- Freeradius-Users - lists.freeradius.org

Re: Re: Freeradius 3 and routers problem
by alter1 19 Jan '15

19 Jan '15

Hello again, I know it might sound impossible, but sometimes I have an idea that radius in certain moment sent some like "deauth" packet to radius clients on AP's and in this case those clients dont talk to radius server anymore. Sorry I haven't so many time to read right RFC :-). So just ask :) After rebooting AP's is the same as I described with radius server. It works for 30-60 minutes and then after another... after another... A few hours ago I compiled my favorite distro - gentoo and emerge freeradius for this platform. I flashed wrt54gl with dd-wrt firmware (for better testing client from linksys dd-wrt shell) # radius-client test test 192.168.10.19 1812 link1 Accept I repeated it every 2 hours and ... is still working without any problems. But because of nighttime I can prove it tomorrowe with real wifi clients. I'll back soon With regards, MK The only difference is that is net-dialup/freeradius-2.2.5 version - not 3 like in centos distr. W dniu 2015-01-19 13:44:01 użytkownik Alan DeKok <aland(a)deployingradius.com> napisał: > On Jan 19, 2015, at 6:29 AM, alter1 <alter1(a)onet.pl> wrote: > > I have a network: 3 soho wifi routers Dlink wrt54gl, wrt320n and Asus RT-AC52U. On each is the same configuration (wifi wpa2-enterprise with radius auth on 192.168.10.x server with 1812 port and secret key for each client) > > OK. That should be simple enough. > > > > Mon Jan 19 12:16:10 2015 : Auth: (80) Login OK: [test/<via Auth-Type = MSCHAP>] (from client rt-a1-1 port 0 via TLS tunnel) > > Mon Jan 19 12:17:13 2015 : Auth: (85) Login OK: [test/<via Auth-Type = EAP>] (from client rt-a1-1 port 13 cli 8c3ae3XXXXXX) > > And all works... But... Ater some period of time 30-60 minutes noone can connect to wifi on AP’s. > > That’s bad. > > > I tried with alternative firmwares. Still the same. > > After tcpdump connections I have nothing... That mean. I tcpdump iface (ens160) and cannot see ANY PACKETS from any AP's to radius server… > > Then the APs are broken. When a user logs in, the APs should start doing RADIUS. > > > Problem disappear after restart freeradius (systemctl restart radiusd.service). > > Restarting FreeRADIUS doesn’t cause the APs to start sending packets. Something else is going on. > > What happens if you reboot the APs instead of FreeRADIUS? > > Alan DeKok. > > - > List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html >

2 1

VMPS sql error - WARNING: Unknown module "sql" in string expansion "%"
by Keith Olsen 19 Jan '15

19 Jan '15

Hello, I have installed 2.2.6 from source on Ubuntu 14.10 and compiled and installed the sql driver I uncommented the $INCLUDE sql.conf line in radiusd.conf and assured the sql.conf is configured for my mysql environment. radiusd -X starts without any errors, but when my switch queries for the mac 2 vlan mapping I get the error: WARNING: Unknown module "sql" in string expansion “%” Not sure what I am missing…. Thanks! Keith radiusd -X output: root@freerad02:/usr/local/etc/raddb# radiusd -X radiusd: FreeRADIUS Version 2.2.6, for host x86_64-unknown-linux-gnu, built on Jan 18 2015 at 12:34:27 Copyright (C) 1999-2013 The FreeRADIUS server project and contributors. There is NO warranty; not even for MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. You may redistribute copies of FreeRADIUS under the terms of the GNU General Public License. For more information about these matters, see the file named COPYRIGHT. Starting - reading configuration files ... including configuration file /usr/local/etc/raddb/radiusd.conf including configuration file /usr/local/etc/raddb/proxy.conf including configuration file /usr/local/etc/raddb/clients.conf including files in directory /usr/local/etc/raddb/modules/ including configuration file /usr/local/etc/raddb/modules/sqlcounter_expire_on_login including configuration file /usr/local/etc/raddb/modules/mac2ip including configuration file /usr/local/etc/raddb/modules/files including configuration file /usr/local/etc/raddb/modules/etc_group including configuration file /usr/local/etc/raddb/modules/mac2vlan including configuration file /usr/local/etc/raddb/modules/expiration including configuration file /usr/local/etc/raddb/modules/sradutmp including configuration file /usr/local/etc/raddb/modules/pam including configuration file /usr/local/etc/raddb/modules/dynamic_clients including configuration file /usr/local/etc/raddb/modules/chap including configuration file /usr/local/etc/raddb/modules/smsotp including configuration file /usr/local/etc/raddb/modules/cache including configuration file /usr/local/etc/raddb/modules/radutmp including configuration file /usr/local/etc/raddb/modules/wimax including configuration file /usr/local/etc/raddb/modules/otp including configuration file /usr/local/etc/raddb/modules/attr_rewrite including configuration file /usr/local/etc/raddb/modules/replicate including configuration file /usr/local/etc/raddb/modules/preprocess including configuration file /usr/local/etc/raddb/modules/mschap including configuration file /usr/local/etc/raddb/modules/ntlm_auth including configuration file /usr/local/etc/raddb/modules/sql_log including configuration file /usr/local/etc/raddb/modules/echo including configuration file /usr/local/etc/raddb/modules/radrelay including configuration file /usr/local/etc/raddb/modules/counter including configuration file /usr/local/etc/raddb/modules/dhcp_sqlippool including configuration file /usr/local/etc/raddb/sql/mysql/ippool-dhcp.conf including configuration file /usr/local/etc/raddb/modules/digest including configuration file /usr/local/etc/raddb/modules/acct_unique including configuration file /usr/local/etc/raddb/modules/ldap including configuration file /usr/local/etc/raddb/modules/cui including configuration file /usr/local/etc/raddb/modules/unix including configuration file /usr/local/etc/raddb/modules/pap including configuration file /usr/local/etc/raddb/modules/redis including configuration file /usr/local/etc/raddb/modules/linelog including configuration file /usr/local/etc/raddb/modules/opendirectory including configuration file /usr/local/etc/raddb/modules/soh including configuration file /usr/local/etc/raddb/modules/exec including configuration file /usr/local/etc/raddb/modules/rediswho including configuration file /usr/local/etc/raddb/modules/always including configuration file /usr/local/etc/raddb/modules/passwd including configuration file /usr/local/etc/raddb/modules/inner-eap including configuration file /usr/local/etc/raddb/modules/expr including configuration file /usr/local/etc/raddb/modules/checkval including configuration file /usr/local/etc/raddb/modules/smbpasswd including configuration file /usr/local/etc/raddb/modules/detail.log including configuration file /usr/local/etc/raddb/modules/realm including configuration file /usr/local/etc/raddb/modules/policy including configuration file /usr/local/etc/raddb/modules/detail including configuration file /usr/local/etc/raddb/modules/ippool including configuration file /usr/local/etc/raddb/modules/detail.example.com including configuration file /usr/local/etc/raddb/modules/perl including configuration file /usr/local/etc/raddb/modules/logintime including configuration file /usr/local/etc/raddb/modules/attr_filter including configuration file /usr/local/etc/raddb/modules/krb5 including configuration file /usr/local/etc/raddb/eap.conf including configuration file /usr/local/etc/raddb/sql.conf including configuration file /usr/local/etc/raddb/sql/mysql/dialup.conf including configuration file /usr/local/etc/raddb/policy.conf including files in directory /usr/local/etc/raddb/sites-enabled/ including configuration file /usr/local/etc/raddb/sites-enabled/vmps including configuration file /usr/local/etc/raddb/sites-enabled/default including configuration file /usr/local/etc/raddb/sites-enabled/inner-tunnel including configuration file /usr/local/etc/raddb/sites-enabled/control-socket main { allow_core_dumps = no } including dictionary file /usr/local/etc/raddb/dictionary main { name = "radiusd" prefix = "/usr/local" localstatedir = "/usr/local/var" sbindir = "/usr/local/sbin" logdir = "/usr/local/var/log/radius" run_dir = "/usr/local/var/run/radiusd" libdir = "/usr/local/lib" radacctdir = "/usr/local/var/log/radius/radacct" hostname_lookups = no max_request_time = 30 cleanup_delay = 5 max_requests = 1024 pidfile = "/usr/local/var/run/radiusd/radiusd.pid" checkrad = "/usr/local/sbin/checkrad" debug_level = 0 proxy_requests = yes log { stripped_names = no auth = no auth_badpass = no auth_goodpass = no } security { max_attributes = 200 reject_delay = 1 status_server = yes allow_vulnerable_openssl = yes } } radiusd: #### Loading Realms and Home Servers #### proxy server { retry_delay = 5 retry_count = 3 default_fallback = no dead_time = 120 wake_all_if_all_dead = no } home_server localhost { ipaddr = 127.0.0.1 port = 1812 type = "auth" secret = "testing123" response_window = 20 max_outstanding = 65536 require_message_authenticator = yes zombie_period = 40 status_check = "status-server" ping_interval = 30 check_interval = 30 num_answers_to_alive = 3 num_pings_to_alive = 3 revive_interval = 120 status_check_timeout = 4 coa { irt = 2 mrt = 16 mrc = 5 mrd = 30 } } home_server_pool my_auth_failover { type = fail-over home_server = localhost } realm example.com { auth_pool = my_auth_failover } realm LOCAL { } radiusd: #### Loading Clients #### client localhost { ipaddr = 127.0.0.1 require_message_authenticator = no secret = "testing123" nastype = "other" } client cisco { ipaddr = 192.168.30.11 require_message_authenticator = no secret = "password" nastype = "cisco" } radiusd: #### Instantiating modules #### instantiate { Module: Linked to module rlm_exec Module: Instantiating module "exec" from file /usr/local/etc/raddb/modules/exec exec { wait = no input_pairs = "request" shell_escape = yes timeout = 10 } Module: Linked to module rlm_expr Module: Instantiating module "expr" from file /usr/local/etc/raddb/modules/expr Module: Linked to module rlm_expiration Module: Instantiating module "expiration" from file /usr/local/etc/raddb/modules/expiration expiration { reply-message = "Password Has Expired " } Module: Linked to module rlm_logintime Module: Instantiating module "logintime" from file /usr/local/etc/raddb/modules/logintime logintime { reply-message = "You are calling outside your allowed timespan " minimum-timeout = 60 } } radiusd: #### Loading Virtual Servers #### server { # from file ? modules { Module: Creating Auth-Type = digest Module: Creating Post-Auth-Type = REJECT Module: Checking authenticate {...} for more modules to load Module: Linked to module rlm_pap Module: Instantiating module "pap" from file /usr/local/etc/raddb/modules/pap pap { encryption_scheme = "auto" auto_header = no } Module: Linked to module rlm_chap Module: Instantiating module "chap" from file /usr/local/etc/raddb/modules/chap Module: Linked to module rlm_mschap Module: Instantiating module "mschap" from file /usr/local/etc/raddb/modules/mschap mschap { use_mppe = yes require_encryption = no require_strong = no with_ntdomain_hack = no allow_retry = yes } Module: Linked to module rlm_digest Module: Instantiating module "digest" from file /usr/local/etc/raddb/modules/digest Module: Linked to module rlm_unix Module: Instantiating module "unix" from file /usr/local/etc/raddb/modules/unix unix { radwtmp = "/usr/local/var/log/radius/radwtmp" } Module: Linked to module rlm_eap Module: Instantiating module "eap" from file /usr/local/etc/raddb/eap.conf eap { default_eap_type = "md5" timer_expire = 60 ignore_unknown_eap_types = no cisco_accounting_username_bug = no max_sessions = 1024 } Module: Linked to sub-module rlm_eap_md5 Module: Instantiating eap-md5 Module: Linked to sub-module rlm_eap_leap Module: Instantiating eap-leap Module: Linked to sub-module rlm_eap_gtc Module: Instantiating eap-gtc gtc { challenge = "Password: " auth_type = "PAP" } Module: Linked to sub-module rlm_eap_tls Module: Instantiating eap-tls tls { rsa_key_exchange = no dh_key_exchange = yes rsa_key_length = 512 dh_key_length = 512 verify_depth = 0 CA_path = "/usr/local/etc/raddb/certs" pem_file_type = yes private_key_file = "/usr/local/etc/raddb/certs/server.pem" certificate_file = "/usr/local/etc/raddb/certs/server.pem" CA_file = "/usr/local/etc/raddb/certs/ca.pem" private_key_password = "whatever" dh_file = "/usr/local/etc/raddb/certs/dh" fragment_size = 1024 include_length = yes check_crl = no cipher_list = "DEFAULT" make_cert_command = "/usr/local/etc/raddb/certs/bootstrap" ecdh_curve = "prime256v1" cache { enable = no lifetime = 24 max_entries = 255 } verify { } ocsp { enable = no override_cert_url = yes url = "http://127.0.0.1/ocsp/" use_nonce = yes timeout = 0 softfail = no } } Module: Linked to sub-module rlm_eap_ttls Module: Instantiating eap-ttls ttls { default_eap_type = "md5" copy_request_to_tunnel = no use_tunneled_reply = no virtual_server = "inner-tunnel" include_length = yes } Module: Linked to sub-module rlm_eap_peap Module: Instantiating eap-peap peap { default_eap_type = "mschapv2" copy_request_to_tunnel = no use_tunneled_reply = no proxy_tunneled_request_as_eap = yes virtual_server = "inner-tunnel" soh = no } Module: Linked to sub-module rlm_eap_mschapv2 Module: Instantiating eap-mschapv2 mschapv2 { with_ntdomain_hack = no send_error = no } Module: Checking authorize {...} for more modules to load Module: Linked to module rlm_preprocess Module: Instantiating module "preprocess" from file /usr/local/etc/raddb/modules/preprocess preprocess { huntgroups = "/usr/local/etc/raddb/huntgroups" hints = "/usr/local/etc/raddb/hints" with_ascend_hack = no ascend_channels_per_line = 23 with_ntdomain_hack = no with_specialix_jetstream_hack = no with_cisco_vsa_hack = no with_alvarion_vsa_hack = no } reading pairlist file /usr/local/etc/raddb/huntgroups reading pairlist file /usr/local/etc/raddb/hints Module: Linked to module rlm_realm Module: Instantiating module "suffix" from file /usr/local/etc/raddb/modules/realm realm suffix { format = "suffix" delimiter = "@" ignore_default = no ignore_null = no } Module: Linked to module rlm_files Module: Instantiating module "files" from file /usr/local/etc/raddb/modules/files files { usersfile = "/usr/local/etc/raddb/users" acctusersfile = "/usr/local/etc/raddb/acct_users" preproxy_usersfile = "/usr/local/etc/raddb/preproxy_users" compat = "no" } reading pairlist file /usr/local/etc/raddb/users reading pairlist file /usr/local/etc/raddb/acct_users reading pairlist file /usr/local/etc/raddb/preproxy_users Module: Checking preacct {...} for more modules to load Module: Linked to module rlm_acct_unique Module: Instantiating module "acct_unique" from file /usr/local/etc/raddb/modules/acct_unique acct_unique { key = "User-Name, Acct-Session-Id, NAS-IP-Address, NAS-Identifier, NAS-Port" } Module: Checking accounting {...} for more modules to load Module: Linked to module rlm_detail Module: Instantiating module "detail" from file /usr/local/etc/raddb/modules/detail detail { detailfile = "/usr/local/var/log/radius/radacct/%{%{Packet-Src-IP-Address}:-%{Packet-Src-IPv6-Address}}/detail-%Y%m%d" header = "%t" detailperm = 384 dirperm = 493 locking = no log_packet_header = no } Module: Linked to module rlm_attr_filter Module: Instantiating module "attr_filter.accounting_response" from file /usr/local/etc/raddb/modules/attr_filter attr_filter attr_filter.accounting_response { attrsfile = "/usr/local/etc/raddb/attrs.accounting_response" key = "%{User-Name}" relaxed = no } reading pairlist file /usr/local/etc/raddb/attrs.accounting_response Module: Checking session {...} for more modules to load Module: Linked to module rlm_radutmp Module: Instantiating module "radutmp" from file /usr/local/etc/raddb/modules/radutmp radutmp { filename = "/usr/local/var/log/radius/radutmp" username = "%{User-Name}" case_sensitive = yes check_with_nas = yes perm = 384 callerid = yes } Module: Checking post-proxy {...} for more modules to load Module: Checking post-auth {...} for more modules to load Module: Instantiating module "attr_filter.access_reject" from file /usr/local/etc/raddb/modules/attr_filter attr_filter attr_filter.access_reject { attrsfile = "/usr/local/etc/raddb/attrs.access_reject" key = "%{User-Name}" relaxed = no } reading pairlist file /usr/local/etc/raddb/attrs.access_reject } # modules } # server server vmps { # from file /usr/local/etc/raddb/sites-enabled/vmps modules { Module: Checking vmps {...} for more modules to load } # modules } # server server inner-tunnel { # from file /usr/local/etc/raddb/sites-enabled/inner-tunnel modules { Module: Checking authenticate {...} for more modules to load Module: Checking authorize {...} for more modules to load Module: Checking session {...} for more modules to load Module: Checking post-proxy {...} for more modules to load Module: Checking post-auth {...} for more modules to load } # modules } # server radiusd: #### Opening IP addresses and Ports #### listen { type = "auth" ipaddr = * port = 0 } listen { type = "acct" ipaddr = * port = 0 } listen { type = "control" listen { socket = "/usr/local/var/run/radiusd/radiusd.sock" } } listen { type = "vmps" ipaddr = * port = 1589 } listen { type = "auth" ipaddr = 127.0.0.1 port = 18120 } ... adding new socket proxy address * port 50880 Listening on authentication address * port 1812 Listening on accounting address * port 1813 Listening on command file /usr/local/var/run/radiusd/radiusd.sock Listening on vmps address * port 1589 as server vmps Listening on authentication address 127.0.0.1 port 18120 as server inner-tunnel Listening on proxy address * port 1814 Ready to process requests. vmps config # -*- text -*- ###################################################################### # # As of version 2.0.0, the server also supports the VMPS # protocol. # # $Id: 13f4e955799583b1b8f843e8965465178ff6038f $ # ###################################################################### server vmps { listen { # VMPS sockets only support IPv4 addresses. ipaddr = * # Port on which to listen. # Allowed values are: # integer port number # 1589 is the default VMPS port. port = 1589 # Type of packets to listen for. Here, it is VMPS. type = vmps # Some systems support binding to an interface, in addition # to the IP address. This feature isn't strictly necessary, # but for sites with many IP addresses on one interface, # it's useful to say "listen on all addresses for # eth0". # # If your system does not support this feature, you will # get an error if you try to use it. # # interface = eth0 } # If you have switches that are allowed to send VMPS, but NOT # RADIUS packets, then list them here as "client" sections. # # Note that for compatibility with RADIUS, you still have to # list a "secret" for each client, though that secret will not # be used for anything. # And the REAL contents. This section is just like the # "post-auth" section of radiusd.conf. In fact, it calls the # "post-auth" component of the modules that are listed here. # But it's called "vmps" to highlight that it's for VMPS. # vmps { # # Some requests may not have a MAC address. Try to # create one using other attributes. if (!VMPS-Mac) { if (VMPS-Ethernet-Frame =~ /0x.{12}(..)(..)(..)(..)(..)(..).*/) { update request { VMPS-Mac = "%{1}:%{2}:%{3}:%{4}:%{5}:%{6}" } } else { update request { VMPS-Mac = "%{VMPS-Cookie}" } } } # Do a simple mapping of MAC to VLAN. # # See radiusd.conf for the definition of the "mac2vlan" # module. # #mac2vlan # required VMPS reply attributes update reply { VMPS-Packet-Type = VMPS-Join-Response VMPS-Cookie = "%{VMPS-Mac}" # VMPS-VLAN-Name = "please_use_real_vlan_here" # # If you have VLAN's in a database, you can select # the VLAN name based on the MAC address. # #VMPS-VLAN-Name = "%{sql:select ... where mac='%{VMPS-Mac}'}" VMPS-VLAN-Name = "%{%{sql:SELECT vlan FROM mac2vlan WHERE mac='%{VMPS-Mac}'}:-'default'}" } # correct reply packet type for reconfirmation requests # if (VMPS-Packet-Type == VMPS-Reconfirm-Request){ update reply { VMPS-Packet-Type := VMPS-Reconfirm-Response } } } # Proxying of VMPS requests is NOT supported. }

3 3

Freeradius 3 and routers problem
by alter1 19 Jan '15

19 Jan '15

Hello, I have a network: 3 soho wifi routers Dlink wrt54gl, wrt320n and Asus RT-AC52U. On each is the same configuration (wifi wpa2-enterprise with radius auth on 192.168.10.x server with 1812 port and secret key for each client) Server is Centos 7 based with latest version with ip 192.168.10.x # repoquery freeradius freeradius-0:3.0.1-6.el7.x86_64 # tail -19 /etc/raddb/clients.conf client rt-a1-2 { ipaddr = 192.168.10.4 secret = test1 shortname = rt-a1-2 } client rt-a1-1 { ipaddr = 192.168.10.2 secret = test2 shortname = rt-a1-1 } client rt-a2-1 { ipaddr = 192.168.10.3 secret = test3 shortname = rt-a2-1 } In /etc/raddb/users par example: "test" Cleartext-Password := "test" and others in the same format... This server is relay to other dhcp server therefore I have: # cat /etc/raddb/sites-available/dhcp.relay server dhcp.ens160 { listen { ipaddr = * port = 67 type = dhcp interface = ens160 } dhcp DHCP-Discover { update config { DHCP-Relay-To-IP-Address := 192.168.10.1 } update request { DHCP-Gateway-IP-Address := 192.168.10.254 } ok } dhcp DHCP-Request { update config { DHCP-Relay-To-IP-Address := 192.168.10.1 } update request { DHCP-Gateway-IP-Address := 192.168.10.254 } ok } } On 192.168.10.1 dhcpserver works ok In logs /var/log/radius/radius.log Mon Jan 19 12:07:14 2015 : Auth: (44) Login OK: [test/<via Auth-Type = MSCHAP>] (from client rt-a1-1 port 0 via TLS tunnel) Mon Jan 19 12:07:14 2015 : Auth: (45) Login OK: [test/<via Auth-Type = EAP>] (from client rt-a1-1 port 13 cli 8c3ae3XXXXXX) Mon Jan 19 12:13:23 2015 : Auth: (59) Login OK: [test/<via Auth-Type = MSCHAP>] (from client rt-a1-1 port 0 via TLS tunnel) Mon Jan 19 12:13:23 2015 : Auth: (60) Login OK: [test/<via Auth-Type = EAP>] (from client rt-a1-1 port 13 cli 8c3ae3XXXXXX) Mon Jan 19 12:15:18 2015 : Auth: (70) Login OK: [test/<via Auth-Type = MSCHAP>] (from client rt-a1-2 port 0 via TLS tunnel) Mon Jan 19 12:15:18 2015 : Auth: (71) Login OK: [test/<via Auth-Type = EAP>] (from client rt-a1-2 port 0 cli 8C-3A-E3-XX-XX-XX) Mon Jan 19 12:16:10 2015 : Auth: (80) Login OK: [test/<via Auth-Type = MSCHAP>] (from client rt-a1-1 port 0 via TLS tunnel) Mon Jan 19 12:17:13 2015 : Auth: (85) Login OK: [test/<via Auth-Type = EAP>] (from client rt-a1-1 port 13 cli 8c3ae3XXXXXX) And all works... But... Ater some period of time 30-60 minutes noone can connect to wifi on AP's. I tried with alternative firmwares. Still the same. After tcpdump connections I have nothing... That mean. I tcpdump iface (ens160) and cannot see ANY PACKETS from any AP's to radius server... Problem disappear after restart freeradius (systemctl restart radiusd.service). And after some period of time... the same is happen. What the point? Where can be a problem? I tried to disable renew key on AP in radius configuration but this not helps. Thanx for help :-) With regards MK

2 1

How to configure freeradius on switch cisco catalyst 2940 and switch juniper ex2200 ?
by Sautron Nick 19 Jan '15

19 Jan '15

Hi, I would like to know, How to configure freeradius on switch cisco "catalyst 2940" and switch "juniper ex2200" ? Best Regards

2 1

Radperf Template example
by Jake Snyder 18 Jan '15

18 Jan '15

So after a long time, radperf is back and available for download. I've got it downloaded and it's working well, although there is no readme for the product. And since i never used the old version, I don't have the requisite knowledge to do what I need. I need to implement the -T feature (template) for radius requests in order to add the NAS-ID or NAS-IP-Address fields. I'm assuming there is a specific format for adding these fields to the Radius-Request, but no clue what it needs to be. Any help would be appreciated. Thanks Jake

3 2

UPN, NTLM_AUTH, Freeradius: It shouldn't work ... but it does (sometimes).
by Sam Fakhreddine 17 Jan '15

17 Jan '15

Hello Esteemed Colleagues, I know that using samba and NTLM_auth UPN authentication is not meant to work. However, much to my embarrassment with management, it does. Sometimes. I am able to login to our WiFi with my UPN login instead of my windows login (these 2 addresses differ significantly for everyone). I cannot determine when and where it works. Sometimes it lets us through, other times denies us. Any help is appreciated. Here is the output of radiusd -X radiusd: #### Instantiating modules #### instantiate { } modules { # Loaded module rlm_always # Instantiating module "fail" from file /usr/local/etc/raddb/mods-enabled/always always fail { rcode = "fail" simulcount = 0 mpp = no } # Instantiating module "reject" from file /usr/local/etc/raddb/mods-enabled/always always reject { rcode = "reject" simulcount = 0 mpp = no } # Instantiating module "noop" from file /usr/local/etc/raddb/mods-enabled/always always noop { rcode = "noop" simulcount = 0 mpp = no } # Instantiating module "handled" from file /usr/local/etc/raddb/mods-enabled/always always handled { rcode = "handled" simulcount = 0 mpp = no } # Instantiating module "updated" from file /usr/local/etc/raddb/mods-enabled/always always updated { rcode = "updated" simulcount = 0 mpp = no } # Instantiating module "notfound" from file /usr/local/etc/raddb/mods-enabled/always always notfound { rcode = "notfound" simulcount = 0 mpp = no } # Instantiating module "ok" from file /usr/local/etc/raddb/mods-enabled/always always ok { rcode = "ok" simulcount = 0 mpp = no } # Loaded module rlm_pap # Instantiating module "pap" from file /usr/local/etc/raddb/mods-enabled/pap pap { auto_header = no normalise = yes } # Loaded module rlm_radutmp # Instantiating module "radutmp" from file /usr/local/etc/raddb/mods-enabled/radutmp radutmp { filename = "/usr/local/var/log/radius/radutmp" username = "%{User-Name}" case_sensitive = yes check_with_nas = yes permissions = 384 caller_id = yes } # Loaded module rlm_exec # Instantiating module "ntlm_auth" from file /usr/local/etc/raddb/mods-enabled/ntlm_auth exec ntlm_auth { wait = yes program = "/usr/bin/ntlm_auth --request-nt-key --domain=company.net --username=%{mschap:User-Name} --password=%{User-Password}" shell_escape = yes } # Loaded module rlm_preprocess # Instantiating module "preprocess" from file /usr/local/etc/raddb/mods-enabled/preprocess preprocess { huntgroups = "/usr/local/etc/raddb/mods-config/preprocess/huntgroups" hints = "/usr/local/etc/raddb/mods-config/preprocess/hints" with_ascend_hack = no ascend_channels_per_line = 23 with_ntdomain_hack = no with_specialix_jetstream_hack = no with_cisco_vsa_hack = no with_alvarion_vsa_hack = no } reading pairlist file /usr/local/etc/raddb/mods-config/preprocess/huntgroups reading pairlist file /usr/local/etc/raddb/mods-config/preprocess/hints # Instantiating module "echo" from file /usr/local/etc/raddb/mods-enabled/echo exec echo { wait = yes program = "/bin/echo %{User-Name}" input_pairs = "request" output_pairs = "reply" shell_escape = yes } # Instantiating module "sradutmp" from file /usr/local/etc/raddb/mods-enabled/sradutmp radutmp sradutmp { filename = "/usr/local/var/log/radius/sradutmp" username = "%{User-Name}" case_sensitive = yes check_with_nas = yes permissions = 420 caller_id = no } # Loaded module rlm_detail # Instantiating module "detail" from file /usr/local/etc/raddb/mods-enabled/detail detail { filename = "/usr/local/var/log/radius/radacct/%{%{Packet-Src-IP-Address}:-%{Packet-Src-IPv6-Address}}/detail-%Y%m%d" header = "%t" permissions = 384 dir_permissions = 493 locking = no log_packet_header = no } # Loaded module rlm_mschap # Instantiating module "mschap" from file /usr/local/etc/raddb/mods-enabled/mschap mschap { use_mppe = yes require_encryption = no require_strong = no with_ntdomain_hack = yes ntlm_auth = "/usr/bin/ntlm_auth --request-nt-key --username=%{%{Stripped-User-Name}:-%{%{User-Name}:-None}} --domain=%{mschap:NT-Domain} --challenge=%{%{mschap:Challenge}:-00} --nt-response=%{%{mschap:NT-Response}:-00}" passchange { } allow_retry = yes } # Loaded module rlm_realm # Instantiating module "IPASS" from file /usr/local/etc/raddb/mods-enabled/realm realm IPASS { format = "prefix" delimiter = "/" ignore_default = no ignore_null = no } # Instantiating module "suffix" from file /usr/local/etc/raddb/mods-enabled/realm realm suffix { format = "suffix" delimiter = "@" ignore_default = no ignore_null = no } # Instantiating module "realmpercent" from file /usr/local/etc/raddb/mods-enabled/realm realm realmpercent { format = "suffix" delimiter = "%" ignore_default = no ignore_null = no } # Instantiating module "ntdomain" from file /usr/local/etc/raddb/mods-enabled/realm realm ntdomain { format = "prefix" delimiter = "\" ignore_default = no ignore_null = no } # Loaded module rlm_replicate # Instantiating module "replicate" from file /usr/local/etc/raddb/mods-enabled/replicate # Loaded module rlm_attr_filter # Instantiating module "attr_filter.post-proxy" from file /usr/local/etc/raddb/mods-enabled/attr_filter attr_filter attr_filter.post-proxy { filename = "/usr/local/etc/raddb/mods-config/attr_filter/post-proxy" key = "%{Realm}" relaxed = no } reading pairlist file /usr/local/etc/raddb/mods-config/attr_filter/post-proxy # Instantiating module "attr_filter.pre-proxy" from file /usr/local/etc/raddb/mods-enabled/attr_filter attr_filter attr_filter.pre-proxy { filename = "/usr/local/etc/raddb/mods-config/attr_filter/pre-proxy" key = "%{Realm}" relaxed = no } reading pairlist file /usr/local/etc/raddb/mods-config/attr_filter/pre-proxy # Instantiating module "attr_filter.access_reject" from file /usr/local/etc/raddb/mods-enabled/attr_filter attr_filter attr_filter.access_reject { filename = "/usr/local/etc/raddb/mods-config/attr_filter/access_reject" key = "%{User-Name}" relaxed = no } reading pairlist file /usr/local/etc/raddb/mods-config/attr_filter/access_reject # Instantiating module "attr_filter.access_challenge" from file /usr/local/etc/raddb/mods-enabled/attr_filter attr_filter attr_filter.access_challenge { filename = "/usr/local/etc/raddb/mods-config/attr_filter/access_challenge" key = "%{User-Name}" relaxed = no } reading pairlist file /usr/local/etc/raddb/mods-config/attr_filter/access_challenge # Instantiating module "attr_filter.accounting_response" from file /usr/local/etc/raddb/mods-enabled/attr_filter attr_filter attr_filter.accounting_response { filename = "/usr/local/etc/raddb/mods-config/attr_filter/accounting_response" key = "%{User-Name}" relaxed = no } reading pairlist file /usr/local/etc/raddb/mods-config/attr_filter/accounting_response # Loaded module rlm_cache # Instantiating module "cache_eap" from file /usr/local/etc/raddb/mods-enabled/cache_eap cache cache_eap { key = "%{%{control:State}:-%{%{reply:State}:-%{State}}}" ttl = 15 max_entries = 16384 epoch = 0 add_stats = no } # Loaded module rlm_logintime # Instantiating module "logintime" from file /usr/local/etc/raddb/mods-enabled/logintime logintime { minimum_timeout = 60 } # Loaded module rlm_dynamic_clients # Instantiating module "dynamic_clients" from file /usr/local/etc/raddb/mods-enabled/dynamic_clients # Loaded module rlm_soh # Instantiating module "soh" from file /usr/local/etc/raddb/mods-enabled/soh soh { dhcp = yes } # Loaded module rlm_files # Instantiating module "files" from file /usr/local/etc/raddb/mods-enabled/files files { filename = "/usr/local/etc/raddb/mods-config/files/authorize" usersfile = "/usr/local/etc/raddb/mods-config/files/authorize" acctusersfile = "/usr/local/etc/raddb/mods-config/files/accounting" preproxy_usersfile = "/usr/local/etc/raddb/mods-config/files/pre-proxy" compat = "no" } reading pairlist file /usr/local/etc/raddb/mods-config/files/authorize reading pairlist file /usr/local/etc/raddb/mods-config/files/authorize reading pairlist file /usr/local/etc/raddb/mods-config/files/accounting reading pairlist file /usr/local/etc/raddb/mods-config/files/pre-proxy # Loaded module rlm_passwd # Instantiating module "etc_passwd" from file /usr/local/etc/raddb/mods-enabled/passwd passwd etc_passwd { filename = "/etc/passwd" format = "*User-Name:Crypt-Password:" delimiter = ":" ignore_nislike = no ignore_empty = yes allow_multiple_keys = no hash_size = 100 } rlm_passwd: nfields: 3 keyfield 0(User-Name) listable: no # Loaded module rlm_chap # Instantiating module "chap" from file /usr/local/etc/raddb/mods-enabled/chap # Instantiating module "exec" from file /usr/local/etc/raddb/mods-enabled/exec exec { wait = no input_pairs = "request" shell_escape = yes timeout = 10 } # Loaded module rlm_expiration # Instantiating module "expiration" from file /usr/local/etc/raddb/mods-enabled/expiration # Loaded module rlm_utf8 # Instantiating module "utf8" from file /usr/local/etc/raddb/mods-enabled/utf8 # Loaded module rlm_dhcp # Instantiating module "dhcp" from file /usr/local/etc/raddb/mods-enabled/dhcp # Loaded module rlm_expr # Instantiating module "expr" from file /usr/local/etc/raddb/mods-enabled/expr expr { safe_characters = "@abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ0123456789.-_: /" } # Loaded module rlm_eap # Instantiating module "eap" from file /usr/local/etc/raddb/mods-enabled/eap eap { default_eap_type = "peap" timer_expire = 60 ignore_unknown_eap_types = no mod_accounting_username_bug = no max_sessions = 4096 } # Linked to sub-module rlm_eap_md5 # Linked to sub-module rlm_eap_leap # Linked to sub-module rlm_eap_gtc gtc { challenge = "Password: " auth_type = "PAP" } # Linked to sub-module rlm_eap_tls tls { tls = "tls-common" } tls-config tls-common { rsa_key_exchange = no dh_key_exchange = yes rsa_key_length = 512 dh_key_length = 512 verify_depth = 0 ca_path = "/usr/local/etc/raddb/certs" pem_file_type = yes private_key_file = "/usr/local/etc/raddb/certs/radius.key" certificate_file = "/usr/local/etc/raddb/certs/radius.CompanyRadiusCA.pem" private_key_password = "corled" dh_file = "/usr/local/etc/raddb/certs/dh" random_file = "/dev/urandom" fragment_size = 1024 include_length = yes check_crl = no cipher_list = "DEFAULT" ecdh_curve = "prime256v1" cache { enable = yes lifetime = 24 max_entries = 255 } verify { } ocsp { enable = no override_cert_url = yes url = "http://127.0.0.1/ocsp/" use_nonce = yes timeout = 0 softfail = yes } } # Linked to sub-module rlm_eap_ttls ttls { tls = "tls-common" default_eap_type = "md5" copy_request_to_tunnel = no use_tunneled_reply = no virtual_server = "inner-tunnel" include_length = yes require_client_cert = no } Using cached TLS configuration from previous invocation # Linked to sub-module rlm_eap_peap peap { tls = "tls-common" default_method = "mschapv2" copy_request_to_tunnel = no use_tunneled_reply = no proxy_tunneled_request_as_eap = yes virtual_server = "inner-tunnel" soh = no require_client_cert = no } Using cached TLS configuration from previous invocation # Linked to sub-module rlm_eap_mschapv2 mschapv2 { with_ntdomain_hack = no send_error = no } # Loaded module rlm_linelog # Instantiating module "linelog" from file /usr/local/etc/raddb/mods-enabled/linelog linelog { filename = "/usr/local/var/log/radius/linelog" permissions = 384 format = "This is a log message for %{User-Name}" reference = "%{%{Packet-Type}:-format}" } # Loaded module rlm_unix # Instantiating module "unix" from file /usr/local/etc/raddb/mods-enabled/unix unix { radwtmp = "/usr/local/var/log/radius/radwtmp" } # Loaded module rlm_digest # Instantiating module "digest" from file /usr/local/etc/raddb/mods-enabled/digest # Instantiating module "auth_log" from file /usr/local/etc/raddb/mods-enabled/detail.log detail auth_log { filename = "/usr/local/var/log/radius/radacct/%{%{Packet-Src-IP-Address}:-%{Packet-Src-IPv6-Address}}/auth-detail-%Y%m%d" header = "%t" permissions = 384 dir_permissions = 493 locking = no log_packet_header = no } rlm_detail (auth_log): 'User-Password' suppressed, will not appear in detail output # Instantiating module "reply_log" from file /usr/local/etc/raddb/mods-enabled/detail.log detail reply_log { filename = "/usr/local/var/log/radius/radacct/%{%{Packet-Src-IP-Address}:-%{Packet-Src-IPv6-Address}}/reply-detail-%Y%m%d" header = "%t" permissions = 384 dir_permissions = 493 locking = no log_packet_header = no } # Instantiating module "pre_proxy_log" from file /usr/local/etc/raddb/mods-enabled/detail.log detail pre_proxy_log { filename = "/usr/local/var/log/radius/radacct/%{%{Packet-Src-IP-Address}:-%{Packet-Src-IPv6-Address}}/pre-proxy-detail-%Y%m%d" header = "%t" permissions = 384 dir_permissions = 493 locking = no log_packet_header = no } # Instantiating module "post_proxy_log" from file /usr/local/etc/raddb/mods-enabled/detail.log detail post_proxy_log { filename = "/usr/local/var/log/radius/radacct/%{%{Packet-Src-IP-Address}:-%{Packet-Src-IPv6-Address}}/post-proxy-detail-%Y%m%d" header = "%t" permissions = 384 dir_permissions = 493 locking = no log_packet_header = no } } # modules radiusd: #### Loading Virtual Servers #### server { # from file /usr/local/etc/raddb/radiusd.conf } # server server default { # from file /usr/local/etc/raddb/sites-enabled/default # Creating Auth-Type = ntlm_auth # Creating Auth-Type = digest # Loading authenticate {...} # Loading authorize {...} # Loading virtual module ntlm_auth # Loading virtual module filter_username WARNING: Ignoring "sql" (see raddb/mods-available/README.rst) WARNING: Ignoring "ldap" (see raddb/mods-available/README.rst) # Loading preacct {...} # Loading virtual module acct_unique # Loading accounting {...} WARNING: Ignoring "sql" (see raddb/mods-available/README.rst) # Loading post-proxy {...} # Loading post-auth {...} WARNING: Ignoring "sql" (see raddb/mods-available/README.rst) # Loading virtual module remove_reply_message_if_eap # Loading virtual module remove_reply_message_if_eap } # server default server inner-tunnel { # from file /usr/local/etc/raddb/sites-enabled/inner-tunnel # Loading authenticate {...} # Loading authorize {...} # Loading virtual module ntlm_auth WARNING: Ignoring "sql" (see raddb/mods-available/README.rst) WARNING: Ignoring "ldap" (see raddb/mods-available/README.rst) # Loading session {...} # Loading post-proxy {...} # Loading post-auth {...} WARNING: Ignoring "sql" (see raddb/mods-available/README.rst) } # server inner-tunnel thread pool { start_servers = 5 max_servers = 32 min_spare_servers = 3 max_spare_servers = 10 max_requests_per_server = 0 cleanup_delay = 5 max_queue_size = 65536 auto_limit_acct = no Thread spawned new child 1. Total threads in pool: 1 Thread spawned new child 2. Total threads in pool: 2 Thread 1 waiting to be assigned a request Thread spawned new child 3. Total threads in pool: 3 Thread 2 waiting to be assigned a request Thread 3 waiting to be assigned a request Thread spawned new child 4. Total threads in pool: 4 Thread spawned new child 5. Total threads in pool: 5 Thread 4 waiting to be assigned a request Thread pool initialized radiusd: #### Opening IP addresses and Ports #### Thread 5 waiting to be assigned a request listen { type = "auth" ipaddr = * port = 0 limit { max_connections = 16 lifetime = 0 idle_timeout = 30 } } listen { type = "acct" ipaddr = * port = 0 limit { max_connections = 16 lifetime = 0 idle_timeout = 30 } } listen { type = "auth" ipaddr = 127.0.0.1 port = 18120 } Listening on auth address * port 1812 as server default Listening on acct address * port 1813 as server default Listening on auth address 127.0.0.1 port 18120 as server inner-tunnel Opening new proxy address * port 1814 Listening on proxy address * port 1814 Ready to process requests. Threads: total/active/spare threads = 5/0/5 And here is an example of freeradius allowing through my login with UPN: Thread 4 waiting to be assigned a request Waking up in 0.2 seconds. Thread 3 got semaphore Thread 3 handling request 16, (4 handled so far) (16) # Executing section authorize from file /usr/local/etc/raddb/sites-enabled/default (16) authorize { (16) ntlm_auth.authorize ntlm_auth.authorize { (16) ? if (!control:Auth-Type && User-Password) (16) ? if (!control:Auth-Type && User-Password) -> FALSE (16) } # ntlm_auth.authorize ntlm_auth.authorize = notfound (16) filter_username filter_username { (16) ? if (User-Name =~ / /) (16) ? if (User-Name =~ / /) -> FALSE (16) ? if (User-Name =~ /@.*@/ ) (16) ? if (User-Name =~ /@.*@/ ) -> FALSE (16) ? if (User-Name =~ /\\.\\./ ) (16) ? if (User-Name =~ /\\.\\./ ) -> FALSE (16) ? if ((User-Name =~ /@/) && (User-Name !~ /(a)(.+)\\.(.+)$/)) (16) ? if ((User-Name =~ /@/) && (User-Name !~ /(a)(.+)\\.(.+)$/)) -> FALSE (16) ? if (User-Name =~ /\\.$/) (16) ? if (User-Name =~ /\\.$/) -> FALSE (16) ? if (User-Name =~ /(a)\\./) (16) ? if (User-Name =~ /(a)\\./) -> FALSE (16) } # filter_username filter_username = notfound (16) [preprocess] = ok (16) [chap] = noop (16) [mschap] = noop (16) [digest] = noop (16) suffix : Looking up realm "company.com" for User-Name = "sam.fakhreddine(a)company.com" (16) suffix : No such realm "company.com" (16) [suffix] = noop (16) eap : EAP packet type response id 226 length 96 (16) eap : Continuing tunnel setup. (16) [eap] = ok (16) } # authorize = ok (16) Found Auth-Type = EAP (16) # Executing group from file /usr/local/etc/raddb/sites-enabled/default (16) authenticate { (16) eap : Expiring EAP session with state 0xab50bbb0aeb2a2e9 (16) eap : Finished EAP session with state 0xab50bbb0aeb2a2e9 (16) eap : Previous EAP request found for state 0xab50bbb0aeb2a2e9, released from the list (16) eap : Peer sent PEAP (25) (16) eap : EAP PEAP (25) (16) eap : Calling eap_peap to process EAP data (16) eap_peap : processing EAP-TLS (16) eap_peap : eaptls_verify returned 7 (16) eap_peap : Done initial handshake (16) eap_peap : eaptls_process returned 7 (16) eap_peap : FR_TLS_OK (16) eap_peap : Session established. Decoding tunneled attributes. (16) eap_peap : Peap state WAITING FOR INNER IDENTITY (16) eap_peap : Identity - sam.fakhreddine(a)company.com (16) eap_peap : Got inner identity 'sam.fakhreddine(a)company.com' (16) eap_peap : Setting default EAP type for tunneled EAP session. (16) eap_peap : Setting User-Name to sam.fakhreddine(a)company.com (16) # Executing section authorize from file /usr/local/etc/raddb/sites-enabled/inner-tunnel (16) authorize { (16) ntlm_auth.authorize ntlm_auth.authorize { (16) ? if (!control:Auth-Type && User-Password) (16) ? if (!control:Auth-Type && User-Password) -> FALSE (16) } # ntlm_auth.authorize ntlm_auth.authorize = notfound (16) [chap] = noop (16) [mschap] = noop (16) suffix : Looking up realm "company.com" for User-Name = "sam.fakhreddine(a)company.com" (16) suffix : No such realm "company.com" (16) [suffix] = noop (16) update control { (16) Proxy-To-Realm := 'LOCAL' (16) } # update control = noop (16) eap : EAP packet type response id 226 length 31 (16) eap : EAP-Identity reply, returning 'ok' so we can short-circuit the rest of authorize (16) [eap] = ok (16) } # authorize = ok (16) Found Auth-Type = EAP (16) # Executing group from file /usr/local/etc/raddb/sites-enabled/inner-tunnel (16) authenticate { (16) eap : Peer sent Identity (1) (16) eap : Calling eap_mschapv2 to process EAP data (16) eap_mschapv2 : Issuing Challenge (16) eap : New EAP session, adding 'State' attribute to reply 0x78c6265278253c43 (16) [eap] = handled (16) } # authenticate = handled (16) eap_peap : Got tunneled Access-Challenge (16) eap : New EAP session, adding 'State' attribute to reply 0xab50bbb0adb3a2e9 (16) [eap] = handled (16) } # authenticate = handled (16) Finished request 16. Thread 3 waiting to be assigned a request Sam Fakhreddine Site System Administrator Ledcor Industries Inc., Information Services 7008 Roper Road NW, Edmonton, AB T6B 3H2 p 780-395-5455 | c 780-996-0763 www.ledcor.com<http://www.ledcor.com/> FORWARD. TOGETHER.

2 1

Re: CHAP authentication fails when radtest communicates with freeradius 3.0.4 server through radsecproxy 1.6.2
by Linus Nordberg 16 Jan '15

16 Jan '15

Alan DeKok <aland(a)deployingradius.com> wrote Wed, 22 Oct 2014 10:43:04 -0400: | When radsecproxy sends a CHAP-Password, it should check for the | existence of a CHAP-Challenge attribute. If that attribute doesn't | exist, it should create a CHAP-Challenge attribute, and copy the | Authenticator field from the input packet into the attribute. This has been fixed in upcoming radsecproxy-1.6.6. Thank you Alan for the analysis and for making me aware of the issue. Thank you anoop for testing radsecproxy.

1 0

post-proxy and detecting dead upstream realms
by Phil Mayers 15 Jan '15

15 Jan '15

I'd like to do something like this: pre-proxy { update control { Tmp-Integer-0 := "%{some_scoring_thing:%{Realm}}" } if (Tmp-Integer-0 > 10) { reject } } post-proxy { Post-Proxy-Type Timeout { some_scoring_thing } } The idea is that I have an upstream proxy (eduroam) with potentially hundreds of realms behind it. Some realms just don't respond, and when that happens above a certain threshold, I'd like to locally blacklist the realm and avoid sending them to the upstream proxy for some time period. I'm not willing to maintain a manual blacklist. The question: what method can I use to run a module/expansion when a proxy request isn't replied to. "Post-Proxy-Type Fail" doesn't seem to do it (in fact, I can't make it trigger at all in my tests). Looking at the source this might be impossible?

5 6

TLS error
by marcos 15 Jan '15

15 Jan '15

Hi In other threat I commented about problems connecting and I discovered now this error TLS Alert read:fatal:unknown CA TLS_accept: failed in SSLv3 read client certificate A rlm_eap: SSL error error:14094418:SSL routines:SSL3_READ_BYTES:tlsv1 alert unknown ca SSL: SSL_read failed inside of TLS (-1), TLS session fails. TLS receive handshake failed during operation Im changing COMODO certificate, but I don't know where checks to find this CA. Suggestions? Thanks! -- For private content :-) Public key 0x0C05942A895BD10E FIngerprint 45B9 EC0B 58D5 B17C 8C37 95C3 0C05 942A 895B D10E

1 0

Re: Freeradius + Cisco WLC + Authorisation
by Sander Eerdekens 15 Jan '15

15 Jan '15

Hello, > > What settings to I need to include in /etc/raddb/users to allow the > > correct Authorisation level? > > ... > > we looked at using RADIUS but found that cisco still have more bias towards TACACS+ > so we use that for multi-grained access control to the WCS system (different tasks > available for different people on the web interface...not just a 'all admin' switch) We actually use radius for this. The Cisco-AVPairs we are using are: Cisco-AVPair += "Wireless-WCS:virtual-domain0=root", Cisco-AVPair += "Wireless-WCS:role0=Admin", Cisco-AVPair += "Wireless-WCS:task0=Users and Groups", Cisco-AVPair += "Wireless-WCS:task1=Audit Trails", Cisco-AVPair += "Wireless-WCS:task2=TACACS+ Servers", Cisco-AVPair += "Wireless-WCS:task3=RADIUS Servers", Cisco-AVPair += "Wireless-WCS:task4=Logging", Cisco-AVPair += "Wireless-WCS:task5=License Center", Cisco-AVPair += "Wireless-WCS:task6=Scheduled Tasks and Data Collection", Cisco-AVPair += "Wireless-WCS:task7=User Preferences", Cisco-AVPair += "Wireless-WCS:task8=System Settings", Cisco-AVPair += "Wireless-WCS:task9=View Alerts and Events", Cisco-AVPair += "Wireless-WCS:task10=Email Notification", Cisco-AVPair += "Wireless-WCS:task11=Delete and Clear Alerts", Cisco-AVPair += "Wireless-WCS:task12=Pick and Unpick Alerts", Cisco-AVPair += "Wireless-WCS:task13=Configure Controllers", Cisco-AVPair += "Wireless-WCS:task14=Configure Templates", Cisco-AVPair += "Wireless-WCS:task15=Configure Config Groups", Cisco-AVPair += "Wireless-WCS:task16=Configure Access Points", Cisco-AVPair += "Wireless-WCS:task17=Configure Access Point Templates", Cisco-AVPair += "Wireless-WCS:task18=Configure Choke Points", Cisco-AVPair += "Wireless-WCS:task19=Monitor Controllers", Cisco-AVPair += "Wireless-WCS:task20=Monitor Access Points", Cisco-AVPair += "Wireless-WCS:task21=Monitor Clients", Cisco-AVPair += "Wireless-WCS:task22=Monitor Tags", Cisco-AVPair += "Wireless-WCS:task23=Monitor Security", Cisco-AVPair += "Wireless-WCS:task24=Monitor Chokepoints", Cisco-AVPair += "Wireless-WCS:task25=Mesh Reports", Cisco-AVPair += "Wireless-WCS:task26=Client Reports", Cisco-AVPair += "Wireless-WCS:task27=Performance Reports", Cisco-AVPair += "Wireless-WCS:task28=Security Reports", Cisco-AVPair += "Wireless-WCS:task29=Location Server Management", Cisco-AVPair += "Wireless-WCS:task30=View Location Notifications", Cisco-AVPair += "Wireless-WCS:task31=Maps Read Only", Cisco-AVPair += "Wireless-WCS:task32=Maps Read Write", Cisco-AVPair += "Wireless-WCS:task33=Client Location", Cisco-AVPair += "Wireless-WCS:task34=Rogue Location", Cisco-AVPair += "Wireless-WCS:task35=Planning Mode", Cisco-AVPair += "Wireless-WCS:task36=Ack and Unack Alerts", Cisco-AVPair += "Wireless-WCS:task37=Migration Templates", Cisco-AVPair += "Wireless-WCS:task38=Configure Spectrum Experts", Cisco-AVPair += "Wireless-WCS:task39=Monitor Spectrum Experts", Cisco-AVPair += "Wireless-WCS:task40=Auto Provisioning", Cisco-AVPair += "Wireless-WCS:task41=Voice Audit Report", Cisco-AVPair += "Wireless-WCS:task42=Virtual Domain Management", Cisco-AVPair += "Wireless-WCS:task43=Scheduled Configuration Tasks", Cisco-AVPair += "Wireless-WCS:task44=Configure WiFi TDOA Receivers", Cisco-AVPair += "Wireless-WCS:task45=Configure ACS View Servers", Cisco-AVPair += "Wireless-WCS:task46=Monitor WiFi TDOA Receivers", Cisco-AVPair += "Wireless-WCS:task47=RRM Dashboard", Cisco-AVPair += "Wireless-WCS:task48=Config Audit Dashboard", Cisco-AVPair += "Wireless-WCS:task49=High Availability Configuration", Cisco-AVPair += "Wireless-WCS:task50=Health Monitor Details", Cisco-AVPair += "Wireless-WCS:task51=Configure WIPS Profiles", Cisco-AVPair += "Wireless-WCS:task52=Global SSID Groups", Cisco-AVPair += "Wireless-WCS:task53=Configure Lightweight Access Point Templates", Cisco-AVPair += "Wireless-WCS:task54=Configure Autonomous Access Point Templates", Cisco-AVPair += "Wireless-WCS:task55=Configure Ethernet Switch Ports", Cisco-AVPair += "Wireless-WCS:task56=Configure Ethernet Switches", Cisco-AVPair += "Wireless-WCS:task57=Device Reports", Cisco-AVPair += "Wireless-WCS:task58=Network Summary Reports", Cisco-AVPair += "Wireless-WCS:task59=Compliance Reports", Cisco-AVPair += "Wireless-WCS:task60=Report Launch Pad", Cisco-AVPair += "Wireless-WCS:task61=Run Reports List", Cisco-AVPair += "Wireless-WCS:task62=Saved Reports List", Cisco-AVPair += "Wireless-WCS:task63=Report Run History", Cisco-AVPair += "Wireless-WCS:task64=Ack and Unack Security Index Issues", Cisco-AVPair += "Wireless-WCS:task65=View Security Index Issues", Cisco-AVPair += "Wireless-WCS:task66=Monitor Media Streams", Cisco-AVPair += "Wireless-WCS:task67=Monitor Interferers", Cisco-AVPair += "Wireless-WCS:task68=Voice Diagnostics", Cisco-AVPair += "Wireless-WCS:task69=CleanAir Reports", Cisco-AVPair += "Wireless-WCS:task70=ContextAware Reports", Cisco-AVPair += "Wireless-WCS:task71=Automated Feedback", Cisco-AVPair += "Wireless-WCS:task72=TAC Case Attachment Tool", The role can be Admin or System Monitoring. Not sure where this came from as a collogue of mine wrote this config. Kind regards Sander Eerdekens

2 1