- Freeradius-Users - lists.freeradius.org

I don't want to see clear text password in debug mode
by Roberto Carna 06 Aug '13

06 Aug '13

Dear, when I execute "freeradius -X" the daemon starts in debug mode. After that when a any user authenticate againts freradisu service, I can see in the screen something like this: [sql] expand: %{User-Name} -> roberto [sql] sql_set_user escaped user --> 'roberto' [sql] expand: %{User-Password} -> 123456 My password is encrypted with MD5 but it can be seen in the debug screen. Is there any way to disallow or masquerade the use's password in debug mode ??? Really thanks, Roberto

3 2

pptpd mschap auth fails
by Horatiu Nimigean 06 Aug '13

06 Aug '13

i have pptpd on a centos 6 box configured to use radius for auth. radius in turn checks credentials in ldap. the user in ldap has a samba extension and a configured password (i used ldap account manager to set it up) it also has a sambaNTPassword field and it's populated. rpm -q freeradius gives freeradius-2.1.12-4.el6_3.x86_64 the auth fails however when i try conencting from my windows8 client. i need to mention that i am sure i'm inputting correct passwords. this is the log from radiusd -X rad_recv: Access-Request packet from host 127.0.0.1 port 49338, id=12, length=152 Service-Type = Framed-User Framed-Protocol = PPP User-Name = "testuser1" MS-CHAP-Challenge = 0x09235ac983790fedc6ccf93af69b67bf MS-CHAP2-Response = 0x5e004a81f91bcf75cd6452c64bd587a74f210000000000000000ff5eaa8a5df6639683423ed294074ceb705105d5d762932d Calling-Station-Id = "***.***.***.***" - edited out NAS-IP-Address = 127.0.0.1 NAS-Port = 0 # Executing section authorize from file /etc/raddb/sites-enabled/default +- entering group authorize {...} ++[preprocess] returns ok ++[chap] returns noop [mschap] Found MS-CHAP attributes. Setting 'Auth-Type = mschap' ++[mschap] returns ok ++[digest] returns noop [suffix] No '@' in User-Name = "testuser1", looking up realm NULL [suffix] No such realm "NULL" ++[suffix] returns noop [eap] No EAP-Message, not doing EAP ++[eap] returns noop [files] users: Matched entry DEFAULT at line 172 ++[files] returns ok [ldap] performing user authorization for testuser1 [ldap] expand: %{Stripped-User-Name} -> [ldap] ... expanding second conditional [ldap] expand: %{User-Name} -> testuser1 [ldap] expand: (uid=%{%{Stripped-User-Name}:-%{User-Name}}) -> (uid=testuser1) [ldap] expand: dc=my-domain,dc=com -> dc=my-domain,dc=com - edited out [ldap] ldap_get_conn: Checking Id: 0 [ldap] ldap_get_conn: Got Id: 0 [ldap] performing search in dc=my-domain,dc=com, with filter (uid=testuser1) [ldap] looking for check items in directory... [ldap] userPassword -> Password-With-Header == "{SSHA}YQwkujoqTZAKF1Jl1e1JRxKKvDVVRGYv" [ldap] sambaNtPassword -> NT-Password == 0x3331443643464530443136414539333142373343353944374530433038394330 [ldap] looking for reply items in directory... [ldap] user testuser1 authorized to use remote access [ldap] ldap_release_conn: Release Id: 0 ++[ldap] returns ok ++[expiration] returns noop ++[logintime] returns noop [pap] Normalizing NT-Password from hex encoding [pap] Normalizing SSHA1-Password from base64 encoding [pap] WARNING: Auth-Type already set. Not setting to PAP ++[pap] returns noop Found Auth-Type = MSCHAP # Executing group from file /etc/raddb/sites-enabled/default +- entering group MS-CHAP {...} [mschap] No Cleartext-Password configured. Cannot create LM-Password. [mschap] Found NT-Password [mschap] Creating challenge hash with username: testuser1 [mschap] Told to do MS-CHAPv2 for testuser1 with NT-Password [mschap] FAILED: MS-CHAP2-Response is incorrect ++[mschap] returns reject Failed to authenticate the user. Using Post-Auth-Type Reject # Executing group from file /etc/raddb/sites-enabled/default +- entering group REJECT {...} [attr_filter.access_reject] expand: %{User-Name} -> testuser1 attr_filter: Matched entry DEFAULT at line 11 ++[attr_filter.access_reject] returns updated Delaying reject of request 4 for 1 seconds Going to the next request Waking up in 0.9 seconds. Sending delayed reject for request 4 Sending Access-Reject of id 12 to 127.0.0.1 port 49338 MS-CHAP-Error = "^E=691 R=1 C=50685502b0ea6334450d0cd8077ac242 V=3 M=Re-enter (or reset) the password" Waking up in 4.9 seconds. Cleaning up request 4 ID 12 with timestamp +801 Ready to process requests.

3 4

SQL-Relay log - radacctdir - High Disk usage
by Alisson 06 Aug '13

06 Aug '13

Hi, I have a high disk utilization because the SQL-RELAY Log. I have this var: radacctdir whats the objetive to keep this log? can I disable it? radacctdir = /var/log/radius/radacct thank you

2 6

Re: Auth by NAS-Identifier using unlang
by Alan Buxey 06 Aug '13

06 Aug '13

I assume that's the freeradius2 package rather than freeradius as 1.x doesn't have unlang alan

2 1

Re: Diffrent authentication based by SSID
by Marcin 06 Aug '13

06 Aug '13

Thank You for reply Alan. I have working eap-tls for my staff and Dnia 5 sierpnia 2013 21:52 A.L.M.Buxey(a)lboro.ac.uk napisał(a): Hi, > In that situation i need to have active, both sql and ldap, authorization > modules in inner-tunnel. So users, who should identify by login/pass in > guest SSID, can be authenticate via inner-tunnel ldap module. I don't want > this. use whatever you want to use. what do you use now? all you need to do is distinguish between the two types of requests. and handle them how you want. will the guest SSID be 802.1X if so, inner-tunnel is available by default (as thats used for EAP) - if not, then you wont configure anything in there. each SSID will be presented to your RADIUS server with particular attributes...you will be able to use those to decide what to do.... eg if (%{whatever-attribute} =~ /sometext/ ) { ldap } else { sql } that sort of thing. and to be honest. you WILL need some decent data source for advancing your RADIUS into something scalable and usable...ie SQL or LDAP - sticking with a flat users file will end up with tears in most systems. alan - List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html

1 0

Auth by NAS-Identifier using unlang
by Joseph Perrin 06 Aug '13

06 Aug '13

I was thinking this should be easy, but it's been two weeks and I give up... This is what I want to do: My NAS, (a WiFi AP), has two SSIDs: "staff" and "guests". I want mutual exclusivity. My /etc/raddb/users file contains something like this: abc Cleartext-Password:="xyz" Local-Group="staff" I've created an attribute in my /etc/raddb/dictionary file: ATTRIBUTE Local-Group 3000 string In my /etc/raddb/sites-enabled/default file, in the authorize section, I've got this: if ( Local-Group != NAS-Identifier ) { update reply { Reply-Message := "You may not connect to %{NAS-Identifier} AP.\r\n" } reject } My access request looks something like this: (edited for brevity.) User-Name = "abc" NAS-IP-Address = 192.168.8.253 NAS-Port = 0 NAS-Identifier = "guests" NAS-Port-Type = Wireless-802.11 Calling-Station-Id = "..." Called-Station-Id = "..." Service-Type = Login-User Framed-MTU = 1100 EAP-Message =... State = ... Aruba-Essid-Name = "test" Aruba-Location-Id = "wifi" Aruba-AP-Group = "Our WiFi" Running radiusd -X I get: : ++? if (Local-Group != NAS-Identifier ) (Attribute Local-Group was not found) ? Evaluating (Local-Group != NAS-Identifier ) -> FALSE ++? if (Local-Group != NAS-Identifier ) -> FALSE : And it's clear Local-Group is always empty. :-( Some things I've tried: -Moved code to post-auth section instead of authorize. -Different attributes instead of private dictionary. (i.e. Group-Name) -Running an executable, (actually works, but selinux appears to be a problem?) -Changing the test from != to == makes things work as expected, so if the comparison will actually work, I'm good. I'm clearly not understanding something.... -Joseph

4 8

Diffrent authentication based by SSID
by Marcin 05 Aug '13

05 Aug '13

Hi. I'm new with FreeRadius. I would like to use FreeRadius to authenticate two groups of users. One group for local staff based on eap-tls, second group to others based on OpenLdap authentication. My AP's have 2 SSID's broadcasting. One for the staff, second for others. Is there a possibility, to use one radius server to handle this scenario? Regards Marcin

3 4

Limit internet bandwidth but not local
by Fabrizio 05 Aug '13

05 Aug '13

2 1

Secure tunnel to freeradius
by Rahul Godbole 05 Aug '13

05 Aug '13

Hi We have a a supplicant that is our own box doing client 802.1x authentication using freeradius. We do not establish a TLS/IPSec connection between the supplicant and freeradius. We need to establish a secure channel between the supplicant and freeradius. Can someone please tell me whether any such thing is supported in radius? Is yes, it would be great if I you could point me to the corresponding config files and code. Thanks Rahul

3 6

Freeradius -username for authentication is not picking from users file.
by rajeev sr 05 Aug '13

05 Aug '13

Hello, I am trying to run the radtest on local machine which is CentOS 6.0. But am getting the following error while sending the Access Request message from client which is another machine. The user name is defined in users file under /usr/local/etc/raddb. But still am getting the error. I had provided the snapshot received on radiusd –Xx in the end. Can you please help me in figuring out the issue? rad_recv: Access-Request packet from host 10.100.111.2 port 4061, id=60, length=77 User-Name = "rajeev" User-Password = "\334a\004\305\355x\321\332G\306\362b\226~\355+" NAS-IP-Address = 135.250.14.111 NAS-Identifier = "login" NAS-Port = 3036 NAS-Port-Type = Virtual Service-Type = Authenticate-Only Fri Aug 2 16:45:38 2013 : Info: # Executing section authorize from file /usr/local/etc/raddb/sites-enabled/default Fri Aug 2 16:45:38 2013 : Info: +- entering group authorize {...} Fri Aug 2 16:45:38 2013 : Info: ++[preprocess] returns ok Fri Aug 2 16:45:38 2013 : Info: [suffix] No '@' in User-Name = "rajeev", looking up realm NULL Fri Aug 2 16:45:38 2013 : Info: [suffix] No such realm "NULL" Radius -X Snapshot: =~=~=~=~=~=~=~=~=~=~=~= PuTTY log 2013.08.02 16:40:08 =~=~=~=~=~=~=~=~=~=~=~= pwdradiusd -Xx Fri Aug 2 16:45:25 2013 : Info: FreeRADIUS Version 2.2.0, for host x86_64-unknown-linux-gnu, built on Aug 1 2013 at 17:38:57 Fri Aug 2 16:45:25 2013 : Info: Copyright (C) 1999-2012 The FreeRADIUS server project and contributors. Fri Aug 2 16:45:25 2013 : Info: There is NO warranty; not even for MERCHANTABILITY or FITNESS FOR A Fri Aug 2 16:45:25 2013 : Info: PARTICULAR PURPOSE. Fri Aug 2 16:45:25 2013 : Info: You may redistribute copies of FreeRADIUS under the terms of the Fri Aug 2 16:45:25 2013 : Info: GNU General Public License v2. Fri Aug 2 16:45:25 2013 : Info: Starting - reading configuration files ... Fri Aug 2 16:45:25 2013 : Debug: including configuration file /usr/local/etc/raddb/radiusd.conf Fri Aug 2 16:45:25 2013 : Debug: including configuration file /usr/local/etc/raddb/clients.conf Fri Aug 2 16:45:25 2013 : Debug: including files in directory /usr/local/etc/raddb/modules/ Fri Aug 2 16:45:25 2013 : Debug: including configuration file /usr/local/etc/raddb/modules/mac2vlan Fri Aug 2 16:45:25 2013 : Debug: including configuration file /usr/local/etc/raddb/modules/radrelay Fri Aug 2 16:45:25 2013 : Debug: including configuration file /usr/local/etc/raddb/modules/radutmp Fri Aug 2 16:45:25 2013 : Debug: including configuration file /usr/local/etc/raddb/modules/files Fri Aug 2 16:45:25 2013 : Debug: including configuration file /usr/local/etc/raddb/modules/passwd Fri Aug 2 16:45:25 2013 : Debug: including configuration file /usr/local/etc/raddb/modules/attr_filter Fri Aug 2 16:45:25 2013 : Debug: including configuration file /usr/local/etc/raddb/modules/digest Fri Aug 2 16:45:25 2013 : Debug: including configuration file /usr/local/etc/raddb/modules/sql_log Fri Aug 2 16:45:25 2013 : Debug: including configuration file /usr/local/etc/raddb/modules/policy Fri Aug 2 16:45:25 2013 : Debug: including configuration file /usr/local/etc/raddb/modules/chap Fri Aug 2 16:45:25 2013 : Debug: including configuration file /usr/local/etc/raddb/modules/counter Fri Aug 2 16:45:25 2013 : Debug: including configuration file /usr/local/etc/raddb/modules/preprocess Fri Aug 2 16:45:25 2013 : Debug: including configuration file /usr/local/etc/raddb/modules/inner-eap Fri Aug 2 16:45:25 2013 : Debug: including configuration file /usr/local/etc/raddb/modules/opendirectory Fri Aug 2 16:45:25 2013 : Debug: including configuration file /usr/local/etc/raddb/modules/mac2ip Fri Aug 2 16:45:25 2013 : Debug: including configuration file /usr/local/etc/raddb/modules/wimax Fri Aug 2 16:45:25 2013 : Debug: including configuration file /usr/local/etc/raddb/modules/unix Fri Aug 2 16:45:25 2013 : Debug: including configuration file /usr/local/etc/raddb/modules/rediswho Fri Aug 2 16:45:25 2013 : Debug: including configuration file /usr/local/etc/raddb/modules/krb5 Fri Aug 2 16:45:25 2013 : Debug: including configuration file /usr/local/etc/raddb/modules/checkval Fri Aug 2 16:45:25 2013 : Debug: including configuration file /usr/local/etc/raddb/modules/ldap Fri Aug 2 16:45:25 2013 : Debug: including configuration file /usr/local/etc/raddb/modules/attr_rewrite Fri Aug 2 16:45:25 2013 : Debug: including configuration file /usr/local/etc/raddb/modules/sqlcounter_expire_on_login Fri Aug 2 16:45:25 2013 : Debug: including configuration file /usr/local/etc/raddb/modules/pam Fri Aug 2 16:45:25 2013 : Debug: including configuration file /usr/local/etc/raddb/modules/detail.log Fri Aug 2 16:45:25 2013 : Debug: including configuration file /usr/local/etc/raddb/modules/linelog Fri Aug 2 16:45:25 2013 : Debug: including configuration file /usr/local/etc/raddb/modules/realm Fri Aug 2 16:45:25 2013 : Debug: including configuration file /usr/local/etc/raddb/modules/expr Fri Aug 2 16:45:25 2013 : Debug: including configuration file /usr/local/etc/raddb/modules/dhcp_sqlippool Fri Aug 2 16:45:25 2013 : Debug: including configuration file /usr/local/etc/raddb/sql/mysql/ippool-dhcp.conf Fri Aug 2 16:45:25 2013 : Debug: including configuration file /usr/local/etc/raddb/modules/ntlm_auth Fri Aug 2 16:45:25 2013 : Debug: including configuration file /usr/local/etc/raddb/modules/cui Fri Aug 2 16:45:25 2013 : Debug: including configuration file /usr/local/etc/raddb/modules/exec Fri Aug 2 16:45:25 2013 : Debug: including configuration file /usr/local/etc/raddb/modules/etc_group Fri Aug 2 16:45:25 2013 : Debug: including configuration file /usr/local/etc/raddb/modules/detail.example.com Fri Aug 2 16:45:25 2013 : Debug: including configuration file /usr/local/etc/raddb/modules/smbpasswd Fri Aug 2 16:45:25 2013 : Debug: including configuration file /usr/local/etc/raddb/modules/dynamic_clients Fri Aug 2 16:45:25 2013 : Debug: including configuration file /usr/local/etc/raddb/modules/smsotp Fri Aug 2 16:45:25 2013 : Debug: including configuration file /usr/local/etc/raddb/modules/logintime Fri Aug 2 16:45:25 2013 : Debug: including configuration file /usr/local/etc/raddb/modules/replicate Fri Aug 2 16:45:25 2013 : Debug: including configuration file /usr/local/etc/raddb/modules/acct_unique Fri Aug 2 16:45:25 2013 : Debug: including configuration file /usr/local/etc/raddb/modules/detail Fri Aug 2 16:45:25 2013 : Debug: including configuration file /usr/local/etc/raddb/modules/pap Fri Aug 2 16:45:25 2013 : Debug: including configuration file /usr/local/etc/raddb/modules/ippool Fri Aug 2 16:45:25 2013 : Debug: including configuration file /usr/local/etc/raddb/modules/expiration Fri Aug 2 16:45:25 2013 : Debug: including configuration file /usr/local/etc/raddb/modules/redis Fri Aug 2 16:45:25 2013 : Debug: including configuration file /usr/local/etc/raddb/modules/echo Fri Aug 2 16:45:25 2013 : Debug: including configuration file /usr/local/etc/raddb/modules/otp Fri Aug 2 16:45:25 2013 : Debug: including configuration file /usr/local/etc/raddb/modules/cache Fri Aug 2 16:45:25 2013 : Debug: including configuration file /usr/local/etc/raddb/modules/perl Fri Aug 2 16:45:25 2013 : Debug: including configuration file /usr/local/etc/raddb/modules/mschap Fri Aug 2 16:45:25 2013 : Debug: including configuration file /usr/local/etc/raddb/modules/sradutmp Fri Aug 2 16:45:25 2013 : Debug: including configuration file /usr/local/etc/raddb/modules/soh Fri Aug 2 16:45:25 2013 : Debug: including configuration file /usr/local/etc/raddb/modules/always Fri Aug 2 16:45:25 2013 : Debug: including configuration file /usr/local/etc/raddb/eap.conf Fri Aug 2 16:45:25 2013 : Debug: including configuration file /usr/local/etc/raddb/policy.conf Fri Aug 2 16:45:25 2013 : Debug: including files in directory /usr/local/etc/raddb/sites-enabled/ Fri Aug 2 16:45:25 2013 : Debug: including configuration file /usr/local/etc/raddb/sites-enabled/inner-tunnel Fri Aug 2 16:45:25 2013 : Debug: including configuration file /usr/local/etc/raddb/sites-enabled/default Fri Aug 2 16:45:25 2013 : Debug: including configuration file /usr/local/etc/raddb/sites-enabled/control-socket Fri Aug 2 16:45:25 2013 : Debug: main { Fri Aug 2 16:45:25 2013 : Debug: allow_core_dumps = no Fri Aug 2 16:45:25 2013 : Debug: } Fri Aug 2 16:45:25 2013 : Debug: including dictionary file /usr/local/etc/raddb/dictionary Fri Aug 2 16:45:25 2013 : Debug: main { Fri Aug 2 16:45:25 2013 : Debug: name = "radiusd" Fri Aug 2 16:45:25 2013 : Debug: prefix = "/usr/local" Fri Aug 2 16:45:25 2013 : Debug: localstatedir = "/usr/local/var" Fri Aug 2 16:45:25 2013 : Debug: sbindir = "/usr/local/sbin" Fri Aug 2 16:45:25 2013 : Debug: logdir = "/usr/local/var/log/radius" Fri Aug 2 16:45:25 2013 : Debug: run_dir = "/usr/local/var/run/radiusd" Fri Aug 2 16:45:25 2013 : Debug: libdir = "/usr/local/lib" Fri Aug 2 16:45:25 2013 : Debug: radacctdir = "/usr/local/var/log/radius/radacct" Fri Aug 2 16:45:25 2013 : Debug: hostname_lookups = no Fri Aug 2 16:45:25 2013 : Debug: max_request_time = 30 Fri Aug 2 16:45:25 2013 : Debug: cleanup_delay = 5 Fri Aug 2 16:45:25 2013 : Debug: max_requests = 1024 Fri Aug 2 16:45:25 2013 : Debug: pidfile = "/usr/local/var/run/radiusd/radiusd.pid" Fri Aug 2 16:45:25 2013 : Debug: checkrad = "/usr/local/sbin/checkrad" Fri Aug 2 16:45:25 2013 : Debug: debug_level = 0 Fri Aug 2 16:45:25 2013 : Debug: proxy_requests = no Fri Aug 2 16:45:25 2013 : Debug: log { Fri Aug 2 16:45:25 2013 : Debug: stripped_names = no Fri Aug 2 16:45:25 2013 : Debug: auth = no Fri Aug 2 16:45:25 2013 : Debug: auth_badpass = no Fri Aug 2 16:45:25 2013 : Debug: auth_goodpass = no Fri Aug 2 16:45:25 2013 : Debug: } Fri Aug 2 16:45:25 2013 : Debug: security { Fri Aug 2 16:45:25 2013 : Debug: max_attributes = 200 Fri Aug 2 16:45:25 2013 : Debug: reject_delay = 1 Fri Aug 2 16:45:25 2013 : Debug: status_server = yes Fri Aug 2 16:45:25 2013 : Debug: } Fri Aug 2 16:45:25 2013 : Debug: } Fri Aug 2 16:45:25 2013 : Debug: radiusd: #### Loading Realms and Home Servers #### Fri Aug 2 16:45:25 2013 : Debug: radiusd: #### Loading Clients #### Fri Aug 2 16:45:25 2013 : Debug: client 10.100.111.0/24 { Fri Aug 2 16:45:25 2013 : Debug: require_message_authenticator = no Fri Aug 2 16:45:25 2013 : Debug: secret = "ABC123" Fri Aug 2 16:45:25 2013 : Debug: shortname = "BTS111" Fri Aug 2 16:45:25 2013 : Debug: } Fri Aug 2 16:45:25 2013 : Debug: client 10.100.111.2/24 { Fri Aug 2 16:45:25 2013 : Debug: ipaddr = 10.100.111.2 Fri Aug 2 16:45:25 2013 : Debug: require_message_authenticator = no Fri Aug 2 16:45:25 2013 : Debug: secret = "ABC123" Fri Aug 2 16:45:25 2013 : Debug: shortname = "BTS111" Fri Aug 2 16:45:25 2013 : Debug: nastype = "other" Fri Aug 2 16:45:25 2013 : Debug: } Fri Aug 2 16:45:25 2013 : Debug: radiusd: #### Instantiating modules #### Fri Aug 2 16:45:25 2013 : Debug: instantiate { Fri Aug 2 16:45:25 2013 : Debug: (Loaded rlm_exec, checking if it's valid) Fri Aug 2 16:45:25 2013 : Debug: Module: Linked to module rlm_exec Fri Aug 2 16:45:25 2013 : Debug: Module: Instantiating module "exec" from file /usr/local/etc/raddb/modules/exec Fri Aug 2 16:45:25 2013 : Debug: exec { Fri Aug 2 16:45:25 2013 : Debug: wait = no Fri Aug 2 16:45:25 2013 : Debug: input_pairs = "request" Fri Aug 2 16:45:25 2013 : Debug: shell_escape = yes Fri Aug 2 16:45:25 2013 : Debug: } Fri Aug 2 16:45:25 2013 : Debug: (Loaded rlm_expr, checking if it's valid) Fri Aug 2 16:45:25 2013 : Debug: Module: Linked to module rlm_expr Fri Aug 2 16:45:25 2013 : Debug: Module: Instantiating module "expr" from file /usr/local/etc/raddb/modules/expr Fri Aug 2 16:45:25 2013 : Debug: (Loaded rlm_expiration, checking if it's valid) Fri Aug 2 16:45:25 2013 : Debug: Module: Linked to module rlm_expiration Fri Aug 2 16:45:25 2013 : Debug: Module: Instantiating module "expiration" from file /usr/local/etc/raddb/modules/expiration Fri Aug 2 16:45:25 2013 : Debug: expiration { Fri Aug 2 16:45:25 2013 : Debug: reply-message = "Password Has Expired " Fri Aug 2 16:45:25 2013 : Debug: } Fri Aug 2 16:45:25 2013 : Debug: (Loaded rlm_logintime, checking if it's valid) Fri Aug 2 16:45:25 2013 : Debug: Module: Linked to module rlm_logintime Fri Aug 2 16:45:25 2013 : Debug: Module: Instantiating module "logintime" from file /usr/local/etc/raddb/modules/logintime Fri Aug 2 16:45:25 2013 : Debug: logintime { Fri Aug 2 16:45:25 2013 : Debug: reply-message = "You are calling outside your allowed timespan " Fri Aug 2 16:45:25 2013 : Debug: minimum-timeout = 60 Fri Aug 2 16:45:25 2013 : Debug: } Fri Aug 2 16:45:25 2013 : Debug: } Fri Aug 2 16:45:25 2013 : Debug: radiusd: #### Loading Virtual Servers #### Fri Aug 2 16:45:25 2013 : Debug: server { # from file /usr/local/etc/raddb/radiusd.conf Fri Aug 2 16:45:25 2013 : Debug: modules { Fri Aug 2 16:45:25 2013 : Debug: Module: Creating Auth-Type = digest Fri Aug 2 16:45:25 2013 : Debug: Module: Creating Post-Auth-Type = REJECT Fri Aug 2 16:45:25 2013 : Debug: Module: Checking authenticate {...} for more modules to load Fri Aug 2 16:45:25 2013 : Debug: (Loaded rlm_pap, checking if it's valid) Fri Aug 2 16:45:25 2013 : Debug: Module: Linked to module rlm_pap Fri Aug 2 16:45:25 2013 : Debug: Module: Instantiating module "pap" from file /usr/local/etc/raddb/modules/pap Fri Aug 2 16:45:25 2013 : Debug: pap { Fri Aug 2 16:45:25 2013 : Debug: encryption_scheme = "auto" Fri Aug 2 16:45:25 2013 : Debug: auto_header = no Fri Aug 2 16:45:25 2013 : Debug: } Fri Aug 2 16:45:25 2013 : Debug: (Loaded rlm_chap, checking if it's valid) Fri Aug 2 16:45:25 2013 : Debug: Module: Linked to module rlm_chap Fri Aug 2 16:45:25 2013 : Debug: Module: Instantiating module "chap" from file /usr/local/etc/raddb/modules/chap Fri Aug 2 16:45:25 2013 : Debug: (Loaded rlm_mschap, checking if it's valid) Fri Aug 2 16:45:25 2013 : Debug: Module: Linked to module rlm_mschap Fri Aug 2 16:45:25 2013 : Debug: Module: Instantiating module "mschap" from file /usr/local/etc/raddb/modules/mschap Fri Aug 2 16:45:25 2013 : Debug: mschap { Fri Aug 2 16:45:25 2013 : Debug: use_mppe = yes Fri Aug 2 16:45:25 2013 : Debug: require_encryption = no Fri Aug 2 16:45:25 2013 : Debug: require_strong = no Fri Aug 2 16:45:25 2013 : Debug: with_ntdomain_hack = no Fri Aug 2 16:45:25 2013 : Debug: allow_retry = yes Fri Aug 2 16:45:25 2013 : Debug: } Fri Aug 2 16:45:25 2013 : Debug: (Loaded rlm_digest, checking if it's valid) Fri Aug 2 16:45:25 2013 : Debug: Module: Linked to module rlm_digest Fri Aug 2 16:45:25 2013 : Debug: Module: Instantiating module "digest" from file /usr/local/etc/raddb/modules/digest Fri Aug 2 16:45:25 2013 : Debug: (Loaded rlm_unix, checking if it's valid) Fri Aug 2 16:45:25 2013 : Debug: Module: Linked to module rlm_unix Fri Aug 2 16:45:25 2013 : Debug: Module: Instantiating module "unix" from file /usr/local/etc/raddb/modules/unix Fri Aug 2 16:45:25 2013 : Debug: unix { Fri Aug 2 16:45:25 2013 : Debug: radwtmp = "/usr/local/var/log/radius/radwtmp" Fri Aug 2 16:45:25 2013 : Debug: } Fri Aug 2 16:45:25 2013 : Debug: (Loaded rlm_eap, checking if it's valid) Fri Aug 2 16:45:25 2013 : Debug: Module: Linked to module rlm_eap Fri Aug 2 16:45:25 2013 : Debug: Module: Instantiating module "eap" from file /usr/local/etc/raddb/eap.conf Fri Aug 2 16:45:25 2013 : Debug: eap { Fri Aug 2 16:45:25 2013 : Debug: default_eap_type = "md5" Fri Aug 2 16:45:25 2013 : Debug: timer_expire = 60 Fri Aug 2 16:45:25 2013 : Debug: ignore_unknown_eap_types = no Fri Aug 2 16:45:25 2013 : Debug: cisco_accounting_username_bug = no Fri Aug 2 16:45:25 2013 : Debug: max_sessions = 4096 Fri Aug 2 16:45:25 2013 : Debug: } Fri Aug 2 16:45:25 2013 : Debug: Module: Linked to sub-module rlm_eap_md5 Fri Aug 2 16:45:25 2013 : Debug: Module: Instantiating eap-md5 Fri Aug 2 16:45:25 2013 : Debug: Module: Linked to sub-module rlm_eap_leap Fri Aug 2 16:45:25 2013 : Debug: Module: Instantiating eap-leap Fri Aug 2 16:45:25 2013 : Debug: Module: Linked to sub-module rlm_eap_gtc Fri Aug 2 16:45:25 2013 : Debug: Module: Instantiating eap-gtc Fri Aug 2 16:45:25 2013 : Debug: gtc { Fri Aug 2 16:45:25 2013 : Debug: challenge = "Password: " Fri Aug 2 16:45:25 2013 : Debug: auth_type = "PAP" Fri Aug 2 16:45:25 2013 : Debug: } Fri Aug 2 16:45:25 2013 : Debug: Module: Linked to sub-module rlm_eap_tls Fri Aug 2 16:45:25 2013 : Debug: Module: Instantiating eap-tls Fri Aug 2 16:45:25 2013 : Debug: tls { Fri Aug 2 16:45:25 2013 : Debug: rsa_key_exchange = no Fri Aug 2 16:45:25 2013 : Debug: dh_key_exchange = yes Fri Aug 2 16:45:25 2013 : Debug: rsa_key_length = 512 Fri Aug 2 16:45:25 2013 : Debug: dh_key_length = 512 Fri Aug 2 16:45:25 2013 : Debug: verify_depth = 0 Fri Aug 2 16:45:25 2013 : Debug: CA_path = "/usr/local/etc/raddb/certs" Fri Aug 2 16:45:25 2013 : Debug: pem_file_type = yes Fri Aug 2 16:45:25 2013 : Debug: private_key_file = "/usr/local/etc/raddb/certs/server.pem" Fri Aug 2 16:45:25 2013 : Debug: certificate_file = "/usr/local/etc/raddb/certs/server.pem" Fri Aug 2 16:45:25 2013 : Debug: CA_file = "/usr/local/etc/raddb/certs/ca.pem" Fri Aug 2 16:45:25 2013 : Debug: private_key_password = "whatever" Fri Aug 2 16:45:25 2013 : Debug: dh_file = "/usr/local/etc/raddb/certs/dh" Fri Aug 2 16:45:25 2013 : Debug: random_file = "/usr/local/etc/raddb/certs/random" Fri Aug 2 16:45:25 2013 : Debug: fragment_size = 1024 Fri Aug 2 16:45:25 2013 : Debug: include_length = yes Fri Aug 2 16:45:25 2013 : Debug: check_crl = no Fri Aug 2 16:45:25 2013 : Debug: cipher_list = "DEFAULT" Fri Aug 2 16:45:25 2013 : Debug: make_cert_command = "/usr/local/etc/raddb/certs/bootstrap" Fri Aug 2 16:45:25 2013 : Debug: cache { Fri Aug 2 16:45:25 2013 : Debug: enable = no Fri Aug 2 16:45:25 2013 : Debug: lifetime = 24 Fri Aug 2 16:45:25 2013 : Debug: max_entries = 255 Fri Aug 2 16:45:25 2013 : Debug: } Fri Aug 2 16:45:25 2013 : Debug: verify { Fri Aug 2 16:45:25 2013 : Debug: } Fri Aug 2 16:45:25 2013 : Debug: ocsp { Fri Aug 2 16:45:25 2013 : Debug: enable = no Fri Aug 2 16:45:25 2013 : Debug: override_cert_url = yes Fri Aug 2 16:45:25 2013 : Debug: url = "http://127.0.0.1/ocsp/" Fri Aug 2 16:45:25 2013 : Debug: use_nonce = yes Fri Aug 2 16:45:25 2013 : Debug: timeout = 0 Fri Aug 2 16:45:25 2013 : Debug: softfail = no Fri Aug 2 16:45:25 2013 : Debug: } Fri Aug 2 16:45:25 2013 : Debug: } Fri Aug 2 16:45:25 2013 : Debug: Module: Linked to sub-module rlm_eap_ttls Fri Aug 2 16:45:25 2013 : Debug: Module: Instantiating eap-ttls Fri Aug 2 16:45:25 2013 : Debug: ttls { Fri Aug 2 16:45:25 2013 : Debug: default_eap_type = "md5" Fri Aug 2 16:45:25 2013 : Debug: copy_request_to_tunnel = no Fri Aug 2 16:45:25 2013 : Debug: use_tunneled_reply = no Fri Aug 2 16:45:25 2013 : Debug: virtual_server = "inner-tunnel" Fri Aug 2 16:45:25 2013 : Debug: include_length = yes Fri Aug 2 16:45:25 2013 : Debug: } Fri Aug 2 16:45:25 2013 : Debug: Module: Linked to sub-module rlm_eap_peap Fri Aug 2 16:45:25 2013 : Debug: Module: Instantiating eap-peap Fri Aug 2 16:45:25 2013 : Debug: peap { Fri Aug 2 16:45:25 2013 : Debug: default_eap_type = "mschapv2" Fri Aug 2 16:45:25 2013 : Debug: copy_request_to_tunnel = no Fri Aug 2 16:45:25 2013 : Debug: use_tunneled_reply = no Fri Aug 2 16:45:25 2013 : Debug: proxy_tunneled_request_as_eap = yes Fri Aug 2 16:45:25 2013 : Debug: virtual_server = "inner-tunnel" Fri Aug 2 16:45:25 2013 : Debug: soh = no Fri Aug 2 16:45:25 2013 : Debug: } Fri Aug 2 16:45:25 2013 : Debug: Module: Linked to sub-module rlm_eap_mschapv2 Fri Aug 2 16:45:25 2013 : Debug: Module: Instantiating eap-mschapv2 Fri Aug 2 16:45:25 2013 : Debug: mschapv2 { Fri Aug 2 16:45:25 2013 : Debug: with_ntdomain_hack = no Fri Aug 2 16:45:25 2013 : Debug: send_error = no Fri Aug 2 16:45:25 2013 : Debug: } Fri Aug 2 16:45:25 2013 : Debug: Module: Checking authorize {...} for more modules to load Fri Aug 2 16:45:25 2013 : Debug: (Loaded rlm_preprocess, checking if it's valid) Fri Aug 2 16:45:25 2013 : Debug: Module: Linked to module rlm_preprocess Fri Aug 2 16:45:25 2013 : Debug: Module: Instantiating module "preprocess" from file /usr/local/etc/raddb/modules/preprocess Fri Aug 2 16:45:25 2013 : Debug: preprocess { Fri Aug 2 16:45:25 2013 : Debug: huntgroups = "/usr/local/etc/raddb/huntgroups" Fri Aug 2 16:45:25 2013 : Debug: hints = "/usr/local/etc/raddb/hints" Fri Aug 2 16:45:25 2013 : Debug: with_ascend_hack = no Fri Aug 2 16:45:25 2013 : Debug: ascend_channels_per_line = 23 Fri Aug 2 16:45:25 2013 : Debug: with_ntdomain_hack = no Fri Aug 2 16:45:25 2013 : Debug: with_specialix_jetstream_hack = no Fri Aug 2 16:45:25 2013 : Debug: with_cisco_vsa_hack = no Fri Aug 2 16:45:25 2013 : Debug: with_alvarion_vsa_hack = no Fri Aug 2 16:45:25 2013 : Debug: } Fri Aug 2 16:45:25 2013 : Debug: reading pairlist file /usr/local/etc/raddb/huntgroups Fri Aug 2 16:45:25 2013 : Debug: reading pairlist file /usr/local/etc/raddb/hints Fri Aug 2 16:45:25 2013 : Debug: (Loaded rlm_realm, checking if it's valid) Fri Aug 2 16:45:25 2013 : Debug: Module: Linked to module rlm_realm Fri Aug 2 16:45:25 2013 : Debug: Module: Instantiating module "suffix" from file /usr/local/etc/raddb/modules/realm Fri Aug 2 16:45:25 2013 : Debug: realm suffix { Fri Aug 2 16:45:25 2013 : Debug: format = "suffix" Fri Aug 2 16:45:25 2013 : Debug: delimiter = "@" Fri Aug 2 16:45:25 2013 : Debug: ignore_default = no Fri Aug 2 16:45:25 2013 : Debug: ignore_null = no Fri Aug 2 16:45:25 2013 : Debug: } Fri Aug 2 16:45:25 2013 : Debug: Module: Checking preacct {...} for more modules to load Fri Aug 2 16:45:25 2013 : Debug: (Loaded rlm_acct_unique, checking if it's valid) Fri Aug 2 16:45:25 2013 : Debug: Module: Linked to module rlm_acct_unique Fri Aug 2 16:45:25 2013 : Debug: Module: Instantiating module "acct_unique" from file /usr/local/etc/raddb/modules/acct_unique Fri Aug 2 16:45:25 2013 : Debug: acct_unique { Fri Aug 2 16:45:25 2013 : Debug: key = "User-Name, Acct-Session-Id, NAS-IP-Address, NAS-Identifier, NAS-Port" Fri Aug 2 16:45:25 2013 : Debug: } Fri Aug 2 16:45:25 2013 : Debug: (Loaded rlm_files, checking if it's valid) Fri Aug 2 16:45:25 2013 : Debug: Module: Linked to module rlm_files Fri Aug 2 16:45:25 2013 : Debug: Module: Instantiating module "files" from file /usr/local/etc/raddb/modules/files Fri Aug 2 16:45:25 2013 : Debug: files { Fri Aug 2 16:45:25 2013 : Debug: usersfile = "/usr/local/etc/raddb/users" Fri Aug 2 16:45:25 2013 : Debug: acctusersfile = "/usr/local/etc/raddb/acct_users" Fri Aug 2 16:45:25 2013 : Debug: preproxy_usersfile = "/usr/local/etc/raddb/preproxy_users" Fri Aug 2 16:45:25 2013 : Debug: compat = "no" Fri Aug 2 16:45:25 2013 : Debug: } Fri Aug 2 16:45:25 2013 : Debug: reading pairlist file /usr/local/etc/raddb/users Fri Aug 2 16:45:25 2013 : Debug: reading pairlist file /usr/local/etc/raddb/acct_users Fri Aug 2 16:45:25 2013 : Debug: reading pairlist file /usr/local/etc/raddb/preproxy_users Fri Aug 2 16:45:25 2013 : Debug: Module: Checking accounting {...} for more modules to load Fri Aug 2 16:45:25 2013 : Debug: (Loaded rlm_detail, checking if it's valid) Fri Aug 2 16:45:25 2013 : Debug: Module: Linked to module rlm_detail Fri Aug 2 16:45:25 2013 : Debug: Module: Instantiating module "detail" from file /usr/local/etc/raddb/modules/detail Fri Aug 2 16:45:25 2013 : Debug: detail { Fri Aug 2 16:45:25 2013 : Debug: detailfile = "/usr/local/var/log/radius/radacct/%{%{Packet-Src-IP-Address}:-%{Packet-Src-IPv6-Address}}/detail-%Y%m%d" Fri Aug 2 16:45:25 2013 : Debug: header = "%t" Fri Aug 2 16:45:25 2013 : Debug: detailperm = 384 Fri Aug 2 16:45:25 2013 : Debug: dirperm = 493 Fri Aug 2 16:45:25 2013 : Debug: locking = no Fri Aug 2 16:45:25 2013 : Debug: log_packet_header = no Fri Aug 2 16:45:25 2013 : Debug: } Fri Aug 2 16:45:25 2013 : Debug: (Loaded rlm_attr_filter, checking if it's valid) Fri Aug 2 16:45:25 2013 : Debug: Module: Linked to module rlm_attr_filter Fri Aug 2 16:45:25 2013 : Debug: Module: Instantiating module "attr_filter.accounting_response" from file /usr/local/etc/raddb/modules/attr_filter Fri Aug 2 16:45:25 2013 : Debug: attr_filter attr_filter.accounting_response { Fri Aug 2 16:45:25 2013 : Debug: attrsfile = "/usr/local/etc/raddb/attrs.accounting_response" Fri Aug 2 16:45:25 2013 : Debug: key = "%{User-Name}" Fri Aug 2 16:45:25 2013 : Debug: relaxed = no Fri Aug 2 16:45:25 2013 : Debug: } Fri Aug 2 16:45:25 2013 : Debug: reading pairlist file /usr/local/etc/raddb/attrs.accounting_response Fri Aug 2 16:45:25 2013 : Debug: Module: Checking session {...} for more modules to load Fri Aug 2 16:45:25 2013 : Debug: (Loaded rlm_radutmp, checking if it's valid) Fri Aug 2 16:45:25 2013 : Debug: Module: Linked to module rlm_radutmp Fri Aug 2 16:45:25 2013 : Debug: Module: Instantiating module "radutmp" from file /usr/local/etc/raddb/modules/radutmp Fri Aug 2 16:45:25 2013 : Debug: radutmp { Fri Aug 2 16:45:25 2013 : Debug: filename = "/usr/local/var/log/radius/radutmp" Fri Aug 2 16:45:25 2013 : Debug: username = "%{User-Name}" Fri Aug 2 16:45:25 2013 : Debug: case_sensitive = yes Fri Aug 2 16:45:25 2013 : Debug: check_with_nas = yes Fri Aug 2 16:45:25 2013 : Debug: perm = 384 Fri Aug 2 16:45:25 2013 : Debug: callerid = yes Fri Aug 2 16:45:25 2013 : Debug: } Fri Aug 2 16:45:25 2013 : Debug: Module: Checking post-auth {...} for more modules to load Fri Aug 2 16:45:25 2013 : Debug: Module: Instantiating module "attr_filter.access_reject" from file /usr/local/etc/raddb/modules/attr_filter Fri Aug 2 16:45:25 2013 : Debug: attr_filter attr_filter.access_reject { Fri Aug 2 16:45:25 2013 : Debug: attrsfile = "/usr/local/etc/raddb/attrs.access_reject" Fri Aug 2 16:45:25 2013 : Debug: key = "%{User-Name}" Fri Aug 2 16:45:25 2013 : Debug: relaxed = no Fri Aug 2 16:45:25 2013 : Debug: } Fri Aug 2 16:45:25 2013 : Debug: reading pairlist file /usr/local/etc/raddb/attrs.access_reject Fri Aug 2 16:45:25 2013 : Debug: } # modules Fri Aug 2 16:45:25 2013 : Debug: } # server Fri Aug 2 16:45:25 2013 : Debug: server inner-tunnel { # from file /usr/local/etc/raddb/sites-enabled/inner-tunnel Fri Aug 2 16:45:25 2013 : Debug: modules { Fri Aug 2 16:45:25 2013 : Debug: Module: Checking authenticate {...} for more modules to load Fri Aug 2 16:45:25 2013 : Debug: Module: Checking authorize {...} for more modules to load Fri Aug 2 16:45:25 2013 : Debug: Module: Checking session {...} for more modules to load Fri Aug 2 16:45:25 2013 : Debug: Module: Checking post-proxy {...} for more modules to load Fri Aug 2 16:45:25 2013 : Debug: Module: Checking post-auth {...} for more modules to load Fri Aug 2 16:45:25 2013 : Debug: } # modules Fri Aug 2 16:45:25 2013 : Debug: } # server Fri Aug 2 16:45:25 2013 : Debug: radiusd: #### Opening IP addresses and Ports #### Fri Aug 2 16:45:25 2013 : Debug: listen { Fri Aug 2 16:45:25 2013 : Debug: type = "auth" Fri Aug 2 16:45:25 2013 : Debug: ipaddr = 10.100.111.3 Fri Aug 2 16:45:25 2013 : Debug: port = 0 Fri Aug 2 16:45:25 2013 : Debug: } Fri Aug 2 16:45:25 2013 : Debug: listen { Fri Aug 2 16:45:25 2013 : Debug: type = "acct" Fri Aug 2 16:45:25 2013 : Debug: ipaddr = 10.100.111.3 Fri Aug 2 16:45:25 2013 : Debug: port = 0 Fri Aug 2 16:45:25 2013 : Debug: } Fri Aug 2 16:45:25 2013 : Debug: listen { Fri Aug 2 16:45:25 2013 : Debug: type = "control" Fri Aug 2 16:45:25 2013 : Debug: listen { Fri Aug 2 16:45:25 2013 : Debug: socket = "/usr/local/var/run/radiusd/radiusd.sock" Fri Aug 2 16:45:25 2013 : Debug: } Fri Aug 2 16:45:25 2013 : Debug: } Fri Aug 2 16:45:25 2013 : Debug: listen { Fri Aug 2 16:45:25 2013 : Debug: type = "auth" Fri Aug 2 16:45:25 2013 : Debug: ipaddr = 127.0.0.1 Fri Aug 2 16:45:25 2013 : Debug: port = 18120 Fri Aug 2 16:45:25 2013 : Debug: } Fri Aug 2 16:45:25 2013 : Debug: Listening on authentication address 10.100.111.3 port 1812 Fri Aug 2 16:45:25 2013 : Debug: Listening on accounting interface eth1 address 10.100.111.3 port 1813 Fri Aug 2 16:45:25 2013 : Debug: Listening on command file /usr/local/var/run/radiusd/radiusd.sock Fri Aug 2 16:45:25 2013 : Debug: Listening on authentication address 127.0.0.1 port 18120 as server inner-tunnel Fri Aug 2 16:45:25 2013 : Info: Ready to process requests. rad_recv: Access-Request packet from host 10.100.111.2 port 4061, id=60, length=77 User-Name = "rajeev" User-Password = "\334a\004\305\355x\321\332G\306\362b\226~\355+" NAS-IP-Address = 135.250.14.111 NAS-Identifier = "login" NAS-Port = 3036 NAS-Port-Type = Virtual Service-Type = Authenticate-Only Fri Aug 2 16:45:38 2013 : Info: # Executing section authorize from file /usr/local/etc/raddb/sites-enabled/default Fri Aug 2 16:45:38 2013 : Info: +- entering group authorize {...} Fri Aug 2 16:45:38 2013 : Info: ++[preprocess] returns ok Fri Aug 2 16:45:38 2013 : Info: [suffix] No '@' in User-Name = "rajeev", looking up realm NULL Fri Aug 2 16:45:38 2013 : Info: [suffix] No such realm "NULL" Fri Aug 2 16:45:38 2013 : Info: ++[suffix] returns noop Fri Aug 2 16:45:38 2013 : Info: ++[expiration] returns noop Fri Aug 2 16:45:38 2013 : Info: ++[logintime] returns noop Fri Aug 2 16:45:38 2013 : Info: [pap] WARNING! No "known good" password found for the user. Authentication may fail because of this. Fri Aug 2 16:45:38 2013 : Info: ++[pap] returns noop Fri Aug 2 16:45:38 2013 : Info: ERROR: No authenticate method (Auth-Type) found for the request: Rejecting the user Fri Aug 2 16:45:38 2013 : Info: Failed to authenticate the user. Fri Aug 2 16:45:38 2013 : Debug: WARNING: Unprintable characters in the password. Double-check the shared secret on the server and the NAS! Fri Aug 2 16:45:38 2013 : Info: Using Post-Auth-Type REJECT Fri Aug 2 16:45:38 2013 : Info: # Executing group from file /usr/local/etc/raddb/sites-enabled/default Fri Aug 2 16:45:38 2013 : Info: +- entering group REJECT {...} Fri Aug 2 16:45:38 2013 : Info: [attr_filter.access_reject] expand: %{User-Name} -> rajeev Fri Aug 2 16:45:38 2013 : Debug: attr_filter: Matched entry DEFAULT at line 11 Fri Aug 2 16:45:38 2013 : Info: ++[attr_filter.access_reject] returns updated Fri Aug 2 16:45:38 2013 : Info: Delaying reject of request 0 for 1 seconds Fri Aug 2 16:45:38 2013 : Debug: Going to the next request Fri Aug 2 16:45:38 2013 : Debug: Waking up in 0.9 seconds. Fri Aug 2 16:45:39 2013 : Info: Sending delayed reject for request 0 Sending Access-Reject of id 60 to 10.100.111.2 port 4061 Fri Aug 2 16:45:39 2013 : Debug: Waking up in 4.9 seconds. Fri Aug 2 16:45:44 2013 : Info: Cleaning up request 0 ID 60 with timestamp +13 Fri Aug 2 16:45:44 2013 : Info: Ready to process requests. ^C ]0;root@radioserver:/usr/local/etc/raddb [root@radioserver raddb]# Br, Rajeev

4 3