- Freeradius-Users - lists.freeradius.org

Need to auth all instead of proxy for 1 realm
by azander 23 Jun '14

23 Jun '14

Greetings, I am running FreeRadius 2.2.x (Working on upgrading to 3.x.x) but ran into a near emergency situation. One of my customer's radius servers died. I need to auth-all their customers, but not any of the other proxied radius users. Is there a relatively simple way to do this? I cannot seem to find it in the docs. -- William

2 2

SQL syntax error in DHCP + Freeradius 3.x
by Marcelo Gondim 23 Jun '14

23 Jun '14

Hi all, When I try to connect via dhclient, I receive this syntax error on radiusd -X: rlm_sql (sql): Executing query: 'SELECT framedipaddress FROM radippool WHERE pool_name = 'local' AND (expiry_time < NOW() OR expiry_time IS NULL) ORDER BY (username <> 'DHCP-08:00:27:93:ff:5d'), (callingstationid <> '08:00:27:93:ff:5d'), expiry_time LIMIT 1 OR UPDATE' rlm_sql_mysql: MYSQL check_error: 1064 received rlm_sql (sql): You have an error in your SQL syntax; check the manual that corresponds to your MySQL server version for the right syntax to use near 'OR UPDATE' at line 1 ) ERROR: dhcp_sqlippool : database query error on 'SELECT framedipaddress FROM radippool WHERE pool_name = '%{control:Pool-Name}' AND (expiry_time < NOW() OR expiry_time IS NULL) ORDER BY (username <> '%{User-Name}'), (callingstationid <> '%{Calling-Station-Id}'), expiry_time LIMIT 1 OR UPDATE' My allocate_find in mods-config/sql/ippool-dhcp/mysql/queries.conf: allocate_find = "\ SELECT framedipaddress \ FROM ${ippool_table} \ WHERE pool_name = '%{control:Pool-Name}' \ AND (expiry_time < NOW() OR expiry_time IS NULL) \ ORDER BY \ (username <> '%{User-Name}'), \ (callingstationid <> '%{Calling-Station-Id}'), \ expiry_time \ LIMIT 1 \ OR UPDATE" I´m using FreeBSD 10-STABLE with mysql 5.5 and Freeradius 3.0.3 Cheers, Gondim

2 1

freeradius radclient MSCHAPv2 command string
by Stephen Nichols 23 Jun '14

23 Jun '14

Hi, I want to use radclient to access radius server using MSCHAPv2. Using freeradius version 2.1.12 on CentOS and 2.2.3 on our own Linux server. I have used the following string to successfully authenticate using MSCHAPv1. Echo 'User-Name = User1,MS-CHAP-Password =mypassword,NAS-IP-Address =172.21.100.131,NAS-Port-Type=15,NAS-Port=1' | radclient -X 172.21.20.50 auth testing123 Searched around and checked radclient -h, but found no information regarding format for an MSCHAPv2 command string. Thanks This e-mail from Ultra Electronics and any attachments to it are confidential to the intended recipient and may also be privileged. If you have received it in error please notify the sender and delete it from your system. If you are not the intended recipient you must not copy it or use it for any purpose nor disclose or distribute its contents to any other person. All communications may be subject to interception or monitoring for operational and/or security purposes. Please rely on your own virus checking as the sender cannot accept any liability for any damage arising from any bug or virus infection. Recipient shall control the disclosure & access of technical data, information, and other items received under this e-mail in accordance with U.S. export control laws & regulations, including but not limited to the ITAR. No technical data, information or other items provided by Ultra Electronics - DNE Technologies, Inc. in connection with this email shall be provided to any foreign persons or to a foreign entity, including without limitation, a foreign subsidiary of recipient without the express written authorization of Ultra Electronics - DNE Technologies, Inc.; dissemination to non-U.S. persons whether in the United States or abroad requires an export license or other authorization

2 1

Logging UDP port
by Jonathan Gazeley 23 Jun '14

23 Jun '14

We've got several RADIUS clients behind a NAT, so we can't distinguish them by source IP. We do not control those NAS (or the NAT) so we can't insert arbitrary attributes, either. Is there a way radiusd can log the UDP port on which a packet entered a virtual server? I think this might be our only way of distinguishing these clients. Thanks, Jonathan

5 5

Using Client-Shortname within perl module
by Alex Sharaz 23 Jun '14

23 Jun '14

Hi, I'm using perl to convert various attributes into a standardised XX-XX-XX-XX-XX-XX format e.g $RAD_REQUEST{'Calling-Station-Id'} = &formatMac($RAD_REQUEST{'Calling-Station-Id'}); $RAD_REQUEST{'Called-Station-Id'} = &formatMac($RAD_REQUEST{'Called-Station-Id'}); $RAD_REQUEST{'User-Name'} = &formatMac($RAD_REQUEST{'User-Name'}); which works just fine. However, our Comp Science dept decided not to use the same hex formatting as us so when I proxy mac-auth requests off to their server, I need to make sure that I don't do the above. Is there any way I can wrap an if ( Client-Shortname != "cseswitches") { ... } round the above so that I only perform the conversion when processing non Comp Sci requests? Rgds A

3 2

DHCPv6 support
by Marcelo Gondim 23 Jun '14

23 Jun '14

Hi All, I wonder if there is DHCPv6support in Freeradius 2.x. I'm not a developer but would like to test Freeradiususing DHCPv4 and DHCPv6 in Dual Stack. Today already use PPPoEwith Mikrotikand Freeradius + MySQL. Cheers, Gondim

3 2

Zombie servers are never marked as dead or unzombied when using status_check = none
by Herwin Weststrate 20 Jun '14

20 Jun '14

Another thing of which I'm not really sure if it's a bug or if I'm misinterpreting something. It's tested with version 3.0.x I'm using a setup with 3 FreeRADIUS backends (10.101.0.11{3,4,5}) and a single inner-proxy-server. All the home servers are marked in the config with a zombie_period of 20 and a revive_interval of 60. Requests are load-balanced to the home server using keyed-balance on the username (yes, I understand this is something you wouldn't normally do when proxying the inner tunnel, but it makes it easier to reproduce). The first authentication get proxied to .114. Then, we disable that home server by adding a firewall rule. The next authentication requests shows some logging that the home serve is marked as a zombie: Marking home server 10.101.0.114 port 1812 as zombie (it has not responded in 10.000000 seconds). The next authentication request with the same user name now get proxied to .115. Authentication requests with other user names are now distributed among .113 and .115 (with somethings that looks like a bias towards .115, possibly because all requests that would originally have gone to .114 are now sent to .115, but it's tested with a very small set, quite possibly it's something else). The strange thing here is that .114 stays a zombie. Even after more than two minutes (which would expire both zombie_period and revive_interval) new requests just get proxied to .115 or .113, but no mention on updating the state of .114 whatsoever. Looking at the source, I see that after a server is marked as a zombie, the method ping_home_server (main/process.c) is called. This method is effectively a no-op if the status_check of the home server is set to none, which might be the cause. -- Herwin Weststrate

1 0

Problem with unlang and customized reply message
by Lorenzo Milesi 20 Jun '14

20 Jun '14

Hi. Following [1] and [2] I modified my site config in order to send custom reply message for each accounting error. Sadly it seems the server is NOT rejecting the user in case of Max-Daily-Session, so I must have done something wrong, but I cannot find the error. I attached my config. This is what debug prints out for dailycounter Thu Jun 19 17:31:35 2014 : Info: [dailycounter] expand: %{sql:SELECT SUM(acctsessiontime - GREATEST((1403128800 - UNIX_TIMESTAMP(acctstarttime)), 0)) FROM radacct WHERE username = 'username' AND UNIX_TIMESTAMP(acctstarttime) + acctsessiontime > '1403128800'} -> 10819 Thu Jun 19 17:31:35 2014 : Debug: rlm_sqlcounter: (Check item - counter) is less than zero Thu Jun 19 17:31:35 2014 : Debug: rlm_sqlcounter: Rejected user username, check_item=10800, counter=10819 Thu Jun 19 17:31:35 2014 : Info: ++[dailycounter] = reject Thu Jun 19 17:31:35 2014 : Info: ++? if (reject) Thu Jun 19 17:31:35 2014 : Info: ? Evaluating (reject) -> TRUE Thu Jun 19 17:31:35 2014 : Info: ++? if (reject) -> TRUE Thu Jun 19 17:31:35 2014 : Info: ++if (reject) { Thu Jun 19 17:31:35 2014 : Info: +++update reply { Thu Jun 19 17:31:35 2014 : Info: +++} # update reply = noop Thu Jun 19 17:31:35 2014 : Info: ++} # if (reject) = noop ... and then goes on on the next module. While if I just let "dailycounter" without additional options the debug correctly return reject: Thu Jun 19 16:23:52 2014 : Debug: rlm_sqlcounter: (Check item - counter) is less than zero Thu Jun 19 16:23:52 2014 : Debug: rlm_sqlcounter: Rejected user username, check_item=10800, counter=10819 Thu Jun 19 16:23:52 2014 : Info: ++[dailycounter] = reject Thu Jun 19 16:23:52 2014 : Info: +} # group authorize = reject Thu Jun 19 16:23:52 2014 : Info: Using Post-Auth-Type REJECT Thu Jun 19 16:23:52 2014 : Info: # Executing group from file /etc/freeradius/sites-enabled/default Thu Jun 19 16:23:52 2014 : Info: +group REJECT { Thu Jun 19 16:23:52 2014 : Info: ++update reply { Thu Jun 19 16:23:52 2014 : Info: ++} # update reply = noop Thu Jun 19 16:23:52 2014 : Info: [attr_filter.access_reject] expand: %{User-Name} -> username Thu Jun 19 16:23:52 2014 : Debug: attr_filter: Matched entry DEFAULT at line 11 Thu Jun 19 16:23:52 2014 : Info: ++[attr_filter.access_reject] = updated Thu Jun 19 16:23:52 2014 : Info: +} # group REJECT = updated This is the dailycounter config: dailycounter{ reject = 1 } if(reject){ update reply { Reply-Message := "You have reached your daily time limit" } ok = reject } For other checks the same code seems to work fine... What's wrong with this? thanks [1] http://grasehotspot.org/documentation/freeradius/meaningful-reply-message-f… [2] http://tim.purewhite.id.au/2011/04/coova-chilli-freeradius-reply-message/ -- Lorenzo Milesi - lorenzo.milesi(a)yetopen.it YetOpen S.r.l. - http://www.yetopen.it/

2 2

Check MAC address
by nicolas.clo＠ricoh-industrie.fr 18 Jun '14

18 Jun '14

Hi list, Are there any way to check validity of MAC address but one times only and not every time while processing the virtual site ? Actually I used this : authorize { if (!Calling-Station-Id == "%{sql:SELECT mac_address FROM `mac` WHERE mac_address='%{Calling-Station-Id}'}") { update reply { Reply-Message += "MAC address %{Calling-Station-Id} was not found in database - Login refused " } reject } } The cache module is the only way ? Thanks. Nicolas.

2 1

EAP-PEAP with mschap login failed MSCHAP returns reject but we want to send no Reject but Accept with GUEST Vlan AVPs
by Becker, Alexander 18 Jun '14

18 Jun '14

Hi all, I am using FreeRADIUS for quite some time now, though I can't wrap my mind around one thing: When a module (say, mschap with ntlm_auth) returns REJECT because of the user is not present in the AD, I want to continue processing the request to, let's say, accept the request, but provide an alternative VLAN (Tunnel-Id) to the endpoint. In chapter 16.3.1 of http://networkradius.com/doc/FreeRADIUS-Implementation-Ch16.pdf, section "Return Codes as Modules", it clearly states: * reject: Causes the request to be immediately rejected So my question boils down to: How can I use the mscap module to check whether a user is valid, and somehow anticipate that he/she does not exist, and continue with an alternate processing (read: decide later on whether to accept/reject the user) in such a case. I thank you very much in advance, and I appreciate your answer. For full reference, I included my current setup with explainations: --- Using EAP-PEAPv0 -> valid user credentials should result in an accept with AV-Pair list A and invalid credentials should result in Accept but AV-Pair list B Example: Using EAP-PEAP Login OK Sending Accept and Tunnel-Type = VLAN Tunnel-Medium-Type = IEEE-802 Tunnel-Private-Group-Id = "22" Login failed Sending Accept and Tunnel-Type = VLAN Tunnel-Medium-Type = IEEE-802 Tunnel-Private-Group-Id = "33" I want to control the result via a manipulated control attribute AcnACLType. I set these attibutes from withing rlm_perl: ########### Snippet Perl Policy ############################### if ( $RAD_CHECK{'AcnACLType'} eq "data" ) { $RAD_CHECK{'Auth-Type'}= "Accept"; $RAD_REPLY{'Reply-Message'}= "data"; $RAD_REPLY{'Tunnel-Medium-Type'}= "IEEE-802"; $RAD_REPLY{'Tunnel-Private-Group-Id'}= "22"; $RAD_REPLY{'Tunnel-Type'}= "VLAN"; return RLM_MODULE_OK; } elsif ( $RAD_CHECK{'AcnACLType'} eq "authfail" ) { $RAD_CHECK{'Auth-Type'}= "Accept"; $RAD_REPLY{'Reply-Message'}= "AuthFail"; $RAD_REPLY{'Tunnel-Medium-Type'}= "IEEE-802"; $RAD_REPLY{'Tunnel-Private-Group-Id'}= "33"; $RAD_REPLY{'Tunnel-Type'}= "VLAN"; return RLM_MODULE_OK; } ########### Snippet Perl Policy ############################### In case of MSCHAP authenticating, everything works as expected: ===================Begin LOG ================================ Wed Jun 18 09:59:50 2014 : Info: [eap] processing type mschapv2 Wed Jun 18 09:59:50 2014 : Info: [mschapv2] # Executing group from file /home/auconet/freeradius/test/CSI/etc/raddb//sites-enabled/inner-tunnel Wed Jun 18 09:59:50 2014 : Info: [mschapv2] +- entering group MS-CHAP {...} Wed Jun 18 09:59:50 2014 : Info: [mschap] Creating challenge hash with username: pschmidt Wed Jun 18 09:59:50 2014 : Info: [mschap] Told to do MS-CHAPv2 for pschmidt with NT-Password Wed Jun 18 09:59:50 2014 : Info: [mschap] expand: --domain=%{mschap:NT-Domain} -> --domain=testlab.auconet.lan Wed Jun 18 09:59:50 2014 : Info: [mschap] expand: --username=%{mschap:User-Name} -> --username=pschmidt Wed Jun 18 09:59:50 2014 : Info: [mschap] Creating challenge hash with username: pschmidt Wed Jun 18 09:59:50 2014 : Info: [mschap] expand: --challenge=%{mschap:Challenge:-00} -> --challenge=9499863a8977daa3 Wed Jun 18 09:59:50 2014 : Info: [mschap] expand: --nt-response=%{mschap:NT-Response:-00} -> --nt-response=161b24c676d1a53738cdb10037111c81f1fe1d4d5407266a Wed Jun 18 09:59:50 2014 : Debug: Exec-Program output: NT_KEY: 00D98A4AFC1CD84EED151A5ECAD45886 Wed Jun 18 09:59:50 2014 : Debug: Exec-Program-Wait: plaintext: NT_KEY: 00D98A4AFC1CD84EED151A5ECAD45886 Wed Jun 18 09:59:50 2014 : Debug: Exec-Program: returned: 0 Wed Jun 18 09:59:50 2014 : Info: ++[mschap] returns ok Wed Jun 18 09:59:50 2014 : Info: ++? if (ok) Wed Jun 18 09:59:50 2014 : Info: ? Evaluating (ok) -> TRUE Wed Jun 18 09:59:50 2014 : Info: ++? if (ok) -> TRUE Wed Jun 18 09:59:50 2014 : Info: ++- entering if (ok) {...} Wed Jun 18 09:59:50 2014 : Info: +++[control] returns ok Wed Jun 18 09:59:50 2014 : Info: ++- if (ok) returns ok Wed Jun 18 09:59:50 2014 : Info: ++ ... skipping elsif for request 20: Preceding "if" was taken Wed Jun 18 09:59:50 2014 : Debug: MSCHAP Success Wed Jun 18 09:59:50 2014 : Info: ++[eap] returns handled } # server inner-tunnel Wed Jun 18 09:59:50 2014 : Info: ++[control] returns ok : Wed Jun 18 09:59:50 2014 : Debug: rlm_perl: Added pair Tunnel-Type = VLAN Wed Jun 18 09:59:50 2014 : Debug: rlm_perl: Added pair Tunnel-Medium-Type = IEEE-802 Wed Jun 18 09:59:50 2014 : Debug: rlm_perl: Added pair Message-Authenticator = 0x00000000000000000000000000000000 Wed Jun 18 09:59:50 2014 : Debug: rlm_perl: Added pair User-Name = testlab.auconet.lan\\pschmidt Wed Jun 18 09:59:50 2014 : Debug: rlm_perl: Added pair MS-MPPE-Recv-Key = 0x8a6959f6fd9e2f85fadce413f5691ba0ade9bd80d6fee90893d598bfc978a1d5 Wed Jun 18 09:59:50 2014 : Debug: rlm_perl: Added pair EAP-Message = 0x030b0004 Wed Jun 18 09:59:50 2014 : Debug: rlm_perl: Added pair EAP-EMSK = 0x97d3f6e398c284127ee6ad52d55d8a0e609e453971050f546c964193d18dae3c0d74518ef466560670426f120bae29e1c268494e07b5c13ce67033c7135a08d3 Wed Jun 18 09:59:50 2014 : Debug: rlm_perl: Added pair Tunnel-Private-Group-Id = 22 Wed Jun 18 09:59:50 2014 : Debug: rlm_perl: Added pair AcnACLType = data Wed Jun 18 09:59:50 2014 : Debug: rlm_perl: Added pair Auth-Type = Accept Wed Jun 18 09:59:50 2014 : Info: ++[perlpolicy] returns ok Wed Jun 18 09:59:50 2014 : Info: # Executing section post-auth from file /home/auconet/freeradius/test/CSI/etc/raddb//sites-enabled/default Wed Jun 18 09:59:50 2014 : Info: +- entering group post-auth {...} Wed Jun 18 09:59:50 2014 : Info: ++[exec] returns noop Sending Access-Accept of id 11 to 127.0.0.1 port 38368 Reply-Message = "AuthFail" MS-MPPE-Send-Key = 0x8cc588be92973040e5f09c8ebdc30ea4480a717aaf984fdf8182c3c6c5ffbfa8 Tunnel-Type:0 = VLAN Tunnel-Medium-Type:0 = IEEE-802 Message-Authenticator = 0x00000000000000000000000000000000 User-Name = "testlab.auconet.lan\\pschmidt" MS-MPPE-Recv-Key = 0x8a6959f6fd9e2f85fadce413f5691ba0ade9bd80d6fee90893d598bfc978a1d5 EAP-Message = 0x030b0004 Tunnel-Private-Group-Id:0 = "22" Wed Jun 18 09:59:50 2014 : Info: Finished request 22. =============================== END LOG ===================================== My problem begins if the credentials are invalid. In this case inner-tunnel returns with "REJECT" and then there seems to be no way to change this into an "ACCEPT". My feeling at this point is that I miss an important concept in the way FreeRADIUS processes requests. Here is a snippet from inner-tunnel section: ############### SNIP ########################## authenticate { Auth-Type EAP { eap { ok = 1 reject = return fail=return } # if (ok) { update control { Auth-Type := "Accept" AcnACLType="data" } } elsif (reject) { update control { Auth-Type := "Accept" AcnACLType="authfail" LogMessage := "RadiusReject" } auconetLog } } ########################## End Inner tunnel ########################### and in default server ############################ Default Server ########################### Auth-Type EAP { eap { ok = 1 reject = return invalid =1 } if (ok) { update control { #Auth-Type := "Accept" AcnACLType := "data" } #update reply { # Tunnel-Type := VLAN # Tunnel-Medium-Type := IEEE-802 # Tunnel-Private-Group-Id := "22" #} } elsif (reject || invalid ) { update control { AcnACLType := "authfail" LogMessage := "RadiusReject" Auth-Type := "Accept" } auconetLog update reply { Tunnel-Type := VLAN Tunnel-Medium-Type := IEEE-802 Tunnel-Private-Group-Id := "33" } } update control { FreeRADIUS-Client-Shortname="%{Client-Shortname}" } perlpolicy } ###################################################### The log is: ================ LOG Begin =================================== Wed Jun 18 10:48:04 2014 : Info: [eap] processing type mschapv2 Wed Jun 18 10:48:04 2014 : Info: [mschapv2] # Executing group from file /home/auconet/freeradius/test/CSI/etc/raddb//sites-enabled/inner-tunnel Wed Jun 18 10:48:04 2014 : Info: [mschapv2] +- entering group MS-CHAP {...} Wed Jun 18 10:48:04 2014 : Info: [mschap] Creating challenge hash with username: radiusfail Wed Jun 18 10:48:04 2014 : Info: [mschap] Told to do MS-CHAPv2 for radiusfail with NT-Password Wed Jun 18 10:48:04 2014 : Info: [mschap] No NT-Domain was found in the User-Name. Wed Jun 18 10:48:04 2014 : Info: [mschap] expand: --domain=%{mschap:NT-Domain} -> --domain= Wed Jun 18 10:48:04 2014 : Info: [mschap] expand: --username=%{mschap:User-Name} -> --username=radiusfail Wed Jun 18 10:48:04 2014 : Info: [mschap] Creating challenge hash with username: radiusfail Wed Jun 18 10:48:04 2014 : Info: [mschap] expand: --challenge=%{mschap:Challenge:-00} -> --challenge=3fc42259705d168a Wed Jun 18 10:48:04 2014 : Info: [mschap] expand: --nt-response=%{mschap:NT-Response:-00} -> --nt-response=1a7a459b40d3527944a7aadcdf32a499c097cf0dc1c296ad Wed Jun 18 10:48:04 2014 : Debug: Exec-Program output: Logon failure (0xc000006d) Wed Jun 18 10:48:04 2014 : Debug: Exec-Program-Wait: plaintext: Logon failure (0xc000006d) Wed Jun 18 10:48:04 2014 : Debug: Exec-Program: returned: 1 Wed Jun 18 10:48:04 2014 : Info: [mschap] External script failed. Wed Jun 18 10:48:04 2014 : Info: [mschap] FAILED: MS-CHAP2-Response is incorrect Wed Jun 18 10:48:04 2014 : Info: ++[mschap] returns reject Wed Jun 18 10:48:04 2014 : Info: [eap] Freeing handler Wed Jun 18 10:48:04 2014 : Info: ++[eap] returns reject <<<<<< Wed Jun 18 10:48:04 2014 : Info: Failed to authenticate the user. } # server inner-tunnel Wed Jun 18 10:48:04 2014 : Info: [peap] Got tunneled reply code 3 MS-CHAP-Error = "\tE=691 R=1" EAP-Message = 0x04090004 Message-Authenticator = 0x00000000000000000000000000000000 Wed Jun 18 10:48:04 2014 : Info: [peap] Got tunneled reply RADIUS code 3 MS-CHAP-Error = "\tE=691 R=1" EAP-Message = 0x04090004 Message-Authenticator = 0x00000000000000000000000000000000 Wed Jun 18 10:48:04 2014 : Info: [peap] Tunneled authentication was rejected. Wed Jun 18 10:48:04 2014 : Debug: rlm_perl: Added pair State = 0xe26df394eb67ea7b6c664f076e6e6a50 Wed Jun 18 10:48:04 2014 : Debug: rlm_perl: Added pair Calling-Station-Id = 02:00:00:00:00:01 Wed Jun 18 10:48:04 2014 : Debug: rlm_perl: Added pair Message-Authenticator = 0x6ab434e42ece49cdb13eb90438443c03 Wed Jun 18 10:48:04 2014 : Debug: rlm_perl: Added pair User-Name = radiusfail Wed Jun 18 10:48:04 2014 : Debug: rlm_perl: Added pair EAP-Message = 0x020a0050190017030100208c1c20ac2dcb12e53b8a57d494b40657b43bd5019ca84e352e57a1069a1176a917030100209ed7b46fa6d167c1aacf327ae328c70674c366c0ddeceab26e7ba5232f3b029e Wed Jun 18 10:48:04 2014 : Debug: rlm_perl: Added pair Connect-Info = CONNECT 11Mbps 802.11b Wed Jun 18 10:48:04 2014 : Debug: rlm_perl: Added pair EAP-Type = PEAP Wed Jun 18 10:48:04 2014 : Debug: rlm_perl: Added pair NAS-IP-Address = 127.0.0.1 Wed Jun 18 10:48:04 2014 : Debug: rlm_perl: Added pair Framed-MTU = 1400 Wed Jun 18 10:48:04 2014 : Debug: rlm_perl: Added pair Reply-Message = AuthFail Wed Jun 18 10:48:04 2014 : Debug: rlm_perl: Added pair EAP-Message = 0x040a0004 Wed Jun 18 10:48:04 2014 : Debug: rlm_perl: Added pair Tunnel-Medium-Type = IEEE-802 Wed Jun 18 10:48:04 2014 : Debug: rlm_perl: Added pair Tunnel-Type = VLAN Wed Jun 18 10:48:04 2014 : Debug: rlm_perl: Added pair Tunnel-Private-Group-Id = 33 Wed Jun 18 10:48:04 2014 : Debug: rlm_perl: Added pair Message-Authenticator = 0x00000000000000000000000000000000 Wed Jun 18 10:48:04 2014 : Debug: rlm_perl: Added pair FreeRADIUS-Client-Shortname = localhost Wed Jun 18 10:48:04 2014 : Debug: rlm_perl: Added pair LogMessage = RadiusReject Wed Jun 18 10:48:04 2014 : Debug: rlm_perl: Added pair AcnACLType = authfail Wed Jun 18 10:48:04 2014 : Debug: rlm_perl: Added pair Auth-Type = Accept Wed Jun 18 10:48:04 2014 : Info: ++[perlpolicy] returns ok Wed Jun 18 10:48:04 2014 : Info: # Executing section post-auth from file /home/auconet/freeradius/test/CSI/etc/raddb//sites-enabled/default Wed Jun 18 10:48:04 2014 : Info: +- entering group post-auth {...} Wed Jun 18 10:48:04 2014 : Info: ++[exec] returns noop Wed Jun 18 10:48:04 2014 : Info: Using Post-Auth-Type Reject Wed Jun 18 10:48:04 2014 : Info: # Executing group from file /home/auconet/freeradius/test/CSI/etc/raddb//sites-enabled/default Wed Jun 18 10:48:04 2014 : Info: +- entering group REJECT {...} Wed Jun 18 10:48:04 2014 : Info: ++- group REJECT returns noop Wed Jun 18 10:48:04 2014 : Info: Delaying reject of request 10 for 1 seconds Wed Jun 18 10:48:04 2014 : Debug: Going to the next request Wed Jun 18 10:48:04 2014 : Debug: Waking up in 0.9 seconds. Wed Jun 18 10:48:05 2014 : Info: Sending delayed reject for request 10 Sending Access-Reject of id 10 to 127.0.0.1 port 51730 Reply-Message = "AuthFail" EAP-Message = 0x040a0004 Tunnel-Medium-Type:0 = IEEE-802 Tunnel-Type:0 = VLAN Tunnel-Private-Group-Id:0 = "33" Message-Authenticator = 0x00000000000000000000000000000000 Wed Jun 18 10:48:05 2014 : Debug: Waking up in 3.9 seconds. ================= LOG End ===================================== My naÃ¯ve idea is to instead send an Access-Accept with a Tunnel-Id of 11. I disabled the filter in Post-Auth-Type REJECT { #attr_filter.access_reject } to see attributes from my perl-policy. Thanks

2 1