- Freeradius-Users - lists.freeradius.org

Configurable failover : Different behavior between 2.1.12 and 2.2.5
by José Paredes 23 Mar '16

23 Mar '16

Hello, We have noticed changes of behavior after update from 2.1.12 to 2.2.5 and we would like to know which configuration is correct. Works on 2.1.12 : if(userlock) { update reply { Reply-Message := "Compte expiré" HM-Reject-Status := "expired" } ok = reject } Same configuration in 2.2.5 doesn't reject the user. Works on 2.2.5 : if(userlock) { update reply { Reply-Message := "Compte expiré" HM-Reject-Status := "expired" } reject } It works as expected but it doesn't seem to complie with the doc : /usr/share/doc/freeradius/configurable_failover.rst.gz On another thread Alan suggested that this was the proper way to do it is but it doesn't reject the user : expiration { userlock = 1 } if (userlock) { update reply { Codigo-Reject := Curenta-Expirada } } Thanks in advance for advices. J -- ADIPSYS José Paredes 2405 route des Dolines CS 10065 06902 Sophia Antipolis Cedex Tel: (33)4 89 82 92 45

2 1

provide DAC and NAC to one host
by MichaelLeung 22 Mar '16

22 Mar '16

hi list here is an example of one of my client.conf and the virtual-server ------------------------nas----------------------- client devices { ipaddr = 192.168.1.1 proto = * secret = testing123 require_message_authenticator = no nas-type = other limit { max_connections = 16 lifetime = 0 idle_timeout = 30 } virtual_server = devicemanager } ----------------------------virtual server---------------------- server devicemanager { authorize { Use_Auth_Ladp filter_username disabled devicemanager_check ldap pap } authenticate { Auth-Type PAP { pap } Auth-Type CHAP { chap } Auth-Type MS-CHAP { mschap } digest Auth-Type LDAP { ldap } eap } preacct { preprocess acct_unique suffix files } accounting { detail unix exec attr_filter.accounting_response } session { } post-auth { exec remove_reply_message_if_eap Post-Auth-Type REJECT { attr_filter.access_reject eap remove_reply_message_if_eap } } pre-proxy { } post-proxy { eap } } ----------------------------------end----------------------- Host 192.168.1.1 is a switch, as i have configed radius device access for host 192.168.1.1, what am i suppose to do if i am want to enable switch port dot1x (network access control)on this swtich with the same radius server,

2 2

error parsing the dictionary for the extended format attributes and flags
by Vereecke, Katrien (Nokia - BE) 21 Mar '16

21 Mar '16

Hello, With version freeradius-server-3.0.11 I get an error when the extended attribute format is used together with the encrypt flag. I have the following defined in my dictionary: BEGIN-VENDOR Alcatel-IPD format=Extended-Vendor-Specific-1 ATTRIBUTE Alc-Test-1 1 string encrypt=2 .... END-VENDOR Alcatel-IPD This gives the following error: Errors reading /usr/local/etc/raddb/dictionary: dict_init: /users/tdebaets/dictionary-freeradius.txt[576]: dict_addattr: The "extended" attributes MUST NOT have any flags set Any help is appreciated. Thanks, Kind regards, Katrien.

2 1

LDAP module for DHCP attribute
by Ryan O'Connell 21 Mar '16

21 Mar '16

Looking to transition an exec module/script I have working to the LDAP module. I am trying to return an option 43 string from LDAP in the reply but I can't seem to figure out the proper way to call the LDAP module correctly. If I call the module in the dhcp site the only time I can get it to trigger is in the post-auth section of the LDAP module where it tries to update the user 'description' attribute that doesn't exist (expected of course but maybe relevant as background info?). I'm using 3.1.x from a week or two ago. Here's a short section of the success with "exec" as well as full debug with the ldap module enabled. Any guidance you can provide is appreciated. Thanks, Ryan ------ Success with Exec ------- (1) Received DHCP-Request Id 6b8b4567 from 10.0.7.27:6700 to 10.0.8.53:6700 via eth0 length 282 (1) &request:DHCP-Opcode = Client-Message (1) &request:DHCP-Hardware-Type = Ethernet (1) &request:DHCP-Hardware-Address-Length = 6 (1) &request:DHCP-Hop-Count = 0 (1) &request:DHCP-Transaction-Id = 1804289383 (1) &request:DHCP-Number-of-Seconds = 0 (1) &request:DHCP-Flags = 0 (1) &request:DHCP-Client-IP-Address = 0.0.0.0 (1) &request:DHCP-Your-IP-Address = 0.0.0.0 (1) &request:DHCP-Server-IP-Address = 0.0.0.0 (1) &request:DHCP-Gateway-IP-Address = 10.0.7.27 (1) &request:DHCP-Client-Hardware-Address = 00:00:00:00:00:01 (1) &request:DHCP-Message-Type = DHCP-Request (1) &request:DHCP-Client-Identifier = 0x646863706572665f31 (1) &request:DHCP-Requested-IP-Address = 192.168.39.168 (1) &request:DHCP-DHCP-Server-Identifier = 10.0.8.53 (1) &request:DHCP-Parameter-Request-List = DHCP-Subnet-Mask (1) &request:DHCP-Parameter-Request-List = DHCP-Router-Address (1) &request:DHCP-Parameter-Request-List = DHCP-Domain-Name-Server (1) &request:DHCP-Parameter-Request-List = DHCP-Domain-Name (1) &request:DHCP-Relay-Remote-Id = 00:00:00:00:00:01 (1) Trying sub-section dhcp DHCP-Request {...} (1) dhcp DHCP-Request { (1) update reply { (1) &reply:DHCP-Message-Type = DHCP-Ack (1) } # update reply (noop) (1) update reply { (1) &reply:DHCP-Subnet-Mask = 255.0.0.0 (1) &reply:DHCP-Router-Address = 10.0.0.1 (1) &reply:DHCP-IP-Address-Lease-Time = 86400 (1) &reply:DHCP-DHCP-Server-Identifier = 10.0.8.53 (1) } # update reply (noop) (1) update control { (1) &control:Pool-Name := test (1) } # update control (noop) (1) update reply { (1) EXPAND %{exec:/etc/raddb/ldaplookup.sh %{DHCP-Client-Hardware-Address}} (1) Executing: /etc/raddb/ldaplookup.sh 00:00:00:00:00:01 (1) Program returned code (0) and output '0x010300A0BC0209555400000000000006030e5554000000000000010101000009041055545f312e312e312e302e392e62696e05040a50001e' (1) --> 0x010300A0BC0209555400000000000006030e5554000000000000010101000009041055545f312e312e312e302e392e62696e05040a50001e (1) &reply:DHCP-Vendor = 0x010300a0bc0209555400000000000006030e5554000000000000010101000009041055545f312e312e312e302e392e62696e05040a50001e (1) } # update reply (noop) (1) redis_ippool - Allocating lease from pool "test", to "00:00:00:00:00:01", expires in 30s (1) redis_ippool - Reserved connection (0) (1) redis_ippool - [1] >>> Sending command(s) to 127.0.0.1:6379 (1) redis_ippool - [1] <<< Returned: success (1) redis_ippool - Released connection (0) (1) redis_ippool - &reply:DHCP-Your-IP-Address := 192.168.39.168 (1) redis_ippool - &reply:DHCP-IP-Address-Lease-Time := 30 (1) redis_ippool - IP address lease allocated (1) redis_ippool (updated) (1) update reply { (1) &reply:DHCP-IP-Address-Lease-Time = 86400 (1) } # update reply (noop) (1) ok (ok) (1) } # dhcp DHCP-Request (updated) (1) Reply will be unicast to giaddr from original packet (1) Sent DHCP-Ack Id 6b8b4567 from 10.0.8.53:6700 to 10.0.7.27:6700 via eth0 length 0 (1) &reply:DHCP-Relay-IP-Address = 10.0.7.27 (1) &reply:DHCP-Message-Type = DHCP-Ack (1) &reply:DHCP-Subnet-Mask = 255.0.0.0 (1) &reply:DHCP-Router-Address = 10.0.0.1 (1) &reply:DHCP-IP-Address-Lease-Time := 30 (1) &reply:DHCP-DHCP-Server-Identifier = 10.0.8.53 (1) &reply:DHCP-Vendor = 0x010300a0bc0209555400000000000006030e5554000000000000010101000009041055545f312e312e312e302e392e62696e05040a50001e (1) &reply:DHCP-Your-IP-Address := 192.168.39.168 (1) &reply:DHCP-Opcode = Server-Message (1) &reply:DHCP-Hardware-Type = Ethernet (1) &reply:DHCP-Hardware-Address-Length = 6 (1) &reply:DHCP-Hop-Count = 0 (1) &reply:DHCP-Transaction-Id = 1804289383 (1) &reply:DHCP-Flags = 0 (1) &reply:DHCP-Client-IP-Address = 0.0.0.0 (1) &reply:DHCP-Gateway-IP-Address = 10.0.7.27 (1) &reply:DHCP-Client-Hardware-Address = 00:00:00:00:00:01 (1) Finished request (1) Cleaning up request packet ID 1804289383 with timestamp +3 ------ Failure with LDAP ------- [root@15597-vos-dhcp2-vos-dhcp10 ~]# /usr/sbin/radiusd -X FreeRADIUS Version 3.1.0 Copyright (C) 1999-2016 The FreeRADIUS server project and contributors There is NO warranty; not even for MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE You may redistribute copies of FreeRADIUS under the terms of the GNU General Public License For more information about these matters, see the file named COPYRIGHT Starting - reading configuration files ... including dictionary file /usr/share/freeradius/dictionary including dictionary file /usr/share/freeradius/dictionary.dhcp including dictionary file /usr/share/freeradius/dictionary.vqp including dictionary file /etc/raddb/dictionary including configuration file /etc/raddb/radiusd.conf including configuration file /etc/raddb/clients.conf including files in directory /etc/raddb/mods-enabled/ including configuration file /etc/raddb/mods-enabled/always including configuration file /etc/raddb/mods-enabled/dhcp including configuration file /etc/raddb/mods-enabled/exec including configuration file /etc/raddb/mods-enabled/redis including configuration file /etc/raddb/mods-enabled/redis_ippool including configuration file /etc/raddb/mods-enabled/ldap including files in directory /etc/raddb/policy.d/ including configuration file /etc/raddb/policy.d/abfab-tr including configuration file /etc/raddb/policy.d/accounting including configuration file /etc/raddb/policy.d/canonicalization including configuration file /etc/raddb/policy.d/control including configuration file /etc/raddb/policy.d/cui including configuration file /etc/raddb/policy.d/debug including configuration file /etc/raddb/policy.d/dhcp including configuration file /etc/raddb/policy.d/eap including configuration file /etc/raddb/policy.d/filter including configuration file /etc/raddb/policy.d/operator-name including configuration file /etc/raddb/policy.d/vendor including files in directory /etc/raddb/sites-enabled/ including configuration file /etc/raddb/sites-enabled/dhcp including configuration file /etc/raddb/sites-enabled/default main { security { user = "radiusd" group = "radiusd" allow_core_dumps = no } name = "radiusd" prefix = "/usr" localstatedir = "/var" logdir = "/var/log/radius" run_dir = "/var/run/radiusd" } main { name = "radiusd" prefix = "/usr" localstatedir = "/var" sbindir = "/usr/sbin" logdir = "/var/log/radius" run_dir = "/var/run/radiusd" libdir = "/usr/lib64/freeradius" radacctdir = "/var/log/radius/radacct" hostname_lookups = no max_request_time = 30 cleanup_delay = 3 continuation_timeout = 15 max_requests = 100000 pidfile = "/var/run/radiusd/radiusd.pid" checkrad = "/usr/sbin/checkrad" debug_level = 0 proxy_requests = yes log { stripped_names = no auth = no auth_badpass = no auth_goodpass = no colourise = yes msg_denied = "You are already logged in - access denied" } resources { } security { max_attributes = 200 reject_delay = 1.000000 status_server = yes allow_vulnerable_openssl = "no" } } radiusd: #### Loading Realms and Home Servers #### radiusd: #### Loading Clients #### client localhost { ipaddr = 127.0.0.1 require_message_authenticator = no secret = <<< secret >>> nas_type = "other" proto = "*" limit { max_connections = 16 lifetime = 0 idle_timeout = 30 } } client localhost_ipv6 { ipv6addr = ::1 require_message_authenticator = no secret = <<< secret >>> limit { max_connections = 16 lifetime = 0 idle_timeout = 30 } } Debugger not attached thread pool { start_servers = 50 max_servers = 64 min_spare_servers = 15 max_spare_servers = 35 max_requests_per_server = 64 cleanup_delay = 5 max_queue_size = 65536 auto_limit_acct = no } WARNING: Ignoring "max_spare_servers = 35", forcing to "max_spare_servers = 15" listen { type = "dhcp" ipaddr = 10.0.8.53 port = 6700 recv_buff = 0 No "interface" setting is defined. Only unicast DHCP will work src_ipaddr = 10.0.8.53 } radiusd: #### Loading modules #### modules { # Loaded module "rlm_always" # Loading module "reject" from file /etc/raddb/mods-enabled/always always reject { rcode = "reject" simulcount = 0 mpp = no } # Loading module "fail" from file /etc/raddb/mods-enabled/always always fail { rcode = "fail" simulcount = 0 mpp = no } # Loading module "ok" from file /etc/raddb/mods-enabled/always always ok { rcode = "ok" simulcount = 0 mpp = no } # Loading module "handled" from file /etc/raddb/mods-enabled/always always handled { rcode = "handled" simulcount = 0 mpp = no } # Loading module "invalid" from file /etc/raddb/mods-enabled/always always invalid { rcode = "invalid" simulcount = 0 mpp = no } # Loading module "userlock" from file /etc/raddb/mods-enabled/always always userlock { rcode = "userlock" simulcount = 0 mpp = no } # Loading module "notfound" from file /etc/raddb/mods-enabled/always always notfound { rcode = "notfound" simulcount = 0 mpp = no } # Loading module "noop" from file /etc/raddb/mods-enabled/always always noop { rcode = "noop" simulcount = 0 mpp = no } # Loading module "updated" from file /etc/raddb/mods-enabled/always always updated { rcode = "updated" simulcount = 0 mpp = no } # Loaded module "rlm_dhcp" # Loading module "dhcp" from file /etc/raddb/mods-enabled/dhcp # Loaded module "rlm_exec" # Loading module "exec" from file /etc/raddb/mods-enabled/exec exec { wait = yes input_pairs = "request" shell_escape = yes timeout = 10 } # Loaded module "rlm_redis" # Loading module "redis" from file /etc/raddb/mods-enabled/redis redis { server = "127.0.0.1" port = 6379 database = 0 max_nodes = 20 max_alt = 3 max_redirects = 2 } libfreeradius-redis: libhiredis version: 0.12.1 # Loaded module "rlm_redis_ippool" # Loading module "redis_ippool" from file /etc/raddb/mods-enabled/redis_ippool redis_ippool { copy_on_update = yes redis { server = "localhost" port = 6379 database = 0 max_nodes = 20 max_alt = 3 max_redirects = 2 } } # Loaded module "rlm_ldap" # Loading module "ldap" from file /etc/raddb/mods-enabled/ldap ldap { server = "10.0.8.156" identity = "cn=Manager,dc=example,dc=com" password = <<< secret >>> sasl { } user { scope = "one" access_positive = yes sasl { } } group { filter = "(objectClass=posixGroup)" scope = "sub" name_attribute = "cn" membership_attribute = "memberOf" cacheable_name = no cacheable_dn = no } client { filter = "(objectClass=radiusClient)" scope = "sub" base_dn = "dc=example,dc=com" } profile { } options { ldap_debug = 296 chase_referrals = yes use_referral_credentials = no rebind = yes session_tracking = no res_timeout = 10 srv_timelimit = 3 idle = 60 probes = 3 interval = 3 } tls { start_tls = no } } Creating attribute LDAP-Group instantiate { } } # modules # Instantiating module "reject" from file /etc/raddb/mods-enabled/always # Instantiating module "fail" from file /etc/raddb/mods-enabled/always # Instantiating module "ok" from file /etc/raddb/mods-enabled/always # Instantiating module "handled" from file /etc/raddb/mods-enabled/always # Instantiating module "invalid" from file /etc/raddb/mods-enabled/always # Instantiating module "userlock" from file /etc/raddb/mods-enabled/always # Instantiating module "notfound" from file /etc/raddb/mods-enabled/always # Instantiating module "noop" from file /etc/raddb/mods-enabled/always # Instantiating module "updated" from file /etc/raddb/mods-enabled/always # Instantiating module "redis" from file /etc/raddb/mods-enabled/redis rlm_redis (redis) [1] - Initialising connection pool pool { start = 50 min = 15 max = 64 spare = 35 uses = 0 lifetime = 86400 cleanup_interval = 300 idle_timeout = 600 connect_timeout = 3.000000 held_trigger_min = 0.000000 held_trigger_max = 0.500000 retry_delay = 30 spread = no } rlm_redis (redis) [1] - Opening additional connection (0), 1 of 64 pending slots used rlm_redis (redis) [1]: Connecting node to 127.0.0.1:6379 ::::::: # Instantiating module "redis_ippool" from file /etc/raddb/mods-enabled/redis_ippool rlm_redis (redis) [1] - Initialising connection pool pool { start = 0 min = 15 max = 64 spare = 35 uses = 0 lifetime = 0 cleanup_interval = 30 idle_timeout = 60 connect_timeout = 3.000000 held_trigger_min = 0.000000 held_trigger_max = 0.500000 retry_delay = 30 spread = no } rlm_redis (redis) [1] - 0 of 0 connections in use. You may need to increase "spare" rlm_redis (redis) [1] - Opening additional connection (0), 1 of 64 pending slots used rlm_redis (redis) [1]: Connecting node to 127.0.0.1:6379 rlm_redis (redis) [1] - Reserved connection (0) rlm_redis (redis): Bootstrap server "localhost" returned: PGf? rlm_redis (redis) [1] - Released connection (0) rlm_redis (redis) [1] - Need 14 more connections to reach 35 spares rlm_redis (redis) [1] - Opening additional connection (1), 1 of 64 pending slots used rlm_redis (redis) [1]: Connecting node to 127.0.0.1:6379 rlm_redis (redis) [1] - Reserved connection (0) rlm_redis (redis) [1] - Released connection (0) # Instantiating module "ldap" from file /etc/raddb/mods-enabled/ldap rlm_ldap (ldap) - libldap vendor: OpenLDAP, version: 20440 accounting { reference = "." } post-auth { reference = "." } rlm_ldap (ldap) - Initialising connection pool pool { start = 50 min = 15 max = 64 spare = 35 uses = 0 lifetime = 0 cleanup_interval = 30 idle_timeout = 60 connect_timeout = 3.000000 held_trigger_min = 0.000000 held_trigger_max = 0.500000 retry_delay = 30 spread = no } rlm_ldap (ldap) - Opening additional connection (0), 1 of 64 pending slots used rlm_ldap (ldap) - Connecting to ldap://10.0.8.156:389 rlm_ldap (ldap) - Waiting for bind result... rlm_ldap (ldap) - Bind successful rlm_ldap (ldap) - Performing search in "" with filter "(objectclass=*)", scope "base" rlm_ldap (ldap) - Waiting for search result... rlm_ldap (ldap) - Directory type: OpenLDAP :::::: radiusd: #### Loading Virtual Servers #### server dhcp { # from file /etc/raddb/sites-enabled/dhcp # Loading dhcp DHCP-Discover {...} # Loading dhcp DHCP-Request {...} # Loading dhcp DHCP-Decline {...} # Loading dhcp DHCP-Inform {...} # Loading dhcp DHCP-Release {...} # Loading dhcp DHCP-Lease-Query {...} } # server dhcp server default { # from file /etc/raddb/sites-enabled/default } # server default radiusd: #### Opening IP addresses and Ports #### Listening on dhcp address 10.0.8.53 port 6700 bound to server dhcp Ready to process requests (0) Received DHCP-Discover Id 6b8b4567 from 10.0.7.27:6700 to 10.0.8.53:6700 via eth0 length 270 (0) &request:DHCP-Opcode = Client-Message (0) &request:DHCP-Hardware-Type = Ethernet (0) &request:DHCP-Hardware-Address-Length = 6 (0) &request:DHCP-Hop-Count = 0 (0) &request:DHCP-Transaction-Id = 1804289383 (0) &request:DHCP-Number-of-Seconds = 0 (0) &request:DHCP-Flags = 0 (0) &request:DHCP-Client-IP-Address = 0.0.0.0 (0) &request:DHCP-Your-IP-Address = 0.0.0.0 (0) &request:DHCP-Server-IP-Address = 0.0.0.0 (0) &request:DHCP-Gateway-IP-Address = 10.0.7.27 (0) &request:DHCP-Client-Hardware-Address = 00:00:00:00:00:01 (0) &request:DHCP-Message-Type = DHCP-Discover (0) &request:DHCP-Client-Identifier = 0x646863706572665f31 (0) &request:DHCP-Parameter-Request-List = DHCP-Subnet-Mask (0) &request:DHCP-Parameter-Request-List = DHCP-Router-Address (0) &request:DHCP-Parameter-Request-List = DHCP-Domain-Name-Server (0) &request:DHCP-Parameter-Request-List = DHCP-Domain-Name (0) &request:DHCP-Relay-Remote-Id = 00:00:00:00:00:01 (0) Trying sub-section dhcp DHCP-Discover {...} (0) dhcp DHCP-Discover { (0) update reply { (0) &reply:DHCP-Message-Type = DHCP-Offer (0) } # update reply (noop) (0) update reply { (0) &reply:DHCP-Subnet-Mask = 255.0.0.0 (0) &reply:DHCP-Router-Address = 10.0.0.1 (0) &reply:DHCP-IP-Address-Lease-Time = 86400 (0) &reply:DHCP-DHCP-Server-Identifier = 10.0.8.53 (0) } # update reply (noop) (0) update control { (0) &control:Pool-Name := test (0) } # update control (noop) (0) redis_ippool - Allocating lease from pool "test", to "00:00:00:00:00:01", expires in 30s (0) redis_ippool - Reserved connection (1) (0) redis_ippool - [1] >>> Sending command(s) to 127.0.0.1:6379 (0) redis_ippool - [1] <<< Returned: success (0) redis_ippool - Released connection (1) (0) redis_ippool - Need 13 more connections to reach 35 spares (0) redis_ippool - Opening additional connection (2), 1 of 1022 pending slots used rlm_redis (redis) [1]: Connecting node to 127.0.0.1:6379 (0) redis_ippool - &reply:DHCP-Your-IP-Address := 192.168.39.169 (0) redis_ippool - &reply:DHCP-IP-Address-Lease-Time := 30 (0) redis_ippool - IP address lease allocated (0) redis_ippool (updated) (0) ok (ok) (0) } # dhcp DHCP-Discover (updated) (0) Reply will be unicast to giaddr from original packet (0) Sent DHCP-Offer Id 6b8b4567 from 10.0.8.53:6700 to 10.0.7.27:6700 via eth0 length 0 (0) &reply:DHCP-Relay-IP-Address = 10.0.7.27 (0) &reply:DHCP-Message-Type = DHCP-Offer (0) &reply:DHCP-Subnet-Mask = 255.0.0.0 (0) &reply:DHCP-Router-Address = 10.0.0.1 (0) &reply:DHCP-IP-Address-Lease-Time := 30 (0) &reply:DHCP-DHCP-Server-Identifier = 10.0.8.53 (0) &reply:DHCP-Your-IP-Address := 192.168.39.169 (0) &reply:DHCP-Opcode = Server-Message (0) &reply:DHCP-Hardware-Type = Ethernet (0) &reply:DHCP-Hardware-Address-Length = 6 (0) &reply:DHCP-Hop-Count = 0 (0) &reply:DHCP-Transaction-Id = 1804289383 (0) &reply:DHCP-Flags = 0 (0) &reply:DHCP-Client-IP-Address = 0.0.0.0 (0) &reply:DHCP-Gateway-IP-Address = 10.0.7.27 (0) &reply:DHCP-Client-Hardware-Address = 00:00:00:00:00:01 (0) Finished request (0) Cleaning up request packet ID 1804289383 with timestamp +7 Ready to process requests (1) Received DHCP-Request Id 6b8b4567 from 10.0.7.27:6700 to 10.0.8.53:6700 via eth0 length 282 (1) &request:DHCP-Opcode = Client-Message (1) &request:DHCP-Hardware-Type = Ethernet (1) &request:DHCP-Hardware-Address-Length = 6 (1) &request:DHCP-Hop-Count = 0 (1) &request:DHCP-Transaction-Id = 1804289383 (1) &request:DHCP-Number-of-Seconds = 0 (1) &request:DHCP-Flags = 0 (1) &request:DHCP-Client-IP-Address = 0.0.0.0 (1) &request:DHCP-Your-IP-Address = 0.0.0.0 (1) &request:DHCP-Server-IP-Address = 0.0.0.0 (1) &request:DHCP-Gateway-IP-Address = 10.0.7.27 (1) &request:DHCP-Client-Hardware-Address = 00:00:00:00:00:01 (1) &request:DHCP-Message-Type = DHCP-Request (1) &request:DHCP-Client-Identifier = 0x646863706572665f31 (1) &request:DHCP-Requested-IP-Address = 192.168.39.169 (1) &request:DHCP-DHCP-Server-Identifier = 10.0.8.53 (1) &request:DHCP-Parameter-Request-List = DHCP-Subnet-Mask (1) &request:DHCP-Parameter-Request-List = DHCP-Router-Address (1) &request:DHCP-Parameter-Request-List = DHCP-Domain-Name-Server (1) &request:DHCP-Parameter-Request-List = DHCP-Domain-Name (1) &request:DHCP-Relay-Remote-Id = 00:00:00:00:00:01 (1) Trying sub-section dhcp DHCP-Request {...} (1) dhcp DHCP-Request { (1) update reply { (1) &reply:DHCP-Message-Type = DHCP-Ack (1) } # update reply (noop) (1) update reply { (1) &reply:DHCP-Subnet-Mask = 255.0.0.0 (1) &reply:DHCP-Router-Address = 10.0.0.1 (1) &reply:DHCP-IP-Address-Lease-Time = 86400 (1) &reply:DHCP-DHCP-Server-Identifier = 10.0.8.53 (1) } # update reply (noop) (1) update control { (1) &control:Pool-Name := test (1) } # update control (noop) (1) ldap - EXPAND . (1) ldap - --> . (1) ldap - EXPAND Authenticated at %S (1) ldap - --> Authenticated at 2016-03-21 12:45:47 (1) ldap - Reserved connection (0) (1) ldap - EXPAND (cn=1,6,%{DHCP-Client-Hardware-Address}) (1) ldap - --> (cn=1,6,00:00:00:00:00:01) (1) ldap - Performing search in "dc=example,dc=com" with filter "(cn=1,6,00:00:00:00:00:01)", scope "one" (1) ldap - Waiting for search result... (1) ldap - User object found at DN "cn=1\,6\,00:00:00:00:00:01,dc=example,dc=com" (1) ldap - Modifying object with DN "cn=1\,6\,00:00:00:00:00:01,dc=example,dc=com" (1) ldap - Waiting for modify result... (1) ldap - ERROR: Failed modifying object: Object class violation (1) ldap - ERROR: Server said: attribute 'description' not allowed. (1) ldap - Released connection (0) (1) ldap (fail) (1) } # dhcp DHCP-Request (fail) (1) Reply will be unicast to giaddr from original packet (1) Sent DHCP-Ack Id 6b8b4567 from 10.0.8.53:6700 to 10.0.7.27:6700 via eth0 length 0 (1) &reply:DHCP-Relay-IP-Address = 10.0.7.27 (1) &reply:DHCP-Message-Type = DHCP-Ack (1) &reply:DHCP-Subnet-Mask = 255.0.0.0 (1) &reply:DHCP-Router-Address = 10.0.0.1 (1) &reply:DHCP-IP-Address-Lease-Time = 86400 (1) &reply:DHCP-DHCP-Server-Identifier = 10.0.8.53 (1) &reply:DHCP-Opcode = Server-Message (1) &reply:DHCP-Hardware-Type = Ethernet (1) &reply:DHCP-Hardware-Address-Length = 6 (1) &reply:DHCP-Hop-Count = 0 (1) &reply:DHCP-Transaction-Id = 1804289383 (1) &reply:DHCP-Flags = 0 (1) &reply:DHCP-Client-IP-Address = 0.0.0.0 (1) &reply:DHCP-Gateway-IP-Address = 10.0.7.27 (1) &reply:DHCP-Client-Hardware-Address = 00:00:00:00:00:01 (1) Finished request (1) Cleaning up request packet ID 1804289383 with timestamp +7

2 1

LDAP Group Against AD Issue
by Matt Brennan 21 Mar '16

21 Mar '16

Good Day, I am attempting to setup FreeRADIUS 3.0.11 against a single Active Directory. I am also trying to use AD via LDAP to check group membership for authorization. The authentication (via MSCHAPv2) is working fine, but I am having issues with group memberships. If the user manually authenticates with their sAMAccoutnName (i.e. systest) everything works as expected. However, when automatic authentication is done by windows, the username is sent in the domain\username pattern, and my LDAP group checks fail. I end up trying to search AD for "DOMAIN\5c5c\5c5csystest" which doesn't work: (7) ldap: EXPAND (sAMAccountName=%{%{Stripped-User-Name}:-%{User-Name}}) (7) ldap: --> (sAMAccountName=applause\5c5csystest) (7) ldap: Performing search in "OU=User Accounts,DC=corp,DC=applause,DC=com" with filter "(sAMAccountName=applause\5c5csystest)", scope "sub" (7) ldap: Waiting for search result... (7) ldap: Search returned no results It appears that proxy is the way to go, but it doesn't seem to be stripping the realm once it's located. Any pointers are appreciated. I've been working on this for days and just can't resolve this portion. -Matt

3 2

Re: understanding the process of setting up eap-tls server/client certs
by Michael Martinez 20 Mar '16

20 Mar '16

One thing I forgot to mention in the previous discourse, is that I'm assuming that eapol_test does not send the client private key over the wire in the case where you give it a single file that contains both the client cert and private key. Hopefully it parses out the cert and only transmits that to the radius server. Other thing, just so people are aware, I tried testing this with jradius but it didn't work. It gets like halfway into the EAP-TLS dialogue, but when radius requests the client certificate, Jradius fails to send it. So there's some sort of bug in Jradius. Not suprising, it looks like the last time their code was updated was in 2004.

1 0

Re: understanding the process of setting up eap-tls server/client certs
by Michael Martinez 20 Mar '16

20 Mar '16

I got this working. I'll share what I did, maybe it will help someone else down the line. First thing I did is refresh myself on how digital certificates and public key infrastructure works (asymmetric public/private keys). It had been a long time since I had worked with any of it, but for radius you need more than just "what is a basic private/public key pair." You need to know what the certificates do and what they contain. Next I ran the make ca.pem, make server.pem, make client.pem commands found in the freeradius certs folder and I looked at the openssl commands that these ran. Each make runs several openssl commands and you need to understand what each of these is doing. Next is to edit the ca.cnf, server.cnf and client.cnf files. A note about the password fields in these files: *for ca.cnf, the "output password" is used to encrypt the ca.key private key that gets created * for server.cnf, the "output password" is first used to encrypt the server.key private key that gets created. It is also subsequently used to encrypt the outputted private key when the p12 (pkcs12) file is created, but this step does not create any new private keys, so it is ignored at that point. the "input password" is used during the p12 creation to decrypt server.key, so therefore it needs to have the same value as output password. so: "input password" must equal "output password" * for client.cnf, same thing. output password is used to encrypt client.key, then later it is used as "input password" to decrypt it to create the p12 file, so: "input password" must equal "output password" here too. For sanity checks, after you have run the three make commands, you can look at passwords.mk file. And of course you should use a different password for each of these three things. After this, you can go into the etc/raddb/certs directory that is used by freeradius, and you can nuke everything in there and then populate it with four new files: dh, ca.pem, server.key and server.pem. Then go into mods-enabled/eap and set the following: private_key_password: this is the password for "server.key" private_key_file: the server.key file certificate file: server.pem ca_file: ca.pem server.key and server.pem are what freeradius uses to identify itself and encrypt traffic, so this pair needs to be unique for each radius server. In order to validate other certs (client certs), it needs the ca.pem file. now to use eapol_test for testing, you need several things: * a configuration file * the CA file * the client certificate which includes its public key * the client private key the EAP-TLS client needs to be able to validate the radius server certificate, therefore the client needs the CA file (ca.pem). the client of course also needs its own certificate with private/public key pair, in order to identify itself and encrypt traffic Now, if you look at the contents of client.pem, you will see it contains both the client public key and private key. You can leave these in one file, or you can split them apart and put them into two separate .pem files. If you choose the first method, then a bare-bones configuration file looks like this: # WPA2-EAP/CCMP using EAP-TLS ctrl_interface=/var/run/wpa_supplicant network={ key_mgmt=WPA-EAP identity="myusername" proto=WPA2 eap=TLS ca_cert="/tmp/clients/ca.pem private_key="/tmp/clients/client.p12" private_key_passwd="xxxxx" } Notice two things: first, eapol_test is smart enough to look at the private key file and realize that it also contains the client certificate, and is able to parse it out and deal with it correctly. Secondly, notice that I'm using the p12 file instead of the pem file. For some reason this doesn't work with the pem file, even though it contains the same information, just in a different format. If instead you want to split the client cert and private key, you can use separate pem files as follows: # WPA2-EAP/CCMP using EAP-TLS ctrl_interface=/var/run/wpa_supplicantnetwork={ key_mgmt=WPA-EAP identity="myusername" proto=WPA2 eap=TLS ca_cert="/tmp/clients/ca.pem" client_cert="/tmp/clients/clientcertpem" private_key="/tmp/clients/clientkey.pem" # private_key="/tmp/clients/client.key" private_key_passwd="xxxxx" } Or you can even use the "key" file as shown above. The "identity" is required, but it can be any arbitrary string. This shows up as the radius 'User-Name' attribute. At first I was thinking this would have to match the commonName of the client certificate, but it turns out it doesn't. To test from any machine where you have eapol_test installed: ./eapol_test -c /tmp/conffile -a<radius server ip> -s<secret> -o /tmp/eap_cert.out Take a look at /tmp/eap_cert.out. It should contain both the CA cert and the Radius server cert, which means your client successfully downloaded these certs across the wire. If you are issuing client certs yourself, you can use the above procedure. Or if the client prefers to keep their private key private then they can generate their own CSR, give the csr to you, you can use "openssl ca" to generate and sign their cert and hand it back to them. -- --- Michael Martinez http://www.michael--martinez.com

1 0

how to disable crlDistributionPoints extension?
by yukou katori 19 Mar '16

19 Mar '16

Hi, I have a problem that crlDistributionPoints is included in server certification.This forces clients to check CRL via http.For the sake of simplicity for my setup, I don't want clients to check CRL via HTTP.# checking CRL stored in clients locally is enough (e.g. in StrongSwan, ipsec.d/crls/) I deleted the following parameter in ca.cnf (I'm using FR3.0.10)[v3_ca]subjectKeyIdentifier = hashauthorityKeyIdentifier = keyid:always,issuer:alwaysbasicConstraints = critical,CA:truecrlDistributionPoints = URI:http://www.example.org/example_ca.crl <<< HERE I performed "make ca.pem"Then I made server certification and CDP is included as follows:openssl x509 -text -noout -in server.pemCertificate: Data: Version: 3 (0x2) Serial Number: 1 (0x1) Signature Algorithm: sha256WithRSAEncryption Issuer: C=JP, ST=Tokyo, L=XXX, O=XXX/emailAddress=XXX@XXX, CN=FR-CA Validity Not Before: Mar 16 15:02:23 2016 GMT Not After : Mar 11 15:02:23 2036 GMT Subject: C=JP, ST=Tokyo, O=XXX, CN=FR-Svr/emailAddress=XXX@XXX(snip) X509v3 extensions: X509v3 Extended Key Usage: TLS Web Server Authentication X509v3 CRL Distribution Points: <<< HERE!!! Full Name: URI:http://www.example.com/example_ca.crl My idea is wrong? Regards,

2 5

FreeRadius-2.2.9 - Help with NAS
by Aurélio de Souza Ribeiro Neto 19 Mar '16

19 Mar '16

Hello Everyone, I'm a newbie in FreeRadius. I have a FreeRadius 2.2.9 authentication in MySQL database, and my NAS is a Mikrotik routerboard. My dhcp-pool is MySQL. Everything is working fine, but I have a problem: I made a mistake and set different passwords on the NAS and the database. So when my client requested access the Radius Server provided an IP that was not received by NAS. The NAS then requested another one and thus my pool finish. Is there a way (perhaps post-auth) to prevent this form happening? Maybe it is checking whether the NAS received the response from the Radius Server? Thanks Aurélio

1 0

Certificate problem between 3.0.11 and 3.1.x
by Jonathan Gazeley 19 Mar '16

19 Mar '16

I've been migrating our RADIUS estate from 2.2.9 and 3.0.11 to 3.1.x, built from git. Thanks to help from this list last week I've got eduroam working successfully. I'm now struggling to get another SSID (machine authentication for domain-joined Windows PCs) to work. I can see that it is printing the warning: !!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!! !! EAP session 0x2ab6bf0 did not finish! !! !! See http://wiki.freeradius.org/guide/Certificate_Compatibility !! !!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!! however the same certificate works properly on 3.0.11. Has there been a change of behaviour in the server? Thanks, Jonathan FreeRADIUS Version 3.1.0 Copyright (C) 1999-2016 The FreeRADIUS server project and contributors There is NO warranty; not even for MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE You may redistribute copies of FreeRADIUS under the terms of the GNU General Public License For more information about these matters, see the file named COPYRIGHT Starting - reading configuration files ... including dictionary file /usr/share/freeradius/dictionary including dictionary file /usr/share/freeradius/dictionary.dhcp including dictionary file /usr/share/freeradius/dictionary.vqp including dictionary file /etc/raddb/dictionary including configuration file /etc/raddb/radiusd.conf including configuration file /etc/raddb/proxy.conf including files in directory /etc/raddb/clients.d/ including configuration file /etc/raddb/clients.d/WISM7.conf including configuration file /etc/raddb/clients.d/YEOVIL.conf including configuration file /etc/raddb/clients.d/WISM8.conf including configuration file /etc/raddb/clients.d/WISM2.conf including configuration file /etc/raddb/clients.d/NHS-JA-GW.conf including configuration file /etc/raddb/clients.d/WISM2-HA.conf including configuration file /etc/raddb/clients.d/localhost.conf including configuration file /etc/raddb/clients.d/WISM5-HA.conf including configuration file /etc/raddb/clients.d/WISM6.conf including configuration file /etc/raddb/clients.d/roaming2.ja.net.conf including configuration file /etc/raddb/clients.d/WISM3.conf including configuration file /etc/raddb/clients.d/WISM6-HA.conf including configuration file /etc/raddb/clients.d/roaming1.ja.net-v6.conf including configuration file /etc/raddb/clients.d/monitor.conf including configuration file /etc/raddb/clients.d/roaming1.ja.net.conf including configuration file /etc/raddb/clients.d/WISM4-HA.conf including configuration file /etc/raddb/clients.d/ENGINE-SHED.conf including configuration file /etc/raddb/clients.d/NBHT.conf including configuration file /etc/raddb/clients.d/roaming0.ja.net.conf including configuration file /etc/raddb/clients.d/WISM5.conf including configuration file /etc/raddb/clients.d/BCC110.conf including configuration file /etc/raddb/clients.d/WISM1-HA.conf including configuration file /etc/raddb/clients.d/testswitch.conf including configuration file /etc/raddb/clients.d/UBHT120.conf including configuration file /etc/raddb/clients.d/WISM7-HA.conf including configuration file /etc/raddb/clients.d/adminctrl.conf including configuration file /etc/raddb/clients.d/monitor-dev.conf including configuration file /etc/raddb/clients.d/WISM4.conf including configuration file /etc/raddb/clients.d/UBHT169.conf including configuration file /etc/raddb/clients.d/WISM1.conf including configuration file /etc/raddb/clients.d/TAUNTON-NEW.conf including configuration file /etc/raddb/clients.d/F5.conf including configuration file /etc/raddb/clients.d/roaming2.ja.net-v6.conf including configuration file /etc/raddb/clients.d/WISM3-HA.conf including configuration file /etc/raddb/clients.d/WISM9.conf including configuration file /etc/raddb/clients.d/roaming0.ja.net-v6.conf including configuration file /etc/raddb/clients.d/WISM12.conf including files in directory /etc/raddb/mods-enabled/ including configuration file /etc/raddb/mods-enabled/detail.log including configuration file /etc/raddb/mods-enabled/rainbowpreprocess including configuration file /etc/raddb/mods-enabled/uobdetail including configuration file /etc/raddb/mods-enabled/rainbowmschap including configuration file /etc/raddb/mods-enabled/mschap including configuration file /etc/raddb/mods-enabled/files-eduroam including configuration file /etc/raddb/mods-enabled/linelog /etc/raddb/mods-enabled/linelog[114]: Reference "${..pool}" not found /etc/raddb/mods-enabled/linelog[127]: Reference "${..pool}" not found including configuration file /etc/raddb/mods-enabled/vpimschap including configuration file /etc/raddb/mods-enabled/rainbowlog including configuration file /etc/raddb/mods-enabled/replicate including configuration file /etc/raddb/mods-enabled/files including configuration file /etc/raddb/mods-enabled/eduroameap including configuration file /etc/raddb/mods-enabled/chap including configuration file /etc/raddb/mods-enabled/exec including configuration file /etc/raddb/mods-enabled/realm including configuration file /etc/raddb/mods-enabled/dynamic_clients including configuration file /etc/raddb/mods-enabled/digest including configuration file /etc/raddb/mods-enabled/expr including configuration file /etc/raddb/mods-enabled/sradutmp including configuration file /etc/raddb/mods-enabled/eduroamvlan including configuration file /etc/raddb/mods-enabled/dhcp including configuration file /etc/raddb/mods-enabled/uobldap including configuration file /etc/raddb/mods-enabled/uobsql-write including configuration file /etc/raddb/mods-config/uobsql-write-queries.conf including configuration file /etc/raddb/mods-enabled/expiration including configuration file /etc/raddb/mods-enabled/eduroamlioneap including configuration file /etc/raddb/mods-enabled/logtofile including configuration file /etc/raddb/mods-enabled/always including configuration file /etc/raddb/mods-enabled/ntlm_auth including configuration file /etc/raddb/mods-enabled/rainbowfiles including configuration file /etc/raddb/mods-enabled/logtosyslog including configuration file /etc/raddb/mods-enabled/attr_filter including configuration file /etc/raddb/mods-enabled/utf8 including configuration file /etc/raddb/mods-enabled/radutmp including configuration file /etc/raddb/mods-enabled/passwd including configuration file /etc/raddb/mods-enabled/soh including configuration file /etc/raddb/mods-enabled/unix including configuration file /etc/raddb/mods-enabled/cache_eap including configuration file /etc/raddb/mods-enabled/eduroammschap including configuration file /etc/raddb/mods-enabled/uobsql including configuration file /etc/raddb/mods-config/uobsql-queries.conf including configuration file /etc/raddb/mods-enabled/eduroaminfo including configuration file /etc/raddb/mods-enabled/detail including configuration file /etc/raddb/mods-enabled/vpieap including configuration file /etc/raddb/mods-enabled/rainboweap including configuration file /etc/raddb/mods-enabled/echo including configuration file /etc/raddb/mods-enabled/preprocess including configuration file /etc/raddb/mods-enabled/unpack including configuration file /etc/raddb/mods-enabled/pap including configuration file /etc/raddb/mods-enabled/logintime including configuration file /etc/raddb/templates.conf including files in directory /etc/raddb/policy.d/ including configuration file /etc/raddb/policy.d/policies including configuration file /etc/raddb/policy.d/normalization including configuration file /etc/raddb/policy.d/filter including configuration file /etc/raddb/policy.d/eduroam-realm-checks.conf including configuration file /etc/raddb/policy.d/debug including configuration file /etc/raddb/policy.d/dhcp including configuration file /etc/raddb/policy.d/get-ssid including configuration file /etc/raddb/policy.d/canonicalization including configuration file /etc/raddb/policy.d/eap including configuration file /etc/raddb/policy.d/control including configuration file /etc/raddb/policy.d/vendor including configuration file /etc/raddb/policy.d/logchecker including configuration file /etc/raddb/policy.d/cui including configuration file /etc/raddb/policy.d/abfab-tr including configuration file /etc/raddb/policy.d/operator-name including configuration file /etc/raddb/policy.d/accounting including configuration file /etc/raddb/policy.d/rainbowmacauth including files in directory /etc/raddb/sites-enabled/ including configuration file /etc/raddb/sites-enabled/eduroam-partners including configuration file /etc/raddb/sites-enabled/bristolresearchnet including configuration file /etc/raddb/sites-enabled/rainbow-inner including configuration file /etc/raddb/sites-enabled/uobconsoles including configuration file /etc/raddb/sites-enabled/control-socket including configuration file /etc/raddb/sites-enabled/vpi-inner including configuration file /etc/raddb/sites-enabled/rainbow including configuration file /etc/raddb/sites-enabled/eduroamalien including configuration file /etc/raddb/sites-enabled/vpi including configuration file /etc/raddb/sites-enabled/status including files in directory /etc/raddb/statusclients.d/ including configuration file /etc/raddb/statusclients.d/localhost.conf including configuration file /etc/raddb/statusclients.d/monitor-devv6.conf including configuration file /etc/raddb/statusclients.d/monitor.conf including configuration file /etc/raddb/statusclients.d/monitorv6.conf including configuration file /etc/raddb/statusclients.d/monitor-dev.conf including configuration file /etc/raddb/sites-enabled/eduroamlocal-acct including configuration file /etc/raddb/sites-enabled/eduroamlocal-auth including configuration file /etc/raddb/sites-enabled/eduroamlion-inner including configuration file /etc/raddb/sites-enabled/rainboweap-tls including configuration file /etc/raddb/sites-enabled/eduroam-inner main { security { user = "radiusd" group = "radiusd" allow_core_dumps = no } name = "radiusd" prefix = "/usr" localstatedir = "/var" logdir = "/var/log/radius" run_dir = "/var/run/radiusd" } main { name = "radiusd" prefix = "/usr" localstatedir = "/var" sbindir = "/usr/sbin" logdir = "/var/log/radius" run_dir = "/var/run/radiusd" libdir = "/usr/lib64/freeradius" radacctdir = "/var/log/radius/radacct" hostname_lookups = no max_request_time = 30 cleanup_delay = 5 continuation_timeout = 15 max_requests = 4096 pidfile = "/var/run/radiusd/radiusd.pid" checkrad = "/usr/sbin/checkrad" debug_level = 0 proxy_requests = yes log { stripped_names = no auth = no auth_badpass = no auth_goodpass = no colourise = yes msg_denied = "You are already logged in - access denied" } resources { } security { max_attributes = 200 reject_delay = 1.000000 status_server = yes allow_vulnerable_openssl = "yes" } } radiusd: #### Loading Realms and Home Servers #### home_server jrs0 { ipaddr = 194.82.174.185 port = 1812 type = "auth+acct" proto = "udp" secret = <<< secret >>> response_window = 30.000000 response_timeouts = 1 max_outstanding = 65536 zombie_period = 40 status_check = "none" ping_interval = 30 check_timeout = 4 num_answers_to_alive = 3 revive_interval = 300 limit { max_connections = 16 max_requests = 0 lifetime = 0 idle_timeout = 0 } coa { irt = 2 mrt = 16 mrc = 5 mrd = 30 } } home_server jrs0v6 { ipv6addr = 2001:630:1:128::185 port = 1812 type = "auth+acct" proto = "udp" secret = <<< secret >>> response_window = 30.000000 response_timeouts = 1 max_outstanding = 65536 zombie_period = 40 status_check = "none" ping_interval = 30 check_timeout = 4 num_answers_to_alive = 3 revive_interval = 300 limit { max_connections = 16 max_requests = 0 lifetime = 0 idle_timeout = 0 } coa { irt = 2 mrt = 16 mrc = 5 mrd = 30 } } home_server jrs1 { ipaddr = 194.83.56.233 port = 1812 type = "auth+acct" proto = "udp" secret = <<< secret >>> response_window = 30.000000 response_timeouts = 1 max_outstanding = 65536 zombie_period = 40 status_check = "none" ping_interval = 30 check_timeout = 4 num_answers_to_alive = 3 revive_interval = 300 limit { max_connections = 16 max_requests = 0 lifetime = 0 idle_timeout = 0 } coa { irt = 2 mrt = 16 mrc = 5 mrd = 30 } } home_server jrs1v6 { ipv6addr = 2001:630:1:12a::233 port = 1812 type = "auth+acct" proto = "udp" secret = <<< secret >>> response_window = 30.000000 response_timeouts = 1 max_outstanding = 65536 zombie_period = 40 status_check = "none" ping_interval = 30 check_timeout = 4 num_answers_to_alive = 3 revive_interval = 300 limit { max_connections = 16 max_requests = 0 lifetime = 0 idle_timeout = 0 } coa { irt = 2 mrt = 16 mrc = 5 mrd = 30 } } home_server jrs2 { ipaddr = 194.83.56.249 port = 1812 type = "auth+acct" proto = "udp" secret = <<< secret >>> response_window = 30.000000 response_timeouts = 1 max_outstanding = 65536 zombie_period = 40 status_check = "none" ping_interval = 30 check_timeout = 4 num_answers_to_alive = 3 revive_interval = 300 limit { max_connections = 16 max_requests = 0 lifetime = 0 idle_timeout = 0 } coa { irt = 2 mrt = 16 mrc = 5 mrd = 30 } } home_server jrs2v6 { ipv6addr = 2001:630:1:129::249 port = 1812 type = "auth+acct" proto = "udp" secret = <<< secret >>> response_window = 30.000000 response_timeouts = 1 max_outstanding = 65536 zombie_period = 40 status_check = "none" ping_interval = 30 check_timeout = 4 num_answers_to_alive = 3 revive_interval = 300 limit { max_connections = 16 max_requests = 0 lifetime = 0 idle_timeout = 0 } coa { irt = 2 mrt = 16 mrc = 5 mrd = 30 } } home_server radius-dev { ipaddr = 137.222.7.119 port = 16006 type = "auth+acct" proto = "udp" secret = <<< secret >>> response_window = 30.000000 response_timeouts = 1 max_outstanding = 65536 zombie_period = 40 status_check = "none" ping_interval = 30 check_timeout = 4 num_answers_to_alive = 3 revive_interval = 300 limit { max_connections = 16 max_requests = 0 lifetime = 0 idle_timeout = 0 } coa { irt = 2 mrt = 16 mrc = 5 mrd = 30 } } home_server radius-dev-v6 { ipv6addr = 2001:630:e4:81:137:222:7:119 port = 16006 type = "auth+acct" proto = "udp" secret = <<< secret >>> response_window = 30.000000 response_timeouts = 1 max_outstanding = 65536 zombie_period = 40 status_check = "none" ping_interval = 30 check_timeout = 4 num_answers_to_alive = 3 revive_interval = 300 limit { max_connections = 16 max_requests = 0 lifetime = 0 idle_timeout = 0 } coa { irt = 2 mrt = 16 mrc = 5 mrd = 30 } } realm LOCAL { } realm bris.ac.uk { } realm bristol.ac.uk { } home_server_pool dev { type = fail-over home_server = radius-dev home_server = radius-dev-v6 } realm dev { pool = dev } home_server_pool jrs { type = fail-over home_server = jrs1v6 home_server = jrs2v6 home_server = jrs1 home_server = jrs0v6 home_server = jrs2 home_server = jrs0 } realm jrs { pool = jrs nostrip } realm lion.bristol.ac.uk { } realm my.bristol.ac.uk { } radiusd: #### Loading Clients #### client WISM7 { ipaddr = 172.17.107.207 require_message_authenticator = no secret = <<< secret >>> shortname = "WISM7" nas_type = "cisco" limit { max_connections = 16 lifetime = 0 idle_timeout = 30 } } client YEOVIL { ipaddr = 195.171.105.146 require_message_authenticator = no secret = <<< secret >>> shortname = "YEOVIL" limit { max_connections = 16 lifetime = 0 idle_timeout = 30 } } client WISM8 { ipaddr = 172.17.107.208 require_message_authenticator = no secret = <<< secret >>> shortname = "WISM8" nas_type = "cisco" limit { max_connections = 16 lifetime = 0 idle_timeout = 30 } } client WISM2 { ipaddr = 172.17.107.202 require_message_authenticator = no secret = <<< secret >>> shortname = "WISM2" nas_type = "cisco" limit { max_connections = 16 lifetime = 0 idle_timeout = 30 } } client NHS-JA-GW { ipaddr = 194.176.105.96/28 require_message_authenticator = no secret = <<< secret >>> shortname = "NHS-JA-GW" limit { max_connections = 16 lifetime = 0 idle_timeout = 30 } } client WISM2-HA { ipaddr = 172.17.107.102 require_message_authenticator = no secret = <<< secret >>> shortname = "WISM2-HA" nas_type = "cisco" limit { max_connections = 16 lifetime = 0 idle_timeout = 30 } } client localhost { ipaddr = 127.0.0.1 require_message_authenticator = no secret = <<< secret >>> shortname = "localhost" nas_type = "other" limit { max_connections = 16 lifetime = 0 idle_timeout = 30 } } client WISM5-HA { ipaddr = 172.17.107.105 require_message_authenticator = no secret = <<< secret >>> shortname = "WISM5-HA" nas_type = "cisco" limit { max_connections = 16 lifetime = 0 idle_timeout = 30 } } client WISM6 { ipaddr = 172.17.107.206 require_message_authenticator = no secret = <<< secret >>> shortname = "WISM6" nas_type = "cisco" limit { max_connections = 16 lifetime = 0 idle_timeout = 30 } } client roaming2.ja.net { ipaddr = 194.83.56.249 require_message_authenticator = no secret = <<< secret >>> shortname = "roaming2.ja.net" virtual_server = "eduroamalien" limit { max_connections = 16 lifetime = 0 idle_timeout = 30 } } client WISM3 { ipaddr = 172.17.107.203 require_message_authenticator = no secret = <<< secret >>> shortname = "WISM3" nas_type = "cisco" limit { max_connections = 16 lifetime = 0 idle_timeout = 30 } } client WISM6-HA { ipaddr = 172.17.107.106 require_message_authenticator = no secret = <<< secret >>> shortname = "WISM6-HA" nas_type = "cisco" limit { max_connections = 16 lifetime = 0 idle_timeout = 30 } } client roaming1.ja.net-v6 { ipv6addr = 2001:630:1:12a::233 require_message_authenticator = no secret = <<< secret >>> shortname = "roaming1.ja.net-v6" virtual_server = "eduroamalien" limit { max_connections = 16 lifetime = 0 idle_timeout = 30 } } client monitor { ipaddr = 137.222.7.147 require_message_authenticator = no secret = <<< secret >>> shortname = "monitor" nas_type = "other" limit { max_connections = 16 lifetime = 0 idle_timeout = 30 } } client roaming1.ja.net { ipaddr = 194.83.56.233 require_message_authenticator = no secret = <<< secret >>> shortname = "roaming1.ja.net" virtual_server = "eduroamalien" limit { max_connections = 16 lifetime = 0 idle_timeout = 30 } } client WISM4-HA { ipaddr = 172.17.107.104 require_message_authenticator = no secret = <<< secret >>> shortname = "WISM4-HA" nas_type = "cisco" limit { max_connections = 16 lifetime = 0 idle_timeout = 30 } } client ENGINE-SHED { ipaddr = 172.21.120.253 require_message_authenticator = no secret = <<< secret >>> shortname = "ENGINE-SHED" limit { max_connections = 16 lifetime = 0 idle_timeout = 30 } } client NBHT { ipaddr = 82.33.242.34 require_message_authenticator = no secret = <<< secret >>> shortname = "NBHT" limit { max_connections = 16 lifetime = 0 idle_timeout = 30 } } client roaming0.ja.net { ipaddr = 194.82.174.185 require_message_authenticator = no secret = <<< secret >>> shortname = "roaming0.ja.net" virtual_server = "eduroamalien" limit { max_connections = 16 lifetime = 0 idle_timeout = 30 } } client WISM5 { ipaddr = 172.17.107.205 require_message_authenticator = no secret = <<< secret >>> shortname = "WISM5" nas_type = "cisco" limit { max_connections = 16 lifetime = 0 idle_timeout = 30 } } client BCC110 { ipaddr = 193.35.235.110 require_message_authenticator = no secret = <<< secret >>> shortname = "BCC110" limit { max_connections = 16 lifetime = 0 idle_timeout = 30 } } client WISM1-HA { ipaddr = 172.17.107.101 require_message_authenticator = no secret = <<< secret >>> shortname = "WISM1-HA" nas_type = "cisco" limit { max_connections = 16 lifetime = 0 idle_timeout = 30 } } client testswitch { ipaddr = 172.17.51.30 require_message_authenticator = no secret = <<< secret >>> shortname = "testswitch" nas_type = "cisco" virtual_server = "rainbow" limit { max_connections = 16 lifetime = 0 idle_timeout = 30 } } client UBHT120 { ipaddr = 10.160.155.120 require_message_authenticator = no secret = <<< secret >>> shortname = "UBHT120" limit { max_connections = 16 lifetime = 0 idle_timeout = 30 } } client WISM7-HA { ipaddr = 172.17.107.107 require_message_authenticator = no secret = <<< secret >>> shortname = "WISM7-HA" nas_type = "cisco" limit { max_connections = 16 lifetime = 0 idle_timeout = 30 } } client adminctrl { ipaddr = 172.17.0.0/16 require_message_authenticator = no secret = <<< secret >>> shortname = "adminctrl" nas_type = "cisco" virtual_server = "rainbow" limit { max_connections = 16 lifetime = 0 idle_timeout = 30 } } client monitor-dev { ipaddr = 137.222.8.103 require_message_authenticator = no secret = <<< secret >>> shortname = "monitor-dev" nas_type = "other" limit { max_connections = 16 lifetime = 0 idle_timeout = 30 } } client WISM4 { ipaddr = 172.17.107.204 require_message_authenticator = no secret = <<< secret >>> shortname = "WISM4" nas_type = "cisco" limit { max_connections = 16 lifetime = 0 idle_timeout = 30 } } client UBHT169 { ipaddr = 10.160.156.169 require_message_authenticator = no secret = <<< secret >>> shortname = "UBHT169" limit { max_connections = 16 lifetime = 0 idle_timeout = 30 } } client WISM1 { ipaddr = 172.17.107.201 require_message_authenticator = no secret = <<< secret >>> shortname = "WISM1" nas_type = "cisco" limit { max_connections = 16 lifetime = 0 idle_timeout = 30 } } client TAUNTON-NEW { ipaddr = 109.176.101.162 require_message_authenticator = no secret = <<< secret >>> shortname = "TAUNTON-NEW" limit { max_connections = 16 lifetime = 0 idle_timeout = 30 } } client F5 { ipaddr = 137.222.250.0/24 require_message_authenticator = no secret = <<< secret >>> shortname = "F5" nas_type = "other" limit { max_connections = 16 lifetime = 0 idle_timeout = 30 } } client roaming2.ja.net-v6 { ipv6addr = 2001:630:1:129::249 require_message_authenticator = no secret = <<< secret >>> shortname = "roaming2.ja.net-v6" virtual_server = "eduroamalien" limit { max_connections = 16 lifetime = 0 idle_timeout = 30 } } client WISM3-HA { ipaddr = 172.17.107.103 require_message_authenticator = no secret = <<< secret >>> shortname = "WISM3-HA" nas_type = "cisco" limit { max_connections = 16 lifetime = 0 idle_timeout = 30 } } client WISM9 { ipaddr = 172.17.107.209 require_message_authenticator = no secret = <<< secret >>> shortname = "WISM9" nas_type = "cisco" limit { max_connections = 16 lifetime = 0 idle_timeout = 30 } } client roaming0.ja.net-v6 { ipv6addr = 2001:630:1:128::185 require_message_authenticator = no secret = <<< secret >>> shortname = "roaming0.ja.net-v6" virtual_server = "eduroamalien" limit { max_connections = 16 lifetime = 0 idle_timeout = 30 } } client WISM12 { ipaddr = 172.17.107.212 require_message_authenticator = no secret = <<< secret >>> shortname = "WISM12" nas_type = "cisco" limit { max_connections = 16 lifetime = 0 idle_timeout = 30 } } Debugger not attached thread pool { start_servers = 5 max_servers = 256 min_spare_servers = 3 max_spare_servers = 10 max_requests_per_server = 0 cleanup_delay = 5 max_queue_size = 65536 auto_limit_acct = no } WARNING: Ignoring "max_spare_servers = 10", forcing to "max_spare_servers = 3" listen { type = "control" listen { socket = "/var/run/radiusd/control/radiusd.sock" mode = "rw" peercred = yes } } listen { type = "auth" ipaddr = * port = 1645 recv_buff = 0 } listen { type = "acct" ipaddr = * port = 1646 recv_buff = 0 } listen { type = "auth" ipaddr = * port = 16061 recv_buff = 0 } listen { type = "acct" ipaddr = * port = 16062 recv_buff = 0 } listen { type = "auth" ipaddr = * port = 16063 recv_buff = 0 } listen { type = "acct" ipaddr = * port = 16064 recv_buff = 0 } # Creating Autz-Type = Status-Server # Creating Auth-Type = eduroameap # Creating Auth-Type = eduroamlioneap # Creating Acct-Type = Status-Server listen { type = "auth" ipaddr = * port = 16014 recv_buff = 0 } listen { type = "acct" ipaddr = * port = 16015 recv_buff = 0 } # Creating Auth-Type = PAP # Creating Auth-Type = MS-CHAP # Creating Auth-Type = rainboweap listen { type = "auth" ipaddr = * port = 16018 recv_buff = 0 } # Creating Auth-Type = vpieap listen { type = "auth" ipaddr = * port = 16028 recv_buff = 0 } listen { type = "acct" ipaddr = * port = 16029 recv_buff = 0 } listen { type = "auth" ipaddr = * port = 1812 recv_buff = 0 } listen { type = "auth" ipv6addr = :: port = 1812 recv_buff = 0 } listen { type = "auth" ipaddr = * port = 16020 recv_buff = 0 } listen { type = "acct" ipaddr = * port = 16021 recv_buff = 0 } listen { type = "status" ipaddr = * port = 18120 recv_buff = 0 client localhost { ipaddr = 127.0.0.1 require_message_authenticator = no secret = <<< secret >>> shortname = "localhost" limit { max_connections = 16 lifetime = 0 idle_timeout = 30 } } client monitor-devv6 { ipv6addr = 2001:630:e4:81:137:222:8:103 require_message_authenticator = no secret = <<< secret >>> shortname = "monitor-devv6" limit { max_connections = 16 lifetime = 0 idle_timeout = 30 } } client monitor { ipaddr = 137.222.7.147 require_message_authenticator = no secret = <<< secret >>> shortname = "monitor" limit { max_connections = 16 lifetime = 0 idle_timeout = 30 } } client monitorv6 { ipv6addr = 2001:630:e4:81:137:222:7:147 require_message_authenticator = no secret = <<< secret >>> shortname = "monitorv6" limit { max_connections = 16 lifetime = 0 idle_timeout = 30 } } client monitor-dev { ipaddr = 137.222.8.103 require_message_authenticator = no secret = <<< secret >>> shortname = "monitor-dev" limit { max_connections = 16 lifetime = 0 idle_timeout = 30 } } } /etc/raddb/statusclients.d/localhost.conf[1]: Ignoring unknown sub-section "client" /etc/raddb/statusclients.d/monitor-devv6.conf[1]: Ignoring unknown sub-section "client" /etc/raddb/statusclients.d/monitor.conf[1]: Ignoring unknown sub-section "client" /etc/raddb/statusclients.d/monitorv6.conf[1]: Ignoring unknown sub-section "client" /etc/raddb/statusclients.d/monitor-dev.conf[1]: Ignoring unknown sub-section "client" listen { type = "acct" ipaddr = * port = 16007 recv_buff = 0 } listen { type = "auth" ipaddr = * port = 16006 recv_buff = 0 } # Creating Auth-Type = files-eduroam radiusd: #### Loading modules #### modules { # Loaded module "rlm_detail" # Loading module "auth_log" from file /etc/raddb/mods-enabled/detail.log detail auth_log { filename = "/var/log/radius/radacct/%{%{Packet-Src-IP-Address}:-%{Packet-Src-IPv6-Address}}/auth-detail-%Y%m%d" header = "%t" permissions = 384 locking = no escape_filenames = no log_packet_header = no } # Loading module "reply_log" from file /etc/raddb/mods-enabled/detail.log detail reply_log { filename = "/var/log/radius/radacct/%{%{Packet-Src-IP-Address}:-%{Packet-Src-IPv6-Address}}/reply-detail-%Y%m%d" header = "%t" permissions = 384 locking = no escape_filenames = no log_packet_header = no } # Loading module "pre_proxy_log" from file /etc/raddb/mods-enabled/detail.log detail pre_proxy_log { filename = "/var/log/radius/radacct/%{%{Packet-Src-IP-Address}:-%{Packet-Src-IPv6-Address}}/pre-proxy-detail-%Y%m%d" header = "%t" permissions = 384 locking = no escape_filenames = no log_packet_header = no } # Loading module "post_proxy_log" from file /etc/raddb/mods-enabled/detail.log detail post_proxy_log { filename = "/var/log/radius/radacct/%{%{Packet-Src-IP-Address}:-%{Packet-Src-IPv6-Address}}/post-proxy-detail-%Y%m%d" header = "%t" permissions = 384 locking = no escape_filenames = no log_packet_header = no } # Loaded module "rlm_preprocess" # Loading module "rainbowpreprocess" from file /etc/raddb/mods-enabled/rainbowpreprocess preprocess rainbowpreprocess { with_ascend_hack = no ascend_channels_per_line = 23 with_ntdomain_hack = no with_specialix_jetstream_hack = no with_cisco_vsa_hack = yes with_alvarion_vsa_hack = no } # Loading module "uob_detail" from file /etc/raddb/mods-enabled/uobdetail detail uob_detail { filename = "/var/log/radius/radacct/%{%{Virtual-Server}:-UNKNOWN}/detail.log" header = "%t" permissions = 416 locking = no escape_filenames = no log_packet_header = no } # Loading module "uob_auth_log" from file /etc/raddb/mods-enabled/uobdetail detail uob_auth_log { filename = "/var/log/radius/radacct/%{%{Virtual-Server}:-UNKNOWN}/auth-detail.log" header = "%t" permissions = 384 locking = no escape_filenames = no log_packet_header = yes } # Loading module "uob_auth_log_password" from file /etc/raddb/mods-enabled/uobdetail detail uob_auth_log_password { filename = "/var/log/radius/radacct/%{%{Virtual-Server}:-UNKNOWN}/auth-detail.log" header = "%t" permissions = 384 locking = no escape_filenames = no log_packet_header = no } # Loading module "uob_reply_log" from file /etc/raddb/mods-enabled/uobdetail detail uob_reply_log { filename = "/var/log/radius/radacct/%{%{Virtual-Server}:-UNKNOWN}/reply-detail.log" header = "%t" permissions = 384 locking = no escape_filenames = no log_packet_header = no } # Loading module "uob_pre_proxy_log" from file /etc/raddb/mods-enabled/uobdetail detail uob_pre_proxy_log { filename = "/var/log/radius/radacct/%{%{Virtual-Server}:-DEFAULT}/pre-proxy-detail.log" header = "%t" permissions = 384 locking = no escape_filenames = no log_packet_header = no } # Loading module "uob_post_proxy_log" from file /etc/raddb/mods-enabled/uobdetail detail uob_post_proxy_log { filename = "/var/log/radius/radacct/%{%{Virtual-Server}:-DEFAULT}/post-proxy-detail.log" header = "%t" permissions = 384 locking = no escape_filenames = no log_packet_header = no } # Loaded module "rlm_mschap" # Loading module "rainbowmschap" from file /etc/raddb/mods-enabled/rainbowmschap mschap rainbowmschap { use_mppe = yes require_encryption = no require_strong = no with_ntdomain_hack = yes ntlm_auth = "/usr/bin/ntlm_auth --request-nt-key --username=%{%{Stripped-User-Name}:-%{rainbowmschap:User-Name}} --challenge=%{%{rainbowmschap:Challenge}:-00} --nt-response=%{%{rainbowmschap:NT-Response}:-00}" passchange { } allow_retry = yes } # Loading module "rainbowmachinemschap" from file /etc/raddb/mods-enabled/rainbowmschap mschap rainbowmachinemschap { use_mppe = yes require_encryption = no require_strong = no with_ntdomain_hack = yes ntlm_auth = "/usr/bin/ntlm_auth --request-nt-key --username=%{%{Stripped-User-Name}:-%{rainbowmschap:User-Name}} --challenge=%{%{rainbowmschap:Challenge}:-00} --nt-response=%{%{rainbowmschap:NT-Response}:-00} --require-membership-of=S-1-5-21-1117850145-1682116191-196506527-515" passchange { } allow_retry = yes } # Loading module "mschap" from file /etc/raddb/mods-enabled/mschap mschap { use_mppe = yes require_encryption = no require_strong = no with_ntdomain_hack = yes passchange { } allow_retry = yes } # Loaded module "rlm_files" # Loading module "files-eduroam" from file /etc/raddb/mods-enabled/files-eduroam files files-eduroam { usersfile = "/etc/raddb/users.d/users-eduroam" } # Loaded module "rlm_linelog" # Loading module "linelog" from file /etc/raddb/mods-enabled/linelog linelog { destination = "file" delimiter = " " file { filename = "/var/log/radius/linelog" permissions = 384 escape_filenames = no } syslog { severity = "info" } unix { } tcp { port = 514 timeout = 2.000000 } udp { port = 514 timeout = 2.000000 } } # Loading module "log_accounting" from file /etc/raddb/mods-enabled/linelog linelog log_accounting { destination = "file" delimiter = " " file { filename = "/var/log/radius/linelog-accounting" permissions = 384 escape_filenames = no } syslog { severity = "info" } unix { } tcp { timeout = 1000.000000 } udp { timeout = 1000.000000 } } # Loading module "vpimschap" from file /etc/raddb/mods-enabled/vpimschap mschap vpimschap { use_mppe = yes require_encryption = no require_strong = no with_ntdomain_hack = yes ntlm_auth = "/usr/bin/ntlm_auth --request-nt-key --username=%{%{Stripped-User-Name}:-%{vpimschap:User-Name}} --challenge=%{vpimschap:Challenge} --nt-response=%{vpimschap:NT-Response} --require-membership-of=S-1-5-21-1117850145-1682116191-196506527-149178" passchange { } allow_retry = yes } # Loading module "rainbowlogsyslog" from file /etc/raddb/mods-enabled/rainbowlog linelog rainbowlogsyslog { destination = "syslog" delimiter = " " file { permissions = 384 escape_filenames = no } syslog { facility = "local5" severity = "info" } unix { } tcp { timeout = 1000.000000 } udp { timeout = 1000.000000 } } # Loading module "rainbowlogfiles" from file /etc/raddb/mods-enabled/rainbowlog linelog rainbowlogfiles { destination = "file" delimiter = " " file { filename = "/var/log/radius/radiusd-%{%{Virtual-Server}:-DEFAULT}.log" permissions = 384 escape_filenames = no } syslog { severity = "info" } unix { } tcp { timeout = 1000.000000 } udp { timeout = 1000.000000 } } # Loading module "rainbowacclog" from file /etc/raddb/mods-enabled/rainbowlog linelog rainbowacclog { destination = "syslog" delimiter = " " file { permissions = 384 escape_filenames = no } syslog { facility = "local5" severity = "info" } unix { } tcp { timeout = 1000.000000 } udp { timeout = 1000.000000 } } # Loaded module "rlm_replicate" # Loading module "replicate" from file /etc/raddb/mods-enabled/replicate # Loading module "files" from file /etc/raddb/mods-enabled/files files { filename = "/etc/raddb/mods-config/files/authorize" acctusersfile = "/etc/raddb/mods-config/files/accounting" preproxy_usersfile = "/etc/raddb/mods-config/files/pre-proxy" } # Loaded module "rlm_eap" # Loading module "eduroameap" from file /etc/raddb/mods-enabled/eduroameap eap eduroameap { default_eap_type = "peap" ignore_unknown_eap_types = no cisco_accounting_username_bug = no } # Linked to sub-module rlm_eap_tls tls { tls = "tls-common" require_client_cert = yes } tls-config tls-common { verify_depth = 0 ca_path = "/etc/raddb/certs" pem_file_type = yes private_key_file = "/etc/raddb/certs/eduroam.wireless.bris.ac.uk.key" certificate_file = "/etc/raddb/certs/eduroam.wireless.bris.ac.uk-cert.pem" ca_file = "/etc/raddb/certs/uob-net-ca.pem" dh_file = "/etc/raddb/certs/dh" fragment_size = 1024 include_length = yes auto_chain = yes check_crl = no check_all_crl = no cipher_list = "DEFAULT:!ADH:!SSLv2" ecdh_curve = "prime256v1" cache { } verify { } ocsp { enable = no override_cert_url = yes url = "http://127.0.0.1/ocsp/" use_nonce = yes timeout = 0 softfail = no } } # Linked to sub-module rlm_eap_ttls ttls { tls = "tls-common" default_eap_type = "mschapv2" copy_request_to_tunnel = yes use_tunneled_reply = yes virtual_server = "eduroam-inner" include_length = yes require_client_cert = no } tls - Using cached TLS configuration from previous invocation # Linked to sub-module rlm_eap_peap peap { tls = "tls-common" default_eap_type = "mschapv2" copy_request_to_tunnel = yes use_tunneled_reply = yes proxy_tunneled_request_as_eap = yes virtual_server = "eduroam-inner" soh = no require_client_cert = no } tls - Using cached TLS configuration from previous invocation rlm_eap_peap - Failed to find 'Auth-Type eap' section in virtual server eduroam-inner. The server cannot proxy inner-tunnel EAP packets. # Linked to sub-module rlm_eap_mschapv2 mschapv2 { with_ntdomain_hack = no send_error = no } # Loaded module "rlm_chap" # Loading module "chap" from file /etc/raddb/mods-enabled/chap # Loaded module "rlm_exec" # Loading module "exec" from file /etc/raddb/mods-enabled/exec exec { wait = no input_pairs = "request" shell_escape = yes timeout = 10 } # Loaded module "rlm_realm" # Loading module "IPASS" from file /etc/raddb/mods-enabled/realm realm IPASS { format = "prefix" delimiter = "/" ignore_default = no ignore_null = no } # Loading module "suffix" from file /etc/raddb/mods-enabled/realm realm suffix { format = "suffix" delimiter = "@" ignore_default = no ignore_null = no } # Loading module "realmpercent" from file /etc/raddb/mods-enabled/realm realm realmpercent { format = "suffix" delimiter = "%" ignore_default = no ignore_null = no } # Loading module "ntdomain" from file /etc/raddb/mods-enabled/realm realm ntdomain { format = "prefix" delimiter = "\\" ignore_default = no ignore_null = no } # Loaded module "rlm_dynamic_clients" # Loading module "dynamic_clients" from file /etc/raddb/mods-enabled/dynamic_clients # Loaded module "rlm_digest" # Loading module "digest" from file /etc/raddb/mods-enabled/digest # Loaded module "rlm_expr" # Loading module "expr" from file /etc/raddb/mods-enabled/expr expr { safe_characters = "@abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ0123456789.-_: /äéöüàâæçèéêëîïôœùûüaÿÄÉÖÜßÀÂÆÇÈÉÊËÎÏÔŒÙÛÜŸ" } # Loaded module "rlm_radutmp" # Loading module "sradutmp" from file /etc/raddb/mods-enabled/sradutmp radutmp sradutmp { filename = "/var/log/radius/sradutmp" username = "%{User-Name}" case_sensitive = yes check_with_nas = yes permissions = 420 caller_id = no } # Loaded module "rlm_cache" # Loading module "eduroamvlan" from file /etc/raddb/mods-enabled/eduroamvlan cache eduroamvlan { driver = "rlm_cache_rbtree" ttl = 600 max_entries = 0 epoch = 0 add_stats = no } # Loaded module "rlm_dhcp" # Loading module "dhcp" from file /etc/raddb/mods-enabled/dhcp # Loaded module "rlm_ldap" # Loading module "uobldap" from file /etc/raddb/mods-enabled/uobldap ldap uobldap { server = "cse-lox.ads.bris.ac.uk" port = 636 identity = "CN=iser-linauth,OU=ISER - Special Purpose Accounts,OU=ISER,DC=ads,DC=bris,DC=ac,DC=uk" password = <<< secret >>> sasl { } user { scope = "sub" access_positive = yes sasl { } } group { filter = "(objectClass=posixGroup)" scope = "sub" name_attribute = "cn" membership_attribute = "memberOf" cacheable_name = no cacheable_dn = no } client { filter = "(objectClass=radiusClient)" scope = "sub" base_dn = "DC=ads,DC=bris,DC=ac,DC=uk" } profile { } options { ldap_debug = 40 chase_referrals = yes use_referral_credentials = no rebind = yes session_tracking = no res_timeout = 10 srv_timelimit = 3 idle = 60 probes = 3 interval = 3 } tls { start_tls = no require_cert = "allow" } } Creating attribute uobldap-LDAP-Group # Loaded module "rlm_sql" # Loading module "uobsql-write" from file /etc/raddb/mods-enabled/uobsql-write sql uobsql-write { driver = "rlm_sql_mysql" server = "db-write.nomadic-core.bris.ac.uk" port = 3306 login = "radiusd" password = <<< secret >>> radius_db = "radius" read_groups = yes read_profiles = yes read_clients = no delete_stale_sessions = yes sql_user_name = "%{%{Stripped-User-Name}:-%{User-Name}}" group_attribute = "uobsql-write-sql-Group" default_user_profile = "" client_query = "SELECT id, nasname, shortname, type, secret, server FROM nas" authorize_check_query = "SELECT id, username, attribute, value, op FROM radcheck WHERE username = '%{SQL-User-Name}' ORDER BY id" authorize_reply_query = "SELECT id, username, attribute, value, op FROM radreply WHERE username = '%{SQL-User-Name}' ORDER BY id" authorize_group_check_query = "SELECT id, groupname, attribute, Value, op FROM radgroupcheck WHERE groupname = '%{uobsql-write-sql-Group}' ORDER BY id" authorize_group_reply_query = "SELECT id, groupname, attribute, value, op FROM radgroupreply WHERE groupname = '%{uobsql-write-sql-Group}' ORDER BY id" group_membership_query = "SELECT groupname FROM radusergroup WHERE username = '%{SQL-User-Name}' ORDER BY priority" simul_verify_query = "SELECT radacctid, acctsessionid, username, nasipaddress, nasportid, framedipaddress, callingstationid, framedprotocol FROM radacct WHERE username = '%{SQL-User-Name}' AND acctstoptime IS NULL" safe_characters = "@abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ0123456789.-_: /" accounting { reference = "%{tolower:type.%{Acct-Status-Type}.query}" type { accounting-on { query = "UPDATE radacct SET acctstoptime = '%S', acctsessiontime = '%{integer:Event-Timestamp}' - UNIX_TIMESTAMP(acctstarttime), acctterminatecause = '%{%{Acct-Terminate-Cause}:-NAS-Reboot}' WHERE acctstoptime IS NULL AND nasipaddress = '%{NAS-IP-Address}' AND acctstarttime <= '%S'" } accounting-off { query = "UPDATE radacct SET acctstoptime = '%S', acctsessiontime = '%{integer:Event-Timestamp}' - UNIX_TIMESTAMP(acctstarttime), acctterminatecause = '%{%{Acct-Terminate-Cause}:-NAS-Reboot}' WHERE acctstoptime IS NULL AND nasipaddress = '%{NAS-IP-Address}' AND acctstarttime <= '%S'" } start { query = "INSERT INTO radacct (acctsessionid, acctuniqueid, username, realm, nasipaddress, nasportid, nasporttype, acctstarttime, acctupdatetime, acctstoptime, acctsessiontime, acctauthentic, connectinfo_start, connectinfo_stop, acctinputoctets, acctoutputoctets, calledstationid, callingstationid, acctterminatecause, servicetype, framedprotocol, framedipaddress, virtual_server, radius_server, vlan, strippedusername) VALUES ('%{Acct-Session-Id}', '%{Acct-Unique-Session-Id}', '%{SQL-User-Name}', '%{Realm}', '%{NAS-IP-Address}', '%{%{NAS-Port-ID}:-%{NAS-Port}}', '%{NAS-Port-Type}', '%S', '%S', NULL, '0', '%{Acct-Authentic}', '%{Connect-Info}', '', '0', '0', '%{Called-Station-Id}', '%{Calling-Station-Id}', '', '%{Service-Type}', '%{Framed-Protocol}', '%{Framed-IP-Address}', '%{Virtual-Server}', '%{Packet-Dst-IP-Address}', '%{Tunnel-Private-Group-Id}', SUBSTRING_INDEX('%{SQL-User-Name}', '@', 1))" query = "UPDATE radacct SET acctstarttime = '%S', acctupdatetime = '%S', connectinfo_start = '%{Connect-Info}' WHERE AcctUniqueId = '%{Acct-Unique-Session-Id}'" } interim-update { query = "UPDATE radacct SET acctupdatetime = (@acctupdatetime_old:=acctupdatetime), acctupdatetime = '%S', acctinterval = %{integer:Event-Timestamp} - UNIX_TIMESTAMP(@acctupdatetime_old), framedipaddress = '%{Framed-IP-Address}', acctsessiontime = %{%{Acct-Session-Time}:-NULL}, acctinputoctets = '%{%{Acct-Input-Gigawords}:-0}' << 32 | '%{%{Acct-Input-Octets}:-0}', acctoutputoctets = '%{%{Acct-Output-Gigawords}:-0}' << 32 | '%{%{Acct-Output-Octets}:-0}' WHERE AcctUniqueId = '%{Acct-Unique-Session-Id}'" query = "INSERT INTO radacct (acctsessionid, acctuniqueid, username, realm, nasipaddress, nasportid, nasporttype, acctstarttime, acctupdatetime, acctstoptime, acctsessiontime, acctauthentic, connectinfo_start, connectinfo_stop, acctinputoctets, acctoutputoctets, calledstationid, callingstationid, acctterminatecause, servicetype, framedprotocol, framedipaddress, virtual_server, radius_server, vlan, strippedusername) VALUES ('%{Acct-Session-Id}', '%{Acct-Unique-Session-Id}', '%{SQL-User-Name}', '%{Realm}', '%{NAS-IP-Address}', '%{%{NAS-Port-ID}:-%{NAS-Port}}', '%{NAS-Port-Type}', FROM_UNIXTIME(%{integer:Event-Timestamp} - %{%{Acct-Session-Time}:-0}), '%S', NULL, %{%{Acct-Session-Time}:-NULL}, '%{Acct-Authentic}', '%{Connect-Info}', '', '%{%{Acct-Input-Gigawords}:-0}' << 32 | '%{%{Acct-Input-Octets}:-0}', '%{%{Acct-Output-Gigawords}:-0}' << 32 | '%{%{Acct-Output-Octets}:-0}', '%{Called-Station-Id}', '%{Calling-Station-Id}', '', '%{Service-Type}', '%{Framed-Protocol}', '%{Framed-IP-Address}', '%{Virtual-Server}', '%{Packet-Dst-IP-Address}', '%{Tunnel-Private-Group-Id}', SUBSTRING_INDEX('%{SQL-User-Name}', '@', 1))" } stop { query = "UPDATE radacct SET acctstoptime = '%S', acctsessiontime = %{%{Acct-Session-Time}:-NULL}, acctinputoctets = '%{%{Acct-Input-Gigawords}:-0}' << 32 | '%{%{Acct-Input-Octets}:-0}', acctoutputoctets = '%{%{Acct-Output-Gigawords}:-0}' << 32 | '%{%{Acct-Output-Octets}:-0}', acctterminatecause = '%{Acct-Terminate-Cause}', connectinfo_stop = '%{Connect-Info}' WHERE AcctUniqueId = '%{Acct-Unique-Session-Id}'" query = "INSERT INTO radacct (acctsessionid, acctuniqueid, username, realm, nasipaddress, nasportid, nasporttype, acctstarttime, acctupdatetime, acctstoptime, acctsessiontime, acctauthentic, connectinfo_start, connectinfo_stop, acctinputoctets, acctoutputoctets, calledstationid, callingstationid, acctterminatecause, servicetype, framedprotocol, framedipaddress, virtual_server, radius_server, vlan, strippedusername) VALUES ('%{Acct-Session-Id}', '%{Acct-Unique-Session-Id}', '%{SQL-User-Name}', '%{Realm}', '%{NAS-IP-Address}', '%{%{NAS-Port-ID}:-%{NAS-Port}}', '%{NAS-Port-Type}', FROM_UNIXTIME(%{integer:Event-Timestamp} - %{%{Acct-Session-Time}:-0}), '%S', '%S', %{%{Acct-Session-Time}:-NULL}, '%{Acct-Authentic}', '', '%{Connect-Info}', '%{%{Acct-Input-Gigawords}:-0}' << 32 | '%{%{Acct-Input-Octets}:-0}', '%{%{Acct-Output-Gigawords}:-0}' << 32 | '%{%{Acct-Output-Octets}:-0}', '%{Called-Station-Id}', '%{Calling-Station-Id}', '%{Acct-Terminate-Cause}', '%{Service-Type}', '%{Framed-Protocol}', '%{Framed-IP-Address}', '%{Virtual-Server}', '%{Packet-Dst-IP-Address}', '%{Tunnel-Private-Group-Id}', SUBSTRING_INDEX('%{SQL-User-Name}', '@', 1))" } } } post-auth { reference = ".query" query = "INSERT INTO radpostauth (username, pass, reply, authdate) VALUES ( '%{SQL-User-Name}', '%{%{User-Password}:-%{Chap-Password}}', '%{reply:Packet-Type}', '%S')" } } rlm_sql (uobsql-write) - Driver rlm_sql_mysql (module rlm_sql_mysql) loaded and linked Creating attribute uobsql-write-sql-Group # Loaded module "rlm_expiration" # Loading module "expiration" from file /etc/raddb/mods-enabled/expiration # Loading module "eduroamlioneap" from file /etc/raddb/mods-enabled/eduroamlioneap eap eduroamlioneap { default_eap_type = "peap" ignore_unknown_eap_types = no cisco_accounting_username_bug = no } # Linked to sub-module rlm_eap_tls tls { tls = "tls-common" require_client_cert = yes } tls-config tls-common { verify_depth = 0 ca_path = "/etc/raddb/certs" pem_file_type = yes private_key_file = "/etc/raddb/certs/eduroam.wireless.bris.ac.uk.key" certificate_file = "/etc/raddb/certs/eduroam.wireless.bris.ac.uk-cert.pem" ca_file = "/etc/raddb/certs/uob-net-ca.pem" dh_file = "/etc/raddb/certs/dh" fragment_size = 1024 include_length = yes auto_chain = yes check_crl = no check_all_crl = no cipher_list = "DEFAULT:!ADH:!SSLv2" ecdh_curve = "prime256v1" cache { } verify { } ocsp { enable = no override_cert_url = yes url = "http://127.0.0.1/ocsp/" use_nonce = yes timeout = 0 softfail = no } } # Linked to sub-module rlm_eap_ttls ttls { tls = "tls-common" default_eap_type = "mschapv2" copy_request_to_tunnel = yes use_tunneled_reply = yes virtual_server = "eduroamlion-inner" include_length = yes require_client_cert = no } tls - Using cached TLS configuration from previous invocation # Linked to sub-module rlm_eap_peap peap { tls = "tls-common" default_eap_type = "mschapv2" copy_request_to_tunnel = yes use_tunneled_reply = yes proxy_tunneled_request_as_eap = yes virtual_server = "eduroamlion-inner" soh = no require_client_cert = no } tls - Using cached TLS configuration from previous invocation rlm_eap_peap - Failed to find 'Auth-Type eap' section in virtual server eduroamlion-inner. The server cannot proxy inner-tunnel EAP packets. # Linked to sub-module rlm_eap_mschapv2 mschapv2 { with_ntdomain_hack = no send_error = no } # Loading module "logtofile" from file /etc/raddb/mods-enabled/logtofile linelog logtofile { destination = "file" delimiter = " " file { filename = "/var/log/radius/radiusd-%{%{Virtual-Server}:-DEFAULT}.log" permissions = 384 escape_filenames = no } syslog { severity = "info" } unix { } tcp { timeout = 1000.000000 } udp { timeout = 1000.000000 } } # Loaded module "rlm_always" # Loading module "reject" from file /etc/raddb/mods-enabled/always always reject { rcode = "reject" simulcount = 0 mpp = no } # Loading module "fail" from file /etc/raddb/mods-enabled/always always fail { rcode = "fail" simulcount = 0 mpp = no } # Loading module "ok" from file /etc/raddb/mods-enabled/always always ok { rcode = "ok" simulcount = 0 mpp = no } # Loading module "handled" from file /etc/raddb/mods-enabled/always always handled { rcode = "handled" simulcount = 0 mpp = no } # Loading module "invalid" from file /etc/raddb/mods-enabled/always always invalid { rcode = "invalid" simulcount = 0 mpp = no } # Loading module "userlock" from file /etc/raddb/mods-enabled/always always userlock { rcode = "userlock" simulcount = 0 mpp = no } # Loading module "notfound" from file /etc/raddb/mods-enabled/always always notfound { rcode = "notfound" simulcount = 0 mpp = no } # Loading module "noop" from file /etc/raddb/mods-enabled/always always noop { rcode = "noop" simulcount = 0 mpp = no } # Loading module "updated" from file /etc/raddb/mods-enabled/always always updated { rcode = "updated" simulcount = 0 mpp = no } # Loading module "ntlm_auth" from file /etc/raddb/mods-enabled/ntlm_auth exec ntlm_auth { wait = yes program = "/path/to/ntlm_auth --request-nt-key --domain=MYDOMAIN --username=%{mschap:User-Name} --password=%{User-Password}" shell_escape = yes } # Loading module "rainbowfiles" from file /etc/raddb/mods-enabled/rainbowfiles files rainbowfiles { usersfile = "/etc/raddb/users.d/users-rainbow" } # Loading module "logtosyslog" from file /etc/raddb/mods-enabled/logtosyslog linelog logtosyslog { destination = "syslog" delimiter = " " file { permissions = 384 escape_filenames = no } syslog { facility = "local5" severity = "info" } unix { } tcp { timeout = 1000.000000 } udp { timeout = 1000.000000 } } # Loaded module "rlm_attr_filter" # Loading module "attr_filter.post-proxy" from file /etc/raddb/mods-enabled/attr_filter attr_filter attr_filter.post-proxy { filename = "/etc/raddb/mods-config/attr_filter/post-proxy" relaxed = no } # Loading module "attr_filter.pre-proxy" from file /etc/raddb/mods-enabled/attr_filter attr_filter attr_filter.pre-proxy { filename = "/etc/raddb/mods-config/attr_filter/pre-proxy" relaxed = no } # Loading module "attr_filter.access_reject" from file /etc/raddb/mods-enabled/attr_filter attr_filter attr_filter.access_reject { filename = "/etc/raddb/mods-config/attr_filter/access_reject" relaxed = no } # Loading module "attr_filter.access_challenge" from file /etc/raddb/mods-enabled/attr_filter attr_filter attr_filter.access_challenge { filename = "/etc/raddb/mods-config/attr_filter/access_challenge" relaxed = no } # Loading module "attr_filter.accounting_response" from file /etc/raddb/mods-enabled/attr_filter attr_filter attr_filter.accounting_response { filename = "/etc/raddb/mods-config/attr_filter/accounting_response" relaxed = no } # Loading module "filter.attrs.accounting_response" from file /etc/raddb/mods-enabled/attr_filter attr_filter filter.attrs.accounting_response { filename = "/etc/raddb/mods-config/attr_filter/attrs.accounting_response" relaxed = no } # Loading module "filter.bristolresearchnet-a_reject" from file /etc/raddb/mods-enabled/attr_filter attr_filter filter.bristolresearchnet-a_reject { filename = "/etc/raddb/mods-config/attr_filter/bristolresearchnet-a_reject" relaxed = no } # Loading module "filter.eduroamalien-a_accept" from file /etc/raddb/mods-enabled/attr_filter attr_filter filter.eduroamalien-a_accept { filename = "/etc/raddb/mods-config/attr_filter/eduroamalien-a_accept" relaxed = no } # Loading module "filter.eduroamalien-a_challenge" from file /etc/raddb/mods-enabled/attr_filter attr_filter filter.eduroamalien-a_challenge { filename = "/etc/raddb/mods-config/attr_filter/eduroamalien-a_challenge" relaxed = no } # Loading module "filter.eduroamalien-a_reject" from file /etc/raddb/mods-enabled/attr_filter attr_filter filter.eduroamalien-a_reject { filename = "/etc/raddb/mods-config/attr_filter/eduroamalien-a_reject" relaxed = no } # Loading module "filter.eduroamlocal-a_accept" from file /etc/raddb/mods-enabled/attr_filter attr_filter filter.eduroamlocal-a_accept { filename = "/etc/raddb/mods-config/attr_filter/eduroamlocal-a_accept" relaxed = no } # Loading module "filter.eduroamlocal-a_challenge" from file /etc/raddb/mods-enabled/attr_filter attr_filter filter.eduroamlocal-a_challenge { filename = "/etc/raddb/mods-config/attr_filter/eduroamlocal-a_challenge" relaxed = no } # Loading module "filter.eduroamlocal-a_reject" from file /etc/raddb/mods-enabled/attr_filter attr_filter filter.eduroamlocal-a_reject { filename = "/etc/raddb/mods-config/attr_filter/eduroamlocal-a_reject" relaxed = no } # Loading module "filter.eduroamlocal-post_proxy" from file /etc/raddb/mods-enabled/attr_filter attr_filter filter.eduroamlocal-post_proxy { filename = "/etc/raddb/mods-config/attr_filter/eduroamlocal-post_proxy" relaxed = no } # Loading module "filter.eduroamlocal-pre_proxy" from file /etc/raddb/mods-enabled/attr_filter attr_filter filter.eduroamlocal-pre_proxy { filename = "/etc/raddb/mods-config/attr_filter/eduroamlocal-pre_proxy" relaxed = no } # Loading module "filter.vpi-a_accept" from file /etc/raddb/mods-enabled/attr_filter attr_filter filter.vpi-a_accept { filename = "/etc/raddb/mods-config/attr_filter/vpi-a_accept" relaxed = no } # Loading module "filter.vpi-a_challenge" from file /etc/raddb/mods-enabled/attr_filter attr_filter filter.vpi-a_challenge { filename = "/etc/raddb/mods-config/attr_filter/vpi-a_challenge" relaxed = no } # Loading module "filter.vpi-a_reject" from file /etc/raddb/mods-enabled/attr_filter attr_filter filter.vpi-a_reject { filename = "/etc/raddb/mods-config/attr_filter/vpi-a_reject" relaxed = no } # Loaded module "rlm_utf8" # Loading module "utf8" from file /etc/raddb/mods-enabled/utf8 # Loading module "radutmp" from file /etc/raddb/mods-enabled/radutmp radutmp { filename = "/var/log/radius/radutmp" username = "%{User-Name}" case_sensitive = yes check_with_nas = yes permissions = 384 caller_id = yes } # Loaded module "rlm_passwd" # Loading module "etc_passwd" from file /etc/raddb/mods-enabled/passwd passwd etc_passwd { filename = "/etc/passwd" format = "*User-Name:Crypt-Password:" delimiter = ":" ignore_nislike = no ignore_empty = yes allow_multiple_keys = no hash_size = 100 } # Loaded module "rlm_soh" # Loading module "soh" from file /etc/raddb/mods-enabled/soh soh { dhcp = yes } # Loaded module "rlm_unix" # Loading module "unix" from file /etc/raddb/mods-enabled/unix unix { radwtmp = "/var/log/radius/radwtmp" } Creating attribute Unix-Group # Loading module "cache_eap" from file /etc/raddb/mods-enabled/cache_eap cache cache_eap { driver = "rlm_cache_rbtree" ttl = 15 max_entries = 0 epoch = 0 add_stats = no } # Loading module "eduroammschap" from file /etc/raddb/mods-enabled/eduroammschap mschap eduroammschap { use_mppe = yes require_encryption = no require_strong = no with_ntdomain_hack = yes passchange { } allow_retry = no retry_msg = "Verify username and re-enter your password" } # Loading module "uobsql" from file /etc/raddb/mods-enabled/uobsql sql uobsql { driver = "rlm_sql_mysql" server = "db.nomadic-core.bris.ac.uk" port = 3306 login = "radiusd" password = <<< secret >>> radius_db = "radius" read_groups = yes read_profiles = yes read_clients = no delete_stale_sessions = yes sql_user_name = "%{%{Stripped-User-Name}:-%{User-Name}}" group_attribute = "uobsql-sql-Group" default_user_profile = "" client_query = "SELECT id, nasname, shortname, type, secret, server FROM nas" authorize_check_query = "SELECT id, username, attribute, value, op FROM radcheck WHERE username = '%{SQL-User-Name}' ORDER BY id" authorize_reply_query = "SELECT id, username, attribute, value, op FROM radreply WHERE username = '%{SQL-User-Name}' ORDER BY id" authorize_group_check_query = "SELECT id, groupname, attribute, Value, op FROM radgroupcheck WHERE groupname = '%{uobsql-sql-Group}' ORDER BY id" authorize_group_reply_query = "SELECT id, groupname, attribute, value, op FROM radgroupreply WHERE groupname = '%{uobsql-sql-Group}' ORDER BY id" group_membership_query = "SELECT groupname FROM radusergroup WHERE username = '%{SQL-User-Name}' ORDER BY priority" simul_verify_query = "SELECT radacctid, acctsessionid, username, nasipaddress, nasportid, framedipaddress, callingstationid, framedprotocol FROM radacct WHERE username = '%{SQL-User-Name}' AND acctstoptime IS NULL" safe_characters = "@abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ0123456789.-_: /" accounting { reference = "%{tolower:type.%{Acct-Status-Type}.query}" type { accounting-on { query = "UPDATE radacct SET acctstoptime = '%S', acctsessiontime = '%{integer:Event-Timestamp}' - UNIX_TIMESTAMP(acctstarttime), acctterminatecause = '%{%{Acct-Terminate-Cause}:-NAS-Reboot}' WHERE acctstoptime IS NULL AND nasipaddress = '%{NAS-IP-Address}' AND acctstarttime <= '%S'" } accounting-off { query = "UPDATE radacct SET acctstoptime = '%S', acctsessiontime = '%{integer:Event-Timestamp}' - UNIX_TIMESTAMP(acctstarttime), acctterminatecause = '%{%{Acct-Terminate-Cause}:-NAS-Reboot}' WHERE acctstoptime IS NULL AND nasipaddress = '%{NAS-IP-Address}' AND acctstarttime <= '%S'" } start { query = "INSERT INTO radacct (acctsessionid, acctuniqueid, username, realm, nasipaddress, nasportid, nasporttype, acctstarttime, acctupdatetime, acctstoptime, acctsessiontime, acctauthentic, connectinfo_start, connectinfo_stop, acctinputoctets, acctoutputoctets, calledstationid, callingstationid, acctterminatecause, servicetype, framedprotocol, framedipaddress, virtual_server, radius_server, vlan, strippedusername) VALUES ('%{Acct-Session-Id}', '%{Acct-Unique-Session-Id}', '%{SQL-User-Name}', '%{Realm}', '%{NAS-IP-Address}', '%{%{NAS-Port-ID}:-%{NAS-Port}}', '%{NAS-Port-Type}', '%S', '%S', NULL, '0', '%{Acct-Authentic}', '%{Connect-Info}', '', '0', '0', '%{Called-Station-Id}', '%{Calling-Station-Id}', '', '%{Service-Type}', '%{Framed-Protocol}', '%{Framed-IP-Address}', '%{Virtual-Server}', '%{Packet-Dst-IP-Address}', '%{Tunnel-Private-Group-Id}', SUBSTRING_INDEX('%{SQL-User-Name}', '@', 1))" query = "UPDATE radacct SET acctstarttime = '%S', acctupdatetime = '%S', connectinfo_start = '%{Connect-Info}' WHERE AcctUniqueId = '%{Acct-Unique-Session-Id}'" } interim-update { query = "UPDATE radacct SET acctupdatetime = (@acctupdatetime_old:=acctupdatetime), acctupdatetime = '%S', acctinterval = %{integer:Event-Timestamp} - UNIX_TIMESTAMP(@acctupdatetime_old), framedipaddress = '%{Framed-IP-Address}', acctsessiontime = %{%{Acct-Session-Time}:-NULL}, acctinputoctets = '%{%{Acct-Input-Gigawords}:-0}' << 32 | '%{%{Acct-Input-Octets}:-0}', acctoutputoctets = '%{%{Acct-Output-Gigawords}:-0}' << 32 | '%{%{Acct-Output-Octets}:-0}' WHERE AcctUniqueId = '%{Acct-Unique-Session-Id}'" query = "INSERT INTO radacct (acctsessionid, acctuniqueid, username, realm, nasipaddress, nasportid, nasporttype, acctstarttime, acctupdatetime, acctstoptime, acctsessiontime, acctauthentic, connectinfo_start, connectinfo_stop, acctinputoctets, acctoutputoctets, calledstationid, callingstationid, acctterminatecause, servicetype, framedprotocol, framedipaddress, virtual_server, radius_server, vlan, strippedusername) VALUES ('%{Acct-Session-Id}', '%{Acct-Unique-Session-Id}', '%{SQL-User-Name}', '%{Realm}', '%{NAS-IP-Address}', '%{%{NAS-Port-ID}:-%{NAS-Port}}', '%{NAS-Port-Type}', FROM_UNIXTIME(%{integer:Event-Timestamp} - %{%{Acct-Session-Time}:-0}), '%S', NULL, %{%{Acct-Session-Time}:-NULL}, '%{Acct-Authentic}', '%{Connect-Info}', '', '%{%{Acct-Input-Gigawords}:-0}' << 32 | '%{%{Acct-Input-Octets}:-0}', '%{%{Acct-Output-Gigawords}:-0}' << 32 | '%{%{Acct-Output-Octets}:-0}', '%{Called-Station-Id}', '%{Calling-Station-Id}', '', '%{Service-Type}', '%{Framed-Protocol}', '%{Framed-IP-Address}', '%{Virtual-Server}', '%{Packet-Dst-IP-Address}', '%{Tunnel-Private-Group-Id}', SUBSTRING_INDEX('%{SQL-User-Name}', '@', 1))" } stop { query = "UPDATE radacct SET acctstoptime = '%S', acctsessiontime = %{%{Acct-Session-Time}:-NULL}, acctinputoctets = '%{%{Acct-Input-Gigawords}:-0}' << 32 | '%{%{Acct-Input-Octets}:-0}', acctoutputoctets = '%{%{Acct-Output-Gigawords}:-0}' << 32 | '%{%{Acct-Output-Octets}:-0}', acctterminatecause = '%{Acct-Terminate-Cause}', connectinfo_stop = '%{Connect-Info}' WHERE AcctUniqueId = '%{Acct-Unique-Session-Id}'" query = "INSERT INTO radacct (acctsessionid, acctuniqueid, username, realm, nasipaddress, nasportid, nasporttype, acctstarttime, acctupdatetime, acctstoptime, acctsessiontime, acctauthentic, connectinfo_start, connectinfo_stop, acctinputoctets, acctoutputoctets, calledstationid, callingstationid, acctterminatecause, servicetype, framedprotocol, framedipaddress, virtual_server, radius_server, vlan, strippedusername) VALUES ('%{Acct-Session-Id}', '%{Acct-Unique-Session-Id}', '%{SQL-User-Name}', '%{Realm}', '%{NAS-IP-Address}', '%{%{NAS-Port-ID}:-%{NAS-Port}}', '%{NAS-Port-Type}', FROM_UNIXTIME(%{integer:Event-Timestamp} - %{%{Acct-Session-Time}:-0}), '%S', '%S', %{%{Acct-Session-Time}:-NULL}, '%{Acct-Authentic}', '', '%{Connect-Info}', '%{%{Acct-Input-Gigawords}:-0}' << 32 | '%{%{Acct-Input-Octets}:-0}', '%{%{Acct-Output-Gigawords}:-0}' << 32 | '%{%{Acct-Output-Octets}:-0}', '%{Called-Station-Id}', '%{Calling-Station-Id}', '%{Acct-Terminate-Cause}', '%{Service-Type}', '%{Framed-Protocol}', '%{Framed-IP-Address}', '%{Virtual-Server}', '%{Packet-Dst-IP-Address}', '%{Tunnel-Private-Group-Id}', SUBSTRING_INDEX('%{SQL-User-Name}', '@', 1))" } } } post-auth { reference = ".query" query = "INSERT INTO radpostauth (username, pass, reply, authdate) VALUES ( '%{SQL-User-Name}', '%{%{User-Password}:-%{Chap-Password}}', '%{reply:Packet-Type}', '%S')" } } rlm_sql (uobsql) - Driver rlm_sql_mysql (module rlm_sql_mysql) loaded and linked Creating attribute uobsql-sql-Group # Loading module "eduroaminfo" from file /etc/raddb/mods-enabled/eduroaminfo linelog eduroaminfo { destination = "syslog" delimiter = " " file { permissions = 384 escape_filenames = no } syslog { facility = "user" severity = "info" } unix { } tcp { timeout = 1000.000000 } udp { timeout = 1000.000000 } } # Loading module "detail" from file /etc/raddb/mods-enabled/detail detail { filename = "/var/log/radius/radacct/%{%{Packet-Src-IP-Address}:-%{Packet-Src-IPv6-Address}}/detail-%Y%m%d" header = "%t" permissions = 384 locking = no escape_filenames = no log_packet_header = no } # Loading module "vpieap" from file /etc/raddb/mods-enabled/vpieap eap vpieap { default_eap_type = "peap" ignore_unknown_eap_types = no cisco_accounting_username_bug = no } # Linked to sub-module rlm_eap_tls tls { tls = "tls-common" require_client_cert = yes } tls-config tls-common { verify_depth = 0 ca_path = "/etc/raddb/certs" pem_file_type = yes private_key_file = "/etc/raddb/certs/2016-vpi.wireless.bris.ac.uk.key" certificate_file = "/etc/raddb/certs/2016-vpi.wireless.bris.ac.uk.pem" ca_file = "/etc/raddb/certs/University-of-Bristol-Windows-CA.pem" dh_file = "/etc/raddb/certs/dh" fragment_size = 1024 include_length = yes auto_chain = yes check_crl = no check_all_crl = no cipher_list = "DEFAULT" ecdh_curve = "prime256v1" disable_tlsv1_2 = yes cache { } verify { } ocsp { enable = no override_cert_url = yes url = "http://127.0.0.1/ocsp/" use_nonce = yes timeout = 0 softfail = no } } # Linked to sub-module rlm_eap_peap peap { tls = "tls-common" default_eap_type = "mschapv2" copy_request_to_tunnel = yes use_tunneled_reply = yes proxy_tunneled_request_as_eap = yes virtual_server = "vpi-inner" soh = no require_client_cert = no } tls - Using cached TLS configuration from previous invocation rlm_eap_peap - Failed to find 'Auth-Type eap' section in virtual server vpi-inner. The server cannot proxy inner-tunnel EAP packets. # Linked to sub-module rlm_eap_mschapv2 mschapv2 { with_ntdomain_hack = no send_error = no } # Loading module "rainboweap" from file /etc/raddb/mods-enabled/rainboweap eap rainboweap { default_eap_type = "peap" ignore_unknown_eap_types = no cisco_accounting_username_bug = no } # Linked to sub-module rlm_eap_tls tls { require_client_cert = yes virtual_server = "rainboweap-tls" } TLS section "tls" missing, trying to use legacy configuration tls { verify_depth = 0 ca_path = "/etc/raddb/certs" pem_file_type = yes private_key_file = "/etc/raddb/certs/The-Rainbow-Edge.key" certificate_file = "/etc/raddb/certs/The-Rainbow-Edge-cert.pem" ca_file = "/etc/raddb/certs/uob-net-ca.pem" dh_file = "/etc/raddb/certs/dh" random_file = "/dev/urandom" fragment_size = 1024 include_length = yes auto_chain = yes check_crl = no check_all_crl = no cipher_list = "DEFAULT" require_client_cert = yes ecdh_curve = "prime256v1" cache { } verify { } ocsp { enable = no override_cert_url = yes url = "http://127.0.0.1/ocsp/" use_nonce = yes timeout = 0 softfail = no } } # Linked to sub-module rlm_eap_ttls ttls { default_eap_type = "mschapv2" copy_request_to_tunnel = yes use_tunneled_reply = yes virtual_server = "rainbow-inner" include_length = yes require_client_cert = no } TLS section "tls" missing, trying to use legacy configuration tls - Using cached TLS configuration from previous invocation # Linked to sub-module rlm_eap_peap peap { default_eap_type = "mschapv2" copy_request_to_tunnel = yes use_tunneled_reply = yes proxy_tunneled_request_as_eap = yes virtual_server = "rainbow-inner" soh = no require_client_cert = no } TLS section "tls" missing, trying to use legacy configuration tls - Using cached TLS configuration from previous invocation rlm_eap_peap - Failed to find 'Auth-Type eap' section in virtual server rainbow-inner. The server cannot proxy inner-tunnel EAP packets. # Linked to sub-module rlm_eap_mschapv2 mschapv2 { with_ntdomain_hack = no send_error = no } # Loading module "echo" from file /etc/raddb/mods-enabled/echo exec echo { wait = yes program = "/bin/echo %{User-Name}" input_pairs = "request" output_pairs = "reply" shell_escape = yes } # Loading module "preprocess" from file /etc/raddb/mods-enabled/preprocess preprocess { huntgroups = "/etc/raddb/mods-config/preprocess/huntgroups" hints = "/etc/raddb/mods-config/preprocess/hints" with_ascend_hack = no ascend_channels_per_line = 23 with_ntdomain_hack = no with_specialix_jetstream_hack = no with_cisco_vsa_hack = no with_alvarion_vsa_hack = no } # Loaded module "rlm_unpack" # Loading module "unpack" from file /etc/raddb/mods-enabled/unpack # Loaded module "rlm_pap" # Loading module "pap" from file /etc/raddb/mods-enabled/pap pap { normalise = yes } # Loaded module "rlm_logintime" # Loading module "logintime" from file /etc/raddb/mods-enabled/logintime logintime { minimum_timeout = 60 } instantiate { } } # modules # Instantiating module "auth_log" from file /etc/raddb/mods-enabled/detail.log rlm_detail (auth_log) - 'User-Password' suppressed, will not appear in detail output # Instantiating module "reply_log" from file /etc/raddb/mods-enabled/detail.log # Instantiating module "pre_proxy_log" from file /etc/raddb/mods-enabled/detail.log # Instantiating module "post_proxy_log" from file /etc/raddb/mods-enabled/detail.log # Instantiating module "rainbowpreprocess" from file /etc/raddb/mods-enabled/rainbowpreprocess # Instantiating module "uob_detail" from file /etc/raddb/mods-enabled/uobdetail rlm_detail (uob_detail) - 'User-Password' suppressed, will not appear in detail output # Instantiating module "uob_auth_log" from file /etc/raddb/mods-enabled/uobdetail rlm_detail (uob_auth_log) - 'User-Password' suppressed, will not appear in detail output # Instantiating module "uob_auth_log_password" from file /etc/raddb/mods-enabled/uobdetail # Instantiating module "uob_reply_log" from file /etc/raddb/mods-enabled/uobdetail # Instantiating module "uob_pre_proxy_log" from file /etc/raddb/mods-enabled/uobdetail # Instantiating module "uob_post_proxy_log" from file /etc/raddb/mods-enabled/uobdetail # Instantiating module "rainbowmschap" from file /etc/raddb/mods-enabled/rainbowmschap rainbowmschap : authenticating by calling 'ntlm_auth' # Instantiating module "rainbowmachinemschap" from file /etc/raddb/mods-enabled/rainbowmschap rainbowmachinemschap : authenticating by calling 'ntlm_auth' # Instantiating module "mschap" from file /etc/raddb/mods-enabled/mschap mschap: using internal authentication # Instantiating module "files-eduroam" from file /etc/raddb/mods-enabled/files-eduroam reading file /etc/raddb/users.d/users-eduroam # Instantiating module "linelog" from file /etc/raddb/mods-enabled/linelog # Instantiating module "log_accounting" from file /etc/raddb/mods-enabled/linelog # Instantiating module "vpimschap" from file /etc/raddb/mods-enabled/vpimschap vpimschap : authenticating by calling 'ntlm_auth' # Instantiating module "rainbowlogsyslog" from file /etc/raddb/mods-enabled/rainbowlog # Instantiating module "rainbowlogfiles" from file /etc/raddb/mods-enabled/rainbowlog # Instantiating module "rainbowacclog" from file /etc/raddb/mods-enabled/rainbowlog # Instantiating module "files" from file /etc/raddb/mods-enabled/files reading file /etc/raddb/mods-config/files/authorize reading file /etc/raddb/mods-config/files/accounting reading file /etc/raddb/mods-config/files/pre-proxy # Instantiating module "IPASS" from file /etc/raddb/mods-enabled/realm # Instantiating module "suffix" from file /etc/raddb/mods-enabled/realm # Instantiating module "realmpercent" from file /etc/raddb/mods-enabled/realm # Instantiating module "ntdomain" from file /etc/raddb/mods-enabled/realm # Instantiating module "eduroamvlan" from file /etc/raddb/mods-enabled/eduroamvlan eduroamvlan - Driver rlm_cache_rbtree loaded and linked # Instantiating module "uobldap" from file /etc/raddb/mods-enabled/uobldap rlm_ldap (uobldap) - libldap vendor: OpenLDAP, version: 20440 accounting { reference = "%{tolower:type.%{Acct-Status-Type}}" } post-auth { reference = "." } rlm_ldap (uobldap) - Initialising connection pool pool { start = 5 min = 3 max = 5 spare = 10 uses = 0 lifetime = 0 cleanup_interval = 30 idle_timeout = 60 connect_timeout = 3.000000 held_trigger_min = 0.000000 held_trigger_max = 0.500000 retry_delay = 30 spread = no } rlm_ldap (uobldap) - WARNING: Ignoring "spare = 10", forcing to "spare = 2" rlm_ldap (uobldap) - Opening additional connection (0), 1 of 5 pending slots used rlm_ldap (uobldap) - Connecting to ldap://cse-lox.ads.bris.ac.uk:636 rlm_ldap (uobldap) - Waiting for bind result... rlm_ldap (uobldap) - Bind successful rlm_ldap (uobldap) - Performing search in "" with filter "(objectclass=*)", scope "base" rlm_ldap (uobldap) - Waiting for search result... rlm_ldap (uobldap) - Directory type: Active Directory rlm_ldap (uobldap) - Opening additional connection (1), 1 of 4 pending slots used rlm_ldap (uobldap) - Connecting to ldap://cse-lox.ads.bris.ac.uk:636 rlm_ldap (uobldap) - Waiting for bind result... rlm_ldap (uobldap) - Bind successful rlm_ldap (uobldap) - Opening additional connection (2), 1 of 3 pending slots used rlm_ldap (uobldap) - Connecting to ldap://cse-lox.ads.bris.ac.uk:636 rlm_ldap (uobldap) - Waiting for bind result... rlm_ldap (uobldap) - Bind successful rlm_ldap (uobldap) - Opening additional connection (3), 1 of 2 pending slots used rlm_ldap (uobldap) - Connecting to ldap://cse-lox.ads.bris.ac.uk:636 rlm_ldap (uobldap) - Waiting for bind result... rlm_ldap (uobldap) - Bind successful rlm_ldap (uobldap) - Opening additional connection (4), 1 of 1 pending slots used rlm_ldap (uobldap) - Connecting to ldap://cse-lox.ads.bris.ac.uk:636 rlm_ldap (uobldap) - Waiting for bind result... rlm_ldap (uobldap) - Bind successful # Instantiating module "uobsql-write" from file /etc/raddb/mods-enabled/uobsql-write rlm_sql_mysql - libmysql version: 5.5.44-MariaDB mysql { tls { } warnings = "auto" } rlm_sql (uobsql-write) - Attempting to connect to database "radius" rlm_sql (uobsql-write) - Initialising connection pool pool { start = 1 min = 1 max = 2 spare = 1 uses = 10000 lifetime = 300 cleanup_interval = 30 idle_timeout = 60 connect_timeout = 3.000000 held_trigger_min = 0.000000 held_trigger_max = 0.500000 retry_delay = 2 spread = no } rlm_sql (uobsql-write) - Opening additional connection (0), 1 of 2 pending slots used rlm_sql_mysql - Starting connect to MySQL server rlm_sql_mysql - Connected to database 'radius' on db-write.nomadic-core.bris.ac.uk via TCP/IP, server version 5.5.48-MariaDB-wsrep, protocol version 10 # Instantiating module "expiration" from file /etc/raddb/mods-enabled/expiration # Instantiating module "logtofile" from file /etc/raddb/mods-enabled/logtofile # Instantiating module "reject" from file /etc/raddb/mods-enabled/always # Instantiating module "fail" from file /etc/raddb/mods-enabled/always # Instantiating module "ok" from file /etc/raddb/mods-enabled/always # Instantiating module "handled" from file /etc/raddb/mods-enabled/always # Instantiating module "invalid" from file /etc/raddb/mods-enabled/always # Instantiating module "userlock" from file /etc/raddb/mods-enabled/always # Instantiating module "notfound" from file /etc/raddb/mods-enabled/always # Instantiating module "noop" from file /etc/raddb/mods-enabled/always # Instantiating module "updated" from file /etc/raddb/mods-enabled/always # Instantiating module "rainbowfiles" from file /etc/raddb/mods-enabled/rainbowfiles reading file /etc/raddb/users.d/users-rainbow # Instantiating module "logtosyslog" from file /etc/raddb/mods-enabled/logtosyslog # Instantiating module "attr_filter.post-proxy" from file /etc/raddb/mods-enabled/attr_filter reading file /etc/raddb/mods-config/attr_filter/post-proxy # Instantiating module "attr_filter.pre-proxy" from file /etc/raddb/mods-enabled/attr_filter reading file /etc/raddb/mods-config/attr_filter/pre-proxy # Instantiating module "attr_filter.access_reject" from file /etc/raddb/mods-enabled/attr_filter reading file /etc/raddb/mods-config/attr_filter/access_reject [/etc/raddb/mods-config/attr_filter/access_reject]:11 Check item "FreeRADIUS-Response-Delay" found in filter list for realm "DEFAULT". [/etc/raddb/mods-config/attr_filter/access_reject]:11 Check item "FreeRADIUS-Response-Delay-USec" found in filter list for realm "DEFAULT". # Instantiating module "attr_filter.access_challenge" from file /etc/raddb/mods-enabled/attr_filter reading file /etc/raddb/mods-config/attr_filter/access_challenge # Instantiating module "attr_filter.accounting_response" from file /etc/raddb/mods-enabled/attr_filter reading file /etc/raddb/mods-config/attr_filter/accounting_response # Instantiating module "filter.attrs.accounting_response" from file /etc/raddb/mods-enabled/attr_filter reading file /etc/raddb/mods-config/attr_filter/attrs.accounting_response # Instantiating module "filter.bristolresearchnet-a_reject" from file /etc/raddb/mods-enabled/attr_filter reading file /etc/raddb/mods-config/attr_filter/bristolresearchnet-a_reject # Instantiating module "filter.eduroamalien-a_accept" from file /etc/raddb/mods-enabled/attr_filter reading file /etc/raddb/mods-config/attr_filter/eduroamalien-a_accept # Instantiating module "filter.eduroamalien-a_challenge" from file /etc/raddb/mods-enabled/attr_filter reading file /etc/raddb/mods-config/attr_filter/eduroamalien-a_challenge # Instantiating module "filter.eduroamalien-a_reject" from file /etc/raddb/mods-enabled/attr_filter reading file /etc/raddb/mods-config/attr_filter/eduroamalien-a_reject # Instantiating module "filter.eduroamlocal-a_accept" from file /etc/raddb/mods-enabled/attr_filter reading file /etc/raddb/mods-config/attr_filter/eduroamlocal-a_accept # Instantiating module "filter.eduroamlocal-a_challenge" from file /etc/raddb/mods-enabled/attr_filter reading file /etc/raddb/mods-config/attr_filter/eduroamlocal-a_challenge # Instantiating module "filter.eduroamlocal-a_reject" from file /etc/raddb/mods-enabled/attr_filter reading file /etc/raddb/mods-config/attr_filter/eduroamlocal-a_reject # Instantiating module "filter.eduroamlocal-post_proxy" from file /etc/raddb/mods-enabled/attr_filter reading file /etc/raddb/mods-config/attr_filter/eduroamlocal-post_proxy # Instantiating module "filter.eduroamlocal-pre_proxy" from file /etc/raddb/mods-enabled/attr_filter reading file /etc/raddb/mods-config/attr_filter/eduroamlocal-pre_proxy # Instantiating module "filter.vpi-a_accept" from file /etc/raddb/mods-enabled/attr_filter reading file /etc/raddb/mods-config/attr_filter/vpi-a_accept # Instantiating module "filter.vpi-a_challenge" from file /etc/raddb/mods-enabled/attr_filter reading file /etc/raddb/mods-config/attr_filter/vpi-a_challenge # Instantiating module "filter.vpi-a_reject" from file /etc/raddb/mods-enabled/attr_filter reading file /etc/raddb/mods-config/attr_filter/vpi-a_reject # Instantiating module "etc_passwd" from file /etc/raddb/mods-enabled/passwd # Instantiating module "cache_eap" from file /etc/raddb/mods-enabled/cache_eap cache_eap - Driver rlm_cache_rbtree loaded and linked # Instantiating module "eduroammschap" from file /etc/raddb/mods-enabled/eduroammschap rlm_mschap (eduroammschap) - Initialising connection pool pool { start = 5 min = 3 max = 256 spare = 10 uses = 0 lifetime = 86400 cleanup_interval = 300 idle_timeout = 600 connect_timeout = 3.000000 held_trigger_min = 0.000000 held_trigger_max = 0.500000 retry_delay = 30 spread = no } rlm_mschap (eduroammschap) - Opening additional connection (0), 1 of 256 pending slots used rlm_mschap (eduroammschap) - Opening additional connection (1), 1 of 255 pending slots used rlm_mschap (eduroammschap) - Opening additional connection (2), 1 of 254 pending slots used rlm_mschap (eduroammschap) - Opening additional connection (3), 1 of 253 pending slots used rlm_mschap (eduroammschap) - Opening additional connection (4), 1 of 252 pending slots used eduroammschap : authenticating directly to winbind # Instantiating module "uobsql" from file /etc/raddb/mods-enabled/uobsql mysql { tls { } warnings = "auto" } rlm_sql (uobsql) - Attempting to connect to database "radius" rlm_sql (uobsql) - Initialising connection pool pool { start = 1 min = 1 max = 8 spare = 1 uses = 10000 lifetime = 300 cleanup_interval = 30 idle_timeout = 60 connect_timeout = 3.000000 held_trigger_min = 0.000000 held_trigger_max = 0.500000 retry_delay = 2 spread = no } rlm_sql (uobsql) - Opening additional connection (0), 1 of 8 pending slots used rlm_sql_mysql - Starting connect to MySQL server rlm_sql_mysql - Connected to database 'radius' on db.nomadic-core.bris.ac.uk via TCP/IP, server version 5.5.48-MariaDB-wsrep, protocol version 10 # Instantiating module "eduroaminfo" from file /etc/raddb/mods-enabled/eduroaminfo # Instantiating module "detail" from file /etc/raddb/mods-enabled/detail # Instantiating module "preprocess" from file /etc/raddb/mods-enabled/preprocess reading file /etc/raddb/mods-config/preprocess/huntgroups reading file /etc/raddb/mods-config/preprocess/hints # Instantiating module "pap" from file /etc/raddb/mods-enabled/pap # Instantiating module "logintime" from file /etc/raddb/mods-enabled/logintime radiusd: #### Loading Virtual Servers #### server eduroam-partners { # from file /etc/raddb/sites-enabled/eduroam-partners } # server eduroam-partners server bristolresearchnet { # from file /etc/raddb/sites-enabled/bristolresearchnet } # server bristolresearchnet server rainbow-inner { # from file /etc/raddb/sites-enabled/rainbow-inner } # server rainbow-inner server uobconsoles { # from file /etc/raddb/sites-enabled/uobconsoles } # server uobconsoles server vpi-inner { # from file /etc/raddb/sites-enabled/vpi-inner } # server vpi-inner server rainbow { # from file /etc/raddb/sites-enabled/rainbow } # server rainbow server eduroamalien { # from file /etc/raddb/sites-enabled/eduroamalien } # server eduroamalien server vpi { # from file /etc/raddb/sites-enabled/vpi } # server vpi server status { # from file /etc/raddb/sites-enabled/status } # server status server eduroamlocal-acct { # from file /etc/raddb/sites-enabled/eduroamlocal-acct } # server eduroamlocal-acct server eduroamlocal-auth { # from file /etc/raddb/sites-enabled/eduroamlocal-auth } # server eduroamlocal-auth server eduroamlion-inner { # from file /etc/raddb/sites-enabled/eduroamlion-inner } # server eduroamlion-inner server rainboweap-tls { # from file /etc/raddb/sites-enabled/rainboweap-tls } # server rainboweap-tls server eduroam-inner { # from file /etc/raddb/sites-enabled/eduroam-inner } # server eduroam-inner radiusd: #### Opening IP addresses and Ports #### Listening on command file /var/run/radiusd/control/radiusd.sock Listening on auth address * port 1645 bound to server eduroam-partners Listening on acct address * port 1646 bound to server eduroam-partners Listening on auth address * port 16061 bound to server eduroam-partners Listening on acct address * port 16062 bound to server eduroam-partners Listening on auth address * port 16063 bound to server eduroam-partners Listening on acct address * port 16064 bound to server eduroam-partners Listening on auth address * port 16014 bound to server bristolresearchnet Listening on acct address * port 16015 bound to server bristolresearchnet Listening on auth address * port 16018 bound to server uobconsoles Listening on auth address * port 16028 bound to server rainbow Listening on acct address * port 16029 bound to server rainbow Listening on auth address * port 1812 bound to server eduroamalien Listening on auth address :: port 1812 bound to server eduroamalien Listening on auth address * port 16020 bound to server vpi Listening on acct address * port 16021 bound to server vpi Listening on status address * port 18120 bound to server status Listening on acct address * port 16007 bound to server eduroamlocal-acct Listening on auth address * port 16006 bound to server eduroamlocal-auth Listening on proxy address * port 48159 Listening on proxy address :: port 46124 Ready to process requests (0) Received Access-Request Id 156 from 172.17.107.208:32770 to 137.222.8.134:16020 via ens192 length 322 (0) User-Name = "host/IT051252.users.bris.ac.uk" (0) Chargeable-User-Identity = 0x00 (0) Location-Capable = Civix-Location (0) Calling-Station-Id = "c4:85:08:a9:05:24" (0) Called-Station-Id = "88:f0:31:b2:be:70:Bristol-ManagedPCs" (0) NAS-Port = 13 (0) Cisco-AVPair = "audit-session-id=ac116bd000015f4456e81e35" (0) Acct-Session-Id = "56e81e35/c4:85:08:a9:05:24/87627" (0) NAS-IP-Address = 172.17.107.208 (0) NAS-Identifier = "wism8" (0) Airespace-Wlan-Id = 3 (0) Service-Type = Framed-User (0) Framed-MTU = 1300 (0) NAS-Port-Type = Wireless-802.11 (0) Tunnel-Type:0 = VLAN (0) Tunnel-Medium-Type:0 = IEEE-802 (0) Tunnel-Private-Group-Id:0 = "547" (0) EAP-Message = 0x0202002301686f73742f49543035313235322e75736572732e627269732e61632e756b (0) Message-Authenticator = 0x210eb8a98c17341f7b1831b8224f1ca9 (0) Running section authorize from file /etc/raddb/sites-enabled/vpi (0) authorize { (0) wism-checks { (0) if (Service-Type == "NAS-Prompt-User") { (0) ... (0) } (0) } # wism-checks (notfound) (0) preprocess (ok) (0) uob_auth_log - EXPAND /var/log/radius/radacct/%{%{Virtual-Server}:-UNKNOWN}/auth-detail.log (0) uob_auth_log - --> /var/log/radius/radacct/vpi/auth-detail.log (0) uob_auth_log - /var/log/radius/radacct/%{%{Virtual-Server}:-UNKNOWN}/auth-detail.log expands to /var/log/radius/radacct/vpi/auth-detail.log (0) uob_auth_log - EXPAND %t (0) uob_auth_log - --> Tue Mar 15 14:59:02 2016 (0) uob_auth_log (ok) (0) if (User-Name !~ /^host\/.+\.bris(tol)?\.ac\.uk$/i) { (0) ... (0) } (0) vpieap - Peer sent EAP Response (code 2) ID 2 length 35 (0) vpieap - Peer sent EAP-Identity. Returning 'ok' so we can short-circuit the rest of authorize (0) vpieap (ok) (0) } # authorize (ok) (0) Using 'Auth-Type = vpieap' for authenticate {...} (0) Running Auth-Type vpieap from file /etc/raddb/sites-enabled/vpi (0) authenticate { (0) vpieap - Peer sent packet with EAP method Identity (1) (0) vpieap - Calling submodule eap_peap to process data (0) eap_peap - Initiating new EAP-TLS session (0) vpieap - Sending EAP Request (code 1) ID 3 length 6 (0) vpieap (handled) (0) } # authenticate (handled) (0) Using Post-Auth-Type Challenge (0) Post-Auth-Type sub-section not found. Ignoring. (0) Running Post-Auth-Type Challenge from file /etc/raddb/sites-enabled/vpi (0) Sent Access-Challenge Id 156 from 137.222.8.134:16020 to 172.17.107.208:32770 via ens192 length 0 (0) EAP-Message = 0x010300061920 (0) Message-Authenticator = 0x00000000000000000000000000000000 (0) State = 0x01016e00b7ba0f346d696f996ec2a586 (0) Finished request Waking up in 4.9 seconds. (1) Received Access-Request Id 157 from 172.17.107.208:32770 to 137.222.8.134:16020 via ens192 length 412 (1) User-Name = "host/IT051252.users.bris.ac.uk" (1) Chargeable-User-Identity = 0x00 (1) Location-Capable = Civix-Location (1) Calling-Station-Id = "c4:85:08:a9:05:24" (1) Called-Station-Id = "88:f0:31:b2:be:70:Bristol-ManagedPCs" (1) NAS-Port = 13 (1) Cisco-AVPair = "audit-session-id=ac116bd000015f4456e81e35" (1) Acct-Session-Id = "56e81e35/c4:85:08:a9:05:24/87627" (1) NAS-IP-Address = 172.17.107.208 (1) NAS-Identifier = "wism8" (1) Airespace-Wlan-Id = 3 (1) Service-Type = Framed-User (1) Framed-MTU = 1300 (1) NAS-Port-Type = Wireless-802.11 (1) Tunnel-Type:0 = VLAN (1) Tunnel-Medium-Type:0 = IEEE-802 (1) Tunnel-Private-Group-Id:0 = "547" (1) EAP-Message = 0x0203006b198000000061160301005c01000058030156e82335df750bf907213b69795c99dd0e5a0fd9cafa4e22e72034f7067ec9cb000018c014c013c00ac0090035002f00380032000a00130005000401000017000a00080006001900170018000b00020100ff01000100 (1) State = 0x01016e00b7ba0f346d696f996ec2a586 (1) Message-Authenticator = 0x8ce96eef1c29f0f8b418aa5516a813f4 (1) Running section authorize from file /etc/raddb/sites-enabled/vpi (1) authorize { (1) wism-checks { (1) if (Service-Type == "NAS-Prompt-User") { (1) ... (1) } (1) } # wism-checks (notfound) (1) preprocess (ok) (1) uob_auth_log - EXPAND /var/log/radius/radacct/%{%{Virtual-Server}:-UNKNOWN}/auth-detail.log (1) uob_auth_log - --> /var/log/radius/radacct/vpi/auth-detail.log (1) uob_auth_log - /var/log/radius/radacct/%{%{Virtual-Server}:-UNKNOWN}/auth-detail.log expands to /var/log/radius/radacct/vpi/auth-detail.log (1) uob_auth_log - EXPAND %t (1) uob_auth_log - --> Tue Mar 15 14:59:02 2016 (1) uob_auth_log (ok) (1) if (User-Name !~ /^host\/.+\.bris(tol)?\.ac\.uk$/i) { (1) ... (1) } (1) vpieap - Peer sent EAP Response (code 2) ID 3 length 107 (1) vpieap - Continuing tunnel setup (1) vpieap (ok) (1) } # authorize (ok) (1) Using 'Auth-Type = vpieap' for authenticate {...} (1) Running Auth-Type vpieap from file /etc/raddb/sites-enabled/vpi (1) authenticate { (1) vpieap - Peer sent packet with EAP method PEAP (25) (1) vpieap - Calling submodule eap_peap to process data (1) eap_peap - Continuing EAP-TLS (1) eap_peap - Peer indicated complete TLS record size will be 97 bytes (1) eap_peap - Got complete TLS record, with length field (97 bytes) (1) eap_peap - [eap-tls verify] = ok (1) eap_peap - before/accept initialization (1) eap_peap - TLS Accept: before/accept initialization (1) eap_peap - <<< recv handshake [length 92], client_hello (1) eap_peap - TLS Accept: SSLv3 read client hello A (1) eap_peap - >>> send handshake [length 57], server_hello (1) eap_peap - TLS Accept: SSLv3 write server hello A (1) eap_peap - >>> send handshake [length 1833], certificate (1) eap_peap - TLS Accept: SSLv3 write certificate A (1) eap_peap - >>> send handshake [length 331], server_key_exchange (1) eap_peap - TLS Accept: SSLv3 write key exchange A (1) eap_peap - >>> send handshake [length 4], server_hello_done (1) eap_peap - TLS Accept: SSLv3 write server done A (1) eap_peap - TLS Accept: SSLv3 flush data (1) eap_peap - TLS Accept: Need to read more data: SSLv3 read client certificate A (1) eap_peap - TLS Accept: Need to read more data: SSLv3 read client certificate A (1) eap_peap - In TLS handshake phase (1) eap_peap - In TLS accept mode (1) eap_peap - Complete TLS record (2245 bytes) larger than MTU (1000 bytes), will fragment (1) eap_peap - Sending first TLS record fragment (1000 bytes), 1245 bytes remaining (1) eap_peap - [eap-tls process] = handled (1) vpieap - Sending EAP Request (code 1) ID 4 length 1010 (1) vpieap (handled) (1) } # authenticate (handled) (1) Using Post-Auth-Type Challenge (1) Post-Auth-Type sub-section not found. Ignoring. (1) Running Post-Auth-Type Challenge from file /etc/raddb/sites-enabled/vpi (1) Sent Access-Challenge Id 157 from 137.222.8.134:16020 to 172.17.107.208:32770 via ens192 length 0 (1) EAP-Message = 0x010403f219c0000008c5160301003902000035030156e823361b5cba1ccb77c8d1c2d294e5648fa5293f6acb6c7e0b210e9899de6e00c01400000dff01000100000b00040300010216030107290b0007250007220002dc308202d830820282020410456227300d06092a864886f70d01010b05003081bf (1) Message-Authenticator = 0x00000000000000000000000000000000 (1) State = 0x02036e003ffa67036d696f996ec2a586 (1) Finished request Waking up in 4.9 seconds. (2) Received Access-Request Id 158 from 172.17.107.208:32770 to 137.222.8.134:16020 via ens192 length 311 (2) User-Name = "host/IT051252.users.bris.ac.uk" (2) Chargeable-User-Identity = 0x00 (2) Location-Capable = Civix-Location (2) Calling-Station-Id = "c4:85:08:a9:05:24" (2) Called-Station-Id = "88:f0:31:b2:be:70:Bristol-ManagedPCs" (2) NAS-Port = 13 (2) Cisco-AVPair = "audit-session-id=ac116bd000015f4456e81e35" (2) Acct-Session-Id = "56e81e35/c4:85:08:a9:05:24/87627" (2) NAS-IP-Address = 172.17.107.208 (2) NAS-Identifier = "wism8" (2) Airespace-Wlan-Id = 3 (2) Service-Type = Framed-User (2) Framed-MTU = 1300 (2) NAS-Port-Type = Wireless-802.11 (2) Tunnel-Type:0 = VLAN (2) Tunnel-Medium-Type:0 = IEEE-802 (2) Tunnel-Private-Group-Id:0 = "547" (2) EAP-Message = 0x020400061900 (2) State = 0x02036e003ffa67036d696f996ec2a586 (2) Message-Authenticator = 0x2973017c64efccc5305299b5fdd47e3d (2) Running section authorize from file /etc/raddb/sites-enabled/vpi (2) authorize { (2) wism-checks { (2) if (Service-Type == "NAS-Prompt-User") { (2) ... (2) } (2) } # wism-checks (notfound) (2) preprocess (ok) (2) uob_auth_log - EXPAND /var/log/radius/radacct/%{%{Virtual-Server}:-UNKNOWN}/auth-detail.log (2) uob_auth_log - --> /var/log/radius/radacct/vpi/auth-detail.log (2) uob_auth_log - /var/log/radius/radacct/%{%{Virtual-Server}:-UNKNOWN}/auth-detail.log expands to /var/log/radius/radacct/vpi/auth-detail.log (2) uob_auth_log - EXPAND %t (2) uob_auth_log - --> Tue Mar 15 14:59:02 2016 (2) uob_auth_log (ok) (2) if (User-Name !~ /^host\/.+\.bris(tol)?\.ac\.uk$/i) { (2) ... (2) } (2) vpieap - Peer sent EAP Response (code 2) ID 4 length 6 (2) vpieap - Continuing tunnel setup (2) vpieap (ok) (2) } # authorize (ok) (2) Using 'Auth-Type = vpieap' for authenticate {...} (2) Running Auth-Type vpieap from file /etc/raddb/sites-enabled/vpi (2) authenticate { (2) vpieap - Peer sent packet with EAP method PEAP (25) (2) vpieap - Calling submodule eap_peap to process data (2) eap_peap - Continuing EAP-TLS (2) eap_peap - Peer ACKed our handshake fragment (2) eap_peap - [eap-tls verify] = request (2) eap_peap - Sending additional TLS record fragment (1004 bytes), 241 bytes remaining (2) eap_peap - [eap-tls process] = handled (2) vpieap - Sending EAP Request (code 1) ID 5 length 1010 (2) vpieap (handled) (2) } # authenticate (handled) (2) Using Post-Auth-Type Challenge (2) Post-Auth-Type sub-section not found. Ignoring. (2) Running Post-Auth-Type Challenge from file /etc/raddb/sites-enabled/vpi (2) Sent Access-Challenge Id 158 from 137.222.8.134:16020 to 172.17.107.208:32770 via ens192 length 0 (2) EAP-Message = 0x010503f219402053657276696365733129302706035504031320556e6976657273697479206f662042726973746f6c2057696e646f7773204341301e170d3033303131303130323733375a170d3233303131303130333531315a3081bf3125302306092a864886f70d010901161663612d61646d696e40 (2) Message-Authenticator = 0x00000000000000000000000000000000 (2) State = 0x03016e00b7ba0f346d696f996ec2a586 (2) Finished request Waking up in 4.9 seconds. (3) Received Access-Request Id 159 from 172.17.107.208:32770 to 137.222.8.134:16020 via ens192 length 311 (3) User-Name = "host/IT051252.users.bris.ac.uk" (3) Chargeable-User-Identity = 0x00 (3) Location-Capable = Civix-Location (3) Calling-Station-Id = "c4:85:08:a9:05:24" (3) Called-Station-Id = "88:f0:31:b2:be:70:Bristol-ManagedPCs" (3) NAS-Port = 13 (3) Cisco-AVPair = "audit-session-id=ac116bd000015f4456e81e35" (3) Acct-Session-Id = "56e81e35/c4:85:08:a9:05:24/87627" (3) NAS-IP-Address = 172.17.107.208 (3) NAS-Identifier = "wism8" (3) Airespace-Wlan-Id = 3 (3) Service-Type = Framed-User (3) Framed-MTU = 1300 (3) NAS-Port-Type = Wireless-802.11 (3) Tunnel-Type:0 = VLAN (3) Tunnel-Medium-Type:0 = IEEE-802 (3) Tunnel-Private-Group-Id:0 = "547" (3) EAP-Message = 0x020500061900 (3) State = 0x03016e00b7ba0f346d696f996ec2a586 (3) Message-Authenticator = 0x98cabe8901eb9b85dccb9e16a30658c2 (3) Running section authorize from file /etc/raddb/sites-enabled/vpi (3) authorize { (3) wism-checks { (3) if (Service-Type == "NAS-Prompt-User") { (3) ... (3) } (3) } # wism-checks (notfound) (3) preprocess (ok) (3) uob_auth_log - EXPAND /var/log/radius/radacct/%{%{Virtual-Server}:-UNKNOWN}/auth-detail.log (3) uob_auth_log - --> /var/log/radius/radacct/vpi/auth-detail.log (3) uob_auth_log - /var/log/radius/radacct/%{%{Virtual-Server}:-UNKNOWN}/auth-detail.log expands to /var/log/radius/radacct/vpi/auth-detail.log (3) uob_auth_log - EXPAND %t (3) uob_auth_log - --> Tue Mar 15 14:59:02 2016 (3) uob_auth_log (ok) (3) if (User-Name !~ /^host\/.+\.bris(tol)?\.ac\.uk$/i) { (3) ... (3) } (3) vpieap - Peer sent EAP Response (code 2) ID 5 length 6 (3) vpieap - Continuing tunnel setup (3) vpieap (ok) (3) } # authorize (ok) (3) Using 'Auth-Type = vpieap' for authenticate {...} (3) Running Auth-Type vpieap from file /etc/raddb/sites-enabled/vpi (3) authenticate { (3) vpieap - Peer sent packet with EAP method PEAP (25) (3) vpieap - Calling submodule eap_peap to process data (3) eap_peap - Continuing EAP-TLS (3) eap_peap - Peer ACKed our handshake fragment (3) eap_peap - [eap-tls verify] = request (3) eap_peap - Sending final TLS record fragment (241 bytes) (3) eap_peap - [eap-tls process] = handled (3) vpieap - Sending EAP Request (code 1) ID 6 length 247 (3) vpieap (handled) (3) } # authenticate (handled) (3) Using Post-Auth-Type Challenge (3) Post-Auth-Type sub-section not found. Ignoring. (3) Running Post-Auth-Type Challenge from file /etc/raddb/sites-enabled/vpi (3) Sent Access-Challenge Id 159 from 137.222.8.134:16020 to 172.17.107.208:32770 via ens192 length 0 (3) EAP-Message = 0x010600f71900ebe0344cb4e5d4ac912e10789408d80c66f81fd27cddd89c4c4a4dc3ae440f0cc86f59ca46e8ff75376eb7910a0af3153626fe0cf81027c02f568b1e56e2656a4191c98103f0da0f1ff061a21c81756cc2aec65066916bda86078229a217c291a4cb982853454ddb46b5e54200d5fd06d4 (3) Message-Authenticator = 0x00000000000000000000000000000000 (3) State = 0x04076e003ffa67036d696f996ec2a586 (3) Finished request Waking up in 4.9 seconds. (4) Received Access-Request Id 160 from 172.17.107.208:32770 to 137.222.8.134:16020 via ens192 length 449 (4) User-Name = "host/IT051252.users.bris.ac.uk" (4) Chargeable-User-Identity = 0x00 (4) Location-Capable = Civix-Location (4) Calling-Station-Id = "c4:85:08:a9:05:24" (4) Called-Station-Id = "88:f0:31:b2:be:70:Bristol-ManagedPCs" (4) NAS-Port = 13 (4) Cisco-AVPair = "audit-session-id=ac116bd000015f4456e81e35" (4) Acct-Session-Id = "56e81e35/c4:85:08:a9:05:24/87627" (4) NAS-IP-Address = 172.17.107.208 (4) NAS-Identifier = "wism8" (4) Airespace-Wlan-Id = 3 (4) Service-Type = Framed-User (4) Framed-MTU = 1300 (4) NAS-Port-Type = Wireless-802.11 (4) Tunnel-Type:0 = VLAN (4) Tunnel-Medium-Type:0 = IEEE-802 (4) Tunnel-Private-Group-Id:0 = "547" (4) EAP-Message = 0x020600901980000000861603010046100000424104647ecb7be9097a5ded8a15cad2f20782f73ac6dc656b780709999a57827e73a8fe8e6a1b0e84a16922438dc84d05ae35ea7a5ea9a0dde79187142978e52f2b8a14030100010116030100306891fee4d9c9dc571d75c0f76b02e5725a63f2d65a9a70 (4) State = 0x04076e003ffa67036d696f996ec2a586 (4) Message-Authenticator = 0x88fc7f16291a306da34adbcad2b075d8 (4) Running section authorize from file /etc/raddb/sites-enabled/vpi (4) authorize { (4) wism-checks { (4) if (Service-Type == "NAS-Prompt-User") { (4) ... (4) } (4) } # wism-checks (notfound) (4) preprocess (ok) (4) uob_auth_log - EXPAND /var/log/radius/radacct/%{%{Virtual-Server}:-UNKNOWN}/auth-detail.log (4) uob_auth_log - --> /var/log/radius/radacct/vpi/auth-detail.log (4) uob_auth_log - /var/log/radius/radacct/%{%{Virtual-Server}:-UNKNOWN}/auth-detail.log expands to /var/log/radius/radacct/vpi/auth-detail.log (4) uob_auth_log - EXPAND %t (4) uob_auth_log - --> Tue Mar 15 14:59:02 2016 (4) uob_auth_log (ok) (4) if (User-Name !~ /^host\/.+\.bris(tol)?\.ac\.uk$/i) { (4) ... (4) } (4) vpieap - Peer sent EAP Response (code 2) ID 6 length 144 (4) vpieap - Continuing tunnel setup (4) vpieap (ok) (4) } # authorize (ok) (4) Using 'Auth-Type = vpieap' for authenticate {...} (4) Running Auth-Type vpieap from file /etc/raddb/sites-enabled/vpi (4) authenticate { (4) vpieap - Peer sent packet with EAP method PEAP (25) (4) vpieap - Calling submodule eap_peap to process data (4) eap_peap - Continuing EAP-TLS (4) eap_peap - Peer indicated complete TLS record size will be 134 bytes (4) eap_peap - Got complete TLS record, with length field (134 bytes) (4) eap_peap - [eap-tls verify] = ok (4) eap_peap - <<< recv handshake [length 70], client_key_exchange (4) eap_peap - TLS Accept: SSLv3 read client key exchange A (4) eap_peap - <<< recv change_cipher_spec [length 1] (4) eap_peap - <<< recv handshake [length 16], finished (4) eap_peap - TLS Accept: SSLv3 read finished A (4) eap_peap - >>> send change_cipher_spec [length 1] (4) eap_peap - TLS Accept: SSLv3 write change cipher spec A (4) eap_peap - >>> send handshake [length 16], finished (4) eap_peap - TLS Accept: SSLv3 write finished A (4) eap_peap - TLS Accept: SSLv3 flush data (4) eap_peap - SSL negotiation finished successfully (4) eap_peap - TLS established with cipher suite: ECDHE-RSA-AES256-SHA SSLv3 Kx=ECDH Au=RSA Enc=AES(256) Mac=SHA1 (4) eap_peap - Sending complete TLS record (59 bytes) (4) eap_peap - [eap-tls process] = handled (4) vpieap - Sending EAP Request (code 1) ID 7 length 69 (4) vpieap (handled) (4) } # authenticate (handled) (4) Using Post-Auth-Type Challenge (4) Post-Auth-Type sub-section not found. Ignoring. (4) Running Post-Auth-Type Challenge from file /etc/raddb/sites-enabled/vpi (4) Sent Access-Challenge Id 160 from 137.222.8.134:16020 to 172.17.107.208:32770 via ens192 length 0 (4) EAP-Message = 0x0107004519800000003b14030100010116030100306fdc388f829843e06f869eeae13afdf94ba2efe759a91d60b7a147cb1663ee604ab474b08aaf072259723668fe0c447b (4) Message-Authenticator = 0x00000000000000000000000000000000 (4) State = 0x05016e00b7ba0f346d696f996ec2a586 (4) Finished request Waking up in 4.9 seconds. (5) Received Access-Request Id 161 from 172.17.107.208:32770 to 137.222.8.134:16020 via ens192 length 311 (5) User-Name = "host/IT051252.users.bris.ac.uk" (5) Chargeable-User-Identity = 0x00 (5) Location-Capable = Civix-Location (5) Calling-Station-Id = "c4:85:08:a9:05:24" (5) Called-Station-Id = "88:f0:31:b2:be:70:Bristol-ManagedPCs" (5) NAS-Port = 13 (5) Cisco-AVPair = "audit-session-id=ac116bd000015f4456e81e35" (5) Acct-Session-Id = "56e81e35/c4:85:08:a9:05:24/87627" (5) NAS-IP-Address = 172.17.107.208 (5) NAS-Identifier = "wism8" (5) Airespace-Wlan-Id = 3 (5) Service-Type = Framed-User (5) Framed-MTU = 1300 (5) NAS-Port-Type = Wireless-802.11 (5) Tunnel-Type:0 = VLAN (5) Tunnel-Medium-Type:0 = IEEE-802 (5) Tunnel-Private-Group-Id:0 = "547" (5) EAP-Message = 0x020700061900 (5) State = 0x05016e00b7ba0f346d696f996ec2a586 (5) Message-Authenticator = 0x96dc59cdbca6df009be0b9cbd5443481 (5) Running section authorize from file /etc/raddb/sites-enabled/vpi (5) authorize { (5) wism-checks { (5) if (Service-Type == "NAS-Prompt-User") { (5) ... (5) } (5) } # wism-checks (notfound) (5) preprocess (ok) (5) uob_auth_log - EXPAND /var/log/radius/radacct/%{%{Virtual-Server}:-UNKNOWN}/auth-detail.log (5) uob_auth_log - --> /var/log/radius/radacct/vpi/auth-detail.log (5) uob_auth_log - /var/log/radius/radacct/%{%{Virtual-Server}:-UNKNOWN}/auth-detail.log expands to /var/log/radius/radacct/vpi/auth-detail.log (5) uob_auth_log - EXPAND %t (5) uob_auth_log - --> Tue Mar 15 14:59:02 2016 (5) uob_auth_log (ok) (5) if (User-Name !~ /^host\/.+\.bris(tol)?\.ac\.uk$/i) { (5) ... (5) } (5) vpieap - Peer sent EAP Response (code 2) ID 7 length 6 (5) vpieap - Continuing tunnel setup (5) vpieap (ok) (5) } # authorize (ok) (5) Using 'Auth-Type = vpieap' for authenticate {...} (5) Running Auth-Type vpieap from file /etc/raddb/sites-enabled/vpi (5) authenticate { (5) vpieap - Peer sent packet with EAP method PEAP (25) (5) vpieap - Calling submodule eap_peap to process data (5) eap_peap - Continuing EAP-TLS (5) eap_peap - Peer ACKed our handshake fragment. handshake is finished (5) eap_peap - [eap-tls verify] = success (5) eap_peap - [eap-tls process] = success (5) eap_peap - Session established. Decoding tunneled data (5) eap_peap - PEAP state TUNNEL ESTABLISHED (5) eap_peap - Sending complete TLS record (37 bytes) (5) vpieap - Sending EAP Request (code 1) ID 8 length 47 (5) vpieap (handled) (5) } # authenticate (handled) (5) Using Post-Auth-Type Challenge (5) Post-Auth-Type sub-section not found. Ignoring. (5) Running Post-Auth-Type Challenge from file /etc/raddb/sites-enabled/vpi (5) Sent Access-Challenge Id 161 from 137.222.8.134:16020 to 172.17.107.208:32770 via ens192 length 0 (5) EAP-Message = 0x0108002f19800000002517030100205f34f3a684a6f8a6c27272a92b19c76ee8552b4ea7b442e2ff9d4c5027a36f41 (5) Message-Authenticator = 0x00000000000000000000000000000000 (5) State = 0x06036e003ffa67036d696f996ec2a586 (5) Finished request Waking up in 4.9 seconds. (0) Cleaning up request packet ID 156 with timestamp +3 (1) Cleaning up request packet ID 157 with timestamp +3 (2) Cleaning up request packet ID 158 with timestamp +3 (3) Cleaning up request packet ID 159 with timestamp +3 (4) Cleaning up request packet ID 160 with timestamp +3 (5) Cleaning up request packet ID 161 with timestamp +3 Ready to process requests Ready to process requests Signalled to terminate Exiting normally !!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!! !! EAP session 0x2ab6bf0 did not finish! !! !! See http://wiki.freeradius.org/guide/Certificate_Compatibility !! !!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!! rlm_sql (uobsql) - Removing connection pool rlm_sql (uobsql) - Closing connection (0) rlm_sql_mysql - Socket destructor called, closing socket rlm_mschap (eduroammschap) - Removing connection pool rlm_mschap (eduroammschap) - Closing connection (4) rlm_mschap (eduroammschap) - Closing connection (3) rlm_mschap (eduroammschap) - Closing connection (2) rlm_mschap (eduroammschap) - Closing connection (1) rlm_mschap (eduroammschap) - Closing connection (0) rlm_sql (uobsql-write) - Removing connection pool rlm_sql (uobsql-write) - Closing connection (0) rlm_sql_mysql - Socket destructor called, closing socket rlm_ldap (uobldap) - Removing connection pool rlm_ldap (uobldap) - Closing connection (4) rlm_ldap (uobldap) - Closing connection (3) rlm_ldap (uobldap) - Closing connection (2) rlm_ldap (uobldap) - Closing connection (1) rlm_ldap (uobldap) - Closing connection (0) -- Jonathan Gazeley Senior Systems Administrator IT Services University of Bristol

8 21