- Freeradius-Users - lists.freeradius.org

Re: Virtual server can't set reply attributes
by Paul 05 Sep '14

05 Sep '14

Alan wrote: > That's wrong. Why are you using Cisco-AVPair twice? It should be: > Cisco-AVPair > += > "ip:inacl=ACL_VIRT_SECURE_IN" I just badly pasted. The SQL table is fine. > OK... and what does the debug log look like for 2.2.5? Are you using the same SQL tables? Or different ones? The same tables. 2.2.5 output: rad_recv: Access-Request packet from host 193.151.53.4 port 1645, id=59, length=121 Framed-Protocol = PPP User-Name = "test1" CHAP-Password = 0x0123554ba1746f7fd30486bd0bd46c39de Calling-Station-Id = "0024.c435.f7e4" NAS-Port-Type = Ethernet NAS-Port = 33554632 NAS-Port-Id = "0/0/2/200" Connect-Info = "POL_Vlan200_500M" Service-Type = Framed-User NAS-IP-Address = 193.151.53.4 # Executing section authorize from file /usr/local/etc/raddb/sites-enabled/srv_default +group authorize { ++[preprocess] = ok [suffix] No '@' in User-Name = "test1", looking up realm NULL [suffix] Found realm "NULL" [suffix] Adding Stripped-User-Name = "test1" [suffix] Adding Realm = "NULL" [suffix] Proxying request from user test1 to realm NULL [suffix] Preparing to proxy authentication request to realm "NULL" ++[suffix] = updated +} # group authorize = updated WARNING: Empty pre-proxy section. Using default return values. >>> Sending proxied request internally to virtual server. server srv_null { # Executing section authorize from file /usr/local/etc/raddb/sites-enabled/srv_null +group authorize { ++[preprocess] = ok [chap] Setting 'Auth-Type := CHAP' ++[chap] = ok [files] users: Matched entry DEFAULT at line 172 ++[files] = ok [sql] expand: %{Stripped-User-Name} -> test1 [sql] expand: %{%{Stripped-User-Name}:-%{%{User-Name}:-DEFAULT}} -> test1 [sql] sql_set_user escaped user --> 'test1' rlm_sql (sql): Reserving sql socket id: 26 [sql] expand: SELECT id, username, attribute, value, op FROM radcheck WHERE username = BINARY '%{SQL-User-Name}' ORDER BY id -> SELECT id, username, attribute, value, op FROM radcheck WHERE username = BINARY 'test1' ORDER BY id [sql] User found in radcheck table [sql] expand: SELECT id, username, attribute, value, op FROM radreply WHERE username = BINARY '%{SQL-User-Name}' ORDER BY id -> SELECT id, username, attribute, value, op FROM radreply WHERE username = BINARY 'test1' ORDER BY id [sql] expand: SELECT groupname FROM radusergroup WHERE username = BINARY '%{SQL-User-Name}' ORDER BY priority -> SELECT groupname FROM radusergroup WHERE username = BINARY 'test1' ORDER BY priority rlm_sql (sql): Released sql socket id: 26 ++[sql] = ok ++[expiration] = noop ++[logintime] = noop +} # group authorize = ok Found Auth-Type = CHAP # Executing group from file /usr/local/etc/raddb/sites-enabled/srv_null +group CHAP { [chap] login attempt by "test1" with CHAP password [chap] Using clear text password "test121" for user test1 authentication. [chap] chap user test1 authenticated succesfully ++[chap] = ok +} # group CHAP = ok WARNING: Empty post-auth section. Using default return values. } # server srv_null Going to the next request <<< Received proxied response code 2 from internal virtual server. WARNING: Empty post-proxy section. Using default return values. Found Auth-Type = Accept Auth-Type = Accept, accepting the user WARNING: Empty post-auth section. Using default return values. # Executing section post-auth from file /usr/local/etc/raddb/sites-enabled/srv_default WARNING: Empty post-auth section. Using default return values. # Executing section post-auth from file /usr/local/etc/raddb/sites-enabled/srv_default Sending Access-Accept of id 59 to 193.151.53.4 port 1645 Framed-Protocol = PPP Cisco-AVPair += "ip:inacl=ACL_VIRT_SECURE_IN" Finished request 5. Going to the next request Waking up in 4.9 seconds. -- Regards, Paul

2 2

Forwarding accounting Data to another radius Server for HA
by Daren Hendricks 05 Sep '14

05 Sep '14

Hi Everyone, We have 2 radius servers (v2.2.1) a primary and secondary. Currently both use same mysql database that lives on the primary server. For HA sake we would like to have the following setup. The primary server will read/write to it's radius DB and that will be replicated using mysql replication to the secondary server. The secondary server will then read/write to the replicated db and forward/proxy it's accounting data to the primary server. Does this sound like a feasible solution? Also, what can we use to forward the accounting data to the primary server, would robust-proxy-accounting be something worth looking into? Regards

6 12

is git working?
by Rui Ribeiro 05 Sep '14

05 Sep '14

Hi, Trying to use git since yesterday. At work and at home, in different machines I am having this error: git clone git://git.freeradius.org/freeradius-server.git Cloning into 'freeradius-server'... fatal: unable to connect to git.freeradius.org: git.freeradius.org[0: 195.154.231.44]: errno=Connection timed out Is it everything ok? Regards, Rui

4 3

Virtual server can't set reply attributes
by Paul 05 Sep '14

05 Sep '14

Hi, My configuration include two local virtual servers for two differnt realms. Everything was fine on freeradius 2.2.5. Now I try to move configuration to the release 3 (3.0.4 rc2). I have a problem with attributes set on the local virual server. These attributes found in the SQL, but not returned to the NAS with Access-Accept. (debug output below) User 'test1' has own attribute in the radreply SQL table: SELECT * FROM radreply WHERE username = 'test1'; +------+----------+--------------+----+------------------------------------------------+ | id | username | attribute | op | value | +------+----------+--------------+----+------------------------------------------------+ | 8880 | test1 | Cisco-AVPair | += | "Cisco-AVPair += "ip:inacl=ACL_VIRT_SECURE_IN" | +------+----------+--------------+----+------------------------------------------------+ Configuration files: proxy.conf: --- proxy server { default_fallback = no } realm NULL { virtual_server = srv_null } realm nofilter { virtual_server = srv_nofilter } --- /sites-enabled/srv_default: --- server default { listen { type = auth ipaddr = * } listen { ipaddr = * port = 0 type = acct } authorize { preprocess suffix } authenticate { } preacct { preprocess suffix } accounting { } session { } post-auth { Post-Auth-Type REJECT { attr_filter.access_reject } } pre-proxy { } post-proxy { } } /sites-enabled/srv_null: --- #realm NULL server srv_null{ authorize { preprocess chap files sql expiration logintime } authenticate { Auth-Type CHAP { chap } } preacct { preprocess acct_unique files } accounting { sql attr_filter.accounting_response } session { } post-auth { } pre-proxy { } post-proxy { } } --- Debug: radiusd: FreeRADIUS Version 3.0.4, for host x86_64-unknown-linux-gnu, built on Aug 25 2014 at 21:38:35 Copyright (C) 1999-2014 The FreeRADIUS server project and contributors There is NO warranty; not even for MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE You may redistribute copies of FreeRADIUS under the terms of the GNU General Public License For more information about these matters, see the file named COPYRIGHT Starting - reading configuration files ... including dictionary file /usr/local/share/freeradius/dictionary including dictionary file /usr/local/share/freeradius/dictionary.dhcp including dictionary file /usr/local/share/freeradius/dictionary.vqp including dictionary file /usr/local/etc/raddb/dictionary including configuration file /usr/local/etc/raddb/radiusd.conf including configuration file /usr/local/etc/raddb/proxy.conf including configuration file /usr/local/etc/raddb/clients.conf including files in directory /usr/local/etc/raddb/mods-enabled/ including configuration file /usr/local/etc/raddb/mods-enabled/always including configuration file /usr/local/etc/raddb/mods-enabled/attr_filter including configuration file /usr/local/etc/raddb/mods-enabled/cache_eap including configuration file /usr/local/etc/raddb/mods-enabled/chap including configuration file /usr/local/etc/raddb/mods-enabled/detail including configuration file /usr/local/etc/raddb/mods-enabled/detail.log including configuration file /usr/local/etc/raddb/mods-enabled/digest including configuration file /usr/local/etc/raddb/mods-enabled/dhcp including configuration file /usr/local/etc/raddb/mods-enabled/dynamic_clients including configuration file /usr/local/etc/raddb/mods-enabled/eap including configuration file /usr/local/etc/raddb/mods-enabled/echo including configuration file /usr/local/etc/raddb/mods-enabled/exec including configuration file /usr/local/etc/raddb/mods-enabled/expiration including configuration file /usr/local/etc/raddb/mods-enabled/expr including configuration file /usr/local/etc/raddb/mods-enabled/files including configuration file /usr/local/etc/raddb/mods-enabled/linelog including configuration file /usr/local/etc/raddb/mods-enabled/logintime including configuration file /usr/local/etc/raddb/mods-enabled/mschap including configuration file /usr/local/etc/raddb/mods-enabled/ntlm_auth including configuration file /usr/local/etc/raddb/mods-enabled/pap including configuration file /usr/local/etc/raddb/mods-enabled/passwd including configuration file /usr/local/etc/raddb/mods-enabled/preprocess including configuration file /usr/local/etc/raddb/mods-enabled/radutmp including configuration file /usr/local/etc/raddb/mods-enabled/realm including configuration file /usr/local/etc/raddb/mods-enabled/replicate including configuration file /usr/local/etc/raddb/mods-enabled/soh including configuration file /usr/local/etc/raddb/mods-enabled/sradutmp including configuration file /usr/local/etc/raddb/mods-enabled/unix including configuration file /usr/local/etc/raddb/mods-enabled/unpack including configuration file /usr/local/etc/raddb/mods-enabled/utf8 including configuration file /usr/local/etc/raddb/mods-enabled/sql including configuration file /usr/local/etc/raddb/mods-config/sql/main/mysql/queries.conf including files in directory /usr/local/etc/raddb/policy.d/ including configuration file /usr/local/etc/raddb/policy.d/accounting including configuration file /usr/local/etc/raddb/policy.d/canonicalization including configuration file /usr/local/etc/raddb/policy.d/control including configuration file /usr/local/etc/raddb/policy.d/cui OPTIMIZING no yes --> FALSE OPTIMIZING no yes --> FALSE including configuration file /usr/local/etc/raddb/policy.d/dhcp including configuration file /usr/local/etc/raddb/policy.d/eap including configuration file /usr/local/etc/raddb/policy.d/filter including configuration file /usr/local/etc/raddb/policy.d/operator-name including files in directory /usr/local/etc/raddb/sites-enabled/ including configuration file /usr/local/etc/raddb/sites-enabled/srv_default including configuration file /usr/local/etc/raddb/sites-enabled/srv_null including configuration file /usr/local/etc/raddb/sites-enabled/srv_nofilter main { security { allow_core_dumps = no } } main { name = "radiusd" prefix = "/usr/local" localstatedir = "/usr/local/var" sbindir = "/usr/local/sbin" logdir = "/usr/local/var/log/radius" run_dir = "/usr/local/var/run/radiusd" libdir = "/usr/local/lib" radacctdir = "/usr/local/var/log/radius/radacct" hostname_lookups = no max_request_time = 30 cleanup_delay = 5 max_requests = 1024 pidfile = "/usr/local/var/run/radiusd/radiusd.pid" checkrad = "/usr/local/sbin/checkrad" debug_level = 0 proxy_requests = yes log { stripped_names = no auth = no auth_badpass = no auth_goodpass = no colourise = yes msg_denied = "You are already logged in - access denied" } security { max_attributes = 200 reject_delay = 1 status_server = yes allow_vulnerable_openssl = "no" } } radiusd: #### Loading Realms and Home Servers #### proxy server { retry_delay = 5 retry_count = 3 default_fallback = no dead_time = 120 wake_all_if_all_dead = no } realm NULL { virtual_server = srv_null } realm nofilter { virtual_server = srv_nofilter } radiusd: #### Loading Clients #### client local { ipv4addr = 127.0.0.1 require_message_authenticator = no secret = <<< secret >>> shortname = "localtest" nas_type = "other" limit { max_connections = 16 lifetime = 0 idle_timeout = 30 } } client er3 { ipv4addr = x.x.53.3 require_message_authenticator = no secret = <<< secret >>> shortname = "c7200" nas_type = "cisco" limit { max_connections = 16 lifetime = 0 idle_timeout = 30 } } client er4 { ipv4addr = x.x.53.4 require_message_authenticator = no secret = <<< secret >>> shortname = "asr1001" nas_type = "cisco" limit { max_connections = 16 lifetime = 0 idle_timeout = 30 } } client test_mt { ipv4addr = x.x.54.38 require_message_authenticator = no secret = <<< secret >>> shortname = "RB2011" nas_type = "other" limit { max_connections = 16 lifetime = 0 idle_timeout = 30 } } radiusd: #### Instantiating modules #### instantiate { } modules { # Loaded module rlm_always # Instantiating module "reject" from file /usr/local/etc/raddb/mods-enabled/always always reject { rcode = "reject" simulcount = 0 mpp = no } # Instantiating module "fail" from file /usr/local/etc/raddb/mods-enabled/always always fail { rcode = "fail" simulcount = 0 mpp = no } # Instantiating module "ok" from file /usr/local/etc/raddb/mods-enabled/always always ok { rcode = "ok" simulcount = 0 mpp = no } # Instantiating module "handled" from file /usr/local/etc/raddb/mods-enabled/always always handled { rcode = "handled" simulcount = 0 mpp = no } # Instantiating module "invalid" from file /usr/local/etc/raddb/mods-enabled/always always invalid { rcode = "invalid" simulcount = 0 mpp = no } # Instantiating module "userlock" from file /usr/local/etc/raddb/mods-enabled/always always userlock { rcode = "userlock" simulcount = 0 mpp = no } # Instantiating module "notfound" from file /usr/local/etc/raddb/mods-enabled/always always notfound { rcode = "notfound" simulcount = 0 mpp = no } # Instantiating module "noop" from file /usr/local/etc/raddb/mods-enabled/always always noop { rcode = "noop" simulcount = 0 mpp = no } # Instantiating module "updated" from file /usr/local/etc/raddb/mods-enabled/always always updated { rcode = "updated" simulcount = 0 mpp = no } # Loaded module rlm_attr_filter # Instantiating module "attr_filter.post-proxy" from file /usr/local/etc/raddb/mods-enabled/attr_filter attr_filter attr_filter.post-proxy { filename = "/usr/local/etc/raddb/mods-config/attr_filter/post-proxy" key = "%{Realm}" relaxed = no } reading pairlist file /usr/local/etc/raddb/mods-config/attr_filter/post-proxy # Instantiating module "attr_filter.pre-proxy" from file /usr/local/etc/raddb/mods-enabled/attr_filter attr_filter attr_filter.pre-proxy { filename = "/usr/local/etc/raddb/mods-config/attr_filter/pre-proxy" key = "%{Realm}" relaxed = no } reading pairlist file /usr/local/etc/raddb/mods-config/attr_filter/pre-proxy # Instantiating module "attr_filter.access_reject" from file /usr/local/etc/raddb/mods-enabled/attr_filter attr_filter attr_filter.access_reject { filename = "/usr/local/etc/raddb/mods-config/attr_filter/access_reject" key = "%{User-Name}" relaxed = no } reading pairlist file /usr/local/etc/raddb/mods-config/attr_filter/access_reject # Instantiating module "attr_filter.access_challenge" from file /usr/local/etc/raddb/mods-enabled/attr_filter attr_filter attr_filter.access_challenge { filename = "/usr/local/etc/raddb/mods-config/attr_filter/access_challenge" key = "%{User-Name}" relaxed = no } reading pairlist file /usr/local/etc/raddb/mods-config/attr_filter/access_challenge # Instantiating module "attr_filter.accounting_response" from file /usr/local/etc/raddb/mods-enabled/attr_filter attr_filter attr_filter.accounting_response { filename = "/usr/local/etc/raddb/mods-config/attr_filter/accounting_response" key = "%{User-Name}" relaxed = no } reading pairlist file /usr/local/etc/raddb/mods-config/attr_filter/accounting_response # Loaded module rlm_cache # Instantiating module "cache_eap" from file /usr/local/etc/raddb/mods-enabled/cache_eap cache cache_eap { key = "%{%{control:State}:-%{%{reply:State}:-%{State}}}" ttl = 15 max_entries = 16384 epoch = 0 add_stats = no } # Loaded module rlm_chap # Instantiating module "chap" from file /usr/local/etc/raddb/mods-enabled/chap # Loaded module rlm_detail # Instantiating module "detail" from file /usr/local/etc/raddb/mods-enabled/detail detail { filename = "/usr/local/var/log/radius/radacct/%{%{Packet-Src-IP-Address}:-%{Packet-Src-IPv6-Address}}/detail-%Y%m%d" header = "%t" permissions = 384 locking = no log_packet_header = no } # Instantiating module "auth_log" from file /usr/local/etc/raddb/mods-enabled/detail.log detail auth_log { filename = "/usr/local/var/log/radius/radacct/%{%{Packet-Src-IP-Address}:-%{Packet-Src-IPv6-Address}}/auth-detail-%Y%m%d" header = "%t" permissions = 384 locking = no log_packet_header = no } rlm_detail (auth_log): 'User-Password' suppressed, will not appear in detail output # Instantiating module "reply_log" from file /usr/local/etc/raddb/mods-enabled/detail.log detail reply_log { filename = "/usr/local/var/log/radius/radacct/%{%{Packet-Src-IP-Address}:-%{Packet-Src-IPv6-Address}}/reply-detail-%Y%m%d" header = "%t" permissions = 384 locking = no log_packet_header = no } # Instantiating module "pre_proxy_log" from file /usr/local/etc/raddb/mods-enabled/detail.log detail pre_proxy_log { filename = "/usr/local/var/log/radius/radacct/%{%{Packet-Src-IP-Address}:-%{Packet-Src-IPv6-Address}}/pre-proxy-detail-%Y%m%d" header = "%t" permissions = 384 locking = no log_packet_header = no } # Instantiating module "post_proxy_log" from file /usr/local/etc/raddb/mods-enabled/detail.log detail post_proxy_log { filename = "/usr/local/var/log/radius/radacct/%{%{Packet-Src-IP-Address}:-%{Packet-Src-IPv6-Address}}/post-proxy-detail-%Y%m%d" header = "%t" permissions = 384 locking = no log_packet_header = no } # Loaded module rlm_digest # Instantiating module "digest" from file /usr/local/etc/raddb/mods-enabled/digest # Loaded module rlm_dhcp # Instantiating module "dhcp" from file /usr/local/etc/raddb/mods-enabled/dhcp # Loaded module rlm_dynamic_clients # Instantiating module "dynamic_clients" from file /usr/local/etc/raddb/mods-enabled/dynamic_clients # Loaded module rlm_eap # Instantiating module "eap" from file /usr/local/etc/raddb/mods-enabled/eap eap { default_eap_type = "md5" timer_expire = 60 ignore_unknown_eap_types = no mod_accounting_username_bug = no max_sessions = 1024 } # Linked to sub-module rlm_eap_md5 # Linked to sub-module rlm_eap_leap # Linked to sub-module rlm_eap_gtc gtc { challenge = "Password: " auth_type = "PAP" } rlm_eap (EAP): Ignoring EAP method tls because we do not have OpenSSL support rlm_eap (EAP): Ignoring EAP method ttls because we do not have OpenSSL support rlm_eap (EAP): Ignoring EAP method peap because we do not have OpenSSL support # Linked to sub-module rlm_eap_mschapv2 mschapv2 { with_ntdomain_hack = no send_error = no } # Loaded module rlm_exec # Instantiating module "echo" from file /usr/local/etc/raddb/mods-enabled/echo exec echo { wait = yes program = "/bin/echo %{User-Name}" input_pairs = "request" output_pairs = "reply" shell_escape = yes } # Instantiating module "exec" from file /usr/local/etc/raddb/mods-enabled/exec exec { wait = no input_pairs = "request" shell_escape = yes timeout = 10 } # Loaded module rlm_expiration # Instantiating module "expiration" from file /usr/local/etc/raddb/mods-enabled/expiration # Loaded module rlm_expr # Instantiating module "expr" from file /usr/local/etc/raddb/mods-enabled/expr expr { safe_characters = "@abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ0123456789.-_: /" } # Loaded module rlm_files # Instantiating module "files" from file /usr/local/etc/raddb/mods-enabled/files files { filename = "/usr/local/etc/raddb/mods-config/files/authorize" usersfile = "/usr/local/etc/raddb/mods-config/files/authorize" acctusersfile = "/usr/local/etc/raddb/mods-config/files/accounting" preproxy_usersfile = "/usr/local/etc/raddb/mods-config/files/pre-proxy" compat = "cistron" } reading pairlist file /usr/local/etc/raddb/mods-config/files/authorize [/usr/local/etc/raddb/mods-config/files/authorize]:181 Cistron compatibility checks for entry DEFAULT ... [/usr/local/etc/raddb/mods-config/files/authorize]:188 Cistron compatibility checks for entry DEFAULT ... [/usr/local/etc/raddb/mods-config/files/authorize]:195 Cistron compatibility checks for entry DEFAULT ... reading pairlist file /usr/local/etc/raddb/mods-config/files/authorize [/usr/local/etc/raddb/mods-config/files/authorize]:181 Cistron compatibility checks for entry DEFAULT ... [/usr/local/etc/raddb/mods-config/files/authorize]:188 Cistron compatibility checks for entry DEFAULT ... [/usr/local/etc/raddb/mods-config/files/authorize]:195 Cistron compatibility checks for entry DEFAULT ... reading pairlist file /usr/local/etc/raddb/mods-config/files/accounting reading pairlist file /usr/local/etc/raddb/mods-config/files/pre-proxy # Loaded module rlm_linelog # Instantiating module "linelog" from file /usr/local/etc/raddb/mods-enabled/linelog linelog { filename = "/usr/local/var/log/radius/linelog" permissions = 384 format = "This is a log message for %{User-Name}" reference = "messages.%{%{Packet-Type}:-default}" } # Instantiating module "log_accounting" from file /usr/local/etc/raddb/mods-enabled/linelog linelog log_accounting { filename = "/usr/local/var/log/radius/linelog-accounting" permissions = 384 format = "" reference = "Accounting-Request.%{%{Acct-Status-Type}:-unknown}" } # Loaded module rlm_logintime # Instantiating module "logintime" from file /usr/local/etc/raddb/mods-enabled/logintime logintime { minimum_timeout = 60 } # Loaded module rlm_mschap # Instantiating module "mschap" from file /usr/local/etc/raddb/mods-enabled/mschap mschap { use_mppe = yes require_encryption = no require_strong = no with_ntdomain_hack = yes passchange { } allow_retry = yes } # Instantiating module "ntlm_auth" from file /usr/local/etc/raddb/mods-enabled/ntlm_auth exec ntlm_auth { wait = yes program = "/path/to/ntlm_auth --request-nt-key --domain=MYDOMAIN --username=%{mschap:User-Name} --password=%{User-Password}" shell_escape = yes } # Loaded module rlm_pap # Instantiating module "pap" from file /usr/local/etc/raddb/mods-enabled/pap pap { normalise = yes } # Loaded module rlm_passwd # Instantiating module "etc_passwd" from file /usr/local/etc/raddb/mods-enabled/passwd passwd etc_passwd { filename = "/etc/passwd" format = "*User-Name:Crypt-Password:" delimiter = ":" ignore_nislike = no ignore_empty = yes allow_multiple_keys = no hash_size = 100 } rlm_passwd: nfields: 3 keyfield 0(User-Name) listable: no # Loaded module rlm_preprocess # Instantiating module "preprocess" from file /usr/local/etc/raddb/mods-enabled/preprocess preprocess { huntgroups = "/usr/local/etc/raddb/mods-config/preprocess/huntgroups" hints = "/usr/local/etc/raddb/mods-config/preprocess/hints" with_ascend_hack = no ascend_channels_per_line = 23 with_ntdomain_hack = no with_specialix_jetstream_hack = no with_cisco_vsa_hack = no with_alvarion_vsa_hack = no } reading pairlist file /usr/local/etc/raddb/mods-config/preprocess/huntgroups reading pairlist file /usr/local/etc/raddb/mods-config/preprocess/hints # Loaded module rlm_radutmp # Instantiating module "radutmp" from file /usr/local/etc/raddb/mods-enabled/radutmp radutmp { filename = "/usr/local/var/log/radius/radutmp" username = "%{User-Name}" case_sensitive = yes check_with_nas = yes permissions = 384 caller_id = yes } # Loaded module rlm_realm # Instantiating module "IPASS" from file /usr/local/etc/raddb/mods-enabled/realm realm IPASS { format = "prefix" delimiter = "/" ignore_default = no ignore_null = no } # Instantiating module "suffix" from file /usr/local/etc/raddb/mods-enabled/realm realm suffix { format = "suffix" delimiter = "@" ignore_default = no ignore_null = no } # Instantiating module "realmpercent" from file /usr/local/etc/raddb/mods-enabled/realm realm realmpercent { format = "suffix" delimiter = "%" ignore_default = no ignore_null = no } # Instantiating module "ntdomain" from file /usr/local/etc/raddb/mods-enabled/realm realm ntdomain { format = "prefix" delimiter = "\" ignore_default = no ignore_null = no } # Loaded module rlm_replicate # Instantiating module "replicate" from file /usr/local/etc/raddb/mods-enabled/replicate # Loaded module rlm_soh # Instantiating module "soh" from file /usr/local/etc/raddb/mods-enabled/soh soh { dhcp = yes } # Instantiating module "sradutmp" from file /usr/local/etc/raddb/mods-enabled/sradutmp radutmp sradutmp { filename = "/usr/local/var/log/radius/sradutmp" username = "%{User-Name}" case_sensitive = yes check_with_nas = yes permissions = 420 caller_id = no } # Loaded module rlm_unix # Instantiating module "unix" from file /usr/local/etc/raddb/mods-enabled/unix unix { radwtmp = "/usr/local/var/log/radius/radwtmp" } # Loaded module rlm_unpack # Instantiating module "unpack" from file /usr/local/etc/raddb/mods-enabled/unpack # Loaded module rlm_utf8 # Instantiating module "utf8" from file /usr/local/etc/raddb/mods-enabled/utf8 # Loaded module rlm_sql # Instantiating module "sql" from file /usr/local/etc/raddb/mods-enabled/sql sql { driver = "rlm_sql_mysql" server = "x.x.52.142" port = "3306" login = "radius" password = <<< secret >>> radius_db = "radius" read_groups = yes read_profiles = yes read_clients = no delete_stale_sessions = yes sql_user_name = "%{%{Stripped-User-Name}:-%{%{User-Name}:-DEFAULT}}" default_user_profile = "" client_query = "SELECT id, nasname, shortname, type, secret, server FROM nas" authorize_check_query = "SELECT id, username, attribute, value, op FROM radcheck WHERE username = BINARY '%{SQL-User-Name}' ORDER BY id" authorize_reply_query = "SELECT id, username, attribute, value, op FROM radreply WHERE username = BINARY '%{SQL-User-Name}' ORDER BY id" authorize_group_check_query = "SELECT id, groupname, attribute, Value, op FROM radgroupcheck WHERE groupname = '%{Sql-Group}' ORDER BY id" authorize_group_reply_query = "SELECT id, groupname, attribute, value, op FROM radgroupreply WHERE groupname = '%{Sql-Group}' ORDER BY id" group_membership_query = "SELECT groupname FROM radusergroup WHERE username = BINARY '%{SQL-User-Name}' ORDER BY priority" simul_count_query = "" simul_verify_query = "SELECT radacctid, acctsessionid, username, nasipaddress, nasportid, framedipaddress, callingstationid, framedprotocol FROM radacct WHERE username = '%{SQL-User-Name}' AND acctstoptime IS NULL" safe_characters = "@abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ0123456789.-_: /" } accounting { reference = "%{tolower:type.%{Acct-Status-Type}.query}" } post-auth { reference = ".query" } mysql { tls { } } rlm_sql (sql): Driver rlm_sql_mysql (module rlm_sql_mysql) loaded and linked rlm_sql (sql): Attempting to connect to database "radius" rlm_sql (sql): Initialising connection pool pool { start = 5 min = 4 max = 32 spare = 3 uses = 0 lifetime = 0 cleanup_interval = 30 idle_timeout = 60 retry_delay = 1 spread = no } rlm_sql (sql): Opening additional connection (0) rlm_sql_mysql: Starting connect to MySQL server rlm_sql (sql): Opening additional connection (1) rlm_sql_mysql: Starting connect to MySQL server rlm_sql (sql): Opening additional connection (2) rlm_sql_mysql: Starting connect to MySQL server rlm_sql (sql): Opening additional connection (3) rlm_sql_mysql: Starting connect to MySQL server rlm_sql (sql): Opening additional connection (4) rlm_sql_mysql: Starting connect to MySQL server } # modules radiusd: #### Loading Virtual Servers #### server { # from file /usr/local/etc/raddb/radiusd.conf } # server server default { # from file /usr/local/etc/raddb/sites-enabled/srv_default # Loading authorize {...} # Loading preacct {...} # Loading post-auth {...} } # server default server srv_null { # from file /usr/local/etc/raddb/sites-enabled/srv_null # Loading authenticate {...} # Loading authorize {...} # Loading preacct {...} # Loading accounting {...} } # server srv_null server srv_nofilter { # from file /usr/local/etc/raddb/sites-enabled/srv_nofilter # Loading authenticate {...} # Loading authorize {...} # Loading preacct {...} # Loading accounting {...} } # server srv_nofilter radiusd: #### Opening IP addresses and Ports #### listen { type = "auth" ipaddr = * port = 0 } listen { type = "acct" ipaddr = * port = 0 } Listening on auth address * port 1812 as server default Listening on acct address * port 1813 as server default Ready to process requests Received Access-Request Id 38 from x.x.53.4:1645 to x.x.52.133:1812 length 121 Framed-Protocol = PPP User-Name = 'test1' CHAP-Password = 0x01c53d540bddb15b80873d70e7b797de19 Calling-Station-Id = '0024.c435.f7e4' NAS-Port-Type = Ethernet NAS-Port = 33554632 NAS-Port-Id = '0/0/2/200' Connect-Info = 'POL_Vlan200_500M' Service-Type = Framed-User NAS-IP-Address = x.x.53.4 (0) Received Access-Request packet from host x.x.53.4 port 1645, id=38, length=121 (0) Framed-Protocol = PPP (0) User-Name = 'test1' (0) CHAP-Password = 0x01c53d540bddb15b80873d70e7b797de19 (0) Calling-Station-Id = '0024.c435.f7e4' (0) NAS-Port-Type = Ethernet (0) NAS-Port = 33554632 (0) NAS-Port-Id = '0/0/2/200' (0) Connect-Info = 'POL_Vlan200_500M' (0) Service-Type = Framed-User (0) NAS-IP-Address = x.x.53.4 (0) # Executing section authorize from file /usr/local/etc/raddb/sites-enabled/srv_default (0) authorize { (0) [preprocess] = ok (0) suffix : Checking for suffix after "@" (0) suffix : No '@' in User-Name = "test1", looking up realm NULL (0) suffix : Found realm "NULL" (0) suffix : Adding Stripped-User-Name = "test1" (0) suffix : Adding Realm = "NULL" (0) suffix : Proxying request from user test1 to realm NULL (0) suffix : Preparing to proxy authentication request to realm "NULL" (0) [suffix] = updated (0) } # authorize = updated Proxying to virtual server srv_null (0) # Executing section authorize from file /usr/local/etc/raddb/sites-enabled/srv_null (0) authorize { (0) [preprocess] = ok (0) chap : Setting 'Auth-Type := CHAP' (0) [chap] = ok (0) files : users: Matched entry DEFAULT at line 181 (0) [files] = ok (0) sql : EXPAND %{%{Stripped-User-Name}:-%{%{User-Name}:-DEFAULT}} (0) sql : --> test1 (0) sql : SQL-User-Name set to 'test1' rlm_sql (sql): Reserved connection (4) (0) sql : EXPAND SELECT id, username, attribute, value, op FROM radcheck WHERE username = BINARY '%{SQL-User-Name}' ORDER BY id (0) sql : --> SELECT id, username, attribute, value, op FROM radcheck WHERE username = BINARY 'test1' ORDER BY id rlm_sql (sql): Executing query: 'SELECT id, username, attribute, value, op FROM radcheck WHERE username = BINARY 'test1' ORDER BY id' (0) sql : User found in radcheck table (0) sql : Check items matched (0) sql : EXPAND SELECT id, username, attribute, value, op FROM radreply WHERE username = BINARY '%{SQL-User-Name}' ORDER BY id (0) sql : --> SELECT id, username, attribute, value, op FROM radreply WHERE username = BINARY 'test1' ORDER BY id rlm_sql (sql): Executing query: 'SELECT id, username, attribute, value, op FROM radreply WHERE username = BINARY 'test1' ORDER BY id' (0) sql : User found in radreply table (0) sql : EXPAND SELECT groupname FROM radusergroup WHERE username = BINARY '%{SQL-User-Name}' ORDER BY priority (0) sql : --> SELECT groupname FROM radusergroup WHERE username = BINARY 'test1' ORDER BY priority rlm_sql (sql): Executing query: 'SELECT groupname FROM radusergroup WHERE username = BINARY 'test1' ORDER BY priority' (0) sql : User not found in any groups rlm_sql (sql): Released connection (4) rlm_sql (sql): Closing connection (0), from 1 unused connections rlm_sql_mysql: Socket destructor called, closing socket (0) [sql] = ok (0) [expiration] = noop (0) [logintime] = noop (0) } # authorize = ok (0) Found Auth-Type = CHAP (0) # Executing group from file /usr/local/etc/raddb/sites-enabled/srv_null (0) Auth-Type CHAP { (0) chap : Login attempt by "test1" with CHAP password (0) chap : Comparing with "known good" Cleartext-Password (0) chap : CHAP user "test1" authenticated successfully (0) [chap] = ok (0) } # Auth-Type CHAP = ok (0) Found Auth-Type = Accept (0) Auth-Type = Accept, accepting the user (0) # Executing section post-auth from file /usr/local/etc/raddb/sites-enabled/srv_default (0) Sending Access-Accept packet to host x.x.53.4 port 1645, id=38, length=0 Sending Access-Accept Id 38 from x.x.52.133:1812 to x.x.53.4:1645 (0) Finished request Waking up in 0.3 seconds. (...) -- Please help. Thx, Paul

2 1

Upgrading FR on Ubuntu
by Kev Pearce 04 Sep '14

04 Sep '14

Hi all, I've installed the v2.x.x branch on my FR server... but my server is running on Ubuntu 14.04 using the release v2.2.5 package, and as such is installed into /etc/freeradius. Installing the branch is installing to /usr/local/etc/raddb and I can't get this to start: radiusd: error while loading shared libraries: libfreeradius-radius-020205.so: cannot open shared object file: No such file or directory Is there anyway to just 'upgrade' on Ubuntu using the original /etc/freeradius location and config files? Cheers Kev/.

5 5

Failed Authentication user on EAP-SIM,
by Iman Rahmat 04 Sep '14

04 Sep '14

Dear all member hello :-), i was installed freeradius-server 2.2.5 on ubuntu 10.04 The configuration was i done is : - i was installed Eap-Sim server and rlm_sim_files.so was in /usr/lib/freeradius - i was input sim { } on eap.conf in last before } closing. - i was make simtriplets.dat in /etc/freeradius with this : 1510011642151135,634B1828FE9F4cd987EE44A54D25DD80,0638e55f,15c22dc20A8ae000 1510011642151135,DD00F2D8D6FB4095B2BD8A2AE11FB600,02ed2e94,536655a061778400 1510011642151135,A852B0E55BC741f5A8C5B6ABF1E81504,F77daa16,71e9bd629Cee3000 - i was input in users file with this : 1510011642151135(a)wlan.mnc001.mcc510.3gppnetwork.org EAP-Type := SIM EAP-Sim-Rand1 = 0x634B1828FE9F4cd987EE44A54D25DD80, EAP-Sim-SRES1 = 0x0638e55f, EAP-Sim-KC1 = 0x15c22dc20A8ae000, EAP-Sim-Rand1 = 0xDD00F2D8D6FB4095B2BD8A2AE11FB600, EAP-Sim-SRES1 = 0x02ed2e94, EAP-Sim-KC1 = 0x536655a061778400, EAP-Sim-Rand1 = 0xA852B0E55BC741f5A8C5B6ABF1E81504, EAP-Sim-SRES1 = 0xF77daa16, EAP-Sim-KC1 = 0x71e9bd629Cee3000 - i was make sim files on /etc/freeradius/modules, with this : sim_files { simtriplets = "/etc/freeradius/simtriplets.dat" } - i was input sim_files @ /etc/freeradius/sites-enabled/default on authorized { } directly befor eap { ok=return } - i was input my ipp address network on clients.conf freeradius -X freeradius: FreeRADIUS Version 2.2.5, for host i486-pc-linux-gnu, built on Sep 2 2014 at 01:14:34 Copyright (C) 1999-2013 The FreeRADIUS server project and contributors. There is NO warranty; not even for MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. You may redistribute copies of FreeRADIUS under the terms of the GNU General Public License. For more information about these matters, see the file named COPYRIGHT. Starting - reading configuration files ... including configuration file /etc/freeradius/radiusd.conf including configuration file /etc/freeradius/proxy.conf including configuration file /etc/freeradius/clients.conf including files in directory /etc/freeradius/modules/ including configuration file /etc/freeradius/modules/opendirectory including configuration file /etc/freeradius/modules/sim_files including configuration file /etc/freeradius/modules/inner-eap including configuration file /etc/freeradius/modules/rediswho including configuration file /etc/freeradius/modules/detail.example.com including configuration file /etc/freeradius/modules/exec including configuration file /etc/freeradius/modules/wimax including configuration file /etc/freeradius/modules/echo including configuration file /etc/freeradius/modules/cui including configuration file /etc/freeradius/modules/passwd including configuration file /etc/freeradius/modules/logintime including configuration file /etc/freeradius/modules/detail.log including configuration file /etc/freeradius/modules/dynamic_clients including configuration file /etc/freeradius/modules/replicate including configuration file /etc/freeradius/modules/linelog including configuration file /etc/freeradius/modules/acct_unique including configuration file /etc/freeradius/modules/cache including configuration file /etc/freeradius/modules/unix including configuration file /etc/freeradius/modules/attr_rewrite including configuration file /etc/freeradius/modules/otp including configuration file /etc/freeradius/modules/expr including configuration file /etc/freeradius/modules/sradutmp including configuration file /etc/freeradius/modules/digest including configuration file /etc/freeradius/modules/krb5 including configuration file /etc/freeradius/modules/preprocess including configuration file /etc/freeradius/modules/smsotp including configuration file /etc/freeradius/modules/sqlcounter_expire_on_login including configuration file /etc/freeradius/modules/mac2vlan including configuration file /etc/freeradius/modules/counter including configuration file /etc/freeradius/modules/dhcp_sqlippool including configuration file /etc/freeradius/modules/etc_group including configuration file /etc/freeradius/modules/radrelay including configuration file /etc/freeradius/modules/chap including configuration file /etc/freeradius/modules/ldap including configuration file /etc/freeradius/modules/expiration including configuration file /etc/freeradius/modules/detail including configuration file /etc/freeradius/modules/pam including configuration file /etc/freeradius/modules/sql_log including configuration file /etc/freeradius/modules/realm including configuration file /etc/freeradius/modules/ntlm_auth including configuration file /etc/freeradius/modules/checkval including configuration file /etc/freeradius/modules/ippool including configuration file /etc/freeradius/modules/redis including configuration file /etc/freeradius/modules/policy including configuration file /etc/freeradius/modules/attr_filter including configuration file /etc/freeradius/modules/mschap including configuration file /etc/freeradius/modules/radutmp including configuration file /etc/freeradius/modules/smbpasswd including configuration file /etc/freeradius/modules/pap including configuration file /etc/freeradius/modules/files including configuration file /etc/freeradius/modules/mac2ip including configuration file /etc/freeradius/modules/soh including configuration file /etc/freeradius/modules/always including configuration file /etc/freeradius/modules/perl including configuration file /etc/freeradius/eap.conf including configuration file /etc/freeradius/policy.conf including files in directory /etc/freeradius/sites-enabled/ including configuration file /etc/freeradius/sites-enabled/inner-tunnel including configuration file /etc/freeradius/sites-enabled/default main { user = "freerad" group = "freerad" allow_core_dumps = no } including dictionary file /etc/freeradius/dictionary main { name = "freeradius" prefix = "/usr" localstatedir = "/var" sbindir = "/usr/sbin" logdir = "/var/log/freeradius" run_dir = "/var/run/freeradius" libdir = "/usr/lib/freeradius" radacctdir = "/var/log/freeradius/radacct" hostname_lookups = no max_request_time = 30 cleanup_delay = 5 max_requests = 1024 pidfile = "/var/run/freeradius/freeradius.pid" checkrad = "/usr/sbin/checkrad" debug_level = 0 proxy_requests = yes log { stripped_names = no auth = no auth_badpass = no auth_goodpass = no } security { max_attributes = 200 reject_delay = 1 status_server = yes allow_vulnerable_openssl = no } } radiusd: #### Loading Realms and Home Servers #### proxy server { retry_delay = 5 retry_count = 3 default_fallback = no dead_time = 120 wake_all_if_all_dead = no } home_server localhost { ipaddr = 127.0.0.1 port = 1812 type = "auth" secret = "testing123" response_window = 20 max_outstanding = 65536 require_message_authenticator = yes zombie_period = 40 status_check = "status-server" ping_interval = 30 check_interval = 30 num_answers_to_alive = 3 num_pings_to_alive = 3 revive_interval = 120 status_check_timeout = 4 coa { irt = 2 mrt = 16 mrc = 5 mrd = 30 } } home_server_pool my_auth_failover { type = fail-over home_server = localhost } realm example.com { auth_pool = my_auth_failover } realm LOCAL { } radiusd: #### Loading Clients #### client localhost { ipaddr = 127.0.0.1 require_message_authenticator = no secret = "testing123" nastype = "other" } client 111.111.111.0/24 { require_message_authenticator = no secret = "imanajadeh" shortname = "unifi" } radiusd: #### Instantiating modules #### instantiate { Module: Linked to module rlm_exec Module: Instantiating module "exec" from file /etc/freeradius/modules/exec exec { wait = no input_pairs = "request" shell_escape = yes timeout = 10 } Module: Linked to module rlm_expr Module: Instantiating module "expr" from file /etc/freeradius/modules/expr Module: Linked to module rlm_expiration Module: Instantiating module "expiration" from file /etc/freeradius/modules/expiration expiration { reply-message = "Password Has Expired " } Module: Linked to module rlm_logintime Module: Instantiating module "logintime" from file /etc/freeradius/modules/logintime logintime { reply-message = "You are calling outside your allowed timespan " minimum-timeout = 60 } } radiusd: #### Loading Virtual Servers #### server { # from file ��?�?2� modules { Module: Creating Auth-Type = digest Module: Creating Post-Auth-Type = REJECT Module: Checking authenticate {...} for more modules to load Module: Linked to module rlm_pap Module: Instantiating module "pap" from file /etc/freeradius/modules/pap pap { encryption_scheme = "auto" auto_header = no } Module: Linked to module rlm_chap Module: Instantiating module "chap" from file /etc/freeradius/modules/chap Module: Linked to module rlm_mschap Module: Instantiating module "mschap" from file /etc/freeradius/modules/mschap mschap { use_mppe = yes require_encryption = no require_strong = no with_ntdomain_hack = no allow_retry = yes } Module: Linked to module rlm_digest Module: Instantiating module "digest" from file /etc/freeradius/modules/digest Module: Linked to module rlm_unix Module: Instantiating module "unix" from file /etc/freeradius/modules/unix unix { radwtmp = "/var/log/freeradius/radwtmp" } Module: Linked to module rlm_eap Module: Instantiating module "eap" from file /etc/freeradius/eap.conf eap { default_eap_type = "md5" timer_expire = 60 ignore_unknown_eap_types = no cisco_accounting_username_bug = no max_sessions = 1024 } Module: Linked to sub-module rlm_eap_md5 Module: Instantiating eap-md5 Module: Linked to sub-module rlm_eap_leap Module: Instantiating eap-leap Module: Linked to sub-module rlm_eap_gtc Module: Instantiating eap-gtc gtc { challenge = "Password: " auth_type = "PAP" } Module: Linked to sub-module rlm_eap_tls Module: Instantiating eap-tls tls { rsa_key_exchange = no dh_key_exchange = yes rsa_key_length = 512 dh_key_length = 512 verify_depth = 0 CA_path = "/etc/freeradius/certs" pem_file_type = yes private_key_file = "/etc/freeradius/certs/server.key" certificate_file = "/etc/freeradius/certs/server.pem" CA_file = "/etc/freeradius/certs/ca.pem" private_key_password = "whatever" dh_file = "/etc/freeradius/certs/dh" fragment_size = 1024 include_length = yes check_crl = no cipher_list = "DEFAULT" make_cert_command = "/etc/freeradius/certs/bootstrap" ecdh_curve = "prime256v1" cache { enable = no lifetime = 24 max_entries = 255 } verify { } ocsp { enable = no override_cert_url = yes url = "http://127.0.0.1/ocsp/" use_nonce = yes timeout = 0 softfail = no } } Module: Linked to sub-module rlm_eap_ttls Module: Instantiating eap-ttls ttls { default_eap_type = "md5" copy_request_to_tunnel = no use_tunneled_reply = no virtual_server = "inner-tunnel" include_length = yes } Module: Linked to sub-module rlm_eap_peap Module: Instantiating eap-peap peap { default_eap_type = "mschapv2" copy_request_to_tunnel = no use_tunneled_reply = no proxy_tunneled_request_as_eap = yes virtual_server = "inner-tunnel" soh = no } Module: Linked to sub-module rlm_eap_mschapv2 Module: Instantiating eap-mschapv2 mschapv2 { with_ntdomain_hack = no send_error = no } Module: Linked to sub-module rlm_eap_sim Module: Instantiating eap-sim Module: Checking authorize {...} for more modules to load Module: Linked to module rlm_preprocess Module: Instantiating module "preprocess" from file /etc/freeradius/modules/preprocess preprocess { huntgroups = "/etc/freeradius/huntgroups" hints = "/etc/freeradius/hints" with_ascend_hack = no ascend_channels_per_line = 23 with_ntdomain_hack = no with_specialix_jetstream_hack = no with_cisco_vsa_hack = no with_alvarion_vsa_hack = no } reading pairlist file /etc/freeradius/huntgroups reading pairlist file /etc/freeradius/hints Module: Linked to module rlm_realm Module: Instantiating module "suffix" from file /etc/freeradius/modules/realm realm suffix { format = "suffix" delimiter = "@" ignore_default = no ignore_null = no } Module: Linked to module rlm_sim_files Module: Instantiating module "sim_files" from file /etc/freeradius/modules/sim_files sim_files { simtriplets = "/etc/freeradius/simtriplets.dat" } Module: Linked to module rlm_files Module: Instantiating module "files" from file /etc/freeradius/modules/files files { usersfile = "/etc/freeradius/users" acctusersfile = "/etc/freeradius/acct_users" preproxy_usersfile = "/etc/freeradius/preproxy_users" compat = "no" } reading pairlist file /etc/freeradius/users [/etc/freeradius/users]:208 WARNING! Check item "EAP-Sim-Rand1" found in reply item list for user "1510011642151135(a)wlan.mnc001.mcc510.3gppnetwork.org". This attribute MUST go on the first line with the other check items [/etc/freeradius/users]:208 WARNING! Check item "EAP-Sim-SRES1" found in reply item list for user "1510011642151135(a)wlan.mnc001.mcc510.3gppnetwork.org". This attribute MUST go on the first line with the other check items [/etc/freeradius/users]:208 WARNING! Check item "EAP-Sim-KC1" found in reply item list for user "1510011642151135(a)wlan.mnc001.mcc510.3gppnetwork.org". This attribute MUST go on the first line with the other check items [/etc/freeradius/users]:208 WARNING! Check item "EAP-Sim-Rand1" found in reply item list for user "1510011642151135(a)wlan.mnc001.mcc510.3gppnetwork.org". This attribute MUST go on the first line with the other check items [/etc/freeradius/users]:208 WARNING! Check item "EAP-Sim-SRES1" found in reply item list for user "1510011642151135(a)wlan.mnc001.mcc510.3gppnetwork.org". This attribute MUST go on the first line with the other check items [/etc/freeradius/users]:208 WARNING! Check item "EAP-Sim-KC1" found in reply item list for user "1510011642151135(a)wlan.mnc001.mcc510.3gppnetwork.org". This attribute MUST go on the first line with the other check items [/etc/freeradius/users]:208 WARNING! Check item "EAP-Sim-Rand1" found in reply item list for user "1510011642151135(a)wlan.mnc001.mcc510.3gppnetwork.org". This attribute MUST go on the first line with the other check items [/etc/freeradius/users]:208 WARNING! Check item "EAP-Sim-SRES1" found in reply item list for user "1510011642151135(a)wlan.mnc001.mcc510.3gppnetwork.org". This attribute MUST go on the first line with the other check items [/etc/freeradius/users]:208 WARNING! Check item "EAP-Sim-KC1" found in reply item list for user "1510011642151135(a)wlan.mnc001.mcc510.3gppnetwork.org". This attribute MUST go on the first line with the other check items reading pairlist file /etc/freeradius/acct_users reading pairlist file /etc/freeradius/preproxy_users Module: Checking preacct {...} for more modules to load Module: Linked to module rlm_acct_unique Module: Instantiating module "acct_unique" from file /etc/freeradius/modules/acct_unique acct_unique { key = "User-Name, Acct-Session-Id, NAS-IP-Address, NAS-Identifier, NAS-Port" } Module: Checking accounting {...} for more modules to load Module: Linked to module rlm_detail Module: Instantiating module "detail" from file /etc/freeradius/modules/detail detail { detailfile = "/var/log/freeradius/radacct/%{%{Packet-Src-IP-Address}:-%{Packet-Src-IPv6-Address}}/detail-%Y%m%d" header = "%t" detailperm = 384 dirperm = 493 locking = no log_packet_header = no } Module: Linked to module rlm_attr_filter Module: Instantiating module "attr_filter.accounting_response" from file /etc/freeradius/modules/attr_filter attr_filter attr_filter.accounting_response { attrsfile = "/etc/freeradius/attrs.accounting_response" key = "%{User-Name}" relaxed = no } reading pairlist file /etc/freeradius/attrs.accounting_response Module: Checking session {...} for more modules to load Module: Linked to module rlm_radutmp Module: Instantiating module "radutmp" from file /etc/freeradius/modules/radutmp radutmp { filename = "/var/log/freeradius/radutmp" username = "%{User-Name}" case_sensitive = yes check_with_nas = yes perm = 384 callerid = yes } Module: Checking post-proxy {...} for more modules to load Module: Checking post-auth {...} for more modules to load Module: Instantiating module "attr_filter.access_reject" from file /etc/freeradius/modules/attr_filter attr_filter attr_filter.access_reject { attrsfile = "/etc/freeradius/attrs.access_reject" key = "%{User-Name}" relaxed = no } reading pairlist file /etc/freeradius/attrs.access_reject } # modules } # server server inner-tunnel { # from file /etc/freeradius/sites-enabled/inner-tunnel modules { Module: Checking authenticate {...} for more modules to load Module: Checking authorize {...} for more modules to load Module: Checking session {...} for more modules to load Module: Checking post-proxy {...} for more modules to load Module: Checking post-auth {...} for more modules to load } # modules } # server radiusd: #### Opening IP addresses and Ports #### listen { type = "auth" ipaddr = * port = 0 } listen { type = "acct" ipaddr = * port = 0 } listen { type = "auth" ipaddr = 127.0.0.1 port = 18120 } ... adding new socket proxy address * port 46286 Listening on authentication address * port 1812 Listening on accounting address * port 1813 Listening on authentication address 127.0.0.1 port 18120 as server inner-tunnel Listening on proxy address * port 1814 Ready to process requests. authentication failed with this debug log : rad_recv: Access-Request packet from host 111.111.111.219 port 56787, id=148, length=232 User-Name = "1510011642151135(a)wlan.mnc000.mcc510.3gppnetwork.org" NAS-IP-Address = 111.111.111.219 NAS-Identifier = "dc9fdb9c7513" NAS-Port = 0 Called-Station-Id = "26-9F-DB-9D-75-13:SuperWiFi-SIM_A" Calling-Station-Id = "D4-97-0B-47-3F-10" Framed-MTU = 1400 NAS-Port-Type = Wireless-802.11 Connect-Info = "CONNECT 0Mbps 802.11b" EAP-Message = 0x02a300060312 State = 0xb03003e9b0930724bdcb3e1f451eecdb Message-Authenticator = 0xcebc5c917498be5780531a7fd0daead0 # Executing section authorize from file /etc/freeradius/sites-enabled/default +group authorize { ++[preprocess] = ok ++[chap] = noop ++[mschap] = noop ++[digest] = noop [suffix] Looking up realm "wlan.mnc000.mcc510.3gppnetwork.org" for User-Name = "1510011642151135(a)wlan.mnc000.mcc510.3gppnetwork.org" [suffix] No such realm "wlan.mnc000.mcc510.3gppnetwork.org" ++[suffix] = noop rlm_sim_files: insufficient number of challenges for imsi 1510011642151135(a)wlan.mnc000.mcc510.3gppnetwork.org: 0 ++[sim_files] = notfound [eap] EAP packet type response id 163 length 6 [eap] No EAP Start, assuming it's an on-going EAP conversation ++[eap] = updated ++[files] = noop ++[expiration] = noop ++[logintime] = noop [pap] WARNING! No "known good" password found for the user. Authentication may fail because of this. ++[pap] = noop +} # group authorize = updated Found Auth-Type = EAP # Executing group from file /etc/freeradius/sites-enabled/default +group authenticate { [eap] Request found, released from the list [eap] EAP NAK [eap] EAP-NAK asked for EAP-Type/sim [eap] processing type sim can not initiate sim, no RAND1 attribute [eap] Default EAP type sim failed in initiate [eap] Failed in EAP select ++[eap] = invalid +} # group authenticate = invalid Failed to authenticate the user. Using Post-Auth-Type REJECT # Executing group from file /etc/freeradius/sites-enabled/default +group REJECT { [attr_filter.access_reject] expand: %{User-Name} -> 1510011642151135(a)wlan.mnc000.mcc510.3gppnetwork.org attr_filter: Matched entry DEFAULT at line 11 ++[attr_filter.access_reject] = updated +} # group REJECT = updated Delaying reject of request 33 for 1 seconds Going to the next request Waking up in 0.5 seconds. Cleaning up request 30 ID 145 with timestamp +1518 Waking up in 0.4 seconds. Sending delayed reject for request 33 Sending Access-Reject of id 148 to 111.111.111.219 port 56787 EAP-Message = 0x04a30004 Message-Authenticator = 0x00000000000000000000000000000000 Waking up in 0.5 seconds. Cleaning up request 31 ID 146 with timestamp +1518 Waking up in 3.4 seconds. Cleaning up request 32 ID 147 with timestamp +1523 Waking up in 1.0 seconds. Cleaning up request 33 ID 148 with timestamp +1523 Ready to process requests. thank you before

1 0

RE: FreeRadius Server Sizing recommendations
by Rui Ribeiro 04 Sep '14

04 Sep '14

As said bellow the thread, use benchmarking tools. I am authentication 15k users in AD (3 times as much of you), Vmware VM. 3-5k daily users and 512-800MB of RAM is more than enough for me for running FreeRadius (in fact in memory the binaries only use 70MB). The detail accounting only grows in the tune of 3GB per month. The MySQL database is on another server. As for the MySQL server you may need more 1-2GB, so 4GB is more than enough for a dedicated server without bloat and FreeRadius + MySQL). My CPU requirements are also *very* low, two CPUs load average: 0.00, 0.01, 0.05. Regards > From: "Wang, Yu" <ywang10(a)fsu.edu> > To: "dxu(a)uoguelph.ca" <dxu(a)uoguelph.ca>, FreeRadius users mailing list > <freeradius-users(a)lists.freeradius.org> > Subject: RE: FreeRadius Server Sizing recommendations > Message-ID: > <712E6E5D87B90E4E833ADC4B96D9C9A3326BBC8A(a)FSU-EXCH-NWR01.fsu.edu> > Content-Type: text/plain; charset="us-ascii" > > A server with Xeon 2.4 GHz dual core CPU, 4-8GB RAM, 250GB 7.2k SATA hard > drive, dual port gigabit NIC will be sufficient for your system. You can > achieve 10 auths/sec easily with most default settings on radius and > samba/winbind. > > Yu Wang > > > -----Original Message----- > From: freeradius-users-bounces+ywang10=fsu.edu(a)lists.freeradius.org > [mailto:freeradius-users-bounces+ywang10=fsu.edu@lists.freeradius.org] On > Behalf Of Dennis Xu > Sent: Tuesday, September 02, 2014 2:57 PM > To: A L M Buxey > Cc: FreeRadius users mailing list > Subject: Re: FreeRadius Server Sizing recommendations > > I am not sure about the certificate size. But it will be using 2048bit > key. The concurrent authentication request will be less than 10 per second. > Backend authentication will use Active Directory. > > thanks. > > Dennis > > ----- Original Message ----- > From: "A L M Buxey" <A.L.M.Buxey(a)lboro.ac.uk> > To: dxu(a)uoguelph.ca, "FreeRadius users mailing list" < > freeradius-users(a)lists.freeradius.org> > Sent: Tuesday, September 2, 2014 10:45:10 AM > Subject: Re: FreeRadius Server Sizing recommendations > > Hi, > > > Does FreeRadius has a server sizing guide to help people to choose the > right hardware? I want to deploy two Linux servers(on VMware) in > active/standby mode to serve maximum 5k PEAP authentication users. What > would be the recommended server specs(such as CPU,RAM,Storage,IOPs) for > this deployment? > > certificate size? concurrent authentication requests? backend > authentication method? > > there is no direct sizing guide but there are benchmarking tools that you > can use to get a measure of performance/capacity > > alan > - > List info/subscribe/unsubscribe? See > http://www.freeradius.org/list/users.html > > > >

2 1

Not able to receive inner identity in Access-Accept in EAP-TTLS.
by Bhavesh Kamani 04 Sep '14

04 Sep '14

Hi Team, I am using freeradius version 2.1.12. I have configured following in the eap.conf file in the ttls section : copy_request_to_tunnel = yes use_tunneled_reply = yes virtual_server = "inner-tunnel" and in the inner-tunnel file i have configured following : post-auth { .... update outer.reply { User-Name := "%{Stripped-User-Name}" } I am able to get the inner identity in Access-Accept if I use PEAP with MS-CHAPv2, but I am not getting inner identity in Access-Accept if I use EAP-TTLS. Please find the eap.conf, inner-tunnel and free_radius.log files in the attachment. File free_radius.log has logs of EAP-TTLS method only. I am using 'testuser' as inner identity and 'anonymous' as outer identity(anonymous identity). Please provide your inputs on this. Thanks, Bhavesh.

4 33

rlm_cache
by BALSIANOK, Peter 04 Sep '14

04 Sep '14

Hi, I`m playing with rlm_cache. I want to cache auth request to speed up future processing of the same auth request. If I send second request (the same as first one), I got reject :(. Could you please help, me. Thx. mods-enabled/cache: ... update { request: := &request: control: := &control: reply: := &reply: } ... sites-enabled/default: authorize { verify_nas preprocess chap suffix update control { Cache-Status-Only := 'yes' } cache if (notfound) { files update control { Cache-Status-Only := 'no' } cache } pap } Debug output: radiusd: FreeRADIUS Version 3.0.3, for host i686-pc-linux-gnu, built on Sep 1 2014 at 21:59:53 Copyright (C) 1999-2014 The FreeRADIUS server project and contributors There is NO warranty; not even for MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE You may redistribute copies of FreeRADIUS under the terms of the GNU General Public License For more information about these matters, see the file named COPYRIGHT Starting - reading configuration files ... including dictionary file /mnt/sdcard/software/freeradius-server-3.0.3/share/freeradius/dictionary including dictionary file /mnt/sdcard/software/freeradius-server-3.0.3/share/freeradius/dictionary.dhcp including dictionary file /mnt/sdcard/software/freeradius-server-3.0.3/share/freeradius/dictionary.vqp including dictionary file ./dictionary including configuration file ./radiusd.conf including configuration file ./proxy.conf including configuration file ./clients.conf including files in directory ./mods-enabled/ including configuration file ./mods-enabled/digest including configuration file ./mods-enabled/pap including configuration file ./mods-enabled/cache including configuration file ./mods-enabled/attr_filter including configuration file ./mods-enabled/chap including configuration file ./mods-enabled/linelog including configuration file ./mods-enabled/expr including configuration file ./mods-enabled/preprocess including configuration file ./mods-enabled/realm including configuration file ./mods-enabled/unpack including configuration file ./mods-enabled/files including configuration file ./mods-enabled/always including files in directory ./policy.d/ including configuration file ./policy.d/cui including configuration file ./policy.d/control including configuration file ./policy.d/filter including configuration file ./policy.d/eap including configuration file ./policy.d/nas including configuration file ./policy.d/accounting including configuration file ./policy.d/dhcp including configuration file ./policy.d/operator-name including configuration file ./policy.d/canonicalization including files in directory ./sites-enabled/ including configuration file ./sites-enabled/default main { name = "radiusd" prefix = "/mnt/sdcard/software/freeradius-server-3.0.3" localstatedir = "/mnt/sdcard/software/freeradius-server-3.0.3/var" sbindir = "/mnt/sdcard/software/freeradius-server-3.0.3/sbin" logdir = "/mnt/sdcard/software/freeradius-server-3.0.3/var/log/radius" run_dir = "/mnt/sdcard/software/freeradius-server-3.0.3/var/run/radiusd" libdir = "/mnt/sdcard/software/freeradius-server-3.0.3/lib" radacctdir = "/mnt/sdcard/software/freeradius-server-3.0.3/var/log/radius/radacct" hostname_lookups = no max_request_time = 30 cleanup_delay = 5 max_requests = 1024 pidfile = "/mnt/sdcard/software/freeradius-server-3.0.3/var/run/radiusd/radiusd.pid" checkrad = "/mnt/sdcard/software/freeradius-server-3.0.3/sbin/checkrad" debug_level = 0 proxy_requests = yes log { stripped_names = no auth = yes auth_badpass = yes auth_goodpass = yes colourise = yes msg_denied = "You are already logged in - access denied" } security { max_attributes = 200 reject_delay = 1 status_server = yes allow_vulnerable_openssl = "yes" } } radiusd: #### Loading Realms and Home Servers #### proxy server { retry_delay = 5 retry_count = 3 default_fallback = no dead_time = 120 wake_all_if_all_dead = no } home_server localhost { ipaddr = 127.0.0.1 port = 1812 type = "auth" secret = <<< secret >>> response_window = 20 max_outstanding = 65536 zombie_period = 40 status_check = "status-server" ping_interval = 30 check_interval = 30 num_answers_to_alive = 3 revive_interval = 120 status_check_timeout = 4 coa { irt = 2 mrt = 16 mrc = 5 mrd = 30 } limit { max_connections = 16 max_requests = 0 lifetime = 0 idle_timeout = 0 } } home_server_pool my_auth_failover { type = fail-over home_server = localhost } realm example.com { auth_pool = my_auth_failover } realm LOCAL { } radiusd: #### Loading Clients #### client localhost { ipaddr = 127.0.0.1 require_message_authenticator = no secret = <<< secret >>> nas_type = "other" proto = "*" limit { max_connections = 16 lifetime = 0 idle_timeout = 30 } } radiusd: #### Instantiating modules #### instantiate { } modules { # Loaded module rlm_digest # Instantiating module "digest" from file ./mods-enabled/digest # Loaded module rlm_pap # Instantiating module "pap" from file ./mods-enabled/pap pap { normalise = yes } # Loaded module rlm_cache # Instantiating module "cache" from file ./mods-enabled/cache cache { key = "%{User-Name}" ttl = 86400 max_entries = 16384 epoch = 0 add_stats = yes } # Loaded module rlm_attr_filter # Instantiating module "attr_filter.post-proxy" from file ./mods-enabled/attr_filter attr_filter attr_filter.post-proxy { filename = "./mods-config/attr_filter/post-proxy" key = "%{Realm}" relaxed = no } reading pairlist file ./mods-config/attr_filter/post-proxy # Instantiating module "attr_filter.pre-proxy" from file ./mods-enabled/attr_filter attr_filter attr_filter.pre-proxy { filename = "./mods-config/attr_filter/pre-proxy" key = "%{Realm}" relaxed = no } reading pairlist file ./mods-config/attr_filter/pre-proxy # Instantiating module "attr_filter.access_reject" from file ./mods-enabled/attr_filter attr_filter attr_filter.access_reject { filename = "./mods-config/attr_filter/access_reject" key = "%{User-Name}" relaxed = no } reading pairlist file ./mods-config/attr_filter/access_reject # Instantiating module "attr_filter.access_challenge" from file ./mods-enabled/attr_filter attr_filter attr_filter.access_challenge { filename = "./mods-config/attr_filter/access_challenge" key = "%{User-Name}" relaxed = no } reading pairlist file ./mods-config/attr_filter/access_challenge # Instantiating module "attr_filter.accounting_response" from file ./mods-enabled/attr_filter attr_filter attr_filter.accounting_response { filename = "./mods-config/attr_filter/accounting_response" key = "%{User-Name}" relaxed = no } reading pairlist file ./mods-config/attr_filter/accounting_response # Loaded module rlm_chap # Instantiating module "chap" from file ./mods-enabled/chap # Loaded module rlm_linelog # Instantiating module "linelog" from file ./mods-enabled/linelog linelog { filename = "/mnt/sdcard/software/freeradius-server-3.0.3/var/log/radius/linelog" permissions = 384 format = "This is a log message for %{User-Name}" reference = "messages.%{%{Packet-Type}:-default}" } # Instantiating module "log_accounting" from file ./mods-enabled/linelog linelog log_accounting { filename = "/mnt/sdcard/software/freeradius-server-3.0.3/var/log/radius/linelog-accounting" permissions = 384 format = "" reference = "Accounting-Request.%{%{Acct-Status-Type}:-unknown}" } # Loaded module rlm_expr # Instantiating module "expr" from file ./mods-enabled/expr expr { safe_characters = "@abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ0123456789.-_: /" } # Loaded module rlm_preprocess # Instantiating module "preprocess" from file ./mods-enabled/preprocess preprocess { huntgroups = "./mods-config/preprocess/huntgroups" hints = "./mods-config/preprocess/hints" with_ascend_hack = no ascend_channels_per_line = 23 with_ntdomain_hack = no with_specialix_jetstream_hack = no with_cisco_vsa_hack = no with_alvarion_vsa_hack = no } reading pairlist file ./mods-config/preprocess/huntgroups reading pairlist file ./mods-config/preprocess/hints # Loaded module rlm_realm # Instantiating module "IPASS" from file ./mods-enabled/realm realm IPASS { format = "prefix" delimiter = "/" ignore_default = no ignore_null = no } # Instantiating module "suffix" from file ./mods-enabled/realm realm suffix { format = "suffix" delimiter = "@" ignore_default = no ignore_null = no } # Instantiating module "realmpercent" from file ./mods-enabled/realm realm realmpercent { format = "suffix" delimiter = "%" ignore_default = no ignore_null = no } # Instantiating module "ntdomain" from file ./mods-enabled/realm realm ntdomain { format = "prefix" delimiter = "\" ignore_default = no ignore_null = no } # Loaded module rlm_unpack # Instantiating module "unpack" from file ./mods-enabled/unpack # Loaded module rlm_files # Instantiating module "files" from file ./mods-enabled/files files { filename = "./mods-config/files/authorize" usersfile = "./mods-config/files/authorize" acctusersfile = "./mods-config/files/accounting" preproxy_usersfile = "./mods-config/files/pre-proxy" compat = "cistron" } reading pairlist file ./mods-config/files/authorize [./mods-config/files/authorize]:83 Cistron compatibility checks for entry dummy ... [./mods-config/files/authorize]:191 Cistron compatibility checks for entry DEFAULT ... [./mods-config/files/authorize]:198 Cistron compatibility checks for entry DEFAULT ... [./mods-config/files/authorize]:205 Cistron compatibility checks for entry DEFAULT ... reading pairlist file ./mods-config/files/authorize [./mods-config/files/authorize]:83 Cistron compatibility checks for entry dummy ... [./mods-config/files/authorize]:191 Cistron compatibility checks for entry DEFAULT ... [./mods-config/files/authorize]:198 Cistron compatibility checks for entry DEFAULT ... [./mods-config/files/authorize]:205 Cistron compatibility checks for entry DEFAULT ... reading pairlist file ./mods-config/files/accounting reading pairlist file ./mods-config/files/pre-proxy # Loaded module rlm_always # Instantiating module "reject" from file ./mods-enabled/always always reject { rcode = "reject" simulcount = 0 mpp = no } # Instantiating module "fail" from file ./mods-enabled/always always fail { rcode = "fail" simulcount = 0 mpp = no } # Instantiating module "ok" from file ./mods-enabled/always always ok { rcode = "ok" simulcount = 0 mpp = no } # Instantiating module "handled" from file ./mods-enabled/always always handled { rcode = "handled" simulcount = 0 mpp = no } # Instantiating module "invalid" from file ./mods-enabled/always always invalid { rcode = "invalid" simulcount = 0 mpp = no } # Instantiating module "userlock" from file ./mods-enabled/always always userlock { rcode = "userlock" simulcount = 0 mpp = no } # Instantiating module "notfound" from file ./mods-enabled/always always notfound { rcode = "notfound" simulcount = 0 mpp = no } # Instantiating module "noop" from file ./mods-enabled/always always noop { rcode = "noop" simulcount = 0 mpp = no } # Instantiating module "updated" from file ./mods-enabled/always always updated { rcode = "updated" simulcount = 0 mpp = no } } # modules radiusd: #### Loading Virtual Servers #### server { # from file ./radiusd.conf } # server server default { # from file ./sites-enabled/default # Loading authenticate {...} # Loading authorize {...} Ignoring "sql" (see raddb/mods-available/README.rst) Ignoring "ldap" (see raddb/mods-available/README.rst) # Loading preacct {...} # Loading accounting {...} # Loading post-auth {...} } # server default radiusd: #### Opening IP addresses and Ports #### listen { type = "auth" ipaddr = * port = 0 limit { max_connections = 16 lifetime = 0 idle_timeout = 30 } } listen { type = "acct" ipaddr = * port = 0 limit { max_connections = 16 lifetime = 0 idle_timeout = 30 } } Listening on auth address * port 1812 as server default Listening on acct address * port 1813 as server default Opening new proxy socket 'proxy address * port 0' Listening on proxy address * port 53265 Ready to process requests. Received Access-Request Id 34 from 127.0.0.1:51488 to 127.0.0.1:1812 length 95 NAS-Port-Type = Virtual Service-Type = Framed-User Framed-Protocol = PPP User-Name = 'dummy' User-Password = 'dummy' Connect-Info = '8640000' NAS-Port = 411 NAS-Port-Id = 'Uniq-Sess-ID411' (0) # Executing section authorize from file ./sites-enabled/default (0) authorize { (0) verify_nas verify_nas { (0) if ( ! NAS-IP-Address ) (0) if ( ! NAS-IP-Address ) -> TRUE (0) if ( ! NAS-IP-Address ) { (0) update { (0) EXPAND %{Packet-Src-IP-Address} (0) --> 127.0.0.1 (0) NAS-IP-Address := 127.0.0.1 (0) } # update = noop (0) } # if ( ! NAS-IP-Address ) = noop (0) } # verify_nas verify_nas = noop (0) [preprocess] = ok (0) [chap] = noop (0) suffix : No '@' in User-Name = "dummy", looking up realm NULL (0) suffix : No such realm "NULL" (0) [suffix] = noop (0) update control { (0) Cache-Status-Only := yes (0) } # update control = noop (0) cache : EXPAND %{User-Name} (0) cache : --> dummy (0) [cache] = notfound (0) if (notfound) (0) if (notfound) -> TRUE (0) if (notfound) { (0) files : users: Matched entry dummy at line 83 (0) [files] = ok (0) update control { (0) Cache-Status-Only := no (0) } # update control = noop (0) cache : EXPAND %{User-Name} (0) cache : --> dummy (0) cache : Creating entry for "dummy" (0) cache : request: := &request:NAS-Port-Type (0) cache : request: := &request:Service-Type (0) cache : request: := &request:Framed-Protocol (0) cache : request: := &request:User-Name (0) cache : request: := &request:User-Password (0) cache : request: := &request:Connect-Info (0) cache : request: := &request:NAS-Port (0) cache : request: := &request:NAS-Port-Id (0) cache : request: := &request:NAS-IP-Address (0) cache : request: := &request:Huntgroup-Name (0) cache : control: := &config:Cleartext-Password (0) cache : skipping Cache-Status-Only (0) cache : reply: := &reply:Service-Type (0) cache : reply: := &reply:Framed-Protocol (0) cache : reply: := &reply:Framed-IP-Address (0) cache : reply: := &reply:Framed-IP-Netmask (0) cache : reply: := &reply:Framed-Routing (0) cache : reply: := &reply:Framed-Filter-Id (0) cache : reply: := &reply:Framed-MTU (0) cache : reply: := &reply:Framed-Compression (0) cache : Inserted entry, TTL 86400 seconds (0) [cache] = updated (0) } # if (notfound) = updated (0) [pap] = updated (0) } # authorize = updated (0) Found Auth-Type = PAP (0) # Executing group from file ./sites-enabled/default (0) Auth-Type PAP { (0) pap : Login attempt with password (0) pap : User authenticated successfully (0) [pap] = ok (0) } # Auth-Type PAP = ok (0) Login OK: [dummy/dummy] (from client localhost port 411) (0) # Executing section post-auth from file ./sites-enabled/default (0) post-auth { (0) remove_reply_message_if_eap remove_reply_message_if_eap { (0) if (reply:EAP-Message && reply:Reply-Message) (0) if (reply:EAP-Message && reply:Reply-Message) -> FALSE (0) else else { (0) [noop] = noop (0) } # else else = noop (0) } # remove_reply_message_if_eap remove_reply_message_if_eap = noop (0) } # post-auth = noop Sending Access-Accept Id 34 from 127.0.0.1:1812 to 127.0.0.1:51488 Service-Type = Framed-User Framed-Protocol = PPP Framed-IP-Address = 172.16.3.33 Framed-IP-Netmask = 255.255.255.0 Framed-Routing = Broadcast-Listen Framed-Filter-Id = 'std.ppp' Framed-MTU = 1500 Framed-Compression = Van-Jacobson-TCP-IP (0) Finished request Waking up in 0.3 seconds. Waking up in 4.6 seconds. (0) Cleaning up request packet ID 34 with timestamp +3 Ready to process requests. Received Access-Request Id 243 from 127.0.0.1:59013 to 127.0.0.1:1812 length 95 NAS-Port-Type = Virtual Service-Type = Framed-User Framed-Protocol = PPP User-Name = 'dummy' User-Password = 'dummy' Connect-Info = '8640000' NAS-Port = 411 NAS-Port-Id = 'Uniq-Sess-ID411' (1) # Executing section authorize from file ./sites-enabled/default (1) authorize { (1) verify_nas verify_nas { (1) if ( ! NAS-IP-Address ) (1) if ( ! NAS-IP-Address ) -> TRUE (1) if ( ! NAS-IP-Address ) { (1) update { (1) EXPAND %{Packet-Src-IP-Address} (1) --> 127.0.0.1 (1) NAS-IP-Address := 127.0.0.1 (1) } # update = noop (1) } # if ( ! NAS-IP-Address ) = noop (1) } # verify_nas verify_nas = noop (1) [preprocess] = ok (1) [chap] = noop (1) suffix : No '@' in User-Name = "dummy", looking up realm NULL (1) suffix : No such realm "NULL" (1) [suffix] = noop (1) update control { (1) Cache-Status-Only := yes (1) } # update control = noop (1) cache : EXPAND %{User-Name} (1) cache : --> dummy (1) cache : Found entry for "dummy" (1) [cache] = ok (1) if (notfound) (1) if (notfound) -> FALSE (1) WARNING: pap : No "known good" password found for the user. Not setting Auth-Type. (1) WARNING: pap : Authentication will fail unless a "known good" password is available. (1) [pap] = noop (1) } # authorize = ok (1) ERROR: No Auth-Type found: rejecting the user via Post-Auth-Type = Reject (1) Failed to authenticate the user. (1) Login incorrect (No Auth-Type found: rejecting the user via Post-Auth-Type = Reject): [dummy/dummy] (from client localhost port 411) (1) Using Post-Auth-Type Reject (1) # Executing group from file ./sites-enabled/default (1) Post-Auth-Type REJECT { (1) remove_reply_message_if_eap remove_reply_message_if_eap { (1) if (reply:EAP-Message && reply:Reply-Message) (1) if (reply:EAP-Message && reply:Reply-Message) -> FALSE (1) else else { (1) [noop] = noop (1) } # else else = noop (1) } # remove_reply_message_if_eap remove_reply_message_if_eap = noop (1) } # Post-Auth-Type REJECT = noop (1) Delaying response for 1 seconds Waking up in 0.3 seconds. Waking up in 0.6 seconds. (1) Sending delayed response Sending Access-Reject Id 243 from 127.0.0.1:1812 to 127.0.0.1:59013 Waking up in 3.9 seconds. (1) Cleaning up request packet ID 243 with timestamp +10 Ready to process requests. Peter

3 8

Limitation of authenticating against AD
by Dennis Xu 03 Sep '14

03 Sep '14

Hello, I am looking for confirmation that because our AD stores passwords in crypt'd or SHA1 format, we cannot use FreeRadius to authenticate against our AD using PEAP and EAP-MSCHAPv2? http://deployingradius.com/documents/protocols/compatibility.html Is the above link still up-to-date? Thanks! --- Dennis Xu Analyst 3, Network Infrastructure Computing and Communications Services(CCS) University of Guelph 519-824-4120 Ext 56217 dxu(a)uoguelph.ca www.uoguelph.ca/ccs

7 10