- Freeradius-Users - lists.freeradius.org

RE: Backtrace of ldap related crash
by Franks Andy (IT Technical Architecture Manager) 22 Sep '15

22 Sep '15

Hi Alan, Drat, I fixed AD (memory leak) and now it's not likely to happen again until the next time, which could be a while away. I guess I'd best come back then :-) Sorry about that. Thanks Andy -----Original Message----- From: Freeradius-Users [mailto:freeradius-users-bounces+andy.franks=sath.nhs.uk@lists.freeradius.org] On Behalf Of Alan DeKok Sent: 22 September 2015 13:11 To: FreeRadius users mailing list Subject: Re: Backtrace of ldap related crash On Sep 22, 2015, at 6:16 AM, Franks Andy (IT Technical Architecture Manager) <Andy.Franks(a)sath.nhs.uk> wrote: > Backtrace: > > Program received signal SIGSEGV, Segmentation fault. > 0x00007ffff2fc2b8a in mod_authorize (instance=0xb3c680, request=0xd5f060) at src/modules/rlm_ldap/rlm_ldap.c:1455 > 1455 if (rlm_ldap_map_do(inst, request, conn->handle, &expanded, entry) > 0) rcode = RLM_MODULE_UPDATED; That's a weird place to have a crash. Can you do: (gdb) p *conn (gdb) p request Alan DeKok. - List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html

4 3

Return not working in 2.2.8?
by Jonathan 22 Sep '15

22 Sep '15

Hi, The server version is 2.2.8; In case the user is not found in our system and we are not doing EAP (as EAP doesn't support webredirects) we want to redirect them to a registration page. authorize { # All other default stuff ... # See "Authorization Queries" in sql.conf sql{ notfound = 1 } # Redirect unknown users to registration page # Do this only for captive-portal users if(notfound){ # Add failsafe when eap{ ok=return } is disabled if(EAP-Message){ notfound } else{ # Redirect unknown user to registration page register.redirect # do not parse other modules in authorize section return } } I tried to add the 'return' action to make avoid processing of the other authorize modules to save precious CPU cycles. However, the server throws an error: Module: Loading virtual module register.redirect /etc/freeradius/sites-enabled/default[197]: Failed to find "return" in the "modules" section. /etc/freeradius/sites-enabled/default[197]: Failed to parse "return" entry. /etc/freeradius/sites-enabled/default[193]: Failed to parse "else" subsection. /etc/freeradius/sites-enabled/default[69]: Errors parsing authorize section. I also tried notfound = return (as in the example of the EAP return message) Without the 'return' action, all works, but unnecessarily parses the other authorize modules which I want to avoid. Not sure what i'm doing wrong here, i followed the docs from http://freeradius.org/radiusd/man/unlang.html

2 1

It's possible to point a accounting packet to another virtual-server using VirtualServer?
by Jorge Pereira 22 Sep '15

22 Sep '15

Hi, I have a setup with many kinds of NAS, something like. 1) I have a default accounting server <set> # # Servidor de accounting # listen { type = acct ipaddr = * port = 1813 virtual_server = default-accounting } server default-accounting { preacct { if (!Acct-Status-Type) { do_not_respond } if ((&Acct-Status-Type == Accounting-On) || (&Acct-Status-Type == Accounting-Off)) { ok } acct_unique } accounting { attr_filter.accounting_response detail sql_acct } } </set> And I have the same below concept for another's NAS. root@srv1:# cat sites-enabled/server-nas-alcatel server server-nas-alcatel { authorize { ...... } authenticate { ...... } preact { ... doing translates from alcatel avp to intermediate avps. } accounting { # send to default acct virtual server update control { &Virtual-Server := "default-accounting" &FreeRADIUS-Client-Virtual-Server := "default-accounting" } } } root@srv1:# But wihtout success... someone have suggestions? -- Jorge Pereira

2 1

Yet Another PEAP-MSCHAPV2 problem
by Alex Moen 22 Sep '15

22 Sep '15

I have searched through the mailing list and Google for the resolution to this, and I have found quite a bit of information, but I have not yet found the solution to my problem. I am trying to properly configure a FreeRADIUS version 3.0.9 server to authenticate wireless users using PEAP and MSCHAPv2 against a OpenLDAP version 2.4.39. I can authenticate both users that I will be discussing directly against the LDAP server correctly (using "ldapsearch"). However, only one of them work via the wireless connection. I have attached 2 files: - debi-debug.txt: the failing account full debug of radiusd -x - alex-debug.txt: the working account full debug of radiusd -x These dubugs were gathered by attempting to authenticate the same Windows 7 laptop to the 802.1x wireless network. Working laptop, working network, different outcomes with two accounts that both work when authenticated with ldapsearch. When I run the debi-debug.txt text through the web debugger, I get the following lines in red: mschap: ERROR: FAILED: No NT/LM-Password. Cannot perform authentication mschap: ERROR: MS-CHAP2-Response is incorrect [mschap] = reject } # Auth-Type MS-CHAP = reject MSCHAP-Error: ?E=691 R=1 Could not parse new challenge from MS-CHAP-Error: 2 ERROR: MSCHAP Failure This is what I have been searching for, but I can't find any real reason that it works for the alex account but not the debi account. I can provide whatever is needed to find the problem here, I just don't know what will be helpful. TIA! Alex

5 12

Backtrace of ldap related crash
by Franks Andy (IT Technical Architecture Manager) 22 Sep '15

22 Sep '15

Hi all, FreeRADIUS Version 3.1.0 (git #390f216), built from source (just testing!) I'm getting the below when having timeouts and connectivity issues with our ldap servers, normally it's fine, but it's still a crash.. Can anybody tell if this issue is fixed and we should upgrade? Ideally we'd have ldap go completely wrong but freeradius ride on through it. Thanks Andy Debug: (-X) rlm_ldap (ldap2): Bind with cn=LDAPQuery,OU=SpecialUsers,OU=SATHUsers,DC=SATH,DC=nhs,DC=uk to ldap://10.51.0.39:389 failed: Timed out while waiting for server to respond rlm_ldap (ldap2): Failed to reconnect (24), no free connections are available (265) ldap2: ERROR: Bind with cn=LDAPQuery,OU=SpecialUsers,OU=SATHUsers,DC=SATH,DC=nhs,DC=uk to ldap://10.51.0.39:389 failed: Timed out while waiting for server to respond (265) ldap2: Processing user attributes Program received signal SIGSEGV, Segmentation fault. Backtrace: Program received signal SIGSEGV, Segmentation fault. 0x00007ffff2fc2b8a in mod_authorize (instance=0xb3c680, request=0xd5f060) at src/modules/rlm_ldap/rlm_ldap.c:1455 1455 if (rlm_ldap_map_do(inst, request, conn->handle, &expanded, entry) > 0) rcode = RLM_MODULE_UPDATED; (gdb) bt #0 0x00007ffff2fc2b8a in mod_authorize (instance=0xb3c680, request=0xd5f060) at src/modules/rlm_ldap/rlm_ldap.c:1455 #1 0x00000000004297bb in call_modsingle (component=RLM_COMPONENT_AUTZ, sp=0xc121e0, request=0xd5f060) at src/main/modcall.c:302 #2 0x0000000000429f52 in modcall_recurse (request=0xd5f060, component=RLM_COMPONENT_AUTZ, depth=5, entry=0x7fffffffd828, do_next_sibling=false) at src/main/modcall.c:584 #3 0x000000000042999e in modcall_child (request=0xd5f060, component=RLM_COMPONENT_AUTZ, depth=5, entry=0x7fffffffd810, c=0xc121e0, result=0x7fffffffb8f0, do_next_sibling=false) at src/main/modcall.c:408 #4 0x000000000042b241 in modcall_recurse (request=0xd5f060, component=RLM_COMPONENT_AUTZ, depth=4, entry=0x7fffffffd810, do_next_sibling=true) at src/main/modcall.c:963 #5 0x000000000042999e in modcall_child (request=0xd5f060, component=RLM_COMPONENT_AUTZ, depth=4, entry=0x7fffffffd7f8, c=0xc12020, result=0x7fffffffbf30, do_next_sibling=true) at src/main/modcall.c:408 #6 0x000000000042aa27 in modcall_recurse (request=0xd5f060, component=RLM_COMPONENT_AUTZ, depth=3, entry=0x7fffffffd7f8, do_next_sibling=true) at src/main/modcall.c:788 #7 0x000000000042999e in modcall_child (request=0xd5f060, component=RLM_COMPONENT_AUTZ, depth=3, entry=0x7fffffffd7e0, c=0xc11f20, result=0x7fffffffc570, do_next_sibling=true) at src/main/modcall.c:408 #8 0x000000000042aff2 in modcall_recurse (request=0xd5f060, component=RLM_COMPONENT_AUTZ, depth=2, entry=0x7fffffffd7e0, do_next_sibling=true) at src/main/modcall.c:925 #9 0x000000000042999e in modcall_child (request=0xd5f060, component=RLM_COMPONENT_AUTZ, depth=2, entry=0x7fffffffd7c8, c=0xc11930, result=0x7fffffffcbb0, do_next_sibling=true) at src/main/modcall.c:408 #10 0x000000000042aa27 in modcall_recurse (request=0xd5f060, component=RLM_COMPONENT_AUTZ, depth=1, entry=0x7fffffffd7c8, do_next_sibling=true) at src/main/modcall.c:788 #11 0x000000000042999e in modcall_child (request=0xd5f060, component=RLM_COMPONENT_AUTZ, depth=1, entry=0x7fffffffd7b0, c=0xbff230, result=0x7fffffffd1f0, do_next_sibling=true) at src/main/modcall.c:408 #12 0x000000000042aa27 in modcall_recurse (request=0xd5f060, component=RLM_COMPONENT_AUTZ, depth=0, entry=0x7fffffffd7b0, do_next_sibling=true) at src/main/modcall.c:788 #13 0x000000000042b864 in modcall (component=RLM_COMPONENT_AUTZ, c=0xbff130, request=0xd5f060) at src/main/modcall.c:1134 #14 0x0000000000426d1f in indexed_modcall (comp=RLM_COMPONENT_AUTZ, idx=0, request=0xd5f060) at src/main/modules.c:890 #15 0x0000000000429088 in process_authorize (autz_type=0, request=0xd5f060) at src/main/modules.c:2000 #16 0x000000000040f2a3 in rad_authenticate (request=0xd5f060) at src/main/auth.c:436 #17 0x000000000043e09e in request_running (request=0xd5f060, action=1) at src/main/process.c:1492 #18 0x000000000043cef5 in request_queue_or_run (request=0xd5f060, process=0x43df60 <request_running>) at src/main/process.c:986 #19 0x000000000043e94a in request_receive (ctx=0xd5ecf0, listener=0xca6ec0, packet=0xd5ed50, client=0xad7d00, fun=0x40f029 <rad_authenticate>) at src/main/process.c:1751 #20 0x00000000004183e8 in auth_socket_recv (listener=0xca6ec0) at src/main/listen.c:1566 #21 0x0000000000445bc6 in event_socket_handler (xel=0xada7a0, fd=12, ctx=0xca6ec0) at src/main/process.c:4473 #22 0x00007ffff7986bf1 in fr_event_loop (el=0xada7a0) at src/lib/event.c:638 #23 0x00000000004479dc in radius_event_process () at src/main/process.c:5420 #24 0x00000000004319b0 in main (argc=2, argv=0x7fffffffe648) at src/main/radiusd.c:581

2 1

proxy incoming PAP request as outgoing PEAP/TTLS requests
by Ian Chang-張志邦 22 Sep '15

22 Sep '15

Hi, I have a question about proxy requests on freeradius 3.0.9 I wonder to know can I proxy incoming PAP request as outgoing PEAP/TTLS requests? That is, RADIUS supplicants ---------PAP-------> freeradius server --------PEAP or TTLS-----> another RADIUS server If it is, what configuration I should config? Thanks a lot. This email and any files transmitted with it may contain information of ZyXEL Communications Corporation that are privileged / confidential and intended solely for the use of the individual or entity to whom they are addressed. If you are not the named addressee you should not disseminate, disclose, distribute, copy, or use this e-mail. Please notify the sender immediately by e-mail if you have received this e-mail by mistake and delete this e-mail from your system.

5 17

Rest API for authentication
by Randeep 22 Sep '15

22 Sep '15

Hi Alan, We have two types of IPTV boxes. One has pppoe support and other one doesn't have pppoe support. We are using FreeRadius 3.0.8 for authentication. I remember you mentioning that authentication can be done via a rest api also. So we can use this api for authentication for the device which doesn't have the pppoe support. Can you please help in configuring this. I couldn't find the details in documentation. -- Randeep Mob: +919447831699[kerala] Mob: +919880050349[B'lore] http://twitter.com/Randeeppr http://in.linkedin.com/in/randeeppr [image: --] Randeep Raman [image: http://]about.me/Randeeppr <http://about.me/Randeeppr>

2 4

Proxy check request problem
by Peter Balsianok 21 Sep '15

21 Sep '15

Hi I have following proxy configuration: Hi, I have following proxy configuration for 3rd party server (only piece of the configuration). .... require_message_authenticator = yes type = auth+acct port = 1812 # Status check via existing user status_check = request check_interval = 6 num_answers_to_alive = 3 username = "orange-system" password = "incorrect" # We don't need Access-Accept, enough is Access-Reject .... My server recieves only auth/autz requests which are proxied to 3rd party servers. In case of 3rd party unavailability the server sends request to check status of the 3rd party server. Question is why does server send Accounting Request instead of Access Accept ? Another question for clarification: If i use type=auth+acct, what is correct value for the port ? Is it correct port=1812 ? 15:34:29.016422 IP (tos 0x0, ttl 64, id 8072, offset 0, flags [none], proto: UDP (17), length: 118) tdrad1.vas.orange.sk.59157 > 10.14.135.19.radius: [udp sum ok] RADIUS, length: 90 Accounting Request (4), id: 0xea, Authenticator: 50365561fa7ae6cca5a956834b05dea8 Username Attribute (1), length: 15, Value: orange-system 0x0000: 6f72 616e 6765 2d73 7973 7465 6d Accounting Status Attribute (40), length: 6, Value: Stop 0x0000: 0000 0002 Accounting Session ID Attribute (44), length: 10, Value: 00000000 0x0000: 3030 3030 3030 3030 Event Timestamp Attribute (55), length: 6, Value: Mon Sep 21 15:34:29 2015 0x0000: 5600 0765 NAS ID Attribute (32), length: 33, Value: Status Check 64. Are you alive? 0x0000: 5374 6174 7573 2043 6865 636b 2036 342e 0x0010: 2041 7265 2079 6f75 2061 6c69 7665 3f 15:34:36.918919 IP (tos 0x0, ttl 64, id 8074, offset 0, flags [none], proto: UDP (17), length: 118) tdrad1.vas.orange.sk.59157 > 10.14.135.19.radius: [udp sum ok] RADIUS, length: 90 Accounting Request (4), id: 0xe9, Authenticator: 2f14cead04b5c267c9c85514235e5d48 Username Attribute (1), length: 15, Value: orange-system 0x0000: 6f72 616e 6765 2d73 7973 7465 6d Accounting Status Attribute (40), length: 6, Value: Stop 0x0000: 0000 0002 Accounting Session ID Attribute (44), length: 10, Value: 00000000 0x0000: 3030 3030 3030 3030 Event Timestamp Attribute (55), length: 6, Value: Mon Sep 21 15:34:36 2015 0x0000: 5600 076c NAS ID Attribute (32), length: 33, Value: Status Check 65. Are you alive? 0x0000: 5374 6174 7573 2043 6865 636b 2036 352e 0x0010: 2041 7265 2079 6f75 2061 6c69 7665 3f Thx.

2 1

Re: Freeradius - Client not authenticated
by Matthew Newton 21 Sep '15

21 Sep '15

Hi, [Please keep replies on-list] On Mon, Sep 21, 2015 at 02:31:29PM +0100, Federico Olivieri wrote: > Pre-configured profile --> Auth-Type Reject > Mine --> Auth-Type Accept > > Obviously, I didn't know what I was doing :) > Which kind of Authorization I need to use? Just remove that line. You shouldn't be setting Auth-Type to anything unless, as I said, you know what you're doing. The server figures it out itself. > In terms of password, it was already configured in clear text OK, you should hopefully be good to go then. Matthew -- Matthew Newton, Ph.D. <mcn4(a)le.ac.uk> Systems Specialist, Infrastructure Services, I.T. Services, University of Leicester, Leicester LE1 7RH, United Kingdom For IT help contact helpdesk extn. 2253, <ithelp(a)le.ac.uk>

2 1

accounting stop with TLS
by Riccardo locatelli 21 Sep '15

21 Sep '15

Hi I use freeradius 2.2.6 and i have configure both ttls and tls (I bought a certificate). My problem is about accounting with tls (used from client win7 and previous). They send always access request but rarely accounting stop! I have also configure simultaneous-use, but if client not send accounting stop, its session remains open and it will not be able to reconnect! TTLS clients have never had a problem aboute accouting. this is my configuration: radiusd: FreeRADIUS Version 2.2.6, for host x86_64-unknown-linux-gnu, built on F eb 18 2015 at 16:53:34 Copyright (C) 1999-2013 The FreeRADIUS server project and contributors. There is NO warranty; not even for MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. You may redistribute copies of FreeRADIUS under the terms of the GNU General Public License. For more information about these matters, see the file named COPYRIGHT. Starting - reading configuration files ... including configuration file /usr/local/etc/raddb/radiusd.conf including configuration file /usr/local/etc/raddb/proxy.conf including files in directory /usr/local/etc/raddb/modules/ including configuration file /usr/local/etc/raddb/modules/checkval including configuration file /usr/local/etc/raddb/modules/ntlm_auth including configuration file /usr/local/etc/raddb/modules/mschap including configuration file /usr/local/etc/raddb/modules/mac2ip including configuration file /usr/local/etc/raddb/modules/policy including configuration file /usr/local/etc/raddb/modules/dynamic_clients including configuration file /usr/local/etc/raddb/modules/expr including configuration file /usr/local/etc/raddb/modules/smsotp including configuration file /usr/local/etc/raddb/modules/radrelay including configuration file /usr/local/etc/raddb/modules/opendirectory including configuration file /usr/local/etc/raddb/modules/pam including configuration file /usr/local/etc/raddb/modules/always including configuration file /usr/local/etc/raddb/modules/detail.log including configuration file /usr/local/etc/raddb/modules/rediswho including configuration file /usr/local/etc/raddb/modules/radutmp including configuration file /usr/local/etc/raddb/modules/attr_filter including configuration file /usr/local/etc/raddb/modules/passwd including configuration file /usr/local/etc/raddb/modules/soh including configuration file /usr/local/etc/raddb/modules/ippool including configuration file /usr/local/etc/raddb/modules/acct_unique including configuration file /usr/local/etc/raddb/modules/smbpasswd including configuration file /usr/local/etc/raddb/modules/linelog including configuration file /usr/local/etc/raddb/modules/digest including configuration file /usr/local/etc/raddb/modules/cache including configuration file /usr/local/etc/raddb/modules/logintime including configuration file /usr/local/etc/raddb/modules/etc_group including configuration file /usr/local/etc/raddb/modules/redis including configuration file /usr/local/etc/raddb/modules/ldap including configuration file /usr/local/etc/raddb/modules/echo including configuration file /usr/local/etc/raddb/modules/chap including configuration file /usr/local/etc/raddb/modules/unix including configuration file /usr/local/etc/raddb/modules/detail including configuration file /usr/local/etc/raddb/modules/perl including configuration file /usr/local/etc/raddb/modules/replicate including configuration file /usr/local/etc/raddb/modules/sqlcounter_expire_on_l ogin including configuration file /usr/local/etc/raddb/modules/mac2vlan including configuration file /usr/local/etc/raddb/modules/cui including configuration file /usr/local/etc/raddb/modules/pap including configuration file /usr/local/etc/raddb/modules/otp including configuration file /usr/local/etc/raddb/modules/sql_log including configuration file /usr/local/etc/raddb/modules/realm including configuration file /usr/local/etc/raddb/modules/counter including configuration file /usr/local/etc/raddb/modules/inner-eap including configuration file /usr/local/etc/raddb/modules/detail.example.com including configuration file /usr/local/etc/raddb/modules/dhcp_sqlippool including configuration file /usr/local/etc/raddb/sql/mysql/ippool-dhcp.conf including configuration file /usr/local/etc/raddb/modules/preprocess including configuration file /usr/local/etc/raddb/modules/attr_rewrite including configuration file /usr/local/etc/raddb/modules/exec including configuration file /usr/local/etc/raddb/modules/expiration including configuration file /usr/local/etc/raddb/modules/krb5 including configuration file /usr/local/etc/raddb/modules/sradutmp including configuration file /usr/local/etc/raddb/modules/wimax including configuration file /usr/local/etc/raddb/modules/files including configuration file /usr/local/etc/raddb/eap.conf including configuration file /usr/local/etc/raddb/sql.conf including configuration file /usr/local/etc/raddb/sql/mysql/dialup.conf including configuration file /usr/local/etc/raddb/policy.conf including files in directory /usr/local/etc/raddb/sites-enabled/ including configuration file /usr/local/etc/raddb/sites-enabled/inner-tunnel including configuration file /usr/local/etc/raddb/sites-enabled/control-socket including configuration file /usr/local/etc/raddb/sites-enabled/default main { allow_core_dumps = no } including dictionary file /usr/local/etc/raddb/dictionary main { name = "radiusd" prefix = "/usr/local" localstatedir = "/usr/local/var" sbindir = "/usr/local/sbin" logdir = "/usr/local/var/log/radius" run_dir = "/usr/local/var/run/radiusd" libdir = "/usr/local/lib" radacctdir = "/usr/local/var/log/radius/radacct" hostname_lookups = no max_request_time = 30 cleanup_delay = 5 max_requests = 1024 pidfile = "/usr/local/var/run/radiusd/radiusd.pid" checkrad = "/usr/local/sbin/checkrad" debug_level = 0 proxy_requests = yes log { stripped_names = no auth = yes auth_badpass = yes auth_goodpass = yes } security { max_attributes = 200 reject_delay = 1 status_server = no allow_vulnerable_openssl = yes } } radiusd: #### Loading Realms and Home Servers #### proxy server { retry_delay = 5 retry_count = 3 default_fallback = no dead_time = 120 wake_all_if_all_dead = no } home_server localhost { ipaddr = 127.0.0.1 port = 1812 type = "auth" secret = "testing123" response_window = 20 max_outstanding = 65536 require_message_authenticator = yes zombie_period = 40 status_check = "status-server" ping_interval = 30 check_interval = 30 num_answers_to_alive = 3 num_pings_to_alive = 3 revive_interval = 120 status_check_timeout = 4 coa { irt = 2 mrt = 16 mrc = 5 mrd = 30 } } home_server_pool my_auth_failover { type = fail-over home_server = localhost } realm example.com { auth_pool = my_auth_failover } realm LOCAL { } radiusd: #### Loading Clients #### radiusd: #### Instantiating modules #### instantiate { Module: Linked to module rlm_exec Module: Instantiating module "exec" from file /usr/local/etc/raddb/modules/exec exec { wait = no input_pairs = "request" shell_escape = yes timeout = 10 } } radiusd: #### Loading Virtual Servers #### server { # from file /usr/loc▒▒▒▒ modules { Module: Creating Post-Auth-Type = REJECT Module: Checking authenticate {...} for more modules to load Module: Linked to module rlm_pap Module: Instantiating module "pap" from file /usr/local/etc/raddb/modules/pap pap { encryption_scheme = "auto" auto_header = no } Module: Linked to module rlm_chap Module: Instantiating module "chap" from file /usr/local/etc/raddb/modules/chap Module: Linked to module rlm_mschap Module: Instantiating module "mschap" from file /usr/local/etc/raddb/modules/ms chap mschap { use_mppe = no require_encryption = no require_strong = no with_ntdomain_hack = no allow_retry = yes } Module: Linked to module rlm_eap Module: Instantiating module "eap" from file /usr/local/etc/raddb/eap.conf eap { default_eap_type = "mschapv2" timer_expire = 2 ignore_unknown_eap_types = no cisco_accounting_username_bug = no max_sessions = 1024 } Module: Linked to sub-module rlm_eap_md5 Module: Instantiating eap-md5 Module: Linked to sub-module rlm_eap_gtc Module: Instantiating eap-gtc gtc { challenge = "Password: " auth_type = "PAP" } Module: Linked to sub-module rlm_eap_tls Module: Instantiating eap-tls tls { rsa_key_exchange = no dh_key_exchange = yes rsa_key_length = 512 dh_key_length = 512 verify_depth = 0 pem_file_type = yes private_key_file = "/usr/local/etc/raddb/certs/server.key" certificate_file = "/usr/local/etc/raddb/certs/server.pem" private_key_password = "RadiusPwdOut" dh_file = "/usr/local/etc/raddb/certs/dh" fragment_size = 1024 include_length = yes check_crl = no make_cert_command = "/usr/local/etc/raddb/certs/bootstrap" ecdh_curve = "prime256v1" cache { enable = no lifetime = 24 max_entries = 255 } verify { } ocsp { enable = no override_cert_url = no url = "http://127.0.0.1/ocsp/" use_nonce = yes timeout = 0 softfail = no } } Module: Linked to sub-module rlm_eap_ttls Module: Instantiating eap-ttls ttls { default_eap_type = "md5" copy_request_to_tunnel = yes use_tunneled_reply = yes virtual_server = "inner-tunnel" include_length = yes } Module: Linked to sub-module rlm_eap_peap Module: Instantiating eap-peap peap { default_eap_type = "mschapv2" copy_request_to_tunnel = yes use_tunneled_reply = yes proxy_tunneled_request_as_eap = no virtual_server = "inner-tunnel" soh = no } Module: Linked to sub-module rlm_eap_mschapv2 Module: Instantiating eap-mschapv2 mschapv2 { with_ntdomain_hack = no send_error = yes } Module: Checking authorize {...} for more modules to load Module: Linked to module rlm_preprocess Module: Instantiating module "preprocess" from file /usr/local/etc/raddb/module s/preprocess preprocess { huntgroups = "/usr/local/etc/raddb/huntgroups" hints = "/usr/local/etc/raddb/hints" with_ascend_hack = no ascend_channels_per_line = 23 with_ntdomain_hack = no with_specialix_jetstream_hack = no with_cisco_vsa_hack = no with_alvarion_vsa_hack = no } reading pairlist file /usr/local/etc/raddb/huntgroups reading pairlist file /usr/local/etc/raddb/hints Module: Linked to module rlm_sql Module: Instantiating module "sql" from file /usr/local/etc/raddb/sql.conf sql { driver = "rlm_sql_mysql" server = "localhost" port = "3306" login = "radius" password = "radpass" radius_db = "radius" read_groups = yes sqltrace = yes sqltracefile = "/usr/local/var/log/radius/sqltrace.sql" readclients = yes deletestalesessions = yes num_sql_socks = 32 lifetime = 0 max_queries = 0 sql_user_name = "%{User-Name}" default_user_profile = "" nas_query = "SELECT id, nasname, shortname, type, secret, server FROM na s" authorize_check_query = "SELECT id, username, attribute, value, op FROM radcheck WHERE username = '%{SQL-User-Name}' ORDER BY id" authorize_reply_query = "SELECT id, username, attribute, value, op FROM radreply WHERE username = '%{SQL-User-Name}' ORDER BY id" authorize_group_check_query = "SELECT id, groupname, attribute, Value, op FROM radgroupcheck WHERE groupname = '%{Sql-Grou p}' ORDER BY id" authorize_group_reply_query = "SELECT id, groupname, attribute, value, op FROM radgroupreply WHERE groupname = '%{Sql-Grou p}' ORDER BY id" accounting_onoff_query = " UPDATE radacct SET acctstoptime = '%S', acctsessiontime = unix_timest amp('%S') - unix_timestamp(acctstarttime), acctterminatecause = '%{Acct-Terminate-Cause}', acctsto pdelay = %{%{Acct-Delay-Time}:-0} WHERE acctstoptime IS NULL AND nasipaddress = '%{NAS-IP-Address}' AND acctstarttime <= '%S'" accounting_update_query = " UPDATE radacct SET framedipaddress = '%{Framed-IP-Address}', acctsessiontime = '%{%{Acct-Session-Time}:-0}', acctinputoctets = '%{%{Acct- Input-Gigawords}:-0}' << 32 | '%{%{Acct-Inpu t-Octets}:-0}', acctoutputoctets = '%{%{Acct-Output-Gigawords}:- 0}' << 32 | '%{%{Acct-Output-Octets}:-0}' WHERE acctsessionid = '%{Acct-Session-Id}' AND username = '%{SQL-User-Name}' AND nasipaddress = '%{NAS-IP-Address}'" accounting_update_query_alt = " INSERT INTO radacct (acctsessionid, acctuniqueid, username, realm, nasipaddress, nasportid, nasporttype, acctstarttime, acctsessiontime, acctauthentic, connectinfo_start, acctinputoct ets, acctoutputoctets, calledstationid, callingstationid, servicetype, framedprotocol, framedipaddress, acctsta rtdelay, xascendsessionsvrkey) VALUES ('%{Acct-Session-I d}', '%{Acct-Unique-Session-Id}', '%{SQL-User-Name}', '%{Realm}', '%{NAS-IP-Address}', '%{NAS-Port}', '%{NAS-Port-Type}', DATE_SUB('%S', INTERVAL (%{%{Acct-Session-Ti me}:-0} + %{%{Acct-Delay-Time}:-0}) SECOND), '%{%{Acct-Session-Time}:-0}', '%{Acct-Authentic} ', '', '%{%{Acct-Input-Gigawords}:-0}' << 32 | '%{%{Ac ct-Input-Octets}:-0}', '%{%{Acct-Output-Gigawords}:-0}' << 32 | '%{%{Acct-Output-Octets}:-0}', '%{Called-Station-Id}', '% {Calling-Station-Id}', '%{Service-Type}', '%{Framed-Protocol}', '%{Framed-IP-Address}', '0', '%{X-Ascend-Session-Svr-Key} ')" accounting_start_query = " INSERT INTO radacct (ac ctsessionid, acctuniqueid, username, realm, nasip address, nasportid, nasporttype, acctstarttime, acctsto ptime, acctsessiontime, acctauthentic, connectinfo_start, connectinfo_stop, acctinputoctets, acctoutputoctets, calle dstationid, callingstationid, acctterminatecause, servicetype, framedprotocol, framedipaddress, acctstartdelay, acctstopdela y, xascendsessionsvrkey) VALUES ('%{Acct-Session-Id}', '%{Acct-Unique-Session-Id}', '%{SQL-User-Name}', '%{Re alm}', '%{NAS-IP-Address}', '%{NAS-Port}', '%{NAS-Port-Type}', '%S' , NULL, '0', '%{Acct-Authentic}', '%{Connect-Info}', ' ', '0', '0', '%{Called-Station-Id}', '%{Calling-Station-Id}', '', '%{Service-Type}', '%{Framed-Protocol}', '%{Framed-IP-Address}', '%{%{Acct-Delay-Time}:-0}', '0', '%{X-Ascend-Session-Svr-Key}')" accounting_start_query_alt = " UPDATE radacct SET acctstarttime = '%S', acctstartdelay = '%{%{Acct-Delay-Time }:-0}', connectinfo_start = '%{Connect-Info}' WHERE accts essionid = '%{Acct-Session-Id}' AND username = '%{SQL-User-Na me}' AND nasipaddress = '%{NAS-IP-Address}'" accounting_stop_query = " UPDATE radacct SET acct stoptime = '%S', acctsessiontime = '%{%{Acct-Session-Time} :-0}', acctinputoctets = '%{%{Acct-Input-Gigawords}:-0}' << 32 | '%{%{Acct-Input-Octets}:-0}', ac ctoutputoctets = '%{%{Acct-Output-Gigawords}:-0}' << 32 | '%{%{Acct-Output-Octets}:-0}', acctterminatecause = ' %{Acct-Terminate-Cause}', acctstopdelay = '%{%{Acct-Delay-Time }:-0}', connectinfo_stop = '%{Connect-Info}' WHERE acct sessionid = '%{Acct-Session-Id}' AND username = '%{SQL-User -Name}' AND nasipaddress = '%{NAS-IP-Address}'" accounting_stop_query_alt = " INSERT INTO radacct (acctsessionid, acctuniqueid, username, realm, nasipaddress, naspor tid, nasporttype, acctstarttime, acctstoptime, acctses siontime, acctauthentic, connectinfo_start, connectinfo_stop, accti nputoctets, acctoutputoctets, calledstationid, callingstationid, ac ctterminatecause, servicetype, framedprotocol, framedipaddress, acctstartdelay, acctstopdelay) VALUES ('%{Acct-S ession-Id}', '%{Acct-Unique-Session-Id}', '%{SQL-User-Name}', '%{Realm}', '%{NAS-IP-Address}', '%{NAS-Port}', '%{NAS-Port -Type}', DATE_SUB('%S', INTERVAL (%{%{Acct-Session -Time}:-0} + %{%{Acct-Delay-Time}:-0}) SECOND), '% S', '%{%{Acct-Session-Time}:-0}', '%{Acct-Authentic}', '', '%{Conne ct-Info}', '%{%{Acct-Input-Gigawords}:-0}' << 32 | '%{ %{Acct-Input-Octets}:-0}', '%{%{Acct-Output-Gigawords}:-0}' << 32 | '%{%{Acct-Output-Octets}:-0}', '%{Called-Station-Id}' , '%{Calling-Station-Id}', '%{Acct-Terminate-Cause}', '%{Service-Type}', '%{Framed-Protocol}', '%{Framed-IP-Address}', '0 ', '%{%{Acct-Delay-Time}:-0}')" group_membership_query = "SELECT groupname FROM radusergroup WHERE username = '%{SQL-User-Name}' ORDER BY priority" connect_failure_retry_delay = 60 simul_count_query = "SELECT COUNT(*) FROM r adacct WHERE username = '%{SQL-User-Name}' AND acctstoptime IS NULL" simul_verify_query = "SELECT radacctid, acctsessionid, username, nasipaddress, nasportid, framedipaddress, callingstationid, framedprotocol FROM radacct WHERE username = '%{SQL-User-Name}' AND acctstoptime IS NULL" postauth_query = "INSERT INTO radpostauth (use rname, pass, reply, authdate) VALUES ( '%{User-Name}', '%{%{User-Password}:-%{Chap -Password}}', '%{reply:Packet-Type}', '%S')" safe-characters = "@abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ 0123456789.-_: /" } rlm_sql (sql): Driver rlm_sql_mysql (module rlm_sql_mysql) loaded and linked rlm_sql (sql): Attempting to connect to radius@localhost:3306/radius rlm_sql (sql): starting 0 rlm_sql (sql): Attempting to connect rlm_sql_mysql #0 rlm_sql_mysql: Starting connect to MySQL server for #0 rlm_sql (sql): Connected new DB handle, #0 rlm_sql (sql): starting 1 rlm_sql (sql): Attempting to connect rlm_sql_mysql #1 rlm_sql_mysql: Starting connect to MySQL server for #1 rlm_sql (sql): Connected new DB handle, #1 rlm_sql (sql): starting 2 rlm_sql (sql): Attempting to connect rlm_sql_mysql #2 rlm_sql_mysql: Starting connect to MySQL server for #2 rlm_sql (sql): Connected new DB handle, #2 rlm_sql (sql): starting 3 rlm_sql (sql): Attempting to connect rlm_sql_mysql #3 rlm_sql_mysql: Starting connect to MySQL server for #3 rlm_sql (sql): Connected new DB handle, #3 rlm_sql (sql): starting 4 rlm_sql (sql): Attempting to connect rlm_sql_mysql #4 rlm_sql_mysql: Starting connect to MySQL server for #4 rlm_sql (sql): Connected new DB handle, #4 rlm_sql (sql): starting 5 rlm_sql (sql): Attempting to connect rlm_sql_mysql #5 rlm_sql_mysql: Starting connect to MySQL server for #5 rlm_sql (sql): Connected new DB handle, #5 rlm_sql (sql): starting 6 rlm_sql (sql): Attempting to connect rlm_sql_mysql #6 rlm_sql_mysql: Starting connect to MySQL server for #6 rlm_sql (sql): Connected new DB handle, #6 rlm_sql (sql): starting 7 rlm_sql (sql): Attempting to connect rlm_sql_mysql #7 rlm_sql_mysql: Starting connect to MySQL server for #7 rlm_sql (sql): Connected new DB handle, #7 rlm_sql (sql): starting 8 rlm_sql (sql): Attempting to connect rlm_sql_mysql #8 rlm_sql_mysql: Starting connect to MySQL server for #8 rlm_sql (sql): Connected new DB handle, #8 rlm_sql (sql): starting 9 rlm_sql (sql): Attempting to connect rlm_sql_mysql #9 rlm_sql_mysql: Starting connect to MySQL server for #9 rlm_sql (sql): Connected new DB handle, #9 rlm_sql (sql): starting 10 rlm_sql (sql): Attempting to connect rlm_sql_mysql #10 rlm_sql_mysql: Starting connect to MySQL server for #10 rlm_sql (sql): Connected new DB handle, #10 rlm_sql (sql): starting 11 rlm_sql (sql): Attempting to connect rlm_sql_mysql #11 rlm_sql_mysql: Starting connect to MySQL server for #11 rlm_sql (sql): Connected new DB handle, #11 rlm_sql (sql): starting 12 rlm_sql (sql): Attempting to connect rlm_sql_mysql #12 rlm_sql_mysql: Starting connect to MySQL server for #12 rlm_sql (sql): Connected new DB handle, #12 rlm_sql (sql): starting 13 rlm_sql (sql): Attempting to connect rlm_sql_mysql #13 rlm_sql_mysql: Starting connect to MySQL server for #13 rlm_sql (sql): Connected new DB handle, #13 rlm_sql (sql): starting 14 rlm_sql (sql): Attempting to connect rlm_sql_mysql #14 rlm_sql_mysql: Starting connect to MySQL server for #14 rlm_sql (sql): Connected new DB handle, #14 rlm_sql (sql): starting 15 rlm_sql (sql): Attempting to connect rlm_sql_mysql #15 rlm_sql_mysql: Starting connect to MySQL server for #15 rlm_sql (sql): Connected new DB handle, #15 rlm_sql (sql): starting 16 rlm_sql (sql): Attempting to connect rlm_sql_mysql #16 rlm_sql_mysql: Starting connect to MySQL server for #16 rlm_sql (sql): Connected new DB handle, #16 rlm_sql (sql): starting 17 rlm_sql (sql): Attempting to connect rlm_sql_mysql #17 rlm_sql_mysql: Starting connect to MySQL server for #17 rlm_sql (sql): Connected new DB handle, #17 rlm_sql (sql): starting 18 rlm_sql (sql): Attempting to connect rlm_sql_mysql #18 rlm_sql_mysql: Starting connect to MySQL server for #18 rlm_sql (sql): Connected new DB handle, #18 rlm_sql (sql): starting 19 rlm_sql (sql): Attempting to connect rlm_sql_mysql #19 rlm_sql_mysql: Starting connect to MySQL server for #19 rlm_sql (sql): Connected new DB handle, #19 rlm_sql (sql): starting 20 rlm_sql (sql): Attempting to connect rlm_sql_mysql #20 rlm_sql_mysql: Starting connect to MySQL server for #20 rlm_sql (sql): Connected new DB handle, #20 rlm_sql (sql): starting 21 rlm_sql (sql): Attempting to connect rlm_sql_mysql #21 rlm_sql_mysql: Starting connect to MySQL server for #21 rlm_sql (sql): Connected new DB handle, #21 rlm_sql (sql): starting 22 rlm_sql (sql): Attempting to connect rlm_sql_mysql #22 rlm_sql_mysql: Starting connect to MySQL server for #22 rlm_sql (sql): Connected new DB handle, #22 rlm_sql (sql): starting 23 rlm_sql (sql): Attempting to connect rlm_sql_mysql #23 rlm_sql_mysql: Starting connect to MySQL server for #23 rlm_sql (sql): Connected new DB handle, #23 rlm_sql (sql): starting 24 rlm_sql (sql): Attempting to connect rlm_sql_mysql #24 rlm_sql_mysql: Starting connect to MySQL server for #24 rlm_sql (sql): Connected new DB handle, #24 rlm_sql (sql): starting 25 rlm_sql (sql): Attempting to connect rlm_sql_mysql #25 rlm_sql_mysql: Starting connect to MySQL server for #25 rlm_sql (sql): Connected new DB handle, #25 rlm_sql (sql): starting 26 rlm_sql (sql): Attempting to connect rlm_sql_mysql #26 rlm_sql_mysql: Starting connect to MySQL server for #26 rlm_sql (sql): Connected new DB handle, #26 rlm_sql (sql): starting 27 rlm_sql (sql): Attempting to connect rlm_sql_mysql #27 rlm_sql_mysql: Starting connect to MySQL server for #27 rlm_sql (sql): Connected new DB handle, #27 rlm_sql (sql): starting 28 rlm_sql (sql): Attempting to connect rlm_sql_mysql #28 rlm_sql_mysql: Starting connect to MySQL server for #28 rlm_sql (sql): Connected new DB handle, #28 rlm_sql (sql): starting 29 rlm_sql (sql): Attempting to connect rlm_sql_mysql #29 rlm_sql_mysql: Starting connect to MySQL server for #29 rlm_sql (sql): Connected new DB handle, #29 rlm_sql (sql): starting 30 rlm_sql (sql): Attempting to connect rlm_sql_mysql #30 rlm_sql_mysql: Starting connect to MySQL server for #30 rlm_sql (sql): Connected new DB handle, #30 rlm_sql (sql): starting 31 rlm_sql (sql): Attempting to connect rlm_sql_mysql #31 rlm_sql_mysql: Starting connect to MySQL server for #31 rlm_sql (sql): Connected new DB handle, #31 rlm_sql (sql): Processing generate_sql_clients rlm_sql (sql) in generate_sql_clients: query is SELECT id, nasname, shortname, t ype, secret, server FROM nas rlm_sql (sql): Reserving sql socket id: 31 rlm_sql_mysql: query: SELECT id, nasname, shortname, type, secret, server FROM nas rlm_sql (sql): Read entry nasname=192.168.16.249,shortname=cisco121,secret=DMedi aRadius rlm_sql (sql): Adding client 192.168.16.249 (cisco121, server=<none>) to clients list rlm_sql (sql): Read entry nasname=192.168.100.110,shortname=SysEdit Trunk,secret =DMediaRadius rlm_sql (sql): Adding client 192.168.100.110 (SysEdit Trunk, server=<none>) to c lients list rlm_sql (sql): Read entry nasname=192.168.10.9,shortname=Treviglio,secret=DMedia Radius rlm_sql (sql): Adding client 192.168.10.9 (Treviglio, server=<none>) to clients list rlm_sql (sql): Released sql socket id: 31 Module: Checking preacct {...} for more modules to load Module: Linked to module rlm_acct_unique Module: Instantiating module "acct_unique" from file /usr/local/etc/raddb/modul es/acct_unique acct_unique { key = "User-Name, Acct-Session-Id, NAS-IP-Address, NAS-Identifier, NAS-P ort" } Module: Checking accounting {...} for more modules to load Module: Linked to module rlm_always Module: Instantiating module "ok" from file /usr/local/etc/raddb/modules/always always ok { rcode = "ok" simulcount = 0 mpp = no } Module: Linked to module rlm_attr_filter Module: Instantiating module "attr_filter.accounting_response" from file /usr/l ocal/etc/raddb/modules/attr_filter attr_filter attr_filter.accounting_response { attrsfile = "/usr/local/etc/raddb/attrs.accounting_response" key = "%{User-Name}" relaxed = no } reading pairlist file /usr/local/etc/raddb/attrs.accounting_response Module: Checking session {...} for more modules to load Module: Checking post-proxy {...} for more modules to load Module: Checking post-auth {...} for more modules to load Module: Instantiating module "attr_filter.access_reject" from file /usr/local/e tc/raddb/modules/attr_filter attr_filter attr_filter.access_reject { attrsfile = "/usr/local/etc/raddb/attrs.access_reject" key = "%{User-Name}" relaxed = no } reading pairlist file /usr/local/etc/raddb/attrs.access_reject } # modules } # server server inner-tunnel { # from file /usr/local/etc/raddb/sites-enabled/inner-tunne l modules { Module: Checking authenticate {...} for more modules to load Module: Checking authorize {...} for more modules to load Module: Checking session {...} for more modules to load Module: Checking post-proxy {...} for more modules to load Module: Checking post-auth {...} for more modules to load } # modules } # server radiusd: #### Opening IP addresses and Ports #### listen { type = "auth" ipaddr = * port = 0 } listen { type = "acct" ipaddr = * port = 0 } listen { type = "control" listen { socket = "/usr/local/var/run/radiusd/radiusd.sock" } } listen { type = "auth" ipaddr = 127.0.0.1 port = 18120 } ... adding new socket proxy address * port 39619 Listening on authentication address * port 1812 Listening on accounting address * port 1813 Listening on command file /usr/local/var/run/radiusd/radiusd.sock Listening on authentication address 127.0.0.1 port 18120 as server inner-tunnel Listening on proxy address * port 1814 Ready to process requests. -- Riccardo Locatelli

4 6