- Freeradius-Users - lists.freeradius.org

wiki.freeradius.org seems unhappy
by Adam Bishop 16 Oct '15

16 Oct '15

A lot of the wiki pages seem to be returning an error (e.g. http://wiki.freeradius.org/building/Packages ): Failed to render page: cannot load such file -- wikicloth Is there a problem with the wiki or am I just having exceptionally bad luck with finding broken links? Regards, Adam Bishop gpg: 0x6609D460 Jisc is a registered charity (number 1149740) and a company limited by guarantee which is registered in England under Company No. 5747339, VAT No. GB 197 0632 86. Jisc’s registered office is: One Castlepark, Tower Hill, Bristol, BS2 0JA. T 0203 697 5800. Jisc Services Limited is a wholly owned Jisc subsidiary and a company limited by guarantee which is registered in England under company number 2881024, VAT number GB 197 0632 86. The registered office is: One Castle Park, Tower Hill, Bristol BS2 0JA. T 0203 697 5800.

2 1

Use update control for VLAN with ntlm_auth
by Torsten Wilms 15 Oct '15

15 Oct '15

Hello @all I use free radius version 3.0.10 and the ntlm_auth for authenticate users via 802.1x over the AD Now i wan’t to setup switches with dynamic VLAN configuration. I tried to use in the authorize section unter default and inner-tunnel mschap if ( ok ) { update control { Tunnel-Type = 13, Tunnel-Medium-Type = 6, Tunnel-Private-Group-Id = 8 } } But no effect. Also i tried to use authenticate { ntlm_auth Auth-Type PAP { pap } Auth-Type CHAP { chap } Auth-Type MS-CHAP { mschap if ( ok ) { update control { Tunnel-Type = 13, Tunnel-Medium-Type = 6, Tunnel-Private-Group-Id = 8 } } } But it doesn’t work. How can i use update control if ntlm_auth was successful? Thanks a lot Torsten

4 9

replacement for FR function
by Lotkov Svyatoslav 14 Oct '15

14 Oct '15

Hi All! Is there any replacement for "userparse" (FR 2) function (located in lib/valuepair.c) ? I need a function to convert my comma-separated string to VALUE_PAIR

3 5

src/modules/rlm_eap: Which types are stable?
by Mathieu Simon (Lists) 14 Oct '15

14 Oct '15

Hi list Trying to work a bit on a BSD-ish port I've seen that a couple of modules previously deemed experimental have become stable so that they are now part of i.e. src/modules/stable (for example rlm_rest) so that they could now be enabled without a big fat warning. However there is no such file in src/modules/rlm_eap(/types) which either would indicate that all rlm_eap types are considered stable, however this page here i.e. states IKEv2 is Experimental: http://freeradius.org/features/eap.html Additionnaly this page mentions rlm_eap2, present in FreeRADIUS 2.2.x but not anymore on 3.0.x for what I can see. Maybe someone is able to tell me where the definitive source of knowledge for this is. Thanks, Mathieu

5 9

what is IP address of my FreeRadius server ?
by Waqas Shafique 14 Oct '15

14 Oct '15

I have setup FreeRadius version 3.0.10 on Ubuntu 14.04 . This server works well with localhost. However now I want to connect it from external system. For this I need to enter radius server IP address in my TP Link Router. I want to ask what is IP address of my FreeRadius server ? Thanks Waqas

3 2

multiple huntgroups for the same NAS-IP-ADDRESS
by ERIC TANGUY 14 Oct '15

14 Oct '15

Hello I use freeradius 3.0.9 and I want to define multiple huntgroups for the same NAS-IP-ADDRESS into the huntgroup file. I 'm using mysql and have followed the following topic http://freeradius.1045715.n5.nabble.com/Huntgroup-Checking-td4950385.html In sites-available/myconfig I have this ( just after preprocess ) # It takes care of processing the 'raddb/hints' and the # 'raddb/huntgroups' files. preprocess ####### Ajout fonction check Nas ip address update request { Huntgroup-Name := "%{sqldbvradius1-a:SELECT `huntgroupname` FROM `radhuntgroup` WHERE nasipaddress='%{NAS-IP-Address}'}" } if (Huntgroup-Name =~ /^$/) { # empty string; try 2nd sql update request { Huntgroup-Name := "%{sqldbvradius1-b:SELECT `huntgroupname` FROM `radhuntgroup` WHERE nasipaddress='%{NAS-IP-Address}'}" } } ############################## In my radgroupcheck Mysql table select * from radgroupcheck; +----+--------------+----------------+----+-------------+ | id | groupname | attribute | op | value | +----+--------------+----------------+----+-------------+ | 1 | AdminRI | Auth-Type | := | LDAPARKEA | | 2 | AdminRI_MOTP | Auth-Type | := | PAMMOTP | | 3 | AdminRI_RSA | Auth-Type | := | PAMRSA | | 4 | AdminRI | Huntgroup-Name | =~ | Pool1|Pool2 | | 5 | AdminRI_MOTP | Huntgroup-Name | =~ | Pool3|Pool2 | | 6 | AdminRI_RSA | Huntgroup-Name | =~ | Pool3|Pool2 | +----+--------------+----------------+----+-------------+ 6 rows in set (0.00 sec) In my radhuntgroup Mysql table select * from radhuntgroup ; +----+----------+-------+---------------+----------------+-----------+ | id | Location | Zone | huntgroupname | nasipaddress | nasportid | +----+----------+-------+---------------+----------------+-----------+ | 1 | rennes | verte | Pool1 | 10.154.253.1 | | | 2 | rennes | verte | Pool1 | 10.154.253.2 | | | 3 | rennes | verte | Pool1 | 10.154.253.3 | | | 4 | rennes | verte | Pool2 | 10.154.253.236 | | | 5 | rennes | verte | Pool3 | 10.154.253.4 | | +----+----------+-------+---------------+----------------+-----------+ 5 rows in set (0.00 sec) An extract of my radusergroup mysql table select * from radusergroup; +------------+--------------+----------+ | username | groupname | priority | +------------+--------------+----------+ | a0327 | AdminRI | 1 | | a0327_motp | AdminRI_MOTP | 1 | | a0327_rsa | AdminRI_RSA | 1 | +------------+--------------+----------+ 36 rows in set (0.00 sec) My debug log Ready to process requests (1) Received Access-Request Id 125 from 10.241.33.1:39902 to 10.239.131.11:1812 length 102 (1) User-Name = "a0327_rsa" (1) User-Password = "XXXXXXXX" (1) NAS-Port = 2 (1) NAS-Port-Id = "tty2" (1) NAS-Port-Type = Virtual (1) NAS-IP-Address = 10.154.253.236 (1) Event-Timestamp = "Oct 9 2015 17:15:43 CEST" (1) Message-Authenticator = 0xea12faeecab79952f4c77f43f464894e (1) Proxy-State = 0x313936 (1) # Executing section authorize from file /opt/freeradius-3.0.9/etc/raddb/sites-enabled/myconfig (1) authorize { (1) policy filter_username { (1) if (!&User-Name) { (1) if (!&User-Name) -> FALSE (1) if (&User-Name =~ / /) { (1) if (&User-Name =~ / /) -> FALSE (1) if (&User-Name =~ /@.*@/ ) { (1) if (&User-Name =~ /@.*@/ ) -> FALSE (1) if (&User-Name =~ /\.\./ ) { (1) if (&User-Name =~ /\.\./ ) -> FALSE (1) if ((&User-Name =~ /@/) && (&User-Name !~ /(a)(.+)\.(.+)$/)) { (1) if ((&User-Name =~ /@/) && (&User-Name !~ /(a)(.+)\.(.+)$/)) -> FALSE (1) if (&User-Name =~ /\.$/) { (1) if (&User-Name =~ /\.$/) -> FALSE (1) if (&User-Name =~ /(a)\./) { (1) if (&User-Name =~ /(a)\./) -> FALSE (1) } # policy filter_username = notfound (1) [preprocess] = ok (1) update request { (1) EXPAND %{User-Name} (1) --> a0327_rsa (1) SQL-User-Name set to 'a0327_rsa' rlm_sql (sqldbvradius1-a): Reserved connection (4) (1) Executing select query: SELECT `huntgroupname` FROM `radhuntgroup` WHERE nasipaddress='10.154.253.236' rlm_sql (sqldbvradius1-a): Released connection (4) rlm_sql (sqldbvradius1-a): 0 of 7 connections in use. Need more spares rlm_sql (sqldbvradius1-a): Opening additional connection (7), 1 of 25 pending slots used rlm_sql_mysql: Starting connect to MySQL server rlm_sql_mysql: Connected to database 'dbvradius1' on radiustux1-a.l.infra.arkea.com via TCP/IP, server version 5.6.24-enterprise-commercial-advanced-log, protocol version 10 (1) EXPAND %{sqldbvradius1-a:SELECT `huntgroupname` FROM `radhuntgroup` WHERE nasipaddress='%{NAS-IP-Address}'} (1) --> Pool2 (1) Huntgroup-Name := Pool2 (1) } # update request = noop (1) if (Huntgroup-Name =~ /^$/) { (1) if (Huntgroup-Name =~ /^$/) -> FALSE (1) underscore: Checking for suffix after "_" (1) underscore: Looking up realm "rsa" for User-Name = "a0327_rsa" (1) underscore: Found realm "rsa" (1) underscore: Adding Stripped-User-Name = "a0327" (1) underscore: Adding Realm = "rsa" (1) underscore: Authentication realm is LOCAL (1) [underscore] = ok (1) arobase: Request already has destination realm set. Ignoring (1) [arobase] = noop (1) [files] = noop (1) group { (1) sqldbvradius1-a: EXPAND %{User-Name} (1) sqldbvradius1-a: --> a0327_rsa (1) sqldbvradius1-a: SQL-User-Name set to 'a0327_rsa' rlm_sql (sqldbvradius1-a): Reserved connection (0) (1) sqldbvradius1-a: EXPAND SELECT id, username, attribute, value, op FROM radcheck WHERE username = '%{SQL-User-Name}' ORDER BY id (1) sqldbvradius1-a: --> SELECT id, username, attribute, value, op FROM radcheck WHERE username = 'a0327_rsa' ORDER BY id (1) sqldbvradius1-a: Executing select query: SELECT id, username, attribute, value, op FROM radcheck WHERE username = 'a0327_rsa' ORDER BY id (1) sqldbvradius1-a: User found in radcheck table (1) sqldbvradius1-a: Conditional check items matched, merging assignment check items (1) sqldbvradius1-a: Expiration := "Dec 30 2035 00:00:00 CET" (1) sqldbvradius1-a: EXPAND SELECT id, username, attribute, value, op FROM radreply WHERE username = '%{SQL-User-Name}' ORDER BY id (1) sqldbvradius1-a: --> SELECT id, username, attribute, value, op FROM radreply WHERE username = 'a0327_rsa' ORDER BY id (1) sqldbvradius1-a: Executing select query: SELECT id, username, attribute, value, op FROM radreply WHERE username = 'a0327_rsa' ORDER BY id (1) sqldbvradius1-a: EXPAND SELECT groupname FROM radusergroup WHERE username = '%{SQL-User-Name}' ORDER BY priority (1) sqldbvradius1-a: --> SELECT groupname FROM radusergroup WHERE username = 'a0327_rsa' ORDER BY priority (1) sqldbvradius1-a: Executing select query: SELECT groupname FROM radusergroup WHERE username = 'a0327_rsa' ORDER BY priority (1) sqldbvradius1-a: User found in the group table (1) sqldbvradius1-a: EXPAND SELECT id, groupname, attribute, Value, op FROM radgroupcheck WHERE groupname = '%{sqldbvradius1-a-SQL-Group}' ORDER BY id (1) sqldbvradius1-a: --> SELECT id, groupname, attribute, Value, op FROM radgroupcheck WHERE groupname = 'AdminRI_RSA' ORDER BY id (1) sqldbvradius1-a: Executing select query: SELECT id, groupname, attribute, Value, op FROM radgroupcheck WHERE groupname = 'AdminRI_RSA' ORDER BY id rlm_sql (sqldbvradius1-a): Released connection (0) (1) [sqldbvradius1-a] = ok (1) } # group = ok (1) expiration: Account will expire at 'Dec 30 2035 00:00:00 CET' (1) [expiration] = ok (1) [logintime] = noop (1) } # authorize = ok (1) ERROR: No Auth-Type found: rejecting the user via Post-Auth-Type = Reject (1) Failed to authenticate the user (1) Login incorrect (No Auth-Type found: rejecting the user via Post-Auth-Type = Reject): [a0327_rsa] (from client proxyradiustux1-a port 2) (1) Using Post-Auth-Type Reject (1) # Executing group from file /opt/freeradius-3.0.9/etc/raddb/sites-enabled/vradius1-a (1) Post-Auth-Type REJECT { (1) redundant (null) { (1) sqldbvradius1-a: EXPAND .query (1) sqldbvradius1-a: --> .query (1) sqldbvradius1-a: Using query template 'query' rlm_sql (sqldbvradius1-a): Reserved connection (5) (1) sqldbvradius1-a: EXPAND %{User-Name} (1) sqldbvradius1-a: --> a0327_rsa (1) sqldbvradius1-a: SQL-User-Name set to 'a0327_rsa' (1) sqldbvradius1-a: EXPAND INSERT INTO radpostauth (username, pass, reply, authdate) VALUES ( '%{SQL-User-Name}', '%{%{User-Password}:-%{Chap-Password}}', '%{reply:Packet-Type}', '%S') (1) sqldbvradius1-a: --> INSERT INTO radpostauth (username, pass, reply, authdate) VALUES ( 'a0327_rsa', '2812525337', 'Access-Reject', '2015-10-09 17:15:43') (1) sqldbvradius1-a: Executing query: INSERT INTO radpostauth (username, pass, reply, authdate) VALUES ( 'a0327_rsa', '2812525337', 'Access-Reject', '2015-10-09 17:15:43') (1) sqldbvradius1-a: SQL query returned: success (1) sqldbvradius1-a: 1 record(s) updated rlm_sql (sqldbvradius1-a): Released connection (5) (1) [sqldbvradius1-a] = ok (1) } # redundant (null) = ok (1) attr_filter.access_reject: EXPAND %{User-Name} (1) attr_filter.access_reject: --> a0327_rsa (1) attr_filter.access_reject: Matched entry DEFAULT at line 18 (1) [attr_filter.access_reject] = updated (1) eap: Request didn't contain an EAP-Message, not inserting EAP-Failure (1) [eap] = noop (1) policy remove_reply_message_if_eap { (1) if (&reply:EAP-Message && &reply:Reply-Message) { (1) if (&reply:EAP-Message && &reply:Reply-Message) -> FALSE (1) else { (1) [noop] = noop (1) } # else = noop (1) } # policy remove_reply_message_if_eap = noop (1) } # Post-Auth-Type REJECT = updated (1) Delaying response for 2.000000 seconds Waking up in 0.2 seconds. Waking up in 1.7 seconds. If I replcae my radgroupcheck; +----+--------------+----------------+----+-------------+ | id | groupname | attribute | op | value | +----+--------------+----------------+----+-------------+ | 1 | AdminRI | Auth-Type | := | LDAP | | 2 | AdminRI_MOTP | Auth-Type | := | PAMMOTP | | 3 | AdminRI_RSA | Auth-Type | := | PAMRSA | | 4 | AdminRI | Huntgroup-Name | =~ | Pool1|Pool2 | | 5 | AdminRI_MOTP | Huntgroup-Name | =~ | Pool3|Pool2 | | 6 | AdminRI_RSA | Huntgroup-Name | =~ | Pool3|Pool2 | +----+--------------+----------------+----+-------------+ with this +----+--------------+----------------+----+-------------+ | id | groupname | attribute | op | value | +----+--------------+----------------+----+-------------+ | 1 | AdminRI | Auth-Type | := | LDAP | | 2 | AdminRI_MOTP | Auth-Type | := | PAMMOTP | | 3 | AdminRI_RSA | Auth-Type | := | PAMRSA | | 4 | AdminRI | Huntgroup-Name | == | Pool1| | 5 | AdminRI_MOTP | Huntgroup-Name | == | Pool3 | | 6 | AdminRI_RSA | Huntgroup-Name | == | Pool2 | +----+--------------+----------------+----+-------------+ It 's a success but it's not what I want I want to use multiple huntgroups for the same NAS-Ip-Address What is the right configuration ? Is it possible to do and how ? Regards -- Ce message et toutes les pieces jointes (ci-apres le "message") sont confidentiels et etablis a l'intention exclusive de ses destinataires. Toute utilisation ou diffusion non autorisee est interdite. Tout message etant susceptible d'alteration, l'emetteur decline toute responsabilite au titre de ce message s'il a ete altere, deforme ou falsifie. ----------------------------------- This message and any attachments (the "message") are confidential and intended solely for the addressees. Any unauthorised use or dissemination is prohibited. As e-mails are susceptible to alteration, the issuer shall not be liable for the message if altered, changed or falsified.

1 0

Warning about OpenSSL 1.0.2
by Alan DeKok 13 Oct '15

13 Oct '15

OpenSSL 1.0.2 changes the way it interacts with FreeRADIUS. None of this is documented by OpenSSL. The result is that instead of successful authentication, you get: (6) eap_ttls: ERROR: Invalid ACK received: 256 (6) eap_ttls: ERROR: [eaptls verify] = invalid (6) eap_ttls: ERROR: [eaptls process] = invalid The only solution is to apply the patch in commit b7b5493c61. It doesn't fix the underlying OpenSSL problem, but it makes FreeRADIUS ignore the broken API calls. This problem is serious enough that we may have to issue 3.0.11, and possibly 2.2.10, also. Sadly, this isn't the first time that OpenSSL broke FreeRADIUS, or other applications. Alan DeKok.

10 27

LDAP FreeRadius and DLINK DWC.
by Martin Rheumer 13 Oct '15

13 Oct '15

Hi All, We are looking at trying to implement WPA Enterprise with LDAP Auth, FreeRadius using a DLINK DWC-1000 Wifi Controller. I have spent the day trying to determine if the new version 3.0 and the inner tunnel now allows this to work over older versions and mailing list entries saying this will never work and I cant seem to figure a straight answer. We are using radiusd: FreeRADIUS Version 3.0.4, for host x86_64-redhat-linux-gnu, built on Mar 5 2015 at 23:41:36 on a centos 7.1.1503 machine. The DWC is the latest firmware. I have read the guide in the inner-tunnel file and attempted the radtest and it even fails at the simple chap auth, but works perfectly at the pap test. ( Debugs below ). Am I kidding myself this actually works with LDAP or just got the config wrong ?. Changing to username and password in files works perfectly for all methods of auth. Thanks in Advance Martin Debug follows. ( for the radtest ) [root@ho-radius raddb]# radtest martinr password 127.0.0.1:18120 0 testing123 Sending Access-Request Id 134 from 0.0.0.0:41385 to 127.0.0.1:18120 User-Name = 'martinr' User-Password = 'password' NAS-IP-Address = 10.0.0.40 NAS-Port = 0 Message-Authenticator = 0x00 Received Access-Accept Id 134 from 127.0.0.1:18120 to 127.0.0.1:41385 length 20 [root@ho-radius raddb]# radtest -t mschap martinr password 127.0.0.1:18120 0 testing123 Sending Access-Request Id 145 from 0.0.0.0:37203 to 127.0.0.1:18120 User-Name = 'martinr' NAS-IP-Address = 10.0.0.40 NAS-Port = 0 Message-Authenticator = 0x00 MS-CHAP-Challenge = 0x062507387c1f6b17 MS-CHAP-Response = 0x0001000000000000000000000000000000000000000000000000adc03505c874be4c4e5e7a7d6549ebd9beb0f752c40fc74f Received Access-Reject Id 145 from 127.0.0.1:18120 to 127.0.0.1:37203 length 38 MS-CHAP-Error = '\000E=691 R=1' (0) -: Expected Access-Accept got Access-Reject radiusd: FreeRADIUS Version 3.0.4, for host x86_64-redhat-linux-gnu, built on Mar 5 2015 at 23:41:36 Copyright (C) 1999-2014 The FreeRADIUS server project and contributors There is NO warranty; not even for MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE You may redistribute copies of FreeRADIUS under the terms of the GNU General Public License For more information about these matters, see the file named COPYRIGHT Starting - reading configuration files ... including dictionary file /usr/share/freeradius/dictionary including dictionary file /usr/share/freeradius/dictionary.dhcp including dictionary file /usr/share/freeradius/dictionary.vqp including dictionary file /etc/raddb/dictionary including configuration file /etc/raddb/radiusd.conf including configuration file /etc/raddb/proxy.conf including configuration file /etc/raddb/clients.conf including files in directory/etc/raddb/mods-enabled/ including configuration file /etc/raddb/mods-enabled/always including configuration file /etc/raddb/mods-enabled/attr_filter including configuration file /etc/raddb/mods-enabled/cache_eap including configuration file /etc/raddb/mods-enabled/chap including configuration file /etc/raddb/mods-enabled/detail including configuration file /etc/raddb/mods-enabled/detail.log including configuration file /etc/raddb/mods-enabled/dhcp including configuration file /etc/raddb/mods-enabled/digest including configuration file /etc/raddb/mods-enabled/dynamic_clients including configuration file /etc/raddb/mods-enabled/eap including configuration file /etc/raddb/mods-enabled/echo including configuration file /etc/raddb/mods-enabled/exec including configuration file /etc/raddb/mods-enabled/expiration including configuration file /etc/raddb/mods-enabled/expr including configuration file /etc/raddb/mods-enabled/files including configuration file /etc/raddb/mods-enabled/linelog including configuration file /etc/raddb/mods-enabled/logintime including configuration file /etc/raddb/mods-enabled/mschap including configuration file /etc/raddb/mods-enabled/ntlm_auth including configuration file /etc/raddb/mods-enabled/pap including configuration file /etc/raddb/mods-enabled/passwd including configuration file /etc/raddb/mods-enabled/preprocess including configuration file /etc/raddb/mods-enabled/radutmp including configuration file /etc/raddb/mods-enabled/realm including configuration file /etc/raddb/mods-enabled/replicate including configuration file /etc/raddb/mods-enabled/soh including configuration file /etc/raddb/mods-enabled/sradutmp including configuration file /etc/raddb/mods-enabled/unix including configuration file /etc/raddb/mods-enabled/unpack including configuration file /etc/raddb/mods-enabled/utf8 including configuration file /etc/raddb/mods-enabled/ldap including files in directory/etc/raddb/policy.d/ including configuration file /etc/raddb/policy.d/accounting including configuration file /etc/raddb/policy.d/canonicalization including configuration file /etc/raddb/policy.d/control including configuration file /etc/raddb/policy.d/cui including configuration file /etc/raddb/policy.d/debug including configuration file /etc/raddb/policy.d/dhcp including configuration file /etc/raddb/policy.d/eap including configuration file /etc/raddb/policy.d/filter including configuration file /etc/raddb/policy.d/operator-name including files in directory/etc/raddb/sites-enabled/ including configuration file /etc/raddb/sites-enabled/default including configuration file /etc/raddb/sites-enabled/inner-tunnel main { security { user = "radiusd" group = "radiusd" allow_core_dumps = no } } main { name = "radiusd" prefix = "/usr" localstatedir = "/var" sbindir = "/usr/sbin" logdir = "/var/log/radius" run_dir = "/var/run/radiusd" libdir = "/usr/lib64/freeradius" radacctdir = "/var/log/radius/radacct" hostname_lookups = no max_request_time = 30 cleanup_delay = 5 max_requests = 1024 pidfile = "/var/run/radiusd/radiusd.pid" checkrad = "/usr/sbin/checkrad" debug_level = 0 proxy_requests = yes log { stripped_names = no auth = no auth_badpass = no auth_goodpass = no colourise = yes msg_denied = "You are already logged in - access denied" } security { max_attributes = 200 reject_delay = 1 status_server = yes } } radiusd: #### Loading Realms and Home Servers #### proxy server { retry_delay = 5 retry_count = 3 default_fallback = no dead_time = 120 wake_all_if_all_dead = no } home_server localhost { ipaddr = 127.0.0.1 port = 1812 type = "auth" secret = <<< secret >>> response_window = 20.000000 response_timeouts = 1 max_outstanding = 65536 zombie_period = 40 status_check = "status-server" ping_interval = 30 check_interval = 30 check_timeout = 4 num_answers_to_alive = 3 revive_interval = 120 coa { irt = 2 mrt = 16 mrc = 5 mrd = 30 } limit { max_connections = 16 max_requests = 0 lifetime = 0 idle_timeout = 0 } } home_server_pool my_auth_failover { type = fail-over home_server = localhost } realm example.com { auth_pool = my_auth_failover } realm LOCAL { } radiusd: #### Loading Clients #### client localhost { ipaddr = 127.0.0.1 require_message_authenticator = no secret = <<< secret >>> nas_type = "other" proto = "*" limit { max_connections = 16 lifetime = 0 idle_timeout = 30 } } client localhost_ipv6 { ipv6addr = ::1 require_message_authenticator = no secret = <<< secret >>> limit { max_connections = 16 lifetime = 0 idle_timeout = 30 } } client dwc1000 { ipaddr = 10.0.254.51 require_message_authenticator = no secret = <<< secret >>> limit { max_connections = 16 lifetime = 0 idle_timeout = 30 } } radiusd: #### Instantiating modules #### instantiate { } modules { # Loaded module rlm_always # Instantiating module "reject" from file /etc/raddb/mods-enabled/always always reject { rcode = "reject" simulcount = 0 mpp = no } # Instantiating module "fail" from file /etc/raddb/mods-enabled/always always fail { rcode = "fail" simulcount = 0 mpp = no } # Instantiating module "ok" from file /etc/raddb/mods-enabled/always always ok { rcode = "ok" simulcount = 0 mpp = no } # Instantiating module "handled" from file /etc/raddb/mods-enabled/always always handled { rcode = "handled" simulcount = 0 mpp = no } # Instantiating module "invalid" from file /etc/raddb/mods-enabled/always always invalid { rcode = "invalid" simulcount = 0 mpp = no } # Instantiating module "userlock" from file /etc/raddb/mods-enabled/always always userlock { rcode = "userlock" simulcount = 0 mpp = no } # Instantiating module "notfound" from file /etc/raddb/mods-enabled/always always notfound { rcode = "notfound" simulcount = 0 mpp = no } # Instantiating module "noop" from file /etc/raddb/mods-enabled/always always noop { rcode = "noop" simulcount = 0 mpp = no } # Instantiating module "updated" from file /etc/raddb/mods-enabled/always always updated { rcode = "updated" simulcount = 0 mpp = no } # Loaded module rlm_attr_filter # Instantiating module "attr_filter.post-proxy" from file /etc/raddb/mods-enabled/attr_filter attr_filter attr_filter.post-proxy { filename = "/etc/raddb/mods-config/attr_filter/post-proxy" key = "%{Realm}" relaxed = no } reading pairlist file /etc/raddb/mods-config/attr_filter/post-proxy # Instantiating module "attr_filter.pre-proxy" from file /etc/raddb/mods-enabled/attr_filter attr_filter attr_filter.pre-proxy { filename = "/etc/raddb/mods-config/attr_filter/pre-proxy" key = "%{Realm}" relaxed = no } reading pairlist file /etc/raddb/mods-config/attr_filter/pre-proxy # Instantiating module "attr_filter.access_reject" from file /etc/raddb/mods-enabled/attr_filter attr_filter attr_filter.access_reject { filename = "/etc/raddb/mods-config/attr_filter/access_reject" key = "%{User-Name}" relaxed = no } reading pairlist file /etc/raddb/mods-config/attr_filter/access_reject # Instantiating module "attr_filter.access_challenge" from file /etc/raddb/mods-enabled/attr_filter attr_filter attr_filter.access_challenge { filename = "/etc/raddb/mods-config/attr_filter/access_challenge" key = "%{User-Name}" relaxed = no } reading pairlist file /etc/raddb/mods-config/attr_filter/access_challenge # Instantiating module "attr_filter.accounting_response" from file /etc/raddb/mods-enabled/attr_filter attr_filter attr_filter.accounting_response { filename = "/etc/raddb/mods-config/attr_filter/accounting_response" key = "%{User-Name}" relaxed = no } reading pairlist file /etc/raddb/mods-config/attr_filter/accounting_response # Loaded module rlm_cache # Instantiating module "cache_eap" from file /etc/raddb/mods-enabled/cache_eap cache cache_eap { key = "%{%{control:State}:-%{%{reply:State}:-%{State}}}" ttl = 15 max_entries = 16384 epoch = 0 add_stats = no } # Loaded module rlm_chap # Instantiating module "chap" from file /etc/raddb/mods-enabled/chap # Loaded module rlm_detail # Instantiating module "detail" from file /etc/raddb/mods-enabled/detail detail { filename = "/var/log/radius/radacct/%{%{Packet-Src-IP-Address}:-%{Packet-Src-IPv6-Address}}/detail-%Y%m%d" header = "%t" permissions = 384 locking = no log_packet_header = no } # Instantiating module "auth_log" from file /etc/raddb/mods-enabled/detail.log detail auth_log { filename = "/var/log/radius/radacct/%{%{Packet-Src-IP-Address}:-%{Packet-Src-IPv6-Address}}/auth-detail-%Y%m%d" header = "%t" permissions = 384 locking = no log_packet_header = no } rlm_detail (auth_log): 'User-Password' suppressed, will not appear in detail output # Instantiating module "reply_log" from file /etc/raddb/mods-enabled/detail.log detail reply_log { filename = "/var/log/radius/radacct/%{%{Packet-Src-IP-Address}:-%{Packet-Src-IPv6-Address}}/reply-detail-%Y%m%d" header = "%t" permissions = 384 locking = no log_packet_header = no } # Instantiating module "pre_proxy_log" from file /etc/raddb/mods-enabled/detail.log detail pre_proxy_log { filename = "/var/log/radius/radacct/%{%{Packet-Src-IP-Address}:-%{Packet-Src-IPv6-Address}}/pre-proxy-detail-%Y%m%d" header = "%t" permissions = 384 locking = no log_packet_header = no } # Instantiating module "post_proxy_log" from file /etc/raddb/mods-enabled/detail.log detail post_proxy_log { filename = "/var/log/radius/radacct/%{%{Packet-Src-IP-Address}:-%{Packet-Src-IPv6-Address}}/post-proxy-detail-%Y%m%d" header = "%t" permissions = 384 locking = no log_packet_header = no } # Loaded module rlm_dhcp # Instantiating module "dhcp" from file /etc/raddb/mods-enabled/dhcp # Loaded module rlm_digest # Instantiating module "digest" from file /etc/raddb/mods-enabled/digest # Loaded module rlm_dynamic_clients # Instantiating module "dynamic_clients" from file /etc/raddb/mods-enabled/dynamic_clients # Loaded module rlm_eap # Instantiating module "eap" from file /etc/raddb/mods-enabled/eap eap { default_eap_type = "md5" timer_expire = 60 ignore_unknown_eap_types = no mod_accounting_username_bug = no max_sessions = 1024 } # Linked to sub-module rlm_eap_md5 # Linked to sub-module rlm_eap_leap # Linked to sub-module rlm_eap_gtc gtc { challenge = "Password: " auth_type = "PAP" } # Linked to sub-module rlm_eap_tls tls { tls = "tls-common" } tls-config tls-common { rsa_key_exchange = no dh_key_exchange = yes rsa_key_length = 512 dh_key_length = 512 verify_depth = 0 ca_path = "/etc/raddb/certs" pem_file_type = yes private_key_file = "/etc/raddb/certs/server.pem" certificate_file = "/etc/raddb/certs/server.pem" ca_file = "/etc/raddb/certs/ca.pem" private_key_password = <<< secret >>> dh_file = "/etc/raddb/certs/dh" fragment_size = 1024 include_length = yes check_crl = no cipher_list = "DEFAULT" ecdh_curve = "prime256v1" cache { enable = yes lifetime = 24 max_entries = 255 } verify { } ocsp { enable = no override_cert_url = yes url ="http://127.0.0.1/ocsp/" use_nonce = yes timeout = 0 softfail = yes } } # Linked to sub-module rlm_eap_ttls ttls { tls = "tls-common" default_eap_type = "md5" copy_request_to_tunnel = no use_tunneled_reply = no virtual_server = "inner-tunnel" include_length = yes require_client_cert = no } Using cached TLS configuration from previous invocation # Linked to sub-module rlm_eap_peap peap { tls = "tls-common" default_method = "mschapv2" copy_request_to_tunnel = no use_tunneled_reply = no proxy_tunneled_request_as_eap = yes virtual_server = "inner-tunnel" soh = no require_client_cert = no } Using cached TLS configuration from previous invocation # Linked to sub-module rlm_eap_mschapv2 mschapv2 { with_ntdomain_hack = no send_error = no } # Loaded module rlm_exec # Instantiating module "echo" from file /etc/raddb/mods-enabled/echo exec echo { wait = yes program = "/bin/echo %{User-Name}" input_pairs = "request" output_pairs = "reply" shell_escape = yes } # Instantiating module "exec" from file /etc/raddb/mods-enabled/exec exec { wait = no input_pairs = "request" shell_escape = yes timeout = 10 } # Loaded module rlm_expiration # Instantiating module "expiration" from file /etc/raddb/mods-enabled/expiration # Loaded module rlm_expr # Instantiating module "expr" from file /etc/raddb/mods-enabled/expr expr { safe_characters = "@abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ0123456789.-_: /" } # Loaded module rlm_files # Instantiating module "files" from file /etc/raddb/mods-enabled/files files { filename = "/etc/raddb/mods-config/files/authorize" usersfile = "/etc/raddb/mods-config/files/authorize" acctusersfile = "/etc/raddb/mods-config/files/accounting" preproxy_usersfile = "/etc/raddb/mods-config/files/pre-proxy" compat = "cistron" } reading pairlist file /etc/raddb/mods-config/files/authorize [/etc/raddb/mods-config/files/authorize]:181 Cistron compatibility checks for entry DEFAULT ... [/etc/raddb/mods-config/files/authorize]:188 Cistron compatibility checks for entry DEFAULT ... [/etc/raddb/mods-config/files/authorize]:195 Cistron compatibility checks for entry DEFAULT ... reading pairlist file /etc/raddb/mods-config/files/authorize [/etc/raddb/mods-config/files/authorize]:181 Cistron compatibility checks for entry DEFAULT ... [/etc/raddb/mods-config/files/authorize]:188 Cistron compatibility checks for entry DEFAULT ... [/etc/raddb/mods-config/files/authorize]:195 Cistron compatibility checks for entry DEFAULT ... reading pairlist file /etc/raddb/mods-config/files/accounting reading pairlist file /etc/raddb/mods-config/files/pre-proxy # Loaded module rlm_linelog # Instantiating module "linelog" from file /etc/raddb/mods-enabled/linelog linelog { filename = "/var/log/radius/linelog" permissions = 384 format = "This is a log message for %{User-Name}" reference = "messages.%{%{Packet-Type}:-default}" } # Instantiating module "log_accounting" from file /etc/raddb/mods-enabled/linelog linelog log_accounting { filename = "/var/log/radius/linelog-accounting" permissions = 384 format = "" reference = "Accounting-Request.%{%{Acct-Status-Type}:-unknown}" } # Loaded module rlm_logintime # Instantiating module "logintime" from file /etc/raddb/mods-enabled/logintime logintime { minimum_timeout = 60 } # Loaded module rlm_mschap # Instantiating module "mschap" from file /etc/raddb/mods-enabled/mschap mschap { use_mppe = yes require_encryption = no require_strong = no with_ntdomain_hack = yes passchange { } allow_retry = yes } # Instantiating module "ntlm_auth" from file /etc/raddb/mods-enabled/ntlm_auth exec ntlm_auth { wait = yes program = "/path/to/ntlm_auth --request-nt-key --domain=MYDOMAIN --username=%{mschap:User-Name} --password=%{User-Password}" shell_escape = yes } # Loaded module rlm_pap # Instantiating module "pap" from file /etc/raddb/mods-enabled/pap pap { normalise = yes } # Loaded module rlm_passwd # Instantiating module "etc_passwd" from file /etc/raddb/mods-enabled/passwd passwd etc_passwd { filename = "/etc/passwd" format = "*User-Name:Crypt-Password:" delimiter = ":" ignore_nislike = no ignore_empty = yes allow_multiple_keys = no hash_size = 100 } rlm_passwd: nfields: 3 keyfield 0(User-Name) listable: no # Loaded module rlm_preprocess # Instantiating module "preprocess" from file /etc/raddb/mods-enabled/preprocess preprocess { huntgroups = "/etc/raddb/mods-config/preprocess/huntgroups" hints = "/etc/raddb/mods-config/preprocess/hints" with_ascend_hack = no ascend_channels_per_line = 23 with_ntdomain_hack = no with_specialix_jetstream_hack = no with_cisco_vsa_hack = no with_alvarion_vsa_hack = no } reading pairlist file /etc/raddb/mods-config/preprocess/huntgroups reading pairlist file /etc/raddb/mods-config/preprocess/hints # Loaded module rlm_radutmp # Instantiating module "radutmp" from file /etc/raddb/mods-enabled/radutmp radutmp { filename = "/var/log/radius/radutmp" username = "%{User-Name}" case_sensitive = yes check_with_nas = yes permissions = 384 caller_id = yes } # Loaded module rlm_realm # Instantiating module "IPASS" from file /etc/raddb/mods-enabled/realm realm IPASS { format = "prefix" delimiter = "/" ignore_default = no ignore_null = no } # Instantiating module "suffix" from file /etc/raddb/mods-enabled/realm realm suffix { format = "suffix" delimiter = "@" ignore_default = no ignore_null = no } # Instantiating module "realmpercent" from file /etc/raddb/mods-enabled/realm realm realmpercent { format = "suffix" delimiter = "%" ignore_default = no ignore_null = no } # Instantiating module "ntdomain" from file /etc/raddb/mods-enabled/realm realm ntdomain { format = "prefix" delimiter = "\" ignore_default = no ignore_null = no } # Loaded module rlm_replicate # Instantiating module "replicate" from file /etc/raddb/mods-enabled/replicate # Loaded module rlm_soh # Instantiating module "soh" from file /etc/raddb/mods-enabled/soh soh { dhcp = yes } # Instantiating module "sradutmp" from file /etc/raddb/mods-enabled/sradutmp radutmp sradutmp { filename = "/var/log/radius/sradutmp" username = "%{User-Name}" case_sensitive = yes check_with_nas = yes permissions = 420 caller_id = no } # Loaded module rlm_unix # Instantiating module "unix" from file /etc/raddb/mods-enabled/unix unix { radwtmp = "/var/log/radius/radwtmp" } # Loaded module rlm_unpack # Instantiating module "unpack" from file /etc/raddb/mods-enabled/unpack # Loaded module rlm_utf8 # Instantiating module "utf8" from file /etc/raddb/mods-enabled/utf8 # Loaded module rlm_ldap # Instantiating module "ldap" from file /etc/raddb/mods-enabled/ldap ldap { server = "ldap.benon.com" port = 389 password = <<< secret >>> identity = "cn=Manager,dc=benon,dc=com" user { filter = "(uid=%{%{Stripped-User-Name}:-%{User-Name}})" scope = "sub" base_dn = "dc=benon,dc=com" access_positive = yes } group { filter = "(objectClass=posixGroup)" scope = "sub" base_dn = "dc=benon,dc=com" name_attribute = "cn" membership_attribute = "memberOf" cacheable_name = no cacheable_dn = no } client { filter = "(objectClass=frClient)" scope = "sub" base_dn = "dc=benon,dc=com" attribute { identifier = "radiusClientIdentifier" shortname = "cn" secret = "radiusClientSecret" } } profile { filter = "(&)" } options { ldap_debug = 40 chase_referrals = yes rebind = yes net_timeout = 1 res_timeout = 20 srv_timelimit = 20 idle = 60 probes = 3 interval = 3 } tls { start_tls = no } } rlm_ldap: Falling back to build time libldap version info. Query for LDAP_OPT_API_INFO returned: -1 rlm_ldap: libldap vendor: OpenLDAP version: 20439 accounting { reference = "%{tolower:type.%{Acct-Status-Type}}" } post-auth { reference = "." } rlm_ldap (ldap): Initialising connection pool pool { start = 5 min = 4 max = 32 spare = 3 uses = 0 lifetime = 0 cleanup_interval = 30 idle_timeout = 60 retry_delay = 1 spread = no } rlm_ldap (ldap): Opening additional connection (0) rlm_ldap (ldap): Connecting to ldap.benon.com:389 rlm_ldap (ldap): Waiting for bind result... rlm_ldap (ldap): Bind successful rlm_ldap (ldap): Opening additional connection (1) rlm_ldap (ldap): Connecting to ldap.benon.com:389 rlm_ldap (ldap): Waiting for bind result... rlm_ldap (ldap): Bind successful rlm_ldap (ldap): Opening additional connection (2) rlm_ldap (ldap): Connecting to ldap.benon.com:389 rlm_ldap (ldap): Waiting for bind result... rlm_ldap (ldap): Bind successful rlm_ldap (ldap): Opening additional connection (3) rlm_ldap (ldap): Connecting to ldap.benon.com:389 rlm_ldap (ldap): Waiting for bind result... rlm_ldap (ldap): Bind successful rlm_ldap (ldap): Opening additional connection (4) rlm_ldap (ldap): Connecting to ldap.benon.com:389 rlm_ldap (ldap): Waiting for bind result... rlm_ldap (ldap): Bind successful } # modules radiusd: #### Loading Virtual Servers #### server { # from file /etc/raddb/radiusd.conf } # server server default { # from file /etc/raddb/sites-enabled/default # Creating Auth-Type = digest # Loading authenticate {...} # Loading authorize {...} Ignoring "sql" (see raddb/mods-available/README.rst) # Loading preacct {...} # Loading accounting {...} # Loading post-proxy {...} # Loading post-auth {...} } # server default server inner-tunnel { # from file /etc/raddb/sites-enabled/inner-tunnel # Loading authenticate {...} # Loading authorize {...} # Loading session {...} # Loading post-proxy {...} # Loading post-auth {...} } # server inner-tunnel radiusd: #### Opening IP addresses and Ports #### listen { type = "auth" ipaddr = * port = 0 limit { max_connections = 16 lifetime = 0 idle_timeout = 30 } } listen { type = "acct" ipaddr = * port = 0 limit { max_connections = 16 lifetime = 0 idle_timeout = 30 } } listen { type = "auth" ipv6addr = :: port = 0 limit { max_connections = 16 lifetime = 0 idle_timeout = 30 } } listen { type = "acct" ipv6addr = :: port = 0 limit { max_connections = 16 lifetime = 0 idle_timeout = 30 } } listen { type = "auth" ipaddr = 127.0.0.1 port = 18120 } Listening on auth address * port 1812 as server default Listening on acct address * port 1813 as server default Listening on auth address :: port 1812 as server default Listening on acct address :: port 1813 as server default Listening on auth address 127.0.0.1 port 18120 as server inner-tunnel Opening new proxy socket 'proxy address * port 0' Listening on proxy address * port 44270 Ready to process requests Received Access-Request Id 134 from 127.0.0.1:41385 to 127.0.0.1:18120 length 77 User-Name = 'martinr' User-Password = 'password' NAS-IP-Address = 10.0.0.40 NAS-Port = 0 Message-Authenticator = 0x212f6acdec862d6dd7fad5f730a6c954 (0) Received Access-Request packet from host 127.0.0.1 port 41385, id=134, length=77 (0) User-Name = 'martinr' (0) User-Password = 'password' (0) NAS-IP-Address = 10.0.0.40 (0) NAS-Port = 0 (0) Message-Authenticator = 0x212f6acdec862d6dd7fad5f730a6c954 (0) # Executing section authorize from file /etc/raddb/sites-enabled/inner-tunnel (0) authorize { (0) [chap] = noop (0) [mschap] = noop (0) suffix : Checking for suffix after "@" (0) suffix : No '@' in User-Name = "martinr", looking up realm NULL (0) suffix : No such realm "NULL" (0) [suffix] = noop (0) update control { (0) Proxy-To-Realm := 'LOCAL' (0) } # update control = noop (0) eap : No EAP-Message, not doing EAP (0) [eap] = noop (0) [files] = noop rlm_ldap (ldap): Reserved connection (4) (0) ldap : EXPAND (uid=%{%{Stripped-User-Name}:-%{User-Name}}) (0) ldap : --> (uid=martinr) (0) ldap : EXPAND dc=benon,dc=com (0) ldap : --> dc=benon,dc=com (0) ldap : Performing search in 'dc=benon,dc=com' with filter '(uid=martinr)', scope 'sub' (0) ldap : Waiting for search result... (0) ldap : User object found at DN "uid=martinr,cn=users,dc=benon,dc=com" (0) ldap : Processing user attributes (0) ldap : control:Password-With-Header += '{SSHA}sjcybNoAjvx2+LHSN9Z8zE0JEd0khiue' rlm_ldap (ldap): Released connection (4) (0) [ldap] = ok (0) [expiration] = noop (0) [logintime] = noop (0) [pap] = updated (0) } # authorize = updated (0) Found Auth-Type = PAP (0) # Executing group from file /etc/raddb/sites-enabled/inner-tunnel (0) Auth-Type PAP { (0) pap : Login attempt with password (0) pap : Comparing with "known-good" SSHA-Password (0) pap : Normalizing SSHA1-Password from base64 encoding, 32 bytes -> 24 bytes (0) pap : User authenticated successfully (0) [pap] = ok (0) } # Auth-Type PAP = ok (0) # Executing section post-auth from file /etc/raddb/sites-enabled/inner-tunnel (0) post-auth { ... } # empty sub-section is ignored (0) Sending Access-Accept packet to host 127.0.0.1 port 41385, id=134, length=0 Sending Access-Accept Id 134 from 127.0.0.1:18120 to 127.0.0.1:41385 (0) Finished request Waking up in 0.3 seconds. Waking up in 4.6 seconds. Received Access-Request Id 145 from 127.0.0.1:37203 to 127.0.0.1:18120 length 133 User-Name = 'martinr' NAS-IP-Address = 10.0.0.40 NAS-Port = 0 Message-Authenticator = 0x0af14873ec9d8c071d4c71f95ebfe9d6 MS-CHAP-Challenge = 0x062507387c1f6b17 MS-CHAP-Response = 0x0001000000000000000000000000000000000000000000000000adc03505c874be4c4e5e7a7d6549ebd9beb0f752c40fc74f (1) Received Access-Request packet from host 127.0.0.1 port 37203, id=145, length=133 (1) User-Name = 'martinr' (1) NAS-IP-Address = 10.0.0.40 (1) NAS-Port = 0 (1) Message-Authenticator = 0x0af14873ec9d8c071d4c71f95ebfe9d6 (1) MS-CHAP-Challenge = 0x062507387c1f6b17 (1) MS-CHAP-Response = 0x0001000000000000000000000000000000000000000000000000adc03505c874be4c4e5e7a7d6549ebd9beb0f752c40fc74f (1) # Executing section authorize from file /etc/raddb/sites-enabled/inner-tunnel (1) authorize { (1) [chap] = noop (1) mschap : Found MS-CHAP attributes. Setting 'Auth-Type = mschap' (1) [mschap] = ok (1) suffix : Checking for suffix after "@" (1) suffix : No '@' in User-Name = "martinr", looking up realm NULL (1) suffix : No such realm "NULL" (1) [suffix] = noop (1) update control { (1) Proxy-To-Realm := 'LOCAL' (1) } # update control = noop (1) eap : No EAP-Message, not doing EAP (1) [eap] = noop (1) [files] = noop rlm_ldap (ldap): Reserved connection (4) (1) ldap : EXPAND (uid=%{%{Stripped-User-Name}:-%{User-Name}}) (1) ldap : --> (uid=martinr) (1) ldap : EXPAND dc=benon,dc=com (1) ldap : --> dc=benon,dc=com (1) ldap : Performing search in 'dc=benon,dc=com' with filter '(uid=martinr)', scope 'sub' (1) ldap : Waiting for search result... (1) ldap : User object found at DN "uid=martinr,cn=users,dc=benon,dc=com" (1) ldap : Processing user attributes (1) ldap : control:Password-With-Header += '{SSHA}sjcybNoAjvx2+LHSN9Z8zE0JEd0khiue' rlm_ldap (ldap): Released connection (4) (1) [ldap] = ok (1) [expiration] = noop (1) [logintime] = noop (1) WARNING: pap : Auth-Type already set. Not setting to PAP (1) [pap] = noop (1) } # authorize = ok (1) Found Auth-Type = MSCHAP (1) # Executing group from file /etc/raddb/sites-enabled/inner-tunnel (1) Auth-Type MS-CHAP { (1) WARNING: mschap : No Cleartext-Password configured. Cannot create LM-Password (1) WARNING: mschap : No Cleartext-Password configured. Cannot create NT-Password (1) mschap : Client is using MS-CHAPv1 with NT-Password (1) ERROR: mschap : FAILED: No NT/LM-Password. Cannot perform authentication (1) ERROR: mschap : MS-CHAP-Response is incorrect (1) [mschap] = reject (1) } # Auth-Type MS-CHAP = reject (1) Failed to authenticate the user (1) Using Post-Auth-Type Reject (1) # Executing group from file /etc/raddb/sites-enabled/inner-tunnel (1) Post-Auth-Type REJECT { (1) attr_filter.access_reject : EXPAND %{User-Name} (1) attr_filter.access_reject : --> martinr (1) attr_filter.access_reject : Matched entry DEFAULT at line 11 (1) [attr_filter.access_reject] = updated (1) } # Post-Auth-Type REJECT = updated (1) Delaying response for 1 seconds Waking up in 0.3 seconds. Waking up in 0.6 seconds. (1) Sending delayed response (1) Sending Access-Reject packet to host 127.0.0.1 port 37203, id=145, length=0 (1) MS-CHAP-Error = '\000E=691 R=1' Sending Access-Reject Id 145 from 127.0.0.1:18120 to 127.0.0.1:37203 MS-CHAP-Error = '\000E=691 R=1' Waking up in 1.5 seconds. (0) Cleaning up request packet ID 134 with timestamp +5 Waking up in 2.4 seconds. (1) Cleaning up request packet ID 145 with timestamp +8 Ready to process requests

2 1

COA to NAS behind proxy
by Sachin Yadav 12 Oct '15

12 Oct '15

Hi, I am trying it kick out user once monthly data limited is reached while account-update packet is received. My setup is - Freeradius ====== internet =========== ISP ===== modem ===== router(running chillispot) At freeradius i get public IP assigned to modem from ISP and now no matter what IP i try to send COA packet it fails. I have following entry - Client.confclient 0.0.0.0/0 { secret = xxxxx nastype = other coa_server = localhost-coa} originate-coahome_server localhost-coa { type = coa ipaddr = localhost port = 3799 secret = testing1234 # rest all is default...... default (in accounting section) update control { Tmp-Integer-0 := "%{sql:#query}" Tmp-Integer-1 := #query}if ("%{control:Tmp-Integer-0}" > "%{control:Tmp-Integer-1}") { update disconnect { User-Name = "%{request:User-Name}" Acct-Session-Id = "%{Acct-Session-Id}" NAS-IP-Address = "%{NAS-IP-Address}"}} Logs shows - ++++[disconnect] returns ok+++- if ("%{control:Tmp-Integer-0}" > "%{control:Tmp-Integer-1}") returns ok++- if ("%{control:Tmp-Integer-1}" != 0) returns ok++[exec] returns noop[attr_filter.accounting_response] expand: %{User-Name} -> xxxxxxxxxattr_filter: Matched entry DEFAULT at line 12++[attr_filter.accounting_response] returns updatedSending Accounting-Response of id 80 to 12x.162.x94.1x7 port 22626 WARNING: Empty pre-proxy section. Using default return values.Sending Disconnect-Request of id 188 to 127.0.0.1 port 3799 User-Name = "xxxxxxxxxx" Acct-Session-Id = "561ad05c00000001" NAS-IP-Address = 192.168.182.1Finished request 0.Cleaning up request 0 ID 80 with timestamp +26Going to the next requestWaking up in 2.0 seconds.Sending Disconnect-Request of id 188 to 127.0.0.1 port 3799 User-Name = "xxxxxxx" Acct-Session-Id = "561ad05c00000001" NAS-IP-Address = 192.168.182.1Waking up in 4.3 seconds.Sending Disconnect-Request of id 188 to 127.0.0.1 port 3799 User-Name = "xxxxxxx" Acct-Session-Id = "561ad05c00000001" NAS-IP-Address = 192.168.182.1Waking up in 8.6 seconds.Sending Disconnect-Request of id 188 to 127.0.0.1 port 3799 User-Name = "xxxxxx" Acct-Session-Id = "561ad05c00000001" NAS-IP-Address = 192.168.182.1Waking up in 14.9 seconds.No response to CoA request sent to 127.0.0.1 Found Post-Proxy-Type WARNING: Unknown value specified for Post-Proxy-Type. Cannot perform requested action.# Executing group from file /etc/freeradius/sites-enabled/defaultFinished request 0. Can someone please guide me if i am missing some conf. somewhere or it is not possible considering my network topology above. Also, i have set coaport 3799 and coanoipcheck in chilli.

2 3

Building from Source
by Arjan Sinnige 12 Oct '15

12 Oct '15

I've just finished building freeradius 2.2.9 from source on an Ubuntu 15.04 Server. Comments here are so other looking for info can find it here. I came across a few issues that one might want to solve in source or wiki. 1 - Build failed because it was unable to locate : /usr/include/isql.h There is an old thread on this list about removing the smart try entry but it now actually fails because of that removal. It is located on /usr/include/iodbc/isql.h on Ubuntu 15.04. (upgraded from 14.10) I had to enter the source of : freeradius-server-2.2.9/src/modules/rlm_sql/drivers/rlm_sql_iodbc/configure search for isql.h and change the data just above it to : smart_try_dir="$iodbc_include_dir /usr/include/iodbc /usr/local/iodbc/include" 2 - Dependancies were quite a few missing : quilt for one.. they are not all installed by apt-get build-dep freeradius but need to be installed apt-get install quilt 3 - Lots of errors caused by systemctl taking over on Ubuntu and service start/stop not functioning. Also caused by 4. 4- It will also fail to start because of openssl versioning : Put : allow_vulnerable_openssl = yes under Security in /etc/freeradius/radius.conf Hope this helps someone in the future.. Arjan Sinnige

5 4