- Freeradius-Users - lists.freeradius.org

Re: Re: Freeradius 3 & LDAP Generic Attributes
by Nicholas Lemberger 12 Apr '13

12 Apr '13

The ldap.attrmap syntax in FR2 was: checkItem $GENERIC$ radiusCheckItem replyItem $GENERIC$ radiusReplyItem Basically the ldap attributes radiusCheckItem & radiusReplyItem contained FR attr/value pairs which were then added to the corresponding attribute list in FR (e.g. in LDAP radiusReplyItem could be "Primary-DNS-Server := 1.1.1.1"). They wouldn't necessarily need to be distinct check/reply attributes in the new rlm_ldap... it could work more like unlang where an LDAP attribute value could be "control:Disabled := true", and where if the list: portion is omitted it would default to reply. No matter how this happens, there's probably going to need to be a special case syntax made in the rlm_ldap attribute mapping... Best Regards, -Nick

2 2

how can detect the cues of reject
by Mehdi Ravanbakhsh 12 Apr '13

12 Apr '13

how we can detect cues of reject in any section of default(site enable) ? do we have any internal attribute or any source that can be use for determine cues of rejecting user ? best regards.

2 2

Adding modified libraries without recompiling entirely FreeRADIUS
by yoann Couble 12 Apr '13

12 Apr '13

Hi everyone, I have a freeRADIUS 2.0.4 server which has been running well for the past two years. I am trying to integrate smoothly a modified version of the chap module. To do that I've been testing different approach on a VM for tests. With the sources downloaded from packages.debian.org, I wrote my version of rlm_chap.c. Everything compiles and works fine when i do: ./configure make make install from the source folder and run it with *radiusd*. NB: To avoid lib conflicts i remove the libs generated in /usr/local/lib during installation before i start again /usr/sbin/freeradius But now i would like to update my working version of freeradius (which was installed through an apt-get install) without causing much trouble. As I only modified rlm_chap.c I thought i could simply replace the current library /usr/lib/rlm_chap-2.0.4.so with the one produced during compilation freeradius-2.0.4/src/modules/rlm_chap/.libs/rlm_chap-2.0.4.so After that i restart freeradius (the apt-get version) with freeradius -X Everything looks fine but when i send a request i get a segmentation fault when the server tries to enter chap module. (see the debug entry further) If i go back and replace /usr/lib/freeradius/rlm_chap-2.0.4.so by the original Everything works fine again. I am pretty sure it has something to do with compilation and the way files were generated. Do you think it is possible to do what I want? i.e. inserting a modified library into the working set of library. Reinstalling the working freeradius or using the compiled files is not an possibility. If you have any idea on what I am doing wrong (I am still a beginner and I probably do a lot of things wrong), please feel free to tell me and to share with me if you had similar situations. Thanks ! Regards, Yoann Couble PS: *tldr: I want to replace chap library by a modified library of mine* Here is the debug entry ------------------------------------------------------------------------------------------------------------------------------------------- # freeradius -X FreeRADIUS Version 2.0.4, for host x86_64-pc-linux-gnu, built on Sep 11 2012 at 17:06:46 Copyright (C) 1999-2009 The FreeRADIUS server project and contributors. There is NO warranty; not even for MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. You may redistribute copies of FreeRADIUS under the terms of the GNU General Public License v2. Starting - reading configuration files ... including configuration file /etc//radiusd.conf including configuration file /etc//proxy.conf including configuration file /etc//clients.conf including files in directory /etc//modules/ including configuration file /etc//modules/digest including configuration file /etc//modules/linelog including configuration file /etc//modules/always including configuration file /etc//modules/dynamic_clients including configuration file /etc//modules/opendirectory including configuration file /etc//modules/cui including configuration file /etc//modules/unix including configuration file /etc//modules/inner-eap including configuration file /etc//modules/mschap including configuration file /etc//modules/attr_filter including configuration file /etc//modules/chap including configuration file /etc//modules/sql_log including configuration file /etc//modules/pap including configuration file /etc//modules/exec including configuration file /etc//modules/expiration including configuration file /etc//modules/ntlm_auth including configuration file /etc//modules/acct_unique including configuration file /etc//modules/counter including configuration file /etc//modules/perl including configuration file /etc//modules/checkval including configuration file /etc//modules/sqlcounter_expire_on_login including configuration file /etc//modules/logintime including configuration file /etc//modules/radutmp including configuration file /etc//modules/echo including configuration file /etc//modules/detail including configuration file /etc//modules/preprocess including configuration file /etc//modules/smsotp including configuration file /etc//modules/krb5 including configuration file /etc//modules/files including configuration file /etc//modules/sradutmp including configuration file /etc//modules/ldap including configuration file /etc//modules/realm including configuration file /etc//modules/ippool including configuration file /etc//modules/detail.example.com including configuration file /etc//modules/etc_group including configuration file /etc//modules/smbpasswd including configuration file /etc//modules/attr_rewrite including configuration file /etc//modules/passwd including configuration file /etc//modules/policy including configuration file /etc//modules/detail.log including configuration file /etc//modules/mac2ip including configuration file /etc//modules/otp including configuration file /etc//modules/pam including configuration file /etc//modules/wimax including configuration file /etc//modules/expr including configuration file /etc//modules/mac2vlan including configuration file /etc//eap.conf including configuration file /etc//sql.conf including configuration file /etc//sql//dialup.conf including configuration file /etc//policy.conf including files in directory /etc//sites-enabled/ including configuration file /etc//sites-enabled/default including configuration file /etc//sites-enabled/inner-tunnel main { user = "freerad" group = "freerad" allow_core_dumps = no } including dictionary file /etc//dictionary main { prefix = "/usr" localstatedir = "/var" logdir = "/var/log/freeradius" libdir = "/usr/lib/freeradius" radacctdir = "/var/log/freeradius/radacct" hostname_lookups = no max_request_time = 30 cleanup_delay = 5 max_requests = 1024 pidfile = "/var/run/freeradius/freeradius.pid" checkrad = "/usr/sbin/checkrad" debug_level = 0 proxy_requests = yes log { stripped_names = no auth = no auth_badpass = no auth_goodpass = no } security { max_attributes = 200 reject_delay = 1 status_server = yes } } radiusd: #### Loading Realms and Home Servers #### proxy server { retry_delay = 5 retry_count = 3 default_fallback = no dead_time = 120 wake_all_if_all_dead = no } home_server localhost { ipaddr = 127.0.0.1 port = 1812 type = "auth" secret = "testing123" response_window = 20 max_outstanding = 65536 require_message_authenticator = yes zombie_period = 40 status_check = "status-server" ping_interval = 30 check_interval = 30 num_answers_to_alive = 3 num_pings_to_alive = 3 revive_interval = 120 status_check_timeout = 4 irt = 2 mrt = 16 mrc = 5 mrd = 30 } home_server_pool my_auth_failover { type = fail-over home_server = localhost } realm example.com { auth_pool = my_auth_failover } realm LOCAL { } radiusd: #### Loading Clients #### client 0.0.0.0/1 { require_message_authenticator = no secret = "secret" } client 128.0.0.0/1 { require_message_authenticator = no secret = "secret" } radiusd: #### Instantiating modules #### instantiate { Module: Linked to module rlm_exec Module: Instantiating module "exec" from file /etc//modules/exec exec { wait = no input_pairs = "request" shell_escape = yes } Module: Linked to module rlm_expr Module: Instantiating module "expr" from file /etc//modules/expr Module: Linked to module rlm_expiration Module: Instantiating module "expiration" from file /etc//modules/expiration expiration { reply-message = "Password Has Expired " } Module: Linked to module rlm_logintime Module: Instantiating module "logintime" from file /etc//modules/logintime logintime { reply-message = "You are calling outside your allowed timespan " minimum-timeout = 60 } } radiusd: #### Loading Virtual Servers #### server inner-tunnel { # from file /etc//sites-enabled/inner-tunnel modules { Module: Checking authenticate {...} for more modules to load Module: Linked to module rlm_pap Module: Instantiating module "pap" from file /etc//modules/pap pap { encryption_scheme = "auto" auto_header = no } Module: Linked to module rlm_chap Module: Instantiating module "chap" from file /etc//modules/chap Module: Linked to module rlm_mschap Module: Instantiating module "mschap" from file /etc//modules/mschap mschap { use_mppe = yes require_encryption = no require_strong = no with_ntdomain_hack = no } Module: Linked to module rlm_unix Module: Instantiating module "unix" from file /etc//modules/unix unix { radwtmp = "/var/log/freeradius/radwtmp" } Module: Linked to module rlm_eap Module: Instantiating module "eap" from file /etc//eap.conf eap { default_eap_type = "md5" timer_expire = 60 ignore_unknown_eap_types = no cisco_accounting_username_bug = no max_sessions = 4096 } Module: Linked to sub-module rlm_eap_md5 Module: Instantiating eap-md5 Module: Linked to sub-module rlm_eap_leap Module: Instantiating eap-leap Module: Linked to sub-module rlm_eap_gtc Module: Instantiating eap-gtc gtc { challenge = "Password: " auth_type = "PAP" } Module: Linked to sub-module rlm_eap_tls Module: Instantiating eap-tls tls { rsa_key_exchange = no dh_key_exchange = yes rsa_key_length = 512 dh_key_length = 512 verify_depth = 0 CA_path = "/etc/freeradius/certs" pem_file_type = yes private_key_file = "/etc/freeradius/certs/server.key" certificate_file = "/etc/freeradius/certs/server.pem" CA_file = "/etc/freeradius/certs/ca.pem" private_key_password = "whatever" dh_file = "/etc/freeradius/certs/dh" random_file = "/dev/urandom" fragment_size = 1024 include_length = yes check_crl = no cipher_list = "DEFAULT" make_cert_command = "/etc/freeradius/certs/bootstrap" cache { enable = no lifetime = 24 max_entries = 255 } verify { } } Module: Linked to sub-module rlm_eap_ttls Module: Instantiating eap-ttls ttls { default_eap_type = "md5" copy_request_to_tunnel = no use_tunneled_reply = no virtual_server = "inner-tunnel" include_length = yes } Module: Linked to sub-module rlm_eap_peap Module: Instantiating eap-peap peap { default_eap_type = "mschapv2" copy_request_to_tunnel = no use_tunneled_reply = no proxy_tunneled_request_as_eap = yes virtual_server = "inner-tunnel" } Module: Linked to sub-module rlm_eap_mschapv2 Module: Instantiating eap-mschapv2 mschapv2 { with_ntdomain_hack = no } Module: Checking authorize {...} for more modules to load Module: Linked to module rlm_realm Module: Instantiating module "suffix" from file /etc//modules/realm realm suffix { format = "suffix" delimiter = "@" ignore_default = no ignore_null = no } Module: Linked to module rlm_files Module: Instantiating module "files" from file /etc//modules/files files { usersfile = "/etc/freeradius/users" acctusersfile = "/etc/freeradius/acct_users" preproxy_usersfile = "/etc/freeradius/preproxy_users" compat = "no" } Module: Checking session {...} for more modules to load Module: Linked to module rlm_radutmp Module: Instantiating module "radutmp" from file /etc//modules/radutmp radutmp { filename = "/var/log/freeradius/radutmp" username = "%{User-Name}" case_sensitive = yes check_with_nas = yes perm = 384 callerid = yes } Module: Checking post-proxy {...} for more modules to load Module: Checking post-auth {...} for more modules to load Module: Linked to module rlm_attr_filter Module: Instantiating module "attr_filter.access_reject" from file /etc/ /modules/attr_filter attr_filter attr_filter.access_reject { attrsfile = "/etc/freeradius/attrs.access_reject" key = "%{User-Name}" } } # modules } # server server { # from file /etc//radiusd.conf modules { Module: Checking authenticate {...} for more modules to load Module: Linked to module rlm_digest Module: Instantiating module "digest" from file /etc//modules/digest Module: Checking authorize {...} for more modules to load Module: Linked to module rlm_preprocess Module: Instantiating module "preprocess" from file /etc//modules/preprocess preprocess { huntgroups = "/etc/freeradius/huntgroups" hints = "/etc/freeradius/hints" with_ascend_hack = no ascend_channels_per_line = 23 with_ntdomain_hack = no with_specialix_jetstream_hack = no with_cisco_vsa_hack = no with_alvarion_vsa_hack = no } Module: Linked to module rlm_sql Module: Instantiating module "sql" from file /etc//sql.conf sql { driver = "rlm_sql_mysql" server = "localhost" port = "" login = "radius" password = "radpass" radius_db = "radius" read_groups = yes sqltrace = no sqltracefile = "/var/log/freeradius/sqltrace.sql" readclients = no deletestalesessions = yes num_sql_socks = 5 lifetime = 0 max_queries = 0 sql_user_name = "%{User-Name}" default_user_profile = "" nas_query = "SELECT id, nasname, shortname, type, secret, server FROM nas" authorize_check_query = "SELECT id, username, attribute, value, op FROM radcheck WHERE username = '%{SQL-User-Name}' ORDER BY id" authorize_reply_query = "SELECT id, username, attribute, value, op FROM radreply WHERE username = '%{SQL-User-Name}' ORDER BY id" authorize_group_check_query = "SELECT id, groupname, attribute, Value, op FROM radgroupcheck WHERE groupname = '%{Sql-Group}' ORDER BY id" authorize_group_reply_query = "SELECT id, groupname, attribute, value, op FROM radgroupreply WHERE groupname = '%{Sql-Group}' ORDER BY id" accounting_onoff_query = " UPDATE radacct SET acctstoptime = '%S', acctsessiontime = unix_timestamp('%S') - unix_timestamp(acctstarttime), acctterminatecause = '%{Acct-Terminate-Cause}', acctstopdelay = %{%{Acct-Delay-Time}:-0} WHERE acctstoptime IS NULL AND nasipaddress = '%{NAS-IP-Address}' AND acctstarttime <= '%S'" accounting_update_query = " UPDATE radacct SET framedipaddress = '%{Framed-IP-Address}', acctsessiontime = '%{Acct-Session-Time}', acctinputoctets = '%{%{Acct-Input-Gigawords}:-0}' << 32 | '%{%{Acct-Input-Octets}:-0}', acctoutputoctets = '%{%{Acct-Output-Gigawords}:-0}' << 32 | '%{%{Acct-Output-Octets}:-0}' WHERE acctsessionid = '%{Acct-Session-Id}' AND username = '%{SQL-User-Name}' AND nasipaddress = '%{NAS-IP-Address}'" accounting_update_query_alt = " INSERT INTO radacct (acctsessionid, acctuniqueid, username, realm, nasipaddress, nasportid, nasporttype, acctstarttime, acctsessiontime, acctauthentic, connectinfo_start, acctinputoctets, acctoutputoctets, calledstationid, callingstationid, servicetype, framedprotocol, framedipaddress, acctstartdelay, xascendsessionsvrkey) VALUES ('%{Acct-Session-Id}', '%{Acct-Unique-Session-Id}', '%{SQL-User-Name}', '%{Realm}', '%{NAS-IP-Address}', '%{NAS-Port}', '%{NAS-Port-Type}', DATE_SUB('%S', INTERVAL (%{%{Acct-Session-Time}:-0} + %{%{Acct-Delay-Time}:-0}) SECOND), '%{Acct-Session-Time}', '%{Acct-Authentic}', '', '%{%{Acct-Input-Gigawords}:-0}' << 32 | '%{%{Acct-Input-Octets}:-0}', '%{%{Acct-Output-Gigawords}:-0}' << 32 | '%{%{Acct-Output-Octets}:-0}', '%{Called-Station-Id}', '%{Calling-Station-Id}', '%{Service-Type}', '%{Framed-Protocol}', '%{Framed-IP-Address}', '0', '%{X-Ascend-Session-Svr-Key}')" accounting_start_query = " INSERT INTO radacct (acctsessionid, acctuniqueid, username, realm, nasipaddress, nasportid, nasporttype, acctstarttime, acctstoptime, acctsessiontime, acctauthentic, connectinfo_start, connectinfo_stop, acctinputoctets, acctoutputoctets, calledstationid, callingstationid, acctterminatecause, servicetype, framedprotocol, framedipaddress, acctstartdelay, acctstopdelay, xascendsessionsvrkey) VALUES ('%{Acct-Session-Id}', '%{Acct-Unique-Session-Id}', '%{SQL-User-Name}', '%{Realm}', '%{NAS-IP-Address}', '%{NAS-Port}', '%{NAS-Port-Type}', '%S', NULL, '0', '%{Acct-Authentic}', '%{Connect-Info}', '', '0', '0', '%{Called-Station-Id}', '%{Calling-Station-Id}', '', '%{Service-Type}', '%{Framed-Protocol}', '%{Framed-IP-Address}', '%{%{Acct-Delay-Time}:-0}', '0', '%{X-Ascend-Session-Svr-Key}')" accounting_start_query_alt = " UPDATE radacct SET acctstarttime = '%S', acctstartdelay = '%{%{Acct-Delay-Time}:-0}', connectinfo_start = '%{Connect-Info}' WHERE acctsessionid = '%{Acct-Session-Id}' AND username = '%{SQL-User-Name}' AND nasipaddress = '%{NAS-IP-Address}'" accounting_stop_query = " UPDATE radacct SET acctstoptime = '%S', acctsessiontime = '%{Acct-Session-Time}', acctinputoctets = '%{%{Acct-Input-Gigawords}:-0}' << 32 | '%{%{Acct-Input-Octets}:-0}', acctoutputoctets = '%{%{Acct-Output-Gigawords}:-0}' << 32 | '%{%{Acct-Output-Octets}:-0}', acctterminatecause = '%{Acct-Terminate-Cause}', acctstopdelay = '%{%{Acct-Delay-Time}:-0}', connectinfo_stop = '%{Connect-Info}' WHERE acctsessionid = '%{Acct-Session-Id}' AND username = '%{SQL-User-Name}' AND nasipaddress = '%{NAS-IP-Address}'" accounting_stop_query_alt = " INSERT INTO radacct (acctsessionid, acctuniqueid, username, realm, nasipaddress, nasportid, nasporttype, acctstarttime, acctstoptime, acctsessiontime, acctauthentic, connectinfo_start, connectinfo_stop, acctinputoctets, acctoutputoctets, calledstationid, callingstationid, acctterminatecause, servicetype, framedprotocol, framedipaddress, acctstartdelay, acctstopdelay) VALUES ('%{Acct-Session-Id}', '%{Acct-Unique-Session-Id}', '%{SQL-User-Name}', '%{Realm}', '%{NAS-IP-Address}', '%{NAS-Port}', '%{NAS-Port-Type}', DATE_SUB('%S', INTERVAL (%{%{Acct-Session-Time}:-0} + %{%{Acct-Delay-Time}:-0}) SECOND), '%S', '%{Acct-Session-Time}', '%{Acct-Authentic}', '', '%{Connect-Info}', '%{%{Acct-Input-Gigawords}:-0}' << 32 | '%{%{Acct-Input-Octets}:-0}', '%{%{Acct-Output-Gigawords}:-0}' << 32 | '%{%{Acct-Output-Octets}:-0}', '%{Called-Station-Id}', '%{Calling-Station-Id}', '%{Acct-Terminate-Cause}', '%{Service-Type}', '%{Framed-Protocol}', '%{Framed-IP-Address}', '0', '%{%{Acct-Delay-Time}:-0}')" group_membership_query = "SELECT groupname FROM radusergroup WHERE username = '%{SQL-User-Name}' ORDER BY priority" connect_failure_retry_delay = 60 simul_count_query = "" simul_verify_query = "SELECT radacctid, acctsessionid, username, nasipaddress, nasportid, framedipaddress, callingstationid, framedprotocol FROM radacct WHERE username = '%{SQL-User-Name}' AND acctstoptime IS NULL" postauth_query = "INSERT INTO radpostauth (username, pass, reply, authdate) VALUES ( '%{User-Name}', '%{%{User-Password}:-%{Chap-Password}}', '%{reply:Packet-Type}', '%S')" safe-characters = "@abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ0123456789.-_: /" } rlm_sql (sql): Driver rlm_sql_mysql (module rlm_sql_mysql) loaded and linked rlm_sql (sql): Attempting to connect to root@localhost:/radius rlm_sql (sql): starting 0 rlm_sql (sql): Attempting to connect rlm_sql_mysql #0 rlm_sql_mysql: Starting connect to MySQL server for #0 rlm_sql (sql): Connected new DB handle, #0 rlm_sql (sql): starting 1 rlm_sql (sql): Attempting to connect rlm_sql_mysql #1 rlm_sql_mysql: Starting connect to MySQL server for #1 rlm_sql (sql): Connected new DB handle, #1 rlm_sql (sql): starting 2 rlm_sql (sql): Attempting to connect rlm_sql_mysql #2 rlm_sql_mysql: Starting connect to MySQL server for #2 rlm_sql (sql): Connected new DB handle, #2 rlm_sql (sql): starting 3 rlm_sql (sql): Attempting to connect rlm_sql_mysql #3 rlm_sql_mysql: Starting connect to MySQL server for #3 rlm_sql (sql): Connected new DB handle, #3 rlm_sql (sql): starting 4 rlm_sql (sql): Attempting to connect rlm_sql_mysql #4 rlm_sql_mysql: Starting connect to MySQL server for #4 rlm_sql (sql): Connected new DB handle, #4 Module: Checking preacct {...} for more modules to load Module: Linked to module rlm_acct_unique Module: Instantiating module "acct_unique" from file /etc/ /modules/acct_unique acct_unique { key = "User-Name, Acct-Session-Id, NAS-IP-Address, Client-IP-Address, NAS-Port" } Module: Checking accounting {...} for more modules to load Module: Linked to module rlm_detail Module: Instantiating module "detail" from file /etc//modules/detail detail { detailfile = "/var/log/freeradius/radacct/%{Client-IP-Address}/detail-%Y%m%d" header = "%t" detailperm = 384 dirperm = 493 locking = no log_packet_header = no } Module: Instantiating module "attr_filter.accounting_response" from file /etc//modules/attr_filter attr_filter attr_filter.accounting_response { attrsfile = "/etc/freeradius/attrs.accounting_response" key = "%{User-Name}" } Module: Checking session {...} for more modules to load Module: Checking post-proxy {...} for more modules to load Module: Checking post-auth {...} for more modules to load } # modules } # server radiusd: #### Opening IP addresses and Ports #### listen { type = "auth" ipaddr = * port = 0 } listen { type = "acct" ipaddr = * port = 0 } listen { type = "auth" ipaddr = 127.0.0.1 port = 18120 } Listening on authentication address * port 1812 Listening on accounting address * port 1813 Listening on authentication address 127.0.0.1 port 18120 as server inner-tunnel Listening on proxy address * port 1814 Ready to process requests. rad_recv: Access-Request packet from host 213.186.50.98 port 47026, id=113, length=57 User-Name = "user1" CHAP-Password = 0x7104a64526171941a63bdee5dd7f4d8760 NAS-IP-Address = 127.0.0.1 NAS-Port = 1812 # Executing section authorize from file /etc//sites-enabled/default +- entering group authorize {...} ++[preprocess] returns ok Segmentation fault ---------------------------------------------------------------------------------------------------------------------------------

2 1

Question about differences between possibilities of authentication
by Bas Penris 12 Apr '13

12 Apr '13

Hi All, The last week I've had my first encounter with FreeRADIUS as we were supposed to deploy eduroam. I had a lot of fun doing it although I have dreamt about the config files after a couple of days :) Everything is working as it should so no worries there, but I'm curious about something. I configured the proxies and the local realm. When I did a radtest like this: radtest cheese(a)localdomain.nl password 127.0.0.1 1 secret I would get an Accept-Accept. The debug output would show that first a bind and then an LDAP search is performed in our eDirectory. Okay! Fun times I thought, let's try it on my mobile phone because a test account I got from an academic institution in the UK worked so local authentication should work as well! I entered the credentials but now comes the difference. Using a Wifi device made the LDAP search fail because it tried to authenticate the user(a)domain.nl in stead of stripping the suffix. I've been staring at the config files to see if I got the LDAP-filter defined two times somewhere but that doesn't seem to be the case. Now, this wasn't a really big problem because users can be pretty stupid and we decided to let them authenticate using their email address in stead of their username@domain which would to too much confusion for them. The LDAP filter was: filter = "(uid=%{Stripped-User-Name:-%{User-Name}})" Is now: filter = "(|(cn=%{Stripped-User-Name:-%{User-Name}})(mail=%{User-Name}))" The proxy.conf lines right before it's defaulted to eduroam: realm ettyhillesumlyceum.nl { } Anyone has an idea why radtest would behave differently from an 802.1x login? Regards, Bas

2 3

[RESOLVED] Need both Local (MySQL database) and Active directory authentications.
by ffgch2 12 Apr '13

12 Apr '13

Thanks Alan! The following code in the sites-available/inner-tunnel solved the problem. if ("%{sql: SELECT COUNT(*) FROM radcheck WHERE username = '%{SQL-User-Name}' AND pwdtype = 'local'}" > 0) { update control { MS-CHAP-Use-NTLM-Auth := 0 } } ffgch2 wrote: > > I have set up Freeradius (v.2.1.10) > > Upgrade to v2.2.0. > > > to do password authentication from > > MySQL database and it works fine but now I need to make some users be > > able to authenticate against Active directory accounts. I’ve setup > > winbind to authenticate windows accounts and it works but as a result > > freeradius lost ability to authenticate by local database. > > You need to figure out when users will be checked against SQL, and > when they will be checked against AD. Right now, you've configured > FreeRADIUS to use both. Which isn't what you want. > > > So if I comment the line: > > Don't randomly change things. It won't work. > > > Is there a way to tell mschap to use ntlm_auth depending on field in > > MySQL table and use the internal mechanisms if plain text passwords > > available in the MySQL table? > > No. There are better ways. > > See raddb/modules/mschap. You can control when ntlm_auth is called. > > See "man unlang". You can configure policies. Read the debug output. > > What you want is this: > > authorize { > ... > sql > if (ok) { > update control { > "MS-CHAP-Use-NTLM-Auth := No > } > > } > ... > } > > Alan DeKok. > - > List info/subscribe/unsubscribe? See > http://www.freeradius.org/list/users.html >

1 0

compile with ldap support
by Chris Taylor 12 Apr '13

12 Apr '13

What are options do I have to use to compile freeradius with ldap support turned on? I tried ./configure -with-ldap but that didn't seem to work I still get an error about not being able to find rlm_ldap. I checked the mail archives but I couldn't find anything. Thanks, Chris

5 8

Group questions..several group memberships to one account. FreeRADIUS Version 2.1.10
by Alexander Silveröhrt 12 Apr '13

12 Apr '13

Hello, Never played around with groups using rlm_sql and the default schema.. I am reading what i assume is saying that it should be possible to have several groups to a account and each group should be able to supply that specific groups radgroupreply attributes.. Number 4 below sure sounds like it should get all the accounts groups first and then process them according to priority? Below test shows it only reads the first group? And no matter what priority.. Is that how it should work or what am i missing here? 1.Search the radcheck table for any check attributes specific to the user 2.If check attributes are found, and there's a match, pull the reply items from the radreply table for this user and add them to the reply 3.Group processing then begins if any of the following conditions are met: ◦The user IS NOT found in radcheck ◦The user IS found in radcheck, but the check items don't match ◦The user IS found in radcheck, the check items DO match AND Fall-Through is set in the radreply table ◦The user IS found in radcheck, the check items DO match AND the read_groups directive is set to 'yes' 4.If groups are to be processed for this user, the first thing that is done is the list of groups this user is a member of is pulled from the usergroup table ordered by the priority field. The priority field of the usergroup table allows us to control the order in which groups are processed, so that we can emulate the ordering in the users file. This can be important in many cases. 5.For each group this user is a member of, the corresponding check items are pulled from radgroupcheck table and compared with the request. If there is a match, the reply items for this group are pulled from the radgroupreply table and applied. 6.Processing continues to the next group IF: ◦There was not a match for the last group's check items OR ◦Fall-Through was set in the last group's reply items (The above is exactly the same as in the users file) 7.Finally, if the user has a User-Profile attribute set or the Default Profile option is set in the sql.conf, then steps 4-6 are repeated for the groups that the profile is a member of. To test it i added som data to mysql> select * from radcheck; +----+----------+-----------+----+-------+ | id | username | attribute | op | value | +----+----------+-----------+----+-------+ | 8 | alex | Password | := | test | +----+----------+-----------+----+-------+ mysql> select * from radusergroup; +----------+------------------+----------+ | username | groupname | priority | +----------+------------------+----------+ | alex | mega-admin-group | 0 | | alex | cisco_admin | 1 | +----------+------------------+----------+ mysql> select * from radgroupreply; +----+------------------+----------------+----+----------------------------------+ | id | groupname | attribute | op | value | +----+------------------+----------------+----+----------------------------------+ | 1 | mega-admin-group | Reply-Message | = | test-mega-admin-reply-attribute | | 2 | mega-admin-group | NAS-Identifier | = | test-NAS | | 3 | cisco_admin | Service-Type | = | NAS-Prompt-User | | 4 | cisco_admin | cisco-avpair | = | shell:priv-lvl=15 | +----+------------------+----------------+----+----------------------------------+ 5 rows in set (0.00 sec) root@noc1:/etc/freeradius# radtest -x alex test localhost 1812 testing123 Sending Access-Request of id 69 to 127.0.0.1 port 1812 User-Name = "alex" User-Password = "test" NAS-IP-Address = 10.173.2.10 NAS-Port = 1812 rad_recv: Access-Accept packet from host 127.0.0.1 port 1812, id=69, length=63 Reply-Message = "test-mega-admin-reply-attribute" NAS-Identifier = "test-NAS" < -- Only replies from group mega-admin-group And freeradius debug is showing it only checked replies from the first group.. rad_recv: Access-Request packet from host 127.0.0.1 port 49061, id=3, length=56 User-Name = "alex" User-Password = "test" NAS-IP-Address = 10.173.2.10 NAS-Port = 1812 # Executing section authorize from file /etc/freeradius/sites-enabled/default +- entering group authorize {...} ++[preprocess] returns ok rlm_perl: rlm_perl::Itux DEBUG::Inside authorize Function. rlm_perl: Added pair User-Name = alex rlm_perl: Added pair User-Password = test rlm_perl: Added pair NAS-Port = 1812 rlm_perl: Added pair NAS-IP-Address = 10.173.2.10 ++[perl] returns ok ++[chap] returns noop ++[mschap] returns noop ++[digest] returns noop [suffix] No '@' in User-Name = "alex", looking up realm NULL [suffix] No such realm "NULL" ++[suffix] returns noop [sql] expand: %{User-Name} -> alex [sql] sql_set_user escaped user --> 'alex' rlm_sql (sql): Reserving sql socket id: 3 [sql] expand: SELECT id, username, attribute, value, op FROM radcheck WHERE username = '%{SQL-User-Name}' ORDER BY id -> SELECT id, username, attribute, value, op FROM radcheck WHERE username = 'alex' ORDER BY id [sql] User found in radcheck table [sql] expand: SELECT id, username, attribute, value, op FROM radreply WHERE username = '%{SQL-User-Name}' ORDER BY id -> SELECT id, username, attribute, value, op FROM radreply WHERE username = 'alex' ORDER BY id [sql] expand: SELECT groupname FROM radusergroup WHERE username = '%{SQL-User-Name}' ORDER BY priority -> SELECT groupname FROM radusergroup WHERE username = 'alex' ORDER BY priority [sql] expand: SELECT id, groupname, attribute, Value, op FROM radgroupcheck WHERE groupname = '%{Sql-Group}' ORDER BY id -> SELECT id, groupname, attribute, Value, op FROM radgroupcheck WHERE groupname = 'mega-admin-group' ORDER BY id [sql] User found in group mega-admin-group [sql] expand: SELECT id, groupname, attribute, value, op FROM radgroupreply WHERE groupname = '%{Sql-Group}' ORDER BY id -> SELECT id, groupname, attribute, value, op FROM radgroupreply WHERE groupname = 'mega-admin-group' ORDER BY id rlm_sql (sql): Released sql socket id: 3 ++[sql] returns ok ++[expiration] returns noop ++[logintime] returns noop ++[pap] returns updated Found Auth-Type = PAP !!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!! !!! Replacing User-Password in config items with Cleartext-Password. !!! !!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!! !!! Please update your configuration so that the "known good" !!! !!! clear text password is in Cleartext-Password, and not in User-Password. !!! !!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!! # Executing group from file /etc/freeradius/sites-enabled/default +- entering group PAP {...} [pap] login attempt with password "test" [pap] Using clear text password "test" [pap] User authenticated successfully ++[pap] returns ok Login OK: [alex] (from client localhost port 1812) # Executing section post-auth from file /etc/freeradius/sites-enabled/default +- entering group post-auth {...} ++[exec] returns noop Sending Access-Accept of id 3 to 127.0.0.1 port 49061 Reply-Message = "test-mega-admin-reply-attribute" Finished request 10. Going to the next request Waking up in 4.9 seconds. Cleaning up request 10 ID 3 with timestamp +7141 Ready to process requests. Thx Alex ********* DISCLAIMER ********* This message and any attachment are confidential and may be privileged or otherwise protected from disclosure and may include proprietary information. If you are not the intended recipient, please telephone or email the sender and delete this message and any attachment from your system. If you are not the intended recipient you must not copy this message or attachment or disclose the contents to any other person

1 2

Re: Radius Squid authentication REJECT
by Iftakhul Anwar 12 Apr '13

12 Apr '13

Hi Adam, I'm sorry my previous attachment too large, This attachment log of radiusd -X output when i try to login using user = alice with passwrod=password Thanks On Thu, Apr 11, 2013 at 8:02 PM, Iftakhul Anwar <anwar(a)meruvian.org> wrote: > Hi Adam, > > This attachment log of radiusd -X output when i try to login using user = > alice with passwrod=password > > > On Thu, Apr 11, 2013 at 4:55 PM, Adam Bishop <Adam.Bishop(a)ja.net> wrote: > >> On 11 Apr 2013, at 10:35, Iftakhul Anwar <anwar(a)meruvian.org> wrote: >> > >> > I just use enter after my shared secret. >> > >> > Any suggestions ? >> >> There are three possibilities >> >> * The shared secret is wrong in the squid radius file >> * The shared secret is wrong in the freeradius clients file >> * Squid is broken (I think this unlikely) >> >> As you've not posted a full debug log, all we can do is guess. >> >> My guess is that radtest is using the secret defined in >> clients.conf:client 127.0.0.1/8 and squid is using the secret defined in >> clients.conf:client 192.168.2.3 >> >> Post a full log, and we can probably do more than guess. >> >> Adam Bishop >> >> gpg: 0x6609D460 >> >> Janet, the UK's research and education network. >> >> >> >> Janet(UK) is a trading name of Jisc Collections and Janet Limited, a >> not-for-profit company which is registered in England under No. 2881024 >> and whose Registered Office is at Lumen House, Library Avenue, >> Harwell Oxford, Didcot, Oxfordshire. OX11 0SG. VAT No. 614944238 >> >> - >> List info/subscribe/unsubscribe? See >> http://www.freeradius.org/list/users.html >> > > > > -- > *M.Iftakhul Anwar* > Meruvian Integrator > High Performance Computing / Cloud Computing (HPC/CC) > > > Office Phone : 021-93586577 > Mobile Phone : 085215331477 > Blog : http://blog.mervpolis.com/roller/anwar > FB : http://www.facebook.com/troya.adromeda > Website : www.meruvian.org > > -- *M.Iftakhul Anwar* Meruvian Integrator High Performance Computing / Cloud Computing (HPC/CC) Office Phone : 021-93586577 Mobile Phone : 085215331477 Blog : http://blog.mervpolis.com/roller/anwar FB : http://www.facebook.com/troya.adromeda Website : www.meruvian.org

3 10

Performing an additional check on the credentials
by Romeo Mihalcea 11 Apr '13

11 Apr '13

I successfully managed to deploy a freeradius server and created a python script which does an additional check on the user (incoming request). I checked the internet (resources for freeradius are pretty horrible) and only found a thread which explains some basics about adding a python script to the process. Right now I have it inside /etc/freeradius/sites-enabled/default under the authorize section: update control { Auth-Type := `/usr/bin/python /etc/test.py '%{User-Name}' '%{User-Password}'` } My test.py file spits Reject or Accept. I also have sql authentication setup with freeradius and the problem is that, if my script returns Accept any other authorization request under is ignored; response will still be an Accept even if sql check rejects the user. >From what I understand I should pass a noop instead of Accept to allow freeradius to continue and only pass Reject if I need to reject the user but If I respond with noop the server complains (probably because it expects a reply for Auth-Type as I coded it). Someone on serverfault suggested I shouldnt use unlang to call a python script and I should use rlm_python but I really have no idea how to even start calling my script. Any ideas? Maybe I need to add my code to the Authentication. section? How?

2 1

freeRadius 2.1.10 PEAP/MSCHAPv2 w/ Active Directory
by trevor_marquis＠selinc.com 11 Apr '13

11 Apr '13

Hello all, I'm new to freeRadius and am using freeRadius version 2.1.10 for some lab testing. I've got freeradius extracting users and passwords from an Active Directory database. I'm using PEAP/MSCHAPv2. All configs have been working until about a week or so ago. All of a sudden, my mschapv2 challenge/response is not correct. Not sure where exactly the problem is occurring so I've posted the debug output below. If other config files are necessary, I can post them too. Thank for any help. Trevor rad_recv: Access-Request packet from host 127.0.0.1 port 50066, id=2, length=81 User-Name = "TheAdmin" NAS-Port = 0 NAS-IP-Address = 127.0.0.1 EAP-Message = 0x0200001001747265766f7261646d696e Message-Authenticator = 0x1f8e3dc1fcbafac6481c9fe22c8449e5 # Executing section authorize from file /etc/freeradius/sites-enabled/default +- entering group authorize {...} ++[preprocess] returns ok ++[chap] returns noop ++[mschap] returns noop ++[digest] returns noop [suffix] No '@' in User-Name = "TheAdmin", looking up realm NULL [suffix] No such realm "NULL" ++[suffix] returns noop [eap] EAP packet type response id 0 length 16 [eap] No EAP Start, assuming it's an on-going EAP conversation ++[eap] returns updated [ldap] Entering ldap_groupcmp() [files] expand: dc=commslab,dc=local -> dc=commslab,dc=local [files] expand: %{Stripped-User-Name} -> [files] ... expanding second conditional [files] expand: %{User-Name} -> TheAdmin [files] expand: (&(objectclass=user)(sAMAccountName=%{%{Stripped-User-Name}:-%{User-Name}}*)) -> (&(objectclass=user)(sAMAccountName=TheAdmin*)) [ldap] ldap_get_conn: Checking Id: 0 [ldap] ldap_get_conn: Got Id: 0 [ldap] performing search in dc=commslab,dc=local, with filter (&(objectclass=user)(sAMAccountName=TheAdmin*)) [ldap] ldap_release_conn: Release Id: 0 [files] expand: (|(&(objectClass=GroupOfNames)(member=%{Ldap-UserDn}))(&(objectClass=GroupOfUniqueNames)(uniquemember=%{Ldap-UserDn}))) -> (|(&(objectClass=GroupOfNames)(member=))(&(objectClass=GroupOfUniqueNames)(uniquemember=))) [ldap] ldap_get_conn: Checking Id: 0 [ldap] ldap_get_conn: Got Id: 0 [ldap] performing search in dc=commslab,dc=local, with filter (&(cn=Commslab_Domain_Users)(|(&(objectClass=GroupOfNames)(member=))(&(objectClass=GroupOfUniqueNames)(uniquemember=)))) [ldap] object not found [ldap] ldap_release_conn: Release Id: 0 [ldap] ldap_get_conn: Checking Id: 0 [ldap] ldap_get_conn: Got Id: 0 [ldap] performing search in CN=TheAdmin,OU=Users,OU=commslab,DC=commslab,DC=local, with filter (objectclass=*) [ldap] performing search in CN=Commslab_Enterprise_Admins,OU=Groups,OU=commslab,DC=commslab,DC=local, with filter (cn=Commslab_Domain_Users) [ldap] object not found [ldap] performing search in CN=Domain Admins,CN=Users,DC=commslab,DC=local, with filter (cn=Commslab_Domain_Users) [ldap] object not found rlm_ldap::groupcmp: Group Commslab_Domain_Users not found or user not a member [ldap] ldap_release_conn: Release Id: 0 [ldap] Entering ldap_groupcmp() [files] expand: dc=commslab,dc=local -> dc=commslab,dc=local [files] expand: (|(&(objectClass=GroupOfNames)(member=%{Ldap-UserDn}))(&(objectClass=GroupOfUniqueNames)(uniquemember=%{Ldap-UserDn}))) -> (|(&(objectClass=GroupOfNames)(member=))(&(objectClass=GroupOfUniqueNames)(uniquemember=))) [ldap] ldap_get_conn: Checking Id: 0 [ldap] ldap_get_conn: Got Id: 0 [ldap] performing search in dc=commslab,dc=local, with filter (&(cn=Commslab_Enterprise_Admins)(|(&(objectClass=GroupOfNames)(member=))(&(objectClass=GroupOfUniqueNames)(uniquemember=)))) [ldap] object not found [ldap] ldap_release_conn: Release Id: 0 [ldap] ldap_get_conn: Checking Id: 0 [ldap] ldap_get_conn: Got Id: 0 [ldap] performing search in CN=TheAdmin,OU=Users,OU=commslab,DC=commslab,DC=local, with filter (objectclass=*) [ldap] performing search in CN=Commslab_Enterprise_Admins,OU=Groups,OU=commslab,DC=commslab,DC=local, with filter (cn=Commslab_Enterprise_Admins) rlm_ldap::ldap_groupcmp: User found in group Commslab_Enterprise_Admins [ldap] ldap_release_conn: Release Id: 0 ++[files] returns noop ++[expiration] returns noop ++[logintime] returns noop [pap] WARNING! No "known good" password found for the user. Authentication may fail because of this. ++[pap] returns noop ++? if (!control:Auth-Type) ? Evaluating !(control:Auth-Type) -> FALSE ++? if (!control:Auth-Type) -> FALSE Found Auth-Type = EAP # Executing group from file /etc/freeradius/sites-enabled/default +- entering group authenticate {...} [eap] EAP Identity [eap] processing type tls [tls] Initiate --- Not sure why were trying TLS [tls] Start returned 1 ++[eap] returns handled Sending Access-Challenge of id 2 to 127.0.0.1 port 50066 EAP-Message = 0x010100061920 Message-Authenticator = 0x00000000000000000000000000000000 State = 0xc823e63dc822ff81c661e84e3a0d59ca Finished request 11. Going to the next request Waking up in 4.9 seconds. rad_recv: Access-Request packet from host 127.0.0.1 port 50066, id=3, length=89 User-Name = "TheAdmin" NAS-Port = 0 NAS-IP-Address = 127.0.0.1 State = 0xc823e63dc822ff81c661e84e3a0d59ca EAP-Message = 0x02010006031a Message-Authenticator = 0x800227d2e97f5df201d1173187725335 # Executing section authorize from file /etc/freeradius/sites-enabled/default +- entering group authorize {...} ++[preprocess] returns ok ++[chap] returns noop ++[mschap] returns noop ++[digest] returns noop [suffix] No '@' in User-Name = "TheAdmin", looking up realm NULL [suffix] No such realm "NULL" ++[suffix] returns noop [eap] EAP packet type response id 1 length 6 [eap] No EAP Start, assuming it's an on-going EAP conversation ++[eap] returns updated [ldap] Entering ldap_groupcmp() [files] expand: dc=commslab,dc=local -> dc=commslab,dc=local [files] expand: %{Stripped-User-Name} -> [files] ... expanding second conditional [files] expand: %{User-Name} -> TheAdmin [files] expand: (&(objectclass=user)(sAMAccountName=%{%{Stripped-User-Name}:-%{User-Name}}*)) -> (&(objectclass=user)(sAMAccountName=TheAdmin*)) [ldap] ldap_get_conn: Checking Id: 0 [ldap] ldap_get_conn: Got Id: 0 [ldap] performing search in dc=commslab,dc=local, with filter (&(objectclass=user)(sAMAccountName=TheAdmin*)) [ldap] ldap_release_conn: Release Id: 0 [files] expand: (|(&(objectClass=GroupOfNames)(member=%{Ldap-UserDn}))(&(objectClass=GroupOfUniqueNames)(uniquemember=%{Ldap-UserDn}))) -> (|(&(objectClass=GroupOfNames)(member=))(&(objectClass=GroupOfUniqueNames)(uniquemember=))) [ldap] ldap_get_conn: Checking Id: 0 [ldap] ldap_get_conn: Got Id: 0 [ldap] performing search in dc=commslab,dc=local, with filter (&(cn=Commslab_Domain_Users)(|(&(objectClass=GroupOfNames)(member=))(&(objectClass=GroupOfUniqueNames)(uniquemember=)))) [ldap] object not found [ldap] ldap_release_conn: Release Id: 0 [ldap] ldap_get_conn: Checking Id: 0 [ldap] ldap_get_conn: Got Id: 0 [ldap] performing search in CN=TheAdmin,OU=Users,OU=commslab,DC=commslab,DC=local, with filter (objectclass=*) [ldap] performing search in CN=Commslab_Enterprise_Admins,OU=Groups,OU=commslab,DC=commslab,DC=local, with filter (cn=Commslab_Domain_Users) [ldap] object not found [ldap] performing search in CN=Domain Admins,CN=Users,DC=commslab,DC=local, with filter (cn=Commslab_Domain_Users) [ldap] object not found rlm_ldap::groupcmp: Group Commslab_Domain_Users not found or user not a member [ldap] ldap_release_conn: Release Id: 0 [ldap] Entering ldap_groupcmp() [files] expand: dc=commslab,dc=local -> dc=commslab,dc=local [files] expand: (|(&(objectClass=GroupOfNames)(member=%{Ldap-UserDn}))(&(objectClass=GroupOfUniqueNames)(uniquemember=%{Ldap-UserDn}))) -> (|(&(objectClass=GroupOfNames)(member=))(&(objectClass=GroupOfUniqueNames)(uniquemember=))) [ldap] ldap_get_conn: Checking Id: 0 [ldap] ldap_get_conn: Got Id: 0 [ldap] performing search in dc=commslab,dc=local, with filter (&(cn=Commslab_Enterprise_Admins)(|(&(objectClass=GroupOfNames)(member=))(&(objectClass=GroupOfUniqueNames)(uniquemember=)))) [ldap] object not found [ldap] ldap_release_conn: Release Id: 0 [ldap] ldap_get_conn: Checking Id: 0 [ldap] ldap_get_conn: Got Id: 0 [ldap] performing search in CN=TheAdmin,OU=Users,OU=commslab,DC=commslab,DC=local, with filter (objectclass=*) [ldap] performing search in CN=Commslab_Enterprise_Admins,OU=Groups,OU=commslab,DC=commslab,DC=local, with filter (cn=Commslab_Enterprise_Admins) rlm_ldap::ldap_groupcmp: User found in group Commslab_Enterprise_Admins [ldap] ldap_release_conn: Release Id: 0 ++[files] returns noop ++[expiration] returns noop ++[logintime] returns noop [pap] WARNING! No "known good" password found for the user. Authentication may fail because of this. ++[pap] returns noop ++? if (!control:Auth-Type) ? Evaluating !(control:Auth-Type) -> FALSE ++? if (!control:Auth-Type) -> FALSE Found Auth-Type = EAP # Executing group from file /etc/freeradius/sites-enabled/default +- entering group authenticate {...} [eap] Request found, released from the list [eap] EAP NAK [eap] EAP-NAK asked for EAP-Type/mschapv2 [eap] processing type mschapv2 rlm_eap_mschapv2: Issuing Challenge ++[eap] returns handled Sending Access-Challenge of id 3 to 127.0.0.1 port 50066 EAP-Message = 0x010200251a0102002010930f6110164723e95627e52001aff4d9747265766f7261646d696e Message-Authenticator = 0x00000000000000000000000000000000 State = 0xc823e63dc921fc81c661e84e3a0d59ca Finished request 12. Going to the next request Waking up in 4.7 seconds. rad_recv: Access-Request packet from host 127.0.0.1 port 50066, id=4, length=153 User-Name = "TheAdmin" NAS-Port = 0 NAS-IP-Address = 127.0.0.1 State = 0xc823e63dc921fc81c661e84e3a0d59ca EAP-Message = 0x020200461a0202004131b42117333d3bf549251d07a7319c724b0000000000000000cfca112520907fc06b8d9625adebf0f172890cf2a89f8c1f00747265766f7261646d696e Message-Authenticator = 0x3917cdcab9c4ee67b9b697ff2fad2fd0 # Executing section authorize from file /etc/freeradius/sites-enabled/default +- entering group authorize {...} ++[preprocess] returns ok ++[chap] returns noop ++[mschap] returns noop ++[digest] returns noop [suffix] No '@' in User-Name = "TheAdmin", looking up realm NULL [suffix] No such realm "NULL" ++[suffix] returns noop [eap] EAP packet type response id 2 length 70 [eap] No EAP Start, assuming it's an on-going EAP conversation ++[eap] returns updated [ldap] Entering ldap_groupcmp() [files] expand: dc=commslab,dc=local -> dc=commslab,dc=local [files] expand: %{Stripped-User-Name} -> [files] ... expanding second conditional [files] expand: %{User-Name} -> TheAdmin [files] expand: (&(objectclass=user)(sAMAccountName=%{%{Stripped-User-Name}:-%{User-Name}}*)) -> (&(objectclass=user)(sAMAccountName=TheAdmin*)) [ldap] ldap_get_conn: Checking Id: 0 [ldap] ldap_get_conn: Got Id: 0 [ldap] performing search in dc=commslab,dc=local, with filter (&(objectclass=user)(sAMAccountName=TheAdmin*)) [ldap] ldap_release_conn: Release Id: 0 [files] expand: (|(&(objectClass=GroupOfNames)(member=%{Ldap-UserDn}))(&(objectClass=GroupOfUniqueNames)(uniquemember=%{Ldap-UserDn}))) -> (|(&(objectClass=GroupOfNames)(member=))(&(objectClass=GroupOfUniqueNames)(uniquemember=))) [ldap] ldap_get_conn: Checking Id: 0 [ldap] ldap_get_conn: Got Id: 0 [ldap] performing search in dc=commslab,dc=local, with filter (&(cn=Commslab_Domain_Users)(|(&(objectClass=GroupOfNames)(member=))(&(objectClass=GroupOfUniqueNames)(uniquemember=)))) [ldap] object not found [ldap] ldap_release_conn: Release Id: 0 [ldap] ldap_get_conn: Checking Id: 0 [ldap] ldap_get_conn: Got Id: 0 [ldap] performing search in CN=TheAdmin,OU=Users,OU=commslab,DC=commslab,DC=local, with filter (objectclass=*) [ldap] performing search in CN=Commslab_Enterprise_Admins,OU=Groups,OU=commslab,DC=commslab,DC=local, with filter (cn=Commslab_Domain_Users) [ldap] object not found [ldap] performing search in CN=Domain Admins,CN=Users,DC=commslab,DC=local, with filter (cn=Commslab_Domain_Users) [ldap] object not found rlm_ldap::groupcmp: Group Commslab_Domain_Users not found or user not a member [ldap] ldap_release_conn: Release Id: 0 [ldap] Entering ldap_groupcmp() [files] expand: dc=commslab,dc=local -> dc=commslab,dc=local [files] expand: (|(&(objectClass=GroupOfNames)(member=%{Ldap-UserDn}))(&(objectClass=GroupOfUniqueNames)(uniquemember=%{Ldap-UserDn}))) -> (|(&(objectClass=GroupOfNames)(member=))(&(objectClass=GroupOfUniqueNames)(uniquemember=))) [ldap] ldap_get_conn: Checking Id: 0 [ldap] ldap_get_conn: Got Id: 0 [ldap] performing search in dc=commslab,dc=local, with filter (&(cn=Commslab_Enterprise_Admins)(|(&(objectClass=GroupOfNames)(member=))(&(objectClass=GroupOfUniqueNames)(uniquemember=)))) [ldap] object not found [ldap] ldap_release_conn: Release Id: 0 [ldap] ldap_get_conn: Checking Id: 0 [ldap] ldap_get_conn: Got Id: 0 [ldap] performing search in CN=TheAdmin,OU=Users,OU=commslab,DC=commslab,DC=local, with filter (objectclass=*) [ldap] performing search in CN=Commslab_Enterprise_Admins,OU=Groups,OU=commslab,DC=commslab,DC=local, with filter (cn=Commslab_Enterprise_Admins) rlm_ldap::ldap_groupcmp: User found in group Commslab_Enterprise_Admins [ldap] ldap_release_conn: Release Id: 0 ++[files] returns noop ++[expiration] returns noop ++[logintime] returns noop [pap] WARNING! No "known good" password found for the user. Authentication may fail because of this. ++[pap] returns noop ++? if (!control:Auth-Type) ? Evaluating !(control:Auth-Type) -> FALSE ++? if (!control:Auth-Type) -> FALSE Found Auth-Type = EAP # Executing group from file /etc/freeradius/sites-enabled/default +- entering group authenticate {...} [eap] Request found, released from the list [eap] EAP/mschapv2 [eap] processing type mschapv2 [mschapv2] # Executing group from file /etc/freeradius/sites-enabled/default [mschapv2] +- entering group MS-CHAP {...} [mschap] Creating challenge hash with username: TheAdmin [mschap] Told to do MS-CHAPv2 for TheAdmin with NT-Password [mschap] expand: --username=%{mschap:User-Name:-None} -> --username=TheAdmin [mschap] No NT-Domain was found in the User-Name. [mschap] expand: %{mschap:NT-Domain} -> [mschap] ... expanding second conditional [mschap] expand: --domain=%{%{mschap:NT-Domain}:-commslab} -> --domain=commslab [mschap] mschap2: 93 [mschap] Creating challenge hash with username: TheAdmin [mschap] expand: --challenge=%{mschap:Challenge:-00} -> --challenge=d5bed64075a3500e [mschap] expand: --nt-response=%{mschap:NT-Response:-00} -> --nt-response=cfca112520907fc06b8d9625adebf0f172890cf2a89f8c1f WARNING: The "idmap uid" option is deprecated WARNING: The "idmap gid" option is deprecated Exec-Program output: Access denied (0xc0000022) Exec-Program-Wait: plaintext: Access denied (0xc0000022) Exec-Program: returned: 1 [mschap] External script failed. [mschap] FAILED: MS-CHAP2-Response is incorrect ++[mschap] returns reject [eap] Freeing handler ++[eap] returns reject Failed to authenticate the user. Login incorrect (mschap: External script says Access denied (0xc0000022)): [TheAdmin/<via Auth-Type = EAP>] (from client localhost port 0) Using Post-Auth-Type Reject # Executing group from file /etc/freeradius/sites-enabled/default +- entering group REJECT {...} [attr_filter.access_reject] expand: %{User-Name} -> TheAdmin attr_filter: Matched entry DEFAULT at line 11 ++[attr_filter.access_reject] returns updated Delaying reject of request 13 for 1 seconds Going to the next request Waking up in 0.8 seconds. Sending delayed reject for request 13 Sending Access-Reject of id 4 to 127.0.0.1 port 50066 EAP-Message = 0x04020004 Message-Authenticator = 0x00000000000000000000000000000000 Waking up in 3.6 seconds. Cleaning up request 11 ID 2 with timestamp +897 Waking up in 0.2 seconds. Cleaning up request 12 ID 3 with timestamp +897 Waking up in 1.0 seconds. Cleaning up request 13 ID 4 with timestamp +897 Ready to process requests.

2 1