- Freeradius-Users - lists.freeradius.org

Valid Characters in User-Name & Password
by Ryan De Kock 31 Mar '14

31 Mar '14

Hi, Sorry if this is a dumb question but I couldn't find anything on google. Is there a list of valid characters that can be in the username & password feild of the access-request and account-start packets? for example, is a space (" ") valid in the username, #,&,^,etc. Where can I find this kind of info? Thanks!

2 1

Re: EAP session didn't finish
by Kiril 31 Mar '14

31 Mar '14

for some strange reason the topic http://freeradius.1045715.n5.nabble.com/EAP-session-didn-t-finish-td5723981… is not continued > >> ssl certs are generated during freeradius install, so the problem >> can't be in ssl >> who can tell in which case this message is shown? > > Ensure the CA for the server cert is trusted on the client. thx, but it is already trusted we have successful auths, too but sometimes it fails performing some other tests we can see that sometimes the AP is sending dissociating frame during the handshake between the device(pc, laptop, mobile, etc) and the AP. so the conversation fails

1 0

Re: EAP session didn't finish
by Kiril 31 Mar '14

31 Mar '14

> > Ensure the CA for the server cert is trusted on the client. thx, but it is already trusted we have successful auths, too but sometimes it fails performing some other tests we can see that sometimes the AP is sending dissociating frame during the handshake between the device(pc, laptop, mobile, etc) and the AP. so the conversation fails

1 0

Re: radius_xlat chops embedded NULs in cisco-av-pair
by Kiril 31 Mar '14

31 Mar '14

> No, it doesn't. > > If you look at the calls to fr_print_string, you'd see quote < 0 > is only passed in two places, valuepair.c:85 and valuepair.c:114, > both in the radius_compare_vps function, where the output is > passed to the regular expression comparison functions. > > Arguably if were doing comparisons on the raw attribute it should > be a memcpy, especially as regcomp appears to take the length > of the input string so it can probably deal with embedded NULLs > > But, this isn't related to your issue, if you read the concat > code in 3.x.x xlat.c:1911 it's calling vp_aprint, which at > the moment just does a talloc_strdup, which is as bad as > strlcpy. > > After i've fixed that, and written a regression test for 3.x.x I will > take a look at 2.x.x. thx

1 0

Re: radius_xlat chops embedded NULs in cisco-av-pair
by Kiril 31 Mar '14

31 Mar '14

> The string (RFC type 'text') should be escaped before being added to the concatenation buffer. I'll take a look and see if it's fixed in later versions. maybe the entire attribute value data is copied but when sql_escape_func from rlm_sql module is called it stops on the first NUL byte in it, so maybe the escaping fails?

2 1

radius_xlat chops embedded NULs in cisco-av-pair
by Kiril 31 Mar '14

31 Mar '14

Hi, there is a problem under freeradius 2.1.12 when incoming radius packet has embedded NUL bytes in the middle of the string attribute cisco-av-pair in debug packet output it is printed as Cisco-AVPair = "release-source=\000\000\000\002" but when we use %{Cisco-AVPair[*]} in sql accounting query it is expanded as "release-source=" in previous version 1.x the bahaviour was different - xlat-ed string in query was shown as in debug output according to RFC 2869 section 5 it is said: "Servers and servers and clients MUST be able to deal with embedded nulls. RADIUS implementers using C are cautioned not to use strcpy() when handling strings." and radius_xlat function uses strlcpy(out, vp->vp_strvalue, outlen) in vp_prints_value, so not the full string vp->vp_strvalue is copied what should be done in this case: fix the radius source, or fix the NAS?

2 2

Re: FreeRadius Authorizing and Authenticating Anyone if One User Logs in
by Lennon Mazonde 31 Mar '14

31 Mar '14

Hi Alan, Thanks for responding > Don't do that. PLEASE follow the instructions. "radiusd -X" is good > enough. When i run "radiusd -X", i get the error The program 'radiusd' can be found in the following packages: * radiusd-livingston * yardradius Try: apt-get install <selected package> > > The debug log shows one user "test" logging in, twice. It doesn't > show other users logging in. That's because I logged the user "test" in and out, and then in again. My bad, should have just posted output from one login. Anyone else who connects to the network after this (the first user) simply gets access to the internet, without any redirect to the captive portal > > You probably need to double-check the captive portal configuration. > The "double login" has nothing to do with FreeRADIUS. The captive > portal should allow ONE user in, when ONE user authenticates. The other > users should be blocked. > > As always, FreeRADIUS does authentication. It does NOT control > network access. If a user is gaining network access when they shouldn't > have it, the problem is the NAS (or Captive portal here). Thanks a lot for that pointer, i'm scouring through the configs of the captive portal to see what might be wrong > > Alan DeKok. Lennon Mazonde

4 4

Perl attribute: length vs 0-byte termination
by Julius Plenz 31 Mar '14

31 Mar '14

Hi, some recent change seems to have broken the "rlm_perl" attribute handling. For a string, instead of adding a scalar value with appropriate length, it seems the whole buffer (including 0-byte) is inserted into the Perl hash. Consider this authorize() method: sub authorize { $RAD_REPLY{'Reply-Message'} = "Username >>".$RAD_REQUEST{'User-Name'}."<<"; return RLM_MODULE_UPDATED; } This leads, wrongly, to a prematurely terminated string: rlm_perl: Added pair Reply-Message = Username >>user When you add a line like this at the beginning of the subroutine: $RAD_REQUEST{'User-Name'} =~ s/\0//g; ...then you'll receive the typical garbage that's in uncleared memory: rlm_perl: Added pair Reply-Message = Username >>user ??"c¨?ìå ??... Somehow, the length computation of the SVs must be fixed, but I don't know what broke it or how to repair it... Any help appreciated, thanks in advance! Julius P.S.: I've tested this with FreeRADIUS Git tag "release_3_0_2".

2 1

Re: group authorization
by Brendan Kearney 30 Mar '14

30 Mar '14

resending. rejected because of size. previously attached screenshot moved to imgur. http://imgur.com/MvEuJXb On Sat, 2014-03-29 at 11:07 -0400, Brendan Kearney wrote: > Reran this test, with a packet capture running to validate the returned > data from my directory. > > As expected, the authN works but the authZ fails. the uid is being > populated with the username and not the DN. The problem is that the > directory is replying with a successful lookup, and is giving back the > DN of my id. See attached screenshot of the packet capture. the blue > highlighted lines indicate the reply from the directory with the DN. > > where do i continue looking for the reason why the DN is not being > populated as the value to the variable "control:Ldap-UserDn"? > > raduisd -X output: > > [root@server modules]# radiusd -X > FreeRADIUS Version 2.2.0, for host x86_64-redhat-linux-gnu, built on Oct > 9 2012 at 17:45:02 > Copyright (C) 1999-2012 The FreeRADIUS server project and contributors. > There is NO warranty; not even for MERCHANTABILITY or FITNESS FOR A > PARTICULAR PURPOSE. > You may redistribute copies of FreeRADIUS under the terms of the > GNU General Public License v2. > Starting - reading configuration files ... > including configuration file /etc/raddb/radiusd.conf > including configuration file /etc/raddb/proxy.conf > including configuration file /etc/raddb/clients.conf > including files in directory /etc/raddb/modules/ > including configuration file /etc/raddb/modules/linelog > including configuration file /etc/raddb/modules/smsotp > including configuration file /etc/raddb/modules/attr_filter > including configuration file /etc/raddb/modules/sql_log > including configuration file /etc/raddb/modules/checkval > including configuration file /etc/raddb/modules/etc_group > including configuration file /etc/raddb/modules/krb5 > including configuration file /etc/raddb/modules/ntlm_auth > including configuration > file /etc/raddb/modules/sqlcounter_expire_on_login > including configuration file /etc/raddb/modules/preprocess > including configuration file /etc/raddb/modules/opendirectory > including configuration file /etc/raddb/modules/digest > including configuration file /etc/raddb/modules/rediswho > including configuration file /etc/raddb/modules/attr_rewrite > including configuration file /etc/raddb/modules/cui > including configuration file /etc/raddb/modules/policy > including configuration file /etc/raddb/modules/mac2vlan > skipping config file, invalid characters in name > "/etc/raddb/modules/&krb5.orig" > including configuration file /etc/raddb/modules/mac2ip > including configuration file /etc/raddb/modules/logintime > including configuration file /etc/raddb/modules/smbpasswd > including configuration file /etc/raddb/modules/sradutmp > including configuration file /etc/raddb/modules/radrelay > including configuration file /etc/raddb/modules/detail.example.com > including configuration file /etc/raddb/modules/expr > including configuration file /etc/raddb/modules/pap > including configuration file /etc/raddb/modules/ippool > including configuration file /etc/raddb/modules/wimax > including configuration file /etc/raddb/modules/mschap > skipping config file, invalid name "/etc/raddb/modules/ldap.rpmnew" > including configuration file /etc/raddb/modules/inner-eap > including configuration file /etc/raddb/modules/passwd > including configuration file /etc/raddb/modules/unix > skipping config file, invalid characters in name > "/etc/raddb/modules/&dhcp_sqlippool.orig" > including configuration file /etc/raddb/modules/perl > including configuration file /etc/raddb/modules/pam > including configuration file /etc/raddb/modules/soh > including configuration file /etc/raddb/modules/ldap > including configuration file /etc/raddb/modules/redis > including configuration file /etc/raddb/modules/counter > including configuration file /etc/raddb/modules/realm > including configuration file /etc/raddb/modules/chap > including configuration file /etc/raddb/modules/cache > skipping config file, invalid characters in name > "/etc/raddb/modules/&ldap.orig" > including configuration file /etc/raddb/modules/always > including configuration file /etc/raddb/modules/replicate > including configuration file /etc/raddb/modules/expiration > including configuration file /etc/raddb/modules/radutmp > including configuration file /etc/raddb/modules/files > including configuration file /etc/raddb/modules/acct_unique > including configuration file /etc/raddb/modules/detail.log > including configuration file /etc/raddb/modules/detail > including configuration file /etc/raddb/modules/exec > including configuration file /etc/raddb/modules/echo > including configuration file /etc/raddb/modules/otp > including configuration file /etc/raddb/modules/dynamic_clients > including configuration file /etc/raddb/eap.conf > including configuration file /etc/raddb/policy.conf > including files in directory /etc/raddb/sites-enabled/ > including configuration file /etc/raddb/sites-enabled/default > including configuration file /etc/raddb/sites-enabled/inner-tunnel > including configuration file /etc/raddb/sites-enabled/control-socket > main { > user = "radiusd" > group = "radiusd" > allow_core_dumps = no > } > including dictionary file /etc/raddb/dictionary > main { > name = "radiusd" > prefix = "/usr" > localstatedir = "/var" > sbindir = "/usr/sbin" > logdir = "/var/log/radius" > run_dir = "/var/run/radiusd" > libdir = "/usr/lib64/freeradius" > radacctdir = "/var/log/radius/radacct" > hostname_lookups = no > max_request_time = 30 > cleanup_delay = 5 > max_requests = 1024 > pidfile = "/var/run/radiusd/radiusd.pid" > checkrad = "/usr/sbin/checkrad" > debug_level = 0 > proxy_requests = yes > log { > stripped_names = no > auth = yes > auth_badpass = no > auth_goodpass = no > } > security { > max_attributes = 200 > reject_delay = 1 > status_server = yes > } > } > radiusd: #### Loading Realms and Home Servers #### > proxy server { > retry_delay = 5 > retry_count = 3 > default_fallback = no > dead_time = 120 > wake_all_if_all_dead = no > } > home_server localhost { > ipaddr = 127.0.0.1 > port = 1812 > type = "auth" > secret = "***REMOVED***" > response_window = 20 > max_outstanding = 65536 > require_message_authenticator = yes > zombie_period = 40 > status_check = "status-server" > ping_interval = 30 > check_interval = 30 > num_answers_to_alive = 3 > num_pings_to_alive = 3 > revive_interval = 120 > status_check_timeout = 4 > coa { > irt = 2 > mrt = 16 > mrc = 5 > mrd = 30 > } > } > home_server_pool my_auth_failover { > type = fail-over > home_server = localhost > } > realm example.com { > auth_pool = my_auth_failover > } > realm LOCAL { > } > realm BPK2.COM { > authhost = server.bpk2.com:1812 > accthost = server.bpk2.com:1813 > secret = ***REMOVED*** > } > radiusd: #### Loading Clients #### > client localhost { > ipaddr = 127.0.0.1 > require_message_authenticator = no > secret = "***REMOVED***" > nastype = "other" > } > client 192.168.254.253 { > require_message_authenticator = no > secret = "***REMOVED***" > shortname = "switch" > nastype = "cisco" > } > client test.bpk2.com { > require_message_authenticator = no > secret = "***REMOVED***" > shortname = "splunk" > nastype = "other" > } > radiusd: #### Instantiating modules #### > instantiate { > Module: Linked to module rlm_exec > Module: Instantiating module "exec" from file /etc/raddb/modules/exec > exec { > wait = no > input_pairs = "request" > shell_escape = yes > } > Module: Linked to module rlm_expr > Module: Instantiating module "expr" from file /etc/raddb/modules/expr > Module: Linked to module rlm_expiration > Module: Instantiating module "expiration" from > file /etc/raddb/modules/expiration > expiration { > reply-message = "Password Has Expired " > } > Module: Linked to module rlm_logintime > Module: Instantiating module "logintime" from > file /etc/raddb/modules/logintime > logintime { > reply-message = "You are calling outside your allowed timespan " > minimum-timeout = 60 > } > } > radiusd: #### Loading Virtual Servers #### > server { # from file /etc/raddb/radiusd.conf > modules { > Module: Creating Auth-Type = digest > Module: Creating Post-Auth-Type = REJECT > Module: Checking authenticate {...} for more modules to load > Module: Linked to module rlm_pap > Module: Instantiating module "pap" from file /etc/raddb/modules/pap > pap { > encryption_scheme = "auto" > auto_header = no > } > Module: Linked to module rlm_chap > Module: Instantiating module "chap" from file /etc/raddb/modules/chap > Module: Linked to module rlm_mschap > Module: Instantiating module "mschap" from > file /etc/raddb/modules/mschap > mschap { > use_mppe = yes > require_encryption = no > require_strong = no > with_ntdomain_hack = no > allow_retry = yes > } > Module: Linked to module rlm_krb5 > Module: Instantiating module "krb5" from file /etc/raddb/modules/krb5 > krb5 { > keytab = "/etc/radius.keytab" > service_principal = "radius/server.bpk2.com" > cache = yes > } > rlm_krb5: krb5_init ok > Module: Linked to module rlm_digest > Module: Instantiating module "digest" from > file /etc/raddb/modules/digest > Module: Linked to module rlm_unix > Module: Instantiating module "unix" from file /etc/raddb/modules/unix > unix { > radwtmp = "/var/log/radius/radwtmp" > } > Module: Linked to module rlm_eap > Module: Instantiating module "eap" from file /etc/raddb/eap.conf > eap { > default_eap_type = "md5" > timer_expire = 60 > ignore_unknown_eap_types = no > cisco_accounting_username_bug = no > max_sessions = 4096 > } > Module: Linked to sub-module rlm_eap_md5 > Module: Instantiating eap-md5 > Module: Linked to sub-module rlm_eap_leap > Module: Instantiating eap-leap > Module: Linked to sub-module rlm_eap_gtc > Module: Instantiating eap-gtc > gtc { > challenge = "Password: " > auth_type = "PAP" > } > Module: Linked to sub-module rlm_eap_tls > Module: Instantiating eap-tls > tls { > rsa_key_exchange = no > dh_key_exchange = yes > rsa_key_length = 512 > dh_key_length = 512 > verify_depth = 0 > CA_path = "/etc/raddb/certs" > pem_file_type = yes > private_key_file = "/etc/raddb/certs/server.pem" > certificate_file = "/etc/raddb/certs/server.pem" > CA_file = "/etc/raddb/certs/ca.pem" > private_key_password = "whatever" > dh_file = "/etc/raddb/certs/dh" > random_file = "/etc/raddb/certs/random" > fragment_size = 1024 > include_length = yes > check_crl = no > cipher_list = "DEFAULT" > cache { > enable = no > lifetime = 24 > max_entries = 255 > } > verify { > } > ocsp { > enable = no > override_cert_url = yes > url = "http://127.0.0.1/ocsp/" > use_nonce = yes > timeout = 0 > softfail = no > } > } > Module: Linked to sub-module rlm_eap_ttls > Module: Instantiating eap-ttls > ttls { > default_eap_type = "md5" > copy_request_to_tunnel = no > use_tunneled_reply = no > virtual_server = "inner-tunnel" > include_length = yes > } > Module: Linked to sub-module rlm_eap_peap > Module: Instantiating eap-peap > peap { > default_eap_type = "mschapv2" > copy_request_to_tunnel = no > use_tunneled_reply = no > proxy_tunneled_request_as_eap = yes > virtual_server = "inner-tunnel" > soh = no > } > Module: Linked to sub-module rlm_eap_mschapv2 > Module: Instantiating eap-mschapv2 > mschapv2 { > with_ntdomain_hack = no > send_error = no > } > Module: Checking authorize {...} for more modules to load > Module: Linked to module rlm_preprocess > Module: Instantiating module "preprocess" from > file /etc/raddb/modules/preprocess > preprocess { > huntgroups = "/etc/raddb/huntgroups" > hints = "/etc/raddb/hints" > with_ascend_hack = no > ascend_channels_per_line = 23 > with_ntdomain_hack = no > with_specialix_jetstream_hack = no > with_cisco_vsa_hack = no > with_alvarion_vsa_hack = no > } > reading pairlist file /etc/raddb/huntgroups > reading pairlist file /etc/raddb/hints > Module: Linked to module rlm_realm > Module: Instantiating module "suffix" from > file /etc/raddb/modules/realm > realm suffix { > format = "suffix" > delimiter = "@" > ignore_default = no > ignore_null = no > } > Module: Linked to module rlm_files > Module: Instantiating module "files" from file /etc/raddb/modules/files > files { > usersfile = "/etc/raddb/users" > acctusersfile = "/etc/raddb/acct_users" > preproxy_usersfile = "/etc/raddb/preproxy_users" > compat = "no" > } > reading pairlist file /etc/raddb/users > reading pairlist file /etc/raddb/acct_users > reading pairlist file /etc/raddb/preproxy_users > Module: Linked to module rlm_ldap > Module: Instantiating module "ldap" from file /etc/raddb/modules/ldap > ldap { > server = "ldap2.bpk2.com" > port = 389 > password = "***REMOVED***" > identity = "cn=Manager,dc=bpk2,dc=com" > net_timeout = 1 > timeout = 4 > timelimit = 3 > max_uses = 0 > tls_mode = no > start_tls = no > tls_require_cert = "allow" > tls { > start_tls = no > require_cert = "allow" > } > basedn = "dc=bpk2,dc=com" > filter = "(uid=%{%{Stripped-User-Name}:-%{User-Name}})" > base_filter = "(objectclass=radiusprofile)" > auto_header = no > access_attr_used_for_allow = yes > groupname_attribute = "cn" > groupmembership_filter = "(&(objectClass=GroupOfNames)(member= > %{control:Ldap-UserDn}))" > groupmembership_attribute = "radiusGroupName" > dictionary_mapping = "/etc/raddb/ldap.attrmap" > ldap_debug = 0 > ldap_connections_number = 5 > compare_check_items = no > do_xlat = yes > set_auth_type = yes > keepalive { > idle = 60 > probes = 3 > interval = 3 > } > } > rlm_ldap: Registering ldap_groupcmp for Ldap-Group > rlm_ldap: Registering ldap_xlat with xlat_name ldap > rlm_ldap: Over-riding set_auth_type, as there is no module ldap listed > in the "authenticate" section. > rlm_ldap: reading ldap<->radius mappings from > file /etc/raddb/ldap.attrmap > rlm_ldap: LDAP radiusCheckItem mapped to RADIUS $GENERIC$ > rlm_ldap: LDAP radiusReplyItem mapped to RADIUS $GENERIC$ > rlm_ldap: LDAP radiusAuthType mapped to RADIUS Auth-Type > rlm_ldap: LDAP radiusSimultaneousUse mapped to RADIUS Simultaneous-Use > rlm_ldap: LDAP radiusCalledStationId mapped to RADIUS Called-Station-Id > rlm_ldap: LDAP radiusCallingStationId mapped to RADIUS > Calling-Station-Id > rlm_ldap: LDAP lmPassword mapped to RADIUS LM-Password > rlm_ldap: LDAP ntPassword mapped to RADIUS NT-Password > rlm_ldap: LDAP sambaLmPassword mapped to RADIUS LM-Password > rlm_ldap: LDAP sambaNtPassword mapped to RADIUS NT-Password > rlm_ldap: LDAP dBCSPwd mapped to RADIUS LM-Password > rlm_ldap: LDAP userPassword mapped to RADIUS Password-With-Header > rlm_ldap: LDAP acctFlags mapped to RADIUS SMB-Account-CTRL-TEXT > rlm_ldap: LDAP radiusExpiration mapped to RADIUS Expiration > rlm_ldap: LDAP radiusNASIpAddress mapped to RADIUS NAS-IP-Address > rlm_ldap: LDAP radiusServiceType mapped to RADIUS Service-Type > rlm_ldap: LDAP radiusFramedProtocol mapped to RADIUS Framed-Protocol > rlm_ldap: LDAP radiusFramedIPAddress mapped to RADIUS Framed-IP-Address > rlm_ldap: LDAP radiusFramedIPNetmask mapped to RADIUS Framed-IP-Netmask > rlm_ldap: LDAP radiusFramedRoute mapped to RADIUS Framed-Route > rlm_ldap: LDAP radiusFramedRouting mapped to RADIUS Framed-Routing > rlm_ldap: LDAP radiusFilterId mapped to RADIUS Filter-Id > rlm_ldap: LDAP radiusFramedMTU mapped to RADIUS Framed-MTU > rlm_ldap: LDAP radiusFramedCompression mapped to RADIUS > Framed-Compression > rlm_ldap: LDAP radiusLoginIPHost mapped to RADIUS Login-IP-Host > rlm_ldap: LDAP radiusLoginService mapped to RADIUS Login-Service > rlm_ldap: LDAP radiusLoginTCPPort mapped to RADIUS Login-TCP-Port > rlm_ldap: LDAP radiusCallbackNumber mapped to RADIUS Callback-Number > rlm_ldap: LDAP radiusCallbackId mapped to RADIUS Callback-Id > rlm_ldap: LDAP radiusFramedIPXNetwork mapped to RADIUS > Framed-IPX-Network > rlm_ldap: LDAP radiusClass mapped to RADIUS Class > rlm_ldap: LDAP radiusSessionTimeout mapped to RADIUS Session-Timeout > rlm_ldap: LDAP radiusIdleTimeout mapped to RADIUS Idle-Timeout > rlm_ldap: LDAP radiusTerminationAction mapped to RADIUS > Termination-Action > rlm_ldap: LDAP radiusLoginLATService mapped to RADIUS Login-LAT-Service > rlm_ldap: LDAP radiusLoginLATNode mapped to RADIUS Login-LAT-Node > rlm_ldap: LDAP radiusLoginLATGroup mapped to RADIUS Login-LAT-Group > rlm_ldap: LDAP radiusFramedAppleTalkLink mapped to RADIUS > Framed-AppleTalk-Link > rlm_ldap: LDAP radiusFramedAppleTalkNetwork mapped to RADIUS > Framed-AppleTalk-Network > rlm_ldap: LDAP radiusFramedAppleTalkZone mapped to RADIUS > Framed-AppleTalk-Zone > rlm_ldap: LDAP radiusPortLimit mapped to RADIUS Port-Limit > rlm_ldap: LDAP radiusLoginLATPort mapped to RADIUS Login-LAT-Port > rlm_ldap: LDAP radiusReplyMessage mapped to RADIUS Reply-Message > rlm_ldap: LDAP radiusTunnelType mapped to RADIUS Tunnel-Type > rlm_ldap: LDAP radiusTunnelMediumType mapped to RADIUS > Tunnel-Medium-Type > rlm_ldap: LDAP radiusTunnelPrivateGroupId mapped to RADIUS > Tunnel-Private-Group-Id > conns: 0x7f4fd76d3080 > Module: Checking preacct {...} for more modules to load > Module: Linked to module rlm_acct_unique > Module: Instantiating module "acct_unique" from > file /etc/raddb/modules/acct_unique > acct_unique { > key = "User-Name, Acct-Session-Id, NAS-IP-Address, NAS-Identifier, > NAS-Port" > } > Module: Checking accounting {...} for more modules to load > Module: Linked to module rlm_radutmp > Module: Instantiating module "radutmp" from > file /etc/raddb/modules/radutmp > radutmp { > filename = "/var/log/radius/radutmp" > username = "%{User-Name}" > case_sensitive = yes > check_with_nas = yes > perm = 384 > callerid = yes > } > Module: Linked to module rlm_attr_filter > Module: Instantiating module "attr_filter.accounting_response" from > file /etc/raddb/modules/attr_filter > attr_filter attr_filter.accounting_response { > attrsfile = "/etc/raddb/attrs.accounting_response" > key = "%{User-Name}" > relaxed = no > } > reading pairlist file /etc/raddb/attrs.accounting_response > Module: Checking session {...} for more modules to load > Module: Checking post-proxy {...} for more modules to load > Module: Checking post-auth {...} for more modules to load > Module: Instantiating module "attr_filter.access_reject" from > file /etc/raddb/modules/attr_filter > attr_filter attr_filter.access_reject { > attrsfile = "/etc/raddb/attrs.access_reject" > key = "%{User-Name}" > relaxed = no > } > reading pairlist file /etc/raddb/attrs.access_reject > } # modules > } # server > server inner-tunnel { # from file /etc/raddb/sites-enabled/inner-tunnel > modules { > Module: Checking authenticate {...} for more modules to load > Module: Checking authorize {...} for more modules to load > Module: Checking session {...} for more modules to load > Module: Checking post-proxy {...} for more modules to load > Module: Checking post-auth {...} for more modules to load > } # modules > } # server > radiusd: #### Opening IP addresses and Ports #### > listen { > type = "auth" > ipaddr = * > port = 0 > } > listen { > type = "acct" > ipaddr = * > port = 0 > } > listen { > type = "control" > listen { > socket = "/var/run/radiusd/radiusd.sock" > } > } > listen { > type = "auth" > ipaddr = 127.0.0.1 > port = 18120 > } > ... adding new socket proxy address * port 43742 > Listening on authentication address * port 1812 > Listening on accounting address * port 1813 > Listening on command file /var/run/radiusd/radiusd.sock > Listening on authentication address 127.0.0.1 port 18120 as server > inner-tunnel > Listening on proxy address * port 1814 > Ready to process requests. > > > > rad_recv: Access-Request packet from host 192.168.254.253 port 49181, > id=0, length=88 > User-Name = "brendan" > User-Password = "***REMOVED***" > Cisco-AVPair = "shell:priv-lvl=15" > NAS-IP-Address = 192.168.254.253 > Acct-Session-Id = "05000039" > # Executing section authorize from file /etc/raddb/sites-enabled/default > +- entering group authorize {...} > ++[preprocess] returns ok > ++? if (EAP-Message && Access-Request) > ? Evaluating (EAP-Message ) -> FALSE > ? Skipping (Access-Request) > ++? if (EAP-Message && Access-Request) -> FALSE > ++- entering else else {...} > +++[chap] returns noop > +++[mschap] returns noop > +++[digest] returns noop > [suffix] No '@' in User-Name = "brendan", looking up realm NULL > [suffix] No such realm "NULL" > +++[suffix] returns noop > [eap] No EAP-Message, not doing EAP > +++[eap] returns noop > [files] users: Matched entry DEFAULT at line 1 > +++[files] returns ok > [ldap] performing user authorization for brendan > [ldap] expand: %{Stripped-User-Name} -> > [ldap] ... expanding second conditional > [ldap] expand: %{User-Name} -> brendan > [ldap] expand: (uid=%{%{Stripped-User-Name}:-%{User-Name}}) -> > (uid=brendan) > [ldap] expand: dc=bpk2,dc=com -> dc=bpk2,dc=com > [ldap] ldap_get_conn: Checking Id: 0 > [ldap] ldap_get_conn: Got Id: 0 > [ldap] attempting LDAP reconnection > [ldap] (re)connect to ldap2.bpk2.com:389, authentication 0 > [ldap] bind as cn=Manager,dc=bpk2,dc=com/***REMOVED*** to > ldap2.bpk2.com:389 > [ldap] waiting for bind result ... > [ldap] Bind was successful > [ldap] performing search in dc=bpk2,dc=com, with filter (uid=brendan) > [ldap] looking for check items in directory... > [ldap] userPassword -> Password-With-Header == "***REMOVED***" > [ldap] sambaNtPassword -> NT-Password == ***REMOVED*** > [ldap] sambaLmPassword -> LM-Password == ***REMOVED*** > [ldap] looking for reply items in directory... > [ldap] user brendan authorized to use remote access > [ldap] ldap_release_conn: Release Id: 0 > +++[ldap] returns ok > +++[expiration] returns noop > +++[logintime] returns noop > [pap] Normalizing NT-Password from hex encoding > [pap] Normalizing LM-Password from hex encoding > [pap] Normalizing SSHA1-Password from base64 encoding > [pap] WARNING: Auth-Type already set. Not setting to PAP > +++[pap] returns noop > ++- else else returns ok > Found Auth-Type = Kerberos > # Executing group from file /etc/raddb/sites-enabled/default > +- entering group Kerberos {...} > ++[krb5] returns ok > Login OK: [brendan] (from client switch port 0) > # Executing section post-auth from file /etc/raddb/sites-enabled/default > +- entering group post-auth {...} > ++[exec] returns noop > Sending Access-Accept of id 0 to 192.168.254.253 port 49181 > Finished request 0. > Going to the next request > Waking up in 4.9 seconds. > Cleaning up request 0 ID 0 with timestamp +5 > Ready to process requests. > ^C >

3 2

Wiki down
by Arran Cudbard-Bell 29 Mar '14

29 Mar '14

Just updating to the latest version of Gollum. "Never goes smooth. How come it never goes smooth?" Arran Cudbard-Bell <a.cudbardb(a)freeradius.org> FreeRADIUS Development Team FD31 3077 42EC 7FCD 32FE 5EE2 56CF 27F9 30A8 CAA2

1 1