- Freeradius-Users - lists.freeradius.org

Server certificate renewal
by douglas eseng 11 Jan '16

11 Jan '16

Not strictly freeradius issue, perhaps those on the list have insight on the issue. Using freeradius for PEAP authentication, server cert is signed by private CA. We don't use profile to install the CA cert onto iOS devices. After renewal of server cert, existing iOS devices ask user to again trust the cert. Is this normal behaviour? Since it was a renewal, would have thought it is recognized as the same cert and remain trusted. Anyone know once user trusted the cert, what digest/fingerprint of the cert does IOS remember? Unable to find info on this from Apple's site. Thanks.

5 5

Question on anonymous identity
by Mathieu Simon (Lists) 11 Jan '16

11 Jan '16

Hi, A question surfaced recently while I was reworking a configuration: By building 3.0 from source I saw that the upcoming 3.0.11 will be actively logging that anonymous identities should be used* to protect identities. I'm not with eduroam, but try to keep an eye on what participating institutions and others recommend. I see they generally tell users to set one (where possible). The profile data from cat.eduroam.org also contains one. We always recommended students to set an anonymous identity and profiles/config tools given to them would set it for them, but it wasn't actively enforced. If the device wasn't configured for sending an anonymous identity it would still let the device in, if inner-tunnel authentication and authorization requirements passed.** So, what is the current take: Would you / Do you (recommend) enforcing the use of an anonymous identity, resulting in Access-Reject? Do most enduser wireless devices finally support setting an anonymous identity these days? Thanks in advance Mathieu * https://github.com/FreeRADIUS/freeradius-server/commit/ec5cb167dd1de6d3c8e7…

3 4

Re: Logging (was: Freeradius-Users Digest, Vol 129, Issue 3)
by Stefan Paetow 08 Jan '16

08 Jan '16

>Yes, 'detail' is included in the accounting section. Ok, that's not going to log then. It will only log when it gets accounting packets. Look at the 'default' server. In the post-auth section you'll see a reply_log entry that is commented out by default. If you uncomment this, it will start logging entries as per the 'reply_log' line log that is defined in the 'detail.log' module in mods-available. However, note that this will *not* be a single-line entry (which is what's recommended by the eduroam operator in the UK). Look at https://github.com/FreeRADIUS/freeradius-server/blob/v2.x.x/raddb/modules/l inelog for the current linelog for v2.x. If you're on 3.x, go to https://github.com/FreeRADIUS/freeradius-server/blob/v3.0.x/raddb/mods-avai lable/linelog - This will come in handy when doing what the Confluence page you found says. >Log file enclosed in ZIP format. Don't do that. Archives are stripped. A simple freeradius -X output capture is useful. >I found this website which may help to enable logging, looks like logging >functionality is different between 2.1.10 and 2.1.12. >http://confluence.diamond.ac.uk/pages/viewpage.action?pageId=22252353 Ahhh... My history comes back to haunt me... ;-) You may want to set up two of the three line logs defined on that page: eduroam_log and inner_auth_log. To log to the *log* directory, do *not* set 'filename' to 'syslog'. Instead set it to whatever you wanted the filename to be... "${logdir}/linelog" is the default in linelog. Tweak that appropriately for the inner_auth_log (if you want to log authentication of your own users separately). Then, like the page says, call 'eduroam_log' in the post-auth section, or, better yet, in the post-proxy section of your eduroam server, since post-proxy gets hit by an incoming reply from a home organisation before post-auth does (and post-auth also gets hit by your own users after their authentication reply returns from the inner-tunnel server). Also, like the page says, call 'inner_auth_log' from the post-auth section of your inner-tunnel. Stop your server. Start it in debug mode. Then hit it with an authentication request (for your own user). You should with any luck get an entry in your inner-tunnel authentication log. Then, if you have a test subject from another institution, get them to authenticate through eduroam and see what happens. Like Alan and others have pointed out, the module files are liberally commented so that it is easier to understand the operation of the server (and what the options do). Of course, if you strip out all comments for a bare-bones configuration, then yes, it becomes distinctly more difficult (or you spend a lot of time on Github to understand what each file does). :-) Stefan Paetow Moonshot Industry & Research Liaison Coordinator t: +44 (0)1235 822 125 gpg: 0x3FCE5142 xmpp: stefanp(a)jabber.dev.ja.net skype: stefan.paetow.janet jisc.ac.uk Networkshop44, University of Manchester. Save the date: 22-24 March, 2016. #NWS44 Jisc is a registered charity (number 1149740) and a company limited by guarantee which is registered in England under Company No. 5747339, VAT No. GB 197 0632 86. Jisc¹s registered office is: One Castlepark, Tower Hill, Bristol, BS2 0JA. T 0203 697 5800. Jisc Collections and Janet Ltd. is a wholly owned Jisc subsidiary and a company limited by guarantee which is registered in England under Company No. number 2881024, VAT No. GB 197 0632 86. The registered office is: Lumen House, Library Avenue, Harwell, Didcot, Oxfordshire, OX11 0SG. T 01235 822200. >

1 0

RE: Freeradius-Users Digest, Vol 129, Issue 3
by Peter Hutchison 08 Jan '16

08 Jan '16

>> We have set up Freeradius on Ubuntu 14.04 LTS but having trouble to >> get it to generating authorization logs for our 'eduroam' >> virtual server. >What does this virtual server do / when is it called? Allows users to authenticate on wireless network using Eduroam with their Active Directory login user (+ domain) and password. Users do authenticate ok no problem, but it is not logging requests for some reason to the /var/log/freeradius/radius-eduroam-yyyy-mm-dd.log >Do you call the linelog or detail modules in any of its sections? Yes, 'detail' is included in the accounting section. >> It is generating logs ok for the default and inner-tunnel but not >> eduroam. I have checked and re-checked the configuration with no >> result. You need to look at the debug output. On ubuntu run it as "freeradius -X" and examine the output then authenticate something you expect to get logs for. > /etc/freeradius/radius.conf log section looks like this: Mostly not useful - you really want linelog or detail, not the main server logging. It’s the requests logging I am interested in which doesn't seem to work. >> And in our eduroam file in sites-available (with link file in >> sites-enabled) has 'auth_log' enabled to in the authorize section. > Any ideas why the log isn't being generated when users connect to it? >Check -X debug output. I cannot see anything obvious, no mention of log being created or updated. >Send the debug here if it doesn't make sense, though it's fairly straightforward to read (if verbose). Right from the FreeRADIUS banner at the >top and including an authentication packet. >A small suspicion is that you might need to put logging in pre/post-proxy sections if you're trying to log non-local auths. I have updated those sections but made no difference with following lines: Pre_proxy_log Post_proxy_log ---- Update: Log file enclosed in ZIP format. I found this website which may help to enable logging, looks like logging functionality is different between 2.1.10 and 2.1.12. http://confluence.diamond.ac.uk/pages/viewpage.action?pageId=22252353 Peter Hutchison MCP Senior Network Systems SpecialistS S 01484 473716 Infrastructure Team University of Huddersfield | Queensgate | Huddersfield | HD1 3DH University of Huddersfield inspiring tomorrow's professionals. [http://marketing.hud.ac.uk/_HOSTED/EmailSig2014/EmailSigFooter.jpg] This transmission is confidential and may be legally privileged. If you receive it in error, please notify us immediately by e-mail and remove it from your system. If the content of this e-mail does not relate to the business of the University of Huddersfield, then we do not endorse it and will accept no liability.

2 1

case-statement regex
by O'Connell, Ryan 07 Jan '16

07 Jan '16

Using version 3.0.10. Can’t seem to implement regex matching with case statements. The request always results in “def” even though the string in the request contains “abc". switch DHCP-Subscriber-Id { case "/(abc)$/" { update control { &Pool-Name := “abc" } } case { update control { &Pool-Name := “def" } } } I have tried a bunch of different variations of the “case” without success. If I use the entire string in the case statement then I get the intended result “abc”. switch DHCP-Subscriber-Id { case 001122334455@abc { update control { &Pool-Name := “abc" } } case { update control { &Pool-Name := “def" } } } Does anyone have a suggestion on how to implement this? I haven’t been able to find examples in the documentation or google about doing this specifically. The same logic implemented with if/else works fine but I was hoping to use switch/case for performance. if (&DHCP-Subscriber-Id =~ /(abc)$/){ update control { &Pool-Name := “abc" } } else { update control { &Pool-Name := “def" } } Thanks, Ryan

2 4

RE: Safe characters, old and new versions of 3.1.0
by Franks Andy (IT Technical Architecture Manager) 07 Jan '16

07 Jan '16

Thanks Alan, that's really useful info, especially the fix - makes good sense. I was doubtful about the older server and what was written to SQL whether it was actually right or not, so this seems better anyway. I've never seen a date expressed with backslashes, dashes yes, forward slashes yes, but backslash is umm, different. Again, thanks very much. Andy -----Original Message----- From: Freeradius-Users [mailto:freeradius-users-bounces+andy.franks=sath.nhs.uk@lists.freeradius.org] On Behalf Of Alan DeKok Sent: 07 January 2016 14:36 To: FreeRadius users mailing list Subject: Re: Safe characters, old and new versions of 3.1.0 On Jan 7, 2016, at 8:13 AM, Franks Andy (IT Technical Architecture Manager) <Andy.Franks(a)sath.nhs.uk> wrote: > We're seeing differences in the way unusual characters are handled in the older version when compared with the newer, in terms of the way variable values with certain characters are expanded. The older versions uses "safe_characters" to determine which characters were "safe". The newer version uses the escape functions provided by the SQL driver. Which is better. Different, but better. > The main problem is it mucks up the SQL character writing - the frontend comes up with an odd asci character that in theory shouldn't be written according to the "safe characters" list afaics. > I can't change what's in the ldap description field we use as the source of this attribute unfortunately - a third party system writes into it which we have no change access to. OK... > Anyway, below are examples on old and new of the ldap attribute source, an example variable expansion of that attribute and lastly what goes into SQL. The examples aren't quite indentical as one is a live system that's so busy it's hard to get exactly the same string from it. Generally the string is "Amended by Directory Manager dd\mm\yyyy" in AD, but that comes over to ldap as dd\\mm?y for some reason, The "backslash digit" is typically used as an escape sequence for special characters. > presumably because of weird characters in the string that look ok in AD console. What gets inserted after that into SQL is, on the old server, > > "Amended by Directory Manager dd(asciicode)mm(asciicode)yy" > Which appears fine within mysql. And is still wrong, to be honest. > On the new server > > "Amended by Directory Manager dd\\mm?y" plus some other non-visible stuff I guess, which isn't fine. In SQL is looks like a square box, not sure of the actual ascii code. It's the escaping. > This character doesn't seem to be part of the "safe characters". Also on the old server and new one, the ordinary backslash makes its way through to sql but I can't see it on the SC list. > Any ideas?! Is there any way of replicating old behaviour or fixing the new? Re-write the date string in FreeRADIUS so that it uses forward slashes instead of backslashes. The easiest way to do this might be to use a regular expression. to parse the string into chunks, and the re-assemble the chunks: if (&control:Ldap-UserDescription =~ /(..).(..).(....)$/) { update control { Ldap-UserDescription := "Amended by Directory Manager %{1}/%{2}/%{3}" } } The simple lesson is "don't use backslashes". The third-party system you're using is broken. Happily, you should be able to fix it with FreeRADIUS. Alan DeKok. - List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html

1 0

proxy implementation
by srithar jeevadurai 07 Jan '16

07 Jan '16

Dear Friends, We have successfully implemented NAS <--> FreeRadius <--> IN However now we have to implement NAS <--> Proxy (auth + acct) <--> FreeRadius <--> IN Can you please help me on the same? When we tried, proxy server is giving below error message. 1. *Auth: Login incorrect: [newhostt(a)domainserver.com <testhost(a)server.com>] (from client 222.222.222.90 port 16634 cli 3455534333)* Proxy server is trying to validate the user however as per my understanding, it has to forward to home server instead of validating the user. Please let me know if you need any configuration files to be uploaded, I will send the same in the email. 1. Proxy server does not obtain persistent connection to home servers and the connection is only when it forwards request (auth or act) home server. Is our understanding correct? because We are doubt that proxy server is connecting to home server or not. -- Regards, Srithar Durairaj Alternate Mail I.D: srijeevadurai1(a)yahoo.co.in Mobile: +919886251852

2 3

Safe characters, old and new versions of 3.1.0
by Franks Andy (IT Technical Architecture Manager) 07 Jan '16

07 Jan '16

Hi all, Sorry to post so much, struggling with differences again in the newer version of FR I have on a server. The older is 3.1.0 git #390f216, the newer 3.1.0 git #f4d5ff6. We're seeing differences in the way unusual characters are handled in the older version when compared with the newer, in terms of the way variable values with certain characters are expanded. The main problem is it mucks up the SQL character writing - the frontend comes up with an odd asci character that in theory shouldn't be written according to the "safe characters" list afaics. I can't change what's in the ldap description field we use as the source of this attribute unfortunately - a third party system writes into it which we have no change access to. Anyway, below are examples on old and new of the ldap attribute source, an example variable expansion of that attribute and lastly what goes into SQL. The examples aren't quite indentical as one is a live system that's so busy it's hard to get exactly the same string from it. Generally the string is "Amended by Directory Manager dd\mm\yyyy" in AD, but that comes over to ldap as dd\\mm?y for some reason, presumably because of weird characters in the string that look ok in AD console. What gets inserted after that into SQL is, on the old server, "Amended by Directory Manager dd(asciicode)mm(asciicode)yy" Which appears fine within mysql. On the new server "Amended by Directory Manager dd\\mm?y" plus some other non-visible stuff I guess, which isn't fine. In SQL is looks like a square box, not sure of the actual ascii code. This character doesn't seem to be part of the "safe characters". Also on the old server and new one, the ordinary backslash makes its way through to sql but I can't see it on the SC list. Any ideas?! Is there any way of replicating old behaviour or fixing the new? Thanks Andy Old server (35) ldap3: control:Ldap-UserDescription := 'Amended by Directory Manager 26\\08?5' Variable expansion (35) EXPAND %{control:LinelogString}, DESC: %{control:Ldap-UserDescription} (35) --> 07-01-2016 11:13:51, WEBSTERC(a)SATH.nhs.uk, Accept, DESC: Amended by Directory Manager 26\\08\2015 Sql config: safe_characters = "@abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ0123456789.-_: /" Insert 'Amended by Directory Manager 26=5C08=815' New server (10) ldap5: control:Ldap-UserDescription := 'Amended by Directory Manager 02\\12?4' Variable expansion (10) EXPAND %{control:LinelogString}, DESC: %{control:Ldap-UserDescription} (10) --> 07-01-2016 10:48:56, franksa, Accept, DESC: Amended by Directory Manager 02\\12\2014 '%{control:Ldap-UserDescription}' Sql config: safe_characters = "@abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ0123456789.-_: /" Insert Amended by Directory Manager 02\\12?4'

2 1

RE: Freeradius-Users Digest, Vol 129, Issue 10
by Peter Hutchison 07 Jan '16

07 Jan '16

>Hi, > TBH, iu cant recall if expansions work for that section in radiusd.conf - if theres a quirky bug it wont get fixed in 2.1.12 Our Ubuntu server setup uses packages from http://packages.ubuntu.com using apt-get, they are still providing v2.1.12 and they have not changed to v3 yet. Not sure why Ubuntu support have not updated the packages for customers when its out of date.... >but for logging there are 2 ways that do work....and should work fine >1) use the 'detail' module >2) use linelog The detail log is not really what I want. I just want to record requests. It is working for 'default' and 'inner-tunnel' but nothing else :( I tried the linelog method, and that didn't work either. No logs generated. I am not even sure that detail logging is working either. There are a couple of old log files in the radacct directory but nothing newer. >for the details module - i think you are using this(!) ? you should be looking at modules/detail.log file - as thats the file that is actuslly >used for auth_log et al >and if %{Virtual-Server} expansion doesnt work there - easy, just create a new detail entry eg >eduroam_auth_log and call that instead of auth_log in relevant section of the virtual server - and do the same for the other calls to log >functions >eg >detail eduroam_auth_log { > detailfile = ${radacctdir}/%{%{Packet-Src-IP-Address}:-%{Packet-Src-IPv6-Address}}/auth-detail-%Y%m%d > detailperm = 0600 > suppress { > User-Password > EAP-MSK > EAP-EMSK > EAP-Message > MS-MPPE-Recv-Key > MS-MPPE-Send-Key > MS-MPPE-Encryption-Policy > MS-MPPE-Encryption-Types > } } > ..for linelog, simply look at the modules/linelog file and configure as required....or make a new one eg >linelog eduroam-linelog { ><put config here!> >} > and then call linelog in relevant place to capture required bits - linelog is generally better as the output can be nicely customised to >contain exactly the stuff needed in format needed... I tried this method, freeradius -X started up ok. But no logs generated... I am stuck at this point. >obviously there are many other methods - eg using the buffered-sql virtual server and copying detail output asynchronously to an SQL server so >you have logs in database format (great for searching) >some of this may only be applicable to 2.2.x - but thats what you should be running as a minimum these days (and even that is around end of >support time) Any other ideas? BTW, what version of Freeradius are you using? Peter Hutchison MCP Senior Network Systems SpecialistS S 01484 473716 Infrastructure Team University of Huddersfield | Queensgate | Huddersfield | HD1 3DH University of Huddersfield inspiring tomorrow's professionals. [http://marketing.hud.ac.uk/_HOSTED/EmailSig2014/EmailSigFooter.jpg] This transmission is confidential and may be legally privileged. If you receive it in error, please notify us immediately by e-mail and remove it from your system. If the content of this e-mail does not relate to the business of the University of Huddersfield, then we do not endorse it and will accept no liability.

3 2

Fwd: FreeRADIUS + Cisco + Active Directory
by Rashad Hall 06 Jan '16

06 Jan '16

I am pretty sure my approach to this is all wrong so I've decided to seek the help of the experts. I have configured a FreeRADIUS server that authenticates our wifi users with EAP-TLS and will also authenticate users for our network devices. Our network devices are mainly Cisco and I need these devices to authenticate users based on their Active Directory credentials. Wifi portion is complete, but having trouble with using FreeRADIUS to check AD credentials correctly. I decided to use MSCHAP (my mistake I believe) for Authentication and my "radtests" are successful, but when trying to log into a switch I set up for testing I am unsuccessful. I believe the switch only uses PAP and does not have the capability to use MSCHAP but I am unsure of how to set up PAP to query AD or somehow convert the PAP request into an MSCHAP request server side. Can anyone tell me the best most secure approach to accomplishing my goal (if possible, I must suck at Googling)? In the future I'd also like to assign Cisco priv levels based on groups a user belongs to in AD. Below is debug output showing first a successful radtest and then the unsuccessful login into the switch. radiusd -X Copyright (C) 1999-2015 The FreeRADIUS server project and contributors There is NO warranty; not even for MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE You may redistribute copies of FreeRADIUS under the terms of the GNU General Public License For more information about these matters, see the file named COPYRIGHT Starting - reading configuration files ... including dictionary file /usr/local/share/freeradius/dictionary including dictionary file /usr/local/share/freeradius/dictionary.dhcp including dictionary file /usr/local/share/freeradius/dictionary.vqp including dictionary file /usr/local/etc/raddb/dictionary including configuration file /usr/local/etc/raddb/radiusd.conf including configuration file /usr/local/etc/raddb/proxy.conf including configuration file /usr/local/etc/raddb/clients.conf including files in directory /usr/local/etc/raddb/mods-enabled/ including configuration file /usr/local/etc/raddb/mods-enabled/mschap including configuration file /usr/local/etc/raddb/mods-enabled/replicate including configuration file /usr/local/etc/raddb/mods-enabled/detail including configuration file /usr/local/etc/raddb/mods-enabled/echo including configuration file /usr/local/etc/raddb/mods-enabled/sradutmp including configuration file /usr/local/etc/raddb/mods-enabled/dhcp including configuration file /usr/local/etc/raddb/mods-enabled/utf8 including configuration file /usr/local/etc/raddb/mods-enabled/soh including configuration file /usr/local/etc/raddb/mods-enabled/unpack including configuration file /usr/local/etc/raddb/mods-enabled/logintime including configuration file /usr/local/etc/raddb/mods-enabled/attr_filter including configuration file /usr/local/etc/raddb/mods-enabled/detail.log including configuration file /usr/local/etc/raddb/mods-enabled/dynamic_clients including configuration file /usr/local/etc/raddb/mods-enabled/ntlm_auth including configuration file /usr/local/etc/raddb/mods-enabled/expr including configuration file /usr/local/etc/raddb/mods-enabled/chap including configuration file /usr/local/etc/raddb/mods-enabled/linelog including configuration file /usr/local/etc/raddb/mods-enabled/eap including configuration file /usr/local/etc/raddb/mods-enabled/files including configuration file /usr/local/etc/raddb/mods-enabled/radutmp including configuration file /usr/local/etc/raddb/mods-enabled/cache_eap including configuration file /usr/local/etc/raddb/mods-enabled/pap including configuration file /usr/local/etc/raddb/mods-enabled/exec including configuration file /usr/local/etc/raddb/mods-enabled/preprocess including configuration file /usr/local/etc/raddb/mods-enabled/always including configuration file /usr/local/etc/raddb/mods-enabled/realm including configuration file /usr/local/etc/raddb/mods-enabled/expiration including files in directory /usr/local/etc/raddb/policy.d/ including configuration file /usr/local/etc/raddb/policy.d/abfab-tr including configuration file /usr/local/etc/raddb/policy.d/accounting including configuration file /usr/local/etc/raddb/policy.d/cui including configuration file /usr/local/etc/raddb/policy.d/debug including configuration file /usr/local/etc/raddb/policy.d/dhcp including configuration file /usr/local/etc/raddb/policy.d/canonicalization including configuration file /usr/local/etc/raddb/policy.d/eap including configuration file /usr/local/etc/raddb/policy.d/filter including configuration file /usr/local/etc/raddb/policy.d/operator-name including configuration file /usr/local/etc/raddb/policy.d/control including files in directory /usr/local/etc/raddb/sites-enabled/ including configuration file /usr/local/etc/raddb/sites-enabled/CUSTOM main { security { allow_core_dumps = no } name = "radiusd" prefix = "/usr/local" localstatedir = "/var" logdir = "/var/log" run_dir = "/var/run/radiusd" } main { name = "radiusd" prefix = "/usr/local" localstatedir = "/var" sbindir = "/usr/local/sbin" logdir = "/var/log" run_dir = "/var/run/radiusd" libdir = "/usr/local/lib/freeradius-3.0.10" radacctdir = "/var/log/radacct" hostname_lookups = yes max_request_time = 30 cleanup_delay = 5 max_requests = 16384 pidfile = "/var/run/radiusd/radiusd.pid" checkrad = "/usr/local/sbin/checkrad" debug_level = 0 proxy_requests = no log { stripped_names = no auth = no auth_badpass = yes auth_goodpass = no colourise = yes msg_denied = "You are already logged in - access denied" } resources { } security { max_attributes = 200 reject_delay = 1.000000 status_server = yes allow_vulnerable_openssl = "no" } } radiusd: #### Loading Realms and Home Servers #### proxy server { retry_delay = 5 retry_count = 3 default_fallback = no dead_time = 120 wake_all_if_all_dead = no } home_server localhost { ipaddr = 127.0.0.1 port = 1812 type = "auth" secret = <<< secret >>> response_window = 20.000000 response_timeouts = 1 max_outstanding = 65536 zombie_period = 40 status_check = "status-server" ping_interval = 30 check_interval = 30 check_timeout = 4 num_answers_to_alive = 3 revive_interval = 120 limit { max_connections = 16 max_requests = 0 lifetime = 0 idle_timeout = 0 } coa { irt = 2 mrt = 16 mrc = 5 mrd = 30 } } home_server_pool my_auth_failover { type = fail-over home_server = localhost } realm example.com { auth_pool = my_auth_failover } realm LOCAL { } radiusd: #### Loading Clients #### Debugger not attached radiusd: #### Instantiating modules #### # Loaded module rlm_mschap # Loading module "mschap" from file /usr/local/etc/raddb/mods-enabled/mschap mschap { use_mppe = no require_encryption = no require_strong = yes with_ntdomain_hack = yes ntlm_auth = "/usr/local/bin/ntlm_auth --request-nt-key --username=%{%{Stripped-User-Name}:-%{%{User-Name}:-None}} --domain=%{%{mschap:NT-Domain}:-CUSTOM} --challenge=%{%{mschap:Challenge}:-00} --nt-response=%{%{mschap:NT-Response}:-00}" passchange { } allow_retry = yes } # Loaded module rlm_replicate # Loading module "replicate" from file /usr/local/etc/raddb/mods-enabled/replicate # Loaded module rlm_detail # Loading module "detail" from file /usr/local/etc/raddb/mods-enabled/detail detail { filename = "/var/log/radacct/%{%{Packet-Src-IP-Address}:-%{Packet-Src-IPv6-Address}}/detail-%Y%m%d" header = "%t" permissions = 384 locking = no escape_filenames = no log_packet_header = no } # Loaded module rlm_exec # Loading module "echo" from file /usr/local/etc/raddb/mods-enabled/echo exec echo { wait = yes program = "/bin/echo %{User-Name}" input_pairs = "request" output_pairs = "reply" shell_escape = yes } # Loaded module rlm_radutmp # Loading module "sradutmp" from file /usr/local/etc/raddb/mods-enabled/sradutmp radutmp sradutmp { filename = "/var/log/sradutmp" username = "%{User-Name}" case_sensitive = yes check_with_nas = yes permissions = 420 caller_id = no } # Loaded module rlm_dhcp # Loading module "dhcp" from file /usr/local/etc/raddb/mods-enabled/dhcp # Loaded module rlm_utf8 # Loading module "utf8" from file /usr/local/etc/raddb/mods-enabled/utf8 # Loaded module rlm_soh # Loading module "soh" from file /usr/local/etc/raddb/mods-enabled/soh soh { dhcp = yes } # Loaded module rlm_unpack # Loading module "unpack" from file /usr/local/etc/raddb/mods-enabled/unpack # Loaded module rlm_logintime # Loading module "logintime" from file /usr/local/etc/raddb/mods-enabled/logintime logintime { minimum_timeout = 60 } # Loaded module rlm_attr_filter # Loading module "attr_filter.post-proxy" from file /usr/local/etc/raddb/mods-enabled/attr_filter attr_filter attr_filter.post-proxy { filename = "/usr/local/etc/raddb/mods-config/attr_filter/post-proxy" key = "%{Realm}" relaxed = no } # Loading module "attr_filter.pre-proxy" from file /usr/local/etc/raddb/mods-enabled/attr_filter attr_filter attr_filter.pre-proxy { filename = "/usr/local/etc/raddb/mods-config/attr_filter/pre-proxy" key = "%{Realm}" relaxed = no } # Loading module "attr_filter.access_reject" from file /usr/local/etc/raddb/mods-enabled/attr_filter attr_filter attr_filter.access_reject { filename = "/usr/local/etc/raddb/mods-config/attr_filter/access_reject" key = "%{User-Name}" relaxed = no } # Loading module "attr_filter.access_challenge" from file /usr/local/etc/raddb/mods-enabled/attr_filter attr_filter attr_filter.access_challenge { filename = "/usr/local/etc/raddb/mods-config/attr_filter/access_challenge" key = "%{User-Name}" relaxed = no } # Loading module "attr_filter.accounting_response" from file /usr/local/etc/raddb/mods-enabled/attr_filter attr_filter attr_filter.accounting_response { filename = "/usr/local/etc/raddb/mods-config/attr_filter/accounting_response" key = "%{User-Name}" relaxed = no } # Loading module "auth_log" from file /usr/local/etc/raddb/mods-enabled/detail.log detail auth_log { filename = "/var/log/radacct/%{%{Packet-Src-IP-Address}:-%{Packet-Src-IPv6-Address}}/auth-detail-%Y%m%d" header = "%t" permissions = 384 locking = no escape_filenames = no log_packet_header = no } # Loading module "reply_log" from file /usr/local/etc/raddb/mods-enabled/detail.log detail reply_log { filename = "/var/log/radacct/%{%{Packet-Src-IP-Address}:-%{Packet-Src-IPv6-Address}}/reply-detail-%Y%m%d" header = "%t" permissions = 384 locking = no escape_filenames = no log_packet_header = no } # Loading module "pre_proxy_log" from file /usr/local/etc/raddb/mods-enabled/detail.log detail pre_proxy_log { filename = "/var/log/radacct/%{%{Packet-Src-IP-Address}:-%{Packet-Src-IPv6-Address}}/pre-proxy-detail-%Y%m%d" header = "%t" permissions = 384 locking = no escape_filenames = no log_packet_header = no } # Loading module "post_proxy_log" from file /usr/local/etc/raddb/mods-enabled/detail.log detail post_proxy_log { filename = "/var/log/radacct/%{%{Packet-Src-IP-Address}:-%{Packet-Src-IPv6-Address}}/post-proxy-detail-%Y%m%d" header = "%t" permissions = 384 locking = no escape_filenames = no log_packet_header = no } # Loaded module rlm_dynamic_clients # Loading module "dynamic_clients" from file /usr/local/etc/raddb/mods-enabled/dynamic_clients # Loading module "ntlm_auth" from file /usr/local/etc/raddb/mods-enabled/ntlm_auth exec ntlm_auth { wait = yes program = "/usr/local/bin/ntlm_auth --request-nt-key --domain=CUSTOM --username=%{mschap:User-Name} --password=%{User-Password}" shell_escape = yes } # Loaded module rlm_expr # Loading module "expr" from file /usr/local/etc/raddb/mods-enabled/expr expr { safe_characters = "@abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ0123456789.-_: /äéöüàâæçèéêëîïôœùûüaÿÄÉÖÜßÀÂÆÇÈÉÊËÎÏÔŒÙÛÜŸ" } # Loaded module rlm_chap # Loading module "chap" from file /usr/local/etc/raddb/mods-enabled/chap # Loaded module rlm_linelog # Loading module "linelog" from file /usr/local/etc/raddb/mods-enabled/linelog linelog { filename = "/var/log/linelog" escape_filenames = no syslog_severity = "info" permissions = 384 format = "This is a log message for %{User-Name}" reference = "messages.%{%{reply:Packet-Type}:-default}" } # Loading module "log_accounting" from file /usr/local/etc/raddb/mods-enabled/linelog linelog log_accounting { filename = "/var/log/linelog-accounting" escape_filenames = no syslog_severity = "info" permissions = 384 format = "" reference = "Accounting-Request.%{%{Acct-Status-Type}:-unknown}" } # Loaded module rlm_eap # Loading module "eap" from file /usr/local/etc/raddb/mods-enabled/eap eap { default_eap_type = "tls" timer_expire = 60 ignore_unknown_eap_types = no cisco_accounting_username_bug = no max_sessions = 16384 } # Loaded module rlm_files # Loading module "files" from file /usr/local/etc/raddb/mods-enabled/files files { filename = "/usr/local/etc/raddb/mods-config/files/authorize" usersfile = "/usr/local/etc/raddb/mods-config/files/authorize" acctusersfile = "/usr/local/etc/raddb/mods-config/files/accounting" preproxy_usersfile = "/usr/local/etc/raddb/mods-config/files/pre-proxy" } # Loading module "radutmp" from file /usr/local/etc/raddb/mods-enabled/radutmp radutmp { filename = "/var/log/radutmp" username = "%{User-Name}" case_sensitive = yes check_with_nas = yes permissions = 384 caller_id = yes } # Loaded module rlm_cache # Loading module "cache_eap" from file /usr/local/etc/raddb/mods-enabled/cache_eap cache cache_eap { driver = "rlm_cache_rbtree" key = "%{%{control:State}:-%{%{reply:State}:-%{State}}}" ttl = 15 max_entries = 0 epoch = 0 add_stats = no } # Loaded module rlm_pap # Loading module "pap" from file /usr/local/etc/raddb/mods-enabled/pap pap { normalise = yes } # Loading module "exec" from file /usr/local/etc/raddb/mods-enabled/exec exec { wait = no input_pairs = "request" shell_escape = yes timeout = 10 } # Loaded module rlm_preprocess # Loading module "preprocess" from file /usr/local/etc/raddb/mods-enabled/preprocess preprocess { huntgroups = "/usr/local/etc/raddb/mods-config/preprocess/huntgroups" hints = "/usr/local/etc/raddb/mods-config/preprocess/hints" with_ascend_hack = no ascend_channels_per_line = 23 with_ntdomain_hack = no with_specialix_jetstream_hack = no with_cisco_vsa_hack = no with_alvarion_vsa_hack = no } # Loaded module rlm_always # Loading module "reject" from file /usr/local/etc/raddb/mods-enabled/always always reject { rcode = "reject" simulcount = 0 mpp = no } # Loading module "fail" from file /usr/local/etc/raddb/mods-enabled/always always fail { rcode = "fail" simulcount = 0 mpp = no } # Loading module "ok" from file /usr/local/etc/raddb/mods-enabled/always always ok { rcode = "ok" simulcount = 0 mpp = no } # Loading module "handled" from file /usr/local/etc/raddb/mods-enabled/always always handled { rcode = "handled" simulcount = 0 mpp = no } # Loading module "invalid" from file /usr/local/etc/raddb/mods-enabled/always always invalid { rcode = "invalid" simulcount = 0 mpp = no } # Loading module "userlock" from file /usr/local/etc/raddb/mods-enabled/always always userlock { rcode = "userlock" simulcount = 0 mpp = no } # Loading module "notfound" from file /usr/local/etc/raddb/mods-enabled/always always notfound { rcode = "notfound" simulcount = 0 mpp = no } # Loading module "noop" from file /usr/local/etc/raddb/mods-enabled/always always noop { rcode = "noop" simulcount = 0 mpp = no } # Loading module "updated" from file /usr/local/etc/raddb/mods-enabled/always always updated { rcode = "updated" simulcount = 0 mpp = no } # Loaded module rlm_realm # Loading module "IPASS" from file /usr/local/etc/raddb/mods-enabled/realm realm IPASS { format = "prefix" delimiter = "/" ignore_default = no ignore_null = no } # Loading module "suffix" from file /usr/local/etc/raddb/mods-enabled/realm realm suffix { format = "suffix" delimiter = "@" ignore_default = no ignore_null = no } # Loading module "realmpercent" from file /usr/local/etc/raddb/mods-enabled/realm realm realmpercent { format = "suffix" delimiter = "%" ignore_default = no ignore_null = no } # Loading module "ntdomain" from file /usr/local/etc/raddb/mods-enabled/realm realm ntdomain { format = "prefix" delimiter = "\\" ignore_default = no ignore_null = no } # Loaded module rlm_expiration # Loading module "expiration" from file /usr/local/etc/raddb/mods-enabled/expiration instantiate { } modules { # Instantiating module "mschap" from file /usr/local/etc/raddb/mods-enabled/mschap rlm_mschap (mschap): authenticating by calling 'ntlm_auth' # Instantiating module "detail" from file /usr/local/etc/raddb/mods-enabled/detail # Instantiating module "logintime" from file /usr/local/etc/raddb/mods-enabled/logintime # Instantiating module "attr_filter.post-proxy" from file /usr/local/etc/raddb/mods-enabled/attr_filter reading pairlist file /usr/local/etc/raddb/mods-config/attr_filter/post-proxy # Instantiating module "attr_filter.pre-proxy" from file /usr/local/etc/raddb/mods-enabled/attr_filter reading pairlist file /usr/local/etc/raddb/mods-config/attr_filter/pre-proxy # Instantiating module "attr_filter.access_reject" from file /usr/local/etc/raddb/mods-enabled/attr_filter reading pairlist file /usr/local/etc/raddb/mods-config/attr_filter/access_reject [/usr/local/etc/raddb/mods-config/attr_filter/access_reject]:11 Check item "FreeRADIUS-Response-Delay" found in filter list for realm "DEFAULT". [/usr/local/etc/raddb/mods-config/attr_filter/access_reject]:11 Check item "FreeRADIUS-Response-Delay-USec" found in filter list for realm "DEFAULT". # Instantiating module "attr_filter.access_challenge" from file /usr/local/etc/raddb/mods-enabled/attr_filter reading pairlist file /usr/local/etc/raddb/mods-config/attr_filter/access_challenge # Instantiating module "attr_filter.accounting_response" from file /usr/local/etc/raddb/mods-enabled/attr_filter reading pairlist file /usr/local/etc/raddb/mods-config/attr_filter/accounting_response # Instantiating module "auth_log" from file /usr/local/etc/raddb/mods-enabled/detail.log rlm_detail (auth_log): 'User-Password' suppressed, will not appear in detail output # Instantiating module "reply_log" from file /usr/local/etc/raddb/mods-enabled/detail.log # Instantiating module "pre_proxy_log" from file /usr/local/etc/raddb/mods-enabled/detail.log # Instantiating module "post_proxy_log" from file /usr/local/etc/raddb/mods-enabled/detail.log # Instantiating module "linelog" from file /usr/local/etc/raddb/mods-enabled/linelog # Instantiating module "log_accounting" from file /usr/local/etc/raddb/mods-enabled/linelog # Instantiating module "eap" from file /usr/local/etc/raddb/mods-enabled/eap # Linked to sub-module rlm_eap_md5 # Linked to sub-module rlm_eap_leap # Linked to sub-module rlm_eap_gtc gtc { challenge = "Password: " auth_type = "PAP" } # Linked to sub-module rlm_eap_tls tls { tls = "tls-common" } tls-config tls-common { rsa_key_exchange = no dh_key_exchange = yes rsa_key_length = 512 dh_key_length = 512 verify_depth = 0 ca_path = "/usr/local/etc/raddb/certs" pem_file_type = yes private_key_file = "/usr/local/etc/raddb/certs/freeradius.dev.network.com.key" certificate_file = "/usr/local/etc/raddb/certs/freeradius.dev.network.com.cer" ca_file = "/usr/local/etc/raddb/certs/CA.crt" dh_file = "/usr/local/etc/raddb/certs/dh4096.pem" fragment_size = 1024 include_length = yes check_crl = no check_all_crl = no cipher_list = "HIGH" ecdh_curve = "prime256v1" cache { enable = yes lifetime = 24 max_entries = 255 } verify { tmpdir = "/tmp/radiusd" client = "/usr/local/bin/openssl verify -CAfile /usr/local/etc/raddb/certs/SD-CUSTOM-CA.crt %{TLS-Client-Cert-Filename}" } ocsp { enable = no override_cert_url = yes url = "http://127.0.0.1/ocsp/" use_nonce = yes timeout = 0 softfail = no } } # Linked to sub-module rlm_eap_ttls ttls { tls = "tls-common" default_eap_type = "md5" copy_request_to_tunnel = no use_tunneled_reply = no virtual_server = "inner-tunnel" include_length = yes require_client_cert = no } tls: Using cached TLS configuration from previous invocation # Linked to sub-module rlm_eap_peap peap { tls = "tls-common" default_eap_type = "mschapv2" copy_request_to_tunnel = no use_tunneled_reply = no proxy_tunneled_request_as_eap = yes virtual_server = "inner-tunnel" soh = no require_client_cert = no } tls: Using cached TLS configuration from previous invocation # Linked to sub-module rlm_eap_mschapv2 mschapv2 { with_ntdomain_hack = no send_error = no } # Instantiating module "files" from file /usr/local/etc/raddb/mods-enabled/files reading pairlist file /usr/local/etc/raddb/mods-config/files/authorize reading pairlist file /usr/local/etc/raddb/mods-config/files/authorize reading pairlist file /usr/local/etc/raddb/mods-config/files/accounting reading pairlist file /usr/local/etc/raddb/mods-config/files/pre-proxy # Instantiating module "cache_eap" from file /usr/local/etc/raddb/mods-enabled/cache_eap rlm_cache (cache_eap): Driver rlm_cache_rbtree (module rlm_cache_rbtree) loaded and linked # Instantiating module "pap" from file /usr/local/etc/raddb/mods-enabled/pap # Instantiating module "preprocess" from file /usr/local/etc/raddb/mods-enabled/preprocess reading pairlist file /usr/local/etc/raddb/mods-config/preprocess/huntgroups reading pairlist file /usr/local/etc/raddb/mods-config/preprocess/hints # Instantiating module "reject" from file /usr/local/etc/raddb/mods-enabled/always # Instantiating module "fail" from file /usr/local/etc/raddb/mods-enabled/always # Instantiating module "ok" from file /usr/local/etc/raddb/mods-enabled/always # Instantiating module "handled" from file /usr/local/etc/raddb/mods-enabled/always # Instantiating module "invalid" from file /usr/local/etc/raddb/mods-enabled/always # Instantiating module "userlock" from file /usr/local/etc/raddb/mods-enabled/always # Instantiating module "notfound" from file /usr/local/etc/raddb/mods-enabled/always # Instantiating module "noop" from file /usr/local/etc/raddb/mods-enabled/always # Instantiating module "updated" from file /usr/local/etc/raddb/mods-enabled/always # Instantiating module "IPASS" from file /usr/local/etc/raddb/mods-enabled/realm # Instantiating module "suffix" from file /usr/local/etc/raddb/mods-enabled/realm # Instantiating module "realmpercent" from file /usr/local/etc/raddb/mods-enabled/realm # Instantiating module "ntdomain" from file /usr/local/etc/raddb/mods-enabled/realm # Instantiating module "expiration" from file /usr/local/etc/raddb/mods-enabled/expiration } # modules radiusd: #### Loading Virtual Servers #### server { # from file /usr/local/etc/raddb/radiusd.conf } # server server WIFI { # from file /usr/local/etc/raddb/sites-enabled/CUSTOM # Loading authenticate {...} # Loading authorize {...} # Loading preacct {...} # Loading session {...} # Loading post-auth {...} } # server WIFI server NETdevs { # from file /usr/local/etc/raddb/sites-enabled/CUSTOM # Loading authenticate {...} # Loading authorize {...} # Loading preacct {...} # Loading session {...} # Loading post-auth {...} } # server NETdevs radiusd: #### Opening IP addresses and Ports #### listen { type = "auth" ipaddr = 192.168.20.90 port = 1812 clients = "CUSTOMdevs" client WLC-AD-01 { ipaddr = 98.87.143.174 require_message_authenticator = no secret = <<< secret >>> virtual_server = "WIFI" limit { max_connections = 16 lifetime = 0 idle_timeout = 30 } } client probe01-rb { ipaddr = 192.168.20.12 require_message_authenticator = no secret = <<< secret >>> virtual_server = "NETdevs" limit { max_connections = 16 lifetime = 0 idle_timeout = 30 } } client ms-01 { ipaddr = 192.168.10.128 require_message_authenticator = no secret = <<< secret >>> virtual_server = "NETdevs" limit { max_connections = 16 lifetime = 0 idle_timeout = 30 } } client localtest { ipaddr = 192.168.20.90 require_message_authenticator = no secret = <<< secret >>> virtual_server = "NETdevs" limit { max_connections = 16 lifetime = 0 idle_timeout = 30 } } client BMMTEST { ipaddr = 192.168.20.138 require_message_authenticator = no secret = <<< secret >>> virtual_server = "NETdevs" limit { max_connections = 16 lifetime = 0 idle_timeout = 30 } } } Listening on auth address 192.168.20.90 port 1812 Ready to process requests (0) Received Access-Request Id 141 from 192.168.20.90:26563to 192.168.20.90:1812 length 137 (0) User-Name = "user" (0) NAS-IP-Address = 192.168.20.91 (0) NAS-Port = 1812 (0) Message-Authenticator = 0xa8cc76ce3b5860d52efc32576eecbf6a (0) MS-CHAP-Challenge = 0xb2f91f9870476e40 (0) MS-CHAP-Response = 0x000100000000000000000000000000000000000000000000000058d1080e7b32397b62fcd4f627d44c3a68a7323fd0124cfb (0) # Executing section authorize from file /usr/local/etc/raddb/sites-enabled/CUSTOM (0) authorize { (0) [preprocess] = ok (0) auth_log: EXPAND /var/log/radacct/%{%{Packet-Src-IP-Address}:-%{Packet-Src-IPv6-Address}}/auth-detail-%Y%m%d (0) auth_log: --> /var/log/radacct/192.168.20.90/auth-detail-20151226 (0) auth_log: /var/log/radacct/%{%{Packet-Src-IP-Address}:-%{Packet-Src-IPv6-Address}}/auth-detail-%Y%m%d expands to /var/log/radacct/192.168.20.90/auth-detail-20151226 (0) auth_log: EXPAND %t (0) auth_log: --> Sat Dec 26 23:06:35 2015 (0) [auth_log] = ok (0) mschap: Found MS-CHAP attributes. Setting 'Auth-Type = mschap' (0) [mschap] = ok (0) [expiration] = noop (0) [logintime] = noop (0) } # authorize = ok (0) Found Auth-Type = MSCHAP (0) # Executing group from file /usr/local/etc/raddb/sites-enabled/CUSTOM (0) authenticate { (0) mschap: Client is using MS-CHAPv1 with NT-Password (0) mschap: Executing: /usr/local/bin/ntlm_auth --request-nt-key --username=%{%{Stripped-User-Name}:-%{%{User-Name}:-None}} --domain=%{%{mschap:NT-Domain}:-CUSTOM} --challenge=%{%{mschap:Challenge}:-00} --nt-response=%{%{mschap:NT-Response}:-00}: (0) mschap: EXPAND --username=%{%{Stripped-User-Name}:-%{%{User-Name}:-None}} (0) mschap: --> --username=user (0) mschap: ERROR: No NT-Domain was found in the User-Name (0) mschap: EXPAND --domain=%{%{mschap:NT-Domain}:-CUSTOM} (0) mschap: --> --domain=CUSTOM (0) mschap: mschap1: b2 (0) mschap: EXPAND --challenge=%{%{mschap:Challenge}:-00} (0) mschap: --> --challenge=b2f91f9870476e40 (0) mschap: EXPAND --nt-response=%{%{mschap:NT-Response}:-00} (0) mschap: --> --nt-response=58d1080e7b32397b62fcd4f627d44c3a68a7323fd0124cfb (0) mschap: Program returned code (0) and output 'NT_KEY: B790031B37A86A5A3EA42ACFD3DE9679' (0) [mschap] = ok (0) } # authenticate = ok (0) # Executing section post-auth from file /usr/local/etc/raddb/sites-enabled/CUSTOM (0) post-auth { (0) [exec] = noop (0) } # post-auth = noop (0) Sent Access-Accept Id 141 from 192.168.20.90:1812 to192.168.20.90:26563 length 0 (0) Finished request Waking up in 4.9 seconds. (0) Cleaning up request packet ID 141 with timestamp +25 Ready to process requests (1) Received Access-Request Id 24 from 192.168.20.138:1645to 192.168.20.90:1812 length 91 (1) User-Name = "user" (1) User-Password = "password1" (1) NAS-Port = 1 (1) NAS-Port-Id = "tty1" (1) NAS-Port-Type = Virtual (1) Calling-Station-Id = "192.168.21.108" (1) NAS-IP-Address = 192.168.20.138 (1) # Executing section authorize from file /usr/local/etc/raddb/sites-enabled/CUSTOM (1) authorize { (1) [preprocess] = ok (1) auth_log: EXPAND /var/log/radacct/%{%{Packet-Src-IP-Address}:-%{Packet-Src-IPv6-Address}}/auth-detail-%Y%m%d (1) auth_log: --> /var/log/radacct/192.168.20.138/auth-detail-20151226 (1) auth_log: /var/log/radacct/%{%{Packet-Src-IP-Address}:-%{Packet-Src-IPv6-Address}}/auth-detail-%Y%m%d expands to /var/log/radacct/192.168.20.138/auth-detail-20151226 (1) auth_log: EXPAND %t (1) auth_log: --> Sat Dec 26 23:06:58 2015 (1) [auth_log] = ok (1) [mschap] = noop (1) [expiration] = noop (1) [logintime] = noop (1) } # authorize = ok (1) ERROR: No Auth-Type found: rejecting the user via Post-Auth-Type = Reject (1) Failed to authenticate the user (1) Using Post-Auth-Type Reject (1) # Executing group from file /usr/local/etc/raddb/sites-enabled/CUSTOM (1) Post-Auth-Type REJECT { (1) attr_filter.access_reject: EXPAND %{User-Name} (1) attr_filter.access_reject: --> user (1) attr_filter.access_reject: Matched entry DEFAULT at line 11 (1) [attr_filter.access_reject] = updated (1) } # Post-Auth-Type REJECT = updated (1) Delaying response for 1.000000 seconds Waking up in 0.6 seconds. Waking up in 0.3 seconds. (1) Sending delayed response (1) Sent Access-Reject Id 24 from 192.168.20.90:1812 to192.168.20.138:1645 length 20 Waking up in 3.9 seconds.

6 13