Apr 19 16:22:20 2016 : Debug: copy_request_to_tunnel = yes Tue Apr 19 16:22:20 2016 : Debug: use_tunneled_reply = yes Tue Apr 19 16:22:20 2016 : Debug: proxy_tunneled_request_as_eap = no Tue Apr 19 16:22:20 2016 : Debug: soh = no Tue Apr 19 16:22:20 2016 : Debug: } Tue Apr 19 16:22:20 2016 : Debug: Module: Linked to sub-module rlm_eap_mschapv2 Tue Apr 19 16:22:20 2016 : Debug: Module: Instantiating eap-mschapv2 Tue Apr 19 16:22:20 2016 : Debug: mschapv2 { Tue Apr 19 16:22:20 2016 : Debug: with_ntdomain_hack = no Tue Apr 19 16:22:20 2016 : Debug: send_error = no Tue Apr 19 16:22:20 2016 : Debug: } Tue Apr 19 16:22:20 2016 : Debug: Module: Checking authorize {...} for more modules to load Tue Apr 19 16:22:20 2016 : Debug: Module: Loading virtual module rewrite.calling_station_id Tue Apr 19 16:22:20 2016 : Debug: (Loaded rlm_always, checking if it's valid) Tue Apr 19 16:22:20 2016 : Debug: Module: Linked to module rlm_always Tue Apr 19 16:22:20 2016 : Debug: Module: Instantiating module "updated" from file /etc/freeradius2/modules/always Tue Apr 19 16:22:20 2016 : Debug: always updated { Tue Apr 19 16:22:20 2016 : Debug: rcode = "updated" Tue Apr 19 16:22:20 2016 : Debug: simulcount = 0 Tue Apr 19 16:22:20 2016 : Debug: mpp = no Tue Apr 19 16:22:20 2016 : Debug: } Tue Apr 19 16:22:20 2016 : Debug: Module: Instantiating module "noop" from file /etc/freeradius2/modules/always Tue Apr 19 16:22:20 2016 : Debug: always noop { Tue Apr 19 16:22:20 2016 : Debug: rcode = "noop" Tue Apr 19 16:22:20 2016 : Debug: simulcount = 0 Tue Apr 19 16:22:20 2016 : Debug: mpp = no Tue Apr 19 16:22:20 2016 : Debug: } Tue Apr 19 16:22:20 2016 : Debug: (Loaded rlm_files, checking if it's valid) Tue Apr 19 16:22:20 2016 : Debug: Module: Linked to module rlm_files Tue Apr 19 16:22:20 2016 : Debug: Module: Instantiating module "authorized_macs" from file /etc/freeradius2/modules/files Tue Apr 19 16:22:20 2016 : Debug: files authorized_macs { Tue Apr 19 16:22:20 2016 : Debug: usersfile = "/etc/freeradius2/authorized_macs" Tue Apr 19 16:22:20 2016 : Debug: compat = "no" Tue Apr 19 16:22:20 2016 : Debug: key = "%{Calling-Station-ID}" Tue Apr 19 16:22:20 2016 : Debug: } Tue Apr 19 16:22:20 2016 : Debug: reading pairlist file /etc/freeradius2/authorized_macs Tue Apr 19 16:22:20 2016 : Debug: Module: Instantiating module "reject" from file /etc/freeradius2/modules/always Tue Apr 19 16:22:20 2016 : Debug: always reject { Tue Apr 19 16:22:20 2016 : Debug: rcode = "reject" Tue Apr 19 16:22:20 2016 : Debug: simulcount = 0 Tue Apr 19 16:22:20 2016 : Debug: mpp = no Tue Apr 19 16:22:20 2016 : Debug: } Tue Apr 19 16:22:20 2016 : Debug: Module: Instantiating module "files" from file /etc/freeradius2/modules/files Tue Apr 19 16:22:20 2016 : Debug: files { Tue Apr 19 16:22:20 2016 : Debug: usersfile = "/etc/freeradius2/users" Tue Apr 19 16:22:20 2016 : Debug: acctusersfile = "/etc/freeradius2/acct_users" Tue Apr 19 16:22:20 2016 : Debug: preproxy_usersfile = "/etc/freeradius2/preproxy_users" Tue Apr 19 16:22:20 2016 : Debug: compat = "no" Tue Apr 19 16:22:20 2016 : Debug: } Tue Apr 19 16:22:20 2016 : Debug: reading pairlist file /etc/freeradius2/users Tue Apr 19 16:22:20 2016 : Debug: reading pairlist file /etc/freeradius2/acct_users Tue Apr 19 16:22:20 2016 : Debug: reading pairlist file /etc/freeradius2/preproxy_users Tue Apr 19 16:22:20 2016 : Debug: Module: Checking accounting {...} for more modules to load Tue Apr 19 16:22:20 2016 : Debug: (Loaded rlm_exec, checking if it's valid) Tue Apr 19 16:22:20 2016 : Debug: Module: Linked to module rlm_exec Tue Apr 19 16:22:20 2016 : Debug: Module: Instantiating module "exec" from file /etc/freeradius2/modules/exec Tue Apr 19 16:22:20 2016 : Debug: exec { Tue Apr 19 16:22:20 2016 : Debug: wait = no Tue Apr 19 16:22:20 2016 : Debug: input_pairs = "request" Tue Apr 19 16:22:20 2016 : Debug: shell_escape = yes Tue Apr 19 16:22:20 2016 : Debug: timeout = 10 Tue Apr 19 16:22:20 2016 : Debug: } Tue Apr 19 16:22:20 2016 : Debug: Module: Checking session {...} for more modules to load Tue Apr 19 16:22:20 2016 : Debug: (Loaded rlm_radutmp, checking if it's valid) Tue Apr 19 16:22:20 2016 : Debug: Module: Linked to module rlm_radutmp Tue Apr 19 16:22:20 2016 : Debug: Module: Instantiating module "radutmp" from file /etc/freeradius2/modules/radutmp Tue Apr 19 16:22:20 2016 : Debug: radutmp { Tue Apr 19 16:22:20 2016 : Debug: filename = "/var/db/radacct/radutmp" Tue Apr 19 16:22:20 2016 : Debug: username = "%{User-Name}" Tue Apr 19 16:22:20 2016 : Debug: case_sensitive = yes Tue Apr 19 16:22:20 2016 : Debug: check_with_nas = yes Tue Apr 19 16:22:20 2016 : Debug: perm = 384 Tue Apr 19 16:22:20 2016 : Debug: callerid = yes Tue Apr 19 16:22:20 2016 : Debug: } Tue Apr 19 16:22:20 2016 : Debug: } # modules Tue Apr 19 16:22:20 2016 : Debug: } # server Tue Apr 19 16:22:20 2016 : Debug: radiusd: #### Opening IP addresses and Ports #### Tue Apr 19 16:22:20 2016 : Debug: listen { Tue Apr 19 16:22:20 2016 : Debug: type = "auth" Tue Apr 19 16:22:20 2016 : Debug: ipaddr = * Tue Apr 19 16:22:20 2016 : Debug: port = 0 Tue Apr 19 16:22:20 2016 : Debug: } Tue Apr 19 16:22:20 2016 : Debug: listen { Tue Apr 19 16:22:20 2016 : Debug: type = "acct" Tue Apr 19 16:22:20 2016 : Debug: ipaddr = * Tue Apr 19 16:22:20 2016 : Debug: port = 0 Tue Apr 19 16:22:20 2016 : Debug: } Tue Apr 19 16:22:20 2016 : Debug: Listening on authentication address * port 1812 Tue Apr 19 16:22:20 2016 : Debug: Listening on accounting interface br-lan address * port 1813 Tue Apr 19 16:22:20 2016 : Info: Ready to process requests. rad_recv: Access-Request packet from host 192.168.1.1 port 47559, id=0, length=115 User-Name = "k" NAS-IP-Address = 192.168.1.1 Called-Station-Id = "b046fc58804c" Calling-Station-Id = "ccaf78073b5a" NAS-Identifier = "b046fc58804c" NAS-Port = 2 Framed-MTU = 1400 NAS-Port-Type = Wireless-802.11 EAP-Message = 0x02000006016b Message-Authenticator = 0x63908c544fdb135590b53eddfac9ffc4 Tue Apr 19 16:22:49 2016 : Info: # Executing section authorize from file /etc/freeradius2/sites/default Tue Apr 19 16:22:49 2016 : Info: +group authorize { Tue Apr 19 16:22:49 2016 : Info: ++policy rewrite.calling_station_id { Tue Apr 19 16:22:49 2016 : Info: +++? if ((Calling-Station-Id) && "%{Calling-Station-Id}" =~ /^%{config:policy.mac-addr}$/i) Tue Apr 19 16:22:49 2016 : Info: ?? Evaluating (Calling-Station-Id) -> TRUE Tue Apr 19 16:22:49 2016 : Info: expand: %{Calling-Station-Id} -> ccaf78073b5a Tue Apr 19 16:22:49 2016 : Info: expand: policy.mac-addr -> policy.mac-addr Tue Apr 19 16:22:49 2016 : Info: expand: ^%{config:policy.mac-addr}$ -> ^([0-9a-f]{2})[^0-9a-f]?([0-9a-f]{2})[^0-9a-f]?([0-9a-f]{2})[^0-9a-f]?([0-9a-f]{2})[^0-9a-f]?([0-9a-f]{2})[^0-9a-f]?([0-9a-f]{2})$ Tue Apr 19 16:22:49 2016 : Info: ? Evaluating ("%{Calling-Station-Id}" =~ /^%{config:policy.mac-addr}$/i) -> TRUE Tue Apr 19 16:22:49 2016 : Info: +++? if ((Calling-Station-Id) && "%{Calling-Station-Id}" =~ /^%{config:policy.mac-addr}$/i) -> TRUE Tue Apr 19 16:22:49 2016 : Info: +++if ((Calling-Station-Id) && "%{Calling-Station-Id}" =~ /^%{config:policy.mac-addr}$/i) { Tue Apr 19 16:22:49 2016 : Info: ++++update request { Tue Apr 19 16:22:49 2016 : Info: expand: %{1}-%{2}-%{3}-%{4}-%{5}-%{6} -> cc-af-78-07-3b-5a Tue Apr 19 16:22:49 2016 : Info: expand: %{tolower:%{1}-%{2}-%{3}-%{4}-%{5}-%{6}} -> cc-af-78-07-3b-5a Tue Apr 19 16:22:49 2016 : Info: ++++} # update request = noop Tue Apr 19 16:22:49 2016 : Info: ++++[updated] = updated Tue Apr 19 16:22:49 2016 : Info: +++} # if ((Calling-Station-Id) && "%{Calling-Station-Id}" =~ /^%{config:policy.mac-addr}$/i) = updated Tue Apr 19 16:22:49 2016 : Info: +++ ... skipping else for request 0: Preceding "if" was taken Tue Apr 19 16:22:49 2016 : Info: ++} # policy rewrite.calling_station_id = updated Tue Apr 19 16:22:49 2016 : Info: [authorized_macs] expand: %{Calling-Station-ID} -> cc-af-78-07-3b-5a Tue Apr 19 16:22:49 2016 : Info: [authorized_macs] users: Matched entry cc-af-78-07-3b-5a at line 12 Tue Apr 19 16:22:49 2016 : Info: ++[authorized_macs] = ok Tue Apr 19 16:22:49 2016 : Info: ++? if (!ok) Tue Apr 19 16:22:49 2016 : Info: ? Evaluating !(ok) -> FALSE Tue Apr 19 16:22:49 2016 : Info: ++? if (!ok) -> FALSE Tue Apr 19 16:22:49 2016 : Info: [eap] EAP packet type response id 0 length 6 Tue Apr 19 16:22:49 2016 : Info: [eap] No EAP Start, assuming it's an on-going EAP conversation Tue Apr 19 16:22:49 2016 : Info: ++[eap] = updated Tue Apr 19 16:22:49 2016 : Info: [files] users: Matched entry k at line 5 Tue Apr 19 16:22:49 2016 : Info: [files] expand: Hello, %{User-Name} -> Hello, k Tue Apr 19 16:22:49 2016 : Info: ++[files] = ok Tue Apr 19 16:22:49 2016 : Info: [pap] WARNING: Auth-Type already set. Not setting to PAP Tue Apr 19 16:22:49 2016 : Info: ++[pap] = noop Tue Apr 19 16:22:49 2016 : Info: +} # group authorize = updated Tue Apr 19 16:22:49 2016 : Info: Found Auth-Type = EAP Tue Apr 19 16:22:49 2016 : Info: # Executing group from file /etc/freeradius2/sites/default Tue Apr 19 16:22:49 2016 : Info: +group authenticate { Tue Apr 19 16:22:49 2016 : Info: [eap] EAP Identity Tue Apr 19 16:22:49 2016 : Info: [eap] processing type tls Tue Apr 19 16:22:49 2016 : Info: [tls] Initiate Tue Apr 19 16:22:49 2016 : Info: [tls] Start returned 1 Tue Apr 19 16:22:49 2016 : Info: ++[eap] = handled Tue Apr 19 16:22:49 2016 : Info: +} # group authenticate = handled Sending Access-Challenge of id 0 to 192.168.1.1 port 47559 Reply-Message = "Hello, k" EAP-Message = 0x010100061920 Message-Authenticator = 0x00000000000000000000000000000000 State = 0x2bc7c2802bc6dba8902f8db7525fd589 Tue Apr 19 16:22:49 2016 : Info: Finished request 0. Tue Apr 19 16:22:49 2016 : Debug: Going to the next request Tue Apr 19 16:22:49 2016 : Debug: Waking up in 4.9 seconds. Tue Apr 19 16:22:54 2016 : Info: Cleaning up request 0 ID 0 with timestamp +29 Tue Apr 19 16:22:54 2016 : Debug: WARNING: !!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!! Tue Apr 19 16:22:54 2016 : Debug: WARNING: !! EAP session for state 0x2bc7c2802bc6dba8 did not finish! Tue Apr 19 16:22:54 2016 : Debug: WARNING: !! Please read http://wiki.freeradius.org/guide/Certificate_Compatibility Tue Apr 19 16:22:54 2016 : Debug: WARNING: !!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!! Tue Apr 19 16:22:54 2016 : Info: Ready to process requests. rad_recv: Access-Request packet from host 192.168.1.1 port 56343, id=0, length=115 User-Name = "k" NAS-IP-Address = 192.168.1.1 Called-Station-Id = "b046fc58804c" Calling-Station-Id = "ccaf78073b5a" NAS-Identifier = "b046fc58804c" NAS-Port = 2 Framed-MTU = 1400 NAS-Port-Type = Wireless-802.11 EAP-Message = 0x02000006016b Message-Authenticator = 0x92c6a8bb5d14b2e4781523d9b5be03df Tue Apr 19 16:24:24 2016 : Info: # Executing section authorize from file /etc/freeradius2/sites/default Tue Apr 19 16:24:24 2016 : Info: +group authorize { Tue Apr 19 16:24:24 2016 : Info: ++policy rewrite.calling_station_id { Tue Apr 19 16:24:24 2016 : Info: +++? if ((Calling-Station-Id) && "%{Calling-Station-Id}" =~ /^%{config:policy.mac-addr}$/i) Tue Apr 19 16:24:24 2016 : Info: ?? Evaluating (Calling-Station-Id) -> TRUE Tue Apr 19 16:24:24 2016 : Info: expand: %{Calling-Station-Id} -> ccaf78073b5a Tue Apr 19 16:24:24 2016 : Info: expand: policy.mac-addr -> policy.mac-addr Tue Apr 19 16:24:24 2016 : Info: expand: ^%{config:policy.mac-addr}$ -> ^([0-9a-f]{2})[^0-9a-f]?([0-9a-f]{2})[^0-9a-f]?([0-9a-f]{2})[^0-9a-f]?([0-9a-f]{2})[^0-9a-f]?([0-9a-f]{2})[^0-9a-f]?([0-9a-f]{2})$ Tue Apr 19 16:24:24 2016 : Info: ? Evaluating ("%{Calling-Station-Id}" =~ /^%{config:policy.mac-addr}$/i) -> TRUE Tue Apr 19 16:24:24 2016 : Info: +++? if ((Calling-Station-Id) && "%{Calling-Station-Id}" =~ /^%{config:policy.mac-addr}$/i) -> TRUE Tue Apr 19 16:24:24 2016 : Info: +++if ((Calling-Station-Id) && "%{Calling-Station-Id}" =~ /^%{config:policy.mac-addr}$/i) { Tue Apr 19 16:24:24 2016 : Info: ++++update request { Tue Apr 19 16:24:24 2016 : Info: expand: %{1}-%{2}-%{3}-%{4}-%{5}-%{6} -> cc-af-78-07-3b-5a Tue Apr 19 16:24:24 2016 : Info: expand: %{tolower:%{1}-%{2}-%{3}-%{4}-%{5}-%{6}} -> cc-af-78-07-3b-5a Tue Apr 19 16:24:24 2016 : Info: ++++} # update request = noop Tue Apr 19 16:24:24 2016 : Info: ++++[updated] = updated Tue Apr 19 16:24:24 2016 : Info: +++} # if ((Calling-Station-Id) && "%{Calling-Station-Id}" =~ /^%{config:policy.mac-addr}$/i) = updated Tue Apr 19 16:24:24 2016 : Info: +++ ... skipping else for request 1: Preceding "if" was taken Tue Apr 19 16:24:24 2016 : Info: ++} # policy rewrite.calling_station_id = updated Tue Apr 19 16:24:24 2016 : Info: [authorized_macs] expand: %{Calling-Station-ID} -> cc-af-78-07-3b-5a Tue Apr 19 16:24:24 2016 : Info: [authorized_macs] users: Matched entry cc-af-78-07-3b-5a at line 12 Tue Apr 19 16:24:24 2016 : Info: ++[authorized_macs] = ok Tue Apr 19 16:24:24 2016 : Info: ++? if (!ok) Tue Apr 19 16:24:24 2016 : Info: ? Evaluating !(ok) -> FALSE Tue Apr 19 16:24:24 2016 : Info: ++? if (!ok) -> FALSE Tue Apr 19 16:24:24 2016 : Info: [eap] EAP packet type response id 0 length 6 Tue Apr 19 16:24:24 2016 : Info: [eap] No EAP Start, assuming it's an on-going EAP conversation Tue Apr 19 16:24:24 2016 : Info: ++[eap] = updated Tue Apr 19 16:24:24 2016 : Info: [files] users: Matched entry k at line 5 Tue Apr 19 16:24:24 2016 : Info: [files] expand: Hello, %{User-Name} -> Hello, k Tue Apr 19 16:24:24 2016 : Info: ++[files] = ok Tue Apr 19 16:24:24 2016 : Info: [pap] WARNING: Auth-Type already set. Not setting to PAP Tue Apr 19 16:24:24 2016 : Info: ++[pap] = noop Tue Apr 19 16:24:24 2016 : Info: +} # group authorize = updated Tue Apr 19 16:24:24 2016 : Info: Found Auth-Type = EAP Tue Apr 19 16:24:24 2016 : Info: # Executing group from file /etc/freeradius2/sites/default Tue Apr 19 16:24:24 2016 : Info: +group authenticate { Tue Apr 19 16:24:24 2016 : Info: [eap] EAP Identity Tue Apr 19 16:24:24 2016 : Info: [eap] processing type tls Tue Apr 19 16:24:24 2016 : Info: [tls] Initiate Tue Apr 19 16:24:24 2016 : Info: [tls] Start returned 1 Tue Apr 19 16:24:24 2016 : Info: ++[eap] = handled Tue Apr 19 16:24:24 2016 : Info: +} # group authenticate = handled Sending Access-Challenge of id 0 to 192.168.1.1 port 56343 Reply-Message = "Hello, k" EAP-Message = 0x010100061920 Message-Authenticator = 0x00000000000000000000000000000000 State = 0xc7cb19abc7ca00b9956b02c17b8e07a9 Tue Apr 19 16:24:24 2016 : Info: Finished request 1. Tue Apr 19 16:24:24 2016 : Debug: Going to the next request Tue Apr 19 16:24:24 2016 : Debug: Waking up in 4.9 seconds. Tue Apr 19 16:24:29 2016 : Info: Cleaning up request 1 ID 0 with timestamp +124 Tue Apr 19 16:24:29 2016 : Debug: WARNING: !!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!! Tue Apr 19 16:24:29 2016 : Debug: WARNING: !! EAP session for state 0xc7cb19abc7ca00b9 did not finish! Tue Apr 19 16:24:29 2016 : Debug: WARNING: !! Please read http://wiki.freeradius.org/guide/Certificate_Compatibility Tue Apr 19 16:24:29 2016 : Debug: WARNING: !!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!! Tue Apr 19 16:24:29 2016 : Info: Ready to process requests. ^C

2 1

IP lease time mysql IP pool
by Tevfik Ceydeliler 20 Apr '16

20 Apr '16

Hi, I have an IP pool (near 30 IP) and some client comes over GSM APN But altough clients disconnect and reconnect often, same client gets always different IP address. As show debug log below, altough same NAS IP and Calling station ID, User gebzewm19 connected 2 times and got 2 diffrent IP addresses in shot time It occurs till IP pool is full. Then I get error thatIP ALLOCATION FAILED. I check sqlippool.conf the lease duration is : lease-duration = 7200 and pool-key= "%{NAS-IP-Address}-%{Calling-Station-Id}" Have you any suggestion to pass this problem? regards... ### DEBUG LOG: User-Name = "gebzewm19" expand: %{User-Name} -> gebzewm19 sql_set_user escaped user --> 'gebzewm19' [suffix] No '@' in User-Name = "gebzewm19", looking up realm NULL [sql] expand: %{User-Name} -> gebzewm19 [sql] sql_set_user escaped user --> 'gebzewm19' [sql] expand: SELECT id, username, attribute, value, op FROM radcheck WHERE username = '%{SQL-User-Name}' ORDER BY id -> SELECT id, username, attribute, value, op FROM radcheck WHERE username = 'gebzewm19' ORDER BY id [sql] expand: SELECT id, username, attribute, value, op FROM radreply WHERE username = '%{SQL-User-Name}' ORDER BY id -> SELECT id, username, attribute, value, op FROM radreply WHERE username = 'gebzewm19' ORDER BY id [sql] expand: SELECT groupname FROM radusergroup WHERE username = '%{SQL-User-Name}' ORDER BY priority -> SELECT groupname FROM radusergroup WHERE username = 'gebzewm19' ORDER BY priority [sqlippool] expand: %{User-Name} -> gebzewm19 [sqlippool] sql_set_user escaped user --> 'gebzewm19' [sqlippool] expand: SELECT framedipaddress FROM radippool WHERE pool_name = '%{control:Pool-Name}' AND (expiry_time < NOW() OR expiry_time IS NULL) ORDER BY (username <> '%{User-Name}'), (callingstationid <> '%{Calling-Station-Id}'), expiry_time LIMIT 1 FOR UPDATE -> SELECT framedipaddress FROM radippool WHERE pool_name = 'IP_TCELL_YSS' AND (expiry_time < NOW() OR expiry_time IS NULL) ORDER BY (username <> 'gebzewm19'), (callingstationid <> '905366292079'), expiry_time LIMIT 1 FOR UPDATE [sqlippool] expand: UPDATE radippool SET nasipaddress = '%{NAS-IP-Address}', pool_key = '%{NAS-IP-Address}-%{Calling-Station-Id}', callingstationid = '%{Calling-Station-Id}', username = '%{User-Name}', expiry_time = NOW() + INTERVAL 7200 SECOND WHERE framedipaddress = '172.30.73.7' AND expiry_time IS NULL -> UPDATE radippool SET nasipaddress = '172.30.80.1', pool_key = '172.30.80.1-905366292079', callingstationid = '905366292079', username = 'gebzewm19', expiry_time = NOW() + INTERVAL 7200 SECOND WHERE framedipaddress = '172.30.73.7' AND expiry_time IS NULL [sqlippool] expand: Allocated IP: %{reply:Framed-IP-Address} from %{control:Pool-Name} (did %{Called-Station-Id} cli %{Calling-Station-Id} port %{NAS-Port} user %{User-Name}) -> Allocated IP: 172.30.73.7 from IP_TCELL_YSS (did yasarapn cli 905366292079 port 26602633 user gebzewm19) Allocated IP: 172.30.73.7 from IP_TCELL_YSS (did yasarapn cli 905366292079 port 26602633 user gebzewm19) User-Name = "gebzewm19" expand: %{User-Name} -> gebzewm19 sql_set_user escaped user --> 'gebzewm19' [suffix] No '@' in User-Name = "gebzewm19", looking up realm NULL [sql] expand: %{User-Name} -> gebzewm19 [sql] sql_set_user escaped user --> 'gebzewm19' [sql] expand: SELECT id, username, attribute, value, op FROM radcheck WHERE username = '%{SQL-User-Name}' ORDER BY id -> SELECT id, username, attribute, value, op FROM radcheck WHERE username = 'gebzewm19' ORDER BY id [sql] expand: SELECT id, username, attribute, value, op FROM radreply WHERE username = '%{SQL-User-Name}' ORDER BY id -> SELECT id, username, attribute, value, op FROM radreply WHERE username = 'gebzewm19' ORDER BY id [sql] expand: SELECT groupname FROM radusergroup WHERE username = '%{SQL-User-Name}' ORDER BY priority -> SELECT groupname FROM radusergroup WHERE username = 'gebzewm19' ORDER BY priority [sqlippool] expand: %{User-Name} -> gebzewm19 [sqlippool] sql_set_user escaped user --> 'gebzewm19' [sqlippool] expand: SELECT framedipaddress FROM radippool WHERE pool_name = '%{control:Pool-Name}' AND (expiry_time < NOW() OR expiry_time IS NULL) ORDER BY (username <> '%{User-Name}'), (callingstationid <> '%{Calling-Station-Id}'), expiry_time LIMIT 1 FOR UPDATE -> SELECT framedipaddress FROM radippool WHERE pool_name = 'IP_TCELL_YSS' AND (expiry_time < NOW() OR expiry_time IS NULL) ORDER BY (username <> 'gebzewm19'), (callingstationid <> '905366292079'), expiry_time LIMIT 1 FOR UPDATE [sqlippool] expand: UPDATE radippool SET nasipaddress = '%{NAS-IP-Address}', pool_key = '%{NAS-IP-Address}-%{Calling-Station-Id}', callingstationid = '%{Calling-Station-Id}', username = '%{User-Name}', expiry_time = NOW() + INTERVAL 7200 SECOND WHERE framedipaddress = '172.30.73.8' AND expiry_time IS NULL -> UPDATE radippool SET nasipaddress = '172.30.80.1', pool_key = '172.30.80.1-905366292079', callingstationid = '905366292079', username = 'gebzewm19', expiry_time = NOW() + INTERVAL 7200 SECOND WHERE framedipaddress = '172.30.73.8' AND expiry_time IS NULL [sqlippool] expand: Allocated IP: %{reply:Framed-IP-Address} from %{control:Pool-Name} (did %{Called-Station-Id} cli %{Calling-Station-Id} port %{NAS-Port} user %{User-Name}) -> Allocated IP: 172.30.73.8 from IP_TCELL_YSS (did yasarapn cli 905366292079 port 32257377 user gebzewm19) Allocated IP: 172.30.73.8 from IP_TCELL_YSS (did yasarapn cli 905366292079 port 32257377 user gebzewm19) ... ... sqlippool] expand: IP Allocation FAILED from %{control:Pool-Name} (did %{Called-Station-Id} cli %{Calling-Station-Id} port %{NAS-Port} user %{User-Name}) -> ... --

3 5

Restrict authentication types per user
by yolanda3000＠freenet.de 20 Apr '16

20 Apr '16

Hi, I want to test a supplicant. I'm looking for a way to restrict the allowed authentication types per user. Only one special authentication type per user. I know that it is a stupid thing to do, but I need it for testing. E.g. user1 is only allowed to use EAP-TLS user2 is only allowed to use EAP-TTLS/EAP-MSCHAPv2 user3 is only allowed to use EAP-TTLS/MSCHAPv2 .. Is there an easy way to do this? I'm using a standard installation of version 3.0.11. Thanks, Yolanda Fischer --- Mail & Cloud Made in Germany mit 3 GB Speicher! https://email.freenet.de/mail/Uebersicht?epid=e9900000450

3 3