- Freeradius-Users - lists.freeradius.org

Exec remote command in Preprocess
by Rafal Pilos 28 Feb '14

28 Feb '14

Hello I want to make some additional checks under authorization. I edited default file in preprocess section. This is how I want to make it: preprocess if (%{exec:/path/to/script.sh} == "some numbers"){ update control { Auth-Type := "Accept" } } else { update control { Auth-Type := "Reject" } } However this doesn't work. Debug shows: Bare %{...} is invalid in condition at: %{exec:/path/to/script.sh} == "some numbers") What im doing wrong ? Is there possibility to execute remote script in this place ?

2 3

EAP-TLS and EAP-TTLS/MSCHAPv2 in parralel...possible ?
by Ben 28 Feb '14

28 Feb '14

Hi, I've got a solution currently in place that works beautifully authenticating users with certificates using EAP-TLS. Unfortunatley, I need to start catering for users who have, shall we say, "limited" endpoints that only support TTLS/MSCHAPv2 type authentication (things like Amazon Kindle Paperwhotsits" for example, have a limited implementation that you can't seem to stick certificates on without jailbreaking... and that ain't gonna happen). So, I'm a bit lost for ideas ? I'm not a freeradius guru either... and the config files I've had a quick peek at seem to suggest bad things will happen .... e.g. the following comment .... # Note that this means "check plain-text password against # the ldap database", which means that EAP won't work, # as it does not supply a plain-text password. Ideas most welcome ! Thanks Ben

4 5

EAP-TLS with CRL Howto
by Gregory Sloop 28 Feb '14

28 Feb '14

I've recently setup EAP-TLS on Ubuntu 12.04 and managed to get CRL's to work, using the c_rehash - which appears to have caused lots of people trouble. [In fact, I couldn't find a single walk-through or functional outcome using the documented ways on either this list of the OpenSSL list - so it seems like a highly relevant need..] I was thinking of posting a walk-through to the list - and would be glad to add it to a Wiki page [and/or]. However, the irritation levels seem fairly high today, so I thought I'd ask before I toss it out there. I'd really like to keep both of my legs intact. :) So [tl;dr]: Is an EAP-TLS guide with a working CRL something appropriate for the list/wiki? If so, any suggestions before I do the final edits and complete the write-up? -Greg

3 2

Hello, please help me with SQL integration
by For Sinton 28 Feb '14

28 Feb '14

Good day! I installed freeradius 3.0.x on a server with FreeBSD. Simple Authorization Users through a "files" works without problems. I started to connect SQL, as described in the documentation "HOW-SQL". Users added to the table radcheck, and when prompted radtest user user_pass localhost 0 testing123 - user can not login. Comes the following error root@gateway:~ # radtest fredf wilma 127.0.0.1 0 testing123 Sending Access-Request of id 9 from 0.0.0.0 port 52606 to 127.0.0.1 port 1812 User-Name = 'fredf' User-Password = 'wilma' NAS-IP-Address = 127.0.0.1 NAS-Port = 0 Message-Authenticator = 0x00 rad_recv: Access-Reject packet from host 127.0.0.1 port 1812, id=9, length=20 root@gateway:~ # debug message rad_recv: Access-Request packet from host 127.0.0.1 port 52606, id=9, length=75 User-Name = 'fredf' User-Password = 'wilma' NAS-IP-Address = 127.0.0.1 NAS-Port = 0 Message-Authenticator = 0x921e720cf0599ea4cae31cf81ee1da87 Thu Feb 27 20:06:01 2014 : Debug: (0) # Executing section authorize from file /usr/local/etc/raddb/sites-enabled/default Thu Feb 27 20:06:01 2014 : Debug: (0) authorize { Thu Feb 27 20:06:01 2014 : Debug: (0) modsingle[authorize]: calling preprocess (rlm_preprocess) for request 0 Thu Feb 27 20:06:01 2014 : Debug: (0) modsingle[authorize]: returned from preprocess (rlm_preprocess) for request 0 Thu Feb 27 20:06:01 2014 : Debug: (0) [preprocess] = ok Thu Feb 27 20:06:01 2014 : Debug: (0) ? if ("%{sql:SELECT id, username, attribute, value, op FROM radcheck WHERE username = '%{User-Name}' ORDER BY id" >= 1) Thu Feb 27 20:06:01 2014 : Debug: %{sql:SELECT id, username, attribute, value, op FROM radcheck WHERE username = '%{User-Name}' ORDER BY id Thu Feb 27 20:06:01 2014 : Debug: Parsed xlat tree: Thu Feb 27 20:06:01 2014 : Debug: xlat: sql Thu Feb 27 20:06:01 2014 : Debug: { Thu Feb 27 20:06:01 2014 : Debug: literal: 'SELECT id, username, attribute, value, op FROM radcheck WHERE username = '' Thu Feb 27 20:06:01 2014 : Debug: attribute: User-Name Thu Feb 27 20:06:01 2014 : Debug: { Thu Feb 27 20:06:01 2014 : Debug: ref 2 Thu Feb 27 20:06:01 2014 : Debug: list 1 Thu Feb 27 20:06:01 2014 : Debug: tag -128 Thu Feb 27 20:06:01 2014 : Debug: } Thu Feb 27 20:06:01 2014 : Debug: literal: '' ORDER BY id' Thu Feb 27 20:06:01 2014 : Debug: } Thu Feb 27 20:06:01 2014 : Debug: %{User-Name} Thu Feb 27 20:06:01 2014 : Debug: Parsed xlat tree: Thu Feb 27 20:06:01 2014 : Debug: attribute: User-Name Thu Feb 27 20:06:01 2014 : Debug: { Thu Feb 27 20:06:01 2014 : Debug: ref 2 Thu Feb 27 20:06:01 2014 : Debug: list 1 Thu Feb 27 20:06:01 2014 : Debug: tag -128 Thu Feb 27 20:06:01 2014 : Debug: } Thu Feb 27 20:06:01 2014 : Debug: (0) expand: "%{User-Name}" -> 'fredf' Thu Feb 27 20:06:01 2014 : Debug: (0) SQL-User-Name set to 'fredf' Thu Feb 27 20:06:01 2014 : Debug: rlm_sql (sql): Reserved connection (4) Thu Feb 27 20:06:01 2014 : Debug: /var/log/sqllog.sql Thu Feb 27 20:06:01 2014 : Debug: Parsed xlat tree: Thu Feb 27 20:06:01 2014 : Debug: literal: '/var/log/sqllog.sql' Thu Feb 27 20:06:01 2014 : Debug: (0) expand: "/var/log/sqllog.sql" -> '/var/log/sqllog.sql' Thu Feb 27 20:06:01 2014 : Debug: rlm_sql (sql): Executing query: 'SELECT id, username, attribute, value, op FROM radcheck WHERE username = 'fredf' ORDER BY id' Thu Feb 27 20:06:01 2014 : Debug: (0) SQL query returned no results ------> why ? If you do this query inside mysql - i got result :( Thu Feb 27 20:06:01 2014 : Debug: rlm_sql (sql): Released connection (4) Thu Feb 27 20:06:01 2014 : Info: rlm_sql (sql): Closing connection (0): Too many free connections (5 > 3) Thu Feb 27 20:06:01 2014 : Debug: (0) expand: "%{sql:SELECT id, username, attribute, value, op FROM radcheck WHERE username = '%{User-Name}' ORDER BY id" -> '' Thu Feb 27 20:06:01 2014 : Debug: (0) ? if ("%{sql:SELECT id, username, attribute, value, op FROM radcheck WHERE username = '%{User-Name}' ORDER BY id" >= 1) -> FALSE Thu Feb 27 20:06:01 2014 : Debug: (0) else else { Thu Feb 27 20:06:01 2014 : Debug: (0) modsingle[authorize]: calling reject (rlm_always) for request 0 Thu Feb 27 20:06:01 2014 : Debug: (0) modsingle[authorize]: returned from reject (rlm_always) for request 0 Thu Feb 27 20:06:01 2014 : Debug: (0) [reject] = reject Thu Feb 27 20:06:01 2014 : Debug: (0) } # else else = reject Thu Feb 27 20:06:01 2014 : Debug: (0) } # authorize = reject Thu Feb 27 20:06:01 2014 : Debug: (0) Using Post-Auth-Type Reject Thu Feb 27 20:06:01 2014 : Debug: (0) # Executing group from file /usr/local/etc/raddb/sites-enabled/default Thu Feb 27 20:06:01 2014 : Debug: (0) Post-Auth-Type REJECT { Thu Feb 27 20:06:01 2014 : Debug: (0) modsingle[post-auth]: calling sql (rlm_sql) for request 0 Thu Feb 27 20:06:01 2014 : Debug: .query Thu Feb 27 20:06:01 2014 : Debug: Parsed xlat tree: Thu Feb 27 20:06:01 2014 : Debug: literal: '.query' Thu Feb 27 20:06:01 2014 : Debug: (0) sql : expand: ".query" -> '.query' Thu Feb 27 20:06:01 2014 : Debug: (0) sql : Using query template 'query' Thu Feb 27 20:06:01 2014 : Debug: rlm_sql (sql): Reserved connection (4) Thu Feb 27 20:06:01 2014 : Debug: %{User-Name} Thu Feb 27 20:06:01 2014 : Debug: Parsed xlat tree: Thu Feb 27 20:06:01 2014 : Debug: attribute: User-Name Thu Feb 27 20:06:01 2014 : Debug: { Thu Feb 27 20:06:01 2014 : Debug: ref 2 Thu Feb 27 20:06:01 2014 : Debug: list 1 Thu Feb 27 20:06:01 2014 : Debug: tag -128 Thu Feb 27 20:06:01 2014 : Debug: } Thu Feb 27 20:06:01 2014 : Debug: (0) sql : expand: "%{User-Name}" -> 'fredf' Thu Feb 27 20:06:01 2014 : Debug: (0) sql : SQL-User-Name set to 'fredf' Thu Feb 27 20:06:01 2014 : Debug: INSERT INTO radpostauth (username, pass, reply, authdate) VALUES ( '%{SQL-User-Name}', '%{%{User-Password}:-%{Chap-Password}}', '%{reply:Packet-Type}', '%S') Thu Feb 27 20:06:01 2014 : Debug: Parsed xlat tree: Thu Feb 27 20:06:01 2014 : Debug: literal: 'INSERT INTO radpostauth (username, pass, reply, authdate) VALUES ( '' Thu Feb 27 20:06:01 2014 : Debug: attribute: SQL-User-Name Thu Feb 27 20:06:01 2014 : Debug: { Thu Feb 27 20:06:01 2014 : Debug: ref 2 Thu Feb 27 20:06:01 2014 : Debug: list 1 Thu Feb 27 20:06:01 2014 : Debug: tag -128 Thu Feb 27 20:06:01 2014 : Debug: } Thu Feb 27 20:06:01 2014 : Debug: literal: '', '' Thu Feb 27 20:06:01 2014 : Debug: if { Thu Feb 27 20:06:01 2014 : Debug: attribute: User-Password Thu Feb 27 20:06:01 2014 : Debug: { Thu Feb 27 20:06:01 2014 : Debug: ref 2 Thu Feb 27 20:06:01 2014 : Debug: list 1 Thu Feb 27 20:06:01 2014 : Debug: tag -128 Thu Feb 27 20:06:01 2014 : Debug: } Thu Feb 27 20:06:01 2014 : Debug: } Thu Feb 27 20:06:01 2014 : Debug: else { Thu Feb 27 20:06:01 2014 : Debug: attribute: CHAP-Password Thu Feb 27 20:06:01 2014 : Debug: { Thu Feb 27 20:06:01 2014 : Debug: ref 2 Thu Feb 27 20:06:01 2014 : Debug: list 1 Thu Feb 27 20:06:01 2014 : Debug: tag -128 Thu Feb 27 20:06:01 2014 : Debug: } Thu Feb 27 20:06:01 2014 : Debug: } Thu Feb 27 20:06:01 2014 : Debug: literal: '', '' Thu Feb 27 20:06:01 2014 : Debug: attribute: Packet-Type Thu Feb 27 20:06:01 2014 : Debug: { Thu Feb 27 20:06:01 2014 : Debug: ref 2 Thu Feb 27 20:06:01 2014 : Debug: list 2 Thu Feb 27 20:06:01 2014 : Debug: tag -128 Thu Feb 27 20:06:01 2014 : Debug: } Thu Feb 27 20:06:01 2014 : Debug: literal: '', '' Thu Feb 27 20:06:01 2014 : Debug: literal (with %): 'S' Thu Feb 27 20:06:01 2014 : Debug: literal: '')' Thu Feb 27 20:06:01 2014 : Debug: (0) sql : expand: "INSERT INTO radpostauth (username, pass, reply, authdate) VALUES ( '%{SQL-User-Name}', '%{%{User-Password}:-%{Chap-Password}}', '%{reply:Packet-Type}', '%S')" -> 'INSERT INTO radpostauth (username, pass, reply, authdate) VALUES ( 'fredf', 'wilma', 'Access-Reject', '2014-02-27 20:06:01')' Thu Feb 27 20:06:01 2014 : Debug: rlm_sql (sql): Executing query: 'INSERT INTO radpostauth (username, pass, reply, authdate) VALUES ( 'fredf', 'wilma', 'Access-Reject', '2014-02-27 20:06:01')' Thu Feb 27 20:06:01 2014 : Debug: rlm_sql (sql): Released connection (4) Thu Feb 27 20:06:01 2014 : Debug: (0) modsingle[post-auth]: returned from sql (rlm_sql) for request 0 Thu Feb 27 20:06:01 2014 : Debug: (0) [-sql] = ok Thu Feb 27 20:06:01 2014 : Debug: (0) modsingle[post-auth]: calling attr_filter.access_reject (rlm_attr_filter) for request 0 Thu Feb 27 20:06:01 2014 : Debug: %{User-Name} Thu Feb 27 20:06:01 2014 : Debug: Parsed xlat tree: Thu Feb 27 20:06:01 2014 : Debug: attribute: User-Name Thu Feb 27 20:06:01 2014 : Debug: { Thu Feb 27 20:06:01 2014 : Debug: ref 2 Thu Feb 27 20:06:01 2014 : Debug: list 1 Thu Feb 27 20:06:01 2014 : Debug: tag -128 Thu Feb 27 20:06:01 2014 : Debug: } Thu Feb 27 20:06:01 2014 : Debug: (0) attr_filter.access_reject : expand: "%{User-Name}" -> 'fredf' Thu Feb 27 20:06:01 2014 : Debug: (0) attr_filter.access_reject : Matched entry DEFAULT at line 11 Thu Feb 27 20:06:01 2014 : Debug: (0) modsingle[post-auth]: returned from attr_filter.access_reject (rlm_attr_filter) for request 0 Thu Feb 27 20:06:01 2014 : Debug: (0) [attr_filter.access_reject] = updated Thu Feb 27 20:06:01 2014 : Debug: (0) modsingle[post-auth]: calling eap (rlm_eap) for request 0 Thu Feb 27 20:06:01 2014 : Debug: (0) eap : Request didn't contain an EAP-Message, not inserting EAP-Failure Thu Feb 27 20:06:01 2014 : Debug: (0) modsingle[post-auth]: returned from eap (rlm_eap) for request 0 Thu Feb 27 20:06:01 2014 : Debug: (0) [eap] = noop Thu Feb 27 20:06:01 2014 : Debug: (0) remove_reply_message_if_eap remove_reply_message_if_eap { Thu Feb 27 20:06:01 2014 : Debug: (0) ? if (reply:EAP-Message && reply:Reply-Message) Thu Feb 27 20:06:01 2014 : Debug: (0) ? if (reply:EAP-Message && reply:Reply-Message) -> FALSE Thu Feb 27 20:06:01 2014 : Debug: (0) else else { Thu Feb 27 20:06:01 2014 : Debug: (0) modsingle[post-auth]: calling noop (rlm_always) for request 0 Thu Feb 27 20:06:01 2014 : Debug: (0) modsingle[post-auth]: returned from noop (rlm_always) for request 0 Thu Feb 27 20:06:01 2014 : Debug: (0) [noop] = noop Thu Feb 27 20:06:01 2014 : Debug: (0) } # else else = noop Thu Feb 27 20:06:01 2014 : Debug: (0) } # remove_reply_message_if_eap remove_reply_message_if_eap = noop Thu Feb 27 20:06:01 2014 : Debug: (0) } # Post-Auth-Type REJECT = updated Thu Feb 27 20:06:01 2014 : Debug: (0) Finished request 0. Thu Feb 27 20:06:01 2014 : Debug: Waking up in 0.3 seconds. Thu Feb 27 20:06:01 2014 : Debug: Waking up in 0.5 seconds. Thu Feb 27 20:06:02 2014 : Debug: (0) Sending delayed reject Sending Access-Reject of id 9 from 127.0.0.1 port 1812 to 127.0.0.1 port 52606 Thu Feb 27 20:06:02 2014 : Debug: Waking up in 4.9 seconds. Thu Feb 27 20:06:07 2014 : Debug: (0) Cleaning up request packet ID 9 with timestamp +53 Thu Feb 27 20:06:07 2014 : Info: Ready to process requests. sqllog.sql SELECT id, username, attribute, value, op FROM radcheck WHERE username = 'fredf' ORDER BY id; Please help me ... Thank you

6 19

freeradius failed to authenticate the users against windos active directory
by Edward Xie 28 Feb '14

28 Feb '14

Hi there, I had the issue when I tried to configure my freeradius server integrate windows 2008 R2 Active directory authentication. It worked before when it connected to a Windows AD 2003. However after I switched the AD server to a new AD server which is in another Windows domain (windows 2008 R2) , it's broken. Looks like the radius server doesn't forward the request to the AD server even it has no Mysql database or local user database. The request was rejected then. All the AD integration configuration files are in place and I don't find any mistakes. The only change I made is upgrading the samba version from 2.x to 3.5.4 because the old version can't build up pipe to windows 2008 R2 domain controller. 1. The radius server has already joined the windows 2008 R2 domain. I can look up the AD information without problem. a. Samba version: [root@GTK_RADIUS /]#smbd -V Version 3.5.4-0.83.el5 b. authenticate a user from the domain [root@GTK_RADIUS /]#wbinfo -a exie%123456 plaintext password authentication failed Could not authenticate user exie%123456 with plaintext password challenge/response password authentication succeeded c. authenticate with NTLM [root@GTK_RADIUS /]#ntlm_auth .-request-nt-key --domain=NE --username=exie password: NT_STATUS_OK: Success (0x0) 2. The Log of Radius authentication is attached. Could you kindly to help me figure out why the freeradius server can't work with windows AD? Thanks so much in advance. Edward Xie The contents of this email are confidential and intended for the recipient only. If you have received this email in error, please notify us, and destroy all copies.

4 6

VMPS AND LDAP
by Bogdan Siara 28 Feb '14

28 Feb '14

Hello, I would like vmps server ask openldap server which VLAN assign to client. In my openldap client have this attributes: dhcpHWAddress: 00-00-00-00-00-00 radiusTunnelPrivateGroupId: 20 How to configure vmps and ldap module to work with ldap server? Regards BS

2 1

Can't authenticate users on LDAP Server by FreeRadius
by Luís Cláudio Veiga 27 Feb '14

27 Feb '14

Hello All, I'm running FreeRADIUS Version 1.1.3, for host i686-redhat-linux-gnu, built on Jan 26 2010 at 18:56:10 Copyright (C) 2000-2006 The FreeRADIUS server project on CENTOS, and trying for now, authenticate the same users in my old users file, but now, I set freeradius to sent auth packets to a LDAP server and I don't know what is wrong. Who can help me with this issue? *#* *# MY DEBUG -X -A* *#* [root@radius_server raddb]# radiusd -X -A Starting - reading configuration files ... reread_config: reading radiusd.conf Config: including file: /etc/raddb/proxy.conf Config: including file: /etc/raddb/clients.conf Config: including file: /etc/raddb/snmp.conf Config: including file: /etc/raddb/eap.conf main: prefix = "/usr" main: localstatedir = "/var" main: logdir = "/var/log/radius" main: libdir = "/usr/lib" main: radacctdir = "/var/log/radius/radacct" main: hostname_lookups = no main: snmp = no main: max_request_time = 60 main: cleanup_delay = 6 main: max_requests = 4096 main: delete_blocked_requests = 0 main: port = 1812 main: allow_core_dumps = no main: log_stripped_names = no main: log_file = "/var/log/radius/radius.log" main: log_auth = yes main: log_auth_badpass = yes main: log_auth_goodpass = yes main: pidfile = "/var/run/radiusd/radiusd.pid" main: user = "radiusd" main: group = "radiusd" main: usercollide = no main: lower_user = "no" main: lower_pass = "no" main: nospace_user = "no" main: nospace_pass = "no" main: checkrad = "/usr/sbin/checkrad" main: proxy_requests = no proxy: retry_delay = 5 proxy: retry_count = 3 proxy: synchronous = no proxy: default_fallback = yes proxy: dead_time = 120 proxy: post_proxy_authorize = yes proxy: wake_all_if_all_dead = no security: max_attributes = 200 security: reject_delay = 3 security: status_server = no main: debug_level = 0 read_config_files: reading dictionary read_config_files: reading naslist Using deprecated naslist file. Support for this will go away soon. read_config_files: reading clients read_config_files: reading realms radiusd: entering modules setup Module: Library search path is /usr/lib Module: Loaded exec exec: wait = yes exec: program = "(null)" exec: input_pairs = "request" exec: output_pairs = "(null)" exec: packet_type = "(null)" rlm_exec: Wait=yes but no output defined. Did you mean output=none? Module: Instantiated exec (exec) Module: Loaded expr Module: Instantiated expr (expr) Module: Loaded LDAP ldap: server = "srv01t.MYCOMPANY.net.br <http://srv01t.mycompany.net.br/>" ldap: port = 389 ldap: net_timeout = 1 ldap: timeout = 4 ldap: timelimit = 3 ldap: identity = "CN=AUTHENTIC,CN=Users,DC=MYCOMPANY,DC=NET,DC=BR" ldap: tls_mode = no ldap: start_tls = no ldap: tls_cacertfile = "(null)" ldap: tls_cacertdir = "(null)" ldap: tls_certfile = "(null)" ldap: tls_keyfile = "(null)" ldap: tls_randfile = "(null)" ldap: tls_require_cert = "allow" ldap: password = "segredo" ldap: basedn = "CN=USERS,DC=MYCOMPANY,DC=NET,DC=BR" ldap: filter = "(cn=%{Stripped-User-Name:-%{User-Name}})" ldap: base_filter = "(objectclass=radiusprofile)" ldap: default_profile = "(null)" ldap: profile_attribute = "(null)" ldap: password_header = "(null)" ldap: password_attribute = "(null)" ldap: access_attr = "(null)" ldap: groupname_attribute = "CN=USERS,DC=MYCOMPANY,DC=NET,DC=BR" ldap: groupmembership_filter = "(|(&(objectClass=GroupOfNames)(member=%{Ldap-UserDn}))(&(objectClass=GroupOfUniqueNames)(uniquemember=%{Ldap-UserDn})))" ldap: groupmembership_attribute = "(null)" ldap: dictionary_mapping = "/etc/raddb/ldap.attrmap" ldap: ldap_debug = 0 ldap: ldap_connections_number = 5 ldap: compare_check_items = no ldap: access_attr_used_for_allow = yes ldap: do_xlat = yes ldap: set_auth_type = yes rlm_ldap: Registering ldap_groupcmp for Ldap-Group rlm_ldap: Registering ldap_xlat with xlat_name ldap rlm_ldap: reading ldap<->radius mappings from file /etc/raddb/ldap.attrmap rlm_ldap: LDAP radiusCheckItem mapped to RADIUS $GENERIC$ rlm_ldap: LDAP radiusReplyItem mapped to RADIUS $GENERIC$ rlm_ldap: LDAP radiusAuthType mapped to RADIUS Auth-Type rlm_ldap: LDAP radiusSimultaneousUse mapped to RADIUS Simultaneous-Use rlm_ldap: LDAP radiusCalledStationId mapped to RADIUS Called-Station-Id rlm_ldap: LDAP radiusCallingStationId mapped to RADIUS Calling-Station-Id rlm_ldap: LDAP sambaLMPassword mapped to RADIUS LM-Password rlm_ldap: LDAP sambaNTPassword mapped to RADIUS NT-Password rlm_ldap: LDAP sambaAcctFlags mapped to RADIUS SMB-Account-CTRL-TEXT rlm_ldap: LDAP radiusExpiration mapped to RADIUS Expiration rlm_ldap: LDAP radiusNASIpAddress mapped to RADIUS NAS-IP-Address rlm_ldap: LDAP radiusServiceType mapped to RADIUS Service-Type rlm_ldap: LDAP radiusFramedProtocol mapped to RADIUS Framed-Protocol rlm_ldap: LDAP radiusFramedIPAddress mapped to RADIUS Framed-IP-Address rlm_ldap: LDAP radiusFramedIPNetmask mapped to RADIUS Framed-IP-Netmask rlm_ldap: LDAP radiusFramedRoute mapped to RADIUS Framed-Route rlm_ldap: LDAP radiusFramedRouting mapped to RADIUS Framed-Routing rlm_ldap: LDAP radiusFilterId mapped to RADIUS Filter-Id rlm_ldap: LDAP radiusFramedMTU mapped to RADIUS Framed-MTU rlm_ldap: LDAP radiusFramedCompression mapped to RADIUS Framed-Compression rlm_ldap: LDAP radiusLoginIPHost mapped to RADIUS Login-IP-Host rlm_ldap: LDAP radiusLoginService mapped to RADIUS Login-Service rlm_ldap: LDAP radiusLoginTCPPort mapped to RADIUS Login-TCP-Port rlm_ldap: LDAP radiusCallbackNumber mapped to RADIUS Callback-Number rlm_ldap: LDAP radiusCallbackId mapped to RADIUS Callback-Id rlm_ldap: LDAP radiusFramedIPXNetwork mapped to RADIUS Framed-IPX-Network rlm_ldap: LDAP radiusClass mapped to RADIUS Class rlm_ldap: LDAP radiusSessionTimeout mapped to RADIUS Session-Timeout rlm_ldap: LDAP radiusIdleTimeout mapped to RADIUS Idle-Timeout rlm_ldap: LDAP radiusTerminationAction mapped to RADIUS Termination-Action rlm_ldap: LDAP radiusLoginLATService mapped to RADIUS Login-LAT-Service rlm_ldap: LDAP radiusLoginLATNode mapped to RADIUS Login-LAT-Node rlm_ldap: LDAP radiusLoginLATGroup mapped to RADIUS Login-LAT-Group rlm_ldap: LDAP radiusFramedAppleTalkLink mapped to RADIUS Framed-AppleTalk-Link rlm_ldap: LDAP radiusFramedAppleTalkNetwork mapped to RADIUS Framed-AppleTalk-Network rlm_ldap: LDAP radiusFramedAppleTalkZone mapped to RADIUS Framed-AppleTalk-Zone rlm_ldap: LDAP radiusPortLimit mapped to RADIUS Port-Limit rlm_ldap: LDAP radiusLoginLATPort mapped to RADIUS Login-LAT-Port rlm_ldap: LDAP radiusReplyMessage mapped to RADIUS Reply-Message *rlm_ldap: LDAP AcmeUserPrivilege mapped to RADIUS Service-Type <-- Need for authorization and access level* *rlm_ldap: LDAP AcmeUserClass mapped to RADIUS Service-Type **<-- Need for authorization and access level* *rlm_ldap: LDAP AcmeUserPrivilege mapped to RADIUS Login-Service **<-- Need for authorization and access level* conns: 0x9ef47c0 Module: Instantiated ldap (ldap) Module: Loaded preprocess preprocess: huntgroups = "/etc/raddb/huntgroups" preprocess: hints = "/etc/raddb/hints" preprocess: with_ascend_hack = no preprocess: ascend_channels_per_line = 23 preprocess: with_ntdomain_hack = no preprocess: with_specialix_jetstream_hack = no preprocess: with_cisco_vsa_hack = no preprocess: with_alvarion_vsa_hack = no Module: Instantiated preprocess (preprocess) Module: Loaded detail detail: detailfile = "/var/log/radius/radacct/%{Client-IP-Address}/auth-detail-%Y%m%d" detail: detailperm = 384 detail: dirperm = 493 detail: locking = no Module: Instantiated detail (auth_log) Module: Loaded Acct-Unique-Session-Id acct_unique: key = "User-Name, Acct-Session-Id, NAS-IP-Address, Client-IP-Address, NAS-Port" Module: Instantiated acct_unique (acct_unique) Module: Loaded realm realm: format = "suffix" realm: delimiter = "@" realm: ignore_default = no realm: ignore_null = no Module: Instantiated realm (suffix) Module: Loaded files files: usersfile = "/etc/raddb/users" files: acctusersfile = "/etc/raddb/acct_users" files: preproxy_usersfile = "/etc/raddb/preproxy_users" files: compat = "no" Module: Instantiated files (files) detail: detailfile = "/var/log/radius/radacct/%{Client-IP-Address}/detail-%Y%m%d" detail: detailperm = 384 detail: dirperm = 493 detail: locking = no Module: Instantiated detail (detail) Module: Loaded System unix: cache = no unix: passwd = "/etc/passwd" unix: shadow = "/etc/shadow" unix: group = "/etc/group" unix: radwtmp = "/var/log/radius/radwtmp" unix: usegroup = no unix: cache_reload = 600 Module: Instantiated unix (unix) Module: Loaded radutmp radutmp: filename = "/var/log/radius/radutmp" radutmp: username = "%{User-Name}" radutmp: case_sensitive = yes radutmp: check_with_nas = yes radutmp: perm = 384 radutmp: callerid = yes Module: Instantiated radutmp (radutmp) Listening on authentication *:1812 Listening on accounting *:1813 Ready to process requests. rad_recv: Access-Request packet from host 10.253.7.156:1812, id=72, length=69 User-Name = "lveiga" User-Password = "mypassword" NAS-Identifier = "102537156" NAS-IP-Address = 10.253.7.156 NAS-Port = 118751232 Processing the authorize section of radiusd.conf modcall: entering group authorize for request 0 modcall[authorize]: module "preprocess" returns ok for request 0 radius_xlat: '/var/log/radius/radacct/10.253.7.156/auth-detail-20140210' rlm_detail: /var/log/radius/radacct/%{Client-IP-Address}/auth-detail-%Y%m%d expands to /var/log/radius/radacct/10.253.7.156/auth-detail-20140210 modcall[authorize]: module "auth_log" returns ok for request 0 rlm_ldap: - authorize rlm_ldap: performing user authorization for lveiga radius_xlat: '(cn=lveiga)' radius_xlat: 'CN=USERS,DC=MYCOMPANY,DC=NET,DC=BR' rlm_ldap: ldap_get_conn: Checking Id: 0 rlm_ldap: ldap_get_conn: Got Id: 0 rlm_ldap: attempting LDAP reconnection rlm_ldap: (re)connect to srv01t.MYCOMPANY.net.br:389<http://srv01t.mycompany.net.br:389/>, authentication 0 rlm_ldap: bind as CN=AUTHENTIC,CN=Users,DC=MYCOMPANY,DC=NET,DC=BR/passwordomitted to srv01t.MYCOMPANY.net.br:389 <http://srv01t.mycompany.net.br:389/> rlm_ldap: waiting for bind result ... rlm_ldap: Bind was successful rlm_ldap: performing search in CN=USERS,DC=MYCOMPANY,DC=NET,DC=BR, with filter (cn=lveiga) *rlm_ldap: object not found or got ambiguous search result* *rlm_ldap: search failed* rlm_ldap: ldap_release_conn: Release Id: 0 modcall[authorize]: module "ldap" returns notfound for request 0 modcall: leaving group authorize (returns ok) for request 0 *auth: No authenticate method (Auth-Type) configuration found for the request: Rejecting the user* *auth: Failed to validate the user.* *Login incorrect (rlm_ldap: User not found): [lveiga/mypassword] (from client myhost80.spoig port 118751232)* Delaying request 0 for 3 seconds Finished request 0 Going to the next request --- Walking the entire request list --- Waking up in 3 seconds... --- Walking the entire request list --- Waking up in 3 seconds... --- Walking the entire request list --- Sending Access-Reject of id 72 to 10.253.7.156 port 1812 Waking up in 1 seconds... --- Walking the entire request list --- Cleaning up request 0 ID 72 with timestamp 52f8d4df Nothing to do. Sleeping until we see a request. *#* *# MY RLM_LDAP FILE* *#* # Lightweight Directory Access Protocol (LDAP) # # This module definition allows you to use LDAP for # authorization and authentication. # # See doc/rlm_ldap for description of configuration options # and sample authorize{} and authenticate{} blocks # # However, LDAP can be used for authentication ONLY when the # Access-Request packet contains a clear-text User-Password # attribute. LDAP authentication will NOT work for any other # authentication method. # # This means that LDAP servers don't understand EAP. If you # force "Auth-Type = LDAP", and then send the server a # request containing EAP authentication, then authentication # WILL NOT WORK. # # The solution is to use the default configuration, which does # work. # # Setting "Auth-Type = LDAP" is ALMOST ALWAYS WRONG. We # really can't emphasize this enough. # ldap { server = "srv01t.MYCOMPANY.net.br <http://srv01t.mycompany.net.br/>" identity = "CN=AUTHENTIC,CN=USERS,DC=MYCOMPANY,DC=NET,DC=BR" password = mypassword basedn = "CN=Users,DC=MYCOMPANY,DC=NET,DC=BR" filter = "(cn=%{Stripped-User-Name:-%{User-Name}})" ldap_connections_number = 5 timeout = 5 timelimit = 3 net_timeout = 1 dictionary_mapping = /etc/raddb/ldap.attrmap access_attr_used_for_allow = no set_auth_type = no compare_check_items = yes do_xlat = yes } # # This subsection configures the tls related items # that control how FreeRADIUS connects to an LDAP # server. It contains all of the "tls_*" configuration # entries used in older versions of FreeRADIUS. Those # configuration entries can still be used, but we recommend # using these. # tls { # Set this to 'yes' to use TLS encrypted connections # to the LDAP database by using the StartTLS extended # operation. # # The StartTLS operation is supposed to be # used with normal ldap connections instead of # using ldaps (port 689) connections start_tls = no # cacertfile = /path/to/cacert.pem # cacertdir = /path/to/ca/dir/ # certfile = /path/to/radius.crt # keyfile = /path/to/radius.key # randfile = /path/to/rnd # require_cert = "demand" } # default_profile = "cn=radprofile,ou=dialup,o=My Org,c=UA" # profile_attribute = "radiusProfileDn" # access_attr = "dialupAccess" # Mapping of RADIUS dictionary attributes to LDAP # directory attributes. dictionary_mapping = ${raddbdir}/ldap.attrmap # Set password_attribute = nspmPassword to get the # user's password from a Novell eDirectory # backend. This will work ONLY IF FreeRADIUS has been # built with the --with-edir configure option. # # password_attribute = userPassword # As of 1.1.0, the LDAP module will auto-discover # the password headers (which are non-standard). # It will use the following table to map passwords # to RADIUS attributes. The PAP module (see above) # can then automatically determine the hashing # method to use to authenticate the user. # # Header Attribute # ------ --------- # {clear} User-Password # {cleartext} User-Password # {md5} MD5-Password # {smd5} SMD5-Password # {crypt} Crypt-Password # {sha} SHA-Password # {ssha} SSHA-Password # {nt} NT-Password # {ns-mta-md5} NS-MTA-MD5-Password # # # The headers are compared in a case-insensitive manner. # The format of the password in LDAP (base 64-encoded, hex, # clear-text, whatever) is not that important. The PAP # module will figure it out. # # The default for "auto_header" is "no", to enable backwards # compatibility with the "password_header" directive, # which is now deprecated. If this is set to "yes", # then the above table will be used, and the # "password_header" directive will be ignored. #auto_header = yes # Un-comment the following to disable Novell # eDirectory account policy check and intruder # detection. This will work *only if* FreeRADIUS is # configured to build with --with-edir option. # #edir_account_policy_check = no # # Group membership checking. Disabled by default. # # groupname_attribute = cn # groupmembership_filter = "(|(&(objectClass=GroupOfNames)(member=%{Ldap-UserDn}))(&(objectClass=GroupOfUniqueNames)(uniquemember=%{Ldap-UserDn})))" # groupmembership_attribute = radiusGroupName compare_check_items = yes do_xlat = yes access_attr_used_for_allow = yes # # By default, if the packet contains a User-Password, # and no other module is configured to handle the # authentication, the LDAP module sets itself to do # LDAP bind for authentication. # # You can disable this behavior by setting the following # configuration entry to "no". # # allowed values: {no, yes} set_auth_type = yes } *#* *# MY LDAP.ATTRMAP* *#* [root@syslog01 raddb]# cat ldap.attrmap # # Mapping of RADIUS dictionary attributes to LDAP directory attributes # to be used by LDAP authentication and authorization module (rlm_ldap) # # Format: # ItemType RADIUS-Attribute-Name ldapAttributeName # # Where: # ItemType = checkItem or replyItem # RADIUS-Attribute-Name = attribute name in RADIUS dictionary # ldapAttributeName = attribute name in LDAP schema # # If $GENERIC$ is specified as RADIUS-Attribute-Name, the line specifies # a LDAP attribute which can be used to store any RADIUS # attribute/value-pair in LDAP directory. # # You should edit this file to suit it to your needs. # checkItem $GENERIC$ radiusCheckItem replyItem $GENERIC$ radiusReplyItem checkItem Auth-Type radiusAuthType checkItem Simultaneous-Use radiusSimultaneousUse checkItem Called-Station-Id radiusCalledStationId checkItem Calling-Station-Id radiusCallingStationId checkItem LM-Password sambaLMPassword checkItem NT-Password sambaNTPassword checkItem SMB-Account-CTRL-TEXT sambaAcctFlags checkItem Expiration radiusExpiration checkItem NAS-IP-Address radiusNASIpAddress replyItem Service-Type radiusServiceType replyItem Framed-Protocol radiusFramedProtocol replyItem Framed-IP-Address radiusFramedIPAddress replyItem Framed-IP-Netmask radiusFramedIPNetmask replyItem Framed-Route radiusFramedRoute replyItem Framed-Routing radiusFramedRouting replyItem Filter-Id radiusFilterId replyItem Framed-MTU radiusFramedMTU replyItem Framed-Compression radiusFramedCompression replyItem Login-IP-Host radiusLoginIPHost replyItem Login-Service radiusLoginService replyItem Login-TCP-Port radiusLoginTCPPort replyItem Callback-Number radiusCallbackNumber replyItem Callback-Id radiusCallbackId replyItem Framed-IPX-Network radiusFramedIPXNetwork replyItem Class radiusClass replyItem Session-Timeout radiusSessionTimeout replyItem Idle-Timeout radiusIdleTimeout replyItem Termination-Action radiusTerminationAction replyItem Login-LAT-Service radiusLoginLATService replyItem Login-LAT-Node radiusLoginLATNode replyItem Login-LAT-Group radiusLoginLATGroup replyItem Framed-AppleTalk-Link radiusFramedAppleTalkLink replyItem Framed-AppleTalk-Network radiusFramedAppleTalkNetwork replyItem Framed-AppleTalk-Zone radiusFramedAppleTalkZone replyItem Port-Limit radiusPortLimit replyItem Login-LAT-Port radiusLoginLATPort replyItem Reply-Message radiusReplyMessage *replyItem Service-Type AcmeUserPrivilege <- define user authorization* *replyItem Login-Service AcmeUserPrivilege <- define user authorization* *replyItem Service-Type AcmeUserClass <- define user authorization* *#* *# MY RADIUSD.CONF concerns to LDAP* *#* # Lightweight Directory Access Protocol (LDAP) # # This module definition allows you to use LDAP for # authorization and authentication. # # See doc/rlm_ldap for description of configuration options # and sample authorize{} and authenticate{} blocks # # However, LDAP can be used for authentication ONLY when the # Access-Request packet contains a clear-text User-Password # attribute. LDAP authentication will NOT work for any other # authentication method. # # This means that LDAP servers don't understand EAP. If you # force "Auth-Type = LDAP", and then send the server a # request containing EAP authentication, then authentication # WILL NOT WORK. # # The solution is to use the default configuration, which does # work. # # Setting "Auth-Type = LDAP" is ALMOST ALWAYS WRONG. We # really can't emphasize this enough. # ldap { server = "srv01t.embratel.net.br" port = 389 password = passwordomitted identity = "CN=AUTHENTIC,CN=Users,DC=MYCONPANY,DC=NET,DC=BR" net_timeout = 1 timeout = 4 timelimit = 3 tls_require_cert = "allow" basedn = "CN=USERS,DC=MYCOMPANY,DC=NET,DC=BR" filter = "(cn=%{Stripped-User-Name:-%{User-Name}})" #groupname_attribute = "CN=USERS,DC=MYCOMPANY,DC=NET,DC=BR" dictionary_mapping = "/etc/raddb/ldap.attrmap" ldap_debug = 0 ldap_connections_number = 5 compare_check_items = no do_xlat = yes set_auth_type = yes } # passwd module allows to do authorization via any passwd-like # file and to extract any attributes from these modules # # parameters are: # filename - path to filename # format - format for filename record. This parameters # correlates record in the passwd file and RADIUS # attributes. # # Field marked as '*' is key field. That is, the parameter # with this name from the request is used to search for # the record from passwd file # Attribute marked as '=' is added to reply_itmes instead # of default configure_itmes # Attribute marked as '~' is added to request_items # # Field marked as ',' may contain a comma separated list # of attributes. # authtype - if record found this Auth-Type is used to authenticate # user # hashsize - hashtable size. If 0 or not specified records are not # stored in memory and file is red on every request. # allowmultiplekeys - if few records for every key are allowed # ignorenislike - ignore NIS-related records # delimiter - symbol to use as a field separator in passwd file, # for format ':' symbol is always used. '\0', '\n' are # not allowed # # An example configuration for using /etc/smbpasswd. # #passwd etc_smbpasswd { # filename = /etc/smbpasswd # format = "*User-Name::LM-Password:NT-Password:SMB-Account-CTRL-TEXT::" # authtype = MS-CHAP # hashsize = 100 # ignorenislike = no # allowmultiplekeys = no #} # Similar configuration, for the /etc/group file. Adds a Group-Name # attribute for every group that the user is member of. # #passwd etc_group { # filename = /etc/group # format = "=Group-Name:::*,User-Name" # hashsize = 50 # ignorenislike = yes # allowmultiplekeys = yes # delimiter = ":" #} # Realm module, for proxying. # # You can have multiple instances of the realm module to # support multiple realm syntaxs at the same time. The # search order is defined by the order in the authorize and # preacct sections. # # Four config options: # format - must be 'prefix' or 'suffix' # delimiter - must be a single character # ignore_default - set to 'yes' or 'no' # ignore_null - set to 'yes' or 'no' # # ignore_default and ignore_null can be set to 'yes' to prevent # the module from matching against DEFAULT or NULL realms. This # may be useful if you have have multiple instances of the # realm module. # # They both default to 'no'. # # 'realm/username' # # Using this entry, IPASS users have their realm set to "IPASS". realm IPASS { format = prefix delimiter = "/" ignore_default = no ignore_null = no } # 'username@realm' # realm suffix { format = suffix delimiter = "@" ignore_default = no ignore_null = no } # 'username%realm' # realm realmpercent { format = suffix delimiter = "%" ignore_default = no ignore_null = no } # # 'domain\user' # realm ntdomain { format = prefix delimiter = "\\" ignore_default = no ignore_null = no } # A simple value checking module # # It can be used to check if an attribute value in the request # matches a (possibly multi valued) attribute in the check # items This can be used for example for caller-id # authentication. For the module to run, both the request # attribute and the check items attribute must exist # # i.e. # A user has an ldap entry with 2 radiusCallingStationId # attributes with values "12345678" and "12345679". If we # enable rlm_checkval, then any request which contains a # Calling-Station-Id with one of those two values will be # accepted. Requests with other values for # Calling-Station-Id will be rejected. # # Regular expressions in the check attribute value are allowed # as long as the operator is '=~' # checkval { # The attribute to look for in the request item-name = Calling-Station-Id # The attribute to look for in check items. Can be multi valued check-name = Calling-Station-Id # The data type. Can be # string,integer,ipaddr,date,abinary,octets data-type = string # If set to yes and we dont find the item-name attribute in the # request then we send back a reject # DEFAULT is no #notfound-reject = no } # rewrite arbitrary packets. Useful in accounting and authorization. # # # The module can also use the Rewrite-Rule attribute. If it # is set and matches the name of the module instance, then # that module instance will be the only one which runs. # # Also if new_attribute is set to yes then a new attribute # will be created containing the value replacewith and it # will be added to searchin (packet, reply, proxy, proxy_reply or config). # searchfor,ignore_case and max_matches will be ignored in that case. # # Backreferences are supported: %{0} will contain the string the whole match # and %{1} to %{8} will contain the contents of the 1st to the 8th parentheses # # If max_matches is greater than one the backreferences will correspond to the # first match # #attr_rewrite sanecallerid { # attribute = Called-Station-Id # may be "packet", "reply", "proxy", "proxy_reply" or "config" # searchin = packet # searchfor = "[+ ]" # replacewith = "" # ignore_case = no # new_attribute = no # max_matches = 10 # ## If set to yes then the replace string will be appended to the original string # append = no #} # Preprocess the incoming RADIUS request, before handing it off # to other modules. # # This module processes the 'huntgroups' and 'hints' files. # In addition, it re-writes some weird attributes created # by some NASes, and converts the attributes into a form which # is a little more standard. # preprocess { huntgroups = ${confdir}/huntgroups hints = ${confdir}/hints # This hack changes Ascend's wierd port numberings # to standard 0-??? port numbers so that the "+" works # for IP address assignments. with_ascend_hack = no ascend_channels_per_line = 23 # Windows NT machines often authenticate themselves as # NT_DOMAIN\username # # If this is set to 'yes', then the NT_DOMAIN portion # of the user-name is silently discarded. # # This configuration entry SHOULD NOT be used. # See the "realms" module for a better way to handle # NT domains. with_ntdomain_hack = no # Specialix Jetstream 8500 24 port access server. # # If the user name is 10 characters or longer, a "/" # and the excess characters after the 10th are # appended to the user name. # # If you're not running that NAS, you don't need # this hack. with_specialix_jetstream_hack = no # Cisco (and Quintum in Cisco mode) sends it's VSA attributes # with the attribute name *again* in the string, like: # # H323-Attribute = "h323-attribute=value". # # If this configuration item is set to 'yes', then # the redundant data in the the attribute text is stripped # out. The result is: # # H323-Attribute = "value" # # If you're not running a Cisco or Quintum NAS, you don't # need this hack. with_cisco_vsa_hack = no } # Livingston-style 'users' file # files { usersfile = ${confdir}/users acctusersfile = ${confdir}/acct_users #preproxy_usersfile = ${confdir}/preproxy_users # If you want to use the old Cistron 'users' file # with FreeRADIUS, you should change the next line # to 'compat = cistron'. You can the copy your 'users' # file from Cistron. compat = no } # Write a detailed log of all accounting records received. # detail { # Note that we do NOT use NAS-IP-Address here, as # that attribute MAY BE from the originating NAS, and # NOT from the proxy which actually sent us the # request. The Client-IP-Address attribute is ALWAYS # the address of the client which sent us the # request. # # The following line creates a new detail file for # every radius client (by IP address or hostname). # In addition, a new detail file is created every # day, so that the detail file doesn't have to go # through a 'log rotation' # # If your detail files are large, you may also want # to add a ':%H' (see doc/variables.txt) to the end # of it, to create a new detail file every hour, e.g.: # # ..../detail-%Y%m%d:%H # # This will create a new detail file for every hour. # detailfile = ${radacctdir}/%{Client-IP-Address}/detail-%Y%m%d # # The Unix-style permissions on the 'detail' file. # # The detail file often contains secret or private # information about users. So by keeping the file # permissions restrictive, we can prevent unwanted # people from seeing that information. detailperm = 0600 # # Certain attributes such as User-Password may be # "sensitive", so they should not be printed in the # detail file. This section lists the attributes # that should be suppressed. # # The attributes should be listed one to a line. # #suppress { # User-Password #} } # # Many people want to log authentication requests. # Rather than modifying the server core to print out more # messages, we can use a different instance of the 'detail' # module, to log the authentication requests to a file. # # You will also need to un-comment the 'auth_log' line # in the 'authorize' section, below. # detail auth_log { detailfile = ${radacctdir}/%{Client-IP-Address}/auth-detail-%Y%m%d # # This MUST be 0600, otherwise anyone can read # the users passwords! detailperm = 0600 } # # This module logs authentication reply packets sent # to a NAS. Both Access-Accept and Access-Reject packets # are logged. # # You will also need to un-comment the 'reply_log' line # in the 'post-auth' section, below. # # Changed here ---- detail reply_log { detailfile = ${radacctdir}/%{Client-IP-Address}/reply-detail-%Y%m%d # # This MUST be 0600, otherwise anyone can read # the users passwords! detailperm = 0600 } # # Finished here # # # This module logs packets proxied to a home server. # # You will also need to un-comment the 'pre_proxy_log' line # in the 'pre-proxy' section, below. # # detail pre_proxy_log { # detailfile = ${radacctdir}/%{Client-IP-Address}/pre-proxy-detail-%Y%m%d # # This MUST be 0600, otherwise anyone can read # the users passwords! # detailperm = 0600 # } # # This module logs response packets from a home server. # # You will also need to un-comment the 'post_proxy_log' line # in the 'post-proxy' section, below. # # detail post_proxy_log { # detailfile = ${radacctdir}/%{Client-IP-Address}/post-proxy-detail-%Y%m%d # # This MUST be 0600, otherwise anyone can read # the users passwords! # detailperm = 0600 # } # # The rlm_sql_log module appends the SQL queries in a log # file which is read later by the radsqlrelay program. # # This module only performs the dynamic expansion of the # variables found in the SQL statements. No operation is # executed on the database server. (this could be done # later by an external program) That means the module is # useful only with non-"SELECT" statements. # # See rlm_sql_log(5) manpage. # # sql_log { # path = ${radacctdir}/sql-relay # acct_table = "radacct" # postauth_table = "radpostauth" # # Start = "INSERT INTO ${acct_table} (AcctSessionId, UserName, \ # NASIPAddress, FramedIPAddress, AcctStartTime, AcctStopTime, \ # AcctSessionTime, AcctTerminateCause) VALUES \ # ('%{Acct-Session-Id}', '%{User-Name}', '%{NAS-IP-Address}', \ # '%{Framed-IP-Address}', '%S', '0', '0', '');" # Stop = "INSERT INTO ${acct_table} (AcctSessionId, UserName, \ # NASIPAddress, FramedIPAddress, AcctStartTime, AcctStopTime, \ # AcctSessionTime, AcctTerminateCause) VALUES \ # ('%{Acct-Session-Id}', '%{User-Name}', '%{NAS-IP-Address}', \ # '%{Framed-IP-Address}', '0', '%S', '%{Acct-Session-Time}', \ # '%{Acct-Terminate-Cause}');" # Alive = "INSERT INTO ${acct_table} (AcctSessionId, UserName, \ # NASIPAddress, FramedIPAddress, AcctStartTime, AcctStopTime, \ # AcctSessionTime, AcctTerminateCause) VALUES \ # ('%{Acct-Session-Id}', '%{User-Name}', '%{NAS-IP-Address}', \ # '%{Framed-IP-Address}', '0', '0', '%{Acct-Session-Time}','');" # # Post-Auth = "INSERT INTO ${postauth_table} \ # (user, pass, reply, date) VALUES \ # ('%{User-Name}', '%{User-Password:-Chap-Password}', \ # '%{reply:Packet-Type}', '%S');" # } # # Create a unique accounting session Id. Many NASes re-use # or repeat values for Acct-Session-Id, causing no end of # confusion. # # This module will add a (probably) unique session id # to an accounting packet based on the attributes listed # below found in the packet. See doc/rlm_acct_unique for # more information. # acct_unique { key = "User-Name, Acct-Session-Id, NAS-IP-Address, Client-IP-Address, NAS-Port" } # Include another file that has the SQL-related configuration. # This is another file only because it tends to be big. # # The following configuration file is for use with MySQL. # # For Postgresql, use: ${confdir}/postgresql.conf # For MS-SQL, use: ${confdir}/mssql.conf # For Oracle, use: ${confdir}/oraclesql.conf # # $INCLUDE ${confdir}/sql.conf # For Cisco VoIP specific accounting with Postgresql, # use: ${confdir}/pgsql-voip.conf # # You will also need the sql schema from: # src/billing/cisco_h323_db_schema-postgres.sql # Note: This config can be use AS WELL AS the standard sql # config if you need SQL based Auth # Write a 'utmp' style file, of which users are currently # logged in, and where they've logged in from. # # This file is used mainly for Simultaneous-Use checking, # and also 'radwho', to see who's currently logged in. # radutmp { # Where the file is stored. It's not a log file, # so it doesn't need rotating. # filename = ${logdir}/radutmp # The field in the packet to key on for the # 'user' name, If you have other fields which you want # to use to key on to control Simultaneous-Use, # then you can use them here. # # Note, however, that the size of the field in the # 'utmp' data structure is small, around 32 # characters, so that will limit the possible choices # of keys. # # You may want instead: %{Stripped-User-Name:-%{User-Name}} username = %{User-Name} # Whether or not we want to treat "user" the same # as "USER", or "User". Some systems have problems # with case sensitivity, so this should be set to # 'no' to enable the comparisons of the key attribute # to be case insensitive. # case_sensitive = yes # Accounting information may be lost, so the user MAY # have logged off of the NAS, but we haven't noticed. # If so, we can verify this information with the NAS, # # If we want to believe the 'utmp' file, then this # configuration entry can be set to 'no'. # check_with_nas = yes # Set the file permissions, as the contents of this file # are usually private. perm = 0600 callerid = "yes"

4 7

Problem with rlm_counter (FR3)
by Marco Marino 27 Feb '14

27 Feb '14

After recent fixes, i have a problem with FR3 and rlm_counter. My configuration in mods-enabled/counter: counter daily { filename = ${db_dir}/db.daily key = User-Name count_attribute = Acct-Session-Time reset = daily counter_name = Daily-Session-Time check_name = Max-Daily-Session reply_name = Session-Timeout #allowed_service_type = Framed-User cache_size = 5000 } my sites-enabled/default configuration is as i found after a compile. Before "expiration" i just added "daily". Radclient command that i'm using for tests: echo "User-Name = marco,User-Password = XXXXXXXX" | /usr/local/bin/radclient localhost:1812 auth testing123 If i comment "daily" in the authorize section i have: Received reply ID 141, code 2, length = 32 Idle-Timeout = 600 Session-Timeout = 120 if I uncomment "daily" i have: Received reply ID 124, code 2, length = 38 Idle-Timeout = 600 Session-Timeout = 120 Session-Timeout = 120 So "Session-Timeout" is duplicated. What happens? "marco" user belongs to a group named "Users" that have a radgroupreply "Session-Timeout" = 120 This is a complete log when "daily" is commented: rad_recv: Access-Request packet from host 127.0.0.1 port 43737, id=141, length=51 User-Name = 'marco@prova' User-Password = 'XXXXXXXX' (1) # Executing section authorize from file /etc/freeradius//sites-enabled/default (1) authorize { (1) filter_username filter_username { (1) ? if (!User-Name) (1) ? if (!User-Name) -> FALSE (1) ? if (User-Name != "%{tolower:%{User-Name}}") (1) expand: "%{tolower:%{User-Name}}" -> 'marco@prova' (1) ? if (User-Name != "%{tolower:%{User-Name}}") -> FALSE (1) ? if (User-Name =~ / /) (1) ? if (User-Name =~ / /) -> FALSE (1) ? if (User-Name =~ /@.*@/ ) (1) ? if (User-Name =~ /@.*@/ ) -> FALSE (1) ? if (User-Name =~ /\\.\\./ ) (1) ? if (User-Name =~ /\\.\\./ ) -> FALSE (1) ? if (User-Name =~ /\\.$/) (1) ? if (User-Name =~ /\\.$/) -> FALSE (1) ? if (User-Name =~ /(a)\\./) (1) ? if (User-Name =~ /(a)\\./) -> FALSE (1) } # filter_username filter_username = notfound (1) [preprocess] = ok (1) [chap] = noop (1) [mschap] = noop (1) [digest] = noop (1) suffix : Looking up realm "prova" for User-Name = "marco@prova" (1) suffix : Found realm "prova" (1) suffix : Adding Stripped-User-Name = "marco" (1) suffix : Adding Realm = "prova" (1) suffix : Authentication realm is LOCAL (1) [suffix] = ok (1) eap : No EAP-Message, not doing EAP (1) [eap] = noop (1) [files] = noop (1) sql : expand: "%{%{Stripped-User-Name}:-%{%{User-Name}:-DEFAULT}}" -> 'marco' (1) sql : SQL-User-Name set to 'marco' rlm_sql (sql): Reserved connection (4) (1) sql : expand: "SELECT id, username, attribute, value, op FROM radcheck WHERE username = '%{SQL-User-Name}' ORDER BY id" -> 'SELECT id, username, attribute, value, op FROM radcheck WHERE username = 'marco' ORDER BY id' rlm_sql (sql): Executing query: 'SELECT id, username, attribute, value, op FROM radcheck WHERE username = 'marco' ORDER BY id' (1) sql : User found in radcheck table (1) sql : Check items matched (1) sql : expand: "SELECT id, username, attribute, value, op FROM radreply WHERE username = '%{SQL-User-Name}' ORDER BY id" -> 'SELECT id, username, attribute, value, op FROM radreply WHERE username = 'marco' ORDER BY id' rlm_sql (sql): Executing query: 'SELECT id, username, attribute, value, op FROM radreply WHERE username = 'marco' ORDER BY id' (1) sql : expand: "SELECT groupname FROM radusergroup WHERE username = '%{SQL-User-Name}' ORDER BY priority" -> 'SELECT groupname FROM radusergroup WHERE username = 'marco' ORDER BY priority' rlm_sql (sql): Executing query: 'SELECT groupname FROM radusergroup WHERE username = 'marco' ORDER BY priority' (1) sql : User found in the group table (1) sql : expand: "SELECT id, groupname, attribute, Value, op FROM radgroupcheck WHERE groupname = '%{Sql-Group}' ORDER BY id" -> 'SELECT id, groupname, attribute, Value, op FROM radgroupcheck WHERE groupname = 'Users' ORDER BY id' rlm_sql (sql): Executing query: 'SELECT id, groupname, attribute, Value, op FROM radgroupcheck WHERE groupname = 'Users' ORDER BY id' (1) sql : Group "Users" check items matched (1) sql : expand: "SELECT id, groupname, attribute, value, op FROM radgroupreply WHERE groupname = '%{Sql-Group}' ORDER BY id" -> 'SELECT id, groupname, attribute, value, op FROM radgroupreply WHERE groupname = 'Users' ORDER BY id' rlm_sql (sql): Executing query: 'SELECT id, groupname, attribute, value, op FROM radgroupreply WHERE groupname = 'Users' ORDER BY id' (1) sql : Group "Users" reply items processed rlm_sql (sql): Released connection (4) rlm_sql (sql): Closing connection (0): Too many free connections (5 > 3) rlm_sql_mysql: Socket destructor called, closing socket (1) [sql] = ok (1) [expiration] = noop (1) [logintime] = noop (1) [pap] = updated (1) } # authorize = updated (1) Found Auth-Type = PAP (1) # Executing group from file /etc/freeradius//sites-enabled/default (1) Auth-Type PAP { (1) pap : Login attempt with password (1) pap : User authenticated successfully (1) [pap] = ok (1) } # Auth-Type PAP = ok (1) # Executing section post-auth from file /etc/freeradius//sites-enabled/default (1) post-auth { (1) [-sql] = noop (1) [exec] = noop (1) remove_reply_message_if_eap remove_reply_message_if_eap { (1) ? if (reply:EAP-Message && reply:Reply-Message) (1) ? if (reply:EAP-Message && reply:Reply-Message) -> FALSE (1) else else { (1) [noop] = noop (1) } # else else = noop (1) } # remove_reply_message_if_eap remove_reply_message_if_eap = noop (1) } # post-auth = noop Sending Access-Accept of id 141 from 127.0.0.1 port 1812 to 127.0.0.1 port 43737 Idle-Timeout = 600 Session-Timeout = 120 (1) Finished request 1. Waking up in 0.3 seconds. Waking up in 4.6 seconds. (1) Cleaning up request packet ID 141 with timestamp +58 Instead, this is a complete log when "daily" is enabled: rad_recv: Access-Request packet from host 127.0.0.1 port 34562, id=124, length=45 User-Name = 'marco' User-Password = 'mc68hc908' (1) # Executing section authorize from file /etc/freeradius//sites-enabled/default (1) authorize { (1) filter_username filter_username { (1) ? if (!User-Name) (1) ? if (!User-Name) -> FALSE (1) ? if (User-Name != "%{tolower:%{User-Name}}") (1) expand: "%{tolower:%{User-Name}}" -> 'marco' (1) ? if (User-Name != "%{tolower:%{User-Name}}") -> FALSE (1) ? if (User-Name =~ / /) (1) ? if (User-Name =~ / /) -> FALSE (1) ? if (User-Name =~ /@.*@/ ) (1) ? if (User-Name =~ /@.*@/ ) -> FALSE (1) ? if (User-Name =~ /\\.\\./ ) (1) ? if (User-Name =~ /\\.\\./ ) -> FALSE (1) ? if (User-Name =~ /\\.$/) (1) ? if (User-Name =~ /\\.$/) -> FALSE (1) ? if (User-Name =~ /(a)\\./) (1) ? if (User-Name =~ /(a)\\./) -> FALSE (1) } # filter_username filter_username = notfound (1) [preprocess] = ok (1) [chap] = noop (1) [mschap] = noop (1) [digest] = noop (1) suffix : No '@' in User-Name = "marco", looking up realm NULL (1) suffix : No such realm "NULL" (1) [suffix] = noop (1) eap : No EAP-Message, not doing EAP (1) [eap] = noop (1) [files] = noop (1) sql : expand: "%{%{Stripped-User-Name}:-%{%{User-Name}:-DEFAULT}}" -> 'marco' (1) sql : SQL-User-Name set to 'marco' rlm_sql (sql): Reserved connection (4) (1) sql : expand: "SELECT id, username, attribute, value, op FROM radcheck WHERE username = '%{SQL-User-Name}' ORDER BY id" -> 'SELECT id, username, attribute, value, op FROM radcheck WHERE username = 'marco' ORDER BY id' rlm_sql (sql): Executing query: 'SELECT id, username, attribute, value, op FROM radcheck WHERE username = 'marco' ORDER BY id' (1) sql : User found in radcheck table (1) sql : Check items matched (1) sql : expand: "SELECT id, username, attribute, value, op FROM radreply WHERE username = '%{SQL-User-Name}' ORDER BY id" -> 'SELECT id, username, attribute, value, op FROM radreply WHERE username = 'marco' ORDER BY id' rlm_sql (sql): Executing query: 'SELECT id, username, attribute, value, op FROM radreply WHERE username = 'marco' ORDER BY id' (1) sql : expand: "SELECT groupname FROM radusergroup WHERE username = '%{SQL-User-Name}' ORDER BY priority" -> 'SELECT groupname FROM radusergroup WHERE username = 'marco' ORDER BY priority' rlm_sql (sql): Executing query: 'SELECT groupname FROM radusergroup WHERE username = 'marco' ORDER BY priority' (1) sql : User found in the group table (1) sql : expand: "SELECT id, groupname, attribute, Value, op FROM radgroupcheck WHERE groupname = '%{Sql-Group}' ORDER BY id" -> 'SELECT id, groupname, attribute, Value, op FROM radgroupcheck WHERE groupname = 'Users' ORDER BY id' rlm_sql (sql): Executing query: 'SELECT id, groupname, attribute, Value, op FROM radgroupcheck WHERE groupname = 'Users' ORDER BY id' (1) sql : Group "Users" check items matched (1) sql : expand: "SELECT id, groupname, attribute, value, op FROM radgroupreply WHERE groupname = '%{Sql-Group}' ORDER BY id" -> 'SELECT id, groupname, attribute, value, op FROM radgroupreply WHERE groupname = 'Users' ORDER BY id' rlm_sql (sql): Executing query: 'SELECT id, groupname, attribute, value, op FROM radgroupreply WHERE groupname = 'Users' ORDER BY id' (1) sql : Group "Users" reply items processed rlm_sql (sql): Released connection (4) (1) [sql] = ok rlm_counter: Entering module authorize code rlm_counter: Searching the database for key 'marco' rlm_counter: Could not find the requested key in the database rlm_counter: Check item = 120, Count = 0 rlm_counter: res is greater than zero rlm_counter: (Check item - counter) is greater than zero rlm_counter: Authorized user marco, check_item=120, counter=0 rlm_counter: Sent Reply-Item for user marco, Type=Session-Timeout, value=120 (1) [daily] = ok (1) [expiration] = noop (1) [logintime] = noop (1) [pap] = updated (1) } # authorize = updated (1) Found Auth-Type = PAP (1) # Executing group from file /etc/freeradius//sites-enabled/default (1) Auth-Type PAP { (1) pap : Login attempt with password (1) pap : User authenticated successfully (1) [pap] = ok (1) } # Auth-Type PAP = ok (1) # Executing section post-auth from file /etc/freeradius//sites-enabled/default (1) post-auth { (1) [-sql] = noop (1) [exec] = noop (1) remove_reply_message_if_eap remove_reply_message_if_eap { (1) ? if (reply:EAP-Message && reply:Reply-Message) (1) ? if (reply:EAP-Message && reply:Reply-Message) -> FALSE (1) else else { (1) [noop] = noop (1) } # else else = noop (1) } # remove_reply_message_if_eap remove_reply_message_if_eap = noop (1) } # post-auth = noop Sending Access-Accept of id 124 from 127.0.0.1 port 1812 to 127.0.0.1 port 34562 Idle-Timeout = 600 Session-Timeout = 120 Session-Timeout = 120 (1) Finished request 1. Waking up in 0.3 seconds. Waking up in 0.6 seconds. (0) Cleaning up request packet ID 198 with timestamp +5 Thanks

4 5

FR3.0.1Problems with raddebug and radmin.
by Palmer J.D.F. 27 Feb '14

27 Feb '14

Hello, I'm having some issues with raddebug and radmin not matching conditions. If I run raddebug with no condition, and run a test auth an output is generated; however if I set a condition I get no output. I've not been able to get radmin to write anything to my debug file. I've tried a few different formats for my conditions, all to no avail. -u user(a)domain.com -u 'user(a)domain.com' -u "user(a)domain.com" debug condition '(User-Name == -u user(a)domain.com)' debug condition '(User-Name == -u 'user(a)domain.com')' debug condition '(User-Name == -u "user(a)domain.com")' Only raddebug with no condition produces anything, which at least proves that it is connecting to the radiusd socket. I also note that if I set a condition within radmin, then do 'show debug condition' there is no condition active. Whereas if I repeat this exercise on FR2.2.0 it returns my condition as expected. Can anyone confirm that they are seeing the same behaviour? FR 3.0.0 had an issues where radmin and raddebug would crash radiusd on exit, however that appears to be fixed in FR3.0.1 Many thanks, Jezz. Jezz Palmer Information Services and Systems Swansea University Singleton Park Swansea SA2 8PP

3 4

DHCP with Oracle and sqlippool
by Бен Томпсон 27 Feb '14

27 Feb '14

Hello everyone I am trying to set up FreeRADIUS as a DHCP server for use with an IP pool in an Oracle DB. I built the latest version from git, and added some basic config to test the DHCP pool functionality. However, the server does not process any requests and gives the following error: Received DHCP-Discover of id cf875833 from 10.180.1.1:67 to 10.160.0.254:67 Threads: total/active/spare threads = 0/0/0 Something is blocking the server. There are 0 packets in the queue, waiting to be processed. Ignoring the new request. (0) Cleaning up request packet ID 3481753651 with timestamp +302 I would be very grateful if someone could advise what the problem is. The full debug log is as follows: radiusd: FreeRADIUS Version 3.1.0 (git #10ffd5b), for host x86_64-unknown-linux-gnu, built on Feb 21 2014 at 13:50:22 Copyright (C) 1999-2014 The FreeRADIUS server project and contributors There is NO warranty; not even for MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE You may redistribute copies of FreeRADIUS under the terms of the GNU General Public License For more information about these matters, see the file named COPYRIGHT Starting - reading configuration files ... including dictionary file /usr/local/share/freeradius/dictionary including dictionary file /usr/local/etc/raddb/dictionary including configuration file /usr/local/etc/raddb/radiusd.conf including configuration file /usr/local/etc/raddb/clients.conf including files in directory /usr/local/etc/raddb/mods-enabled/ including configuration file /usr/local/etc/raddb/mods-enabled/expr including configuration file /usr/local/etc/raddb/mods-enabled/ntlm_auth including configuration file /usr/local/etc/raddb/mods-enabled/logintime including configuration file /usr/local/etc/raddb/mods-enabled/expiration including configuration file /usr/local/etc/raddb/mods-enabled/realm including configuration file /usr/local/etc/raddb/mods-enabled/detail.log including configuration file /usr/local/etc/raddb/mods-enabled/pap including configuration file /usr/local/etc/raddb/mods-enabled/digest including configuration file /usr/local/etc/raddb/mods-enabled/attr_filter including configuration file /usr/local/etc/raddb/mods-enabled/chap including configuration file /usr/local/etc/raddb/mods-enabled/eap including configuration file /usr/local/etc/raddb/mods-enabled/utf8 including configuration file /usr/local/etc/raddb/mods-enabled/replicate including configuration file /usr/local/etc/raddb/mods-enabled/detail including configuration file /usr/local/etc/raddb/mods-enabled/always including configuration file /usr/local/etc/raddb/mods-enabled/echo including configuration file /usr/local/etc/raddb/mods-enabled/cache_eap including configuration file /usr/local/etc/raddb/mods-enabled/linelog including configuration file /usr/local/etc/raddb/mods-enabled/files including configuration file /usr/local/etc/raddb/mods-enabled/dhcp including configuration file /usr/local/etc/raddb/mods-enabled/dynamic_clients including configuration file /usr/local/etc/raddb/mods-enabled/mschap including configuration file /usr/local/etc/raddb/mods-enabled/radutmp including configuration file /usr/local/etc/raddb/mods-enabled/unix including configuration file /usr/local/etc/raddb/mods-enabled/sql including configuration file /usr/local/etc/raddb/mods-config/sql/main/oracle/queries.conf including configuration file /usr/local/etc/raddb/mods-enabled/passwd including configuration file /usr/local/etc/raddb/mods-enabled/sradutmp including configuration file /usr/local/etc/raddb/mods-enabled/exec including configuration file /usr/local/etc/raddb/mods-enabled/soh including configuration file /usr/local/etc/raddb/mods-enabled/dhcp_sqlippool including configuration file /usr/local/etc/raddb/mods-config/sql/ippool-dhcp/oracle/queries.conf including configuration file /usr/local/etc/raddb/mods-enabled/preprocess including configuration file /usr/local/etc/raddb/mods-enabled/sqlippool including configuration file /usr/local/etc/raddb/mods-config/sql/ippool/mysql/queries.conf including files in directory /usr/local/etc/raddb/policy.d/ including configuration file /usr/local/etc/raddb/policy.d/canonicalization including configuration file /usr/local/etc/raddb/policy.d/control including configuration file /usr/local/etc/raddb/policy.d/filter including configuration file /usr/local/etc/raddb/policy.d/eap including configuration file /usr/local/etc/raddb/policy.d/dhcp including configuration file /usr/local/etc/raddb/policy.d/operator-name including configuration file /usr/local/etc/raddb/policy.d/cui including configuration file /usr/local/etc/raddb/policy.d/accounting including files in directory /usr/local/etc/raddb/sites-enabled/ including configuration file /usr/local/etc/raddb/sites-enabled/dhcp_pool main { security { allow_core_dumps = no } } main { name = "radiusd" prefix = "/usr/local" localstatedir = "/usr/local/var" sbindir = "/usr/local/sbin" logdir = "/usr/local/var/log/radius" run_dir = "/usr/local/var/run/radiusd" libdir = "/usr/local/lib" radacctdir = "/usr/local/var/log/radius/radacct" hostname_lookups = no max_request_time = 30 cleanup_delay = 5 max_requests = 1024 pidfile = "/usr/local/var/run/radiusd/radiusd.pid" checkrad = "/usr/local/sbin/checkrad" debug_level = 0 proxy_requests = no log { stripped_names = no auth = no auth_badpass = no auth_goodpass = no colourise = yes } security { max_attributes = 200 reject_delay = 1 status_server = yes } } radiusd: #### Loading Realms and Home Servers #### radiusd: #### Loading Clients #### client localhost { ipaddr = 127.0.0.1 require_message_authenticator = no secret = <<< secret >>> nas_type = "other" proto = "*" limit { max_connections = 16 lifetime = 0 idle_timeout = 30 } } radiusd: #### Instantiating modules #### instantiate { } modules { # Loaded module rlm_expr # Instantiating module "expr" from file /usr/local/etc/raddb/mods-enabled/expr expr { safe_characters = "@abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ0123456789.-_: /" } # Loaded module rlm_exec # Instantiating module "ntlm_auth" from file /usr/local/etc/raddb/mods-enabled/ntlm_auth exec ntlm_auth { wait = yes program = "/path/to/ntlm_auth --request-nt-key --domain=MYDOMAIN --username=%{mschap:User-Name} --password=%{User-Password}" shell_escape = yes } # Loaded module rlm_logintime # Instantiating module "logintime" from file /usr/local/etc/raddb/mods-enabled/logintime logintime { minimum_timeout = 60 } # Loaded module rlm_expiration # Instantiating module "expiration" from file /usr/local/etc/raddb/mods-enabled/expiration # Loaded module rlm_realm # Instantiating module "IPASS" from file /usr/local/etc/raddb/mods-enabled/realm realm IPASS { format = "prefix" delimiter = "/" ignore_default = no ignore_null = no } # Instantiating module "suffix" from file /usr/local/etc/raddb/mods-enabled/realm realm suffix { format = "suffix" delimiter = "@" ignore_default = no ignore_null = no } # Instantiating module "realmpercent" from file /usr/local/etc/raddb/mods-enabled/realm realm realmpercent { format = "suffix" delimiter = "%" ignore_default = no ignore_null = no } # Instantiating module "ntdomain" from file /usr/local/etc/raddb/mods-enabled/realm realm ntdomain { format = "prefix" delimiter = "\" ignore_default = no ignore_null = no } # Loaded module rlm_detail # Instantiating module "auth_log" from file /usr/local/etc/raddb/mods-enabled/detail.log detail auth_log { filename = "/usr/local/var/log/radius/radacct/%{%{Packet-Src-IP-Address}:-%{Packet-Src-IPv6-Address}}/auth-detail-%Y%m%d" header = "%t" permissions = 384 dir_permissions = 493 locking = no log_packet_header = no } rlm_detail (auth_log): 'User-Password' suppressed, will not appear in detail output # Instantiating module "reply_log" from file /usr/local/etc/raddb/mods-enabled/detail.log detail reply_log { filename = "/usr/local/var/log/radius/radacct/%{%{Packet-Src-IP-Address}:-%{Packet-Src-IPv6-Address}}/reply-detail-%Y%m%d" header = "%t" permissions = 384 dir_permissions = 493 locking = no log_packet_header = no } # Instantiating module "pre_proxy_log" from file /usr/local/etc/raddb/mods-enabled/detail.log detail pre_proxy_log { filename = "/usr/local/var/log/radius/radacct/%{%{Packet-Src-IP-Address}:-%{Packet-Src-IPv6-Address}}/pre-proxy-detail-%Y%m%d" header = "%t" permissions = 384 dir_permissions = 493 locking = no log_packet_header = no } # Instantiating module "post_proxy_log" from file /usr/local/etc/raddb/mods-enabled/detail.log detail post_proxy_log { filename = "/usr/local/var/log/radius/radacct/%{%{Packet-Src-IP-Address}:-%{Packet-Src-IPv6-Address}}/post-proxy-detail-%Y%m%d" header = "%t" permissions = 384 dir_permissions = 493 locking = no log_packet_header = no } # Loaded module rlm_pap # Instantiating module "pap" from file /usr/local/etc/raddb/mods-enabled/pap pap { auto_header = no normalise = yes } # Loaded module rlm_digest # Instantiating module "digest" from file /usr/local/etc/raddb/mods-enabled/digest # Loaded module rlm_attr_filter # Instantiating module "attr_filter.post-proxy" from file /usr/local/etc/raddb/mods-enabled/attr_filter attr_filter attr_filter.post-proxy { filename = "/usr/local/etc/raddb/mods-config/attr_filter/post-proxy" key = "%{Realm}" relaxed = no } reading pairlist file /usr/local/etc/raddb/mods-config/attr_filter/post-proxy # Instantiating module "attr_filter.pre-proxy" from file /usr/local/etc/raddb/mods-enabled/attr_filter attr_filter attr_filter.pre-proxy { filename = "/usr/local/etc/raddb/mods-config/attr_filter/pre-proxy" key = "%{Realm}" relaxed = no } reading pairlist file /usr/local/etc/raddb/mods-config/attr_filter/pre-proxy # Instantiating module "attr_filter.access_reject" from file /usr/local/etc/raddb/mods-enabled/attr_filter attr_filter attr_filter.access_reject { filename = "/usr/local/etc/raddb/mods-config/attr_filter/access_reject" key = "%{User-Name}" relaxed = no } reading pairlist file /usr/local/etc/raddb/mods-config/attr_filter/access_reject # Instantiating module "attr_filter.access_challenge" from file /usr/local/etc/raddb/mods-enabled/attr_filter attr_filter attr_filter.access_challenge { filename = "/usr/local/etc/raddb/mods-config/attr_filter/access_challenge" key = "%{User-Name}" relaxed = no } reading pairlist file /usr/local/etc/raddb/mods-config/attr_filter/access_challenge # Instantiating module "attr_filter.accounting_response" from file /usr/local/etc/raddb/mods-enabled/attr_filter attr_filter attr_filter.accounting_response { filename = "/usr/local/etc/raddb/mods-config/attr_filter/accounting_response" key = "%{User-Name}" relaxed = no } reading pairlist file /usr/local/etc/raddb/mods-config/attr_filter/accounting_response # Loaded module rlm_chap # Instantiating module "chap" from file /usr/local/etc/raddb/mods-enabled/chap # Loaded module rlm_eap # Instantiating module "eap" from file /usr/local/etc/raddb/mods-enabled/eap eap { default_eap_type = "md5" timer_expire = 60 ignore_unknown_eap_types = no mod_accounting_username_bug = no max_sessions = 4096 } # Linked to sub-module rlm_eap_md5 # Linked to sub-module rlm_eap_leap # Linked to sub-module rlm_eap_gtc gtc { challenge = "Password: " auth_type = "PAP" } # Linked to sub-module rlm_eap_tls tls { tls = "tls-common" } tls-config tls-common { rsa_key_exchange = no dh_key_exchange = yes rsa_key_length = 512 dh_key_length = 512 verify_depth = 0 ca_path = "/usr/local/etc/raddb/certs" pem_file_type = yes private_key_file = "/usr/local/etc/raddb/certs/server.pem" certificate_file = "/usr/local/etc/raddb/certs/server.pem" ca_file = "/usr/local/etc/raddb/certs/ca.pem" private_key_password = <<< secret >>> dh_file = "/usr/local/etc/raddb/certs/dh" fragment_size = 1024 include_length = yes check_crl = no cipher_list = "DEFAULT" ecdh_curve = "prime256v1" cache { enable = yes lifetime = 24 max_entries = 255 } verify { } ocsp { enable = no override_cert_url = yes url = "http://127.0.0.1/ocsp/" use_nonce = yes timeout = 0 softfail = yes } } # Linked to sub-module rlm_eap_ttls ttls { tls = "tls-common" default_eap_type = "md5" copy_request_to_tunnel = no use_tunneled_reply = no virtual_server = "inner-tunnel" include_length = yes require_client_cert = no } Using cached TLS configuration from previous invocation # Linked to sub-module rlm_eap_peap peap { tls = "tls-common" default_method = "mschapv2" copy_request_to_tunnel = no use_tunneled_reply = no proxy_tunneled_request_as_eap = yes virtual_server = "inner-tunnel" soh = no require_client_cert = no } Using cached TLS configuration from previous invocation # Linked to sub-module rlm_eap_mschapv2 mschapv2 { with_ntdomain_hack = no send_error = no } # Loaded module rlm_utf8 # Instantiating module "utf8" from file /usr/local/etc/raddb/mods-enabled/utf8 # Loaded module rlm_replicate # Instantiating module "replicate" from file /usr/local/etc/raddb/mods-enabled/replicate # Instantiating module "detail" from file /usr/local/etc/raddb/mods-enabled/detail detail { filename = "/usr/local/var/log/radius/radacct/%{%{Packet-Src-IP-Address}:-%{Packet-Src-IPv6-Address}}/detail-%Y%m%d" header = "%t" permissions = 384 dir_permissions = 493 locking = no log_packet_header = no } # Loaded module rlm_always # Instantiating module "reject" from file /usr/local/etc/raddb/mods-enabled/always always reject { rcode = "reject" simulcount = 0 mpp = no } # Instantiating module "fail" from file /usr/local/etc/raddb/mods-enabled/always always fail { rcode = "fail" simulcount = 0 mpp = no } # Instantiating module "ok" from file /usr/local/etc/raddb/mods-enabled/always always ok { rcode = "ok" simulcount = 0 mpp = no } # Instantiating module "handled" from file /usr/local/etc/raddb/mods-enabled/always always handled { rcode = "handled" simulcount = 0 mpp = no } # Instantiating module "invalid" from file /usr/local/etc/raddb/mods-enabled/always always invalid { rcode = "invalid" simulcount = 0 mpp = no } # Instantiating module "userlock" from file /usr/local/etc/raddb/mods-enabled/always always userlock { rcode = "userlock" simulcount = 0 mpp = no } # Instantiating module "notfound" from file /usr/local/etc/raddb/mods-enabled/always always notfound { rcode = "notfound" simulcount = 0 mpp = no } # Instantiating module "noop" from file /usr/local/etc/raddb/mods-enabled/always always noop { rcode = "noop" simulcount = 0 mpp = no } # Instantiating module "updated" from file /usr/local/etc/raddb/mods-enabled/always always updated { rcode = "updated" simulcount = 0 mpp = no } # Instantiating module "echo" from file /usr/local/etc/raddb/mods-enabled/echo exec echo { wait = yes program = "/bin/echo %{User-Name}" input_pairs = "request" output_pairs = "reply" shell_escape = yes } # Loaded module rlm_cache # Instantiating module "cache_eap" from file /usr/local/etc/raddb/mods-enabled/cache_eap cache cache_eap { key = "%{%{control:State}:-%{%{reply:State}:-%{State}}}" ttl = 15 max_entries = 16384 epoch = 0 add_stats = no } # Loaded module rlm_linelog # Instantiating module "linelog" from file /usr/local/etc/raddb/mods-enabled/linelog linelog { filename = "/usr/local/var/log/radius/linelog" permissions = 384 format = "This is a log message for %{User-Name}" reference = "%{%{Packet-Type}:-format}" } # Instantiating module "linelog-dhcp" from file /usr/local/etc/raddb/mods-enabled/linelog linelog linelog-dhcp { filename = "/usr/local/var/log/radius/linelog-dhcp.log" permissions = 384 format = "" reference = "%{%{reply:DHCP-Message-Type}:-%{request:DHCP-Message-Type}}" } # Loaded module rlm_files # Instantiating module "files" from file /usr/local/etc/raddb/mods-enabled/files files { filename = "/usr/local/etc/raddb/mods-config/files/authorize" usersfile = "/usr/local/etc/raddb/mods-config/files/authorize" acctusersfile = "/usr/local/etc/raddb/mods-config/files/accounting" preproxy_usersfile = "/usr/local/etc/raddb/mods-config/files/pre-proxy" compat = "no" } reading pairlist file /usr/local/etc/raddb/mods-config/files/authorize reading pairlist file /usr/local/etc/raddb/mods-config/files/authorize reading pairlist file /usr/local/etc/raddb/mods-config/files/accounting reading pairlist file /usr/local/etc/raddb/mods-config/files/pre-proxy # Loaded module rlm_dhcp # Instantiating module "dhcp" from file /usr/local/etc/raddb/mods-enabled/dhcp # Loaded module rlm_dynamic_clients # Instantiating module "dynamic_clients" from file /usr/local/etc/raddb/mods-enabled/dynamic_clients # Loaded module rlm_mschap # Instantiating module "mschap" from file /usr/local/etc/raddb/mods-enabled/mschap mschap { use_mppe = yes require_encryption = no require_strong = no with_ntdomain_hack = yes passchange { } allow_retry = yes } # Loaded module rlm_radutmp # Instantiating module "radutmp" from file /usr/local/etc/raddb/mods-enabled/radutmp radutmp { filename = "/usr/local/var/log/radius/radutmp" username = "%{User-Name}" case_sensitive = yes check_with_nas = yes permissions = 384 caller_id = yes } # Loaded module rlm_unix # Instantiating module "unix" from file /usr/local/etc/raddb/mods-enabled/unix unix { radwtmp = "/usr/local/var/log/radius/radwtmp" } # Loaded module rlm_sql # Instantiating module "sql" from file /usr/local/etc/raddb/mods-enabled/sql sql { driver = "rlm_sql_oracle" server = "localhost" port = "" login = "foo" password = <<< secret >>> radius_db = "(DESCRIPTION=(ADDRESS=(PROTOCOL=TCP)(HOST=foo)(PORT=1521))(CONNECT_DATA=(SID=bar)))" read_groups = yes read_clients = no delete_stale_sessions = yes sql_user_name = "%{User-Name}" default_user_profile = "" client_query = "SELECT id, nasname, shortname, type, secret, server FROM nas" authorize_check_query = "SELECT id,UserName,Attribute,Value,op FROM radcheck WHERE Username = '%{SQL-User-Name}' ORDER BY id" authorize_reply_query = "SELECT id,UserName,Attribute,Value,op FROM radreply WHERE Username = '%{SQL-User-Name}' ORDER BY id" authorize_group_check_query = "SELECT radgroupcheck.id,radgroupcheck.GroupName,radgroupcheck.Attribute,radgroupcheck.Value,radgroupcheck.op FROM radgroupcheck,radusergroup WHERE radusergroup.Username = '%{SQL-User-Name}' AND radusergroup.GroupName = radgroupcheck.GroupName ORDER BY radgroupcheck.id" authorize_group_reply_query = "SELECT radgroupreply.id,radgroupreply.GroupName,radgroupreply.Attribute,radgroupreply.Value,radgroupreply.op FROM radgroupreply,radusergroup WHERE radusergroup.Username = '%{SQL-User-Name}' AND radusergroup.GroupName = radgroupreply.GroupName ORDER BY radgroupreply.id" group_membership_query = "SELECT GroupName FROM radusergroup WHERE UserName='%{SQL-User-Name}'" simul_count_query = "" simul_verify_query = "SELECT RadAcctId, AcctSessionId, UserName, NASIPAddress, NASPortId, FramedIPAddress, CallingStationId, FramedProtocol FROM radacct WHERE UserName='%{SQL-User-Name}' AND AcctStopTime IS NULL" safe_characters = "@abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ0123456789.-_: /" } accounting { reference = "%{tolower:type.%{Acct-Status-Type}.query}" } post-auth { reference = ".query" } rlm_sql (sql): Driver rlm_sql_oracle (module rlm_sql_oracle) loaded and linked rlm_sql (sql): Attempting to connect to database "(DESCRIPTION=(ADDRESS=(PROTOCOL=TCP)(HOST=foo)(PORT1521))(CONNECT_DATA=(SID=bar)))" rlm_sql (sql): Initialising connection pool pool { start = 5 min = 4 max = 32 spare = 3 uses = 0 lifetime = 0 cleanup_delay = 5 idle_timeout = 60 spread = no } rlm_sql (sql): Opening additional connection (0) rlm_sql (sql): Opening additional connection (1) rlm_sql (sql): Opening additional connection (2) rlm_sql (sql): Opening additional connection (3) rlm_sql (sql): Opening additional connection (4) # Loaded module rlm_passwd # Instantiating module "etc_passwd" from file /usr/local/etc/raddb/mods-enabled/passwd passwd etc_passwd { filename = "/etc/passwd" format = "*User-Name:Crypt-Password:" delimiter = ":" ignore_nislike = no ignore_empty = yes allow_multiple_keys = no hash_size = 100 } rlm_passwd: nfields: 3 keyfield 0(User-Name) listable: no # Instantiating module "sradutmp" from file /usr/local/etc/raddb/mods-enabled/sradutmp radutmp sradutmp { filename = "/usr/local/var/log/radius/sradutmp" username = "%{User-Name}" case_sensitive = yes check_with_nas = yes permissions = 420 caller_id = no } # Instantiating module "exec" from file /usr/local/etc/raddb/mods-enabled/exec exec { wait = no input_pairs = "request" shell_escape = yes timeout = 10 } # Loaded module rlm_soh # Instantiating module "soh" from file /usr/local/etc/raddb/mods-enabled/soh soh { dhcp = yes } # Loaded module rlm_sqlippool # Instantiating module "dhcp_sqlippool" from file /usr/local/etc/raddb/mods-enabled/dhcp_sqlippool sqlippool dhcp_sqlippool { sql_module_instance = "sql" lease_duration = 7200 pool_name = "" default_pool = "main_pool" allocate_begin = "COMMIT" allocate_clear = " UPDATE radippool SET EXPIRY_TIME = CURRENT_TIMESTAMP - INTERVAL '1' SECOND(1) WHERE POOL_KEY = '%{Calling-Station-Id}'" allocate_find = " WITH POOLS AS ( SELECT * FROM radippool WHERE EXPIRY_TIME < CURRENT_TIMESTAMP AND POOL_NAME = '%{control:Pool-Name}') SELECT FRAMEDIPADDRESS FROM ( SELECT FRAMEDIPADDRESS FROM POOLS WHERE POOL_KEY = '%{Calling-Station-Id}' OR (NOT EXISTS ( SELECT 1 FROM POOLS WHERE POOL_KEY = '%{Calling-Station-Id}'))) WHERE ROWNUM = 1 FOR UPDATE" allocate_update = " UPDATE radippool SET NASIPADDRESS = '%{NAS-IP-Address}', POOL_KEY = '%{Calling-Station-Id}', CALLINGSTATIONID = '%{Mac-Addr}', USERNAME = '%{SQL-User-Name}', EXPIRY_TIME = CURRENT_TIMESTAMP + INTERVAL '7200' SECOND(1) WHERE FRAMEDIPADDRESS = '%I'" allocate_commit = "COMMIT" pool_check = "" start_begin = "COMMIT" start_update = " UPDATE radippool SET EXPIRY_TIME = CURRENT_TIMESTAMP + INTERVAL '7200' SECOND(1) WHERE NASIPADDRESS = '%{NAS-IP-Address}' AND POOL_NAME = '%{control:Pool-Name}' AND POOL_KEY = '%{Calling-Station-Id}' AND FRAMEDIPADDRESS = '%{Framed-IP-Address}'" start_commit = "COMMIT" alive_begin = "COMMIT" alive_update = " UPDATE radippool SET EXPIRY_TIME = CURRENT_TIMESTAMP + INTERVAL '7200' SECOND(1) WHERE POOL_KEY = '%{Calling-Station-Id}' AND POOL_NAME = '%{control:Pool-Name}' AND FRAMEDIPADDRESS = '%{Framed-IP-Address}'" alive_commit = "COMMIT" stop_begin = "COMMIT" stop_clear = " UPDATE radippool SET EXPIRY_TIME = CURRENT_TIMESTAMP - INTERVAL '1' SECOND(1) WHERE POOL_KEY = '%{Calling-Station-Id}'" stop_commit = "COMMIT" on_begin = "COMMIT" on_clear = " UPDATE radippool SET EXPIRY_TIME = CURRENT_TIMESTAMP - INTERVAL '1' SECOND(1) WHERE NASIPADDRESS = '%{Nas-IP-Address}'" on_commit = "COMMIT" off_begin = "COMMIT" off_clear = " UPDATE radippool SET EXPIRY_TIME = CURRENT_TIMESTAMP - INTERVAL '1' SECOND(1) WHERE NASIPADDRESS = '%{Nas-IP-Address}'" off_commit = "COMMIT" messages { } } # Loaded module rlm_preprocess # Instantiating module "preprocess" from file /usr/local/etc/raddb/mods-enabled/preprocess preprocess { huntgroups = "/usr/local/etc/raddb/mods-config/preprocess/huntgroups" hints = "/usr/local/etc/raddb/mods-config/preprocess/hints" with_ascend_hack = no ascend_channels_per_line = 23 with_ntdomain_hack = no with_specialix_jetstream_hack = no with_cisco_vsa_hack = no with_alvarion_vsa_hack = no } reading pairlist file /usr/local/etc/raddb/mods-config/preprocess/huntgroups reading pairlist file /usr/local/etc/raddb/mods-config/preprocess/hints # Instantiating module "sqlippool" from file /usr/local/etc/raddb/mods-enabled/sqlippool sqlippool { sql_module_instance = "sql" lease_duration = 3600 pool_name = "" default_pool = "main_pool" allocate_begin = "START TRANSACTION" allocate_clear = "UPDATE radippool SET nasipaddress = '', pool_key = 0, callingstationid = '', username = '', expiry_time = NULL WHERE expiry_time <= NOW() - INTERVAL 1 SECOND AND nasipaddress = '%{Nas-IP-Address}'" allocate_find = "SELECT framedipaddress FROM radippool WHERE pool_name = '%{control:Pool-Name}' AND (expiry_time < NOW() OR expiry_time IS NULL) ORDER BY (username <> '%{User-Name}'), (callingstationid <> '%{Calling-Station-Id}'), expiry_time LIMIT 1 FOR UPDATE" allocate_update = "UPDATE radippool SET nasipaddress = '%{NAS-IP-Address}', pool_key = '%{NAS-Port}', callingstationid = '%{Calling-Station-Id}', username = '%{User-Name}', expiry_time = NOW() + INTERVAL 3600 SECOND WHERE framedipaddress = '%I' AND expiry_time IS NULL" allocate_commit = "COMMIT" pool_check = "SELECT id FROM radippool WHERE pool_name='%{control:Pool-Name}' LIMIT 1" start_begin = "START TRANSACTION" start_update = "UPDATE radippool SET expiry_time = NOW() + INTERVAL 3600 SECOND WHERE nasipaddress = '%{NAS-IP-Address}' AND pool_key = '%{NAS-Port}' AND username = '%{User-Name}' AND callingstationid = '%{Calling-Station-Id}' AND framedipaddress = '%{Framed-IP-Address}'" start_commit = "COMMIT" alive_begin = "START TRANSACTION" alive_update = "UPDATE radippool SET expiry_time = NOW() + INTERVAL 3600 SECOND WHERE nasipaddress = '%{Nas-IP-Address}' AND pool_key = '%{NAS-Port}' AND username = '%{User-Name}' AND callingstationid = '%{Calling-Station-Id}' AND framedipaddress = '%{Framed-IP-Address}'" alive_commit = "COMMIT" stop_begin = "START TRANSACTION" stop_clear = "UPDATE radippool SET nasipaddress = '', pool_key = 0, callingstationid = '', username = '', expiry_time = NULL WHERE nasipaddress = '%{Nas-IP-Address}' AND pool_key = '%{NAS-Port}' AND username = '%{User-Name}' AND callingstationid = '%{Calling-Station-Id}' AND framedipaddress = '%{Framed-IP-Address}'" stop_commit = "COMMIT" on_begin = "START TRANSACTION" on_clear = "UPDATE radippool SET nasipaddress = '', pool_key = 0, callingstationid = '', username = '', expiry_time = NULL WHERE nasipaddress = '%{Nas-IP-Address}'" on_commit = "COMMIT" off_begin = "START TRANSACTION" off_clear = "UPDATE radippool SET nasipaddress = '', pool_key = 0, callingstationid = '', username = '', expiry_time = NULL WHERE nasipaddress = '%{Nas-IP-Address}'" off_commit = "COMMIT" messages { exists = "Existing IP: %{reply:Framed-IP-Address} (did %{Called-Station-Id} cli %{Calling-Station-Id} port %{NAS-Port} user %{User-Name})" success = "Allocated IP: %{reply:Framed-IP-Address} from %{control:Pool-Name} (did %{Called-Station-Id} cli %{Calling-Station-Id} port %{NAS-Port} user %{User-Name})" clear = "Released IP %{Framed-IP-Address} (did %{Called-Station-Id} cli %{Calling-Station-Id} user %{User-Name})" failed = "IP Allocation FAILED from %{control:Pool-Name} (did %{Called-Station-Id} cli %{Calling-Station-Id} port %{NAS-Port} user %{User-Name})" nopool = "No Pool-Name defined (did %{Called-Station-Id} cli %{Calling-Station-Id} port %{NAS-Port} user %{User-Name})" } } } # modules radiusd: #### Loading Virtual Servers #### server { # from file /usr/local/etc/raddb/radiusd.conf } # server server dhcp { # from file /usr/local/etc/raddb/sites-enabled/dhcp_pool # Loading dictionary.dhcp # Loading dhcp DHCP-Discover {...} # Loading dhcp DHCP-Request {...} # Loading dhcp DHCP-Release {...} # Loading dhcp DHCP-Inform {...} # Loading dhcp DHCP-Decline {...} # Loading dhcp {...} } # server dhcp radiusd: #### Opening IP addresses and Ports #### listen { type = "dhcp" ipaddr = 0.0.0.0 port = 67 } Listening on dhcp interface eth1 address * port 67 as server dhcp Ready to process requests Received DHCP-Discover of id cf875833 from 10.180.1.1:67 to 10.160.0.254:67 Threads: total/active/spare threads = 0/0/0 Something is blocking the server. There are 0 packets in the queue, waiting to be processed. Ignoring the new request. (0) Cleaning up request packet ID 3481753651 with timestamp +302

3 8