Freeradius + Ldap - Authorise OK but NO dynamic VLANs
Hi all, I am trying to have dynamic VLAN assignment on Freeradius based on LDAP. The connection between Freeradius and LDAP works fine. If I test with a user I get the Authorise packet but not the dynamic VLAN assignment. We will be testing using this LDAP user: # ttester, SeminaryAdmin, SeminaryOU, seminary.local dn: cn=ttester,cn=SeminaryAdmin,ou=SeminaryOU,dc=seminary,dc=local cn: ttester givenName: Test gidNumber: 505 homeDirectory: /home/users/ttester sn: Tester objectClass: inetOrgPerson objectClass: posixAccount objectClass: top uidNumber: 1002 uid: ttester This is the received reply: radius@daloradius:~$ radtest -x ttester openldap localhost 1812 testing456 Sending Access-Request of id 30 to 127.0.0.1 port 1812 User-Name = "ttester" User-Password = "openldap" NAS-IP-Address = 127.0.1.1 NAS-Port = 1812 Message-Authenticator = 0x00000000000000000000000000000000 rad_recv: Access-Accept packet from host 127.0.0.1 port 1812, id=30, length=20 Freeradius version: FreeRADIUS Version 2.1.12, for host x86_64-pc-linux-gnu, built on Feb 27 2015 at 12:38:34 This is an extract of the Freeradius debug: Ready to process requests. rad_recv: Access-Request packet from host 127.0.0.1 port 38281, id=59, length=77 User-Name = "ttester" User-Password = "openldap" NAS-IP-Address = 127.0.1.1 NAS-Port = 1812 Message-Authenticator = 0xbe303901f2b855fb146f2f1fda9cd3fd # Executing section authorize from file /etc/freeradius/sites-enabled/default +- entering group authorize {...} ++[preprocess] returns ok ++[chap] returns noop ++[mschap] returns noop ++[digest] returns noop [suffix] No '@' in User-Name = "ttester", looking up realm NULL [suffix] No such realm "NULL" ++[suffix] returns noop [eap] No EAP-Message, not doing EAP ++[eap] returns noop [ldap] performing user authorization for ttester [ldap] expand: %{Stripped-User-Name} -> [ldap] ... expanding second conditional [ldap] expand: %{User-Name} -> ttester [ldap] expand: (uid=%{%{Stripped-User-Name}:-%{User-Name}}) -> (uid=ttester) [ldap] expand: ou=SeminaryOU,dc=seminary,dc=local -> ou=SeminaryOU,dc=seminary,dc=local [ldap] ldap_get_conn: Checking Id: 0 [ldap] ldap_get_conn: Got Id: 0 [ldap] attempting LDAP reconnection [ldap] (re)connect to seminary.local:389, authentication 0 [ldap] bind as cn=admin,dc=seminary,dc=local/FalseBINDINGPASS to seminary.local:389 [ldap] waiting for bind result ... [ldap] Bind was successful * [ldap] performing search in ou=SeminaryOU,dc=seminary,dc=local, with filter (uid=ttester)* [ldap] No default NMAS login sequence [ldap] looking for check items in directory... [ldap] userPassword -> Password-With-Header == "{SSHA}T4sU9zSLN/Auop+ImthH4nLyLG/rPU0R" [ldap] looking for reply items in directory... [ldap] user ttester authorized to use remote access [ldap] ldap_release_conn: Release Id: 0 ++[ldap] returns ok ++[expiration] returns noop ++[logintime] returns noop ++[pap] returns updated Found Auth-Type = PAP # Executing group from file /etc/freeradius/sites-enabled/default +- entering group PAP {...} [pap] login attempt with password "openldap" [pap] Using SSHA encryption. [pap] Normalizing SSHA1-Password from base64 encoding [pap] User authenticated successfully ++[pap] returns ok Login OK: [ttester] (from client localhost port 1812) # Executing section post-auth from file /etc/freeradius/sites-enabled/default +- entering group post-auth {...} ++[exec] returns noop Sending Access-Accept of id 59 to 127.0.0.1 port 38281 Finished request 0. Going to the next request Waking up in 4.9 seconds. Cleaning up request 0 ID 59 with timestamp +5 Ready to process requests. In any tutorials I am following this line: [ldap] performing search in ou=SeminaryOU,dc=seminary,dc=local, with filter (uid=ttester) .... should have the filter but in mine this is not coming. I am following this tutorial mainly: https://system-eng.blogspot.com.mt/2015/12/setting-up-freeradius-in-debian-w... My config files: /etc/freeradius/modules/ldap : http://paste.ubuntu.com/23060929/ /etc/freeradius/sites-available/inner-tunnel : http://paste.ubuntu.com/23060930/ /etc/freeradius/sites-available/default : http://paste.ubuntu.com/23060931/ /etc/freeradius/users : http://paste.ubuntu.com/23060935/ Any idea where I should start looking at the problem please? Thanks and best regards Matthew Matthew Pulis web: www.matthewpulis.info mob: +356 79539404
Hi,
I am trying to have dynamic VLAN assignment on Freeradius based on LDAP. The connection between Freeradius and LDAP works fine. If I test with a user I get the Authorise packet but not the dynamic VLAN assignment. We will be testing using this LDAP user:
how do you think you are doing the VLAN assignment? what method are you trying to use for the VLAN assignment? pulling values out of LDAP?
This is the received reply: radius@daloradius:~$ radtest -x ttester openldap localhost 1812 testing456 Sending Access-Request of id 30 to 127.0.0.1 port 1812 User-Name = "ttester" User-Password = "openldap" NAS-IP-Address = 127.0.1.1 NAS-Port = 1812 Message-Authenticator = 0x00000000000000000000000000000000 rad_recv: Access-Accept packet from host 127.0.0.1 port 1812, id=30, length=20
this is just a PAP request...so the request will only use the 'default' virtual server in your case
FreeRADIUS Version 2.1.12, for host x86_64-pc-linux-gnu, built on Feb 27 2015 at 12:38:34
obviously = old - upgrade
This is an extract of the Freeradius debug:
which shows not a single sign of policy to set the VLAN
My config files:
/etc/freeradius/modules/ldap : http://paste.ubuntu.com/23060929/
<snip> dont do that - either provide the 'radiusd -X' output, as requested as rules for this list, or put the text here. dont expect others to go off looking at other web sites for your config. alan
Dear Buxley, Thanks for your reply. I want to assign the VLAN according to which cn in LDAP is the user assigned. So ttester since he is in cn=SeminaryAdmin,ou=SeminaryOU,dc=seminary,dc=local he should get VLAN ID 12. I only have one virtual-server so I guess the default should work no? I took your advice to upgrade and this is the new version: freeradius: FreeRADIUS Version 2.2.8, for host x86_64-pc-linux-gnu, built on Apr 5 2016 at 13:40:43 which shows not a single sign of policy to set the VLAN <- this is why I am so lost as to why it is not working :S Some configs which I guess you might find useful to help me please: radiusd: #### Loading Virtual Servers #### server { # from file /etc/freeradius/radiusd.conf modules { Module: Creating Auth-Type = digest Module: Checking authenticate {...} for more modules to load Module: Linked to module rlm_pap Module: Instantiating module "pap" from file /etc/freeradius/modules/pap pap { encryption_scheme = "auto" auto_header = no } Module: Linked to module rlm_chap Module: Instantiating module "chap" from file /etc/freeradius/modules/chap Module: Linked to module rlm_mschap Module: Instantiating module "mschap" from file /etc/freeradius/modules/mschap mschap { use_mppe = yes require_encryption = no require_strong = no with_ntdomain_hack = no allow_retry = yes } Module: Linked to module rlm_digest Module: Instantiating module "digest" from file /etc/freeradius/modules/digest Module: Linked to module rlm_unix Module: Instantiating module "unix" from file /etc/freeradius/modules/unix unix { radwtmp = "/var/log/freeradius/radwtmp" } Module: Linked to module rlm_eap Module: Instantiating module "eap" from file /etc/freeradius/eap.conf eap { default_eap_type = "peap" timer_expire = 60 ignore_unknown_eap_types = no cisco_accounting_username_bug = no max_sessions = 4096 } Module: Instantiating eap-peap peap { default_eap_type = "mschapv2" copy_request_to_tunnel = no use_tunneled_reply = no proxy_tunneled_request_as_eap = yes virtual_server = "inner-tunnel" soh = no } Module: Linked to module rlm_ldap Module: Instantiating module "ldap" from file /etc/freeradius/modules/ldap ldap { server = "seminary.local" port = 389 password = "FAKEPASS" expect_password = yes identity = "cn=admin,dc=seminary,dc=local" net_timeout = 1 timeout = 4 timelimit = 3 max_uses = 0 tls_mode = no start_tls = no tls_require_cert = "allow" tls { start_tls = no require_cert = "allow" } basedn = "ou=SeminaryOU,dc=seminary,dc=local" filter = "(uid=%{%{Stripped-User-Name}:-%{User-Name}})" base_filter = "(objectclass=radiusprofile)" auto_header = no access_attr_used_for_allow = yes groupname_attribute = "cn" groupmembership_filter = "(|(&(objectClass=GroupOfNames)(member=%{control:Ldap-UserDn}))(&(objectClass=GroupOfUniqueNames)(uniquemember=%{control:Ldap-UserDn})))" groupmembership_attribute = "radiusGroupName" dictionary_mapping = "/etc/freeradius/ldap.attrmap" ldap_debug = 0 ldap_connections_number = 5 compare_check_items = no do_xlat = yes edir_account_policy_check = no set_auth_type = yes keepalive { idle = 60 probes = 3 interval = 3 } } Thanks for your support :) Matthew Pulis web: www.matthewpulis.info mob: +356 79539404 On Tue, Aug 16, 2016 at 11:14 AM, Matthew Pulis <mpulis@gmail.com> wrote:
Hi all,
I am trying to have dynamic VLAN assignment on Freeradius based on LDAP. The connection between Freeradius and LDAP works fine. If I test with a user I get the Authorise packet but not the dynamic VLAN assignment. We will be testing using this LDAP user:
# ttester, SeminaryAdmin, SeminaryOU, seminary.local dn: cn=ttester,cn=SeminaryAdmin,ou=SeminaryOU,dc=seminary,dc=local cn: ttester givenName: Test gidNumber: 505 homeDirectory: /home/users/ttester sn: Tester objectClass: inetOrgPerson objectClass: posixAccount objectClass: top uidNumber: 1002 uid: ttester
This is the received reply: radius@daloradius:~$ radtest -x ttester openldap localhost 1812 testing456 Sending Access-Request of id 30 to 127.0.0.1 port 1812 User-Name = "ttester" User-Password = "openldap" NAS-IP-Address = 127.0.1.1 NAS-Port = 1812 Message-Authenticator = 0x00000000000000000000000000000000 rad_recv: Access-Accept packet from host 127.0.0.1 port 1812, id=30, length=20
Freeradius version: FreeRADIUS Version 2.1.12, for host x86_64-pc-linux-gnu, built on Feb 27 2015 at 12:38:34
This is an extract of the Freeradius debug:
Ready to process requests. rad_recv: Access-Request packet from host 127.0.0.1 port 38281, id=59, length=77 User-Name = "ttester" User-Password = "openldap" NAS-IP-Address = 127.0.1.1 NAS-Port = 1812 Message-Authenticator = 0xbe303901f2b855fb146f2f1fda9cd3fd # Executing section authorize from file /etc/freeradius/sites-enabled/ default +- entering group authorize {...} ++[preprocess] returns ok ++[chap] returns noop ++[mschap] returns noop ++[digest] returns noop [suffix] No '@' in User-Name = "ttester", looking up realm NULL [suffix] No such realm "NULL" ++[suffix] returns noop [eap] No EAP-Message, not doing EAP ++[eap] returns noop [ldap] performing user authorization for ttester [ldap] expand: %{Stripped-User-Name} -> [ldap] ... expanding second conditional [ldap] expand: %{User-Name} -> ttester [ldap] expand: (uid=%{%{Stripped-User-Name}:-%{User-Name}}) -> (uid=ttester) [ldap] expand: ou=SeminaryOU,dc=seminary,dc=local -> ou=SeminaryOU,dc=seminary,dc=local [ldap] ldap_get_conn: Checking Id: 0 [ldap] ldap_get_conn: Got Id: 0 [ldap] attempting LDAP reconnection [ldap] (re)connect to seminary.local:389, authentication 0 [ldap] bind as cn=admin,dc=seminary,dc=local/FalseBINDINGPASS to seminary.local:389 [ldap] waiting for bind result ... [ldap] Bind was successful * [ldap] performing search in ou=SeminaryOU,dc=seminary,dc=local, with filter (uid=ttester)* [ldap] No default NMAS login sequence [ldap] looking for check items in directory... [ldap] userPassword -> Password-With-Header == "{SSHA}T4sU9zSLN/Auop+ ImthH4nLyLG/rPU0R" [ldap] looking for reply items in directory... [ldap] user ttester authorized to use remote access [ldap] ldap_release_conn: Release Id: 0 ++[ldap] returns ok ++[expiration] returns noop ++[logintime] returns noop ++[pap] returns updated Found Auth-Type = PAP # Executing group from file /etc/freeradius/sites-enabled/default +- entering group PAP {...} [pap] login attempt with password "openldap" [pap] Using SSHA encryption. [pap] Normalizing SSHA1-Password from base64 encoding [pap] User authenticated successfully ++[pap] returns ok Login OK: [ttester] (from client localhost port 1812) # Executing section post-auth from file /etc/freeradius/sites-enabled/ default +- entering group post-auth {...} ++[exec] returns noop Sending Access-Accept of id 59 to 127.0.0.1 port 38281 Finished request 0. Going to the next request Waking up in 4.9 seconds. Cleaning up request 0 ID 59 with timestamp +5 Ready to process requests.
In any tutorials I am following this line: [ldap] performing search in ou=SeminaryOU,dc=seminary,dc=local, with filter (uid=ttester) .... should have the filter but in mine this is not coming.
I am following this tutorial mainly: https://system-eng.blogspot. com.mt/2015/12/setting-up-freeradius-in-debian-with_28. html?showComment=1470925094566
My config files:
/etc/freeradius/modules/ldap : http://paste.ubuntu.com/23060929/ /etc/freeradius/sites-available/inner-tunnel : http://paste.ubuntu.com/ 23060930/ /etc/freeradius/sites-available/default : http://paste.ubuntu.com/ 23060931/ /etc/freeradius/users : http://paste.ubuntu.com/23060935/
Any idea where I should start looking at the problem please?
Thanks and best regards
Matthew
Matthew Pulis web: www.matthewpulis.info mob: +356 79539404
Hi,
I want to assign the VLAN according to which cn in LDAP is the user assigned. So ttester since he is in cn=SeminaryAdmin,ou=SeminaryOU,dc=seminary,dc=local he should get VLAN ID 12.
right...and how is that to be done? there is nothign saying 12 there 0- so obviously you need to do some lookup or translation....and then , via return attributes, set that value as per your NAS requirements. so first, check how to do the return attributes (read documentation) and then check out how to check a value and make a decision via eg unlang - the 'policy' part. RADIUS servers are dumb....all your config is doing is an auth check....and its likely that a real client will be doing an EAP method and so you'll need to configure inner-tunnel as required (check debug logs to see what server is doing) - and decide hwo you are going to make the policy decision in the inner tunnel (real userid) and pass it to the outer tunnel reply.
I took your advice to upgrade and this is the new version: freeradius: FreeRADIUS Version 2.2.8, for host x86_64-pc-linux-gnu, built on Apr 5 2016 at 13:40:43
3.0.11 is the current latest release/stable version. how did you upgrade? if you are using your distribution then ask them when they are going to be providing the latest FR and not code from years ago. use of mail archives helps for a quick boost here: http://lists.freeradius.org/pipermail/freeradius-users/2011-July/054952.html basically, you need to pull out ldap group info, then , using that info make a decision to set VLAN - then set it - either via unlang policy . or in users file. unlang method is way way better/ alan
Dear Alan Thanks again for your help and guidance. I forgot to paste the /users config file. This is it: DEFAULT Ldap-Group == "cn=Management,ou=SeminaryOU,dc=seminary,dc=local" Tunnel-Type = VLAN, Tunnel-Medium-Type = IEEE-802, Tunnel-Private-Group-Id = "1" #Reply-Message = "You are Accepted" DEFAULT Ldap-Group == "cn=Formators,ou=SeminaryOU,dc=seminary,dc=local" Tunnel-Type = VLAN, Tunnel-Medium-Type = IEEE-802, Tunnel-Private-Group-Id = "10" #Reply-Message = "You are Accepted" DEFAULT Ldap-Group == "cn=Seminarians,ou=SeminaryOU,dc=seminary,dc=local" Tunnel-Type = VLAN, Tunnel-Medium-Type = IEEE-802, Tunnel-Private-Group-Id = "11" #Reply-Message = "You are Accepted" DEFAULT Ldap-Group == "cn=SeminaryAdmin,ou=SeminaryOU,dc=seminary,dc=local" Tunnel-Type = VLAN, Tunnel-Medium-Type = IEEE-802, Tunnel-Private-Group-Id = "12" DEFAULT Ldap-Group == "cn=Staff,ou=SeminaryOU,dc=seminary,dc=local" Tunnel-Type = VLAN, Tunnel-Medium-Type = IEEE-802, Tunnel-Private-Group-Id = "13" #Reply-Message = "You are Accepted" DEFAULT Ldap-Group == "cn=Guests1,ou=SeminaryOU,dc=seminary,dc=local" Tunnel-Type = VLAN, Tunnel-Medium-Type = IEEE-802, Tunnel-Private-Group-Id = "20" #Reply-Message = "You are Accepted" DEFAULT Ldap-Group == "cn=Guests2,ou=SeminaryOU,dc=seminary,dc=local" Tunnel-Type = VLAN, Tunnel-Medium-Type = IEEE-802, Tunnel-Private-Group-Id = "30" #Reply-Message = "You are Accepted" DEFAULT Ldap-Group == "cn=School,ou=SeminaryOU,dc=seminary,dc=local" Tunnel-Type = VLAN, Tunnel-Medium-Type = IEEE-802, Tunnel-Private-Group-Id = "50" #Reply-Message = "You are Accepted" DEFAULT Auth-Type := Reject and the /ldap configuration: ldap { # # Note that this needs to match the name in the LDAP # server certificate, if you're using ldaps. server = "seminary.local" identity = "cn=admin,dc=seminary,dc=local" password = PASSOFADMIN basedn = "ou=SeminaryOU,dc=seminary,dc=local" filter = "(uid=%{%{Stripped-User-Name}:-%{User-Name}})" #base_filter = "(objectclass=radiusprofile)" #access_attr = "uid" # authtype = ldap # password_attribute = userPassword groupname_attribute = cn groupmembership_filter = "(|(&(objectClass=GroupOfNames)(member=%{control:Ldap-UserDn}))(&(objectClass=GroupOfUniqueNames)(uniquemember=%{control:Ldap-UserDn})))" groupmembership_attribute = radiusGroupName # How many connections to keep open to the LDAP server. # This saves time over opening a new LDAP socket for # every authentication request. ldap_connections_number = 5 # seconds to wait for LDAP query to finish. default: 20 timeout = 4 # seconds LDAP server has to process the query (server-side # time limit). default: 20 # # LDAP_OPT_TIMELIMIT is set to this value. timelimit = 3 Is that what you suggested in your reply? This should be the translation no? Matthew Pulis web: www.matthewpulis.info mob: +356 79539404 On Tue, Aug 16, 2016 at 8:36 PM, Matthew Pulis <mpulis@gmail.com> wrote:
Dear Buxley,
Thanks for your reply.
I want to assign the VLAN according to which cn in LDAP is the user assigned. So ttester since he is in cn=SeminaryAdmin,ou= SeminaryOU,dc=seminary,dc=local he should get VLAN ID 12.
I only have one virtual-server so I guess the default should work no?
I took your advice to upgrade and this is the new version: freeradius: FreeRADIUS Version 2.2.8, for host x86_64-pc-linux-gnu, built on Apr 5 2016 at 13:40:43
which shows not a single sign of policy to set the VLAN <- this is why I am so lost as to why it is not working :S
Some configs which I guess you might find useful to help me please:
radiusd: #### Loading Virtual Servers #### server { # from file /etc/freeradius/radiusd.conf modules { Module: Creating Auth-Type = digest Module: Checking authenticate {...} for more modules to load Module: Linked to module rlm_pap Module: Instantiating module "pap" from file /etc/freeradius/modules/pap pap { encryption_scheme = "auto" auto_header = no } Module: Linked to module rlm_chap Module: Instantiating module "chap" from file /etc/freeradius/modules/chap Module: Linked to module rlm_mschap Module: Instantiating module "mschap" from file /etc/freeradius/modules/mschap mschap { use_mppe = yes require_encryption = no require_strong = no with_ntdomain_hack = no allow_retry = yes } Module: Linked to module rlm_digest Module: Instantiating module "digest" from file /etc/freeradius/modules/digest Module: Linked to module rlm_unix Module: Instantiating module "unix" from file /etc/freeradius/modules/unix unix { radwtmp = "/var/log/freeradius/radwtmp" } Module: Linked to module rlm_eap Module: Instantiating module "eap" from file /etc/freeradius/eap.conf eap { default_eap_type = "peap" timer_expire = 60 ignore_unknown_eap_types = no cisco_accounting_username_bug = no max_sessions = 4096 }
Module: Instantiating eap-peap peap { default_eap_type = "mschapv2" copy_request_to_tunnel = no use_tunneled_reply = no proxy_tunneled_request_as_eap = yes virtual_server = "inner-tunnel" soh = no }
Module: Linked to module rlm_ldap Module: Instantiating module "ldap" from file /etc/freeradius/modules/ldap ldap { server = "seminary.local" port = 389 password = "FAKEPASS" expect_password = yes identity = "cn=admin,dc=seminary,dc=local" net_timeout = 1 timeout = 4 timelimit = 3 max_uses = 0 tls_mode = no start_tls = no tls_require_cert = "allow" tls { start_tls = no require_cert = "allow" } basedn = "ou=SeminaryOU,dc=seminary,dc=local" filter = "(uid=%{%{Stripped-User-Name}:-%{User-Name}})" base_filter = "(objectclass=radiusprofile)" auto_header = no access_attr_used_for_allow = yes groupname_attribute = "cn" groupmembership_filter = "(|(&(objectClass=GroupOfNames)(member=%{ control:Ldap-UserDn}))(&(objectClass=GroupOfUniqueNames)( uniquemember=%{control:Ldap-UserDn})))" groupmembership_attribute = "radiusGroupName" dictionary_mapping = "/etc/freeradius/ldap.attrmap" ldap_debug = 0 ldap_connections_number = 5 compare_check_items = no do_xlat = yes edir_account_policy_check = no set_auth_type = yes keepalive { idle = 60 probes = 3 interval = 3 } }
Thanks for your support :)
Matthew Pulis web: www.matthewpulis.info mob: +356 79539404
On Tue, Aug 16, 2016 at 11:14 AM, Matthew Pulis <mpulis@gmail.com> wrote:
Hi all,
I am trying to have dynamic VLAN assignment on Freeradius based on LDAP. The connection between Freeradius and LDAP works fine. If I test with a user I get the Authorise packet but not the dynamic VLAN assignment. We will be testing using this LDAP user:
# ttester, SeminaryAdmin, SeminaryOU, seminary.local dn: cn=ttester,cn=SeminaryAdmin,ou=SeminaryOU,dc=seminary,dc=local cn: ttester givenName: Test gidNumber: 505 homeDirectory: /home/users/ttester sn: Tester objectClass: inetOrgPerson objectClass: posixAccount objectClass: top uidNumber: 1002 uid: ttester
This is the received reply: radius@daloradius:~$ radtest -x ttester openldap localhost 1812 testing456 Sending Access-Request of id 30 to 127.0.0.1 port 1812 User-Name = "ttester" User-Password = "openldap" NAS-IP-Address = 127.0.1.1 NAS-Port = 1812 Message-Authenticator = 0x00000000000000000000000000000000 rad_recv: Access-Accept packet from host 127.0.0.1 port 1812, id=30, length=20
Freeradius version: FreeRADIUS Version 2.1.12, for host x86_64-pc-linux-gnu, built on Feb 27 2015 at 12:38:34
This is an extract of the Freeradius debug:
Ready to process requests. rad_recv: Access-Request packet from host 127.0.0.1 port 38281, id=59, length=77 User-Name = "ttester" User-Password = "openldap" NAS-IP-Address = 127.0.1.1 NAS-Port = 1812 Message-Authenticator = 0xbe303901f2b855fb146f2f1fda9cd3fd # Executing section authorize from file /etc/freeradius/sites-enabled/ default +- entering group authorize {...} ++[preprocess] returns ok ++[chap] returns noop ++[mschap] returns noop ++[digest] returns noop [suffix] No '@' in User-Name = "ttester", looking up realm NULL [suffix] No such realm "NULL" ++[suffix] returns noop [eap] No EAP-Message, not doing EAP ++[eap] returns noop [ldap] performing user authorization for ttester [ldap] expand: %{Stripped-User-Name} -> [ldap] ... expanding second conditional [ldap] expand: %{User-Name} -> ttester [ldap] expand: (uid=%{%{Stripped-User-Name}:-%{User-Name}}) -> (uid=ttester) [ldap] expand: ou=SeminaryOU,dc=seminary,dc=local -> ou=SeminaryOU,dc=seminary,dc=local [ldap] ldap_get_conn: Checking Id: 0 [ldap] ldap_get_conn: Got Id: 0 [ldap] attempting LDAP reconnection [ldap] (re)connect to seminary.local:389, authentication 0 [ldap] bind as cn=admin,dc=seminary,dc=local/FalseBINDINGPASS to seminary.local:389 [ldap] waiting for bind result ... [ldap] Bind was successful * [ldap] performing search in ou=SeminaryOU,dc=seminary,dc=local, with filter (uid=ttester)* [ldap] No default NMAS login sequence [ldap] looking for check items in directory... [ldap] userPassword -> Password-With-Header == "{SSHA}T4sU9zSLN/Auop+ImthH4nLyLG/rPU0R" [ldap] looking for reply items in directory... [ldap] user ttester authorized to use remote access [ldap] ldap_release_conn: Release Id: 0 ++[ldap] returns ok ++[expiration] returns noop ++[logintime] returns noop ++[pap] returns updated Found Auth-Type = PAP # Executing group from file /etc/freeradius/sites-enabled/default +- entering group PAP {...} [pap] login attempt with password "openldap" [pap] Using SSHA encryption. [pap] Normalizing SSHA1-Password from base64 encoding [pap] User authenticated successfully ++[pap] returns ok Login OK: [ttester] (from client localhost port 1812) # Executing section post-auth from file /etc/freeradius/sites-enabled/ default +- entering group post-auth {...} ++[exec] returns noop Sending Access-Accept of id 59 to 127.0.0.1 port 38281 Finished request 0. Going to the next request Waking up in 4.9 seconds. Cleaning up request 0 ID 59 with timestamp +5 Ready to process requests.
In any tutorials I am following this line: [ldap] performing search in ou=SeminaryOU,dc=seminary,dc=local, with filter (uid=ttester) .... should have the filter but in mine this is not coming.
I am following this tutorial mainly: https://system-eng.blogspot.co m.mt/2015/12/setting-up-freeradius-in-debian-with_28.html? showComment=1470925094566
My config files:
/etc/freeradius/modules/ldap : http://paste.ubuntu.com/23060929/ /etc/freeradius/sites-available/inner-tunnel : http://paste.ubuntu.com/23060930/ /etc/freeradius/sites-available/default : http://paste.ubuntu.com/230609 31/ /etc/freeradius/users : http://paste.ubuntu.com/23060935/
Any idea where I should start looking at the problem please?
Thanks and best regards
Matthew
Matthew Pulis web: www.matthewpulis.info mob: +356 79539404
On Wed, Aug 17, 2016 at 10:29:43AM +0200, Matthew Pulis wrote:
Thanks again for your help and guidance. I forgot to paste the /users config file. This is it:
From your debug output - you've commented out the "files" module, so this isn't being read.
I'd suggest you don't remove things from the default configuration unless you know what you're doing. Or get it all working first, then remove things one at a time, making sure you don't break anything in the process. Putting your configuration in version control such as git will help with this, and is highly recommended. Matthew -- Matthew Newton, Ph.D. <mcn4@leicester.ac.uk> Systems Specialist, Infrastructure Services, I.T. Services, University of Leicester, Leicester LE1 7RH, United Kingdom For IT help contact helpdesk extn. 2253, <ithelp@le.ac.uk>
Dear Matthew I did not comment files on purporse (as in it's not listed in the tutorial so I didn't do it) Can you please pinpoint which config file you are referring to as I have gone through all the config files and 'files' is un-commented everywhere (at least where I saw). Thanks and best regards matthew Matthew Pulis web: www.matthewpulis.info mob: +356 79539404
On Wed, Aug 17, 2016 at 04:06:40PM +0200, Matthew Pulis wrote:
I did not comment files on purporse (as in it's not listed in the tutorial so I didn't do it) Can you please pinpoint which config file you are referring to as I have gone through all the config files and 'files' is un-commented everywhere (at least where I saw).
There is no call to "files" in your debug output: On Tue, Aug 16, 2016 at 11:14:35AM +0200, Matthew Pulis wrote:
Ready to process requests. rad_recv: Access-Request packet from host 127.0.0.1 port 38281, id=59, length=77 User-Name = "ttester" User-Password = "openldap" NAS-IP-Address = 127.0.1.1 NAS-Port = 1812 Message-Authenticator = 0xbe303901f2b855fb146f2f1fda9cd3fd # Executing section authorize from file /etc/freeradius/sites-enabled/default +- entering group authorize {...} ++[preprocess] returns ok ++[chap] returns noop ++[mschap] returns noop ++[digest] returns noop [suffix] No '@' in User-Name = "ttester", looking up realm NULL [suffix] No such realm "NULL" ++[suffix] returns noop [eap] No EAP-Message, not doing EAP ++[eap] returns noop
[files] would normally be here.
[ldap] performing user authorization for ttester [ldap] expand: %{Stripped-User-Name} -> [ldap] ... expanding second conditional [ldap] expand: %{User-Name} -> ttester [ldap] expand: (uid=%{%{Stripped-User-Name}:-%{User-Name}}) -> (uid=ttester) [ldap] expand: ou=SeminaryOU,dc=seminary,dc=local -> ...
Look in sites-enabled/default in the authorize section.
My config files:
...
/etc/freeradius/sites-available/default : http://paste.ubuntu.com/23060931/
See line 170. That's not commented out in the default config. Matthew -- Matthew Newton, Ph.D. <mcn4@leicester.ac.uk> Systems Specialist, Infrastructure Services, I.T. Services, University of Leicester, Leicester LE1 7RH, United Kingdom For IT help contact helpdesk extn. 2253, <ithelp@le.ac.uk>
Dear Matthew Again thanks for your help :) That files comment was fixed but no luck :( The more it goes the more I'm loosing hope :( Your help is surely appreciated! radius@daloradius:~$ sudo freeradius -X [sudo] password for radius: freeradius: FreeRADIUS Version 2.2.8, for host x86_64-pc-linux-gnu, built on Apr 5 2016 at 13:40:43 Copyright (C) 1999-2015 The FreeRADIUS server project and contributors. There is NO warranty; not even for MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. You may redistribute copies of FreeRADIUS under the terms of the GNU General Public License. For more information about these matters, see the file named COPYRIGHT. Starting - reading configuration files ... including configuration file /etc/freeradius/radiusd.conf including configuration file /etc/freeradius/proxy.conf including configuration file /etc/freeradius/clients.conf including files in directory /etc/freeradius/modules/ including configuration file /etc/freeradius/modules/mschap including configuration file /etc/freeradius/modules/opendirectory including configuration file /etc/freeradius/modules/checkval including configuration file /etc/freeradius/modules/detail.example.com including configuration file /etc/freeradius/modules/always including configuration file /etc/freeradius/modules/krb5 including configuration file /etc/freeradius/modules/acct_unique including configuration file /etc/freeradius/modules/soh including configuration file /etc/freeradius/modules/redis including configuration file /etc/freeradius/modules/inner-eap including configuration file /etc/freeradius/modules/counter including configuration file /etc/freeradius/modules/dynamic_clients including configuration file /etc/freeradius/modules/logintime including configuration file /etc/freeradius/modules/mschap.bkp including configuration file /etc/freeradius/modules/smsotp including configuration file /etc/freeradius/modules/exec including configuration file /etc/freeradius/modules/mac2ip including configuration file /etc/freeradius/modules/realm including configuration file /etc/freeradius/modules/policy including configuration file /etc/freeradius/modules/cache including configuration file /etc/freeradius/modules/echo including configuration file /etc/freeradius/modules/smbpasswd including configuration file /etc/freeradius/modules/attr_rewrite including configuration file /etc/freeradius/modules/unix including configuration file /etc/freeradius/modules/detail.log including configuration file /etc/freeradius/modules/ippool including configuration file /etc/freeradius/modules/expr including configuration file /etc/freeradius/modules/ntlm_auth including configuration file /etc/freeradius/modules/pap including configuration file /etc/freeradius/modules/dhcp_sqlippool including configuration file /etc/freeradius/modules/ldap including configuration file /etc/freeradius/modules/digest including configuration file /etc/freeradius/modules/files including configuration file /etc/freeradius/modules/preprocess including configuration file /etc/freeradius/modules/perl including configuration file /etc/freeradius/modules/pam including configuration file /etc/freeradius/modules/detail including configuration file /etc/freeradius/modules/wimax including configuration file /etc/freeradius/modules/rediswho including configuration file /etc/freeradius/modules/etc_group including configuration file /etc/freeradius/modules/expiration including configuration file /etc/freeradius/modules/cui including configuration file /etc/freeradius/modules/chap including configuration file /etc/freeradius/modules/sqlcounter_expire_on_login including configuration file /etc/freeradius/modules/sradutmp including configuration file /etc/freeradius/modules/radrelay including configuration file /etc/freeradius/modules/radutmp including configuration file /etc/freeradius/modules/passwd including configuration file /etc/freeradius/modules/linelog including configuration file /etc/freeradius/modules/attr_filter including configuration file /etc/freeradius/modules/mac2vlan including configuration file /etc/freeradius/modules/otp including configuration file /etc/freeradius/modules/sql_log including configuration file /etc/freeradius/modules/replicate including configuration file /etc/freeradius/eap.conf including configuration file /etc/freeradius/policy.conf including files in directory /etc/freeradius/sites-enabled/ including configuration file /etc/freeradius/sites-enabled/inner-tunnel including configuration file /etc/freeradius/sites-enabled/default main { user = "freerad" group = "freerad" allow_core_dumps = no } including dictionary file /etc/freeradius/dictionary main { name = "freeradius" prefix = "/usr" localstatedir = "/var" sbindir = "/usr/sbin" logdir = "/var/log/freeradius" run_dir = "/var/run/freeradius" libdir = "/usr/lib/freeradius" radacctdir = "/var/log/freeradius/radacct" hostname_lookups = no max_request_time = 30 cleanup_delay = 5 max_requests = 1024 pidfile = "/var/run/freeradius/freeradius.pid" checkrad = "/usr/sbin/checkrad" debug_level = 0 proxy_requests = yes log { stripped_names = no auth = no auth_badpass = no auth_goodpass = no } security { max_attributes = 200 reject_delay = 1 status_server = yes allow_vulnerable_openssl = no } } radiusd: #### Loading Realms and Home Servers #### proxy server { retry_delay = 5 retry_count = 3 default_fallback = no dead_time = 120 wake_all_if_all_dead = no } home_server localhost { ipaddr = 127.0.0.1 port = 1812 type = "auth" secret = "testing123" response_window = 20 max_outstanding = 65536 require_message_authenticator = yes zombie_period = 40 status_check = "status-server" ping_interval = 30 check_interval = 30 num_answers_to_alive = 3 num_pings_to_alive = 3 revive_interval = 120 status_check_timeout = 4 coa { irt = 2 mrt = 16 mrc = 5 mrd = 30 } } home_server_pool my_auth_failover { type = fail-over home_server = localhost } realm example.com { auth_pool = my_auth_failover } realm LOCAL { } radiusd: #### Loading Clients #### client localhost { ipaddr = 127.0.0.1 require_message_authenticator = no secret = "testing456" nastype = "other" } client 192.168.100.0/24 { require_message_authenticator = no secret = "testing456" shortname = "NAS" } radiusd: #### Instantiating modules #### instantiate { Module: Linked to module rlm_exec Module: Instantiating module "exec" from file /etc/freeradius/modules/exec exec { wait = no input_pairs = "request" shell_escape = yes timeout = 10 } Module: Linked to module rlm_expr Module: Instantiating module "expr" from file /etc/freeradius/modules/expr Module: Linked to module rlm_expiration Module: Instantiating module "expiration" from file /etc/freeradius/modules/expiration expiration { reply-message = "Password Has Expired " } Module: Linked to module rlm_logintime Module: Instantiating module "logintime" from file /etc/freeradius/modules/logintime logintime { reply-message = "You are calling outside your allowed timespan " minimum-timeout = 60 } } radiusd: #### Loading Virtual Servers #### server { # from file /etc/freeradius/radiusd.conf modules { Module: Creating Auth-Type = digest Module: Checking authenticate {...} for more modules to load Module: Linked to module rlm_pap Module: Instantiating module "pap" from file /etc/freeradius/modules/pap pap { encryption_scheme = "auto" auto_header = no } Module: Linked to module rlm_chap Module: Instantiating module "chap" from file /etc/freeradius/modules/chap Module: Linked to module rlm_mschap Module: Instantiating module "mschap" from file /etc/freeradius/modules/mschap mschap { use_mppe = yes require_encryption = no require_strong = no with_ntdomain_hack = no allow_retry = yes } Module: Linked to module rlm_digest Module: Instantiating module "digest" from file /etc/freeradius/modules/digest Module: Linked to module rlm_unix Module: Instantiating module "unix" from file /etc/freeradius/modules/unix unix { radwtmp = "/var/log/freeradius/radwtmp" } Module: Linked to module rlm_eap Module: Instantiating module "eap" from file /etc/freeradius/eap.conf eap { default_eap_type = "peap" timer_expire = 60 ignore_unknown_eap_types = no cisco_accounting_username_bug = no max_sessions = 4096 } Module: Linked to sub-module rlm_eap_md5 Module: Instantiating eap-md5 Module: Linked to sub-module rlm_eap_leap Module: Instantiating eap-leap Module: Linked to sub-module rlm_eap_gtc Module: Instantiating eap-gtc gtc { challenge = "Password: " auth_type = "PAP" } Module: Linked to sub-module rlm_eap_tls Module: Instantiating eap-tls tls { rsa_key_exchange = no dh_key_exchange = yes rsa_key_length = 512 dh_key_length = 512 verify_depth = 0 CA_path = "/etc/freeradius/certs" pem_file_type = yes private_key_file = "/etc/freeradius/certs/server.key" certificate_file = "/etc/freeradius/certs/server.pem" CA_file = "/etc/freeradius/certs/ca.pem" private_key_password = "whatever" dh_file = "/etc/freeradius/certs/dh" random_file = "/dev/urandom" fragment_size = 1024 include_length = yes check_crl = no check_all_crl = no cipher_list = "DEFAULT" make_cert_command = "/etc/freeradius/certs/bootstrap" ecdh_curve = "prime256v1" cache { enable = no lifetime = 24 max_entries = 255 } verify { } ocsp { enable = no override_cert_url = yes url = "http://127.0.0.1/ocsp/" use_nonce = yes timeout = 0 softfail = no } } Module: Linked to sub-module rlm_eap_ttls Module: Instantiating eap-ttls ttls { default_eap_type = "md5" copy_request_to_tunnel = no use_tunneled_reply = yes virtual_server = "inner-tunnel" include_length = yes } Module: Linked to sub-module rlm_eap_peap Module: Instantiating eap-peap peap { default_eap_type = "mschapv2" copy_request_to_tunnel = no use_tunneled_reply = no proxy_tunneled_request_as_eap = yes virtual_server = "inner-tunnel" soh = no } Module: Linked to sub-module rlm_eap_mschapv2 Module: Instantiating eap-mschapv2 mschapv2 { with_ntdomain_hack = no send_error = no } Module: Checking authorize {...} for more modules to load Module: Linked to module rlm_preprocess Module: Instantiating module "preprocess" from file /etc/freeradius/modules/preprocess preprocess { huntgroups = "/etc/freeradius/huntgroups" hints = "/etc/freeradius/hints" with_ascend_hack = no ascend_channels_per_line = 23 with_ntdomain_hack = no with_specialix_jetstream_hack = no with_cisco_vsa_hack = no with_alvarion_vsa_hack = no } reading pairlist file /etc/freeradius/huntgroups reading pairlist file /etc/freeradius/hints Module: Linked to module rlm_realm Module: Instantiating module "suffix" from file /etc/freeradius/modules/realm realm suffix { format = "suffix" delimiter = "@" ignore_default = no ignore_null = no } Module: Linked to module rlm_files Module: Instantiating module "files" from file /etc/freeradius/modules/files files { usersfile = "/etc/freeradius/users" acctusersfile = "/etc/freeradius/acct_users" preproxy_usersfile = "/etc/freeradius/preproxy_users" compat = "no" } reading pairlist file /etc/freeradius/users reading pairlist file /etc/freeradius/acct_users reading pairlist file /etc/freeradius/preproxy_users Module: Linked to module rlm_ldap Module: Instantiating module "ldap" from file /etc/freeradius/modules/ldap ldap { server = "seminary.local" port = 389 password = "LDAPPASS" expect_password = yes identity = "cn=admin,dc=seminary,dc=local" net_timeout = 1 timeout = 4 timelimit = 3 max_uses = 0 tls_mode = no start_tls = no tls_require_cert = "allow" tls { start_tls = no require_cert = "allow" } basedn = "ou=SeminaryOU,dc=seminary,dc=local" filter = "(uid=%{%{Stripped-User-Name}:-%{User-Name}})" base_filter = "(objectclass=radiusprofile)" auto_header = no access_attr_used_for_allow = yes groupname_attribute = "cn" groupmembership_filter = "(|(&(objectClass=GroupOfNames)(member=%{control:Ldap-UserDn}))(&(objectClass=GroupOfUniqueNames)(uniquemember=%{control:Ldap-UserDn})))" dictionary_mapping = "/etc/freeradius/ldap.attrmap" ldap_debug = 0 ldap_connections_number = 5 compare_check_items = no do_xlat = yes edir_account_policy_check = no set_auth_type = yes keepalive { idle = 60 probes = 3 interval = 3 } } rlm_ldap: Registering ldap_groupcmp for Ldap-Group rlm_ldap: Registering ldap_xlat with xlat_name ldap rlm_ldap: Over-riding set_auth_type, as there is no module ldap listed in the "authenticate" section. rlm_ldap: reading ldap<->radius mappings from file /etc/freeradius/ldap.attrmap rlm_ldap: LDAP radiusCheckItem mapped to RADIUS $GENERIC$ rlm_ldap: LDAP radiusReplyItem mapped to RADIUS $GENERIC$ rlm_ldap: LDAP radiusAuthType mapped to RADIUS Auth-Type rlm_ldap: LDAP radiusSimultaneousUse mapped to RADIUS Simultaneous-Use rlm_ldap: LDAP radiusCalledStationId mapped to RADIUS Called-Station-Id rlm_ldap: LDAP radiusCallingStationId mapped to RADIUS Calling-Station-Id rlm_ldap: LDAP lmPassword mapped to RADIUS LM-Password rlm_ldap: LDAP ntPassword mapped to RADIUS NT-Password rlm_ldap: LDAP sambaLmPassword mapped to RADIUS LM-Password rlm_ldap: LDAP sambaNtPassword mapped to RADIUS NT-Password rlm_ldap: LDAP dBCSPwd mapped to RADIUS LM-Password rlm_ldap: LDAP userPassword mapped to RADIUS Password-With-Header rlm_ldap: LDAP acctFlags mapped to RADIUS SMB-Account-CTRL-TEXT rlm_ldap: LDAP radiusExpiration mapped to RADIUS Expiration rlm_ldap: LDAP radiusNASIpAddress mapped to RADIUS NAS-IP-Address rlm_ldap: LDAP radiusServiceType mapped to RADIUS Service-Type rlm_ldap: LDAP radiusFramedProtocol mapped to RADIUS Framed-Protocol rlm_ldap: LDAP radiusFramedIPAddress mapped to RADIUS Framed-IP-Address rlm_ldap: LDAP radiusFramedIPNetmask mapped to RADIUS Framed-IP-Netmask rlm_ldap: LDAP radiusFramedRoute mapped to RADIUS Framed-Route rlm_ldap: LDAP radiusFramedRouting mapped to RADIUS Framed-Routing rlm_ldap: LDAP radiusFilterId mapped to RADIUS Filter-Id rlm_ldap: LDAP radiusFramedMTU mapped to RADIUS Framed-MTU rlm_ldap: LDAP radiusFramedCompression mapped to RADIUS Framed-Compression rlm_ldap: LDAP radiusLoginIPHost mapped to RADIUS Login-IP-Host rlm_ldap: LDAP radiusLoginService mapped to RADIUS Login-Service rlm_ldap: LDAP radiusLoginTCPPort mapped to RADIUS Login-TCP-Port rlm_ldap: LDAP radiusCallbackNumber mapped to RADIUS Callback-Number rlm_ldap: LDAP radiusCallbackId mapped to RADIUS Callback-Id rlm_ldap: LDAP radiusFramedIPXNetwork mapped to RADIUS Framed-IPX-Network rlm_ldap: LDAP radiusClass mapped to RADIUS Class rlm_ldap: LDAP radiusSessionTimeout mapped to RADIUS Session-Timeout rlm_ldap: LDAP radiusIdleTimeout mapped to RADIUS Idle-Timeout rlm_ldap: LDAP radiusTerminationAction mapped to RADIUS Termination-Action rlm_ldap: LDAP radiusLoginLATService mapped to RADIUS Login-LAT-Service rlm_ldap: LDAP radiusLoginLATNode mapped to RADIUS Login-LAT-Node rlm_ldap: LDAP radiusLoginLATGroup mapped to RADIUS Login-LAT-Group rlm_ldap: LDAP radiusFramedAppleTalkLink mapped to RADIUS Framed-AppleTalk-Link rlm_ldap: LDAP radiusFramedAppleTalkNetwork mapped to RADIUS Framed-AppleTalk-Network rlm_ldap: LDAP radiusFramedAppleTalkZone mapped to RADIUS Framed-AppleTalk-Zone rlm_ldap: LDAP radiusPortLimit mapped to RADIUS Port-Limit rlm_ldap: LDAP radiusLoginLATPort mapped to RADIUS Login-LAT-Port rlm_ldap: LDAP radiusReplyMessage mapped to RADIUS Reply-Message rlm_ldap: LDAP radiusTunnelType mapped to RADIUS Tunnel-Type rlm_ldap: LDAP radiusTunnelMediumType mapped to RADIUS Tunnel-Medium-Type rlm_ldap: LDAP radiusTunnelPrivateGroupId mapped to RADIUS Tunnel-Private-Group-Id conns: 0x1dc3c60 Module: Checking preacct {...} for more modules to load Module: Linked to module rlm_acct_unique Module: Instantiating module "acct_unique" from file /etc/freeradius/modules/acct_unique acct_unique { key = "User-Name, Acct-Session-Id, NAS-IP-Address, NAS-Identifier, NAS-Port" } Module: Checking accounting {...} for more modules to load Module: Linked to module rlm_detail Module: Instantiating module "detail" from file /etc/freeradius/modules/detail detail { detailfile = "/var/log/freeradius/radacct/%{%{Packet-Src-IP-Address}:-%{Packet-Src-IPv6-Address}}/detail-%Y%m%d" header = "%t" detailperm = 384 dirperm = 493 locking = no log_packet_header = no escape_filenames = no } Module: Linked to module rlm_attr_filter Module: Instantiating module "attr_filter.accounting_response" from file /etc/freeradius/modules/attr_filter attr_filter attr_filter.accounting_response { attrsfile = "/etc/freeradius/attrs.accounting_response" key = "%{User-Name}" relaxed = no } reading pairlist file /etc/freeradius/attrs.accounting_response Module: Checking session {...} for more modules to load Module: Linked to module rlm_radutmp Module: Instantiating module "radutmp" from file /etc/freeradius/modules/radutmp radutmp { filename = "/var/log/freeradius/radutmp" username = "%{User-Name}" case_sensitive = yes check_with_nas = yes perm = 384 callerid = yes } Module: Checking post-proxy {...} for more modules to load Module: Checking post-auth {...} for more modules to load Module: Instantiating module "attr_filter.access_reject" from file /etc/freeradius/modules/attr_filter attr_filter attr_filter.access_reject { attrsfile = "/etc/freeradius/attrs.access_reject" key = "%{User-Name}" relaxed = no } reading pairlist file /etc/freeradius/attrs.access_reject } # modules } # server server inner-tunnel { # from file /etc/freeradius/sites-enabled/inner-tunnel modules { Module: Checking authenticate {...} for more modules to load Module: Checking authorize {...} for more modules to load Module: Checking session {...} for more modules to load Module: Checking post-proxy {...} for more modules to load Module: Checking post-auth {...} for more modules to load } # modules } # server radiusd: #### Opening IP addresses and Ports #### listen { type = "auth" ipaddr = * port = 0 } listen { type = "acct" ipaddr = * port = 0 } listen { type = "auth" ipaddr = 127.0.0.1 port = 18120 } ... adding new socket proxy address * port 40828 Listening on authentication address * port 1812 Listening on accounting address * port 1813 Listening on authentication address 127.0.0.1 port 18120 as server inner-tunnel Listening on proxy address * port 1814 Ready to process requests. rad_recv: Access-Request packet from host 127.0.0.1 port 38475, id=3, length=77 User-Name = "ttester" User-Password = "openldap" NAS-IP-Address = 127.0.1.1 NAS-Port = 1812 Message-Authenticator = 0x249a6d3696ec0d28cf6c6ad68d1edb02 # Executing section authorize from file /etc/freeradius/sites-enabled/default +group authorize { ++[preprocess] = ok ++[chap] = noop ++[mschap] = noop ++[digest] = noop [suffix] No '@' in User-Name = "ttester", looking up realm NULL [suffix] No such realm "NULL" ++[suffix] = noop [eap] No EAP-Message, not doing EAP ++[eap] = noop ++[files] = noop [ldap] performing user authorization for ttester [ldap] expand: %{Stripped-User-Name} -> [ldap] ... expanding second conditional [ldap] expand: %{User-Name} -> ttester [ldap] expand: (uid=%{%{Stripped-User-Name}:-%{User-Name}}) -> (uid=ttester) [ldap] expand: ou=SeminaryOU,dc=seminary,dc=local -> ou=SeminaryOU,dc=seminary,dc=local [ldap] ldap_get_conn: Checking Id: 0 [ldap] ldap_get_conn: Got Id: 0 [ldap] attempting LDAP reconnection [ldap] (re)connect to seminary.local:389, authentication 0 [ldap] bind as cn=admin,dc=seminary,dc=local/S3m1n4ry to seminary.local:389 [ldap] waiting for bind result ... [ldap] Bind was successful [ldap] performing search in ou=SeminaryOU,dc=seminary,dc=local, with filter (uid=ttester) [ldap] No default NMAS login sequence [ldap] looking for check items in directory... [ldap] userPassword -> Password-With-Header == "{SSHA}T4sU9zSLN/Auop+ImthH4nLyLG/rPU0R" [ldap] looking for reply items in directory... [ldap] ldap_release_conn: Release Id: 0 ++[ldap] = ok ++[expiration] = noop ++[logintime] = noop ++[pap] = updated +} # group authorize = updated Found Auth-Type = PAP # Executing group from file /etc/freeradius/sites-enabled/default +group PAP { [pap] login attempt with password "openldap" [pap] Using SSHA encryption. [pap] Normalizing SSHA1-Password from base64 encoding [pap] User authenticated successfully ++[pap] = ok +} # group PAP = ok # Executing section post-auth from file /etc/freeradius/sites-enabled/default +group post-auth { ++[exec] = noop +} # group post-auth = noop Sending Access-Accept of id 3 to 127.0.0.1 port 38475 Finished request 0. Going to the next request Waking up in 4.9 seconds. ^C Matthew Pulis web: www.matthewpulis.info mob: +356 79539404 On Wed, Aug 17, 2016 at 4:06 PM, Matthew Pulis <mpulis@gmail.com> wrote:
Dear Matthew
I did not comment files on purporse (as in it's not listed in the tutorial so I didn't do it) Can you please pinpoint which config file you are referring to as I have gone through all the config files and 'files' is un-commented everywhere (at least where I saw).
Thanks and best regards
matthew
Matthew Pulis web: www.matthewpulis.info mob: +356 79539404
Hi,
That files comment was fixed but no luck :( The more it goes the more I'm loosing hope :( Your help is surely appreciated!
the more it goes the more experienced with the server you should get. note: [ldap] looking for reply items in directory... [ldap] ldap_release_conn: Release Id: 0 ++[ldap] = ok so that looks like you havent configured the server to provide return items... if thats the case you need to set the reply items by policy - eg unlang or files... but you are not:
# Executing section post-auth from file /etc/freeradius/sites-enabled/default +group post-auth { ++[exec] = noop +} # group post-auth = noop Sending Access-Accept of id 3 to 127.0.0.1 port 38475
nothing in post-auth, just the default call to exec. use unlang in post-auth to do policy , or configure the reply items directive. alan
Is this to what you are referring Alan please? DEFAULT Ldap-Group == "cn=SeminaryAdmin,ou=SeminaryOU,dc=seminary,dc=local" Tunnel-Type = VLAN, Tunnel-Medium-Type = IEEE-802, Tunnel-Private-Group-Id = "12" #Reply-Message = "You are Accepted" and this: in: /sites-enabled/default: But there is a bug in update-reply .. not sure why: Thu Aug 18 11:41:05 2016 : Error: /etc/freeradius/sites-enabled/default[465]: Failed to find "update-reply" in the "modules" section. Thu Aug 18 11:41:05 2016 : Error: /etc/freeradius/sites-enabled/default[465]: Failed to parse "update-reply" subsection. Thu Aug 18 11:41:05 2016 : Error: /etc/freeradius/sites-enabled/default[461]: Errors parsing post-auth section. post-auth { if (Ldap-Group == "Management") { update-reply { Tunnel-Type = VLAN, Tunnel-Medium-Type = 802, Tunnel-Private-Group-ID = 1 } } elsif (Ldap-Group == "Formators") { update-reply { Tunnel-Type = VLAN, Tunnel-Medium-Type = 802, Tunnel-Private-Group-ID = 10 } } elsif (Ldap-Group == "Seminarians") { update-reply { Tunnel-Type = VLAN, Tunnel-Medium-Type = 802, Tunnel-Private-Group-ID = 11 } } elsif (Ldap-Group == "SeminaryAdmin") { update-reply { Tunnel-Type = VLAN, Tunnel-Medium-Type = 802, Tunnel-Private-Group-ID = 12 } } elsif (Ldap-Group == "Staff") { update-reply { Tunnel-Type = VLAN, Tunnel-Medium-Type = 802, Tunnel-Private-Group-ID = 13 } } elsif (Ldap-Group == "Guests") { update-reply { Tunnel-Type = VLAN, Tunnel-Medium-Type = 802, Tunnel-Private-Group-ID = 20 } } else { reject }
Hi, Fixed the syntax error. But now authentication is not working. Would truly appreciate your help :) This is ttester: cn=ttester,cn=SeminaryAdmin,ou=SeminaryOU,dc=seminary,dc=local Thu Aug 18 12:01:24 2016 : Debug: Listening on proxy address * port 1814 Thu Aug 18 12:01:24 2016 : Info: Ready to process requests. rad_recv: Access-Request packet from host 127.0.0.1 port 35174, id=199, length=77 User-Name = "ttester" User-Password = "openldap" NAS-IP-Address = 127.0.1.1 NAS-Port = 1812 Message-Authenticator = 0x8d240eb2d64bf34cbd940c5728a88e14 Thu Aug 18 12:01:29 2016 : Info: # Executing section authorize from file /etc/freeradius/sites-enabled/default Thu Aug 18 12:01:29 2016 : Info: +group authorize { Thu Aug 18 12:01:29 2016 : Info: ++[preprocess] = ok Thu Aug 18 12:01:29 2016 : Info: ++[chap] = noop Thu Aug 18 12:01:29 2016 : Info: ++[mschap] = noop Thu Aug 18 12:01:29 2016 : Info: ++[digest] = noop Thu Aug 18 12:01:29 2016 : Info: [suffix] No '@' in User-Name = "ttester", looking up realm NULL Thu Aug 18 12:01:29 2016 : Info: [suffix] No such realm "NULL" Thu Aug 18 12:01:29 2016 : Info: ++[suffix] = noop Thu Aug 18 12:01:29 2016 : Info: [eap] No EAP-Message, not doing EAP Thu Aug 18 12:01:29 2016 : Info: ++[eap] = noop Thu Aug 18 12:01:29 2016 : Info: ++[files] = noop Thu Aug 18 12:01:29 2016 : Info: [ldap] performing user authorization for ttester Thu Aug 18 12:01:29 2016 : Info: [ldap] expand: %{Stripped-User-Name} -> Thu Aug 18 12:01:29 2016 : Info: [ldap] ... expanding second conditional Thu Aug 18 12:01:29 2016 : Info: [ldap] expand: %{User-Name} -> ttester Thu Aug 18 12:01:29 2016 : Info: [ldap] expand: (uid=%{%{Stripped-User-Name}:-%{User-Name}}) -> (uid=ttester) Thu Aug 18 12:01:29 2016 : Info: [ldap] expand: ou=SeminaryOU,dc=seminary,dc=local -> ou=SeminaryOU,dc=seminary,dc=local Thu Aug 18 12:01:29 2016 : Debug: [ldap] ldap_get_conn: Checking Id: 0 Thu Aug 18 12:01:29 2016 : Debug: [ldap] ldap_get_conn: Got Id: 0 Thu Aug 18 12:01:29 2016 : Debug: [ldap] attempting LDAP reconnection Thu Aug 18 12:01:29 2016 : Debug: [ldap] (re)connect to seminary.local:389, authentication 0 Thu Aug 18 12:01:29 2016 : Debug: [ldap] bind as cn=admin,dc=seminary,dc=local/S3m1n4ry to seminary.local:389 Thu Aug 18 12:01:29 2016 : Debug: [ldap] waiting for bind result ... Thu Aug 18 12:01:29 2016 : Debug: [ldap] Bind was successful Thu Aug 18 12:01:29 2016 : Debug: [ldap] performing search in ou=SeminaryOU,dc=seminary,dc=local, with filter (uid=ttester) Thu Aug 18 12:01:29 2016 : Info: [ldap] No default NMAS login sequence Thu Aug 18 12:01:29 2016 : Info: [ldap] looking for check items in directory... Thu Aug 18 12:01:29 2016 : Debug: [ldap] userPassword -> Password-With-Header == "{SSHA}T4sU9zSLN/Auop+ImthH4nLyLG/rPU0R" Thu Aug 18 12:01:29 2016 : Info: [ldap] looking for reply items in directory... Thu Aug 18 12:01:29 2016 : Debug: [ldap] ldap_release_conn: Release Id: 0 Thu Aug 18 12:01:29 2016 : Info: ++[ldap] = ok Thu Aug 18 12:01:29 2016 : Info: ++[expiration] = noop Thu Aug 18 12:01:29 2016 : Info: ++[logintime] = noop Thu Aug 18 12:01:29 2016 : Info: ++[pap] = updated Thu Aug 18 12:01:29 2016 : Info: +} # group authorize = updated Thu Aug 18 12:01:29 2016 : Info: Found Auth-Type = PAP Thu Aug 18 12:01:29 2016 : Info: # Executing group from file /etc/freeradius/sites-enabled/default Thu Aug 18 12:01:29 2016 : Info: +group PAP { Thu Aug 18 12:01:29 2016 : Info: [pap] login attempt with password "openldap" Thu Aug 18 12:01:29 2016 : Info: [pap] Using SSHA encryption. Thu Aug 18 12:01:29 2016 : Info: [pap] Normalizing SSHA1-Password from base64 encoding Thu Aug 18 12:01:29 2016 : Info: [pap] User authenticated successfully Thu Aug 18 12:01:29 2016 : Info: ++[pap] = ok Thu Aug 18 12:01:29 2016 : Info: +} # group PAP = ok Thu Aug 18 12:01:29 2016 : Info: # Executing section post-auth from file /etc/freeradius/sites-enabled/default Thu Aug 18 12:01:29 2016 : Info: +group post-auth { Thu Aug 18 12:01:29 2016 : Info: ++? if (Ldap-Group == "Management") Thu Aug 18 12:01:29 2016 : Debug: [ldap] Entering ldap_groupcmp() Thu Aug 18 12:01:29 2016 : Info: expand: ou=SeminaryOU,dc=seminary,dc=local -> ou=SeminaryOU,dc=seminary,dc=local Thu Aug 18 12:01:29 2016 : Info: expand: (|(&(objectClass=GroupOfNames)(member=%{control:Ldap-UserDn}))(&(objectClass=GroupOfUniqueNames)(uniquemember=%{control:Ldap-UserDn}))) -> (|(&(objectClass=GroupOfNames)(member=cn\3dttester\2ccn\3dSeminaryAdmin\2cou\3dSeminaryOU\2cdc\3dseminary\2cdc\3dlocal))(&(objectClass=GroupOfUniqueNames)(uniquemember=cn\3dttester\2ccn\3dSeminaryAdmin\2cou\3dSeminaryOU\2cdc\3dseminary\2cdc\3dlocal))) Thu Aug 18 12:01:29 2016 : Debug: [ldap] ldap_get_conn: Checking Id: 0 Thu Aug 18 12:01:29 2016 : Debug: [ldap] ldap_get_conn: Got Id: 0 Thu Aug 18 12:01:29 2016 : Debug: [ldap] performing search in ou=SeminaryOU,dc=seminary,dc=local, with filter (&(cn=Management)(|(&(objectClass=GroupOfNames)(member=cn\3dttester\2ccn\3dSeminaryAdmin\2cou\3dSeminaryOU\2cdc\3dseminary\2cdc\3dlocal))(&(objectClass=GroupOfUniqueNames)(uniquemember=cn\3dttester\2ccn\3dSeminaryAdmin\2cou\3dSeminaryOU\2cdc\3dseminary\2cdc\3dlocal)))) Thu Aug 18 12:01:29 2016 : Debug: [ldap] object not found Thu Aug 18 12:01:29 2016 : Debug: [ldap] ldap_release_conn: Release Id: 0 Thu Aug 18 12:01:29 2016 : Debug: rlm_ldap::ldap_groupcmp: Group Management not found or user is not a member. Thu Aug 18 12:01:29 2016 : Info: ? Evaluating (Ldap-Group == "Management") -> FALSE Thu Aug 18 12:01:29 2016 : Info: ++? if (Ldap-Group == "Management") -> FALSE Thu Aug 18 12:01:29 2016 : Info: ++? elsif (Ldap-Group == "Formators") Thu Aug 18 12:01:29 2016 : Debug: [ldap] Entering ldap_groupcmp() Thu Aug 18 12:01:29 2016 : Info: expand: ou=SeminaryOU,dc=seminary,dc=local -> ou=SeminaryOU,dc=seminary,dc=local Thu Aug 18 12:01:29 2016 : Info: expand: (|(&(objectClass=GroupOfNames)(member=%{control:Ldap-UserDn}))(&(objectClass=GroupOfUniqueNames)(uniquemember=%{control:Ldap-UserDn}))) -> (|(&(objectClass=GroupOfNames)(member=cn\3dttester\2ccn\3dSeminaryAdmin\2cou\3dSeminaryOU\2cdc\3dseminary\2cdc\3dlocal))(&(objectClass=GroupOfUniqueNames)(uniquemember=cn\3dttester\2ccn\3dSeminaryAdmin\2cou\3dSeminaryOU\2cdc\3dseminary\2cdc\3dlocal))) Thu Aug 18 12:01:29 2016 : Debug: [ldap] ldap_get_conn: Checking Id: 0 Thu Aug 18 12:01:29 2016 : Debug: [ldap] ldap_get_conn: Got Id: 0 Thu Aug 18 12:01:29 2016 : Debug: [ldap] performing search in ou=SeminaryOU,dc=seminary,dc=local, with filter (&(cn=Formators)(|(&(objectClass=GroupOfNames)(member=cn\3dttester\2ccn\3dSeminaryAdmin\2cou\3dSeminaryOU\2cdc\3dseminary\2cdc\3dlocal))(&(objectClass=GroupOfUniqueNames)(uniquemember=cn\3dttester\2ccn\3dSeminaryAdmin\2cou\3dSeminaryOU\2cdc\3dseminary\2cdc\3dlocal)))) Thu Aug 18 12:01:29 2016 : Debug: [ldap] object not found Thu Aug 18 12:01:29 2016 : Debug: [ldap] ldap_release_conn: Release Id: 0 Thu Aug 18 12:01:29 2016 : Debug: rlm_ldap::ldap_groupcmp: Group Formators not found or user is not a member. Thu Aug 18 12:01:29 2016 : Info: ? Evaluating (Ldap-Group == "Formators") -> FALSE Thu Aug 18 12:01:29 2016 : Info: ++? elsif (Ldap-Group == "Formators") -> FALSE Thu Aug 18 12:01:29 2016 : Info: ++? elsif (Ldap-Group == "Seminarians") Thu Aug 18 12:01:29 2016 : Debug: [ldap] Entering ldap_groupcmp() Thu Aug 18 12:01:29 2016 : Info: expand: ou=SeminaryOU,dc=seminary,dc=local -> ou=SeminaryOU,dc=seminary,dc=local Thu Aug 18 12:01:29 2016 : Info: expand: (|(&(objectClass=GroupOfNames)(member=%{control:Ldap-UserDn}))(&(objectClass=GroupOfUniqueNames)(uniquemember=%{control:Ldap-UserDn}))) -> (|(&(objectClass=GroupOfNames)(member=cn\3dttester\2ccn\3dSeminaryAdmin\2cou\3dSeminaryOU\2cdc\3dseminary\2cdc\3dlocal))(&(objectClass=GroupOfUniqueNames)(uniquemember=cn\3dttester\2ccn\3dSeminaryAdmin\2cou\3dSeminaryOU\2cdc\3dseminary\2cdc\3dlocal))) Thu Aug 18 12:01:29 2016 : Debug: [ldap] ldap_get_conn: Checking Id: 0 Thu Aug 18 12:01:29 2016 : Debug: [ldap] ldap_get_conn: Got Id: 0 Thu Aug 18 12:01:29 2016 : Debug: [ldap] performing search in ou=SeminaryOU,dc=seminary,dc=local, with filter (&(cn=Seminarians)(|(&(objectClass=GroupOfNames)(member=cn\3dttester\2ccn\3dSeminaryAdmin\2cou\3dSeminaryOU\2cdc\3dseminary\2cdc\3dlocal))(&(objectClass=GroupOfUniqueNames)(uniquemember=cn\3dttester\2ccn\3dSeminaryAdmin\2cou\3dSeminaryOU\2cdc\3dseminary\2cdc\3dlocal)))) Thu Aug 18 12:01:29 2016 : Debug: [ldap] object not found Thu Aug 18 12:01:29 2016 : Debug: [ldap] ldap_release_conn: Release Id: 0 Thu Aug 18 12:01:29 2016 : Debug: rlm_ldap::ldap_groupcmp: Group Seminarians not found or user is not a member. Thu Aug 18 12:01:29 2016 : Info: ? Evaluating (Ldap-Group == "Seminarians") -> FALSE Thu Aug 18 12:01:29 2016 : Info: ++? elsif (Ldap-Group == "Seminarians") -> FALSE Thu Aug 18 12:01:29 2016 : Info: ++? elsif (Ldap-Group == "SeminaryAdmin") Thu Aug 18 12:01:29 2016 : Debug: [ldap] Entering ldap_groupcmp() Thu Aug 18 12:01:29 2016 : Info: expand: ou=SeminaryOU,dc=seminary,dc=local -> ou=SeminaryOU,dc=seminary,dc=local Thu Aug 18 12:01:29 2016 : Info: expand: (|(&(objectClass=GroupOfNames)(member=%{control:Ldap-UserDn}))(&(objectClass=GroupOfUniqueNames)(uniquemember=%{control:Ldap-UserDn}))) -> (|(&(objectClass=GroupOfNames)(member=cn\3dttester\2ccn\3dSeminaryAdmin\2cou\3dSeminaryOU\2cdc\3dseminary\2cdc\3dlocal))(&(objectClass=GroupOfUniqueNames)(uniquemember=cn\3dttester\2ccn\3dSeminaryAdmin\2cou\3dSeminaryOU\2cdc\3dseminary\2cdc\3dlocal))) Thu Aug 18 12:01:29 2016 : Debug: [ldap] ldap_get_conn: Checking Id: 0 Thu Aug 18 12:01:29 2016 : Debug: [ldap] ldap_get_conn: Got Id: 0 Thu Aug 18 12:01:29 2016 : Debug: [ldap] performing search in ou=SeminaryOU,dc=seminary,dc=local, with filter (&(cn=SeminaryAdmin)(|(&(objectClass=GroupOfNames)(member=cn\3dttester\2ccn\3dSeminaryAdmin\2cou\3dSeminaryOU\2cdc\3dseminary\2cdc\3dlocal))(&(objectClass=GroupOfUniqueNames)(uniquemember=cn\3dttester\2ccn\3dSeminaryAdmin\2cou\3dSeminaryOU\2cdc\3dseminary\2cdc\3dlocal)))) Thu Aug 18 12:01:29 2016 : Debug: [ldap] object not found Thu Aug 18 12:01:29 2016 : Debug: [ldap] ldap_release_conn: Release Id: 0 Thu Aug 18 12:01:29 2016 : Debug: rlm_ldap::ldap_groupcmp: Group SeminaryAdmin not found or user is not a member. Thu Aug 18 12:01:29 2016 : Info: ? Evaluating (Ldap-Group == "SeminaryAdmin") -> FALSE Thu Aug 18 12:01:29 2016 : Info: ++? elsif (Ldap-Group == "SeminaryAdmin") -> FALSE Thu Aug 18 12:01:29 2016 : Info: ++? elsif (Ldap-Group == "Staff") Thu Aug 18 12:01:29 2016 : Debug: [ldap] Entering ldap_groupcmp() Thu Aug 18 12:01:29 2016 : Info: expand: ou=SeminaryOU,dc=seminary,dc=local -> ou=SeminaryOU,dc=seminary,dc=local Thu Aug 18 12:01:29 2016 : Info: expand: (|(&(objectClass=GroupOfNames)(member=%{control:Ldap-UserDn}))(&(objectClass=GroupOfUniqueNames)(uniquemember=%{control:Ldap-UserDn}))) -> (|(&(objectClass=GroupOfNames)(member=cn\3dttester\2ccn\3dSeminaryAdmin\2cou\3dSeminaryOU\2cdc\3dseminary\2cdc\3dlocal))(&(objectClass=GroupOfUniqueNames)(uniquemember=cn\3dttester\2ccn\3dSeminaryAdmin\2cou\3dSeminaryOU\2cdc\3dseminary\2cdc\3dlocal))) Thu Aug 18 12:01:29 2016 : Debug: [ldap] ldap_get_conn: Checking Id: 0 Thu Aug 18 12:01:29 2016 : Debug: [ldap] ldap_get_conn: Got Id: 0 Thu Aug 18 12:01:29 2016 : Debug: [ldap] performing search in ou=SeminaryOU,dc=seminary,dc=local, with filter (&(cn=Staff)(|(&(objectClass=GroupOfNames)(member=cn\3dttester\2ccn\3dSeminaryAdmin\2cou\3dSeminaryOU\2cdc\3dseminary\2cdc\3dlocal))(&(objectClass=GroupOfUniqueNames)(uniquemember=cn\3dttester\2ccn\3dSeminaryAdmin\2cou\3dSeminaryOU\2cdc\3dseminary\2cdc\3dlocal)))) Thu Aug 18 12:01:29 2016 : Debug: [ldap] object not found Thu Aug 18 12:01:29 2016 : Debug: [ldap] ldap_release_conn: Release Id: 0 Thu Aug 18 12:01:29 2016 : Debug: rlm_ldap::ldap_groupcmp: Group Staff not found or user is not a member. Thu Aug 18 12:01:29 2016 : Info: ? Evaluating (Ldap-Group == "Staff") -> FALSE Thu Aug 18 12:01:29 2016 : Info: ++? elsif (Ldap-Group == "Staff") -> FALSE Thu Aug 18 12:01:29 2016 : Info: ++? elsif (Ldap-Group == "Guests") Thu Aug 18 12:01:29 2016 : Debug: [ldap] Entering ldap_groupcmp() Thu Aug 18 12:01:29 2016 : Info: expand: ou=SeminaryOU,dc=seminary,dc=local -> ou=SeminaryOU,dc=seminary,dc=local Thu Aug 18 12:01:29 2016 : Info: expand: (|(&(objectClass=GroupOfNames)(member=%{control:Ldap-UserDn}))(&(objectClass=GroupOfUniqueNames)(uniquemember=%{control:Ldap-UserDn}))) -> (|(&(objectClass=GroupOfNames)(member=cn\3dttester\2ccn\3dSeminaryAdmin\2cou\3dSeminaryOU\2cdc\3dseminary\2cdc\3dlocal))(&(objectClass=GroupOfUniqueNames)(uniquemember=cn\3dttester\2ccn\3dSeminaryAdmin\2cou\3dSeminaryOU\2cdc\3dseminary\2cdc\3dlocal))) Thu Aug 18 12:01:29 2016 : Debug: [ldap] ldap_get_conn: Checking Id: 0 Thu Aug 18 12:01:29 2016 : Debug: [ldap] ldap_get_conn: Got Id: 0 Thu Aug 18 12:01:29 2016 : Debug: [ldap] performing search in ou=SeminaryOU,dc=seminary,dc=local, with filter (&(cn=Guests)(|(&(objectClass=GroupOfNames)(member=cn\3dttester\2ccn\3dSeminaryAdmin\2cou\3dSeminaryOU\2cdc\3dseminary\2cdc\3dlocal))(&(objectClass=GroupOfUniqueNames)(uniquemember=cn\3dttester\2ccn\3dSeminaryAdmin\2cou\3dSeminaryOU\2cdc\3dseminary\2cdc\3dlocal)))) Thu Aug 18 12:01:29 2016 : Debug: [ldap] object not found Thu Aug 18 12:01:29 2016 : Debug: [ldap] ldap_release_conn: Release Id: 0 Thu Aug 18 12:01:29 2016 : Debug: rlm_ldap::ldap_groupcmp: Group Guests not found or user is not a member. Thu Aug 18 12:01:29 2016 : Info: ? Evaluating (Ldap-Group == "Guests") -> FALSE Thu Aug 18 12:01:29 2016 : Info: ++? elsif (Ldap-Group == "Guests") -> FALSE Thu Aug 18 12:01:29 2016 : Info: ++else else { Thu Aug 18 12:01:29 2016 : Info: +++[reject] = reject Thu Aug 18 12:01:29 2016 : Info: ++} # else else = reject Thu Aug 18 12:01:29 2016 : Info: +} # group post-auth = reject Thu Aug 18 12:01:29 2016 : Info: Using Post-Auth-Type Reject Thu Aug 18 12:01:29 2016 : Info: # Executing group from file /etc/freeradius/sites-enabled/default Thu Aug 18 12:01:29 2016 : Info: +group REJECT { Thu Aug 18 12:01:29 2016 : Info: [eap] Request didn't contain an EAP-Message, not inserting EAP-Failure Thu Aug 18 12:01:29 2016 : Info: ++[eap] = noop Thu Aug 18 12:01:29 2016 : Info: [attr_filter.access_reject] expand: %{User-Name} -> ttester Thu Aug 18 12:01:29 2016 : Debug: attr_filter: Matched entry DEFAULT at line 11 Thu Aug 18 12:01:29 2016 : Info: ++[attr_filter.access_reject] = updated Thu Aug 18 12:01:29 2016 : Info: +} # group REJECT = updated Thu Aug 18 12:01:29 2016 : Info: Delaying reject of request 0 for 1 seconds Thu Aug 18 12:01:29 2016 : Debug: Going to the next request Thu Aug 18 12:01:29 2016 : Debug: Waking up in 0.9 seconds. Thu Aug 18 12:01:30 2016 : Info: Sending delayed reject for request 0 Sending Access-Reject of id 199 to 127.0.0.1 port 35174 Thu Aug 18 12:01:30 2016 : Debug: Waking up in 4.9 seconds. Thu Aug 18 12:01:35 2016 : Info: Cleaning up request 0 ID 199 with timestamp +5 Thu Aug 18 12:01:35 2016 : Info: Ready to process requests. Matthew Pulis web: www.matthewpulis.info mob: +356 79539404 On Thu, Aug 18, 2016 at 11:44 AM, Matthew Pulis <mpulis@gmail.com> wrote:
Is this to what you are referring Alan please?
DEFAULT Ldap-Group == "cn=SeminaryAdmin,ou=SeminaryOU,dc=seminary,dc= local" Tunnel-Type = VLAN, Tunnel-Medium-Type = IEEE-802, Tunnel-Private-Group-Id = "12" #Reply-Message = "You are Accepted"
and this: in: /sites-enabled/default:
But there is a bug in update-reply .. not sure why:
Thu Aug 18 11:41:05 2016 : Error: /etc/freeradius/sites-enabled/default[465]: Failed to find "update-reply" in the "modules" section. Thu Aug 18 11:41:05 2016 : Error: /etc/freeradius/sites-enabled/default[465]: Failed to parse "update-reply" subsection. Thu Aug 18 11:41:05 2016 : Error: /etc/freeradius/sites-enabled/default[461]: Errors parsing post-auth section.
post-auth {
if (Ldap-Group == "Management") { update-reply { Tunnel-Type = VLAN, Tunnel-Medium-Type = 802, Tunnel-Private-Group-ID = 1 } }
elsif (Ldap-Group == "Formators") { update-reply { Tunnel-Type = VLAN, Tunnel-Medium-Type = 802, Tunnel-Private-Group-ID = 10 } }
elsif (Ldap-Group == "Seminarians") { update-reply { Tunnel-Type = VLAN, Tunnel-Medium-Type = 802, Tunnel-Private-Group-ID = 11 } }
elsif (Ldap-Group == "SeminaryAdmin") { update-reply { Tunnel-Type = VLAN, Tunnel-Medium-Type = 802, Tunnel-Private-Group-ID = 12 } }
elsif (Ldap-Group == "Staff") { update-reply { Tunnel-Type = VLAN, Tunnel-Medium-Type = 802, Tunnel-Private-Group-ID = 13 } }
elsif (Ldap-Group == "Guests") { update-reply { Tunnel-Type = VLAN, Tunnel-Medium-Type = 802, Tunnel-Private-Group-ID = 20 } }
else { reject }
Hi all again, Thanks for your patience and help. A few more improvements yet I'm still stuck :( This is /etc/freeradius/sites-default/inner-tunnel: (the section post_auth) if (Ldap-Group == "SeminaryAdmin") { update reply { Tunnel-Type := "VLAN", Tunnel-Medium-Type := "802", Tunnel-Private-Group-ID := "12" } } I tried Ldap-Group == SeminaryAdmin / "SeminaryAdmin" / "cn=SeminaryAdmin,ou=SeminaryOU,dc=seminary,dc=local" but neither of the 3 options worked. Can you please suggest further, this is really mind boggling!! :( This is the debug log: Fri Aug 19 11:01:56 2016 : Info: # Executing section authorize from file /etc/freeradius/sites-enabled/default Fri Aug 19 11:01:56 2016 : Info: +group authorize { Fri Aug 19 11:01:56 2016 : Info: ++[preprocess] = ok Fri Aug 19 11:01:56 2016 : Info: ++[chap] = noop Fri Aug 19 11:01:56 2016 : Info: ++[mschap] = noop Fri Aug 19 11:01:56 2016 : Info: ++[digest] = noop Fri Aug 19 11:01:56 2016 : Info: [suffix] No '@' in User-Name = "ttester", looking up realm NULL Fri Aug 19 11:01:56 2016 : Info: [suffix] No such realm "NULL" Fri Aug 19 11:01:56 2016 : Info: ++[suffix] = noop Fri Aug 19 11:01:56 2016 : Info: [eap] No EAP-Message, not doing EAP Fri Aug 19 11:01:56 2016 : Info: ++[eap] = noop Fri Aug 19 11:01:56 2016 : Info: ++[files] = noop Fri Aug 19 11:01:56 2016 : Info: [ldap] performing user authorization for ttester Fri Aug 19 11:01:56 2016 : Info: [ldap] expand: %{Stripped-User-Name} -> Fri Aug 19 11:01:56 2016 : Info: [ldap] ... expanding second conditional Fri Aug 19 11:01:56 2016 : Info: [ldap] expand: %{User-Name} -> ttester Fri Aug 19 11:01:56 2016 : Info: [ldap] expand: (uid=%{%{Stripped-User-Name}:-%{User-Name}}) -> (uid=ttester) Fri Aug 19 11:01:56 2016 : Info: [ldap] expand: ou=SeminaryOU,dc=seminary,dc=local -> ou=SeminaryOU,dc=seminary,dc=local Fri Aug 19 11:01:56 2016 : Debug: [ldap] ldap_get_conn: Checking Id: 0 Fri Aug 19 11:01:56 2016 : Debug: [ldap] ldap_get_conn: Got Id: 0 Fri Aug 19 11:01:56 2016 : Debug: [ldap] attempting LDAP reconnection Fri Aug 19 11:01:56 2016 : Debug: [ldap] (re)connect to seminary.local:389, authentication 0 Fri Aug 19 11:01:56 2016 : Debug: [ldap] bind as cn=admin,dc=seminary,dc=local/S3m1n4ry to seminary.local:389 Fri Aug 19 11:01:56 2016 : Debug: [ldap] waiting for bind result ... Fri Aug 19 11:01:56 2016 : Debug: [ldap] Bind was successful Fri Aug 19 11:01:56 2016 : Debug: [ldap] performing search in ou=SeminaryOU,dc=seminary,dc=local, with filter (uid=ttester) Fri Aug 19 11:01:56 2016 : Info: [ldap] No default NMAS login sequence Fri Aug 19 11:01:56 2016 : Info: [ldap] looking for check items in directory... Fri Aug 19 11:01:56 2016 : Debug: [ldap] userPassword -> Password-With-Header == "{SSHA}T4sU9zSLN/Auop+ImthH4nLyLG/rPU0R" Fri Aug 19 11:01:56 2016 : Info: [ldap] looking for reply items in directory... Fri Aug 19 11:01:56 2016 : Debug: [ldap] ldap_release_conn: Release Id: 0 Fri Aug 19 11:01:56 2016 : Info: ++[ldap] = ok Fri Aug 19 11:01:56 2016 : Info: ++[expiration] = noop Fri Aug 19 11:01:56 2016 : Info: ++[logintime] = noop Fri Aug 19 11:01:56 2016 : Info: ++[pap] = updated Fri Aug 19 11:01:56 2016 : Info: +} # group authorize = updated Fri Aug 19 11:01:56 2016 : Info: Found Auth-Type = PAP Fri Aug 19 11:01:56 2016 : Info: # Executing group from file /etc/freeradius/sites-enabled/default Fri Aug 19 11:01:56 2016 : Info: +group PAP { Fri Aug 19 11:01:56 2016 : Info: [pap] login attempt with password "openldap" Fri Aug 19 11:01:56 2016 : Info: [pap] Using SSHA encryption. Fri Aug 19 11:01:56 2016 : Info: [pap] Normalizing SSHA1-Password from base64 encoding Fri Aug 19 11:01:56 2016 : Info: [pap] User authenticated successfully Fri Aug 19 11:01:56 2016 : Info: ++[pap] = ok Fri Aug 19 11:01:56 2016 : Info: +} # group PAP = ok Fri Aug 19 11:01:56 2016 : Info: # Executing section post-auth from file /etc/freeradius/sites-enabled/default Fri Aug 19 11:01:56 2016 : Info: +group post-auth { Fri Aug 19 11:01:56 2016 : Info: ++? if (Ldap-Group == SeminaryAdmin) Fri Aug 19 11:01:56 2016 : Debug: [ldap] Entering ldap_groupcmp() Fri Aug 19 11:01:56 2016 : Info: expand: ou=SeminaryOU,dc=seminary,dc=local -> ou=SeminaryOU,dc=seminary,dc=local Fri Aug 19 11:01:56 2016 : Info: expand: (|(&(objectClass=GroupOfNames)(member=%{control:Ldap-UserDn}))(&(objectClass=GroupOfUniqueNames)(uniquemember=%{control:Ldap-UserDn}))) -> (|(&(objectClass=GroupOfNames)(member=cn\3dttester\2ccn\3dSeminaryAdmin\2cou\3dSeminaryOU\2cdc\3dseminary\2cdc\3dlocal))(&(objectClass=GroupOfUniqueNames)(uniquemember=cn\3dttester\2ccn\3dSeminaryAdmin\2cou\3dSeminaryOU\2cdc\3dseminary\2cdc\3dlocal))) Fri Aug 19 11:01:56 2016 : Debug: [ldap] ldap_get_conn: Checking Id: 0 Fri Aug 19 11:01:56 2016 : Debug: [ldap] ldap_get_conn: Got Id: 0 Fri Aug 19 11:01:56 2016 : Debug: [ldap] performing search in ou=SeminaryOU,dc=seminary,dc=local, with filter (&(cn=SeminaryAdmin)(|(&(objectClass=GroupOfNames)(member=cn\3dttester\2ccn\3dSeminaryAdmin\2cou\3dSeminaryOU\2cdc\3dseminary\2cdc\3dlocal))(&(objectClass=GroupOfUniqueNames)(uniquemember=cn\3dttester\2ccn\3dSeminaryAdmin\2cou\3dSeminaryOU\2cdc\3dseminary\2cdc\3dlocal)))) Fri Aug 19 11:01:56 2016 : Debug: [ldap] object not found Fri Aug 19 11:01:56 2016 : Debug: [ldap] ldap_release_conn: Release Id: 0 Fri Aug 19 11:01:56 2016 : Debug: rlm_ldap::ldap_groupcmp: Group SeminaryAdmin not found or user is not a member. Fri Aug 19 11:01:56 2016 : Info: ? Evaluating (Ldap-Group == SeminaryAdmin) -> FALSE Fri Aug 19 11:01:56 2016 : Info: ++? if (Ldap-Group == SeminaryAdmin) -> FALSE Fri Aug 19 11:01:56 2016 : Info: ++else else { Fri Aug 19 11:01:56 2016 : Info: +++[reject] = reject Fri Aug 19 11:01:56 2016 : Info: ++} # else else = reject Fri Aug 19 11:01:56 2016 : Info: +} # group post-auth = reject Fri Aug 19 11:01:56 2016 : Info: Using Post-Auth-Type Reject Fri Aug 19 11:01:56 2016 : Info: # Executing group from file /etc/freeradius/sites-enabled/default Fri Aug 19 11:01:56 2016 : Info: +group REJECT { Fri Aug 19 11:01:56 2016 : Info: [eap] Request didn't contain an EAP-Message, not inserting EAP-Failure Fri Aug 19 11:01:56 2016 : Info: ++[eap] = noop Fri Aug 19 11:01:56 2016 : Info: [attr_filter.access_reject] expand: %{User-Name} -> ttester Fri Aug 19 11:01:56 2016 : Debug: attr_filter: Matched entry DEFAULT at line 11 Fri Aug 19 11:01:56 2016 : Info: ++[attr_filter.access_reject] = updated Fri Aug 19 11:01:56 2016 : Info: +} # group REJECT = updated Fri Aug 19 11:01:56 2016 : Info: Delaying reject of request 0 for 1 seconds Fri Aug 19 11:01:56 2016 : Debug: Going to the next request Fri Aug 19 11:01:56 2016 : Debug: Waking up in 0.9 seconds. Fri Aug 19 11:01:57 2016 : Info: Sending delayed reject for request 0 Sending Access-Reject of id 4 to 127.0.0.1 port 49728 Fri Aug 19 11:01:57 2016 : Debug: Waking up in 4.9 seconds. Fri Aug 19 11:02:02 2016 : Info: Cleaning up request 0 ID 4 with timestamp +3 Fri Aug 19 11:02:02 2016 : Info: Ready to process requests.
On Fri, Aug 19, 2016 at 11:08:52AM +0200, Matthew Pulis wrote:
Thanks for your patience and help. A few more improvements yet I'm still stuck :(
This is /etc/freeradius/sites-default/inner-tunnel: (the section post_auth)
if (Ldap-Group == "SeminaryAdmin") { update reply { Tunnel-Type := "VLAN", Tunnel-Medium-Type := "802", Tunnel-Private-Group-ID := "12" } }
You aren't doing EAP, so the inner-tunnel isn't being used. This config should go in sites-enabled/default.
I tried Ldap-Group == SeminaryAdmin / "SeminaryAdmin" / "cn=SeminaryAdmin,ou=SeminaryOU,dc=seminary,dc=local" but neither of the 3 options worked.
There's no magic - the values are just plugged into the settings in the config file, and fed to the ldap server. So the debug output shows you what the actual query is. The only comment here is you're using version 2 of the server, which is now EOL and obsolete, and the ldap module has been rewritten in version 3. So the config you're writing is more restrictive in what it can do and people will be less inclined to help here. But it should work.
Can you please suggest further, this is really mind boggling!! :(
Fri Aug 19 11:01:56 2016 : Info: # Executing section post-auth from file /etc/freeradius/sites-enabled/default Fri Aug 19 11:01:56 2016 : Info: +group post-auth {
But looks like you've got it in sites-enabled/default as well...
Fri Aug 19 11:01:56 2016 : Info: ++? if (Ldap-Group == SeminaryAdmin) Fri Aug 19 11:01:56 2016 : Debug: [ldap] Entering ldap_groupcmp() Fri Aug 19 11:01:56 2016 : Info: expand: ou=SeminaryOU,dc=seminary,dc=local -> ou=SeminaryOU,dc=seminary,dc=local Fri Aug 19 11:01:56 2016 : Info: expand: (|(&(objectClass=GroupOfNames)(member=%{control:Ldap-UserDn}))(&(objectClass=GroupOfUniqueNames)(uniquemember=%{control:Ldap-UserDn}))) -> (|(&(objectClass=GroupOfNames)(member=cn\3dttester\2ccn\3dSeminaryAdmin\2cou\3dSeminaryOU\2cdc\3dseminary\2cdc\3dlocal))(&(objectClass=GroupOfUniqueNames)(uniquemember=cn\3dttester\2ccn\3dSeminaryAdmin\2cou\3dSeminaryOU\2cdc\3dseminary\2cdc\3dlocal))) Fri Aug 19 11:01:56 2016 : Debug: [ldap] ldap_get_conn: Checking Id: 0 Fri Aug 19 11:01:56 2016 : Debug: [ldap] ldap_get_conn: Got Id: 0 Fri Aug 19 11:01:56 2016 : Debug: [ldap] performing search in ou=SeminaryOU,dc=seminary,dc=local, with filter (&(cn=SeminaryAdmin)(|(&(objectClass=GroupOfNames)(member=cn\3dttester\2ccn\3dSeminaryAdmin\2cou\3dSeminaryOU\2cdc\3dseminary\2cdc\3dlocal))(&(objectClass=GroupOfUniqueNames)(uniquemember=cn\3dttester\2ccn\3dSeminaryAdmin\2cou\3dSeminaryOU\2cdc\3dseminary\2cdc\3dlocal)))) Fri Aug 19 11:01:56 2016 : Debug: [ldap] object not found
Feed these exact queries into e.g. ldapsearch or some other LDAP search tool, and see if they come up with the required results. My guess is not. In which case, update the ldap queries in modules/ldap to match the layout of your directory.
Fri Aug 19 11:01:56 2016 : Debug: [ldap] ldap_release_conn: Release Id: 0 Fri Aug 19 11:01:56 2016 : Debug: rlm_ldap::ldap_groupcmp: Group SeminaryAdmin not found or user is not a member.
Looks right - the query didn't return any results. Matthew -- Matthew Newton, Ph.D. <mcn4@leicester.ac.uk> Systems Specialist, Infrastructure Services, I.T. Services, University of Leicester, Leicester LE1 7RH, United Kingdom For IT help contact helpdesk extn. 2253, <ithelp@le.ac.uk>
Dear Matthew Thanks for your reply. It was in sites-enabled/default .. not sure why I wrote /inner-tunnel here .. must be the amount of files I have been opening that confused me. This is the ttester ldap search. I am seeing them matching :S radius@daloradius:/etc/freeradius$ ldapsearch -h localhost -D "cn=admin,dc=seminary,dc=local" -w PASSWORD -b "cn=ttester,cn=SeminaryAdmin,ou=SeminaryOU,dc=seminary,dc=local" # extended LDIF # # LDAPv3 # base <cn=ttester,cn=SeminaryAdmin,ou=SeminaryOU,dc=seminary,dc=local> with scope subtree # filter: (objectclass=*) # requesting: ALL # # ttester, SeminaryAdmin, SeminaryOU, seminary.local dn: cn=ttester,cn=SeminaryAdmin,ou=SeminaryOU,dc=seminary,dc=local cn: ttester givenName: Test gidNumber: 505 homeDirectory: /home/users/ttester sn: Tester objectClass: inetOrgPerson objectClass: posixAccount objectClass: top userPassword:: e1NTSEF9VDRzVTl6U0xOL0F1b3ArSW10aEg0bkx5TEcvclBVMFI= uidNumber: 1002 uid: ttester # search result search: 2 result: 0 Success # numResponses: 2 # numEntries: 1 radius@daloradius:/etc/freeradius$ RE Freeradius version: not sure if I should go for one different to my distro :S Many thanks
On Fri, Aug 19, 2016 at 12:24:18PM +0200, Matthew Pulis wrote:
This is the ttester ldap search. I am seeing them matching :S
radius@daloradius:/etc/freeradius$ ldapsearch -h localhost -D "cn=admin,dc=seminary,dc=local" -w PASSWORD -b "cn=ttester,cn=SeminaryAdmin,ou=SeminaryOU,dc=seminary,dc=local"
That isn't the same search. Read the debug output:
ou=SeminaryOU,dc=seminary,dc=local, with filter (&(cn=SeminaryAdmin)(|(&(objectClass=GroupOfNames)(member=cn\3dttester\2ccn\3dSeminaryAdmin\2cou\3dSeminaryOU\2cdc\3dseminary\2cdc\3dlocal))(&(objectClass=GroupOfUniqueNames)(uniquemember=cn\3dttester\2ccn\3dSeminaryAdmin\2cou\3dSeminaryOU\2cdc\3dseminary\2cdc\3dlocal))))
What result do you get when you use the same filter?
RE Freeradius version: not sure if I should go for one different to my distro :S
The biggest problem is the newest version in any distro is 3.0.4, and that is two years old. Most distros have version 2, which is even older. FreeRADIUS is now up to 3.0.11 (nearly 12) and 4.0 is in the works. There's no effort or desire to support obsolete software that distros can't be bothered to update. Also, if you're building a new service on obsolete software, then you're only going to create more work for yourself in the future. The config from 2.x to 3.x isn't directly compatible. Matthew -- Matthew Newton, Ph.D. <mcn4@leicester.ac.uk> Systems Specialist, Infrastructure Services, I.T. Services, University of Leicester, Leicester LE1 7RH, United Kingdom For IT help contact helpdesk extn. 2253, <ithelp@le.ac.uk>
Hi again Matt radius@daloradius:/etc/freeradius$ ldapsearch -h localhost -D "cn=admin,dc=seminary,dc=local" -w S3m1n4ry -b "cn=ttester,cn=SeminaryAdmin,ou=SeminaryOU,dc=seminary,dc=local" filter="(&(cn=SeminaryAdmin)(|(&(objectClass=GroupOfNames)(member=cn\3dttester\2ccn\3dSeminaryAdmin\2cou\3dSeminaryOU\2cdc\3dseminary\2cdc\3dlocal))(&(objectClass=GroupOfUniqueNames)(uniquemember=cn\3dttester\2ccn\3dSeminaryAdmin\2cou\3dSeminaryOU\2cdc\3dseminary\2cdc\3dlocal))))" # extended LDIF # # LDAPv3 # base <cn=ttester,cn=SeminaryAdmin,ou=SeminaryOU,dc=seminary,dc=local> with scope subtree # filter: filter=(&(cn=SeminaryAdmin)(|(&(objectClass=GroupOfNames)(member=cn\3dttester\2ccn\3dSeminaryAdmin\2cou\3dSeminaryOU\2cdc\3dseminary\2cdc\3dlocal))(&(objectClass=GroupOfUniqueNames)(uniquemember=cn\3dttester\2ccn\3dSeminaryAdmin\2cou\3dSeminaryOU\2cdc\3dseminary\2cdc\3dlocal)))) # requesting: ALL # ldap_search_ext: Bad search filter (-7) The thing is that this filter has been copied many a time from many tutorials and they all agree, could you please point out as from where I should start tackling the issue? It's all overwhelming at this stage! Would truly appreciate your help Thanks
On Fri, Aug 19, 2016 at 03:24:34PM +0200, Matthew Pulis wrote:
radius@daloradius:/etc/freeradius$ ldapsearch -h localhost -D "cn=admin,dc=seminary,dc=local" -w S3m1n4ry -b "cn=ttester,cn=SeminaryAdmin,ou=SeminaryOU,dc=seminary,dc=local" filter="(&(cn=SeminaryAdmin)(|(&(objectClass=GroupOfNames)(member=cn\3dttester\2ccn\3dSeminaryAdmin\2cou\3dSeminaryOU\2cdc\3dseminary\2cdc\3dlocal))(&(objectClass=GroupOfUniqueNames)(uniquemember=cn\3dttester\2ccn\3dSeminaryAdmin\2cou\3dSeminaryOU\2cdc\3dseminary\2cdc\3dlocal))))" # extended LDIF # # LDAPv3 # base <cn=ttester,cn=SeminaryAdmin,ou=SeminaryOU,dc=seminary,dc=local> with scope subtree # filter: filter=(&(cn=SeminaryAdmin)(|(&(objectClass=GroupOfNames)(member=cn\3dttester\2ccn\3dSeminaryAdmin\2cou\3dSeminaryOU\2cdc\3dseminary\2cdc\3dlocal))(&(objectClass=GroupOfUniqueNames)(uniquemember=cn\3dttester\2ccn\3dSeminaryAdmin\2cou\3dSeminaryOU\2cdc\3dseminary\2cdc\3dlocal)))) # requesting: ALL #
ldap_search_ext: Bad search filter (-7)
Hmm, try expanding the escaped characters back to normal again for ldapsearch (e.g. \3d to "=", \2c to ",", etc.)
The thing is that this filter has been copied many a time from many tutorials and they all agree, could you please point out as from where I should start tackling the issue?
But do the tutorials exactly match your directory structure? Matthew -- Matthew Newton, Ph.D. <mcn4@leicester.ac.uk> Systems Specialist, Infrastructure Services, I.T. Services, University of Leicester, Leicester LE1 7RH, United Kingdom For IT help contact helpdesk extn. 2253, <ithelp@le.ac.uk>
Hi again Matt I have taken your advice and upgraded to the stable 3.0 Freeradius. It is now: freeradius-server : 3.0.11 After going through the changes, I am still unable to do the VLAN part :( Now I am using the inbuilt filters. This is what I have in sites-available/default under the post-auth section: if (Ldap-Group == "cn=SeminaryAdmin,ou=SeminaryOU,dc=seminary,dc=local") { update reply { Tunnel-Type := "VLAN", Tunnel-Medium-Type := "802", Tunnel-Private-Group-ID := "12" } } I tried also Ldap-Group == "SeminaryAdmin" but same result Ldap searching: radius@daloradius:/etc/freeradius/mods-enabled$ ldapsearch -h localhost -b "cn=ttester,cn=SeminaryAdmin,ou=SeminaryOU,dc=seminary,dc=local" -D "cn=admin,dc=seminary,dc=local" -w PASS # extended LDIF # # LDAPv3 # base <cn=ttester,cn=SeminaryAdmin,ou=SeminaryOU,dc=seminary,dc=local> with scope subtree # filter: (objectclass=*) # requesting: ALL # # ttester, SeminaryAdmin, SeminaryOU, seminary.local dn: cn=ttester,cn=SeminaryAdmin,ou=SeminaryOU,dc=seminary,dc=local cn: ttester givenName: Tester gidNumber: 503 homeDirectory: /home/users/ttester sn: Tester objectClass: inetOrgPerson objectClass: posixAccount objectClass: top userPassword:: e1NTSEF9OElRMXFFa2hqTUpIUkpIMHZtN2FqdVJOY1NCdzl5cnA= uidNumber: 1002 uid: ttester description: Authenticated at 2016-08-19 17:15:38 # search result search: 2 result: 0 Success # numResponses: 2 # numEntries: 1 radius@daloradius:/etc/freeradius/mods-enabled$ ldapsearch -h localhost -b dc=seminary,dc=local -s sub '(isMemberOf=cn=SeminaryAdmin,ou=seminaryOU,dc=seminary,dc=local)' -D "cn=admin,dc=seminary,dc=local" -w PASS -L version: 1 # # LDAPv3 # base <dc=seminary,dc=local> with scope subtree # filter: (isMemberOf=cn=SeminaryAdmin,ou=seminaryOU,dc=seminary,dc=local) # requesting: ALL # # search result # numResponses: 1 and ... radius@daloradius:/etc/freeradius/mods-enabled$ ldapsearch -h localhost -b dc=seminary,dc=local -s sub '(cn=ttester)' memberOf -D "cn=admin,dc=seminary,dc=local" -w PASS # extended LDIF # # LDAPv3 # base <dc=seminary,dc=local> with scope subtree # filter: (cn=ttester) # requesting: memberOf # # ttester, SeminaryAdmin, SeminaryOU, seminary.local dn: cn=ttester,cn=SeminaryAdmin,ou=SeminaryOU,dc=seminary,dc=local # search result search: 2 result: 0 Success # numResponses: 2 # numEntries: 1 The whole of the debug: radius@daloradius:/etc/freeradius/mods-enabled$ sudo freeradius -XXX [sudo] password for radius: Fri Aug 19 17:43:59 2016 : Debug: Server was built with: Fri Aug 19 17:43:59 2016 : Debug: accounting : yes Fri Aug 19 17:43:59 2016 : Debug: authentication : yes Fri Aug 19 17:43:59 2016 : Debug: ascend-binary-attributes : yes Fri Aug 19 17:43:59 2016 : Debug: coa : yes Fri Aug 19 17:43:59 2016 : Debug: control-socket : yes Fri Aug 19 17:43:59 2016 : Debug: detail : yes Fri Aug 19 17:43:59 2016 : Debug: dhcp : yes Fri Aug 19 17:43:59 2016 : Debug: dynamic-clients : yes Fri Aug 19 17:43:59 2016 : Debug: osfc2 : no Fri Aug 19 17:43:59 2016 : Debug: proxy : yes Fri Aug 19 17:43:59 2016 : Debug: regex-pcre : no Fri Aug 19 17:43:59 2016 : Debug: regex-posix : yes Fri Aug 19 17:43:59 2016 : Debug: regex-posix-extended : yes Fri Aug 19 17:43:59 2016 : Debug: session-management : yes Fri Aug 19 17:43:59 2016 : Debug: stats : yes Fri Aug 19 17:43:59 2016 : Debug: tcp : yes Fri Aug 19 17:43:59 2016 : Debug: threads : yes Fri Aug 19 17:43:59 2016 : Debug: tls : yes Fri Aug 19 17:43:59 2016 : Debug: unlang : yes Fri Aug 19 17:43:59 2016 : Debug: vmps : yes Fri Aug 19 17:43:59 2016 : Debug: developer : no Fri Aug 19 17:43:59 2016 : Debug: Server core libs: Fri Aug 19 17:43:59 2016 : Debug: freeradius-server : 3.0.11 Fri Aug 19 17:43:59 2016 : Debug: talloc : 2.0.* Fri Aug 19 17:43:59 2016 : Debug: ssl : 1.0.2g release Fri Aug 19 17:43:59 2016 : Debug: Endianness: Fri Aug 19 17:43:59 2016 : Debug: little Fri Aug 19 17:43:59 2016 : Debug: Compilation flags: Fri Aug 19 17:43:59 2016 : Debug: cppflags : -Wdate-time -D_FORTIFY_SOURCE=2 Fri Aug 19 17:43:59 2016 : Debug: cflags : -I/build/freeradius-G88Mfz/freeradius-3.0.11 -I/build/freeradius-G88Mfz/freeradius-3.0.11/src -include /build/freeradius-G88Mfz/freeradius-3.0.11/src/freeradius-devel/autoconf.h -include /build/freeradius-G88Mfz/freeradius-3.0.11/src/freeradius-devel/build.h -include /build/freeradius-G88Mfz/freeradius-3.0.11/src/freeradius-devel/features.h -include /build/freeradius-G88Mfz/freeradius-3.0.11/src/freeradius-devel/radpaths.h -fno-strict-aliasing -g -O2 -fstack-protector-strong -Wformat -Werror=format-security -O2 -Wall -std=c99 -D_GNU_SOURCE -D_REENTRANT -D_POSIX_PTHREAD_SEMANTICS -DOPENSSL_NO_KRB5 -DNDEBUG -DIS_MODULE=1 Fri Aug 19 17:43:59 2016 : Debug: ldflags : -Wl,-Bsymbolic-functions -Wl,-z,relro Fri Aug 19 17:43:59 2016 : Debug: libs : -lcrypto -lssl -ltalloc -lcap -lnsl -lresolv -ldl -lpthread -lreadline Fri Aug 19 17:43:59 2016 : Debug: Fri Aug 19 17:43:59 2016 : Info: Copyright (C) 1999-2016 The FreeRADIUS server project and contributors Fri Aug 19 17:43:59 2016 : Info: There is NO warranty; not even for MERCHANTABILITY or FITNESS FOR A Fri Aug 19 17:43:59 2016 : Info: PARTICULAR PURPOSE Fri Aug 19 17:43:59 2016 : Info: You may redistribute copies of FreeRADIUS under the terms of the Fri Aug 19 17:43:59 2016 : Info: GNU General Public License Fri Aug 19 17:43:59 2016 : Info: For more information about these matters, see the file named COPYRIGHT Fri Aug 19 17:43:59 2016 : Info: Starting - reading configuration files ... Fri Aug 19 17:43:59 2016 : Debug: including dictionary file /usr/share/freeradius/dictionary Fri Aug 19 17:43:59 2016 : Debug: including dictionary file /usr/share/freeradius/dictionary.dhcp Fri Aug 19 17:43:59 2016 : Debug: including dictionary file /usr/share/freeradius/dictionary.vqp Fri Aug 19 17:43:59 2016 : Debug: including dictionary file /etc/freeradius/dictionary Fri Aug 19 17:43:59 2016 : Debug: including configuration file /etc/freeradius/radiusd.conf Fri Aug 19 17:43:59 2016 : Debug: including configuration file /etc/freeradius/proxy.conf Fri Aug 19 17:43:59 2016 : Debug: including configuration file /etc/freeradius/clients.conf Fri Aug 19 17:43:59 2016 : Debug: including files in directory /etc/freeradius/mods-enabled/ Fri Aug 19 17:43:59 2016 : Debug: including configuration file /etc/freeradius/mods-enabled/mschap Fri Aug 19 17:43:59 2016 : Debug: including configuration file /etc/freeradius/mods-enabled/always Fri Aug 19 17:43:59 2016 : Debug: including configuration file /etc/freeradius/mods-enabled/soh Fri Aug 19 17:43:59 2016 : Debug: including configuration file /etc/freeradius/mods-enabled/eap Fri Aug 19 17:43:59 2016 : Debug: including configuration file /etc/freeradius/mods-enabled/dynamic_clients Fri Aug 19 17:43:59 2016 : Debug: including configuration file /etc/freeradius/mods-enabled/logintime Fri Aug 19 17:43:59 2016 : Debug: including configuration file /etc/freeradius/mods-enabled/exec Fri Aug 19 17:43:59 2016 : Debug: including configuration file /etc/freeradius/mods-enabled/realm Fri Aug 19 17:43:59 2016 : Debug: including configuration file /etc/freeradius/mods-enabled/utf8 Fri Aug 19 17:43:59 2016 : Debug: including configuration file /etc/freeradius/mods-enabled/echo Fri Aug 19 17:43:59 2016 : Debug: including configuration file /etc/freeradius/mods-enabled/unix Fri Aug 19 17:43:59 2016 : Debug: including configuration file /etc/freeradius/mods-enabled/detail.log Fri Aug 19 17:43:59 2016 : Debug: including configuration file /etc/freeradius/mods-enabled/expr Fri Aug 19 17:43:59 2016 : Debug: including configuration file /etc/freeradius/mods-enabled/ntlm_auth Fri Aug 19 17:43:59 2016 : Debug: including configuration file /etc/freeradius/mods-enabled/pap Fri Aug 19 17:43:59 2016 : Debug: including configuration file /etc/freeradius/mods-enabled/ldap Fri Aug 19 17:43:59 2016 : Debug: including configuration file /etc/freeradius/mods-enabled/digest Fri Aug 19 17:43:59 2016 : Debug: including configuration file /etc/freeradius/mods-enabled/files Fri Aug 19 17:43:59 2016 : Debug: including configuration file /etc/freeradius/mods-enabled/preprocess Fri Aug 19 17:43:59 2016 : Debug: including configuration file /etc/freeradius/mods-enabled/cache_eap Fri Aug 19 17:43:59 2016 : Debug: including configuration file /etc/freeradius/mods-enabled/detail Fri Aug 19 17:43:59 2016 : Debug: including configuration file /etc/freeradius/mods-enabled/expiration Fri Aug 19 17:43:59 2016 : Debug: including configuration file /etc/freeradius/mods-enabled/chap Fri Aug 19 17:43:59 2016 : Debug: including configuration file /etc/freeradius/mods-enabled/sradutmp Fri Aug 19 17:43:59 2016 : Debug: including configuration file /etc/freeradius/mods-enabled/radutmp Fri Aug 19 17:43:59 2016 : Debug: including configuration file /etc/freeradius/mods-enabled/passwd Fri Aug 19 17:43:59 2016 : Debug: including configuration file /etc/freeradius/mods-enabled/linelog Fri Aug 19 17:43:59 2016 : Debug: including configuration file /etc/freeradius/mods-enabled/unpack Fri Aug 19 17:43:59 2016 : Debug: including configuration file /etc/freeradius/mods-enabled/attr_filter Fri Aug 19 17:43:59 2016 : Debug: including configuration file /etc/freeradius/mods-enabled/replicate Fri Aug 19 17:43:59 2016 : Debug: including files in directory /etc/freeradius/policy.d/ Fri Aug 19 17:43:59 2016 : Debug: including configuration file /etc/freeradius/policy.d/filter Fri Aug 19 17:43:59 2016 : Debug: including configuration file /etc/freeradius/policy.d/control Fri Aug 19 17:43:59 2016 : Debug: including configuration file /etc/freeradius/policy.d/canonicalization Fri Aug 19 17:43:59 2016 : Debug: including configuration file /etc/freeradius/policy.d/eap Fri Aug 19 17:43:59 2016 : Debug: including configuration file /etc/freeradius/policy.d/debug Fri Aug 19 17:43:59 2016 : Debug: including configuration file /etc/freeradius/policy.d/dhcp Fri Aug 19 17:43:59 2016 : Debug: including configuration file /etc/freeradius/policy.d/accounting Fri Aug 19 17:43:59 2016 : Debug: including configuration file /etc/freeradius/policy.d/abfab-tr Fri Aug 19 17:43:59 2016 : Debug: including configuration file /etc/freeradius/policy.d/cui Fri Aug 19 17:43:59 2016 : Debug: OPTIMIZING (${policy.cui_require_operator_name} == yes) --> FALSE Fri Aug 19 17:43:59 2016 : Debug: OPTIMIZING (no == yes) --> FALSE Fri Aug 19 17:43:59 2016 : Debug: OPTIMIZING (${policy.cui_require_operator_name} == yes) --> FALSE Fri Aug 19 17:43:59 2016 : Debug: OPTIMIZING (no == yes) --> FALSE Fri Aug 19 17:43:59 2016 : Debug: including configuration file /etc/freeradius/policy.d/operator-name Fri Aug 19 17:43:59 2016 : Debug: including files in directory /etc/freeradius/sites-enabled/ Fri Aug 19 17:43:59 2016 : Debug: including configuration file /etc/freeradius/sites-enabled/inner-tunnel Fri Aug 19 17:43:59 2016 : Debug: including configuration file /etc/freeradius/sites-enabled/default Fri Aug 19 17:43:59 2016 : Debug: main { Fri Aug 19 17:43:59 2016 : Debug: security { Fri Aug 19 17:43:59 2016 : Debug: user = "freerad" Fri Aug 19 17:43:59 2016 : Debug: group = "freerad" Fri Aug 19 17:43:59 2016 : Debug: allow_core_dumps = no Fri Aug 19 17:43:59 2016 : Warning: /etc/freeradius/radiusd.conf[462]: The item 'max_attributes' is defined, but is unused by the configuration Fri Aug 19 17:43:59 2016 : Warning: /etc/freeradius/radiusd.conf[480]: The item 'reject_delay' is defined, but is unused by the configuration Fri Aug 19 17:43:59 2016 : Warning: /etc/freeradius/radiusd.conf[500]: The item 'status_server' is defined, but is unused by the configuration Fri Aug 19 17:43:59 2016 : Debug: } Fri Aug 19 17:43:59 2016 : Debug: name = "freeradius" Fri Aug 19 17:43:59 2016 : Debug: prefix = "/usr" Fri Aug 19 17:43:59 2016 : Debug: localstatedir = "/var" Fri Aug 19 17:43:59 2016 : Debug: logdir = "/var/log/freeradius" Fri Aug 19 17:43:59 2016 : Debug: run_dir = "/var/run/freeradius" Fri Aug 19 17:43:59 2016 : Warning: /etc/freeradius/radiusd.conf[55]: The item 'sysconfdir' is defined, but is unused by the configuration Fri Aug 19 17:43:59 2016 : Warning: /etc/freeradius/radiusd.conf[67]: The item 'confdir' is defined, but is unused by the configuration Fri Aug 19 17:43:59 2016 : Warning: /etc/freeradius/radiusd.conf[74]: The item 'db_dir' is defined, but is unused by the configuration Fri Aug 19 17:43:59 2016 : Warning: /etc/freeradius/radiusd.conf[108]: The item 'libdir' is defined, but is unused by the configuration Fri Aug 19 17:43:59 2016 : Warning: /etc/freeradius/radiusd.conf[119]: The item 'pidfile' is defined, but is unused by the configuration Fri Aug 19 17:43:59 2016 : Warning: /etc/freeradius/radiusd.conf[140]: The item 'correct_escapes' is defined, but is unused by the configuration Fri Aug 19 17:43:59 2016 : Warning: /etc/freeradius/radiusd.conf[194]: The item 'max_request_time' is defined, but is unused by the configuration Fri Aug 19 17:43:59 2016 : Warning: /etc/freeradius/radiusd.conf[213]: The item 'cleanup_delay' is defined, but is unused by the configuration Fri Aug 19 17:43:59 2016 : Warning: /etc/freeradius/radiusd.conf[250]: The item 'hostname_lookups' is defined, but is unused by the configuration Fri Aug 19 17:43:59 2016 : Warning: /etc/freeradius/radiusd.conf[372]: The item 'checkrad' is defined, but is unused by the configuration Fri Aug 19 17:43:59 2016 : Warning: /etc/freeradius/radiusd.conf[521]: The item 'proxy_requests' is defined, but is unused by the configuration Fri Aug 19 17:43:59 2016 : Debug: } Fri Aug 19 17:43:59 2016 : Debug: main { Fri Aug 19 17:43:59 2016 : Debug: name = "freeradius" Fri Aug 19 17:43:59 2016 : Debug: prefix = "/usr" Fri Aug 19 17:43:59 2016 : Debug: localstatedir = "/var" Fri Aug 19 17:43:59 2016 : Debug: sbindir = "/usr/sbin" Fri Aug 19 17:43:59 2016 : Debug: logdir = "/var/log/freeradius" Fri Aug 19 17:43:59 2016 : Debug: run_dir = "/var/run/freeradius" Fri Aug 19 17:43:59 2016 : Debug: libdir = "/usr/lib/freeradius" Fri Aug 19 17:43:59 2016 : Debug: radacctdir = "/var/log/freeradius/radacct" Fri Aug 19 17:43:59 2016 : Debug: hostname_lookups = no Fri Aug 19 17:43:59 2016 : Debug: max_request_time = 30 Fri Aug 19 17:43:59 2016 : Debug: cleanup_delay = 5 Fri Aug 19 17:43:59 2016 : Debug: max_requests = 16384 Fri Aug 19 17:43:59 2016 : Debug: pidfile = "/var/run/freeradius/freeradius.pid" Fri Aug 19 17:43:59 2016 : Debug: checkrad = "/usr/sbin/checkrad" Fri Aug 19 17:43:59 2016 : Debug: debug_level = 0 Fri Aug 19 17:43:59 2016 : Debug: proxy_requests = yes Fri Aug 19 17:43:59 2016 : Debug: log { Fri Aug 19 17:43:59 2016 : Debug: stripped_names = no Fri Aug 19 17:43:59 2016 : Debug: auth = no Fri Aug 19 17:43:59 2016 : Debug: auth_badpass = no Fri Aug 19 17:43:59 2016 : Debug: auth_goodpass = no Fri Aug 19 17:43:59 2016 : Debug: colourise = yes Fri Aug 19 17:43:59 2016 : Debug: msg_denied = "You are already logged in - access denied" Fri Aug 19 17:43:59 2016 : Warning: /etc/freeradius/radiusd.conf[268]: The item 'destination' is defined, but is unused by the configuration Fri Aug 19 17:43:59 2016 : Warning: /etc/freeradius/radiusd.conf[285]: The item 'file' is defined, but is unused by the configuration Fri Aug 19 17:43:59 2016 : Warning: /etc/freeradius/radiusd.conf[331]: The item 'syslog_facility' is defined, but is unused by the configuration Fri Aug 19 17:43:59 2016 : Debug: } Fri Aug 19 17:43:59 2016 : Debug: resources { Fri Aug 19 17:43:59 2016 : Debug: } Fri Aug 19 17:43:59 2016 : Debug: security { Fri Aug 19 17:43:59 2016 : Debug: max_attributes = 200 Fri Aug 19 17:43:59 2016 : Debug: reject_delay = 1.000000 Fri Aug 19 17:43:59 2016 : Debug: status_server = yes Fri Aug 19 17:43:59 2016 : Debug: } Fri Aug 19 17:43:59 2016 : Warning: /etc/freeradius/radiusd.conf[55]: The item 'sysconfdir' is defined, but is unused by the configuration Fri Aug 19 17:43:59 2016 : Warning: /etc/freeradius/radiusd.conf[67]: The item 'confdir' is defined, but is unused by the configuration Fri Aug 19 17:43:59 2016 : Warning: /etc/freeradius/radiusd.conf[74]: The item 'db_dir' is defined, but is unused by the configuration Fri Aug 19 17:43:59 2016 : Warning: /etc/freeradius/radiusd.conf[140]: The item 'correct_escapes' is defined, but is unused by the configuration Fri Aug 19 17:43:59 2016 : Debug: } Fri Aug 19 17:43:59 2016 : Debug: radiusd: #### Loading Realms and Home Servers #### Fri Aug 19 17:43:59 2016 : Debug: proxy server { Fri Aug 19 17:43:59 2016 : Debug: retry_delay = 5 Fri Aug 19 17:43:59 2016 : Debug: retry_count = 3 Fri Aug 19 17:43:59 2016 : Debug: default_fallback = no Fri Aug 19 17:43:59 2016 : Debug: dead_time = 120 Fri Aug 19 17:43:59 2016 : Debug: wake_all_if_all_dead = no Fri Aug 19 17:43:59 2016 : Debug: } Fri Aug 19 17:43:59 2016 : Debug: home_server localhost { Fri Aug 19 17:43:59 2016 : Debug: ipaddr = 127.0.0.1 Fri Aug 19 17:43:59 2016 : Debug: port = 1812 Fri Aug 19 17:43:59 2016 : Debug: type = "auth" Fri Aug 19 17:43:59 2016 : Debug: secret = "testing123" Fri Aug 19 17:43:59 2016 : Debug: response_window = 20.000000 Fri Aug 19 17:43:59 2016 : Debug: response_timeouts = 1 Fri Aug 19 17:43:59 2016 : Debug: max_outstanding = 65536 Fri Aug 19 17:43:59 2016 : Debug: zombie_period = 40 Fri Aug 19 17:43:59 2016 : Debug: status_check = "status-server" Fri Aug 19 17:43:59 2016 : Debug: ping_interval = 30 Fri Aug 19 17:43:59 2016 : Debug: check_interval = 30 Fri Aug 19 17:43:59 2016 : Debug: check_timeout = 4 Fri Aug 19 17:43:59 2016 : Debug: num_answers_to_alive = 3 Fri Aug 19 17:43:59 2016 : Debug: revive_interval = 120 Fri Aug 19 17:43:59 2016 : Debug: limit { Fri Aug 19 17:43:59 2016 : Debug: max_connections = 16 Fri Aug 19 17:43:59 2016 : Debug: max_requests = 0 Fri Aug 19 17:43:59 2016 : Debug: lifetime = 0 Fri Aug 19 17:43:59 2016 : Debug: idle_timeout = 0 Fri Aug 19 17:43:59 2016 : Debug: } Fri Aug 19 17:43:59 2016 : Debug: coa { Fri Aug 19 17:43:59 2016 : Debug: irt = 2 Fri Aug 19 17:43:59 2016 : Debug: mrt = 16 Fri Aug 19 17:43:59 2016 : Debug: mrc = 5 Fri Aug 19 17:43:59 2016 : Debug: mrd = 30 Fri Aug 19 17:43:59 2016 : Debug: } Fri Aug 19 17:43:59 2016 : Debug: } Fri Aug 19 17:43:59 2016 : Debug: home_server_pool my_auth_failover { Fri Aug 19 17:43:59 2016 : Debug: type = fail-over Fri Aug 19 17:43:59 2016 : Debug: home_server = localhost Fri Aug 19 17:43:59 2016 : Debug: } Fri Aug 19 17:43:59 2016 : Debug: realm example.com { Fri Aug 19 17:43:59 2016 : Debug: auth_pool = my_auth_failover Fri Aug 19 17:43:59 2016 : Debug: } Fri Aug 19 17:43:59 2016 : Debug: realm LOCAL { Fri Aug 19 17:43:59 2016 : Debug: } Fri Aug 19 17:43:59 2016 : Debug: radiusd: #### Loading Clients #### Fri Aug 19 17:43:59 2016 : Debug: client localhost { Fri Aug 19 17:43:59 2016 : Debug: ipaddr = 127.0.0.1 Fri Aug 19 17:43:59 2016 : Debug: require_message_authenticator = no Fri Aug 19 17:43:59 2016 : Debug: secret = "testing456" Fri Aug 19 17:43:59 2016 : Debug: nas_type = "other" Fri Aug 19 17:43:59 2016 : Debug: proto = "*" Fri Aug 19 17:43:59 2016 : Debug: limit { Fri Aug 19 17:43:59 2016 : Debug: max_connections = 16 Fri Aug 19 17:43:59 2016 : Debug: lifetime = 0 Fri Aug 19 17:43:59 2016 : Debug: idle_timeout = 30 Fri Aug 19 17:43:59 2016 : Debug: } Fri Aug 19 17:43:59 2016 : Debug: } Fri Aug 19 17:43:59 2016 : Debug: Adding client 127.0.0.1/32 (127.0.0.1) to prefix tree 32 Fri Aug 19 17:43:59 2016 : Debug: client localhost_ipv6 { Fri Aug 19 17:43:59 2016 : Debug: ipv6addr = ::1 Fri Aug 19 17:43:59 2016 : Debug: require_message_authenticator = no Fri Aug 19 17:43:59 2016 : Debug: secret = "testing123" Fri Aug 19 17:43:59 2016 : Debug: limit { Fri Aug 19 17:43:59 2016 : Debug: max_connections = 16 Fri Aug 19 17:43:59 2016 : Debug: lifetime = 0 Fri Aug 19 17:43:59 2016 : Debug: idle_timeout = 30 Fri Aug 19 17:43:59 2016 : Debug: } Fri Aug 19 17:43:59 2016 : Debug: } Fri Aug 19 17:43:59 2016 : Debug: Adding client ::1/128 (::1) to prefix tree 128 Fri Aug 19 17:43:59 2016 : Debug: client 192.168.100.0/24 { Fri Aug 19 17:43:59 2016 : Debug: require_message_authenticator = no Fri Aug 19 17:43:59 2016 : Debug: secret = "testing456" Fri Aug 19 17:43:59 2016 : Debug: shortname = "NAS" Fri Aug 19 17:43:59 2016 : Debug: limit { Fri Aug 19 17:43:59 2016 : Debug: max_connections = 16 Fri Aug 19 17:43:59 2016 : Debug: lifetime = 0 Fri Aug 19 17:43:59 2016 : Debug: idle_timeout = 30 Fri Aug 19 17:43:59 2016 : Debug: } Fri Aug 19 17:43:59 2016 : Debug: } Fri Aug 19 17:43:59 2016 : Warning: No 'ipaddr' or 'ipv4addr' or 'ipv6addr' field found in client 192.168.100.0/24. Please fix your configuration Fri Aug 19 17:43:59 2016 : Warning: Support for old-style clients will be removed in a future release Fri Aug 19 17:43:59 2016 : Debug: Adding client 192.168.100.0/24 (192.168.100.0/24) to prefix tree 24 Fri Aug 19 17:43:59 2016 : Info: Debugger not attached Fri Aug 19 17:43:59 2016 : Debug: # Creating Auth-Type = PAP Fri Aug 19 17:43:59 2016 : Debug: # Creating Auth-Type = CHAP Fri Aug 19 17:43:59 2016 : Debug: # Creating Auth-Type = MS-CHAP Fri Aug 19 17:43:59 2016 : Debug: # Creating Auth-Type = eap Fri Aug 19 17:43:59 2016 : Debug: # Creating Auth-Type = digest Fri Aug 19 17:43:59 2016 : Debug: radiusd: #### Instantiating modules #### Fri Aug 19 17:43:59 2016 : Debug: modules { Fri Aug 19 17:43:59 2016 : Debug: Loading rlm_mschap with path: /usr/lib/freeradius/rlm_mschap.so Fri Aug 19 17:43:59 2016 : Debug: Loaded rlm_mschap, checking if it's valid Fri Aug 19 17:43:59 2016 : Debug: # Loaded module rlm_mschap Fri Aug 19 17:43:59 2016 : Debug: # Loading module "mschap" from file /etc/freeradius/mods-enabled/mschap Fri Aug 19 17:43:59 2016 : Debug: mschap { Fri Aug 19 17:43:59 2016 : Debug: use_mppe = yes Fri Aug 19 17:43:59 2016 : Debug: require_encryption = no Fri Aug 19 17:43:59 2016 : Debug: require_strong = no Fri Aug 19 17:43:59 2016 : Debug: with_ntdomain_hack = yes Fri Aug 19 17:43:59 2016 : Debug: passchange { Fri Aug 19 17:43:59 2016 : Debug: } Fri Aug 19 17:43:59 2016 : Debug: allow_retry = yes Fri Aug 19 17:43:59 2016 : Debug: } Fri Aug 19 17:43:59 2016 : Debug: Loading rlm_always with path: /usr/lib/freeradius/rlm_always.so Fri Aug 19 17:43:59 2016 : Debug: Loaded rlm_always, checking if it's valid Fri Aug 19 17:43:59 2016 : Debug: # Loaded module rlm_always Fri Aug 19 17:43:59 2016 : Debug: # Loading module "reject" from file /etc/freeradius/mods-enabled/always Fri Aug 19 17:43:59 2016 : Debug: always reject { Fri Aug 19 17:43:59 2016 : Debug: rcode = "reject" Fri Aug 19 17:43:59 2016 : Debug: simulcount = 0 Fri Aug 19 17:43:59 2016 : Debug: mpp = no Fri Aug 19 17:43:59 2016 : Debug: } Fri Aug 19 17:43:59 2016 : Debug: # Loading module "fail" from file /etc/freeradius/mods-enabled/always Fri Aug 19 17:43:59 2016 : Debug: always fail { Fri Aug 19 17:43:59 2016 : Debug: rcode = "fail" Fri Aug 19 17:43:59 2016 : Debug: simulcount = 0 Fri Aug 19 17:43:59 2016 : Debug: mpp = no Fri Aug 19 17:43:59 2016 : Debug: } Fri Aug 19 17:43:59 2016 : Debug: # Loading module "ok" from file /etc/freeradius/mods-enabled/always Fri Aug 19 17:43:59 2016 : Debug: always ok { Fri Aug 19 17:43:59 2016 : Debug: rcode = "ok" Fri Aug 19 17:43:59 2016 : Debug: simulcount = 0 Fri Aug 19 17:43:59 2016 : Debug: mpp = no Fri Aug 19 17:43:59 2016 : Debug: } Fri Aug 19 17:43:59 2016 : Debug: # Loading module "handled" from file /etc/freeradius/mods-enabled/always Fri Aug 19 17:43:59 2016 : Debug: always handled { Fri Aug 19 17:43:59 2016 : Debug: rcode = "handled" Fri Aug 19 17:43:59 2016 : Debug: simulcount = 0 Fri Aug 19 17:43:59 2016 : Debug: mpp = no Fri Aug 19 17:43:59 2016 : Debug: } Fri Aug 19 17:43:59 2016 : Debug: # Loading module "invalid" from file /etc/freeradius/mods-enabled/always Fri Aug 19 17:43:59 2016 : Debug: always invalid { Fri Aug 19 17:43:59 2016 : Debug: rcode = "invalid" Fri Aug 19 17:43:59 2016 : Debug: simulcount = 0 Fri Aug 19 17:43:59 2016 : Debug: mpp = no Fri Aug 19 17:43:59 2016 : Debug: } Fri Aug 19 17:43:59 2016 : Debug: # Loading module "userlock" from file /etc/freeradius/mods-enabled/always Fri Aug 19 17:43:59 2016 : Debug: always userlock { Fri Aug 19 17:43:59 2016 : Debug: rcode = "userlock" Fri Aug 19 17:43:59 2016 : Debug: simulcount = 0 Fri Aug 19 17:43:59 2016 : Debug: mpp = no Fri Aug 19 17:43:59 2016 : Debug: } Fri Aug 19 17:43:59 2016 : Debug: # Loading module "notfound" from file /etc/freeradius/mods-enabled/always Fri Aug 19 17:43:59 2016 : Debug: always notfound { Fri Aug 19 17:43:59 2016 : Debug: rcode = "notfound" Fri Aug 19 17:43:59 2016 : Debug: simulcount = 0 Fri Aug 19 17:43:59 2016 : Debug: mpp = no Fri Aug 19 17:43:59 2016 : Debug: } Fri Aug 19 17:43:59 2016 : Debug: # Loading module "noop" from file /etc/freeradius/mods-enabled/always Fri Aug 19 17:43:59 2016 : Debug: always noop { Fri Aug 19 17:43:59 2016 : Debug: rcode = "noop" Fri Aug 19 17:43:59 2016 : Debug: simulcount = 0 Fri Aug 19 17:43:59 2016 : Debug: mpp = no Fri Aug 19 17:43:59 2016 : Debug: } Fri Aug 19 17:43:59 2016 : Debug: # Loading module "updated" from file /etc/freeradius/mods-enabled/always Fri Aug 19 17:43:59 2016 : Debug: always updated { Fri Aug 19 17:43:59 2016 : Debug: rcode = "updated" Fri Aug 19 17:43:59 2016 : Debug: simulcount = 0 Fri Aug 19 17:43:59 2016 : Debug: mpp = no Fri Aug 19 17:43:59 2016 : Debug: } Fri Aug 19 17:43:59 2016 : Debug: Loading rlm_soh with path: /usr/lib/freeradius/rlm_soh.so Fri Aug 19 17:43:59 2016 : Debug: Loaded rlm_soh, checking if it's valid Fri Aug 19 17:43:59 2016 : Debug: # Loaded module rlm_soh Fri Aug 19 17:43:59 2016 : Debug: # Loading module "soh" from file /etc/freeradius/mods-enabled/soh Fri Aug 19 17:43:59 2016 : Debug: soh { Fri Aug 19 17:43:59 2016 : Debug: dhcp = yes Fri Aug 19 17:43:59 2016 : Debug: } Fri Aug 19 17:43:59 2016 : Debug: Loading rlm_eap with path: /usr/lib/freeradius/rlm_eap.so Fri Aug 19 17:43:59 2016 : Debug: Loaded rlm_eap, checking if it's valid Fri Aug 19 17:43:59 2016 : Debug: # Loaded module rlm_eap Fri Aug 19 17:43:59 2016 : Debug: # Loading module "eap" from file /etc/freeradius/mods-enabled/eap Fri Aug 19 17:43:59 2016 : Debug: eap { Fri Aug 19 17:43:59 2016 : Debug: default_eap_type = "md5" Fri Aug 19 17:43:59 2016 : Debug: timer_expire = 60 Fri Aug 19 17:43:59 2016 : Debug: ignore_unknown_eap_types = no Fri Aug 19 17:43:59 2016 : Debug: cisco_accounting_username_bug = no Fri Aug 19 17:43:59 2016 : Debug: max_sessions = 16384 Fri Aug 19 17:43:59 2016 : Debug: } Fri Aug 19 17:43:59 2016 : Debug: Loading rlm_dynamic_clients with path: /usr/lib/freeradius/rlm_dynamic_clients.so Fri Aug 19 17:43:59 2016 : Debug: Loaded rlm_dynamic_clients, checking if it's valid Fri Aug 19 17:43:59 2016 : Debug: # Loaded module rlm_dynamic_clients Fri Aug 19 17:43:59 2016 : Debug: # Loading module "dynamic_clients" from file /etc/freeradius/mods-enabled/dynamic_clients Fri Aug 19 17:43:59 2016 : Debug: Loading rlm_logintime with path: /usr/lib/freeradius/rlm_logintime.so Fri Aug 19 17:43:59 2016 : Debug: Loaded rlm_logintime, checking if it's valid Fri Aug 19 17:43:59 2016 : Debug: # Loaded module rlm_logintime Fri Aug 19 17:43:59 2016 : Debug: # Loading module "logintime" from file /etc/freeradius/mods-enabled/logintime Fri Aug 19 17:43:59 2016 : Debug: logintime { Fri Aug 19 17:43:59 2016 : Debug: minimum_timeout = 60 Fri Aug 19 17:43:59 2016 : Debug: } Fri Aug 19 17:43:59 2016 : Debug: Loading rlm_exec with path: /usr/lib/freeradius/rlm_exec.so Fri Aug 19 17:43:59 2016 : Debug: Loaded rlm_exec, checking if it's valid Fri Aug 19 17:43:59 2016 : Debug: # Loaded module rlm_exec Fri Aug 19 17:43:59 2016 : Debug: # Loading module "exec" from file /etc/freeradius/mods-enabled/exec Fri Aug 19 17:43:59 2016 : Debug: exec { Fri Aug 19 17:43:59 2016 : Debug: wait = no Fri Aug 19 17:43:59 2016 : Debug: input_pairs = "request" Fri Aug 19 17:43:59 2016 : Debug: shell_escape = yes Fri Aug 19 17:43:59 2016 : Debug: timeout = 10 Fri Aug 19 17:43:59 2016 : Debug: } Fri Aug 19 17:43:59 2016 : Debug: Loading rlm_realm with path: /usr/lib/freeradius/rlm_realm.so Fri Aug 19 17:43:59 2016 : Debug: Loaded rlm_realm, checking if it's valid Fri Aug 19 17:43:59 2016 : Debug: # Loaded module rlm_realm Fri Aug 19 17:43:59 2016 : Debug: # Loading module "IPASS" from file /etc/freeradius/mods-enabled/realm Fri Aug 19 17:43:59 2016 : Debug: realm IPASS { Fri Aug 19 17:43:59 2016 : Debug: format = "prefix" Fri Aug 19 17:43:59 2016 : Debug: delimiter = "/" Fri Aug 19 17:43:59 2016 : Debug: ignore_default = no Fri Aug 19 17:43:59 2016 : Debug: ignore_null = no Fri Aug 19 17:43:59 2016 : Debug: } Fri Aug 19 17:43:59 2016 : Debug: # Loading module "suffix" from file /etc/freeradius/mods-enabled/realm Fri Aug 19 17:43:59 2016 : Debug: realm suffix { Fri Aug 19 17:43:59 2016 : Debug: format = "suffix" Fri Aug 19 17:43:59 2016 : Debug: delimiter = "@" Fri Aug 19 17:43:59 2016 : Debug: ignore_default = no Fri Aug 19 17:43:59 2016 : Debug: ignore_null = no Fri Aug 19 17:43:59 2016 : Debug: } Fri Aug 19 17:43:59 2016 : Debug: # Loading module "realmpercent" from file /etc/freeradius/mods-enabled/realm Fri Aug 19 17:43:59 2016 : Debug: realm realmpercent { Fri Aug 19 17:43:59 2016 : Debug: format = "suffix" Fri Aug 19 17:43:59 2016 : Debug: delimiter = "%" Fri Aug 19 17:43:59 2016 : Debug: ignore_default = no Fri Aug 19 17:43:59 2016 : Debug: ignore_null = no Fri Aug 19 17:43:59 2016 : Debug: } Fri Aug 19 17:43:59 2016 : Debug: # Loading module "ntdomain" from file /etc/freeradius/mods-enabled/realm Fri Aug 19 17:43:59 2016 : Debug: realm ntdomain { Fri Aug 19 17:43:59 2016 : Debug: format = "prefix" Fri Aug 19 17:43:59 2016 : Debug: delimiter = "\\" Fri Aug 19 17:43:59 2016 : Debug: ignore_default = no Fri Aug 19 17:43:59 2016 : Debug: ignore_null = no Fri Aug 19 17:43:59 2016 : Debug: } Fri Aug 19 17:43:59 2016 : Debug: Loading rlm_utf8 with path: /usr/lib/freeradius/rlm_utf8.so Fri Aug 19 17:43:59 2016 : Debug: Loaded rlm_utf8, checking if it's valid Fri Aug 19 17:43:59 2016 : Debug: # Loaded module rlm_utf8 Fri Aug 19 17:43:59 2016 : Debug: # Loading module "utf8" from file /etc/freeradius/mods-enabled/utf8 Fri Aug 19 17:43:59 2016 : Debug: # Loading module "echo" from file /etc/freeradius/mods-enabled/echo Fri Aug 19 17:43:59 2016 : Debug: exec echo { Fri Aug 19 17:43:59 2016 : Debug: wait = yes Fri Aug 19 17:43:59 2016 : Debug: program = "/bin/echo %{User-Name}" Fri Aug 19 17:43:59 2016 : Debug: input_pairs = "request" Fri Aug 19 17:43:59 2016 : Debug: output_pairs = "reply" Fri Aug 19 17:43:59 2016 : Debug: shell_escape = yes Fri Aug 19 17:43:59 2016 : Debug: } Fri Aug 19 17:43:59 2016 : Debug: Loading rlm_unix with path: /usr/lib/freeradius/rlm_unix.so Fri Aug 19 17:43:59 2016 : Debug: Loaded rlm_unix, checking if it's valid Fri Aug 19 17:43:59 2016 : Debug: # Loaded module rlm_unix Fri Aug 19 17:43:59 2016 : Debug: # Loading module "unix" from file /etc/freeradius/mods-enabled/unix Fri Aug 19 17:43:59 2016 : Debug: unix { Fri Aug 19 17:43:59 2016 : Debug: radwtmp = "/var/log/freeradius/radwtmp" Fri Aug 19 17:43:59 2016 : Debug: } Fri Aug 19 17:43:59 2016 : Debug: Creating attribute Unix-Group Fri Aug 19 17:43:59 2016 : Debug: Loading rlm_detail with path: /usr/lib/freeradius/rlm_detail.so Fri Aug 19 17:43:59 2016 : Debug: Loaded rlm_detail, checking if it's valid Fri Aug 19 17:43:59 2016 : Debug: # Loaded module rlm_detail Fri Aug 19 17:43:59 2016 : Debug: # Loading module "auth_log" from file /etc/freeradius/mods-enabled/detail.log Fri Aug 19 17:43:59 2016 : Debug: detail auth_log { Fri Aug 19 17:43:59 2016 : Debug: filename = "/var/log/freeradius/radacct/%{%{Packet-Src-IP-Address}:-%{Packet-Src-IPv6-Address}}/auth-detail-%Y%m%d" Fri Aug 19 17:43:59 2016 : Debug: header = "%t" Fri Aug 19 17:43:59 2016 : Debug: permissions = 384 Fri Aug 19 17:43:59 2016 : Debug: locking = no Fri Aug 19 17:43:59 2016 : Debug: escape_filenames = no Fri Aug 19 17:43:59 2016 : Debug: log_packet_header = no Fri Aug 19 17:43:59 2016 : Debug: } Fri Aug 19 17:43:59 2016 : Debug: # Loading module "reply_log" from file /etc/freeradius/mods-enabled/detail.log Fri Aug 19 17:43:59 2016 : Debug: detail reply_log { Fri Aug 19 17:43:59 2016 : Debug: filename = "/var/log/freeradius/radacct/%{%{Packet-Src-IP-Address}:-%{Packet-Src-IPv6-Address}}/reply-detail-%Y%m%d" Fri Aug 19 17:43:59 2016 : Debug: header = "%t" Fri Aug 19 17:43:59 2016 : Debug: permissions = 384 Fri Aug 19 17:43:59 2016 : Debug: locking = no Fri Aug 19 17:43:59 2016 : Debug: escape_filenames = no Fri Aug 19 17:43:59 2016 : Debug: log_packet_header = no Fri Aug 19 17:43:59 2016 : Debug: } Fri Aug 19 17:43:59 2016 : Debug: # Loading module "pre_proxy_log" from file /etc/freeradius/mods-enabled/detail.log Fri Aug 19 17:43:59 2016 : Debug: detail pre_proxy_log { Fri Aug 19 17:43:59 2016 : Debug: filename = "/var/log/freeradius/radacct/%{%{Packet-Src-IP-Address}:-%{Packet-Src-IPv6-Address}}/pre-proxy-detail-%Y%m%d" Fri Aug 19 17:43:59 2016 : Debug: header = "%t" Fri Aug 19 17:43:59 2016 : Debug: permissions = 384 Fri Aug 19 17:43:59 2016 : Debug: locking = no Fri Aug 19 17:43:59 2016 : Debug: escape_filenames = no Fri Aug 19 17:43:59 2016 : Debug: log_packet_header = no Fri Aug 19 17:43:59 2016 : Debug: } Fri Aug 19 17:43:59 2016 : Debug: # Loading module "post_proxy_log" from file /etc/freeradius/mods-enabled/detail.log Fri Aug 19 17:43:59 2016 : Debug: detail post_proxy_log { Fri Aug 19 17:43:59 2016 : Debug: filename = "/var/log/freeradius/radacct/%{%{Packet-Src-IP-Address}:-%{Packet-Src-IPv6-Address}}/post-proxy-detail-%Y%m%d" Fri Aug 19 17:43:59 2016 : Debug: header = "%t" Fri Aug 19 17:43:59 2016 : Debug: permissions = 384 Fri Aug 19 17:43:59 2016 : Debug: locking = no Fri Aug 19 17:43:59 2016 : Debug: escape_filenames = no Fri Aug 19 17:43:59 2016 : Debug: log_packet_header = no Fri Aug 19 17:43:59 2016 : Debug: } Fri Aug 19 17:43:59 2016 : Debug: Loading rlm_expr with path: /usr/lib/freeradius/rlm_expr.so Fri Aug 19 17:43:59 2016 : Debug: Loaded rlm_expr, checking if it's valid Fri Aug 19 17:43:59 2016 : Debug: # Loaded module rlm_expr Fri Aug 19 17:43:59 2016 : Debug: # Loading module "expr" from file /etc/freeradius/mods-enabled/expr Fri Aug 19 17:43:59 2016 : Debug: expr { Fri Aug 19 17:43:59 2016 : Debug: safe_characters = "@abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ0123456789.-_: /äéöüàâæçèéêëîïôœùûüaÿÄÉÖÜßÀÂÆÇÈÉÊËÎÏÔŒÙÛÜŸ" Fri Aug 19 17:43:59 2016 : Debug: } Fri Aug 19 17:43:59 2016 : Debug: # Loading module "ntlm_auth" from file /etc/freeradius/mods-enabled/ntlm_auth Fri Aug 19 17:43:59 2016 : Debug: exec ntlm_auth { Fri Aug 19 17:43:59 2016 : Debug: wait = yes Fri Aug 19 17:43:59 2016 : Debug: program = "/path/to/ntlm_auth --request-nt-key --domain=MYDOMAIN --username=%{mschap:User-Name} --password=%{User-Password}" Fri Aug 19 17:43:59 2016 : Debug: shell_escape = yes Fri Aug 19 17:43:59 2016 : Debug: } Fri Aug 19 17:43:59 2016 : Debug: Loading rlm_pap with path: /usr/lib/freeradius/rlm_pap.so Fri Aug 19 17:43:59 2016 : Debug: Loaded rlm_pap, checking if it's valid Fri Aug 19 17:43:59 2016 : Debug: # Loaded module rlm_pap Fri Aug 19 17:43:59 2016 : Debug: # Loading module "pap" from file /etc/freeradius/mods-enabled/pap Fri Aug 19 17:43:59 2016 : Debug: pap { Fri Aug 19 17:43:59 2016 : Debug: normalise = yes Fri Aug 19 17:43:59 2016 : Debug: } Fri Aug 19 17:43:59 2016 : Debug: Loading rlm_ldap with path: /usr/lib/freeradius/rlm_ldap.so Fri Aug 19 17:43:59 2016 : Debug: Loaded rlm_ldap, checking if it's valid Fri Aug 19 17:43:59 2016 : Debug: # Loaded module rlm_ldap Fri Aug 19 17:43:59 2016 : Debug: # Loading module "ldap" from file /etc/freeradius/mods-enabled/ldap Fri Aug 19 17:43:59 2016 : Debug: ldap { Fri Aug 19 17:43:59 2016 : Debug: server = "localhost" Fri Aug 19 17:43:59 2016 : Debug: identity = "cn=admin,dc=seminary,dc=local" Fri Aug 19 17:43:59 2016 : Debug: password = "PASSWORD" Fri Aug 19 17:43:59 2016 : Debug: sasl { Fri Aug 19 17:43:59 2016 : Debug: } Fri Aug 19 17:43:59 2016 : Debug: user { Fri Aug 19 17:43:59 2016 : Debug: scope = "sub" Fri Aug 19 17:43:59 2016 : Debug: access_positive = yes Fri Aug 19 17:43:59 2016 : Debug: sasl { Fri Aug 19 17:43:59 2016 : Debug: } Fri Aug 19 17:43:59 2016 : Warning: /etc/freeradius/mods-enabled/ldap[159]: The item 'membership_filter' is defined, but is unused by the configuration Fri Aug 19 17:43:59 2016 : Debug: } Fri Aug 19 17:43:59 2016 : Debug: group { Fri Aug 19 17:43:59 2016 : Debug: filter = "(objectClass=posixGroup)" Fri Aug 19 17:43:59 2016 : Debug: scope = "sub" Fri Aug 19 17:43:59 2016 : Debug: name_attribute = "cn" Fri Aug 19 17:43:59 2016 : Debug: membership_attribute = "memberOf" Fri Aug 19 17:43:59 2016 : Debug: cacheable_name = no Fri Aug 19 17:43:59 2016 : Debug: cacheable_dn = no Fri Aug 19 17:43:59 2016 : Debug: } Fri Aug 19 17:43:59 2016 : Debug: client { Fri Aug 19 17:43:59 2016 : Debug: filter = "(objectClass=radiusClient)" Fri Aug 19 17:43:59 2016 : Debug: scope = "sub" Fri Aug 19 17:43:59 2016 : Debug: base_dn = "ou=SeminaryOU,dc=seminary,dc=local" Fri Aug 19 17:43:59 2016 : Debug: } Fri Aug 19 17:43:59 2016 : Debug: profile { Fri Aug 19 17:43:59 2016 : Debug: } Fri Aug 19 17:43:59 2016 : Debug: options { Fri Aug 19 17:43:59 2016 : Debug: ldap_debug = 40 Fri Aug 19 17:43:59 2016 : Debug: chase_referrals = yes Fri Aug 19 17:43:59 2016 : Debug: rebind = yes Fri Aug 19 17:43:59 2016 : Debug: net_timeout = 1 Fri Aug 19 17:43:59 2016 : Debug: res_timeout = 10 Fri Aug 19 17:43:59 2016 : Debug: srv_timelimit = 3 Fri Aug 19 17:43:59 2016 : Debug: idle = 60 Fri Aug 19 17:43:59 2016 : Debug: probes = 3 Fri Aug 19 17:43:59 2016 : Debug: interval = 3 Fri Aug 19 17:43:59 2016 : Debug: } Fri Aug 19 17:43:59 2016 : Debug: tls { Fri Aug 19 17:43:59 2016 : Debug: start_tls = no Fri Aug 19 17:43:59 2016 : Debug: } Fri Aug 19 17:43:59 2016 : Debug: } Fri Aug 19 17:43:59 2016 : Debug: Creating attribute LDAP-Group Fri Aug 19 17:43:59 2016 : Debug: Loading rlm_digest with path: /usr/lib/freeradius/rlm_digest.so Fri Aug 19 17:43:59 2016 : Debug: Loaded rlm_digest, checking if it's valid Fri Aug 19 17:43:59 2016 : Debug: # Loaded module rlm_digest Fri Aug 19 17:43:59 2016 : Debug: # Loading module "digest" from file /etc/freeradius/mods-enabled/digest Fri Aug 19 17:43:59 2016 : Debug: Loading rlm_files with path: /usr/lib/freeradius/rlm_files.so Fri Aug 19 17:43:59 2016 : Debug: Loaded rlm_files, checking if it's valid Fri Aug 19 17:43:59 2016 : Debug: # Loaded module rlm_files Fri Aug 19 17:43:59 2016 : Debug: # Loading module "files" from file /etc/freeradius/mods-enabled/files Fri Aug 19 17:43:59 2016 : Debug: files { Fri Aug 19 17:43:59 2016 : Debug: filename = "/etc/freeradius/mods-config/files/authorize" Fri Aug 19 17:43:59 2016 : Debug: acctusersfile = "/etc/freeradius/mods-config/files/accounting" Fri Aug 19 17:43:59 2016 : Debug: preproxy_usersfile = "/etc/freeradius/mods-config/files/pre-proxy" Fri Aug 19 17:43:59 2016 : Debug: } Fri Aug 19 17:43:59 2016 : Debug: Loading rlm_preprocess with path: /usr/lib/freeradius/rlm_preprocess.so Fri Aug 19 17:43:59 2016 : Debug: Loaded rlm_preprocess, checking if it's valid Fri Aug 19 17:43:59 2016 : Debug: # Loaded module rlm_preprocess Fri Aug 19 17:43:59 2016 : Debug: # Loading module "preprocess" from file /etc/freeradius/mods-enabled/preprocess Fri Aug 19 17:43:59 2016 : Debug: preprocess { Fri Aug 19 17:43:59 2016 : Debug: huntgroups = "/etc/freeradius/mods-config/preprocess/huntgroups" Fri Aug 19 17:43:59 2016 : Debug: hints = "/etc/freeradius/mods-config/preprocess/hints" Fri Aug 19 17:43:59 2016 : Debug: with_ascend_hack = no Fri Aug 19 17:43:59 2016 : Debug: ascend_channels_per_line = 23 Fri Aug 19 17:43:59 2016 : Debug: with_ntdomain_hack = no Fri Aug 19 17:43:59 2016 : Debug: with_specialix_jetstream_hack = no Fri Aug 19 17:43:59 2016 : Debug: with_cisco_vsa_hack = no Fri Aug 19 17:43:59 2016 : Debug: with_alvarion_vsa_hack = no Fri Aug 19 17:43:59 2016 : Debug: } Fri Aug 19 17:43:59 2016 : Debug: Loading rlm_cache with path: /usr/lib/freeradius/rlm_cache.so Fri Aug 19 17:43:59 2016 : Debug: Loaded rlm_cache, checking if it's valid Fri Aug 19 17:43:59 2016 : Debug: # Loaded module rlm_cache Fri Aug 19 17:43:59 2016 : Debug: # Loading module "cache_eap" from file /etc/freeradius/mods-enabled/cache_eap Fri Aug 19 17:43:59 2016 : Debug: cache cache_eap { Fri Aug 19 17:43:59 2016 : Debug: driver = "rlm_cache_rbtree" Fri Aug 19 17:43:59 2016 : Debug: key = "%{%{control:State}:-%{%{reply:State}:-%{State}}}" Fri Aug 19 17:43:59 2016 : Debug: ttl = 15 Fri Aug 19 17:43:59 2016 : Debug: max_entries = 0 Fri Aug 19 17:43:59 2016 : Debug: epoch = 0 Fri Aug 19 17:43:59 2016 : Debug: add_stats = no Fri Aug 19 17:43:59 2016 : Debug: } Fri Aug 19 17:43:59 2016 : Debug: # Loading module "detail" from file /etc/freeradius/mods-enabled/detail Fri Aug 19 17:43:59 2016 : Debug: detail { Fri Aug 19 17:43:59 2016 : Debug: filename = "/var/log/freeradius/radacct/%{%{Packet-Src-IP-Address}:-%{Packet-Src-IPv6-Address}}/detail-%Y%m%d" Fri Aug 19 17:43:59 2016 : Debug: header = "%t" Fri Aug 19 17:43:59 2016 : Debug: permissions = 384 Fri Aug 19 17:43:59 2016 : Debug: locking = no Fri Aug 19 17:43:59 2016 : Debug: escape_filenames = no Fri Aug 19 17:43:59 2016 : Debug: log_packet_header = no Fri Aug 19 17:43:59 2016 : Debug: } Fri Aug 19 17:43:59 2016 : Debug: Loading rlm_expiration with path: /usr/lib/freeradius/rlm_expiration.so Fri Aug 19 17:43:59 2016 : Debug: Loaded rlm_expiration, checking if it's valid Fri Aug 19 17:43:59 2016 : Debug: # Loaded module rlm_expiration Fri Aug 19 17:43:59 2016 : Debug: # Loading module "expiration" from file /etc/freeradius/mods-enabled/expiration Fri Aug 19 17:43:59 2016 : Debug: Loading rlm_chap with path: /usr/lib/freeradius/rlm_chap.so Fri Aug 19 17:43:59 2016 : Debug: Loaded rlm_chap, checking if it's valid Fri Aug 19 17:43:59 2016 : Debug: # Loaded module rlm_chap Fri Aug 19 17:43:59 2016 : Debug: # Loading module "chap" from file /etc/freeradius/mods-enabled/chap Fri Aug 19 17:43:59 2016 : Debug: Loading rlm_radutmp with path: /usr/lib/freeradius/rlm_radutmp.so Fri Aug 19 17:43:59 2016 : Debug: Loaded rlm_radutmp, checking if it's valid Fri Aug 19 17:43:59 2016 : Debug: # Loaded module rlm_radutmp Fri Aug 19 17:43:59 2016 : Debug: # Loading module "sradutmp" from file /etc/freeradius/mods-enabled/sradutmp Fri Aug 19 17:43:59 2016 : Debug: radutmp sradutmp { Fri Aug 19 17:43:59 2016 : Debug: filename = "/var/log/freeradius/sradutmp" Fri Aug 19 17:43:59 2016 : Debug: username = "%{User-Name}" Fri Aug 19 17:43:59 2016 : Debug: case_sensitive = yes Fri Aug 19 17:43:59 2016 : Debug: check_with_nas = yes Fri Aug 19 17:43:59 2016 : Debug: permissions = 420 Fri Aug 19 17:43:59 2016 : Debug: caller_id = no Fri Aug 19 17:43:59 2016 : Debug: } Fri Aug 19 17:43:59 2016 : Debug: # Loading module "radutmp" from file /etc/freeradius/mods-enabled/radutmp Fri Aug 19 17:43:59 2016 : Debug: radutmp { Fri Aug 19 17:43:59 2016 : Debug: filename = "/var/log/freeradius/radutmp" Fri Aug 19 17:43:59 2016 : Debug: username = "%{User-Name}" Fri Aug 19 17:43:59 2016 : Debug: case_sensitive = yes Fri Aug 19 17:43:59 2016 : Debug: check_with_nas = yes Fri Aug 19 17:43:59 2016 : Debug: permissions = 384 Fri Aug 19 17:43:59 2016 : Debug: caller_id = yes Fri Aug 19 17:43:59 2016 : Debug: } Fri Aug 19 17:43:59 2016 : Debug: Loading rlm_passwd with path: /usr/lib/freeradius/rlm_passwd.so Fri Aug 19 17:43:59 2016 : Debug: Loaded rlm_passwd, checking if it's valid Fri Aug 19 17:43:59 2016 : Debug: # Loaded module rlm_passwd Fri Aug 19 17:43:59 2016 : Debug: # Loading module "etc_passwd" from file /etc/freeradius/mods-enabled/passwd Fri Aug 19 17:43:59 2016 : Debug: passwd etc_passwd { Fri Aug 19 17:43:59 2016 : Debug: filename = "/etc/passwd" Fri Aug 19 17:43:59 2016 : Debug: format = "*User-Name:Crypt-Password:" Fri Aug 19 17:43:59 2016 : Debug: delimiter = ":" Fri Aug 19 17:43:59 2016 : Debug: ignore_nislike = no Fri Aug 19 17:43:59 2016 : Debug: ignore_empty = yes Fri Aug 19 17:43:59 2016 : Debug: allow_multiple_keys = no Fri Aug 19 17:43:59 2016 : Debug: hash_size = 100 Fri Aug 19 17:43:59 2016 : Debug: } Fri Aug 19 17:43:59 2016 : Debug: Loading rlm_linelog with path: /usr/lib/freeradius/rlm_linelog.so Fri Aug 19 17:43:59 2016 : Debug: Loaded rlm_linelog, checking if it's valid Fri Aug 19 17:43:59 2016 : Debug: # Loaded module rlm_linelog Fri Aug 19 17:43:59 2016 : Debug: # Loading module "linelog" from file /etc/freeradius/mods-enabled/linelog Fri Aug 19 17:43:59 2016 : Debug: linelog { Fri Aug 19 17:43:59 2016 : Debug: filename = "/var/log/freeradius/linelog" Fri Aug 19 17:43:59 2016 : Debug: escape_filenames = no Fri Aug 19 17:43:59 2016 : Debug: syslog_severity = "info" Fri Aug 19 17:43:59 2016 : Debug: permissions = 384 Fri Aug 19 17:43:59 2016 : Debug: format = "This is a log message for %{User-Name}" Fri Aug 19 17:43:59 2016 : Debug: reference = "messages.%{%{reply:Packet-Type}:-default}" Fri Aug 19 17:43:59 2016 : Debug: } Fri Aug 19 17:43:59 2016 : Debug: # Loading module "log_accounting" from file /etc/freeradius/mods-enabled/linelog Fri Aug 19 17:43:59 2016 : Debug: linelog log_accounting { Fri Aug 19 17:43:59 2016 : Debug: filename = "/var/log/freeradius/linelog-accounting" Fri Aug 19 17:43:59 2016 : Debug: escape_filenames = no Fri Aug 19 17:43:59 2016 : Debug: syslog_severity = "info" Fri Aug 19 17:43:59 2016 : Debug: permissions = 384 Fri Aug 19 17:43:59 2016 : Debug: format = "" Fri Aug 19 17:43:59 2016 : Debug: reference = "Accounting-Request.%{%{Acct-Status-Type}:-unknown}" Fri Aug 19 17:43:59 2016 : Debug: } Fri Aug 19 17:43:59 2016 : Debug: Loading rlm_unpack with path: /usr/lib/freeradius/rlm_unpack.so Fri Aug 19 17:43:59 2016 : Debug: Loaded rlm_unpack, checking if it's valid Fri Aug 19 17:43:59 2016 : Debug: # Loaded module rlm_unpack Fri Aug 19 17:43:59 2016 : Debug: # Loading module "unpack" from file /etc/freeradius/mods-enabled/unpack Fri Aug 19 17:43:59 2016 : Debug: Loading rlm_attr_filter with path: /usr/lib/freeradius/rlm_attr_filter.so Fri Aug 19 17:43:59 2016 : Debug: Loaded rlm_attr_filter, checking if it's valid Fri Aug 19 17:43:59 2016 : Debug: # Loaded module rlm_attr_filter Fri Aug 19 17:43:59 2016 : Debug: # Loading module "attr_filter.post-proxy" from file /etc/freeradius/mods-enabled/attr_filter Fri Aug 19 17:43:59 2016 : Debug: attr_filter attr_filter.post-proxy { Fri Aug 19 17:43:59 2016 : Debug: filename = "/etc/freeradius/mods-config/attr_filter/post-proxy" Fri Aug 19 17:43:59 2016 : Debug: key = "%{Realm}" Fri Aug 19 17:43:59 2016 : Debug: relaxed = no Fri Aug 19 17:43:59 2016 : Debug: } Fri Aug 19 17:43:59 2016 : Debug: # Loading module "attr_filter.pre-proxy" from file /etc/freeradius/mods-enabled/attr_filter Fri Aug 19 17:43:59 2016 : Debug: attr_filter attr_filter.pre-proxy { Fri Aug 19 17:43:59 2016 : Debug: filename = "/etc/freeradius/mods-config/attr_filter/pre-proxy" Fri Aug 19 17:43:59 2016 : Debug: key = "%{Realm}" Fri Aug 19 17:43:59 2016 : Debug: relaxed = no Fri Aug 19 17:43:59 2016 : Debug: } Fri Aug 19 17:43:59 2016 : Debug: # Loading module "attr_filter.access_reject" from file /etc/freeradius/mods-enabled/attr_filter Fri Aug 19 17:43:59 2016 : Debug: attr_filter attr_filter.access_reject { Fri Aug 19 17:43:59 2016 : Debug: filename = "/etc/freeradius/mods-config/attr_filter/access_reject" Fri Aug 19 17:43:59 2016 : Debug: key = "%{User-Name}" Fri Aug 19 17:43:59 2016 : Debug: relaxed = no Fri Aug 19 17:43:59 2016 : Debug: } Fri Aug 19 17:43:59 2016 : Debug: # Loading module "attr_filter.access_challenge" from file /etc/freeradius/mods-enabled/attr_filter Fri Aug 19 17:43:59 2016 : Debug: attr_filter attr_filter.access_challenge { Fri Aug 19 17:43:59 2016 : Debug: filename = "/etc/freeradius/mods-config/attr_filter/access_challenge" Fri Aug 19 17:43:59 2016 : Debug: key = "%{User-Name}" Fri Aug 19 17:43:59 2016 : Debug: relaxed = no Fri Aug 19 17:43:59 2016 : Debug: } Fri Aug 19 17:43:59 2016 : Debug: # Loading module "attr_filter.accounting_response" from file /etc/freeradius/mods-enabled/attr_filter Fri Aug 19 17:43:59 2016 : Debug: attr_filter attr_filter.accounting_response { Fri Aug 19 17:43:59 2016 : Debug: filename = "/etc/freeradius/mods-config/attr_filter/accounting_response" Fri Aug 19 17:43:59 2016 : Debug: key = "%{User-Name}" Fri Aug 19 17:43:59 2016 : Debug: relaxed = no Fri Aug 19 17:43:59 2016 : Debug: } Fri Aug 19 17:43:59 2016 : Debug: Loading rlm_replicate with path: /usr/lib/freeradius/rlm_replicate.so Fri Aug 19 17:43:59 2016 : Debug: Loaded rlm_replicate, checking if it's valid Fri Aug 19 17:43:59 2016 : Debug: # Loaded module rlm_replicate Fri Aug 19 17:43:59 2016 : Debug: # Loading module "replicate" from file /etc/freeradius/mods-enabled/replicate Fri Aug 19 17:43:59 2016 : Debug: instantiate { Fri Aug 19 17:43:59 2016 : Debug: } Fri Aug 19 17:43:59 2016 : Debug: # Instantiating module "mschap" from file /etc/freeradius/mods-enabled/mschap Fri Aug 19 17:43:59 2016 : Debug: rlm_mschap (mschap): using internal authentication Fri Aug 19 17:43:59 2016 : Debug: # Instantiating module "reject" from file /etc/freeradius/mods-enabled/always Fri Aug 19 17:43:59 2016 : Debug: # Instantiating module "fail" from file /etc/freeradius/mods-enabled/always Fri Aug 19 17:43:59 2016 : Debug: # Instantiating module "ok" from file /etc/freeradius/mods-enabled/always Fri Aug 19 17:43:59 2016 : Debug: # Instantiating module "handled" from file /etc/freeradius/mods-enabled/always Fri Aug 19 17:43:59 2016 : Debug: # Instantiating module "invalid" from file /etc/freeradius/mods-enabled/always Fri Aug 19 17:43:59 2016 : Debug: # Instantiating module "userlock" from file /etc/freeradius/mods-enabled/always Fri Aug 19 17:43:59 2016 : Debug: # Instantiating module "notfound" from file /etc/freeradius/mods-enabled/always Fri Aug 19 17:43:59 2016 : Debug: # Instantiating module "noop" from file /etc/freeradius/mods-enabled/always Fri Aug 19 17:43:59 2016 : Debug: # Instantiating module "updated" from file /etc/freeradius/mods-enabled/always Fri Aug 19 17:43:59 2016 : Debug: # Instantiating module "eap" from file /etc/freeradius/mods-enabled/eap Fri Aug 19 17:43:59 2016 : Debug: Loading rlm_eap_md5 with path: /usr/lib/freeradius/rlm_eap_md5.so Fri Aug 19 17:43:59 2016 : Debug: # Linked to sub-module rlm_eap_md5 Fri Aug 19 17:43:59 2016 : Debug: Loading rlm_eap_leap with path: /usr/lib/freeradius/rlm_eap_leap.so Fri Aug 19 17:43:59 2016 : Debug: # Linked to sub-module rlm_eap_leap Fri Aug 19 17:43:59 2016 : Debug: Loading rlm_eap_gtc with path: /usr/lib/freeradius/rlm_eap_gtc.so Fri Aug 19 17:43:59 2016 : Debug: # Linked to sub-module rlm_eap_gtc Fri Aug 19 17:43:59 2016 : Debug: gtc { Fri Aug 19 17:43:59 2016 : Debug: challenge = "Password: " Fri Aug 19 17:43:59 2016 : Debug: auth_type = "PAP" Fri Aug 19 17:43:59 2016 : Debug: } Fri Aug 19 17:43:59 2016 : Debug: Loading rlm_eap_tls with path: /usr/lib/freeradius/rlm_eap_tls.so Fri Aug 19 17:43:59 2016 : Debug: # Linked to sub-module rlm_eap_tls Fri Aug 19 17:43:59 2016 : Debug: tls { Fri Aug 19 17:43:59 2016 : Debug: tls = "tls-common" Fri Aug 19 17:43:59 2016 : Debug: } Fri Aug 19 17:43:59 2016 : Debug: tls-config tls-common { Fri Aug 19 17:43:59 2016 : Debug: verify_depth = 0 Fri Aug 19 17:43:59 2016 : Debug: ca_path = "/etc/freeradius/certs" Fri Aug 19 17:43:59 2016 : Debug: pem_file_type = yes Fri Aug 19 17:43:59 2016 : Debug: private_key_file = "/etc/freeradius/certs/server.pem" Fri Aug 19 17:43:59 2016 : Debug: certificate_file = "/etc/freeradius/certs/server.pem" Fri Aug 19 17:43:59 2016 : Debug: ca_file = "/etc/freeradius/certs/ca.pem" Fri Aug 19 17:43:59 2016 : Debug: private_key_password = "whatever" Fri Aug 19 17:43:59 2016 : Debug: dh_file = "/etc/freeradius/certs/dh" Fri Aug 19 17:43:59 2016 : Debug: fragment_size = 1024 Fri Aug 19 17:43:59 2016 : Debug: include_length = yes Fri Aug 19 17:43:59 2016 : Debug: auto_chain = yes Fri Aug 19 17:43:59 2016 : Debug: check_crl = no Fri Aug 19 17:43:59 2016 : Debug: check_all_crl = no Fri Aug 19 17:43:59 2016 : Debug: cipher_list = "DEFAULT" Fri Aug 19 17:43:59 2016 : Debug: ecdh_curve = "prime256v1" Fri Aug 19 17:43:59 2016 : Debug: cache { Fri Aug 19 17:43:59 2016 : Debug: enable = yes Fri Aug 19 17:43:59 2016 : Debug: lifetime = 24 Fri Aug 19 17:43:59 2016 : Debug: max_entries = 255 Fri Aug 19 17:43:59 2016 : Debug: } Fri Aug 19 17:43:59 2016 : Debug: verify { Fri Aug 19 17:43:59 2016 : Debug: skip_if_ocsp_ok = no Fri Aug 19 17:43:59 2016 : Debug: } Fri Aug 19 17:43:59 2016 : Debug: ocsp { Fri Aug 19 17:43:59 2016 : Debug: enable = no Fri Aug 19 17:43:59 2016 : Debug: override_cert_url = yes Fri Aug 19 17:43:59 2016 : Debug: url = "http://127.0.0.1/ocsp/" Fri Aug 19 17:43:59 2016 : Debug: use_nonce = yes Fri Aug 19 17:43:59 2016 : Debug: timeout = 0 Fri Aug 19 17:43:59 2016 : Debug: softfail = no Fri Aug 19 17:43:59 2016 : Debug: } Fri Aug 19 17:43:59 2016 : Debug: } Fri Aug 19 17:43:59 2016 : Debug: Loading rlm_eap_ttls with path: /usr/lib/freeradius/rlm_eap_ttls.so Fri Aug 19 17:43:59 2016 : Debug: # Linked to sub-module rlm_eap_ttls Fri Aug 19 17:43:59 2016 : Debug: ttls { Fri Aug 19 17:43:59 2016 : Debug: tls = "tls-common" Fri Aug 19 17:43:59 2016 : Debug: default_eap_type = "md5" Fri Aug 19 17:43:59 2016 : Debug: copy_request_to_tunnel = no Fri Aug 19 17:43:59 2016 : Debug: use_tunneled_reply = no Fri Aug 19 17:43:59 2016 : Debug: virtual_server = "inner-tunnel" Fri Aug 19 17:43:59 2016 : Debug: include_length = yes Fri Aug 19 17:43:59 2016 : Debug: require_client_cert = no Fri Aug 19 17:43:59 2016 : Debug: } Fri Aug 19 17:43:59 2016 : Debug: tls: Using cached TLS configuration from previous invocation Fri Aug 19 17:43:59 2016 : Debug: Loading rlm_eap_peap with path: /usr/lib/freeradius/rlm_eap_peap.so Fri Aug 19 17:43:59 2016 : Debug: # Linked to sub-module rlm_eap_peap Fri Aug 19 17:43:59 2016 : Debug: peap { Fri Aug 19 17:43:59 2016 : Debug: tls = "tls-common" Fri Aug 19 17:43:59 2016 : Debug: default_eap_type = "mschapv2" Fri Aug 19 17:43:59 2016 : Debug: copy_request_to_tunnel = no Fri Aug 19 17:43:59 2016 : Debug: use_tunneled_reply = no Fri Aug 19 17:43:59 2016 : Debug: proxy_tunneled_request_as_eap = yes Fri Aug 19 17:43:59 2016 : Debug: virtual_server = "inner-tunnel" Fri Aug 19 17:43:59 2016 : Debug: soh = no Fri Aug 19 17:43:59 2016 : Debug: require_client_cert = no Fri Aug 19 17:43:59 2016 : Debug: } Fri Aug 19 17:43:59 2016 : Debug: tls: Using cached TLS configuration from previous invocation Fri Aug 19 17:43:59 2016 : Debug: Loading rlm_eap_mschapv2 with path: /usr/lib/freeradius/rlm_eap_mschapv2.so Fri Aug 19 17:43:59 2016 : Debug: # Linked to sub-module rlm_eap_mschapv2 Fri Aug 19 17:43:59 2016 : Debug: mschapv2 { Fri Aug 19 17:43:59 2016 : Debug: with_ntdomain_hack = no Fri Aug 19 17:43:59 2016 : Debug: send_error = no Fri Aug 19 17:43:59 2016 : Debug: } Fri Aug 19 17:43:59 2016 : Debug: # Instantiating module "logintime" from file /etc/freeradius/mods-enabled/logintime Fri Aug 19 17:43:59 2016 : Debug: # Instantiating module "IPASS" from file /etc/freeradius/mods-enabled/realm Fri Aug 19 17:43:59 2016 : Debug: # Instantiating module "suffix" from file /etc/freeradius/mods-enabled/realm Fri Aug 19 17:43:59 2016 : Debug: # Instantiating module "realmpercent" from file /etc/freeradius/mods-enabled/realm Fri Aug 19 17:43:59 2016 : Debug: # Instantiating module "ntdomain" from file /etc/freeradius/mods-enabled/realm Fri Aug 19 17:43:59 2016 : Debug: # Instantiating module "auth_log" from file /etc/freeradius/mods-enabled/detail.log Fri Aug 19 17:43:59 2016 : Debug: rlm_detail (auth_log): 'User-Password' suppressed, will not appear in detail output Fri Aug 19 17:43:59 2016 : Debug: # Instantiating module "reply_log" from file /etc/freeradius/mods-enabled/detail.log Fri Aug 19 17:43:59 2016 : Debug: # Instantiating module "pre_proxy_log" from file /etc/freeradius/mods-enabled/detail.log Fri Aug 19 17:43:59 2016 : Debug: # Instantiating module "post_proxy_log" from file /etc/freeradius/mods-enabled/detail.log Fri Aug 19 17:43:59 2016 : Debug: # Instantiating module "pap" from file /etc/freeradius/mods-enabled/pap Fri Aug 19 17:43:59 2016 : Debug: # Instantiating module "ldap" from file /etc/freeradius/mods-enabled/ldap Fri Aug 19 17:43:59 2016 : Info: rlm_ldap: libldap vendor: OpenLDAP, version: 20442 Fri Aug 19 17:43:59 2016 : Debug: accounting { Fri Aug 19 17:43:59 2016 : Debug: reference = "%{tolower:type.%{Acct-Status-Type}}" Fri Aug 19 17:43:59 2016 : Debug: } Fri Aug 19 17:43:59 2016 : Debug: post-auth { Fri Aug 19 17:43:59 2016 : Debug: reference = "." Fri Aug 19 17:43:59 2016 : Debug: } Fri Aug 19 17:43:59 2016 : Debug: LDAP server string: ldap://localhost:389 Fri Aug 19 17:43:59 2016 : Debug: rlm_ldap (ldap): Using local pool section Fri Aug 19 17:43:59 2016 : Debug: rlm_ldap (ldap): No pool reference found for config item "ldap.pool" Fri Aug 19 17:43:59 2016 : Debug: rlm_ldap (ldap): Initialising connection pool Fri Aug 19 17:43:59 2016 : Debug: pool { Fri Aug 19 17:43:59 2016 : Debug: start = 5 Fri Aug 19 17:43:59 2016 : Debug: min = 3 Fri Aug 19 17:43:59 2016 : Debug: max = 32 Fri Aug 19 17:43:59 2016 : Debug: spare = 10 Fri Aug 19 17:43:59 2016 : Debug: uses = 0 Fri Aug 19 17:43:59 2016 : Debug: lifetime = 0 Fri Aug 19 17:43:59 2016 : Debug: cleanup_interval = 30 Fri Aug 19 17:43:59 2016 : Debug: idle_timeout = 60 Fri Aug 19 17:43:59 2016 : Debug: retry_delay = 30 Fri Aug 19 17:43:59 2016 : Debug: spread = no Fri Aug 19 17:43:59 2016 : Debug: } Fri Aug 19 17:43:59 2016 : Info: rlm_ldap (ldap): Opening additional connection (0), 1 of 32 pending slots used Fri Aug 19 17:43:59 2016 : Debug: rlm_ldap (ldap): Connecting to ldap://localhost:389 Fri Aug 19 17:43:59 2016 : Debug: rlm_ldap (ldap): New libldap handle 0x255d6f0 Fri Aug 19 17:43:59 2016 : Debug: rlm_ldap (ldap): Waiting for bind result... Fri Aug 19 17:43:59 2016 : Debug: rlm_ldap (ldap): Bind successful Fri Aug 19 17:43:59 2016 : Info: rlm_ldap (ldap): Opening additional connection (1), 1 of 31 pending slots used Fri Aug 19 17:43:59 2016 : Debug: rlm_ldap (ldap): Connecting to ldap://localhost:389 Fri Aug 19 17:43:59 2016 : Debug: rlm_ldap (ldap): New libldap handle 0x25487c0 Fri Aug 19 17:43:59 2016 : Debug: rlm_ldap (ldap): Waiting for bind result... Fri Aug 19 17:43:59 2016 : Debug: rlm_ldap (ldap): Bind successful Fri Aug 19 17:43:59 2016 : Info: rlm_ldap (ldap): Opening additional connection (2), 1 of 30 pending slots used Fri Aug 19 17:43:59 2016 : Debug: rlm_ldap (ldap): Connecting to ldap://localhost:389 Fri Aug 19 17:43:59 2016 : Debug: rlm_ldap (ldap): New libldap handle 0x2551780 Fri Aug 19 17:43:59 2016 : Debug: rlm_ldap (ldap): Waiting for bind result... Fri Aug 19 17:43:59 2016 : Debug: rlm_ldap (ldap): Bind successful Fri Aug 19 17:43:59 2016 : Info: rlm_ldap (ldap): Opening additional connection (3), 1 of 29 pending slots used Fri Aug 19 17:43:59 2016 : Debug: rlm_ldap (ldap): Connecting to ldap://localhost:389 Fri Aug 19 17:43:59 2016 : Debug: rlm_ldap (ldap): New libldap handle 0x254f750 Fri Aug 19 17:43:59 2016 : Debug: rlm_ldap (ldap): Waiting for bind result... Fri Aug 19 17:43:59 2016 : Debug: rlm_ldap (ldap): Bind successful Fri Aug 19 17:43:59 2016 : Info: rlm_ldap (ldap): Opening additional connection (4), 1 of 28 pending slots used Fri Aug 19 17:43:59 2016 : Debug: rlm_ldap (ldap): Connecting to ldap://localhost:389 Fri Aug 19 17:43:59 2016 : Debug: rlm_ldap (ldap): New libldap handle 0x2597c50 Fri Aug 19 17:43:59 2016 : Debug: rlm_ldap (ldap): Waiting for bind result... Fri Aug 19 17:43:59 2016 : Debug: rlm_ldap (ldap): Bind successful Fri Aug 19 17:43:59 2016 : Debug: rlm_ldap (ldap): Adding pool reference 0x25865d0 to config item "ldap.pool" Fri Aug 19 17:43:59 2016 : Debug: # Instantiating module "files" from file /etc/freeradius/mods-enabled/files Fri Aug 19 17:43:59 2016 : Debug: reading pairlist file /etc/freeradius/mods-config/files/authorize Fri Aug 19 17:43:59 2016 : Debug: reading pairlist file /etc/freeradius/mods-config/files/accounting Fri Aug 19 17:43:59 2016 : Debug: reading pairlist file /etc/freeradius/mods-config/files/pre-proxy Fri Aug 19 17:43:59 2016 : Debug: # Instantiating module "preprocess" from file /etc/freeradius/mods-enabled/preprocess Fri Aug 19 17:43:59 2016 : Debug: reading pairlist file /etc/freeradius/mods-config/preprocess/huntgroups Fri Aug 19 17:43:59 2016 : Debug: reading pairlist file /etc/freeradius/mods-config/preprocess/hints Fri Aug 19 17:43:59 2016 : Debug: # Instantiating module "cache_eap" from file /etc/freeradius/mods-enabled/cache_eap Fri Aug 19 17:43:59 2016 : Debug: Loading rlm_cache_rbtree with path: /usr/lib/freeradius/rlm_cache_rbtree.so Fri Aug 19 17:43:59 2016 : Debug: rlm_cache (cache_eap): Driver rlm_cache_rbtree (module rlm_cache_rbtree) loaded and linked Fri Aug 19 17:43:59 2016 : Debug: # Instantiating module "detail" from file /etc/freeradius/mods-enabled/detail Fri Aug 19 17:43:59 2016 : Debug: # Instantiating module "expiration" from file /etc/freeradius/mods-enabled/expiration Fri Aug 19 17:43:59 2016 : Debug: # Instantiating module "etc_passwd" from file /etc/freeradius/mods-enabled/passwd Fri Aug 19 17:43:59 2016 : Debug: rlm_passwd: nfields: 3 keyfield 0(User-Name) listable: no Fri Aug 19 17:43:59 2016 : Debug: # Instantiating module "linelog" from file /etc/freeradius/mods-enabled/linelog Fri Aug 19 17:43:59 2016 : Debug: # Instantiating module "log_accounting" from file /etc/freeradius/mods-enabled/linelog Fri Aug 19 17:43:59 2016 : Debug: # Instantiating module "attr_filter.post-proxy" from file /etc/freeradius/mods-enabled/attr_filter Fri Aug 19 17:43:59 2016 : Debug: reading pairlist file /etc/freeradius/mods-config/attr_filter/post-proxy Fri Aug 19 17:43:59 2016 : Debug: # Instantiating module "attr_filter.pre-proxy" from file /etc/freeradius/mods-enabled/attr_filter Fri Aug 19 17:43:59 2016 : Debug: reading pairlist file /etc/freeradius/mods-config/attr_filter/pre-proxy Fri Aug 19 17:43:59 2016 : Debug: # Instantiating module "attr_filter.access_reject" from file /etc/freeradius/mods-enabled/attr_filter Fri Aug 19 17:43:59 2016 : Debug: reading pairlist file /etc/freeradius/mods-config/attr_filter/access_reject Fri Aug 19 17:43:59 2016 : Warning: [/etc/freeradius/mods-config/attr_filter/access_reject]:11 Check item "FreeRADIUS-Response-Delay" found in filter list for realm "DEFAULT". Fri Aug 19 17:43:59 2016 : Warning: [/etc/freeradius/mods-config/attr_filter/access_reject]:11 Check item "FreeRADIUS-Response-Delay-USec" found in filter list for realm "DEFAULT". Fri Aug 19 17:43:59 2016 : Debug: # Instantiating module "attr_filter.access_challenge" from file /etc/freeradius/mods-enabled/attr_filter Fri Aug 19 17:43:59 2016 : Debug: reading pairlist file /etc/freeradius/mods-config/attr_filter/access_challenge Fri Aug 19 17:43:59 2016 : Debug: # Instantiating module "attr_filter.accounting_response" from file /etc/freeradius/mods-enabled/attr_filter Fri Aug 19 17:43:59 2016 : Debug: reading pairlist file /etc/freeradius/mods-config/attr_filter/accounting_response Fri Aug 19 17:43:59 2016 : Debug: } # modules Fri Aug 19 17:43:59 2016 : Debug: radiusd: #### Loading Virtual Servers #### Fri Aug 19 17:43:59 2016 : Debug: server { # from file /etc/freeradius/radiusd.conf Fri Aug 19 17:43:59 2016 : Debug: } # server Fri Aug 19 17:43:59 2016 : Debug: server inner-tunnel { # from file /etc/freeradius/sites-enabled/inner-tunnel Fri Aug 19 17:43:59 2016 : Debug: authenticate { Fri Aug 19 17:43:59 2016 : Debug: group { Fri Aug 19 17:43:59 2016 : Debug: pap Fri Aug 19 17:43:59 2016 : Debug: } Fri Aug 19 17:43:59 2016 : Debug: group { Fri Aug 19 17:43:59 2016 : Debug: chap Fri Aug 19 17:43:59 2016 : Debug: } Fri Aug 19 17:43:59 2016 : Debug: group { Fri Aug 19 17:43:59 2016 : Debug: mschap Fri Aug 19 17:43:59 2016 : Debug: } Fri Aug 19 17:43:59 2016 : Debug: eap Fri Aug 19 17:43:59 2016 : Debug: } # authenticate Fri Aug 19 17:43:59 2016 : Debug: authorize { Fri Aug 19 17:43:59 2016 : Debug: policy filter_username { Fri Aug 19 17:43:59 2016 : Debug: if (&User-Name) { Fri Aug 19 17:43:59 2016 : Debug: if (&User-Name =~ / /) { Fri Aug 19 17:43:59 2016 : Debug: update { Fri Aug 19 17:43:59 2016 : Debug: &Module-Failure-Message += 'Rejected: User-Name contains whitespace' Fri Aug 19 17:43:59 2016 : Debug: } Fri Aug 19 17:43:59 2016 : Debug: reject Fri Aug 19 17:43:59 2016 : Debug: } Fri Aug 19 17:43:59 2016 : Debug: if (&User-Name =~ /@[^@]*@/) { Fri Aug 19 17:43:59 2016 : Debug: update { Fri Aug 19 17:43:59 2016 : Debug: &Module-Failure-Message += 'Rejected: Multiple @ in User-Name' Fri Aug 19 17:43:59 2016 : Debug: } Fri Aug 19 17:43:59 2016 : Debug: reject Fri Aug 19 17:43:59 2016 : Debug: } Fri Aug 19 17:43:59 2016 : Debug: if (&User-Name =~ /\.\./) { Fri Aug 19 17:43:59 2016 : Debug: update { Fri Aug 19 17:43:59 2016 : Debug: &Module-Failure-Message += 'Rejected: User-Name contains multiple ..s' Fri Aug 19 17:43:59 2016 : Debug: } Fri Aug 19 17:43:59 2016 : Debug: reject Fri Aug 19 17:43:59 2016 : Debug: } Fri Aug 19 17:43:59 2016 : Debug: if (&User-Name =~ /@/ && !&User-Name =~ /@(.+)\.(.+)$/) { Fri Aug 19 17:43:59 2016 : Debug: update { Fri Aug 19 17:43:59 2016 : Debug: &Module-Failure-Message += 'Rejected: Realm does not have at least one dot separator' Fri Aug 19 17:43:59 2016 : Debug: } Fri Aug 19 17:43:59 2016 : Debug: reject Fri Aug 19 17:43:59 2016 : Debug: } Fri Aug 19 17:43:59 2016 : Debug: if (&User-Name =~ /\.$/) { Fri Aug 19 17:43:59 2016 : Debug: update { Fri Aug 19 17:43:59 2016 : Debug: &Module-Failure-Message += 'Rejected: Realm ends with a dot' Fri Aug 19 17:43:59 2016 : Debug: } Fri Aug 19 17:43:59 2016 : Debug: reject Fri Aug 19 17:43:59 2016 : Debug: } Fri Aug 19 17:43:59 2016 : Debug: if (&User-Name =~ /@\./) { Fri Aug 19 17:43:59 2016 : Debug: update { Fri Aug 19 17:43:59 2016 : Debug: &Module-Failure-Message += 'Rejected: Realm begins with a dot' Fri Aug 19 17:43:59 2016 : Debug: } Fri Aug 19 17:43:59 2016 : Debug: reject Fri Aug 19 17:43:59 2016 : Debug: } Fri Aug 19 17:43:59 2016 : Debug: } Fri Aug 19 17:43:59 2016 : Debug: } Fri Aug 19 17:43:59 2016 : Debug: chap Fri Aug 19 17:43:59 2016 : Debug: mschap Fri Aug 19 17:43:59 2016 : Debug: suffix Fri Aug 19 17:43:59 2016 : Debug: update { Fri Aug 19 17:43:59 2016 : Debug: &control:Proxy-To-Realm := LOCAL Fri Aug 19 17:43:59 2016 : Debug: } Fri Aug 19 17:43:59 2016 : Debug: eap Fri Aug 19 17:43:59 2016 : Debug: files Fri Aug 19 17:43:59 2016 : Debug: ldap Fri Aug 19 17:43:59 2016 : Debug: expiration Fri Aug 19 17:43:59 2016 : Debug: logintime Fri Aug 19 17:43:59 2016 : Debug: pap Fri Aug 19 17:43:59 2016 : Debug: } # authorize Fri Aug 19 17:43:59 2016 : Debug: session { Fri Aug 19 17:43:59 2016 : Debug: radutmp Fri Aug 19 17:43:59 2016 : Debug: } # session Fri Aug 19 17:43:59 2016 : Debug: post-proxy { Fri Aug 19 17:43:59 2016 : Debug: eap Fri Aug 19 17:43:59 2016 : Debug: } # post-proxy Fri Aug 19 17:43:59 2016 : Debug: post-auth { Fri Aug 19 17:43:59 2016 : Warning: Ignoring "sql" (see raddb/mods-available/README.rst) Fri Aug 19 17:43:59 2016 : Debug: ldap Fri Aug 19 17:43:59 2016 : Debug: group { Fri Aug 19 17:43:59 2016 : Debug: attr_filter.access_reject Fri Aug 19 17:43:59 2016 : Debug: update { Fri Aug 19 17:43:59 2016 : Debug: &outer.session-state:Module-Failure-Message := &Module-Failure-Message Fri Aug 19 17:43:59 2016 : Debug: } Fri Aug 19 17:43:59 2016 : Debug: } Fri Aug 19 17:43:59 2016 : Debug: } # post-auth Fri Aug 19 17:43:59 2016 : Debug: } # server inner-tunnel Fri Aug 19 17:43:59 2016 : Debug: server default { # from file /etc/freeradius/sites-enabled/default Fri Aug 19 17:43:59 2016 : Debug: authenticate { Fri Aug 19 17:43:59 2016 : Debug: group { Fri Aug 19 17:43:59 2016 : Debug: pap Fri Aug 19 17:43:59 2016 : Debug: } Fri Aug 19 17:43:59 2016 : Debug: group { Fri Aug 19 17:43:59 2016 : Debug: chap Fri Aug 19 17:43:59 2016 : Debug: } Fri Aug 19 17:43:59 2016 : Debug: group { Fri Aug 19 17:43:59 2016 : Debug: mschap Fri Aug 19 17:43:59 2016 : Debug: } Fri Aug 19 17:43:59 2016 : Debug: digest Fri Aug 19 17:43:59 2016 : Debug: eap Fri Aug 19 17:43:59 2016 : Debug: } # authenticate Fri Aug 19 17:43:59 2016 : Debug: authorize { Fri Aug 19 17:43:59 2016 : Debug: policy filter_username { Fri Aug 19 17:43:59 2016 : Debug: if (&User-Name) { Fri Aug 19 17:43:59 2016 : Debug: if (&User-Name =~ / /) { Fri Aug 19 17:43:59 2016 : Debug: update { Fri Aug 19 17:43:59 2016 : Debug: &Module-Failure-Message += 'Rejected: User-Name contains whitespace' Fri Aug 19 17:43:59 2016 : Debug: } Fri Aug 19 17:43:59 2016 : Debug: reject Fri Aug 19 17:43:59 2016 : Debug: } Fri Aug 19 17:43:59 2016 : Debug: if (&User-Name =~ /@[^@]*@/) { Fri Aug 19 17:43:59 2016 : Debug: update { Fri Aug 19 17:43:59 2016 : Debug: &Module-Failure-Message += 'Rejected: Multiple @ in User-Name' Fri Aug 19 17:43:59 2016 : Debug: } Fri Aug 19 17:43:59 2016 : Debug: reject Fri Aug 19 17:43:59 2016 : Debug: } Fri Aug 19 17:43:59 2016 : Debug: if (&User-Name =~ /\.\./) { Fri Aug 19 17:43:59 2016 : Debug: update { Fri Aug 19 17:43:59 2016 : Debug: &Module-Failure-Message += 'Rejected: User-Name contains multiple ..s' Fri Aug 19 17:43:59 2016 : Debug: } Fri Aug 19 17:43:59 2016 : Debug: reject Fri Aug 19 17:43:59 2016 : Debug: } Fri Aug 19 17:43:59 2016 : Debug: if (&User-Name =~ /@/ && !&User-Name =~ /@(.+)\.(.+)$/) { Fri Aug 19 17:43:59 2016 : Debug: update { Fri Aug 19 17:43:59 2016 : Debug: &Module-Failure-Message += 'Rejected: Realm does not have at least one dot separator' Fri Aug 19 17:43:59 2016 : Debug: } Fri Aug 19 17:43:59 2016 : Debug: reject Fri Aug 19 17:43:59 2016 : Debug: } Fri Aug 19 17:43:59 2016 : Debug: if (&User-Name =~ /\.$/) { Fri Aug 19 17:43:59 2016 : Debug: update { Fri Aug 19 17:43:59 2016 : Debug: &Module-Failure-Message += 'Rejected: Realm ends with a dot' Fri Aug 19 17:43:59 2016 : Debug: } Fri Aug 19 17:43:59 2016 : Debug: reject Fri Aug 19 17:43:59 2016 : Debug: } Fri Aug 19 17:43:59 2016 : Debug: if (&User-Name =~ /@\./) { Fri Aug 19 17:43:59 2016 : Debug: update { Fri Aug 19 17:43:59 2016 : Debug: &Module-Failure-Message += 'Rejected: Realm begins with a dot' Fri Aug 19 17:43:59 2016 : Debug: } Fri Aug 19 17:43:59 2016 : Debug: reject Fri Aug 19 17:43:59 2016 : Debug: } Fri Aug 19 17:43:59 2016 : Debug: } Fri Aug 19 17:43:59 2016 : Debug: } Fri Aug 19 17:43:59 2016 : Debug: preprocess Fri Aug 19 17:43:59 2016 : Debug: chap Fri Aug 19 17:43:59 2016 : Debug: mschap Fri Aug 19 17:43:59 2016 : Debug: suffix Fri Aug 19 17:43:59 2016 : Debug: eap Fri Aug 19 17:43:59 2016 : Debug: files Fri Aug 19 17:43:59 2016 : Debug: ldap Fri Aug 19 17:43:59 2016 : Debug: expiration Fri Aug 19 17:43:59 2016 : Debug: logintime Fri Aug 19 17:43:59 2016 : Debug: pap Fri Aug 19 17:43:59 2016 : Debug: } # authorize Fri Aug 19 17:43:59 2016 : Debug: preacct { Fri Aug 19 17:43:59 2016 : Debug: preprocess Fri Aug 19 17:43:59 2016 : Debug: policy acct_unique { Fri Aug 19 17:43:59 2016 : Debug: if ("%{string:Class}" =~ /ai:([0-9a-f]{32})/) { Fri Aug 19 17:43:59 2016 : Debug: update { Fri Aug 19 17:43:59 2016 : Debug: &Acct-Unique-Session-Id := "%{md5:%{1},%{Acct-Session-ID}}" Fri Aug 19 17:43:59 2016 : Debug: } Fri Aug 19 17:43:59 2016 : Debug: } Fri Aug 19 17:43:59 2016 : Debug: else { Fri Aug 19 17:43:59 2016 : Debug: update { Fri Aug 19 17:43:59 2016 : Debug: &Acct-Unique-Session-Id := "%{md5:%{User-Name},%{Acct-Session-ID},%{%{NAS-IPv6-Address}:-%{NAS-IP-Address}},%{NAS-Identifier},%{NAS-Port-ID},%{NAS-Port}}" Fri Aug 19 17:43:59 2016 : Debug: } Fri Aug 19 17:43:59 2016 : Debug: } Fri Aug 19 17:43:59 2016 : Debug: } Fri Aug 19 17:43:59 2016 : Debug: suffix Fri Aug 19 17:43:59 2016 : Debug: files Fri Aug 19 17:43:59 2016 : Debug: } # preacct Fri Aug 19 17:43:59 2016 : Debug: accounting { Fri Aug 19 17:43:59 2016 : Debug: detail Fri Aug 19 17:43:59 2016 : Debug: unix Fri Aug 19 17:43:59 2016 : Debug: exec Fri Aug 19 17:43:59 2016 : Debug: attr_filter.accounting_response Fri Aug 19 17:43:59 2016 : Debug: } # accounting Fri Aug 19 17:43:59 2016 : Debug: post-proxy { Fri Aug 19 17:43:59 2016 : Debug: eap Fri Aug 19 17:43:59 2016 : Debug: } # post-proxy Fri Aug 19 17:43:59 2016 : Debug: post-auth { Fri Aug 19 17:43:59 2016 : Debug: update { Fri Aug 19 17:43:59 2016 : Debug: &reply[*] += &session-state[*] Fri Aug 19 17:43:59 2016 : Debug: } Fri Aug 19 17:43:59 2016 : Warning: /etc/freeradius/sites-enabled/default[694]: Please change attribute reference to '&Tunnel-Type := ...' Fri Aug 19 17:43:59 2016 : Warning: /etc/freeradius/sites-enabled/default[695]: Please change attribute reference to '&Tunnel-Medium-Type := ...' Fri Aug 19 17:43:59 2016 : Warning: /etc/freeradius/sites-enabled/default[696]: Please change attribute reference to '&Tunnel-Private-Group-ID := ...' Fri Aug 19 17:43:59 2016 : Debug: if (&Ldap-Group == "cn=SeminaryAdmin,ou=SeminaryOU,dc=seminary,dc=local") { Fri Aug 19 17:43:59 2016 : Debug: update { Fri Aug 19 17:43:59 2016 : Debug: &reply:Tunnel-Type := VLAN Fri Aug 19 17:43:59 2016 : Debug: &reply:Tunnel-Medium-Type := 802 Fri Aug 19 17:43:59 2016 : Debug: &reply:Tunnel-Private-Group-Id := "12" Fri Aug 19 17:43:59 2016 : Debug: } Fri Aug 19 17:43:59 2016 : Debug: } Fri Aug 19 17:43:59 2016 : Debug: ldap Fri Aug 19 17:43:59 2016 : Debug: exec Fri Aug 19 17:43:59 2016 : Debug: policy remove_reply_message_if_eap { Fri Aug 19 17:43:59 2016 : Debug: if (&reply:EAP-Message && &reply:Reply-Message) { Fri Aug 19 17:43:59 2016 : Debug: update { Fri Aug 19 17:43:59 2016 : Debug: &reply:Reply-Message !* ANY Fri Aug 19 17:43:59 2016 : Debug: } Fri Aug 19 17:43:59 2016 : Debug: } Fri Aug 19 17:43:59 2016 : Debug: else { Fri Aug 19 17:43:59 2016 : Debug: noop Fri Aug 19 17:43:59 2016 : Debug: } Fri Aug 19 17:43:59 2016 : Debug: } Fri Aug 19 17:43:59 2016 : Debug: group { Fri Aug 19 17:43:59 2016 : Debug: attr_filter.access_reject Fri Aug 19 17:43:59 2016 : Debug: eap Fri Aug 19 17:43:59 2016 : Debug: policy remove_reply_message_if_eap { Fri Aug 19 17:43:59 2016 : Debug: if (&reply:EAP-Message && &reply:Reply-Message) { Fri Aug 19 17:43:59 2016 : Debug: update { Fri Aug 19 17:43:59 2016 : Debug: &reply:Reply-Message !* ANY Fri Aug 19 17:43:59 2016 : Debug: } Fri Aug 19 17:43:59 2016 : Debug: } Fri Aug 19 17:43:59 2016 : Debug: else { Fri Aug 19 17:43:59 2016 : Debug: noop Fri Aug 19 17:43:59 2016 : Debug: } Fri Aug 19 17:43:59 2016 : Debug: } Fri Aug 19 17:43:59 2016 : Debug: } Fri Aug 19 17:43:59 2016 : Debug: } # post-auth Fri Aug 19 17:43:59 2016 : Debug: } # server default Fri Aug 19 17:43:59 2016 : Debug: Created signal pipe. Read end FD 11, write end FD 12 Fri Aug 19 17:43:59 2016 : Debug: radiusd: #### Opening IP addresses and Ports #### Fri Aug 19 17:43:59 2016 : Debug: Loading proto_auth with path: /usr/lib/freeradius/proto_auth.so Fri Aug 19 17:43:59 2016 : Debug: Loading proto_auth failed: /usr/lib/freeradius/proto_auth.so: cannot open shared object file: No such file or directory - No such file or directory Fri Aug 19 17:43:59 2016 : Debug: Loading library using linker search path(s) Fri Aug 19 17:43:59 2016 : Debug: Defaults : /lib:/usr/lib Fri Aug 19 17:43:59 2016 : Debug: Failed with error: proto_auth.so: cannot open shared object file: No such file or directory Fri Aug 19 17:43:59 2016 : Debug: listen { Fri Aug 19 17:43:59 2016 : Debug: type = "auth" Fri Aug 19 17:43:59 2016 : Debug: ipaddr = 127.0.0.1 Fri Aug 19 17:43:59 2016 : Debug: port = 18120 Fri Aug 19 17:43:59 2016 : Debug: } Fri Aug 19 17:43:59 2016 : Debug: Loading proto_auth with path: /usr/lib/freeradius/proto_auth.so Fri Aug 19 17:43:59 2016 : Debug: Loading proto_auth failed: /usr/lib/freeradius/proto_auth.so: cannot open shared object file: No such file or directory - No such file or directory Fri Aug 19 17:43:59 2016 : Debug: Loading library using linker search path(s) Fri Aug 19 17:43:59 2016 : Debug: Defaults : /lib:/usr/lib Fri Aug 19 17:43:59 2016 : Debug: Failed with error: proto_auth.so: cannot open shared object file: No such file or directory Fri Aug 19 17:43:59 2016 : Debug: listen { Fri Aug 19 17:43:59 2016 : Debug: type = "auth" Fri Aug 19 17:43:59 2016 : Debug: ipaddr = * Fri Aug 19 17:43:59 2016 : Debug: port = 0 Fri Aug 19 17:43:59 2016 : Debug: limit { Fri Aug 19 17:43:59 2016 : Debug: max_connections = 16 Fri Aug 19 17:43:59 2016 : Debug: lifetime = 0 Fri Aug 19 17:43:59 2016 : Debug: idle_timeout = 30 Fri Aug 19 17:43:59 2016 : Debug: } Fri Aug 19 17:43:59 2016 : Debug: } Fri Aug 19 17:43:59 2016 : Debug: Loading proto_acct with path: /usr/lib/freeradius/proto_acct.so Fri Aug 19 17:43:59 2016 : Debug: Loading proto_acct failed: /usr/lib/freeradius/proto_acct.so: cannot open shared object file: No such file or directory - No such file or directory Fri Aug 19 17:43:59 2016 : Debug: Loading library using linker search path(s) Fri Aug 19 17:43:59 2016 : Debug: Defaults : /lib:/usr/lib Fri Aug 19 17:43:59 2016 : Debug: Failed with error: proto_acct.so: cannot open shared object file: No such file or directory Fri Aug 19 17:43:59 2016 : Debug: listen { Fri Aug 19 17:43:59 2016 : Debug: type = "acct" Fri Aug 19 17:43:59 2016 : Debug: ipaddr = * Fri Aug 19 17:43:59 2016 : Debug: port = 0 Fri Aug 19 17:43:59 2016 : Debug: limit { Fri Aug 19 17:43:59 2016 : Debug: max_connections = 16 Fri Aug 19 17:43:59 2016 : Debug: lifetime = 0 Fri Aug 19 17:43:59 2016 : Debug: idle_timeout = 30 Fri Aug 19 17:43:59 2016 : Debug: } Fri Aug 19 17:43:59 2016 : Debug: } Fri Aug 19 17:43:59 2016 : Debug: Loading proto_auth with path: /usr/lib/freeradius/proto_auth.so Fri Aug 19 17:43:59 2016 : Debug: Loading proto_auth failed: /usr/lib/freeradius/proto_auth.so: cannot open shared object file: No such file or directory - No such file or directory Fri Aug 19 17:43:59 2016 : Debug: Loading library using linker search path(s) Fri Aug 19 17:43:59 2016 : Debug: Defaults : /lib:/usr/lib Fri Aug 19 17:43:59 2016 : Debug: Failed with error: proto_auth.so: cannot open shared object file: No such file or directory Fri Aug 19 17:43:59 2016 : Debug: listen { Fri Aug 19 17:43:59 2016 : Debug: type = "auth" Fri Aug 19 17:43:59 2016 : Debug: ipv6addr = :: Fri Aug 19 17:43:59 2016 : Debug: port = 0 Fri Aug 19 17:43:59 2016 : Debug: limit { Fri Aug 19 17:43:59 2016 : Debug: max_connections = 16 Fri Aug 19 17:43:59 2016 : Debug: lifetime = 0 Fri Aug 19 17:43:59 2016 : Debug: idle_timeout = 30 Fri Aug 19 17:43:59 2016 : Debug: } Fri Aug 19 17:43:59 2016 : Debug: } Fri Aug 19 17:43:59 2016 : Debug: Loading proto_acct with path: /usr/lib/freeradius/proto_acct.so Fri Aug 19 17:43:59 2016 : Debug: Loading proto_acct failed: /usr/lib/freeradius/proto_acct.so: cannot open shared object file: No such file or directory - No such file or directory Fri Aug 19 17:43:59 2016 : Debug: Loading library using linker search path(s) Fri Aug 19 17:43:59 2016 : Debug: Defaults : /lib:/usr/lib Fri Aug 19 17:43:59 2016 : Debug: Failed with error: proto_acct.so: cannot open shared object file: No such file or directory Fri Aug 19 17:43:59 2016 : Debug: listen { Fri Aug 19 17:43:59 2016 : Debug: type = "acct" Fri Aug 19 17:43:59 2016 : Debug: ipv6addr = :: Fri Aug 19 17:43:59 2016 : Debug: port = 0 Fri Aug 19 17:43:59 2016 : Debug: limit { Fri Aug 19 17:43:59 2016 : Debug: max_connections = 16 Fri Aug 19 17:43:59 2016 : Debug: lifetime = 0 Fri Aug 19 17:43:59 2016 : Debug: idle_timeout = 30 Fri Aug 19 17:43:59 2016 : Debug: } Fri Aug 19 17:43:59 2016 : Debug: } Fri Aug 19 17:43:59 2016 : Debug: Listening on auth address 127.0.0.1 port 18120 bound to server inner-tunnel Fri Aug 19 17:43:59 2016 : Debug: Listening on auth address * port 1812 bound to server default Fri Aug 19 17:43:59 2016 : Debug: Listening on acct address * port 1813 bound to server default Fri Aug 19 17:43:59 2016 : Debug: Listening on auth address :: port 1812 bound to server default Fri Aug 19 17:43:59 2016 : Debug: Listening on acct address :: port 1813 bound to server default Fri Aug 19 17:43:59 2016 : Debug: Opened new proxy socket 'proxy address * port 38311' Fri Aug 19 17:43:59 2016 : Debug: Listening on proxy address * port 38311 Fri Aug 19 17:43:59 2016 : Debug: Opened new proxy socket 'proxy address :: port 42873' Fri Aug 19 17:43:59 2016 : Debug: Listening on proxy address :: port 42873 Fri Aug 19 17:43:59 2016 : Info: Ready to process requests
Hi. I am still far from any result. After spending another weekend in, I would truly appreciate any further guidance. Thanks for your patience and help. Any other logs I need to show? Matthew On Aug 19, 2016 5:51 PM, "Matthew Pulis" <mpulis@gmail.com> wrote:
Hi again Matt
I have taken your advice and upgraded to the stable 3.0 Freeradius. It is now: freeradius-server : 3.0.11
After going through the changes, I am still unable to do the VLAN part :( Now I am using the inbuilt filters.
This is what I have in sites-available/default under the post-auth section:
if (Ldap-Group == "cn=SeminaryAdmin,ou=SeminaryOU,dc=seminary,dc=local") { update reply { Tunnel-Type := "VLAN", Tunnel-Medium-Type := "802", Tunnel-Private-Group-ID := "12" } }
I tried also Ldap-Group == "SeminaryAdmin" but same result
Ldap searching:
radius@daloradius:/etc/freeradius/mods-enabled$ ldapsearch -h localhost -b "cn=ttester,cn=SeminaryAdmin,ou=SeminaryOU,dc=seminary,dc=local" -D "cn=admin,dc=seminary,dc=local" -w PASS # extended LDIF # # LDAPv3 # base <cn=ttester,cn=SeminaryAdmin,ou=SeminaryOU,dc=seminary,dc=local> with scope subtree # filter: (objectclass=*) # requesting: ALL #
# ttester, SeminaryAdmin, SeminaryOU, seminary.local dn: cn=ttester,cn=SeminaryAdmin,ou=SeminaryOU,dc=seminary,dc=local cn: ttester givenName: Tester gidNumber: 503 homeDirectory: /home/users/ttester sn: Tester objectClass: inetOrgPerson objectClass: posixAccount objectClass: top userPassword:: e1NTSEF9OElRMXFFa2hqTUpIUkpIMHZtN2FqdVJOY1NCdzl5cnA= uidNumber: 1002 uid: ttester description: Authenticated at 2016-08-19 17:15:38
# search result search: 2 result: 0 Success
# numResponses: 2 # numEntries: 1
radius@daloradius:/etc/freeradius/mods-enabled$ ldapsearch -h localhost -b dc=seminary,dc=local -s sub '(isMemberOf=cn=SeminaryAdmin, ou=seminaryOU,dc=seminary,dc=local)' -D "cn=admin,dc=seminary,dc=local" -w PASS -L version: 1
# # LDAPv3 # base <dc=seminary,dc=local> with scope subtree # filter: (isMemberOf=cn=SeminaryAdmin,ou=seminaryOU,dc=seminary,dc=local) # requesting: ALL #
# search result
# numResponses: 1
and ...
radius@daloradius:/etc/freeradius/mods-enabled$ ldapsearch -h localhost -b dc=seminary,dc=local -s sub '(cn=ttester)' memberOf -D "cn=admin,dc=seminary,dc=local" -w PASS # extended LDIF # # LDAPv3 # base <dc=seminary,dc=local> with scope subtree # filter: (cn=ttester) # requesting: memberOf #
# ttester, SeminaryAdmin, SeminaryOU, seminary.local dn: cn=ttester,cn=SeminaryAdmin,ou=SeminaryOU,dc=seminary,dc=local
# search result search: 2 result: 0 Success
# numResponses: 2 # numEntries: 1
The whole of the debug:
radius@daloradius:/etc/freeradius/mods-enabled$ sudo freeradius -XXX [sudo] password for radius: Fri Aug 19 17:43:59 2016 : Debug: Server was built with: Fri Aug 19 17:43:59 2016 : Debug: accounting : yes Fri Aug 19 17:43:59 2016 : Debug: authentication : yes Fri Aug 19 17:43:59 2016 : Debug: ascend-binary-attributes : yes Fri Aug 19 17:43:59 2016 : Debug: coa : yes Fri Aug 19 17:43:59 2016 : Debug: control-socket : yes Fri Aug 19 17:43:59 2016 : Debug: detail : yes Fri Aug 19 17:43:59 2016 : Debug: dhcp : yes Fri Aug 19 17:43:59 2016 : Debug: dynamic-clients : yes Fri Aug 19 17:43:59 2016 : Debug: osfc2 : no Fri Aug 19 17:43:59 2016 : Debug: proxy : yes Fri Aug 19 17:43:59 2016 : Debug: regex-pcre : no Fri Aug 19 17:43:59 2016 : Debug: regex-posix : yes Fri Aug 19 17:43:59 2016 : Debug: regex-posix-extended : yes Fri Aug 19 17:43:59 2016 : Debug: session-management : yes Fri Aug 19 17:43:59 2016 : Debug: stats : yes Fri Aug 19 17:43:59 2016 : Debug: tcp : yes Fri Aug 19 17:43:59 2016 : Debug: threads : yes Fri Aug 19 17:43:59 2016 : Debug: tls : yes Fri Aug 19 17:43:59 2016 : Debug: unlang : yes Fri Aug 19 17:43:59 2016 : Debug: vmps : yes Fri Aug 19 17:43:59 2016 : Debug: developer : no Fri Aug 19 17:43:59 2016 : Debug: Server core libs: Fri Aug 19 17:43:59 2016 : Debug: freeradius-server : 3.0.11 Fri Aug 19 17:43:59 2016 : Debug: talloc : 2.0.* Fri Aug 19 17:43:59 2016 : Debug: ssl : 1.0.2g release Fri Aug 19 17:43:59 2016 : Debug: Endianness: Fri Aug 19 17:43:59 2016 : Debug: little Fri Aug 19 17:43:59 2016 : Debug: Compilation flags: Fri Aug 19 17:43:59 2016 : Debug: cppflags : -Wdate-time -D_FORTIFY_SOURCE=2 Fri Aug 19 17:43:59 2016 : Debug: cflags : -I/build/freeradius-G88Mfz/freeradius-3.0.11 -I/build/freeradius-G88Mfz/freeradius-3.0.11/src -include /build/freeradius-G88Mfz/freeradius-3.0.11/src/freeradius-devel/autoconf.h -include /build/freeradius-G88Mfz/freeradius-3.0.11/src/freeradius-devel/build.h -include /build/freeradius-G88Mfz/freeradius-3.0.11/src/freeradius-devel/features.h -include /build/freeradius-G88Mfz/freeradius-3.0.11/src/freeradius-devel/radpaths.h -fno-strict-aliasing -g -O2 -fstack-protector-strong -Wformat -Werror=format-security -O2 -Wall -std=c99 -D_GNU_SOURCE -D_REENTRANT -D_POSIX_PTHREAD_SEMANTICS -DOPENSSL_NO_KRB5 -DNDEBUG -DIS_MODULE=1 Fri Aug 19 17:43:59 2016 : Debug: ldflags : -Wl,-Bsymbolic-functions -Wl,-z,relro Fri Aug 19 17:43:59 2016 : Debug: libs : -lcrypto -lssl -ltalloc -lcap -lnsl -lresolv -ldl -lpthread -lreadline Fri Aug 19 17:43:59 2016 : Debug: Fri Aug 19 17:43:59 2016 : Info: Copyright (C) 1999-2016 The FreeRADIUS server project and contributors Fri Aug 19 17:43:59 2016 : Info: There is NO warranty; not even for MERCHANTABILITY or FITNESS FOR A Fri Aug 19 17:43:59 2016 : Info: PARTICULAR PURPOSE Fri Aug 19 17:43:59 2016 : Info: You may redistribute copies of FreeRADIUS under the terms of the Fri Aug 19 17:43:59 2016 : Info: GNU General Public License Fri Aug 19 17:43:59 2016 : Info: For more information about these matters, see the file named COPYRIGHT Fri Aug 19 17:43:59 2016 : Info: Starting - reading configuration files ... Fri Aug 19 17:43:59 2016 : Debug: including dictionary file /usr/share/freeradius/dictionary Fri Aug 19 17:43:59 2016 : Debug: including dictionary file /usr/share/freeradius/dictionary.dhcp Fri Aug 19 17:43:59 2016 : Debug: including dictionary file /usr/share/freeradius/dictionary.vqp Fri Aug 19 17:43:59 2016 : Debug: including dictionary file /etc/freeradius/dictionary Fri Aug 19 17:43:59 2016 : Debug: including configuration file /etc/freeradius/radiusd.conf Fri Aug 19 17:43:59 2016 : Debug: including configuration file /etc/freeradius/proxy.conf Fri Aug 19 17:43:59 2016 : Debug: including configuration file /etc/freeradius/clients.conf Fri Aug 19 17:43:59 2016 : Debug: including files in directory /etc/freeradius/mods-enabled/ Fri Aug 19 17:43:59 2016 : Debug: including configuration file /etc/freeradius/mods-enabled/mschap Fri Aug 19 17:43:59 2016 : Debug: including configuration file /etc/freeradius/mods-enabled/always Fri Aug 19 17:43:59 2016 : Debug: including configuration file /etc/freeradius/mods-enabled/soh Fri Aug 19 17:43:59 2016 : Debug: including configuration file /etc/freeradius/mods-enabled/eap Fri Aug 19 17:43:59 2016 : Debug: including configuration file /etc/freeradius/mods-enabled/dynamic_clients Fri Aug 19 17:43:59 2016 : Debug: including configuration file /etc/freeradius/mods-enabled/logintime Fri Aug 19 17:43:59 2016 : Debug: including configuration file /etc/freeradius/mods-enabled/exec Fri Aug 19 17:43:59 2016 : Debug: including configuration file /etc/freeradius/mods-enabled/realm Fri Aug 19 17:43:59 2016 : Debug: including configuration file /etc/freeradius/mods-enabled/utf8 Fri Aug 19 17:43:59 2016 : Debug: including configuration file /etc/freeradius/mods-enabled/echo Fri Aug 19 17:43:59 2016 : Debug: including configuration file /etc/freeradius/mods-enabled/unix Fri Aug 19 17:43:59 2016 : Debug: including configuration file /etc/freeradius/mods-enabled/detail.log Fri Aug 19 17:43:59 2016 : Debug: including configuration file /etc/freeradius/mods-enabled/expr Fri Aug 19 17:43:59 2016 : Debug: including configuration file /etc/freeradius/mods-enabled/ntlm_auth Fri Aug 19 17:43:59 2016 : Debug: including configuration file /etc/freeradius/mods-enabled/pap Fri Aug 19 17:43:59 2016 : Debug: including configuration file /etc/freeradius/mods-enabled/ldap Fri Aug 19 17:43:59 2016 : Debug: including configuration file /etc/freeradius/mods-enabled/digest Fri Aug 19 17:43:59 2016 : Debug: including configuration file /etc/freeradius/mods-enabled/files Fri Aug 19 17:43:59 2016 : Debug: including configuration file /etc/freeradius/mods-enabled/preprocess Fri Aug 19 17:43:59 2016 : Debug: including configuration file /etc/freeradius/mods-enabled/cache_eap Fri Aug 19 17:43:59 2016 : Debug: including configuration file /etc/freeradius/mods-enabled/detail Fri Aug 19 17:43:59 2016 : Debug: including configuration file /etc/freeradius/mods-enabled/expiration Fri Aug 19 17:43:59 2016 : Debug: including configuration file /etc/freeradius/mods-enabled/chap Fri Aug 19 17:43:59 2016 : Debug: including configuration file /etc/freeradius/mods-enabled/sradutmp Fri Aug 19 17:43:59 2016 : Debug: including configuration file /etc/freeradius/mods-enabled/radutmp Fri Aug 19 17:43:59 2016 : Debug: including configuration file /etc/freeradius/mods-enabled/passwd Fri Aug 19 17:43:59 2016 : Debug: including configuration file /etc/freeradius/mods-enabled/linelog Fri Aug 19 17:43:59 2016 : Debug: including configuration file /etc/freeradius/mods-enabled/unpack Fri Aug 19 17:43:59 2016 : Debug: including configuration file /etc/freeradius/mods-enabled/attr_filter Fri Aug 19 17:43:59 2016 : Debug: including configuration file /etc/freeradius/mods-enabled/replicate Fri Aug 19 17:43:59 2016 : Debug: including files in directory /etc/freeradius/policy.d/ Fri Aug 19 17:43:59 2016 : Debug: including configuration file /etc/freeradius/policy.d/filter Fri Aug 19 17:43:59 2016 : Debug: including configuration file /etc/freeradius/policy.d/control Fri Aug 19 17:43:59 2016 : Debug: including configuration file /etc/freeradius/policy.d/canonicalization Fri Aug 19 17:43:59 2016 : Debug: including configuration file /etc/freeradius/policy.d/eap Fri Aug 19 17:43:59 2016 : Debug: including configuration file /etc/freeradius/policy.d/debug Fri Aug 19 17:43:59 2016 : Debug: including configuration file /etc/freeradius/policy.d/dhcp Fri Aug 19 17:43:59 2016 : Debug: including configuration file /etc/freeradius/policy.d/accounting Fri Aug 19 17:43:59 2016 : Debug: including configuration file /etc/freeradius/policy.d/abfab-tr Fri Aug 19 17:43:59 2016 : Debug: including configuration file /etc/freeradius/policy.d/cui Fri Aug 19 17:43:59 2016 : Debug: OPTIMIZING (${policy.cui_require_operator_name} == yes) --> FALSE Fri Aug 19 17:43:59 2016 : Debug: OPTIMIZING (no == yes) --> FALSE Fri Aug 19 17:43:59 2016 : Debug: OPTIMIZING (${policy.cui_require_operator_name} == yes) --> FALSE Fri Aug 19 17:43:59 2016 : Debug: OPTIMIZING (no == yes) --> FALSE Fri Aug 19 17:43:59 2016 : Debug: including configuration file /etc/freeradius/policy.d/operator-name Fri Aug 19 17:43:59 2016 : Debug: including files in directory /etc/freeradius/sites-enabled/ Fri Aug 19 17:43:59 2016 : Debug: including configuration file /etc/freeradius/sites-enabled/inner-tunnel Fri Aug 19 17:43:59 2016 : Debug: including configuration file /etc/freeradius/sites-enabled/default Fri Aug 19 17:43:59 2016 : Debug: main { Fri Aug 19 17:43:59 2016 : Debug: security { Fri Aug 19 17:43:59 2016 : Debug: user = "freerad" Fri Aug 19 17:43:59 2016 : Debug: group = "freerad" Fri Aug 19 17:43:59 2016 : Debug: allow_core_dumps = no Fri Aug 19 17:43:59 2016 : Warning: /etc/freeradius/radiusd.conf[462]: The item 'max_attributes' is defined, but is unused by the configuration Fri Aug 19 17:43:59 2016 : Warning: /etc/freeradius/radiusd.conf[480]: The item 'reject_delay' is defined, but is unused by the configuration Fri Aug 19 17:43:59 2016 : Warning: /etc/freeradius/radiusd.conf[500]: The item 'status_server' is defined, but is unused by the configuration Fri Aug 19 17:43:59 2016 : Debug: } Fri Aug 19 17:43:59 2016 : Debug: name = "freeradius" Fri Aug 19 17:43:59 2016 : Debug: prefix = "/usr" Fri Aug 19 17:43:59 2016 : Debug: localstatedir = "/var" Fri Aug 19 17:43:59 2016 : Debug: logdir = "/var/log/freeradius" Fri Aug 19 17:43:59 2016 : Debug: run_dir = "/var/run/freeradius" Fri Aug 19 17:43:59 2016 : Warning: /etc/freeradius/radiusd.conf[55]: The item 'sysconfdir' is defined, but is unused by the configuration Fri Aug 19 17:43:59 2016 : Warning: /etc/freeradius/radiusd.conf[67]: The item 'confdir' is defined, but is unused by the configuration Fri Aug 19 17:43:59 2016 : Warning: /etc/freeradius/radiusd.conf[74]: The item 'db_dir' is defined, but is unused by the configuration Fri Aug 19 17:43:59 2016 : Warning: /etc/freeradius/radiusd.conf[108]: The item 'libdir' is defined, but is unused by the configuration Fri Aug 19 17:43:59 2016 : Warning: /etc/freeradius/radiusd.conf[119]: The item 'pidfile' is defined, but is unused by the configuration Fri Aug 19 17:43:59 2016 : Warning: /etc/freeradius/radiusd.conf[140]: The item 'correct_escapes' is defined, but is unused by the configuration Fri Aug 19 17:43:59 2016 : Warning: /etc/freeradius/radiusd.conf[194]: The item 'max_request_time' is defined, but is unused by the configuration Fri Aug 19 17:43:59 2016 : Warning: /etc/freeradius/radiusd.conf[213]: The item 'cleanup_delay' is defined, but is unused by the configuration Fri Aug 19 17:43:59 2016 : Warning: /etc/freeradius/radiusd.conf[250]: The item 'hostname_lookups' is defined, but is unused by the configuration Fri Aug 19 17:43:59 2016 : Warning: /etc/freeradius/radiusd.conf[372]: The item 'checkrad' is defined, but is unused by the configuration Fri Aug 19 17:43:59 2016 : Warning: /etc/freeradius/radiusd.conf[521]: The item 'proxy_requests' is defined, but is unused by the configuration Fri Aug 19 17:43:59 2016 : Debug: } Fri Aug 19 17:43:59 2016 : Debug: main { Fri Aug 19 17:43:59 2016 : Debug: name = "freeradius" Fri Aug 19 17:43:59 2016 : Debug: prefix = "/usr" Fri Aug 19 17:43:59 2016 : Debug: localstatedir = "/var" Fri Aug 19 17:43:59 2016 : Debug: sbindir = "/usr/sbin" Fri Aug 19 17:43:59 2016 : Debug: logdir = "/var/log/freeradius" Fri Aug 19 17:43:59 2016 : Debug: run_dir = "/var/run/freeradius" Fri Aug 19 17:43:59 2016 : Debug: libdir = "/usr/lib/freeradius" Fri Aug 19 17:43:59 2016 : Debug: radacctdir = "/var/log/freeradius/radacct" Fri Aug 19 17:43:59 2016 : Debug: hostname_lookups = no Fri Aug 19 17:43:59 2016 : Debug: max_request_time = 30 Fri Aug 19 17:43:59 2016 : Debug: cleanup_delay = 5 Fri Aug 19 17:43:59 2016 : Debug: max_requests = 16384 Fri Aug 19 17:43:59 2016 : Debug: pidfile = "/var/run/freeradius/freeradius.pid" Fri Aug 19 17:43:59 2016 : Debug: checkrad = "/usr/sbin/checkrad" Fri Aug 19 17:43:59 2016 : Debug: debug_level = 0 Fri Aug 19 17:43:59 2016 : Debug: proxy_requests = yes Fri Aug 19 17:43:59 2016 : Debug: log { Fri Aug 19 17:43:59 2016 : Debug: stripped_names = no Fri Aug 19 17:43:59 2016 : Debug: auth = no Fri Aug 19 17:43:59 2016 : Debug: auth_badpass = no Fri Aug 19 17:43:59 2016 : Debug: auth_goodpass = no Fri Aug 19 17:43:59 2016 : Debug: colourise = yes Fri Aug 19 17:43:59 2016 : Debug: msg_denied = "You are already logged in - access denied" Fri Aug 19 17:43:59 2016 : Warning: /etc/freeradius/radiusd.conf[268]: The item 'destination' is defined, but is unused by the configuration Fri Aug 19 17:43:59 2016 : Warning: /etc/freeradius/radiusd.conf[285]: The item 'file' is defined, but is unused by the configuration Fri Aug 19 17:43:59 2016 : Warning: /etc/freeradius/radiusd.conf[331]: The item 'syslog_facility' is defined, but is unused by the configuration Fri Aug 19 17:43:59 2016 : Debug: } Fri Aug 19 17:43:59 2016 : Debug: resources { Fri Aug 19 17:43:59 2016 : Debug: } Fri Aug 19 17:43:59 2016 : Debug: security { Fri Aug 19 17:43:59 2016 : Debug: max_attributes = 200 Fri Aug 19 17:43:59 2016 : Debug: reject_delay = 1.000000 Fri Aug 19 17:43:59 2016 : Debug: status_server = yes Fri Aug 19 17:43:59 2016 : Debug: } Fri Aug 19 17:43:59 2016 : Warning: /etc/freeradius/radiusd.conf[55]: The item 'sysconfdir' is defined, but is unused by the configuration Fri Aug 19 17:43:59 2016 : Warning: /etc/freeradius/radiusd.conf[67]: The item 'confdir' is defined, but is unused by the configuration Fri Aug 19 17:43:59 2016 : Warning: /etc/freeradius/radiusd.conf[74]: The item 'db_dir' is defined, but is unused by the configuration Fri Aug 19 17:43:59 2016 : Warning: /etc/freeradius/radiusd.conf[140]: The item 'correct_escapes' is defined, but is unused by the configuration Fri Aug 19 17:43:59 2016 : Debug: } Fri Aug 19 17:43:59 2016 : Debug: radiusd: #### Loading Realms and Home Servers #### Fri Aug 19 17:43:59 2016 : Debug: proxy server { Fri Aug 19 17:43:59 2016 : Debug: retry_delay = 5 Fri Aug 19 17:43:59 2016 : Debug: retry_count = 3 Fri Aug 19 17:43:59 2016 : Debug: default_fallback = no Fri Aug 19 17:43:59 2016 : Debug: dead_time = 120 Fri Aug 19 17:43:59 2016 : Debug: wake_all_if_all_dead = no Fri Aug 19 17:43:59 2016 : Debug: } Fri Aug 19 17:43:59 2016 : Debug: home_server localhost { Fri Aug 19 17:43:59 2016 : Debug: ipaddr = 127.0.0.1 Fri Aug 19 17:43:59 2016 : Debug: port = 1812 Fri Aug 19 17:43:59 2016 : Debug: type = "auth" Fri Aug 19 17:43:59 2016 : Debug: secret = "testing123" Fri Aug 19 17:43:59 2016 : Debug: response_window = 20.000000 Fri Aug 19 17:43:59 2016 : Debug: response_timeouts = 1 Fri Aug 19 17:43:59 2016 : Debug: max_outstanding = 65536 Fri Aug 19 17:43:59 2016 : Debug: zombie_period = 40 Fri Aug 19 17:43:59 2016 : Debug: status_check = "status-server" Fri Aug 19 17:43:59 2016 : Debug: ping_interval = 30 Fri Aug 19 17:43:59 2016 : Debug: check_interval = 30 Fri Aug 19 17:43:59 2016 : Debug: check_timeout = 4 Fri Aug 19 17:43:59 2016 : Debug: num_answers_to_alive = 3 Fri Aug 19 17:43:59 2016 : Debug: revive_interval = 120 Fri Aug 19 17:43:59 2016 : Debug: limit { Fri Aug 19 17:43:59 2016 : Debug: max_connections = 16 Fri Aug 19 17:43:59 2016 : Debug: max_requests = 0 Fri Aug 19 17:43:59 2016 : Debug: lifetime = 0 Fri Aug 19 17:43:59 2016 : Debug: idle_timeout = 0 Fri Aug 19 17:43:59 2016 : Debug: } Fri Aug 19 17:43:59 2016 : Debug: coa { Fri Aug 19 17:43:59 2016 : Debug: irt = 2 Fri Aug 19 17:43:59 2016 : Debug: mrt = 16 Fri Aug 19 17:43:59 2016 : Debug: mrc = 5 Fri Aug 19 17:43:59 2016 : Debug: mrd = 30 Fri Aug 19 17:43:59 2016 : Debug: } Fri Aug 19 17:43:59 2016 : Debug: } Fri Aug 19 17:43:59 2016 : Debug: home_server_pool my_auth_failover { Fri Aug 19 17:43:59 2016 : Debug: type = fail-over Fri Aug 19 17:43:59 2016 : Debug: home_server = localhost Fri Aug 19 17:43:59 2016 : Debug: } Fri Aug 19 17:43:59 2016 : Debug: realm example.com { Fri Aug 19 17:43:59 2016 : Debug: auth_pool = my_auth_failover Fri Aug 19 17:43:59 2016 : Debug: } Fri Aug 19 17:43:59 2016 : Debug: realm LOCAL { Fri Aug 19 17:43:59 2016 : Debug: } Fri Aug 19 17:43:59 2016 : Debug: radiusd: #### Loading Clients #### Fri Aug 19 17:43:59 2016 : Debug: client localhost { Fri Aug 19 17:43:59 2016 : Debug: ipaddr = 127.0.0.1 Fri Aug 19 17:43:59 2016 : Debug: require_message_authenticator = no Fri Aug 19 17:43:59 2016 : Debug: secret = "testing456" Fri Aug 19 17:43:59 2016 : Debug: nas_type = "other" Fri Aug 19 17:43:59 2016 : Debug: proto = "*" Fri Aug 19 17:43:59 2016 : Debug: limit { Fri Aug 19 17:43:59 2016 : Debug: max_connections = 16 Fri Aug 19 17:43:59 2016 : Debug: lifetime = 0 Fri Aug 19 17:43:59 2016 : Debug: idle_timeout = 30 Fri Aug 19 17:43:59 2016 : Debug: } Fri Aug 19 17:43:59 2016 : Debug: } Fri Aug 19 17:43:59 2016 : Debug: Adding client 127.0.0.1/32 (127.0.0.1) to prefix tree 32 Fri Aug 19 17:43:59 2016 : Debug: client localhost_ipv6 { Fri Aug 19 17:43:59 2016 : Debug: ipv6addr = ::1 Fri Aug 19 17:43:59 2016 : Debug: require_message_authenticator = no Fri Aug 19 17:43:59 2016 : Debug: secret = "testing123" Fri Aug 19 17:43:59 2016 : Debug: limit { Fri Aug 19 17:43:59 2016 : Debug: max_connections = 16 Fri Aug 19 17:43:59 2016 : Debug: lifetime = 0 Fri Aug 19 17:43:59 2016 : Debug: idle_timeout = 30 Fri Aug 19 17:43:59 2016 : Debug: } Fri Aug 19 17:43:59 2016 : Debug: } Fri Aug 19 17:43:59 2016 : Debug: Adding client ::1/128 (::1) to prefix tree 128 Fri Aug 19 17:43:59 2016 : Debug: client 192.168.100.0/24 { Fri Aug 19 17:43:59 2016 : Debug: require_message_authenticator = no Fri Aug 19 17:43:59 2016 : Debug: secret = "testing456" Fri Aug 19 17:43:59 2016 : Debug: shortname = "NAS" Fri Aug 19 17:43:59 2016 : Debug: limit { Fri Aug 19 17:43:59 2016 : Debug: max_connections = 16 Fri Aug 19 17:43:59 2016 : Debug: lifetime = 0 Fri Aug 19 17:43:59 2016 : Debug: idle_timeout = 30 Fri Aug 19 17:43:59 2016 : Debug: } Fri Aug 19 17:43:59 2016 : Debug: } Fri Aug 19 17:43:59 2016 : Warning: No 'ipaddr' or 'ipv4addr' or 'ipv6addr' field found in client 192.168.100.0/24. Please fix your configuration Fri Aug 19 17:43:59 2016 : Warning: Support for old-style clients will be removed in a future release Fri Aug 19 17:43:59 2016 : Debug: Adding client 192.168.100.0/24 (192.168.100.0/24) to prefix tree 24 Fri Aug 19 17:43:59 2016 : Info: Debugger not attached Fri Aug 19 17:43:59 2016 : Debug: # Creating Auth-Type = PAP Fri Aug 19 17:43:59 2016 : Debug: # Creating Auth-Type = CHAP Fri Aug 19 17:43:59 2016 : Debug: # Creating Auth-Type = MS-CHAP Fri Aug 19 17:43:59 2016 : Debug: # Creating Auth-Type = eap Fri Aug 19 17:43:59 2016 : Debug: # Creating Auth-Type = digest Fri Aug 19 17:43:59 2016 : Debug: radiusd: #### Instantiating modules #### Fri Aug 19 17:43:59 2016 : Debug: modules { Fri Aug 19 17:43:59 2016 : Debug: Loading rlm_mschap with path: /usr/lib/freeradius/rlm_mschap.so Fri Aug 19 17:43:59 2016 : Debug: Loaded rlm_mschap, checking if it's valid Fri Aug 19 17:43:59 2016 : Debug: # Loaded module rlm_mschap Fri Aug 19 17:43:59 2016 : Debug: # Loading module "mschap" from file /etc/freeradius/mods-enabled/mschap Fri Aug 19 17:43:59 2016 : Debug: mschap { Fri Aug 19 17:43:59 2016 : Debug: use_mppe = yes Fri Aug 19 17:43:59 2016 : Debug: require_encryption = no Fri Aug 19 17:43:59 2016 : Debug: require_strong = no Fri Aug 19 17:43:59 2016 : Debug: with_ntdomain_hack = yes Fri Aug 19 17:43:59 2016 : Debug: passchange { Fri Aug 19 17:43:59 2016 : Debug: } Fri Aug 19 17:43:59 2016 : Debug: allow_retry = yes Fri Aug 19 17:43:59 2016 : Debug: } Fri Aug 19 17:43:59 2016 : Debug: Loading rlm_always with path: /usr/lib/freeradius/rlm_always.so Fri Aug 19 17:43:59 2016 : Debug: Loaded rlm_always, checking if it's valid Fri Aug 19 17:43:59 2016 : Debug: # Loaded module rlm_always Fri Aug 19 17:43:59 2016 : Debug: # Loading module "reject" from file /etc/freeradius/mods-enabled/always Fri Aug 19 17:43:59 2016 : Debug: always reject { Fri Aug 19 17:43:59 2016 : Debug: rcode = "reject" Fri Aug 19 17:43:59 2016 : Debug: simulcount = 0 Fri Aug 19 17:43:59 2016 : Debug: mpp = no Fri Aug 19 17:43:59 2016 : Debug: } Fri Aug 19 17:43:59 2016 : Debug: # Loading module "fail" from file /etc/freeradius/mods-enabled/always Fri Aug 19 17:43:59 2016 : Debug: always fail { Fri Aug 19 17:43:59 2016 : Debug: rcode = "fail" Fri Aug 19 17:43:59 2016 : Debug: simulcount = 0 Fri Aug 19 17:43:59 2016 : Debug: mpp = no Fri Aug 19 17:43:59 2016 : Debug: } Fri Aug 19 17:43:59 2016 : Debug: # Loading module "ok" from file /etc/freeradius/mods-enabled/always Fri Aug 19 17:43:59 2016 : Debug: always ok { Fri Aug 19 17:43:59 2016 : Debug: rcode = "ok" Fri Aug 19 17:43:59 2016 : Debug: simulcount = 0 Fri Aug 19 17:43:59 2016 : Debug: mpp = no Fri Aug 19 17:43:59 2016 : Debug: } Fri Aug 19 17:43:59 2016 : Debug: # Loading module "handled" from file /etc/freeradius/mods-enabled/always Fri Aug 19 17:43:59 2016 : Debug: always handled { Fri Aug 19 17:43:59 2016 : Debug: rcode = "handled" Fri Aug 19 17:43:59 2016 : Debug: simulcount = 0 Fri Aug 19 17:43:59 2016 : Debug: mpp = no Fri Aug 19 17:43:59 2016 : Debug: } Fri Aug 19 17:43:59 2016 : Debug: # Loading module "invalid" from file /etc/freeradius/mods-enabled/always Fri Aug 19 17:43:59 2016 : Debug: always invalid { Fri Aug 19 17:43:59 2016 : Debug: rcode = "invalid" Fri Aug 19 17:43:59 2016 : Debug: simulcount = 0 Fri Aug 19 17:43:59 2016 : Debug: mpp = no Fri Aug 19 17:43:59 2016 : Debug: } Fri Aug 19 17:43:59 2016 : Debug: # Loading module "userlock" from file /etc/freeradius/mods-enabled/always Fri Aug 19 17:43:59 2016 : Debug: always userlock { Fri Aug 19 17:43:59 2016 : Debug: rcode = "userlock" Fri Aug 19 17:43:59 2016 : Debug: simulcount = 0 Fri Aug 19 17:43:59 2016 : Debug: mpp = no Fri Aug 19 17:43:59 2016 : Debug: } Fri Aug 19 17:43:59 2016 : Debug: # Loading module "notfound" from file /etc/freeradius/mods-enabled/always Fri Aug 19 17:43:59 2016 : Debug: always notfound { Fri Aug 19 17:43:59 2016 : Debug: rcode = "notfound" Fri Aug 19 17:43:59 2016 : Debug: simulcount = 0 Fri Aug 19 17:43:59 2016 : Debug: mpp = no Fri Aug 19 17:43:59 2016 : Debug: } Fri Aug 19 17:43:59 2016 : Debug: # Loading module "noop" from file /etc/freeradius/mods-enabled/always Fri Aug 19 17:43:59 2016 : Debug: always noop { Fri Aug 19 17:43:59 2016 : Debug: rcode = "noop" Fri Aug 19 17:43:59 2016 : Debug: simulcount = 0 Fri Aug 19 17:43:59 2016 : Debug: mpp = no Fri Aug 19 17:43:59 2016 : Debug: } Fri Aug 19 17:43:59 2016 : Debug: # Loading module "updated" from file /etc/freeradius/mods-enabled/always Fri Aug 19 17:43:59 2016 : Debug: always updated { Fri Aug 19 17:43:59 2016 : Debug: rcode = "updated" Fri Aug 19 17:43:59 2016 : Debug: simulcount = 0 Fri Aug 19 17:43:59 2016 : Debug: mpp = no Fri Aug 19 17:43:59 2016 : Debug: } Fri Aug 19 17:43:59 2016 : Debug: Loading rlm_soh with path: /usr/lib/freeradius/rlm_soh.so Fri Aug 19 17:43:59 2016 : Debug: Loaded rlm_soh, checking if it's valid Fri Aug 19 17:43:59 2016 : Debug: # Loaded module rlm_soh Fri Aug 19 17:43:59 2016 : Debug: # Loading module "soh" from file /etc/freeradius/mods-enabled/soh Fri Aug 19 17:43:59 2016 : Debug: soh { Fri Aug 19 17:43:59 2016 : Debug: dhcp = yes Fri Aug 19 17:43:59 2016 : Debug: } Fri Aug 19 17:43:59 2016 : Debug: Loading rlm_eap with path: /usr/lib/freeradius/rlm_eap.so Fri Aug 19 17:43:59 2016 : Debug: Loaded rlm_eap, checking if it's valid Fri Aug 19 17:43:59 2016 : Debug: # Loaded module rlm_eap Fri Aug 19 17:43:59 2016 : Debug: # Loading module "eap" from file /etc/freeradius/mods-enabled/eap Fri Aug 19 17:43:59 2016 : Debug: eap { Fri Aug 19 17:43:59 2016 : Debug: default_eap_type = "md5" Fri Aug 19 17:43:59 2016 : Debug: timer_expire = 60 Fri Aug 19 17:43:59 2016 : Debug: ignore_unknown_eap_types = no Fri Aug 19 17:43:59 2016 : Debug: cisco_accounting_username_bug = no Fri Aug 19 17:43:59 2016 : Debug: max_sessions = 16384 Fri Aug 19 17:43:59 2016 : Debug: } Fri Aug 19 17:43:59 2016 : Debug: Loading rlm_dynamic_clients with path: /usr/lib/freeradius/rlm_dynamic_clients.so Fri Aug 19 17:43:59 2016 : Debug: Loaded rlm_dynamic_clients, checking if it's valid Fri Aug 19 17:43:59 2016 : Debug: # Loaded module rlm_dynamic_clients Fri Aug 19 17:43:59 2016 : Debug: # Loading module "dynamic_clients" from file /etc/freeradius/mods-enabled/dynamic_clients Fri Aug 19 17:43:59 2016 : Debug: Loading rlm_logintime with path: /usr/lib/freeradius/rlm_logintime.so Fri Aug 19 17:43:59 2016 : Debug: Loaded rlm_logintime, checking if it's valid Fri Aug 19 17:43:59 2016 : Debug: # Loaded module rlm_logintime Fri Aug 19 17:43:59 2016 : Debug: # Loading module "logintime" from file /etc/freeradius/mods-enabled/logintime Fri Aug 19 17:43:59 2016 : Debug: logintime { Fri Aug 19 17:43:59 2016 : Debug: minimum_timeout = 60 Fri Aug 19 17:43:59 2016 : Debug: } Fri Aug 19 17:43:59 2016 : Debug: Loading rlm_exec with path: /usr/lib/freeradius/rlm_exec.so Fri Aug 19 17:43:59 2016 : Debug: Loaded rlm_exec, checking if it's valid Fri Aug 19 17:43:59 2016 : Debug: # Loaded module rlm_exec Fri Aug 19 17:43:59 2016 : Debug: # Loading module "exec" from file /etc/freeradius/mods-enabled/exec Fri Aug 19 17:43:59 2016 : Debug: exec { Fri Aug 19 17:43:59 2016 : Debug: wait = no Fri Aug 19 17:43:59 2016 : Debug: input_pairs = "request" Fri Aug 19 17:43:59 2016 : Debug: shell_escape = yes Fri Aug 19 17:43:59 2016 : Debug: timeout = 10 Fri Aug 19 17:43:59 2016 : Debug: } Fri Aug 19 17:43:59 2016 : Debug: Loading rlm_realm with path: /usr/lib/freeradius/rlm_realm.so Fri Aug 19 17:43:59 2016 : Debug: Loaded rlm_realm, checking if it's valid Fri Aug 19 17:43:59 2016 : Debug: # Loaded module rlm_realm Fri Aug 19 17:43:59 2016 : Debug: # Loading module "IPASS" from file /etc/freeradius/mods-enabled/realm Fri Aug 19 17:43:59 2016 : Debug: realm IPASS { Fri Aug 19 17:43:59 2016 : Debug: format = "prefix" Fri Aug 19 17:43:59 2016 : Debug: delimiter = "/" Fri Aug 19 17:43:59 2016 : Debug: ignore_default = no Fri Aug 19 17:43:59 2016 : Debug: ignore_null = no Fri Aug 19 17:43:59 2016 : Debug: } Fri Aug 19 17:43:59 2016 : Debug: # Loading module "suffix" from file /etc/freeradius/mods-enabled/realm Fri Aug 19 17:43:59 2016 : Debug: realm suffix { Fri Aug 19 17:43:59 2016 : Debug: format = "suffix" Fri Aug 19 17:43:59 2016 : Debug: delimiter = "@" Fri Aug 19 17:43:59 2016 : Debug: ignore_default = no Fri Aug 19 17:43:59 2016 : Debug: ignore_null = no Fri Aug 19 17:43:59 2016 : Debug: } Fri Aug 19 17:43:59 2016 : Debug: # Loading module "realmpercent" from file /etc/freeradius/mods-enabled/realm Fri Aug 19 17:43:59 2016 : Debug: realm realmpercent { Fri Aug 19 17:43:59 2016 : Debug: format = "suffix" Fri Aug 19 17:43:59 2016 : Debug: delimiter = "%" Fri Aug 19 17:43:59 2016 : Debug: ignore_default = no Fri Aug 19 17:43:59 2016 : Debug: ignore_null = no Fri Aug 19 17:43:59 2016 : Debug: } Fri Aug 19 17:43:59 2016 : Debug: # Loading module "ntdomain" from file /etc/freeradius/mods-enabled/realm Fri Aug 19 17:43:59 2016 : Debug: realm ntdomain { Fri Aug 19 17:43:59 2016 : Debug: format = "prefix" Fri Aug 19 17:43:59 2016 : Debug: delimiter = "\\" Fri Aug 19 17:43:59 2016 : Debug: ignore_default = no Fri Aug 19 17:43:59 2016 : Debug: ignore_null = no Fri Aug 19 17:43:59 2016 : Debug: } Fri Aug 19 17:43:59 2016 : Debug: Loading rlm_utf8 with path: /usr/lib/freeradius/rlm_utf8.so Fri Aug 19 17:43:59 2016 : Debug: Loaded rlm_utf8, checking if it's valid Fri Aug 19 17:43:59 2016 : Debug: # Loaded module rlm_utf8 Fri Aug 19 17:43:59 2016 : Debug: # Loading module "utf8" from file /etc/freeradius/mods-enabled/utf8 Fri Aug 19 17:43:59 2016 : Debug: # Loading module "echo" from file /etc/freeradius/mods-enabled/echo Fri Aug 19 17:43:59 2016 : Debug: exec echo { Fri Aug 19 17:43:59 2016 : Debug: wait = yes Fri Aug 19 17:43:59 2016 : Debug: program = "/bin/echo %{User-Name}" Fri Aug 19 17:43:59 2016 : Debug: input_pairs = "request" Fri Aug 19 17:43:59 2016 : Debug: output_pairs = "reply" Fri Aug 19 17:43:59 2016 : Debug: shell_escape = yes Fri Aug 19 17:43:59 2016 : Debug: } Fri Aug 19 17:43:59 2016 : Debug: Loading rlm_unix with path: /usr/lib/freeradius/rlm_unix.so Fri Aug 19 17:43:59 2016 : Debug: Loaded rlm_unix, checking if it's valid Fri Aug 19 17:43:59 2016 : Debug: # Loaded module rlm_unix Fri Aug 19 17:43:59 2016 : Debug: # Loading module "unix" from file /etc/freeradius/mods-enabled/unix Fri Aug 19 17:43:59 2016 : Debug: unix { Fri Aug 19 17:43:59 2016 : Debug: radwtmp = "/var/log/freeradius/radwtmp" Fri Aug 19 17:43:59 2016 : Debug: } Fri Aug 19 17:43:59 2016 : Debug: Creating attribute Unix-Group Fri Aug 19 17:43:59 2016 : Debug: Loading rlm_detail with path: /usr/lib/freeradius/rlm_detail.so Fri Aug 19 17:43:59 2016 : Debug: Loaded rlm_detail, checking if it's valid Fri Aug 19 17:43:59 2016 : Debug: # Loaded module rlm_detail Fri Aug 19 17:43:59 2016 : Debug: # Loading module "auth_log" from file /etc/freeradius/mods-enabled/detail.log Fri Aug 19 17:43:59 2016 : Debug: detail auth_log { Fri Aug 19 17:43:59 2016 : Debug: filename = "/var/log/freeradius/radacct/%{%{Packet-Src-IP-Address}:-%{ Packet-Src-IPv6-Address}}/auth-detail-%Y%m%d" Fri Aug 19 17:43:59 2016 : Debug: header = "%t" Fri Aug 19 17:43:59 2016 : Debug: permissions = 384 Fri Aug 19 17:43:59 2016 : Debug: locking = no Fri Aug 19 17:43:59 2016 : Debug: escape_filenames = no Fri Aug 19 17:43:59 2016 : Debug: log_packet_header = no Fri Aug 19 17:43:59 2016 : Debug: } Fri Aug 19 17:43:59 2016 : Debug: # Loading module "reply_log" from file /etc/freeradius/mods-enabled/detail.log Fri Aug 19 17:43:59 2016 : Debug: detail reply_log { Fri Aug 19 17:43:59 2016 : Debug: filename = "/var/log/freeradius/radacct/%{%{Packet-Src-IP-Address}:-%{ Packet-Src-IPv6-Address}}/reply-detail-%Y%m%d" Fri Aug 19 17:43:59 2016 : Debug: header = "%t" Fri Aug 19 17:43:59 2016 : Debug: permissions = 384 Fri Aug 19 17:43:59 2016 : Debug: locking = no Fri Aug 19 17:43:59 2016 : Debug: escape_filenames = no Fri Aug 19 17:43:59 2016 : Debug: log_packet_header = no Fri Aug 19 17:43:59 2016 : Debug: } Fri Aug 19 17:43:59 2016 : Debug: # Loading module "pre_proxy_log" from file /etc/freeradius/mods-enabled/detail.log Fri Aug 19 17:43:59 2016 : Debug: detail pre_proxy_log { Fri Aug 19 17:43:59 2016 : Debug: filename = "/var/log/freeradius/radacct/%{%{Packet-Src-IP-Address}:-%{ Packet-Src-IPv6-Address}}/pre-proxy-detail-%Y%m%d" Fri Aug 19 17:43:59 2016 : Debug: header = "%t" Fri Aug 19 17:43:59 2016 : Debug: permissions = 384 Fri Aug 19 17:43:59 2016 : Debug: locking = no Fri Aug 19 17:43:59 2016 : Debug: escape_filenames = no Fri Aug 19 17:43:59 2016 : Debug: log_packet_header = no Fri Aug 19 17:43:59 2016 : Debug: } Fri Aug 19 17:43:59 2016 : Debug: # Loading module "post_proxy_log" from file /etc/freeradius/mods-enabled/detail.log Fri Aug 19 17:43:59 2016 : Debug: detail post_proxy_log { Fri Aug 19 17:43:59 2016 : Debug: filename = "/var/log/freeradius/radacct/%{%{Packet-Src-IP-Address}:-%{ Packet-Src-IPv6-Address}}/post-proxy-detail-%Y%m%d" Fri Aug 19 17:43:59 2016 : Debug: header = "%t" Fri Aug 19 17:43:59 2016 : Debug: permissions = 384 Fri Aug 19 17:43:59 2016 : Debug: locking = no Fri Aug 19 17:43:59 2016 : Debug: escape_filenames = no Fri Aug 19 17:43:59 2016 : Debug: log_packet_header = no Fri Aug 19 17:43:59 2016 : Debug: } Fri Aug 19 17:43:59 2016 : Debug: Loading rlm_expr with path: /usr/lib/freeradius/rlm_expr.so Fri Aug 19 17:43:59 2016 : Debug: Loaded rlm_expr, checking if it's valid Fri Aug 19 17:43:59 2016 : Debug: # Loaded module rlm_expr Fri Aug 19 17:43:59 2016 : Debug: # Loading module "expr" from file /etc/freeradius/mods-enabled/expr Fri Aug 19 17:43:59 2016 : Debug: expr { Fri Aug 19 17:43:59 2016 : Debug: safe_characters = "@ abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ0123456789.-_: / äéöüàâæçèéêëîïôœùûüaÿÄÉÖÜßÀÂÆÇÈÉÊËÎÏÔŒÙÛÜŸ" Fri Aug 19 17:43:59 2016 : Debug: } Fri Aug 19 17:43:59 2016 : Debug: # Loading module "ntlm_auth" from file /etc/freeradius/mods-enabled/ntlm_auth Fri Aug 19 17:43:59 2016 : Debug: exec ntlm_auth { Fri Aug 19 17:43:59 2016 : Debug: wait = yes Fri Aug 19 17:43:59 2016 : Debug: program = "/path/to/ntlm_auth --request-nt-key --domain=MYDOMAIN --username=%{mschap:User-Name} --password=%{User-Password}" Fri Aug 19 17:43:59 2016 : Debug: shell_escape = yes Fri Aug 19 17:43:59 2016 : Debug: } Fri Aug 19 17:43:59 2016 : Debug: Loading rlm_pap with path: /usr/lib/freeradius/rlm_pap.so Fri Aug 19 17:43:59 2016 : Debug: Loaded rlm_pap, checking if it's valid Fri Aug 19 17:43:59 2016 : Debug: # Loaded module rlm_pap Fri Aug 19 17:43:59 2016 : Debug: # Loading module "pap" from file /etc/freeradius/mods-enabled/pap Fri Aug 19 17:43:59 2016 : Debug: pap { Fri Aug 19 17:43:59 2016 : Debug: normalise = yes Fri Aug 19 17:43:59 2016 : Debug: } Fri Aug 19 17:43:59 2016 : Debug: Loading rlm_ldap with path: /usr/lib/freeradius/rlm_ldap.so Fri Aug 19 17:43:59 2016 : Debug: Loaded rlm_ldap, checking if it's valid Fri Aug 19 17:43:59 2016 : Debug: # Loaded module rlm_ldap Fri Aug 19 17:43:59 2016 : Debug: # Loading module "ldap" from file /etc/freeradius/mods-enabled/ldap Fri Aug 19 17:43:59 2016 : Debug: ldap { Fri Aug 19 17:43:59 2016 : Debug: server = "localhost" Fri Aug 19 17:43:59 2016 : Debug: identity = "cn=admin,dc=seminary,dc=local" Fri Aug 19 17:43:59 2016 : Debug: password = "PASSWORD" Fri Aug 19 17:43:59 2016 : Debug: sasl { Fri Aug 19 17:43:59 2016 : Debug: } Fri Aug 19 17:43:59 2016 : Debug: user { Fri Aug 19 17:43:59 2016 : Debug: scope = "sub" Fri Aug 19 17:43:59 2016 : Debug: access_positive = yes Fri Aug 19 17:43:59 2016 : Debug: sasl { Fri Aug 19 17:43:59 2016 : Debug: } Fri Aug 19 17:43:59 2016 : Warning: /etc/freeradius/mods-enabled/ldap[159]: The item 'membership_filter' is defined, but is unused by the configuration Fri Aug 19 17:43:59 2016 : Debug: } Fri Aug 19 17:43:59 2016 : Debug: group { Fri Aug 19 17:43:59 2016 : Debug: filter = "(objectClass=posixGroup)" Fri Aug 19 17:43:59 2016 : Debug: scope = "sub" Fri Aug 19 17:43:59 2016 : Debug: name_attribute = "cn" Fri Aug 19 17:43:59 2016 : Debug: membership_attribute = "memberOf" Fri Aug 19 17:43:59 2016 : Debug: cacheable_name = no Fri Aug 19 17:43:59 2016 : Debug: cacheable_dn = no Fri Aug 19 17:43:59 2016 : Debug: } Fri Aug 19 17:43:59 2016 : Debug: client { Fri Aug 19 17:43:59 2016 : Debug: filter = "(objectClass=radiusClient)" Fri Aug 19 17:43:59 2016 : Debug: scope = "sub" Fri Aug 19 17:43:59 2016 : Debug: base_dn = "ou=SeminaryOU,dc=seminary,dc=local" Fri Aug 19 17:43:59 2016 : Debug: } Fri Aug 19 17:43:59 2016 : Debug: profile { Fri Aug 19 17:43:59 2016 : Debug: } Fri Aug 19 17:43:59 2016 : Debug: options { Fri Aug 19 17:43:59 2016 : Debug: ldap_debug = 40 Fri Aug 19 17:43:59 2016 : Debug: chase_referrals = yes Fri Aug 19 17:43:59 2016 : Debug: rebind = yes Fri Aug 19 17:43:59 2016 : Debug: net_timeout = 1 Fri Aug 19 17:43:59 2016 : Debug: res_timeout = 10 Fri Aug 19 17:43:59 2016 : Debug: srv_timelimit = 3 Fri Aug 19 17:43:59 2016 : Debug: idle = 60 Fri Aug 19 17:43:59 2016 : Debug: probes = 3 Fri Aug 19 17:43:59 2016 : Debug: interval = 3 Fri Aug 19 17:43:59 2016 : Debug: } Fri Aug 19 17:43:59 2016 : Debug: tls { Fri Aug 19 17:43:59 2016 : Debug: start_tls = no Fri Aug 19 17:43:59 2016 : Debug: } Fri Aug 19 17:43:59 2016 : Debug: } Fri Aug 19 17:43:59 2016 : Debug: Creating attribute LDAP-Group Fri Aug 19 17:43:59 2016 : Debug: Loading rlm_digest with path: /usr/lib/freeradius/rlm_digest.so Fri Aug 19 17:43:59 2016 : Debug: Loaded rlm_digest, checking if it's valid Fri Aug 19 17:43:59 2016 : Debug: # Loaded module rlm_digest Fri Aug 19 17:43:59 2016 : Debug: # Loading module "digest" from file /etc/freeradius/mods-enabled/digest Fri Aug 19 17:43:59 2016 : Debug: Loading rlm_files with path: /usr/lib/freeradius/rlm_files.so Fri Aug 19 17:43:59 2016 : Debug: Loaded rlm_files, checking if it's valid Fri Aug 19 17:43:59 2016 : Debug: # Loaded module rlm_files Fri Aug 19 17:43:59 2016 : Debug: # Loading module "files" from file /etc/freeradius/mods-enabled/files Fri Aug 19 17:43:59 2016 : Debug: files { Fri Aug 19 17:43:59 2016 : Debug: filename = "/etc/freeradius/mods-config/files/authorize" Fri Aug 19 17:43:59 2016 : Debug: acctusersfile = "/etc/freeradius/mods-config/files/accounting" Fri Aug 19 17:43:59 2016 : Debug: preproxy_usersfile = "/etc/freeradius/mods-config/files/pre-proxy" Fri Aug 19 17:43:59 2016 : Debug: } Fri Aug 19 17:43:59 2016 : Debug: Loading rlm_preprocess with path: /usr/lib/freeradius/rlm_preprocess.so Fri Aug 19 17:43:59 2016 : Debug: Loaded rlm_preprocess, checking if it's valid Fri Aug 19 17:43:59 2016 : Debug: # Loaded module rlm_preprocess Fri Aug 19 17:43:59 2016 : Debug: # Loading module "preprocess" from file /etc/freeradius/mods-enabled/preprocess Fri Aug 19 17:43:59 2016 : Debug: preprocess { Fri Aug 19 17:43:59 2016 : Debug: huntgroups = "/etc/freeradius/mods-config/preprocess/huntgroups" Fri Aug 19 17:43:59 2016 : Debug: hints = "/etc/freeradius/mods-config/preprocess/hints" Fri Aug 19 17:43:59 2016 : Debug: with_ascend_hack = no Fri Aug 19 17:43:59 2016 : Debug: ascend_channels_per_line = 23 Fri Aug 19 17:43:59 2016 : Debug: with_ntdomain_hack = no Fri Aug 19 17:43:59 2016 : Debug: with_specialix_jetstream_hack = no Fri Aug 19 17:43:59 2016 : Debug: with_cisco_vsa_hack = no Fri Aug 19 17:43:59 2016 : Debug: with_alvarion_vsa_hack = no Fri Aug 19 17:43:59 2016 : Debug: } Fri Aug 19 17:43:59 2016 : Debug: Loading rlm_cache with path: /usr/lib/freeradius/rlm_cache.so Fri Aug 19 17:43:59 2016 : Debug: Loaded rlm_cache, checking if it's valid Fri Aug 19 17:43:59 2016 : Debug: # Loaded module rlm_cache Fri Aug 19 17:43:59 2016 : Debug: # Loading module "cache_eap" from file /etc/freeradius/mods-enabled/cache_eap Fri Aug 19 17:43:59 2016 : Debug: cache cache_eap { Fri Aug 19 17:43:59 2016 : Debug: driver = "rlm_cache_rbtree" Fri Aug 19 17:43:59 2016 : Debug: key = "%{%{control:State}:-%{%{reply:State}:-%{State}}}" Fri Aug 19 17:43:59 2016 : Debug: ttl = 15 Fri Aug 19 17:43:59 2016 : Debug: max_entries = 0 Fri Aug 19 17:43:59 2016 : Debug: epoch = 0 Fri Aug 19 17:43:59 2016 : Debug: add_stats = no Fri Aug 19 17:43:59 2016 : Debug: } Fri Aug 19 17:43:59 2016 : Debug: # Loading module "detail" from file /etc/freeradius/mods-enabled/detail Fri Aug 19 17:43:59 2016 : Debug: detail { Fri Aug 19 17:43:59 2016 : Debug: filename = "/var/log/freeradius/radacct/%{%{Packet-Src-IP-Address}:-%{ Packet-Src-IPv6-Address}}/detail-%Y%m%d" Fri Aug 19 17:43:59 2016 : Debug: header = "%t" Fri Aug 19 17:43:59 2016 : Debug: permissions = 384 Fri Aug 19 17:43:59 2016 : Debug: locking = no Fri Aug 19 17:43:59 2016 : Debug: escape_filenames = no Fri Aug 19 17:43:59 2016 : Debug: log_packet_header = no Fri Aug 19 17:43:59 2016 : Debug: } Fri Aug 19 17:43:59 2016 : Debug: Loading rlm_expiration with path: /usr/lib/freeradius/rlm_expiration.so Fri Aug 19 17:43:59 2016 : Debug: Loaded rlm_expiration, checking if it's valid Fri Aug 19 17:43:59 2016 : Debug: # Loaded module rlm_expiration Fri Aug 19 17:43:59 2016 : Debug: # Loading module "expiration" from file /etc/freeradius/mods-enabled/expiration Fri Aug 19 17:43:59 2016 : Debug: Loading rlm_chap with path: /usr/lib/freeradius/rlm_chap.so Fri Aug 19 17:43:59 2016 : Debug: Loaded rlm_chap, checking if it's valid Fri Aug 19 17:43:59 2016 : Debug: # Loaded module rlm_chap Fri Aug 19 17:43:59 2016 : Debug: # Loading module "chap" from file /etc/freeradius/mods-enabled/chap Fri Aug 19 17:43:59 2016 : Debug: Loading rlm_radutmp with path: /usr/lib/freeradius/rlm_radutmp.so Fri Aug 19 17:43:59 2016 : Debug: Loaded rlm_radutmp, checking if it's valid Fri Aug 19 17:43:59 2016 : Debug: # Loaded module rlm_radutmp Fri Aug 19 17:43:59 2016 : Debug: # Loading module "sradutmp" from file /etc/freeradius/mods-enabled/sradutmp Fri Aug 19 17:43:59 2016 : Debug: radutmp sradutmp { Fri Aug 19 17:43:59 2016 : Debug: filename = "/var/log/freeradius/sradutmp" Fri Aug 19 17:43:59 2016 : Debug: username = "%{User-Name}" Fri Aug 19 17:43:59 2016 : Debug: case_sensitive = yes Fri Aug 19 17:43:59 2016 : Debug: check_with_nas = yes Fri Aug 19 17:43:59 2016 : Debug: permissions = 420 Fri Aug 19 17:43:59 2016 : Debug: caller_id = no Fri Aug 19 17:43:59 2016 : Debug: } Fri Aug 19 17:43:59 2016 : Debug: # Loading module "radutmp" from file /etc/freeradius/mods-enabled/radutmp Fri Aug 19 17:43:59 2016 : Debug: radutmp { Fri Aug 19 17:43:59 2016 : Debug: filename = "/var/log/freeradius/radutmp" Fri Aug 19 17:43:59 2016 : Debug: username = "%{User-Name}" Fri Aug 19 17:43:59 2016 : Debug: case_sensitive = yes Fri Aug 19 17:43:59 2016 : Debug: check_with_nas = yes Fri Aug 19 17:43:59 2016 : Debug: permissions = 384 Fri Aug 19 17:43:59 2016 : Debug: caller_id = yes Fri Aug 19 17:43:59 2016 : Debug: } Fri Aug 19 17:43:59 2016 : Debug: Loading rlm_passwd with path: /usr/lib/freeradius/rlm_passwd.so Fri Aug 19 17:43:59 2016 : Debug: Loaded rlm_passwd, checking if it's valid Fri Aug 19 17:43:59 2016 : Debug: # Loaded module rlm_passwd Fri Aug 19 17:43:59 2016 : Debug: # Loading module "etc_passwd" from file /etc/freeradius/mods-enabled/passwd Fri Aug 19 17:43:59 2016 : Debug: passwd etc_passwd { Fri Aug 19 17:43:59 2016 : Debug: filename = "/etc/passwd" Fri Aug 19 17:43:59 2016 : Debug: format = "*User-Name:Crypt-Password:" Fri Aug 19 17:43:59 2016 : Debug: delimiter = ":" Fri Aug 19 17:43:59 2016 : Debug: ignore_nislike = no Fri Aug 19 17:43:59 2016 : Debug: ignore_empty = yes Fri Aug 19 17:43:59 2016 : Debug: allow_multiple_keys = no Fri Aug 19 17:43:59 2016 : Debug: hash_size = 100 Fri Aug 19 17:43:59 2016 : Debug: } Fri Aug 19 17:43:59 2016 : Debug: Loading rlm_linelog with path: /usr/lib/freeradius/rlm_linelog.so Fri Aug 19 17:43:59 2016 : Debug: Loaded rlm_linelog, checking if it's valid Fri Aug 19 17:43:59 2016 : Debug: # Loaded module rlm_linelog Fri Aug 19 17:43:59 2016 : Debug: # Loading module "linelog" from file /etc/freeradius/mods-enabled/linelog Fri Aug 19 17:43:59 2016 : Debug: linelog { Fri Aug 19 17:43:59 2016 : Debug: filename = "/var/log/freeradius/linelog" Fri Aug 19 17:43:59 2016 : Debug: escape_filenames = no Fri Aug 19 17:43:59 2016 : Debug: syslog_severity = "info" Fri Aug 19 17:43:59 2016 : Debug: permissions = 384 Fri Aug 19 17:43:59 2016 : Debug: format = "This is a log message for %{User-Name}" Fri Aug 19 17:43:59 2016 : Debug: reference = "messages.%{%{reply:Packet-Type}:-default}" Fri Aug 19 17:43:59 2016 : Debug: } Fri Aug 19 17:43:59 2016 : Debug: # Loading module "log_accounting" from file /etc/freeradius/mods-enabled/linelog Fri Aug 19 17:43:59 2016 : Debug: linelog log_accounting { Fri Aug 19 17:43:59 2016 : Debug: filename = "/var/log/freeradius/linelog-accounting" Fri Aug 19 17:43:59 2016 : Debug: escape_filenames = no Fri Aug 19 17:43:59 2016 : Debug: syslog_severity = "info" Fri Aug 19 17:43:59 2016 : Debug: permissions = 384 Fri Aug 19 17:43:59 2016 : Debug: format = "" Fri Aug 19 17:43:59 2016 : Debug: reference = "Accounting-Request.%{%{Acct-Status-Type}:-unknown}" Fri Aug 19 17:43:59 2016 : Debug: } Fri Aug 19 17:43:59 2016 : Debug: Loading rlm_unpack with path: /usr/lib/freeradius/rlm_unpack.so Fri Aug 19 17:43:59 2016 : Debug: Loaded rlm_unpack, checking if it's valid Fri Aug 19 17:43:59 2016 : Debug: # Loaded module rlm_unpack Fri Aug 19 17:43:59 2016 : Debug: # Loading module "unpack" from file /etc/freeradius/mods-enabled/unpack Fri Aug 19 17:43:59 2016 : Debug: Loading rlm_attr_filter with path: /usr/lib/freeradius/rlm_attr_filter.so Fri Aug 19 17:43:59 2016 : Debug: Loaded rlm_attr_filter, checking if it's valid Fri Aug 19 17:43:59 2016 : Debug: # Loaded module rlm_attr_filter Fri Aug 19 17:43:59 2016 : Debug: # Loading module "attr_filter.post-proxy" from file /etc/freeradius/mods-enabled/attr_filter Fri Aug 19 17:43:59 2016 : Debug: attr_filter attr_filter.post-proxy { Fri Aug 19 17:43:59 2016 : Debug: filename = "/etc/freeradius/mods-config/attr_filter/post-proxy" Fri Aug 19 17:43:59 2016 : Debug: key = "%{Realm}" Fri Aug 19 17:43:59 2016 : Debug: relaxed = no Fri Aug 19 17:43:59 2016 : Debug: } Fri Aug 19 17:43:59 2016 : Debug: # Loading module "attr_filter.pre-proxy" from file /etc/freeradius/mods-enabled/attr_filter Fri Aug 19 17:43:59 2016 : Debug: attr_filter attr_filter.pre-proxy { Fri Aug 19 17:43:59 2016 : Debug: filename = "/etc/freeradius/mods-config/attr_filter/pre-proxy" Fri Aug 19 17:43:59 2016 : Debug: key = "%{Realm}" Fri Aug 19 17:43:59 2016 : Debug: relaxed = no Fri Aug 19 17:43:59 2016 : Debug: } Fri Aug 19 17:43:59 2016 : Debug: # Loading module "attr_filter.access_reject" from file /etc/freeradius/mods-enabled/attr_filter Fri Aug 19 17:43:59 2016 : Debug: attr_filter attr_filter.access_reject { Fri Aug 19 17:43:59 2016 : Debug: filename = "/etc/freeradius/mods-config/attr_filter/access_reject" Fri Aug 19 17:43:59 2016 : Debug: key = "%{User-Name}" Fri Aug 19 17:43:59 2016 : Debug: relaxed = no Fri Aug 19 17:43:59 2016 : Debug: } Fri Aug 19 17:43:59 2016 : Debug: # Loading module "attr_filter.access_challenge" from file /etc/freeradius/mods-enabled/attr_filter Fri Aug 19 17:43:59 2016 : Debug: attr_filter attr_filter.access_challenge { Fri Aug 19 17:43:59 2016 : Debug: filename = "/etc/freeradius/mods-config/attr_filter/access_challenge" Fri Aug 19 17:43:59 2016 : Debug: key = "%{User-Name}" Fri Aug 19 17:43:59 2016 : Debug: relaxed = no Fri Aug 19 17:43:59 2016 : Debug: } Fri Aug 19 17:43:59 2016 : Debug: # Loading module "attr_filter.accounting_response" from file /etc/freeradius/mods-enabled/attr_filter Fri Aug 19 17:43:59 2016 : Debug: attr_filter attr_filter.accounting_response { Fri Aug 19 17:43:59 2016 : Debug: filename = "/etc/freeradius/mods-config/ attr_filter/accounting_response" Fri Aug 19 17:43:59 2016 : Debug: key = "%{User-Name}" Fri Aug 19 17:43:59 2016 : Debug: relaxed = no Fri Aug 19 17:43:59 2016 : Debug: } Fri Aug 19 17:43:59 2016 : Debug: Loading rlm_replicate with path: /usr/lib/freeradius/rlm_replicate.so Fri Aug 19 17:43:59 2016 : Debug: Loaded rlm_replicate, checking if it's valid Fri Aug 19 17:43:59 2016 : Debug: # Loaded module rlm_replicate Fri Aug 19 17:43:59 2016 : Debug: # Loading module "replicate" from file /etc/freeradius/mods-enabled/replicate Fri Aug 19 17:43:59 2016 : Debug: instantiate { Fri Aug 19 17:43:59 2016 : Debug: } Fri Aug 19 17:43:59 2016 : Debug: # Instantiating module "mschap" from file /etc/freeradius/mods-enabled/mschap Fri Aug 19 17:43:59 2016 : Debug: rlm_mschap (mschap): using internal authentication Fri Aug 19 17:43:59 2016 : Debug: # Instantiating module "reject" from file /etc/freeradius/mods-enabled/always Fri Aug 19 17:43:59 2016 : Debug: # Instantiating module "fail" from file /etc/freeradius/mods-enabled/always Fri Aug 19 17:43:59 2016 : Debug: # Instantiating module "ok" from file /etc/freeradius/mods-enabled/always Fri Aug 19 17:43:59 2016 : Debug: # Instantiating module "handled" from file /etc/freeradius/mods-enabled/always Fri Aug 19 17:43:59 2016 : Debug: # Instantiating module "invalid" from file /etc/freeradius/mods-enabled/always Fri Aug 19 17:43:59 2016 : Debug: # Instantiating module "userlock" from file /etc/freeradius/mods-enabled/always Fri Aug 19 17:43:59 2016 : Debug: # Instantiating module "notfound" from file /etc/freeradius/mods-enabled/always Fri Aug 19 17:43:59 2016 : Debug: # Instantiating module "noop" from file /etc/freeradius/mods-enabled/always Fri Aug 19 17:43:59 2016 : Debug: # Instantiating module "updated" from file /etc/freeradius/mods-enabled/always Fri Aug 19 17:43:59 2016 : Debug: # Instantiating module "eap" from file /etc/freeradius/mods-enabled/eap Fri Aug 19 17:43:59 2016 : Debug: Loading rlm_eap_md5 with path: /usr/lib/freeradius/rlm_eap_md5.so Fri Aug 19 17:43:59 2016 : Debug: # Linked to sub-module rlm_eap_md5 Fri Aug 19 17:43:59 2016 : Debug: Loading rlm_eap_leap with path: /usr/lib/freeradius/rlm_eap_leap.so Fri Aug 19 17:43:59 2016 : Debug: # Linked to sub-module rlm_eap_leap Fri Aug 19 17:43:59 2016 : Debug: Loading rlm_eap_gtc with path: /usr/lib/freeradius/rlm_eap_gtc.so Fri Aug 19 17:43:59 2016 : Debug: # Linked to sub-module rlm_eap_gtc Fri Aug 19 17:43:59 2016 : Debug: gtc { Fri Aug 19 17:43:59 2016 : Debug: challenge = "Password: " Fri Aug 19 17:43:59 2016 : Debug: auth_type = "PAP" Fri Aug 19 17:43:59 2016 : Debug: } Fri Aug 19 17:43:59 2016 : Debug: Loading rlm_eap_tls with path: /usr/lib/freeradius/rlm_eap_tls.so Fri Aug 19 17:43:59 2016 : Debug: # Linked to sub-module rlm_eap_tls Fri Aug 19 17:43:59 2016 : Debug: tls { Fri Aug 19 17:43:59 2016 : Debug: tls = "tls-common" Fri Aug 19 17:43:59 2016 : Debug: } Fri Aug 19 17:43:59 2016 : Debug: tls-config tls-common { Fri Aug 19 17:43:59 2016 : Debug: verify_depth = 0 Fri Aug 19 17:43:59 2016 : Debug: ca_path = "/etc/freeradius/certs" Fri Aug 19 17:43:59 2016 : Debug: pem_file_type = yes Fri Aug 19 17:43:59 2016 : Debug: private_key_file = "/etc/freeradius/certs/server.pem" Fri Aug 19 17:43:59 2016 : Debug: certificate_file = "/etc/freeradius/certs/server.pem" Fri Aug 19 17:43:59 2016 : Debug: ca_file = "/etc/freeradius/certs/ca.pem" Fri Aug 19 17:43:59 2016 : Debug: private_key_password = "whatever" Fri Aug 19 17:43:59 2016 : Debug: dh_file = "/etc/freeradius/certs/dh" Fri Aug 19 17:43:59 2016 : Debug: fragment_size = 1024 Fri Aug 19 17:43:59 2016 : Debug: include_length = yes Fri Aug 19 17:43:59 2016 : Debug: auto_chain = yes Fri Aug 19 17:43:59 2016 : Debug: check_crl = no Fri Aug 19 17:43:59 2016 : Debug: check_all_crl = no Fri Aug 19 17:43:59 2016 : Debug: cipher_list = "DEFAULT" Fri Aug 19 17:43:59 2016 : Debug: ecdh_curve = "prime256v1" Fri Aug 19 17:43:59 2016 : Debug: cache { Fri Aug 19 17:43:59 2016 : Debug: enable = yes Fri Aug 19 17:43:59 2016 : Debug: lifetime = 24 Fri Aug 19 17:43:59 2016 : Debug: max_entries = 255 Fri Aug 19 17:43:59 2016 : Debug: } Fri Aug 19 17:43:59 2016 : Debug: verify { Fri Aug 19 17:43:59 2016 : Debug: skip_if_ocsp_ok = no Fri Aug 19 17:43:59 2016 : Debug: } Fri Aug 19 17:43:59 2016 : Debug: ocsp { Fri Aug 19 17:43:59 2016 : Debug: enable = no Fri Aug 19 17:43:59 2016 : Debug: override_cert_url = yes Fri Aug 19 17:43:59 2016 : Debug: url = "http://127.0.0.1/ocsp/" Fri Aug 19 17:43:59 2016 : Debug: use_nonce = yes Fri Aug 19 17:43:59 2016 : Debug: timeout = 0 Fri Aug 19 17:43:59 2016 : Debug: softfail = no Fri Aug 19 17:43:59 2016 : Debug: } Fri Aug 19 17:43:59 2016 : Debug: } Fri Aug 19 17:43:59 2016 : Debug: Loading rlm_eap_ttls with path: /usr/lib/freeradius/rlm_eap_ttls.so Fri Aug 19 17:43:59 2016 : Debug: # Linked to sub-module rlm_eap_ttls Fri Aug 19 17:43:59 2016 : Debug: ttls { Fri Aug 19 17:43:59 2016 : Debug: tls = "tls-common" Fri Aug 19 17:43:59 2016 : Debug: default_eap_type = "md5" Fri Aug 19 17:43:59 2016 : Debug: copy_request_to_tunnel = no Fri Aug 19 17:43:59 2016 : Debug: use_tunneled_reply = no Fri Aug 19 17:43:59 2016 : Debug: virtual_server = "inner-tunnel" Fri Aug 19 17:43:59 2016 : Debug: include_length = yes Fri Aug 19 17:43:59 2016 : Debug: require_client_cert = no Fri Aug 19 17:43:59 2016 : Debug: } Fri Aug 19 17:43:59 2016 : Debug: tls: Using cached TLS configuration from previous invocation Fri Aug 19 17:43:59 2016 : Debug: Loading rlm_eap_peap with path: /usr/lib/freeradius/rlm_eap_peap.so Fri Aug 19 17:43:59 2016 : Debug: # Linked to sub-module rlm_eap_peap Fri Aug 19 17:43:59 2016 : Debug: peap { Fri Aug 19 17:43:59 2016 : Debug: tls = "tls-common" Fri Aug 19 17:43:59 2016 : Debug: default_eap_type = "mschapv2" Fri Aug 19 17:43:59 2016 : Debug: copy_request_to_tunnel = no Fri Aug 19 17:43:59 2016 : Debug: use_tunneled_reply = no Fri Aug 19 17:43:59 2016 : Debug: proxy_tunneled_request_as_eap = yes Fri Aug 19 17:43:59 2016 : Debug: virtual_server = "inner-tunnel" Fri Aug 19 17:43:59 2016 : Debug: soh = no Fri Aug 19 17:43:59 2016 : Debug: require_client_cert = no Fri Aug 19 17:43:59 2016 : Debug: } Fri Aug 19 17:43:59 2016 : Debug: tls: Using cached TLS configuration from previous invocation Fri Aug 19 17:43:59 2016 : Debug: Loading rlm_eap_mschapv2 with path: /usr/lib/freeradius/rlm_eap_mschapv2.so Fri Aug 19 17:43:59 2016 : Debug: # Linked to sub-module rlm_eap_mschapv2 Fri Aug 19 17:43:59 2016 : Debug: mschapv2 { Fri Aug 19 17:43:59 2016 : Debug: with_ntdomain_hack = no Fri Aug 19 17:43:59 2016 : Debug: send_error = no Fri Aug 19 17:43:59 2016 : Debug: } Fri Aug 19 17:43:59 2016 : Debug: # Instantiating module "logintime" from file /etc/freeradius/mods-enabled/logintime Fri Aug 19 17:43:59 2016 : Debug: # Instantiating module "IPASS" from file /etc/freeradius/mods-enabled/realm Fri Aug 19 17:43:59 2016 : Debug: # Instantiating module "suffix" from file /etc/freeradius/mods-enabled/realm Fri Aug 19 17:43:59 2016 : Debug: # Instantiating module "realmpercent" from file /etc/freeradius/mods-enabled/realm Fri Aug 19 17:43:59 2016 : Debug: # Instantiating module "ntdomain" from file /etc/freeradius/mods-enabled/realm Fri Aug 19 17:43:59 2016 : Debug: # Instantiating module "auth_log" from file /etc/freeradius/mods-enabled/detail.log Fri Aug 19 17:43:59 2016 : Debug: rlm_detail (auth_log): 'User-Password' suppressed, will not appear in detail output Fri Aug 19 17:43:59 2016 : Debug: # Instantiating module "reply_log" from file /etc/freeradius/mods-enabled/detail.log Fri Aug 19 17:43:59 2016 : Debug: # Instantiating module "pre_proxy_log" from file /etc/freeradius/mods-enabled/detail.log Fri Aug 19 17:43:59 2016 : Debug: # Instantiating module "post_proxy_log" from file /etc/freeradius/mods-enabled/detail.log Fri Aug 19 17:43:59 2016 : Debug: # Instantiating module "pap" from file /etc/freeradius/mods-enabled/pap Fri Aug 19 17:43:59 2016 : Debug: # Instantiating module "ldap" from file /etc/freeradius/mods-enabled/ldap Fri Aug 19 17:43:59 2016 : Info: rlm_ldap: libldap vendor: OpenLDAP, version: 20442 Fri Aug 19 17:43:59 2016 : Debug: accounting { Fri Aug 19 17:43:59 2016 : Debug: reference = "%{tolower:type.%{Acct-Status-Type}}" Fri Aug 19 17:43:59 2016 : Debug: } Fri Aug 19 17:43:59 2016 : Debug: post-auth { Fri Aug 19 17:43:59 2016 : Debug: reference = "." Fri Aug 19 17:43:59 2016 : Debug: } Fri Aug 19 17:43:59 2016 : Debug: LDAP server string: ldap://localhost:389 Fri Aug 19 17:43:59 2016 : Debug: rlm_ldap (ldap): Using local pool section Fri Aug 19 17:43:59 2016 : Debug: rlm_ldap (ldap): No pool reference found for config item "ldap.pool" Fri Aug 19 17:43:59 2016 : Debug: rlm_ldap (ldap): Initialising connection pool Fri Aug 19 17:43:59 2016 : Debug: pool { Fri Aug 19 17:43:59 2016 : Debug: start = 5 Fri Aug 19 17:43:59 2016 : Debug: min = 3 Fri Aug 19 17:43:59 2016 : Debug: max = 32 Fri Aug 19 17:43:59 2016 : Debug: spare = 10 Fri Aug 19 17:43:59 2016 : Debug: uses = 0 Fri Aug 19 17:43:59 2016 : Debug: lifetime = 0 Fri Aug 19 17:43:59 2016 : Debug: cleanup_interval = 30 Fri Aug 19 17:43:59 2016 : Debug: idle_timeout = 60 Fri Aug 19 17:43:59 2016 : Debug: retry_delay = 30 Fri Aug 19 17:43:59 2016 : Debug: spread = no Fri Aug 19 17:43:59 2016 : Debug: } Fri Aug 19 17:43:59 2016 : Info: rlm_ldap (ldap): Opening additional connection (0), 1 of 32 pending slots used Fri Aug 19 17:43:59 2016 : Debug: rlm_ldap (ldap): Connecting to ldap://localhost:389 Fri Aug 19 17:43:59 2016 : Debug: rlm_ldap (ldap): New libldap handle 0x255d6f0 Fri Aug 19 17:43:59 2016 : Debug: rlm_ldap (ldap): Waiting for bind result... Fri Aug 19 17:43:59 2016 : Debug: rlm_ldap (ldap): Bind successful Fri Aug 19 17:43:59 2016 : Info: rlm_ldap (ldap): Opening additional connection (1), 1 of 31 pending slots used Fri Aug 19 17:43:59 2016 : Debug: rlm_ldap (ldap): Connecting to ldap://localhost:389 Fri Aug 19 17:43:59 2016 : Debug: rlm_ldap (ldap): New libldap handle 0x25487c0 Fri Aug 19 17:43:59 2016 : Debug: rlm_ldap (ldap): Waiting for bind result... Fri Aug 19 17:43:59 2016 : Debug: rlm_ldap (ldap): Bind successful Fri Aug 19 17:43:59 2016 : Info: rlm_ldap (ldap): Opening additional connection (2), 1 of 30 pending slots used Fri Aug 19 17:43:59 2016 : Debug: rlm_ldap (ldap): Connecting to ldap://localhost:389 Fri Aug 19 17:43:59 2016 : Debug: rlm_ldap (ldap): New libldap handle 0x2551780 Fri Aug 19 17:43:59 2016 : Debug: rlm_ldap (ldap): Waiting for bind result... Fri Aug 19 17:43:59 2016 : Debug: rlm_ldap (ldap): Bind successful Fri Aug 19 17:43:59 2016 : Info: rlm_ldap (ldap): Opening additional connection (3), 1 of 29 pending slots used Fri Aug 19 17:43:59 2016 : Debug: rlm_ldap (ldap): Connecting to ldap://localhost:389 Fri Aug 19 17:43:59 2016 : Debug: rlm_ldap (ldap): New libldap handle 0x254f750 Fri Aug 19 17:43:59 2016 : Debug: rlm_ldap (ldap): Waiting for bind result... Fri Aug 19 17:43:59 2016 : Debug: rlm_ldap (ldap): Bind successful Fri Aug 19 17:43:59 2016 : Info: rlm_ldap (ldap): Opening additional connection (4), 1 of 28 pending slots used Fri Aug 19 17:43:59 2016 : Debug: rlm_ldap (ldap): Connecting to ldap://localhost:389 Fri Aug 19 17:43:59 2016 : Debug: rlm_ldap (ldap): New libldap handle 0x2597c50 Fri Aug 19 17:43:59 2016 : Debug: rlm_ldap (ldap): Waiting for bind result... Fri Aug 19 17:43:59 2016 : Debug: rlm_ldap (ldap): Bind successful Fri Aug 19 17:43:59 2016 : Debug: rlm_ldap (ldap): Adding pool reference 0x25865d0 to config item "ldap.pool" Fri Aug 19 17:43:59 2016 : Debug: # Instantiating module "files" from file /etc/freeradius/mods-enabled/files Fri Aug 19 17:43:59 2016 : Debug: reading pairlist file /etc/freeradius/mods-config/files/authorize Fri Aug 19 17:43:59 2016 : Debug: reading pairlist file /etc/freeradius/mods-config/files/accounting Fri Aug 19 17:43:59 2016 : Debug: reading pairlist file /etc/freeradius/mods-config/files/pre-proxy Fri Aug 19 17:43:59 2016 : Debug: # Instantiating module "preprocess" from file /etc/freeradius/mods-enabled/preprocess Fri Aug 19 17:43:59 2016 : Debug: reading pairlist file /etc/freeradius/mods-config/preprocess/huntgroups Fri Aug 19 17:43:59 2016 : Debug: reading pairlist file /etc/freeradius/mods-config/preprocess/hints Fri Aug 19 17:43:59 2016 : Debug: # Instantiating module "cache_eap" from file /etc/freeradius/mods-enabled/cache_eap Fri Aug 19 17:43:59 2016 : Debug: Loading rlm_cache_rbtree with path: /usr/lib/freeradius/rlm_cache_rbtree.so Fri Aug 19 17:43:59 2016 : Debug: rlm_cache (cache_eap): Driver rlm_cache_rbtree (module rlm_cache_rbtree) loaded and linked Fri Aug 19 17:43:59 2016 : Debug: # Instantiating module "detail" from file /etc/freeradius/mods-enabled/detail Fri Aug 19 17:43:59 2016 : Debug: # Instantiating module "expiration" from file /etc/freeradius/mods-enabled/expiration Fri Aug 19 17:43:59 2016 : Debug: # Instantiating module "etc_passwd" from file /etc/freeradius/mods-enabled/passwd Fri Aug 19 17:43:59 2016 : Debug: rlm_passwd: nfields: 3 keyfield 0(User-Name) listable: no Fri Aug 19 17:43:59 2016 : Debug: # Instantiating module "linelog" from file /etc/freeradius/mods-enabled/linelog Fri Aug 19 17:43:59 2016 : Debug: # Instantiating module "log_accounting" from file /etc/freeradius/mods-enabled/linelog Fri Aug 19 17:43:59 2016 : Debug: # Instantiating module "attr_filter.post-proxy" from file /etc/freeradius/mods-enabled/attr_filter Fri Aug 19 17:43:59 2016 : Debug: reading pairlist file /etc/freeradius/mods-config/attr_filter/post-proxy Fri Aug 19 17:43:59 2016 : Debug: # Instantiating module "attr_filter.pre-proxy" from file /etc/freeradius/mods-enabled/attr_filter Fri Aug 19 17:43:59 2016 : Debug: reading pairlist file /etc/freeradius/mods-config/attr_filter/pre-proxy Fri Aug 19 17:43:59 2016 : Debug: # Instantiating module "attr_filter.access_reject" from file /etc/freeradius/mods-enabled/attr_filter Fri Aug 19 17:43:59 2016 : Debug: reading pairlist file /etc/freeradius/mods-config/attr_filter/access_reject Fri Aug 19 17:43:59 2016 : Warning: [/etc/freeradius/mods-config/attr_filter/access_reject]:11 Check item "FreeRADIUS-Response-Delay" found in filter list for realm "DEFAULT". Fri Aug 19 17:43:59 2016 : Warning: [/etc/freeradius/mods-config/attr_filter/access_reject]:11 Check item "FreeRADIUS-Response-Delay-USec" found in filter list for realm "DEFAULT". Fri Aug 19 17:43:59 2016 : Debug: # Instantiating module "attr_filter.access_challenge" from file /etc/freeradius/mods-enabled/attr_filter Fri Aug 19 17:43:59 2016 : Debug: reading pairlist file /etc/freeradius/mods-config/attr_filter/access_challenge Fri Aug 19 17:43:59 2016 : Debug: # Instantiating module "attr_filter.accounting_response" from file /etc/freeradius/mods-enabled/attr_filter Fri Aug 19 17:43:59 2016 : Debug: reading pairlist file /etc/freeradius/mods-config/ attr_filter/accounting_response Fri Aug 19 17:43:59 2016 : Debug: } # modules Fri Aug 19 17:43:59 2016 : Debug: radiusd: #### Loading Virtual Servers #### Fri Aug 19 17:43:59 2016 : Debug: server { # from file /etc/freeradius/radiusd.conf Fri Aug 19 17:43:59 2016 : Debug: } # server Fri Aug 19 17:43:59 2016 : Debug: server inner-tunnel { # from file /etc/freeradius/sites-enabled/inner-tunnel Fri Aug 19 17:43:59 2016 : Debug: authenticate { Fri Aug 19 17:43:59 2016 : Debug: group { Fri Aug 19 17:43:59 2016 : Debug: pap Fri Aug 19 17:43:59 2016 : Debug: } Fri Aug 19 17:43:59 2016 : Debug: group { Fri Aug 19 17:43:59 2016 : Debug: chap Fri Aug 19 17:43:59 2016 : Debug: } Fri Aug 19 17:43:59 2016 : Debug: group { Fri Aug 19 17:43:59 2016 : Debug: mschap Fri Aug 19 17:43:59 2016 : Debug: } Fri Aug 19 17:43:59 2016 : Debug: eap Fri Aug 19 17:43:59 2016 : Debug: } # authenticate Fri Aug 19 17:43:59 2016 : Debug: authorize { Fri Aug 19 17:43:59 2016 : Debug: policy filter_username { Fri Aug 19 17:43:59 2016 : Debug: if (&User-Name) { Fri Aug 19 17:43:59 2016 : Debug: if (&User-Name =~ / /) { Fri Aug 19 17:43:59 2016 : Debug: update { Fri Aug 19 17:43:59 2016 : Debug: &Module-Failure-Message += 'Rejected: User-Name contains whitespace' Fri Aug 19 17:43:59 2016 : Debug: } Fri Aug 19 17:43:59 2016 : Debug: reject Fri Aug 19 17:43:59 2016 : Debug: } Fri Aug 19 17:43:59 2016 : Debug: if (&User-Name =~ /@[^@]*@/) { Fri Aug 19 17:43:59 2016 : Debug: update { Fri Aug 19 17:43:59 2016 : Debug: &Module-Failure-Message += 'Rejected: Multiple @ in User-Name' Fri Aug 19 17:43:59 2016 : Debug: } Fri Aug 19 17:43:59 2016 : Debug: reject Fri Aug 19 17:43:59 2016 : Debug: } Fri Aug 19 17:43:59 2016 : Debug: if (&User-Name =~ /\.\./) { Fri Aug 19 17:43:59 2016 : Debug: update { Fri Aug 19 17:43:59 2016 : Debug: &Module-Failure-Message += 'Rejected: User-Name contains multiple ..s' Fri Aug 19 17:43:59 2016 : Debug: } Fri Aug 19 17:43:59 2016 : Debug: reject Fri Aug 19 17:43:59 2016 : Debug: } Fri Aug 19 17:43:59 2016 : Debug: if (&User-Name =~ /@/ && !&User-Name =~ /@(.+)\.(.+)$/) { Fri Aug 19 17:43:59 2016 : Debug: update { Fri Aug 19 17:43:59 2016 : Debug: &Module-Failure-Message += 'Rejected: Realm does not have at least one dot separator' Fri Aug 19 17:43:59 2016 : Debug: } Fri Aug 19 17:43:59 2016 : Debug: reject Fri Aug 19 17:43:59 2016 : Debug: } Fri Aug 19 17:43:59 2016 : Debug: if (&User-Name =~ /\.$/) { Fri Aug 19 17:43:59 2016 : Debug: update { Fri Aug 19 17:43:59 2016 : Debug: &Module-Failure-Message += 'Rejected: Realm ends with a dot' Fri Aug 19 17:43:59 2016 : Debug: } Fri Aug 19 17:43:59 2016 : Debug: reject Fri Aug 19 17:43:59 2016 : Debug: } Fri Aug 19 17:43:59 2016 : Debug: if (&User-Name =~ /@\./) { Fri Aug 19 17:43:59 2016 : Debug: update { Fri Aug 19 17:43:59 2016 : Debug: &Module-Failure-Message += 'Rejected: Realm begins with a dot' Fri Aug 19 17:43:59 2016 : Debug: } Fri Aug 19 17:43:59 2016 : Debug: reject Fri Aug 19 17:43:59 2016 : Debug: } Fri Aug 19 17:43:59 2016 : Debug: } Fri Aug 19 17:43:59 2016 : Debug: } Fri Aug 19 17:43:59 2016 : Debug: chap Fri Aug 19 17:43:59 2016 : Debug: mschap Fri Aug 19 17:43:59 2016 : Debug: suffix Fri Aug 19 17:43:59 2016 : Debug: update { Fri Aug 19 17:43:59 2016 : Debug: &control:Proxy-To-Realm := LOCAL Fri Aug 19 17:43:59 2016 : Debug: } Fri Aug 19 17:43:59 2016 : Debug: eap Fri Aug 19 17:43:59 2016 : Debug: files Fri Aug 19 17:43:59 2016 : Debug: ldap Fri Aug 19 17:43:59 2016 : Debug: expiration Fri Aug 19 17:43:59 2016 : Debug: logintime Fri Aug 19 17:43:59 2016 : Debug: pap Fri Aug 19 17:43:59 2016 : Debug: } # authorize Fri Aug 19 17:43:59 2016 : Debug: session { Fri Aug 19 17:43:59 2016 : Debug: radutmp Fri Aug 19 17:43:59 2016 : Debug: } # session Fri Aug 19 17:43:59 2016 : Debug: post-proxy { Fri Aug 19 17:43:59 2016 : Debug: eap Fri Aug 19 17:43:59 2016 : Debug: } # post-proxy Fri Aug 19 17:43:59 2016 : Debug: post-auth { Fri Aug 19 17:43:59 2016 : Warning: Ignoring "sql" (see raddb/mods-available/README.rst) Fri Aug 19 17:43:59 2016 : Debug: ldap Fri Aug 19 17:43:59 2016 : Debug: group { Fri Aug 19 17:43:59 2016 : Debug: attr_filter.access_reject Fri Aug 19 17:43:59 2016 : Debug: update { Fri Aug 19 17:43:59 2016 : Debug: &outer.session-state:Module-Failure-Message := &Module-Failure-Message Fri Aug 19 17:43:59 2016 : Debug: } Fri Aug 19 17:43:59 2016 : Debug: } Fri Aug 19 17:43:59 2016 : Debug: } # post-auth Fri Aug 19 17:43:59 2016 : Debug: } # server inner-tunnel Fri Aug 19 17:43:59 2016 : Debug: server default { # from file /etc/freeradius/sites-enabled/default Fri Aug 19 17:43:59 2016 : Debug: authenticate { Fri Aug 19 17:43:59 2016 : Debug: group { Fri Aug 19 17:43:59 2016 : Debug: pap Fri Aug 19 17:43:59 2016 : Debug: } Fri Aug 19 17:43:59 2016 : Debug: group { Fri Aug 19 17:43:59 2016 : Debug: chap Fri Aug 19 17:43:59 2016 : Debug: } Fri Aug 19 17:43:59 2016 : Debug: group { Fri Aug 19 17:43:59 2016 : Debug: mschap Fri Aug 19 17:43:59 2016 : Debug: } Fri Aug 19 17:43:59 2016 : Debug: digest Fri Aug 19 17:43:59 2016 : Debug: eap Fri Aug 19 17:43:59 2016 : Debug: } # authenticate Fri Aug 19 17:43:59 2016 : Debug: authorize { Fri Aug 19 17:43:59 2016 : Debug: policy filter_username { Fri Aug 19 17:43:59 2016 : Debug: if (&User-Name) { Fri Aug 19 17:43:59 2016 : Debug: if (&User-Name =~ / /) { Fri Aug 19 17:43:59 2016 : Debug: update { Fri Aug 19 17:43:59 2016 : Debug: &Module-Failure-Message += 'Rejected: User-Name contains whitespace' Fri Aug 19 17:43:59 2016 : Debug: } Fri Aug 19 17:43:59 2016 : Debug: reject Fri Aug 19 17:43:59 2016 : Debug: } Fri Aug 19 17:43:59 2016 : Debug: if (&User-Name =~ /@[^@]*@/) { Fri Aug 19 17:43:59 2016 : Debug: update { Fri Aug 19 17:43:59 2016 : Debug: &Module-Failure-Message += 'Rejected: Multiple @ in User-Name' Fri Aug 19 17:43:59 2016 : Debug: } Fri Aug 19 17:43:59 2016 : Debug: reject Fri Aug 19 17:43:59 2016 : Debug: } Fri Aug 19 17:43:59 2016 : Debug: if (&User-Name =~ /\.\./) { Fri Aug 19 17:43:59 2016 : Debug: update { Fri Aug 19 17:43:59 2016 : Debug: &Module-Failure-Message += 'Rejected: User-Name contains multiple ..s' Fri Aug 19 17:43:59 2016 : Debug: } Fri Aug 19 17:43:59 2016 : Debug: reject Fri Aug 19 17:43:59 2016 : Debug: } Fri Aug 19 17:43:59 2016 : Debug: if (&User-Name =~ /@/ && !&User-Name =~ /@(.+)\.(.+)$/) { Fri Aug 19 17:43:59 2016 : Debug: update { Fri Aug 19 17:43:59 2016 : Debug: &Module-Failure-Message += 'Rejected: Realm does not have at least one dot separator' Fri Aug 19 17:43:59 2016 : Debug: } Fri Aug 19 17:43:59 2016 : Debug: reject Fri Aug 19 17:43:59 2016 : Debug: } Fri Aug 19 17:43:59 2016 : Debug: if (&User-Name =~ /\.$/) { Fri Aug 19 17:43:59 2016 : Debug: update { Fri Aug 19 17:43:59 2016 : Debug: &Module-Failure-Message += 'Rejected: Realm ends with a dot' Fri Aug 19 17:43:59 2016 : Debug: } Fri Aug 19 17:43:59 2016 : Debug: reject Fri Aug 19 17:43:59 2016 : Debug: } Fri Aug 19 17:43:59 2016 : Debug: if (&User-Name =~ /@\./) { Fri Aug 19 17:43:59 2016 : Debug: update { Fri Aug 19 17:43:59 2016 : Debug: &Module-Failure-Message += 'Rejected: Realm begins with a dot' Fri Aug 19 17:43:59 2016 : Debug: } Fri Aug 19 17:43:59 2016 : Debug: reject Fri Aug 19 17:43:59 2016 : Debug: } Fri Aug 19 17:43:59 2016 : Debug: } Fri Aug 19 17:43:59 2016 : Debug: } Fri Aug 19 17:43:59 2016 : Debug: preprocess Fri Aug 19 17:43:59 2016 : Debug: chap Fri Aug 19 17:43:59 2016 : Debug: mschap Fri Aug 19 17:43:59 2016 : Debug: suffix Fri Aug 19 17:43:59 2016 : Debug: eap Fri Aug 19 17:43:59 2016 : Debug: files Fri Aug 19 17:43:59 2016 : Debug: ldap Fri Aug 19 17:43:59 2016 : Debug: expiration Fri Aug 19 17:43:59 2016 : Debug: logintime Fri Aug 19 17:43:59 2016 : Debug: pap Fri Aug 19 17:43:59 2016 : Debug: } # authorize Fri Aug 19 17:43:59 2016 : Debug: preacct { Fri Aug 19 17:43:59 2016 : Debug: preprocess Fri Aug 19 17:43:59 2016 : Debug: policy acct_unique { Fri Aug 19 17:43:59 2016 : Debug: if ("%{string:Class}" =~ /ai:([0-9a-f]{32})/) { Fri Aug 19 17:43:59 2016 : Debug: update { Fri Aug 19 17:43:59 2016 : Debug: &Acct-Unique-Session-Id := "%{md5:%{1},%{Acct-Session-ID}}" Fri Aug 19 17:43:59 2016 : Debug: } Fri Aug 19 17:43:59 2016 : Debug: } Fri Aug 19 17:43:59 2016 : Debug: else { Fri Aug 19 17:43:59 2016 : Debug: update { Fri Aug 19 17:43:59 2016 : Debug: &Acct-Unique-Session-Id := "%{md5:%{User-Name},%{Acct-Session-ID},%{%{NAS-IPv6- Address}:-%{NAS-IP-Address}},%{NAS-Identifier},%{NAS-Port-ID},%{NAS-Port}}" Fri Aug 19 17:43:59 2016 : Debug: } Fri Aug 19 17:43:59 2016 : Debug: } Fri Aug 19 17:43:59 2016 : Debug: } Fri Aug 19 17:43:59 2016 : Debug: suffix Fri Aug 19 17:43:59 2016 : Debug: files Fri Aug 19 17:43:59 2016 : Debug: } # preacct Fri Aug 19 17:43:59 2016 : Debug: accounting { Fri Aug 19 17:43:59 2016 : Debug: detail Fri Aug 19 17:43:59 2016 : Debug: unix Fri Aug 19 17:43:59 2016 : Debug: exec Fri Aug 19 17:43:59 2016 : Debug: attr_filter.accounting_response Fri Aug 19 17:43:59 2016 : Debug: } # accounting Fri Aug 19 17:43:59 2016 : Debug: post-proxy { Fri Aug 19 17:43:59 2016 : Debug: eap Fri Aug 19 17:43:59 2016 : Debug: } # post-proxy Fri Aug 19 17:43:59 2016 : Debug: post-auth { Fri Aug 19 17:43:59 2016 : Debug: update { Fri Aug 19 17:43:59 2016 : Debug: &reply[*] += &session-state[*] Fri Aug 19 17:43:59 2016 : Debug: } Fri Aug 19 17:43:59 2016 : Warning: /etc/freeradius/sites-enabled/default[694]: Please change attribute reference to '&Tunnel-Type := ...' Fri Aug 19 17:43:59 2016 : Warning: /etc/freeradius/sites-enabled/default[695]: Please change attribute reference to '&Tunnel-Medium-Type := ...' Fri Aug 19 17:43:59 2016 : Warning: /etc/freeradius/sites-enabled/default[696]: Please change attribute reference to '&Tunnel-Private-Group-ID := ...' Fri Aug 19 17:43:59 2016 : Debug: if (&Ldap-Group == "cn=SeminaryAdmin,ou= SeminaryOU,dc=seminary,dc=local") { Fri Aug 19 17:43:59 2016 : Debug: update { Fri Aug 19 17:43:59 2016 : Debug: &reply:Tunnel-Type := VLAN Fri Aug 19 17:43:59 2016 : Debug: &reply:Tunnel-Medium-Type := 802 Fri Aug 19 17:43:59 2016 : Debug: &reply:Tunnel-Private-Group-Id := "12" Fri Aug 19 17:43:59 2016 : Debug: } Fri Aug 19 17:43:59 2016 : Debug: } Fri Aug 19 17:43:59 2016 : Debug: ldap Fri Aug 19 17:43:59 2016 : Debug: exec Fri Aug 19 17:43:59 2016 : Debug: policy remove_reply_message_if_eap { Fri Aug 19 17:43:59 2016 : Debug: if (&reply:EAP-Message && &reply:Reply-Message) { Fri Aug 19 17:43:59 2016 : Debug: update { Fri Aug 19 17:43:59 2016 : Debug: &reply:Reply-Message !* ANY Fri Aug 19 17:43:59 2016 : Debug: } Fri Aug 19 17:43:59 2016 : Debug: } Fri Aug 19 17:43:59 2016 : Debug: else { Fri Aug 19 17:43:59 2016 : Debug: noop Fri Aug 19 17:43:59 2016 : Debug: } Fri Aug 19 17:43:59 2016 : Debug: } Fri Aug 19 17:43:59 2016 : Debug: group { Fri Aug 19 17:43:59 2016 : Debug: attr_filter.access_reject Fri Aug 19 17:43:59 2016 : Debug: eap Fri Aug 19 17:43:59 2016 : Debug: policy remove_reply_message_if_eap { Fri Aug 19 17:43:59 2016 : Debug: if (&reply:EAP-Message && &reply:Reply-Message) { Fri Aug 19 17:43:59 2016 : Debug: update { Fri Aug 19 17:43:59 2016 : Debug: &reply:Reply-Message !* ANY Fri Aug 19 17:43:59 2016 : Debug: } Fri Aug 19 17:43:59 2016 : Debug: } Fri Aug 19 17:43:59 2016 : Debug: else { Fri Aug 19 17:43:59 2016 : Debug: noop Fri Aug 19 17:43:59 2016 : Debug: } Fri Aug 19 17:43:59 2016 : Debug: } Fri Aug 19 17:43:59 2016 : Debug: } Fri Aug 19 17:43:59 2016 : Debug: } # post-auth Fri Aug 19 17:43:59 2016 : Debug: } # server default Fri Aug 19 17:43:59 2016 : Debug: Created signal pipe. Read end FD 11, write end FD 12 Fri Aug 19 17:43:59 2016 : Debug: radiusd: #### Opening IP addresses and Ports #### Fri Aug 19 17:43:59 2016 : Debug: Loading proto_auth with path: /usr/lib/freeradius/proto_auth.so Fri Aug 19 17:43:59 2016 : Debug: Loading proto_auth failed: /usr/lib/freeradius/proto_auth.so: cannot open shared object file: No such file or directory - No such file or directory Fri Aug 19 17:43:59 2016 : Debug: Loading library using linker search path(s) Fri Aug 19 17:43:59 2016 : Debug: Defaults : /lib:/usr/lib Fri Aug 19 17:43:59 2016 : Debug: Failed with error: proto_auth.so: cannot open shared object file: No such file or directory Fri Aug 19 17:43:59 2016 : Debug: listen { Fri Aug 19 17:43:59 2016 : Debug: type = "auth" Fri Aug 19 17:43:59 2016 : Debug: ipaddr = 127.0.0.1 Fri Aug 19 17:43:59 2016 : Debug: port = 18120 Fri Aug 19 17:43:59 2016 : Debug: } Fri Aug 19 17:43:59 2016 : Debug: Loading proto_auth with path: /usr/lib/freeradius/proto_auth.so Fri Aug 19 17:43:59 2016 : Debug: Loading proto_auth failed: /usr/lib/freeradius/proto_auth.so: cannot open shared object file: No such file or directory - No such file or directory Fri Aug 19 17:43:59 2016 : Debug: Loading library using linker search path(s) Fri Aug 19 17:43:59 2016 : Debug: Defaults : /lib:/usr/lib Fri Aug 19 17:43:59 2016 : Debug: Failed with error: proto_auth.so: cannot open shared object file: No such file or directory Fri Aug 19 17:43:59 2016 : Debug: listen { Fri Aug 19 17:43:59 2016 : Debug: type = "auth" Fri Aug 19 17:43:59 2016 : Debug: ipaddr = * Fri Aug 19 17:43:59 2016 : Debug: port = 0 Fri Aug 19 17:43:59 2016 : Debug: limit { Fri Aug 19 17:43:59 2016 : Debug: max_connections = 16 Fri Aug 19 17:43:59 2016 : Debug: lifetime = 0 Fri Aug 19 17:43:59 2016 : Debug: idle_timeout = 30 Fri Aug 19 17:43:59 2016 : Debug: } Fri Aug 19 17:43:59 2016 : Debug: } Fri Aug 19 17:43:59 2016 : Debug: Loading proto_acct with path: /usr/lib/freeradius/proto_acct.so Fri Aug 19 17:43:59 2016 : Debug: Loading proto_acct failed: /usr/lib/freeradius/proto_acct.so: cannot open shared object file: No such file or directory - No such file or directory Fri Aug 19 17:43:59 2016 : Debug: Loading library using linker search path(s) Fri Aug 19 17:43:59 2016 : Debug: Defaults : /lib:/usr/lib Fri Aug 19 17:43:59 2016 : Debug: Failed with error: proto_acct.so: cannot open shared object file: No such file or directory Fri Aug 19 17:43:59 2016 : Debug: listen { Fri Aug 19 17:43:59 2016 : Debug: type = "acct" Fri Aug 19 17:43:59 2016 : Debug: ipaddr = * Fri Aug 19 17:43:59 2016 : Debug: ...
On Aug 22, 2016, at 8:06 AM, Matthew Pulis <mpulis@gmail.com> wrote:
I am still far from any result. After spending another weekend in, I would truly appreciate any further guidance. Thanks for your patience and help.
My $0.02 is that you've been trying a lot of things, and haven't made progress. The solution is simple: do less. Start with the default configuration. It works. Configure the LDAP module as per your specs, and nothing else. Ensure that the server starts, and connects to LDAP. Update raddb/sites-available/default, the "authorize" section, to add: if (Ldap-Group == "SeminaryAdmin") { ok } And then run the server in debugging mode. Send it requests via radclient. You don't really care what the response from the server is. You *do* care to see what happens when that LDAP-Group check is done. Read the output to see where it's searching in LDAP. Ensure that it's searching in the right place. The larger concern is that LDAP module is designed to work with a relatively standard LDAP schema. The more you vary the schema, the harder it is to get it to work. The on-line docs and examples will help you less, because they also expect standard schema. With a standard schema, doing LDAP group checks is a matter of about 5 minutes work. Which leads me to conclude that either your schema is overly complex, or there's something very simple that's missing. Alan DeKok.
Hi Alan thanks for your suggestion. I added that snippet in the authorize {} section too. But!!! : How come it is seeing that it is not a member of SeminaryAdmin when ldapsearch specifically says it is. I didn't touch the default schema in OpenLDAP so it should be pretty much straight forward from that side. Thanks Mon Aug 22 17:43:18 2016 : Debug: rlm_ldap (ldap): Bind successful Mon Aug 22 17:43:18 2016 : Debug: (0) User is not a member of "SeminaryAdmin" <============================!!!!!!!!! Mon Aug 22 17:43:18 2016 : Debug: (0) if (Ldap-Group == "SeminaryAdmin") -> FALSE Mon Aug 22 17:43:18 2016 : Debug: (0) modsingle[authorize]: calling preprocess (rlm_preprocess) for request 0 Mon Aug 22 17:43:18 2016 : Debug: (0) modsingle[authorize]: returned from preprocess (rlm_preprocess) for request 0 Mon Aug 22 17:43:18 2016 : Debug: (0) [preprocess] = ok Mon Aug 22 17:43:18 2016 : Debug: (0) modsingle[authorize]: calling chap (rlm_chap) for request 0 Mon Aug 22 17:43:18 2016 : Debug: (0) modsingle[authorize]: returned from chap (rlm_chap) for request 0 Mon Aug 22 17:43:18 2016 : Debug: (0) [chap] = noop Mon Aug 22 17:43:18 2016 : Debug: (0) modsingle[authorize]: calling mschap (rlm_mschap) for request 0 Mon Aug 22 17:43:18 2016 : Debug: (0) modsingle[authorize]: returned from mschap (rlm_mschap) for request 0 Mon Aug 22 17:43:18 2016 : Debug: (0) [mschap] = noop Mon Aug 22 17:43:18 2016 : Debug: (0) modsingle[authorize]: calling suffix (rlm_realm) for request 0 Mon Aug 22 17:43:18 2016 : Debug: (0) suffix: Checking for suffix after "@" Mon Aug 22 17:43:18 2016 : Debug: (0) suffix: No '@' in User-Name = "ttester", looking up realm NULL Mon Aug 22 17:43:18 2016 : Debug: (0) suffix: No such realm "NULL" Mon Aug 22 17:43:18 2016 : Debug: (0) modsingle[authorize]: returned from suffix (rlm_realm) for request 0 Mon Aug 22 17:43:18 2016 : Debug: (0) [suffix] = noop Mon Aug 22 17:43:18 2016 : Debug: (0) modsingle[authorize]: calling eap (rlm_eap) for request 0 Mon Aug 22 17:43:18 2016 : Debug: (0) eap: No EAP-Message, not doing EAP Mon Aug 22 17:43:18 2016 : Debug: (0) modsingle[authorize]: returned from eap (rlm_eap) for request 0 Mon Aug 22 17:43:18 2016 : Debug: (0) [eap] = noop Mon Aug 22 17:43:18 2016 : Debug: (0) modsingle[authorize]: calling files (rlm_files) for request 0 Mon Aug 22 17:43:18 2016 : Debug: (0) modsingle[authorize]: returned from files (rlm_files) for request 0 Mon Aug 22 17:43:18 2016 : Debug: (0) [files] = noop Mon Aug 22 17:43:18 2016 : Debug: (0) modsingle[authorize]: calling ldap (rlm_ldap) for request 0 Mon Aug 22 17:43:18 2016 : Debug: (0) ldap: EXPAND TMPL LITERAL Mon Aug 22 17:43:18 2016 : Debug: (0) ldap: EXPAND TMPL LITERAL Mon Aug 22 17:43:18 2016 : Debug: (0) ldap: EXPAND TMPL LITERAL Mon Aug 22 17:43:18 2016 : Debug: (0) ldap: EXPAND TMPL LITERAL Mon Aug 22 17:43:18 2016 : Debug: (0) ldap: EXPAND TMPL LITERAL Mon Aug 22 17:43:18 2016 : Debug: (0) ldap: EXPAND TMPL LITERAL Mon Aug 22 17:43:18 2016 : Debug: (0) ldap: EXPAND TMPL LITERAL Mon Aug 22 17:43:18 2016 : Debug: (0) ldap: EXPAND TMPL LITERAL Mon Aug 22 17:43:18 2016 : Debug: rlm_ldap (ldap): Reserved connection (1) Mon Aug 22 17:43:18 2016 : Debug: (0) ldap: EXPAND TMPL XLAT Mon Aug 22 17:43:18 2016 : Debug: (uid=%{%{Stripped-User-Name}:-%{User-Name}}) Mon Aug 22 17:43:18 2016 : Debug: Parsed xlat tree: Mon Aug 22 17:43:18 2016 : Debug: literal --> (uid= Mon Aug 22 17:43:18 2016 : Debug: if { Mon Aug 22 17:43:18 2016 : Debug: attribute --> Stripped-User-Name Mon Aug 22 17:43:18 2016 : Debug: } Mon Aug 22 17:43:18 2016 : Debug: else { Mon Aug 22 17:43:18 2016 : Debug: attribute --> User-Name Mon Aug 22 17:43:18 2016 : Debug: } Mon Aug 22 17:43:18 2016 : Debug: literal --> ) Mon Aug 22 17:43:18 2016 : Debug: (0) ldap: EXPAND (uid=%{%{Stripped-User-Name}:-%{User-Name}}) Mon Aug 22 17:43:18 2016 : Debug: (0) ldap: --> (uid=ttester) Mon Aug 22 17:43:18 2016 : Debug: (0) ldap: EXPAND TMPL LITERAL Mon Aug 22 17:43:18 2016 : Debug: (0) ldap: Performing search in "ou=SeminaryOU,dc=seminary,dc=local" with filter "(uid=ttester)", scope "sub" Mon Aug 22 17:43:18 2016 : Debug: (0) ldap: Waiting for search result... Mon Aug 22 17:43:18 2016 : Debug: (0) ldap: User object found at DN "cn=ttester,cn=SeminaryAdmin,ou=SeminaryOU,dc=seminary,dc=local" Mon Aug 22 17:43:18 2016 : Debug: (0) ldap: Processing user attributes Mon Aug 22 17:43:18 2016 : Debug: (0) ldap: control:Password-With-Header += '{SSHA}8IQ1qEkhjMJHRJH0vm7ajuRNcSBw9yrp' Mon Aug 22 17:43:18 2016 : Debug: (0) ldap: Attribute "radiusReplyMessage" not found in LDAP object Mon Aug 22 17:43:18 2016 : Debug: (0) ldap: Attribute "radiusTunnelType" not found in LDAP object Mon Aug 22 17:43:18 2016 : Debug: (0) ldap: Attribute "radiusTunnelMediumType" not found in LDAP object Mon Aug 22 17:43:18 2016 : Debug: (0) ldap: Attribute "radiusTunnelPrivategroupId" not found in LDAP object Mon Aug 22 17:43:18 2016 : Debug: (0) ldap: Attribute "radiusControlAttribute" not found in LDAP object Mon Aug 22 17:43:18 2016 : Debug: (0) ldap: Attribute "radiusRequestAttribute" not found in LDAP object Mon Aug 22 17:43:18 2016 : Debug: (0) ldap: Attribute "radiusReplyAttribute" not found in LDAP object Mon Aug 22 17:43:18 2016 : Debug: rlm_ldap (ldap): Released connection (1) Mon Aug 22 17:43:18 2016 : Debug: (0) modsingle[authorize]: returned from ldap (rlm_ldap) for request 0 Mon Aug 22 17:43:18 2016 : Debug: (0) [ldap] = updated Mon Aug 22 17:43:18 2016 : Debug: (0) modsingle[authorize]: calling expiration (rlm_expiration) for request 0 Mon Aug 22 17:43:18 2016 : Debug: (0) modsingle[authorize]: returned from expiration (rlm_expiration) for request 0 Mon Aug 22 17:43:18 2016 : Debug: (0) [expiration] = noop Mon Aug 22 17:43:18 2016 : Debug: (0) modsingle[authorize]: calling logintime (rlm_logintime) for request 0 Mon Aug 22 17:43:18 2016 : Debug: (0) modsingle[authorize]: returned from logintime (rlm_logintime) for request 0 Mon Aug 22 17:43:18 2016 : Debug: (0) [logintime] = noop Mon Aug 22 17:43:18 2016 : Debug: (0) modsingle[authorize]: calling pap (rlm_pap) for request 0 Mon Aug 22 17:43:18 2016 : Debug: (0) pap: Converted: Password-With-Header = '{SSHA}8IQ1qEkhjMJHRJH0vm7ajuRNcSBw9yrp' -> SSHA1-Password = '0x3849513171456b686a4d4a48524a4830766d37616a75524e6353427739797270' Mon Aug 22 17:43:18 2016 : Debug: (0) pap: Removing &control:Password-With-Header Mon Aug 22 17:43:18 2016 : Debug: (0) pap: Normalizing SSHA1-Password from base64 encoding, 32 bytes -> 24 bytes Mon Aug 22 17:43:18 2016 : Debug: (0) modsingle[authorize]: returned from pap (rlm_pap) for request 0 Mon Aug 22 17:43:18 2016 : Debug: (0) [pap] = updated Mon Aug 22 17:43:18 2016 : Debug: (0) } # authorize = updated Mon Aug 22 17:43:18 2016 : Debug: (0) Found Auth-Type = PAP Mon Aug 22 17:43:18 2016 : Debug: (0) # Executing group from file /etc/freeradius/sites-enabled/default Mon Aug 22 17:43:18 2016 : Debug: (0) Auth-Type PAP { Mon Aug 22 17:43:18 2016 : Debug: (0) modsingle[authenticate]: calling pap (rlm_pap) for request 0 Mon Aug 22 17:43:18 2016 : Debug: (0) pap: Login attempt with password "openldap" (8) Mon Aug 22 17:43:18 2016 : Debug: (0) pap: Comparing with "known-good" SSHA-Password Mon Aug 22 17:43:18 2016 : Debug: (0) pap: User authenticated successfully Mon Aug 22 17:43:18 2016 : Debug: (0) modsingle[authenticate]: returned from pap (rlm_pap) for request 0 Mon Aug 22 17:43:18 2016 : Debug: (0) [pap] = ok Mon Aug 22 17:43:18 2016 : Debug: (0) } # Auth-Type PAP = ok Mon Aug 22 17:43:18 2016 : Debug: (0) # Executing section post-auth from file /etc/freeradius/sites-enabled/default Mon Aug 22 17:43:18 2016 : Debug: (0) post-auth { Mon Aug 22 17:43:18 2016 : Debug: (0) update { Mon Aug 22 17:43:18 2016 : Debug: (0) No attributes updated Mon Aug 22 17:43:18 2016 : Debug: (0) } # update = noop Mon Aug 22 17:43:18 2016 : Debug: (0) if (Ldap-Group == "SeminaryAdmin") { Mon Aug 22 17:43:18 2016 : Debug: (0) Searching for user in group "SeminaryAdmin" Mon Aug 22 17:43:18 2016 : Debug: rlm_ldap (ldap): Reserved connection (2) Mon Aug 22 17:43:18 2016 : Debug: (0) Using user DN from request "cn=ttester,cn=SeminaryAdmin,ou=SeminaryOU,dc=seminary,dc=local" Mon Aug 22 17:43:18 2016 : Debug: (0) Checking user object's memberOf attributes Mon Aug 22 17:43:18 2016 : Debug: (0) Performing unfiltered search in "cn=ttester,cn=SeminaryAdmin,ou=SeminaryOU,dc=seminary,dc=local", scope "base" Mon Aug 22 17:43:18 2016 : Debug: (0) Waiting for search result... Mon Aug 22 17:43:18 2016 : Debug: (0) No group membership attribute(s) found in user object Mon Aug 22 17:43:18 2016 : Debug: rlm_ldap (ldap): Released connection (2) Mon Aug 22 17:43:18 2016 : Debug: (0) User is not a member of "SeminaryAdmin" Mon Aug 22 17:43:18 2016 : Debug: (0) if (Ldap-Group == "SeminaryAdmin") -> FALSE Mon Aug 22 17:43:18 2016 : Debug: (0) modsingle[post-auth]: calling ldap (rlm_ldap) for request 0 Mon Aug 22 17:43:18 2016 : Debug: . Mon Aug 22 17:43:18 2016 : Debug: Parsed xlat tree: Mon Aug 22 17:43:18 2016 : Debug: literal --> . Mon Aug 22 17:43:18 2016 : Debug: (0) ldap: EXPAND . Mon Aug 22 17:43:18 2016 : Debug: (0) ldap: --> . Mon Aug 22 17:43:18 2016 : Debug: Authenticated at %S Mon Aug 22 17:43:18 2016 : Debug: Parsed xlat tree: Mon Aug 22 17:43:18 2016 : Debug: literal --> Authenticated at Mon Aug 22 17:43:18 2016 : Debug: percent --> S Mon Aug 22 17:43:18 2016 : Debug: (0) ldap: EXPAND Authenticated at %S Mon Aug 22 17:43:18 2016 : Debug: (0) ldap: --> Authenticated at 2016-08-22 17:43:18 Mon Aug 22 17:43:18 2016 : Debug: rlm_ldap (ldap): Reserved connection (3) Mon Aug 22 17:43:18 2016 : Debug: (0) ldap: Using user DN from request "cn=ttester,cn=SeminaryAdmin,ou=SeminaryOU,dc=seminary,dc=local" Mon Aug 22 17:43:18 2016 : Debug: (0) ldap: Modifying object with DN "cn=ttester,cn=SeminaryAdmin,ou=SeminaryOU,dc=seminary,dc=local" Mon Aug 22 17:43:18 2016 : Debug: (0) ldap: Waiting for modify result... Mon Aug 22 17:43:18 2016 : Debug: rlm_ldap (ldap): Released connection (3) Mon Aug 22 17:43:18 2016 : Debug: (0) modsingle[post-auth]: returned from ldap (rlm_ldap) for request 0 Mon Aug 22 17:43:18 2016 : Debug: (0) [ldap] = ok Mon Aug 22 17:43:18 2016 : Debug: (0) modsingle[post-auth]: calling exec (rlm_exec) for request 0 Mon Aug 22 17:43:18 2016 : Debug: (0) modsingle[post-auth]: returned from exec (rlm_exec) for request 0 Mon Aug 22 17:43:18 2016 : Debug: (0) [exec] = noop Mon Aug 22 17:43:18 2016 : Debug: (0) policy remove_reply_message_if_eap { Mon Aug 22 17:43:18 2016 : Debug: (0) if (&reply:EAP-Message && &reply:Reply-Message) { Mon Aug 22 17:43:18 2016 : Debug: (0) if (&reply:EAP-Message && &reply:Reply-Message) -> FALSE Mon Aug 22 17:43:18 2016 : Debug: (0) else { Mon Aug 22 17:43:18 2016 : Debug: (0) modsingle[post-auth]: calling noop (rlm_always) for request 0 Mon Aug 22 17:43:18 2016 : Debug: (0) modsingle[post-auth]: returned from noop (rlm_always) for request 0 Mon Aug 22 17:43:18 2016 : Debug: (0) [noop] = noop Mon Aug 22 17:43:18 2016 : Debug: (0) } # else = noop Mon Aug 22 17:43:18 2016 : Debug: (0) } # policy remove_reply_message_if_eap = noop Mon Aug 22 17:43:18 2016 : Debug: (0) } # post-auth = ok Mon Aug 22 17:43:18 2016 : Debug: (0) Sent Access-Accept Id 100 from 127.0.0.1:1812 to 127.0.0.1:41765 length 0 Mon Aug 22 17:43:18 2016 : Debug: (0) Finished request Mon Aug 22 17:43:18 2016 : Debug: Waking up in 4.9 seconds. Mon Aug 22 17:43:23 2016 : Debug: (0) Cleaning up request packet ID 100 with timestamp +4 Mon Aug 22 17:43:23 2016 : Info: Ready to process requests
On Mon, Aug 22, 2016 at 05:53:04PM +0200, Matthew Pulis wrote:
How come it is seeing that it is not a member of SeminaryAdmin when ldapsearch specifically says it is. I didn't touch the default schema in OpenLDAP so it should be pretty much straight forward from that side.
Because likely either the search that FreeRADIUS is doing is the wrong search for your LDAP schema, or the bind user hasn't got permission to read the data. Looks like the former.
Mon Aug 22 17:43:18 2016 : Debug: rlm_ldap (ldap): Bind successful Mon Aug 22 17:43:18 2016 : Debug: (0) User is not a member of "SeminaryAdmin" <============================!!!!!!!!! Mon Aug 22 17:43:18 2016 : Debug: (0) if (Ldap-Group == "SeminaryAdmin") -> FALSE
This is really hard to read, and missing all the startup data. Please always post the whole debug output in each mail, it makes it so much easier to help. And just "radiusd -X". No -xx or -XXX or anything else, unless asked. That should skip the timestamps out and just include everything that is needed. Easiest way is to run radiusd -X | tee log.txt send a test packet, then hit Ctrl-C, and attach the log.txt file to the e-mail. That will hopefully preserve it without line wrapping and mangling it. It's good you've now got a fresh up-to-date install, and it should be clearer to see but we need the whole output. Thanks Matthew -- Matthew Newton, Ph.D. <mcn4@leicester.ac.uk> Systems Specialist, Infrastructure Services, I.T. Services, University of Leicester, Leicester LE1 7RH, United Kingdom For IT help contact helpdesk extn. 2253, <ithelp@le.ac.uk>
Hi, in the output: Mon Aug 22 17:43:18 2016 : Debug: rlm_ldap (ldap): Reserved connection (2) Mon Aug 22 17:43:18 2016 : Debug: (0) Using user DN from request "cn=ttester,cn=SeminaryAdmin,ou=SeminaryOU,dc=seminary,dc=local" Mon Aug 22 17:43:18 2016 : Debug: (0) Checking user object's memberOf attributes Mon Aug 22 17:43:18 2016 : Debug: (0) Performing unfiltered search in "cn=ttester,cn=SeminaryAdmin,ou=SeminaryOU,dc=seminary,dc=local", scope "base" Mon Aug 22 17:43:18 2016 : Debug: (0) Waiting for search result... Mon Aug 22 17:43:18 2016 : Debug: (0) No group membership attribute(s) found in user object Mon Aug 22 17:43:18 2016 : Debug: rlm_ldap (ldap): Released connection (2) Mon Aug 22 17:43:18 2016 : Debug: (0) User is not a member of "SeminaryAdmin" Mon Aug 22 17:43:18 2016 : Debug: (0) if (Ldap-Group == "SeminaryAdmin") -> FALSE so the scope is wrong... or you havent defined the gorup stuff in ldap module? I was at a site a couple of months back....we fought their LDAP schema for a few hours ldapsearch came to the rescue....sorry, if you're not LDAP guru and really know your schema its a case of trial and error and keep going at it. then ...bingo! you'll get it. alan
On Mon, Aug 22, 2016 at 05:59:34PM +0000, A.L.M.Buxey@lboro.ac.uk wrote:
in the output:
Hmm, I missed this bit of debug output.
Mon Aug 22 17:43:18 2016 : Debug: rlm_ldap (ldap): Reserved connection (2) Mon Aug 22 17:43:18 2016 : Debug: (0) Using user DN from request "cn=ttester,cn=SeminaryAdmin,ou=SeminaryOU,dc=seminary,dc=local" Mon Aug 22 17:43:18 2016 : Debug: (0) Checking user object's memberOf attributes Mon Aug 22 17:43:18 2016 : Debug: (0) Performing unfiltered search in "cn=ttester,cn=SeminaryAdmin,ou=SeminaryOU,dc=seminary,dc=local", scope "base" Mon Aug 22 17:43:18 2016 : Debug: (0) Waiting for search result...
Mon Aug 22 17:43:18 2016 : Debug: (0) No group membership attribute(s) found in user object
That line looks ominous. Previous ldapsearch outputs (even when bound as the admin user) don't show the memberOf attribute. So check that your LDAP server is actually including memberOf in the search results. You can search for group membership two ways. - configure "membership_attribute", in which case FR will search for the user, and then look at the specified attribute (memberOf by default) to see if the required group is there; or - configure "membership_filter", which means FR will search using that filter, then check through the list of all groups returned to see if the user is in any of them. You can also do both, in which case one happens first, and if that fails it checks the other method. I forget which way around this happens (probably attribute first). IIRC membership_attribute can have problems when you have very large groups, but the searching is done on FR so is less load on the LDAP server. membership_filter puts the load on the LDAP server (to search the groups and create the dynamic memberOf attribute), but easier for FR... but some servers restrict searching of attributes like memberOf. Try something simple like base_dn = "dc=seminary,dc=local" group { base_dn = "${..base_dn}" filter = '(objectClass=group)' name_attribute = cn scope = 'sub' # look in group for user account (not using this): membership_filter = '(member=%{control:Ldap-UserDn})' # look in use account for group: # membership_attribute = 'memberOf' } if that works then put more restrictions in to get the filter you need. Have you done an ldapsearch to pull the group back, rather than the user? - actually make sure the user *is* a member (according to the view that the FR LDAP bind user has). Also - I've not used openldap before. Try searching the web for "openldap memberof". It looks like you need to manually enable the memberOf attribute in the LDAP server. This may be your problem. Matthew -- Matthew Newton, Ph.D. <mcn4@leicester.ac.uk> Systems Specialist, Infrastructure Services, I.T. Services, University of Leicester, Leicester LE1 7RH, United Kingdom For IT help contact helpdesk extn. 2253, <ithelp@le.ac.uk>
Dear Matt / Alan After a week of depression, it seems like we are getting there, but we are still not there :) I have added the ismemberOf overlay in my Openldap. thanks a lot for your support and patience!! This is the ldap search: radius@daloradius:~$ ldapsearch -h localhost -b dc=seminary,dc=local -s sub '(cn=ttester3)' ismemberOf -D "cn=admin,dc=seminary,dc=local" -w PASS # extended LDIF # # LDAPv3 # base <dc=seminary,dc=local> with scope subtree # filter: (cn=ttester3) # requesting: ismemberOf # # ttester3, SeminaryAdmin, SeminaryOU, seminary.local dn: cn=ttester3,cn=SeminaryAdmin,ou=SeminaryOU,dc=seminary,dc=local # search result search: 2 result: 0 Success # numResponses: 2 # numEntries: 1 radius@daloradius:~$ radtest ttester3 openldap localhost 1812 testing456 Sent Access-Request Id 203 from 0.0.0.0:42741 to 127.0.0.1:1812 length 78 User-Name = "ttester3" User-Password = "openldap" NAS-IP-Address = 127.0.1.1 NAS-Port = 1812 Message-Authenticator = 0x00 Cleartext-Password = "openldap" Received Access-Accept Id 203 from 127.0.0.1:1812 to 0.0.0.0:0 length 20 This is the freeradius -x output: radius@daloradius:~$ cat radius.log Server was built with: accounting : yes authentication : yes ascend-binary-attributes : yes coa : yes control-socket : yes detail : yes dhcp : yes dynamic-clients : yes osfc2 : no proxy : yes regex-pcre : no regex-posix : yes regex-posix-extended : yes session-management : yes stats : yes tcp : yes threads : yes tls : yes unlang : yes vmps : yes developer : no Server core libs: freeradius-server : 3.0.11 talloc : 2.0.* ssl : 1.0.2g release Endianness: little Compilation flags: cppflags : -Wdate-time -D_FORTIFY_SOURCE=2 cflags : -I/build/freeradius-G88Mfz/freeradius-3.0.11 -I/build/freeradius-G88Mfz/freeradius-3.0.11/src -include /build/freeradius-G88Mfz/freeradius-3.0.11/src/freeradius-devel/autoconf.h -include /build/freeradius-G88Mfz/freeradius-3.0.11/src/freeradius-devel/build.h -include /build/freeradius-G88Mfz/freeradius-3.0.11/src/freeradius-devel/features.h -include /build/freeradius-G88Mfz/freeradius-3.0.11/src/freeradius-devel/radpaths.h -fno-strict-aliasing -g -O2 -fstack-protector-strong -Wformat -Werror=format-security -O2 -Wall -std=c99 -D_GNU_SOURCE -D_REENTRANT -D_POSIX_PTHREAD_SEMANTICS -DOPENSSL_NO_KRB5 -DNDEBUG -DIS_MODULE=1 ldflags : -Wl,-Bsymbolic-functions -Wl,-z,relro libs : -lcrypto -lssl -ltalloc -lcap -lnsl -lresolv -ldl -lpthread -lreadline Copyright (C) 1999-2016 The FreeRADIUS server project and contributors There is NO warranty; not even for MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE You may redistribute copies of FreeRADIUS under the terms of the GNU General Public License For more information about these matters, see the file named COPYRIGHT Starting - reading configuration files ... including dictionary file /usr/share/freeradius/dictionary including dictionary file /usr/share/freeradius/dictionary.dhcp including dictionary file /usr/share/freeradius/dictionary.vqp including dictionary file /etc/freeradius/dictionary including configuration file /etc/freeradius/radiusd.conf including configuration file /etc/freeradius/proxy.conf including configuration file /etc/freeradius/clients.conf including files in directory /etc/freeradius/mods-enabled/ including configuration file /etc/freeradius/mods-enabled/mschap including configuration file /etc/freeradius/mods-enabled/always including configuration file /etc/freeradius/mods-enabled/soh including configuration file /etc/freeradius/mods-enabled/eap including configuration file /etc/freeradius/mods-enabled/dynamic_clients including configuration file /etc/freeradius/mods-enabled/logintime including configuration file /etc/freeradius/mods-enabled/exec including configuration file /etc/freeradius/mods-enabled/realm including configuration file /etc/freeradius/mods-enabled/utf8 including configuration file /etc/freeradius/mods-enabled/echo including configuration file /etc/freeradius/mods-enabled/unix including configuration file /etc/freeradius/mods-enabled/detail.log including configuration file /etc/freeradius/mods-enabled/expr including configuration file /etc/freeradius/mods-enabled/ntlm_auth including configuration file /etc/freeradius/mods-enabled/pap including configuration file /etc/freeradius/mods-enabled/ldap including configuration file /etc/freeradius/mods-enabled/digest including configuration file /etc/freeradius/mods-enabled/files including configuration file /etc/freeradius/mods-enabled/preprocess including configuration file /etc/freeradius/mods-enabled/cache_eap including configuration file /etc/freeradius/mods-enabled/detail including configuration file /etc/freeradius/mods-enabled/expiration including configuration file /etc/freeradius/mods-enabled/chap including configuration file /etc/freeradius/mods-enabled/sradutmp including configuration file /etc/freeradius/mods-enabled/radutmp including configuration file /etc/freeradius/mods-enabled/passwd including configuration file /etc/freeradius/mods-enabled/linelog including configuration file /etc/freeradius/mods-enabled/unpack including configuration file /etc/freeradius/mods-enabled/attr_filter including configuration file /etc/freeradius/mods-enabled/replicate including files in directory /etc/freeradius/policy.d/ including configuration file /etc/freeradius/policy.d/filter including configuration file /etc/freeradius/policy.d/control including configuration file /etc/freeradius/policy.d/canonicalization including configuration file /etc/freeradius/policy.d/eap including configuration file /etc/freeradius/policy.d/debug including configuration file /etc/freeradius/policy.d/dhcp including configuration file /etc/freeradius/policy.d/accounting including configuration file /etc/freeradius/policy.d/abfab-tr including configuration file /etc/freeradius/policy.d/cui including configuration file /etc/freeradius/policy.d/operator-name including files in directory /etc/freeradius/sites-enabled/ including configuration file /etc/freeradius/sites-enabled/inner-tunnel including configuration file /etc/freeradius/sites-enabled/default main { security { user = "freerad" group = "freerad" allow_core_dumps = no } name = "freeradius" prefix = "/usr" localstatedir = "/var" logdir = "/var/log/freeradius" run_dir = "/var/run/freeradius" } main { name = "freeradius" prefix = "/usr" localstatedir = "/var" sbindir = "/usr/sbin" logdir = "/var/log/freeradius" run_dir = "/var/run/freeradius" libdir = "/usr/lib/freeradius" radacctdir = "/var/log/freeradius/radacct" hostname_lookups = no max_request_time = 30 cleanup_delay = 5 max_requests = 16384 pidfile = "/var/run/freeradius/freeradius.pid" checkrad = "/usr/sbin/checkrad" debug_level = 0 proxy_requests = yes log { stripped_names = no auth = no auth_badpass = no auth_goodpass = no colourise = yes msg_denied = "You are already logged in - access denied" } resources { } security { max_attributes = 200 reject_delay = 1.000000 status_server = yes } } radiusd: #### Loading Realms and Home Servers #### proxy server { retry_delay = 5 retry_count = 3 default_fallback = no dead_time = 120 wake_all_if_all_dead = no } home_server localhost { ipaddr = 127.0.0.1 port = 1812 type = "auth" secret = <<< secret >>> response_window = 20.000000 response_timeouts = 1 max_outstanding = 65536 zombie_period = 40 status_check = "status-server" ping_interval = 30 check_interval = 30 check_timeout = 4 num_answers_to_alive = 3 revive_interval = 120 limit { max_connections = 16 max_requests = 0 lifetime = 0 idle_timeout = 0 } coa { irt = 2 mrt = 16 mrc = 5 mrd = 30 } } home_server_pool my_auth_failover { type = fail-over home_server = localhost } realm example.com { auth_pool = my_auth_failover } realm LOCAL { } radiusd: #### Loading Clients #### client localhost { ipaddr = 127.0.0.1 require_message_authenticator = no secret = <<< secret >>> nas_type = "other" proto = "*" limit { max_connections = 16 lifetime = 0 idle_timeout = 30 } } client localhost_ipv6 { ipv6addr = ::1 require_message_authenticator = no secret = <<< secret >>> limit { max_connections = 16 lifetime = 0 idle_timeout = 30 } } client 192.168.100.0/24 { require_message_authenticator = no secret = <<< secret >>> shortname = "NAS" limit { max_connections = 16 lifetime = 0 idle_timeout = 30 } } No 'ipaddr' or 'ipv4addr' or 'ipv6addr' field found in client 192.168.100.0/24. Please fix your configuration Support for old-style clients will be removed in a future release Debugger not attached # Creating Auth-Type = PAP # Creating Auth-Type = CHAP # Creating Auth-Type = MS-CHAP # Creating Auth-Type = eap # Creating Auth-Type = digest radiusd: #### Instantiating modules #### modules { # Loaded module rlm_mschap # Loading module "mschap" from file /etc/freeradius/mods-enabled/mschap mschap { use_mppe = yes require_encryption = no require_strong = no with_ntdomain_hack = yes passchange { } allow_retry = yes } # Loaded module rlm_always # Loading module "reject" from file /etc/freeradius/mods-enabled/always always reject { rcode = "reject" simulcount = 0 mpp = no } # Loading module "fail" from file /etc/freeradius/mods-enabled/always always fail { rcode = "fail" simulcount = 0 mpp = no } # Loading module "ok" from file /etc/freeradius/mods-enabled/always always ok { rcode = "ok" simulcount = 0 mpp = no } # Loading module "handled" from file /etc/freeradius/mods-enabled/always always handled { rcode = "handled" simulcount = 0 mpp = no } # Loading module "invalid" from file /etc/freeradius/mods-enabled/always always invalid { rcode = "invalid" simulcount = 0 mpp = no } # Loading module "userlock" from file /etc/freeradius/mods-enabled/always always userlock { rcode = "userlock" simulcount = 0 mpp = no } # Loading module "notfound" from file /etc/freeradius/mods-enabled/always always notfound { rcode = "notfound" simulcount = 0 mpp = no } # Loading module "noop" from file /etc/freeradius/mods-enabled/always always noop { rcode = "noop" simulcount = 0 mpp = no } # Loading module "updated" from file /etc/freeradius/mods-enabled/always always updated { rcode = "updated" simulcount = 0 mpp = no } # Loaded module rlm_soh # Loading module "soh" from file /etc/freeradius/mods-enabled/soh soh { dhcp = yes } # Loaded module rlm_eap # Loading module "eap" from file /etc/freeradius/mods-enabled/eap eap { default_eap_type = "md5" timer_expire = 60 ignore_unknown_eap_types = no cisco_accounting_username_bug = no max_sessions = 16384 } # Loaded module rlm_dynamic_clients # Loading module "dynamic_clients" from file /etc/freeradius/mods-enabled/dynamic_clients # Loaded module rlm_logintime # Loading module "logintime" from file /etc/freeradius/mods-enabled/logintime logintime { minimum_timeout = 60 } # Loaded module rlm_exec # Loading module "exec" from file /etc/freeradius/mods-enabled/exec exec { wait = no input_pairs = "request" shell_escape = yes timeout = 10 } # Loaded module rlm_realm # Loading module "IPASS" from file /etc/freeradius/mods-enabled/realm realm IPASS { format = "prefix" delimiter = "/" ignore_default = no ignore_null = no } # Loading module "suffix" from file /etc/freeradius/mods-enabled/realm realm suffix { format = "suffix" delimiter = "@" ignore_default = no ignore_null = no } # Loading module "realmpercent" from file /etc/freeradius/mods-enabled/realm realm realmpercent { format = "suffix" delimiter = "%" ignore_default = no ignore_null = no } # Loading module "ntdomain" from file /etc/freeradius/mods-enabled/realm realm ntdomain { format = "prefix" delimiter = "\\" ignore_default = no ignore_null = no } # Loaded module rlm_utf8 # Loading module "utf8" from file /etc/freeradius/mods-enabled/utf8 # Loading module "echo" from file /etc/freeradius/mods-enabled/echo exec echo { wait = yes program = "/bin/echo %{User-Name}" input_pairs = "request" output_pairs = "reply" shell_escape = yes } # Loaded module rlm_unix # Loading module "unix" from file /etc/freeradius/mods-enabled/unix unix { radwtmp = "/var/log/freeradius/radwtmp" } Creating attribute Unix-Group # Loaded module rlm_detail # Loading module "auth_log" from file /etc/freeradius/mods-enabled/detail.log detail auth_log { filename = "/var/log/freeradius/radacct/%{%{Packet-Src-IP-Address}:-%{Packet-Src-IPv6-Address}}/auth-detail-%Y%m%d" header = "%t" permissions = 384 locking = no escape_filenames = no log_packet_header = no } # Loading module "reply_log" from file /etc/freeradius/mods-enabled/detail.log detail reply_log { filename = "/var/log/freeradius/radacct/%{%{Packet-Src-IP-Address}:-%{Packet-Src-IPv6-Address}}/reply-detail-%Y%m%d" header = "%t" permissions = 384 locking = no escape_filenames = no log_packet_header = no } # Loading module "pre_proxy_log" from file /etc/freeradius/mods-enabled/detail.log detail pre_proxy_log { filename = "/var/log/freeradius/radacct/%{%{Packet-Src-IP-Address}:-%{Packet-Src-IPv6-Address}}/pre-proxy-detail-%Y%m%d" header = "%t" permissions = 384 locking = no escape_filenames = no log_packet_header = no } # Loading module "post_proxy_log" from file /etc/freeradius/mods-enabled/detail.log detail post_proxy_log { filename = "/var/log/freeradius/radacct/%{%{Packet-Src-IP-Address}:-%{Packet-Src-IPv6-Address}}/post-proxy-detail-%Y%m%d" header = "%t" permissions = 384 locking = no escape_filenames = no log_packet_header = no } # Loaded module rlm_expr # Loading module "expr" from file /etc/freeradius/mods-enabled/expr expr { safe_characters = "@abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ0123456789.-_: /äéöüàâæçèéêëîïôœùûüaÿÄÉÖÜßÀÂÆÇÈÉÊËÎÏÔŒÙÛÜŸ" } # Loading module "ntlm_auth" from file /etc/freeradius/mods-enabled/ntlm_auth exec ntlm_auth { wait = yes program = "/path/to/ntlm_auth --request-nt-key --domain=MYDOMAIN --username=%{mschap:User-Name} --password=%{User-Password}" shell_escape = yes } # Loaded module rlm_pap # Loading module "pap" from file /etc/freeradius/mods-enabled/pap pap { normalise = yes } # Loaded module rlm_ldap # Loading module "ldap" from file /etc/freeradius/mods-enabled/ldap ldap { server = "localhost" identity = "cn=admin,dc=seminary,dc=local" password = <<< secret >>> sasl { } user { scope = "sub" access_positive = yes sasl { } } group { filter = "(objectClass=posixGroup)" scope = "sub" name_attribute = "cn" membership_attribute = "memberOf" cacheable_name = no cacheable_dn = no } client { filter = "(objectClass=radiusClient)" scope = "sub" base_dn = "ou=SeminaryOU,dc=seminary,dc=local" } profile { } options { ldap_debug = 40 chase_referrals = yes rebind = yes net_timeout = 1 res_timeout = 10 srv_timelimit = 3 idle = 60 probes = 3 interval = 3 } tls { start_tls = no } } Creating attribute LDAP-Group # Loaded module rlm_digest # Loading module "digest" from file /etc/freeradius/mods-enabled/digest # Loaded module rlm_files # Loading module "files" from file /etc/freeradius/mods-enabled/files files { filename = "/etc/freeradius/mods-config/files/authorize" acctusersfile = "/etc/freeradius/mods-config/files/accounting" preproxy_usersfile = "/etc/freeradius/mods-config/files/pre-proxy" } # Loaded module rlm_preprocess # Loading module "preprocess" from file /etc/freeradius/mods-enabled/preprocess preprocess { huntgroups = "/etc/freeradius/mods-config/preprocess/huntgroups" hints = "/etc/freeradius/mods-config/preprocess/hints" with_ascend_hack = no ascend_channels_per_line = 23 with_ntdomain_hack = no with_specialix_jetstream_hack = no with_cisco_vsa_hack = no with_alvarion_vsa_hack = no } # Loaded module rlm_cache # Loading module "cache_eap" from file /etc/freeradius/mods-enabled/cache_eap cache cache_eap { driver = "rlm_cache_rbtree" key = "%{%{control:State}:-%{%{reply:State}:-%{State}}}" ttl = 15 max_entries = 0 epoch = 0 add_stats = no } # Loading module "detail" from file /etc/freeradius/mods-enabled/detail detail { filename = "/var/log/freeradius/radacct/%{%{Packet-Src-IP-Address}:-%{Packet-Src-IPv6-Address}}/detail-%Y%m%d" header = "%t" permissions = 384 locking = no escape_filenames = no log_packet_header = no } # Loaded module rlm_expiration # Loading module "expiration" from file /etc/freeradius/mods-enabled/expiration # Loaded module rlm_chap # Loading module "chap" from file /etc/freeradius/mods-enabled/chap # Loaded module rlm_radutmp # Loading module "sradutmp" from file /etc/freeradius/mods-enabled/sradutmp radutmp sradutmp { filename = "/var/log/freeradius/sradutmp" username = "%{User-Name}" case_sensitive = yes check_with_nas = yes permissions = 420 caller_id = no } # Loading module "radutmp" from file /etc/freeradius/mods-enabled/radutmp radutmp { filename = "/var/log/freeradius/radutmp" username = "%{User-Name}" case_sensitive = yes check_with_nas = yes permissions = 384 caller_id = yes } # Loaded module rlm_passwd # Loading module "etc_passwd" from file /etc/freeradius/mods-enabled/passwd passwd etc_passwd { filename = "/etc/passwd" format = "*User-Name:Crypt-Password:" delimiter = ":" ignore_nislike = no ignore_empty = yes allow_multiple_keys = no hash_size = 100 } # Loaded module rlm_linelog # Loading module "linelog" from file /etc/freeradius/mods-enabled/linelog linelog { filename = "/var/log/freeradius/linelog" escape_filenames = no syslog_severity = "info" permissions = 384 format = "This is a log message for %{User-Name}" reference = "messages.%{%{reply:Packet-Type}:-default}" } # Loading module "log_accounting" from file /etc/freeradius/mods-enabled/linelog linelog log_accounting { filename = "/var/log/freeradius/linelog-accounting" escape_filenames = no syslog_severity = "info" permissions = 384 format = "" reference = "Accounting-Request.%{%{Acct-Status-Type}:-unknown}" } # Loaded module rlm_unpack # Loading module "unpack" from file /etc/freeradius/mods-enabled/unpack # Loaded module rlm_attr_filter # Loading module "attr_filter.post-proxy" from file /etc/freeradius/mods-enabled/attr_filter attr_filter attr_filter.post-proxy { filename = "/etc/freeradius/mods-config/attr_filter/post-proxy" key = "%{Realm}" relaxed = no } # Loading module "attr_filter.pre-proxy" from file /etc/freeradius/mods-enabled/attr_filter attr_filter attr_filter.pre-proxy { filename = "/etc/freeradius/mods-config/attr_filter/pre-proxy" key = "%{Realm}" relaxed = no } # Loading module "attr_filter.access_reject" from file /etc/freeradius/mods-enabled/attr_filter attr_filter attr_filter.access_reject { filename = "/etc/freeradius/mods-config/attr_filter/access_reject" key = "%{User-Name}" relaxed = no } # Loading module "attr_filter.access_challenge" from file /etc/freeradius/mods-enabled/attr_filter attr_filter attr_filter.access_challenge { filename = "/etc/freeradius/mods-config/attr_filter/access_challenge" key = "%{User-Name}" relaxed = no } # Loading module "attr_filter.accounting_response" from file /etc/freeradius/mods-enabled/attr_filter attr_filter attr_filter.accounting_response { filename = "/etc/freeradius/mods-config/attr_filter/accounting_response" key = "%{User-Name}" relaxed = no } # Loaded module rlm_replicate # Loading module "replicate" from file /etc/freeradius/mods-enabled/replicate instantiate { } # Instantiating module "mschap" from file /etc/freeradius/mods-enabled/mschap rlm_mschap (mschap): using internal authentication # Instantiating module "reject" from file /etc/freeradius/mods-enabled/always # Instantiating module "fail" from file /etc/freeradius/mods-enabled/always # Instantiating module "ok" from file /etc/freeradius/mods-enabled/always # Instantiating module "handled" from file /etc/freeradius/mods-enabled/always # Instantiating module "invalid" from file /etc/freeradius/mods-enabled/always # Instantiating module "userlock" from file /etc/freeradius/mods-enabled/always # Instantiating module "notfound" from file /etc/freeradius/mods-enabled/always # Instantiating module "noop" from file /etc/freeradius/mods-enabled/always # Instantiating module "updated" from file /etc/freeradius/mods-enabled/always # Instantiating module "eap" from file /etc/freeradius/mods-enabled/eap # Linked to sub-module rlm_eap_md5 # Linked to sub-module rlm_eap_leap # Linked to sub-module rlm_eap_gtc gtc { challenge = "Password: " auth_type = "PAP" } # Linked to sub-module rlm_eap_tls tls { tls = "tls-common" } tls-config tls-common { verify_depth = 0 ca_path = "/etc/freeradius/certs" pem_file_type = yes private_key_file = "/etc/freeradius/certs/server.pem" certificate_file = "/etc/freeradius/certs/server.pem" ca_file = "/etc/freeradius/certs/ca.pem" private_key_password = <<< secret >>> dh_file = "/etc/freeradius/certs/dh" fragment_size = 1024 include_length = yes auto_chain = yes check_crl = no check_all_crl = no cipher_list = "DEFAULT" ecdh_curve = "prime256v1" cache { enable = yes lifetime = 24 max_entries = 255 } verify { skip_if_ocsp_ok = no } ocsp { enable = no override_cert_url = yes url = "http://127.0.0.1/ocsp/" use_nonce = yes timeout = 0 softfail = no } } # Linked to sub-module rlm_eap_ttls ttls { tls = "tls-common" default_eap_type = "md5" copy_request_to_tunnel = no use_tunneled_reply = no virtual_server = "inner-tunnel" include_length = yes require_client_cert = no } tls: Using cached TLS configuration from previous invocation # Linked to sub-module rlm_eap_peap peap { tls = "tls-common" default_eap_type = "mschapv2" copy_request_to_tunnel = no use_tunneled_reply = no proxy_tunneled_request_as_eap = yes virtual_server = "inner-tunnel" soh = no require_client_cert = no } tls: Using cached TLS configuration from previous invocation # Linked to sub-module rlm_eap_mschapv2 mschapv2 { with_ntdomain_hack = no send_error = no } # Instantiating module "logintime" from file /etc/freeradius/mods-enabled/logintime # Instantiating module "IPASS" from file /etc/freeradius/mods-enabled/realm # Instantiating module "suffix" from file /etc/freeradius/mods-enabled/realm # Instantiating module "realmpercent" from file /etc/freeradius/mods-enabled/realm # Instantiating module "ntdomain" from file /etc/freeradius/mods-enabled/realm # Instantiating module "auth_log" from file /etc/freeradius/mods-enabled/detail.log rlm_detail (auth_log): 'User-Password' suppressed, will not appear in detail output # Instantiating module "reply_log" from file /etc/freeradius/mods-enabled/detail.log # Instantiating module "pre_proxy_log" from file /etc/freeradius/mods-enabled/detail.log # Instantiating module "post_proxy_log" from file /etc/freeradius/mods-enabled/detail.log # Instantiating module "pap" from file /etc/freeradius/mods-enabled/pap # Instantiating module "ldap" from file /etc/freeradius/mods-enabled/ldap rlm_ldap: libldap vendor: OpenLDAP, version: 20442 accounting { reference = "%{tolower:type.%{Acct-Status-Type}}" } post-auth { reference = "." } rlm_ldap (ldap): Initialising connection pool pool { start = 5 min = 3 max = 32 spare = 10 uses = 0 lifetime = 0 cleanup_interval = 30 idle_timeout = 60 retry_delay = 30 spread = no } rlm_ldap (ldap): Opening additional connection (0), 1 of 32 pending slots used rlm_ldap (ldap): Connecting to ldap://localhost:389 rlm_ldap (ldap): Waiting for bind result... rlm_ldap (ldap): Bind successful rlm_ldap (ldap): Opening additional connection (1), 1 of 31 pending slots used rlm_ldap (ldap): Connecting to ldap://localhost:389 rlm_ldap (ldap): Waiting for bind result... rlm_ldap (ldap): Bind successful rlm_ldap (ldap): Opening additional connection (2), 1 of 30 pending slots used rlm_ldap (ldap): Connecting to ldap://localhost:389 rlm_ldap (ldap): Waiting for bind result... rlm_ldap (ldap): Bind successful rlm_ldap (ldap): Opening additional connection (3), 1 of 29 pending slots used rlm_ldap (ldap): Connecting to ldap://localhost:389 rlm_ldap (ldap): Waiting for bind result... rlm_ldap (ldap): Bind successful rlm_ldap (ldap): Opening additional connection (4), 1 of 28 pending slots used rlm_ldap (ldap): Connecting to ldap://localhost:389 rlm_ldap (ldap): Waiting for bind result... rlm_ldap (ldap): Bind successful # Instantiating module "files" from file /etc/freeradius/mods-enabled/files reading pairlist file /etc/freeradius/mods-config/files/authorize reading pairlist file /etc/freeradius/mods-config/files/accounting reading pairlist file /etc/freeradius/mods-config/files/pre-proxy # Instantiating module "preprocess" from file /etc/freeradius/mods-enabled/preprocess reading pairlist file /etc/freeradius/mods-config/preprocess/huntgroups reading pairlist file /etc/freeradius/mods-config/preprocess/hints # Instantiating module "cache_eap" from file /etc/freeradius/mods-enabled/cache_eap rlm_cache (cache_eap): Driver rlm_cache_rbtree (module rlm_cache_rbtree) loaded and linked # Instantiating module "detail" from file /etc/freeradius/mods-enabled/detail # Instantiating module "expiration" from file /etc/freeradius/mods-enabled/expiration # Instantiating module "etc_passwd" from file /etc/freeradius/mods-enabled/passwd rlm_passwd: nfields: 3 keyfield 0(User-Name) listable: no # Instantiating module "linelog" from file /etc/freeradius/mods-enabled/linelog # Instantiating module "log_accounting" from file /etc/freeradius/mods-enabled/linelog # Instantiating module "attr_filter.post-proxy" from file /etc/freeradius/mods-enabled/attr_filter reading pairlist file /etc/freeradius/mods-config/attr_filter/post-proxy # Instantiating module "attr_filter.pre-proxy" from file /etc/freeradius/mods-enabled/attr_filter reading pairlist file /etc/freeradius/mods-config/attr_filter/pre-proxy # Instantiating module "attr_filter.access_reject" from file /etc/freeradius/mods-enabled/attr_filter reading pairlist file /etc/freeradius/mods-config/attr_filter/access_reject [/etc/freeradius/mods-config/attr_filter/access_reject]:11 Check item "FreeRADIUS-Response-Delay" found in filter list for realm "DEFAULT". [/etc/freeradius/mods-config/attr_filter/access_reject]:11 Check item "FreeRADIUS-Response-Delay-USec" found in filter list for realm "DEFAULT". # Instantiating module "attr_filter.access_challenge" from file /etc/freeradius/mods-enabled/attr_filter reading pairlist file /etc/freeradius/mods-config/attr_filter/access_challenge # Instantiating module "attr_filter.accounting_response" from file /etc/freeradius/mods-enabled/attr_filter reading pairlist file /etc/freeradius/mods-config/attr_filter/accounting_response } # modules radiusd: #### Loading Virtual Servers #### server { # from file /etc/freeradius/radiusd.conf } # server server inner-tunnel { # from file /etc/freeradius/sites-enabled/inner-tunnel # Loading authenticate {...} # Loading authorize {...} # Loading session {...} # Loading post-proxy {...} # Loading post-auth {...} Ignoring "sql" (see raddb/mods-available/README.rst) } # server inner-tunnel server default { # from file /etc/freeradius/sites-enabled/default # Loading authenticate {...} # Loading authorize {...} # Loading preacct {...} # Loading accounting {...} # Loading post-proxy {...} # Loading post-auth {...} } # server default radiusd: #### Opening IP addresses and Ports #### listen { type = "auth" ipaddr = 127.0.0.1 port = 18120 } listen { type = "auth" ipaddr = * port = 0 limit { max_connections = 16 lifetime = 0 idle_timeout = 30 } } listen { type = "acct" ipaddr = * port = 0 limit { max_connections = 16 lifetime = 0 idle_timeout = 30 } } listen { type = "auth" ipv6addr = :: port = 0 limit { max_connections = 16 lifetime = 0 idle_timeout = 30 } } listen { type = "acct" ipv6addr = :: port = 0 limit { max_connections = 16 lifetime = 0 idle_timeout = 30 } } Listening on auth address 127.0.0.1 port 18120 bound to server inner-tunnel Listening on auth address * port 1812 bound to server default Listening on acct address * port 1813 bound to server default Listening on auth address :: port 1812 bound to server default Listening on acct address :: port 1813 bound to server default Listening on proxy address * port 35028 Listening on proxy address :: port 37804 Ready to process requests (0) Received Access-Request Id 244 from 127.0.0.1:55691 to 127.0.0.1:1812 length 78 (0) User-Name = "ttester3" (0) User-Password = "openldap" (0) NAS-IP-Address = 127.0.1.1 (0) NAS-Port = 1812 (0) Message-Authenticator = 0xcb668af2e5fb404fe4abf8a7d7ec67d2 (0) # Executing section authorize from file /etc/freeradius/sites-enabled/default (0) authorize { (0) policy filter_username { (0) if (&User-Name) { (0) if (&User-Name) -> TRUE (0) if (&User-Name) { (0) if (&User-Name =~ / /) { (0) if (&User-Name =~ / /) -> FALSE (0) if (&User-Name =~ /@[^@]*@/ ) { (0) if (&User-Name =~ /@[^@]*@/ ) -> FALSE (0) if (&User-Name =~ /\.\./ ) { (0) if (&User-Name =~ /\.\./ ) -> FALSE (0) if ((&User-Name =~ /@/) && (&User-Name !~ /@(.+)\.(.+)$/)) { (0) if ((&User-Name =~ /@/) && (&User-Name !~ /@(.+)\.(.+)$/)) -> FALSE (0) if (&User-Name =~ /\.$/) { (0) if (&User-Name =~ /\.$/) -> FALSE (0) if (&User-Name =~ /@\./) { (0) if (&User-Name =~ /@\./) -> FALSE (0) } # if (&User-Name) = notfound (0) } # policy filter_username = notfound (0) if (Ldap-Group == "SeminaryAdmin") { (0) Searching for user in group "SeminaryAdmin" rlm_ldap (ldap): Reserved connection (0) (0) EXPAND (uid=%{%{Stripped-User-Name}:-%{User-Name}}) (0) --> (uid=ttester3) (0) Performing search in "ou=SeminaryOU,dc=seminary,dc=local" with filter "(uid=ttester3)", scope "sub" (0) Waiting for search result... (0) User object found at DN "cn=ttester3,cn=SeminaryAdmin,ou=SeminaryOU,dc=seminary,dc=local" (0) Checking user object's memberOf attributes (0) Performing unfiltered search in "cn=ttester3,cn=SeminaryAdmin,ou=SeminaryOU,dc=seminary,dc=local", scope "base" (0) Waiting for search result... (0) No group membership attribute(s) found in user object rlm_ldap (ldap): Released connection (0) rlm_ldap (ldap): Need 5 more connections to reach 10 spares rlm_ldap (ldap): Opening additional connection (5), 1 of 27 pending slots used rlm_ldap (ldap): Connecting to ldap://localhost:389 rlm_ldap (ldap): Waiting for bind result... rlm_ldap (ldap): Bind successful (0) User is not a member of "SeminaryAdmin" (0) if (Ldap-Group == "SeminaryAdmin") -> FALSE (0) [preprocess] = ok (0) [chap] = noop (0) [mschap] = noop (0) suffix: Checking for suffix after "@" (0) suffix: No '@' in User-Name = "ttester3", looking up realm NULL (0) suffix: No such realm "NULL" (0) [suffix] = noop (0) eap: No EAP-Message, not doing EAP (0) [eap] = noop (0) [files] = noop rlm_ldap (ldap): Reserved connection (1) (0) ldap: EXPAND (uid=%{%{Stripped-User-Name}:-%{User-Name}}) (0) ldap: --> (uid=ttester3) (0) ldap: Performing search in "ou=SeminaryOU,dc=seminary,dc=local" with filter "(uid=ttester3)", scope "sub" (0) ldap: Waiting for search result... (0) ldap: User object found at DN "cn=ttester3,cn=SeminaryAdmin,ou=SeminaryOU,dc=seminary,dc=local" (0) ldap: Processing user attributes (0) ldap: control:Password-With-Header += '{SSHA}4LVYfdr3D7MVe18YXQw+AixV9Xdb2plc' rlm_ldap (ldap): Released connection (1) (0) [ldap] = updated (0) [expiration] = noop (0) [logintime] = noop (0) pap: Converted: Password-With-Header -> SSHA1-Password (0) pap: Removing &control:Password-With-Header (0) pap: Normalizing SSHA1-Password from base64 encoding, 32 bytes -> 24 bytes (0) [pap] = updated (0) } # authorize = updated (0) Found Auth-Type = PAP (0) # Executing group from file /etc/freeradius/sites-enabled/default (0) Auth-Type PAP { (0) pap: Login attempt with password (0) pap: Comparing with "known-good" SSHA-Password (0) pap: User authenticated successfully (0) [pap] = ok (0) } # Auth-Type PAP = ok (0) # Executing section post-auth from file /etc/freeradius/sites-enabled/default (0) post-auth { (0) update { (0) No attributes updated (0) } # update = noop (0) if (Ldap-Group == "cn=SeminaryAdmin,ou=SeminaryOU,dc=seminary,dc=local") { (0) Searching for user in group "cn=SeminaryAdmin,ou=SeminaryOU,dc=seminary,dc=local" rlm_ldap (ldap): Reserved connection (2) (0) Using user DN from request "cn=ttester3,cn=SeminaryAdmin,ou=SeminaryOU,dc=seminary,dc=local" (0) Checking user object's memberOf attributes (0) Performing unfiltered search in "cn=ttester3,cn=SeminaryAdmin,ou=SeminaryOU,dc=seminary,dc=local", scope "base" (0) Waiting for search result... (0) No group membership attribute(s) found in user object rlm_ldap (ldap): Released connection (2) (0) User is not a member of "cn=SeminaryAdmin,ou=SeminaryOU,dc=seminary,dc=local" (0) if (Ldap-Group == "cn=SeminaryAdmin,ou=SeminaryOU,dc=seminary,dc=local") -> FALSE (0) ldap: EXPAND . (0) ldap: --> . (0) ldap: EXPAND Authenticated at %S (0) ldap: --> Authenticated at 2016-08-23 13:27:32 rlm_ldap (ldap): Reserved connection (3) (0) ldap: Using user DN from request "cn=ttester3,cn=SeminaryAdmin,ou=SeminaryOU,dc=seminary,dc=local" (0) ldap: Modifying object with DN "cn=ttester3,cn=SeminaryAdmin,ou=SeminaryOU,dc=seminary,dc=local" (0) ldap: Waiting for modify result... rlm_ldap (ldap): Released connection (3) (0) [ldap] = ok (0) [exec] = noop (0) policy remove_reply_message_if_eap { (0) if (&reply:EAP-Message && &reply:Reply-Message) { (0) if (&reply:EAP-Message && &reply:Reply-Message) -> FALSE (0) else { (0) [noop] = noop (0) } # else = noop (0) } # policy remove_reply_message_if_eap = noop (0) } # post-auth = ok (0) Sent Access-Accept Id 244 from 127.0.0.1:1812 to 127.0.0.1:55691 length 0 (0) Finished request Waking up in 4.9 seconds. radius@daloradius:~$
hi, from a quick glance..... your ldapsearch is using cn=ttester3 your FressRADIUS is using uid=ttester3 alan
Hi Unfortunately both cn and uid give the same result :( Was testing before and tried both combinations - hence the flawed paste. Matthew Pulis web: www.matthewpulis.info mob: +356 79539404 On Tue, Aug 23, 2016 at 1:42 PM, <A.L.M.Buxey@lboro.ac.uk> wrote:
hi,
from a quick glance.....
your ldapsearch is using cn=ttester3
your FressRADIUS is using uid=ttester3
alan
On Aug 23, 2016, at 8:18 AM, Matthew Pulis <mpulis@gmail.com> wrote:
Unfortunately both cn and uid give the same result :( Was testing before and tried both combinations - hence the flawed paste.
Then ask a local LDAP expert, or use a standard LDAP server, and a standard LDAP schema. I don't think we can help you here. Configuring FreeRADIUS to use LDAP should be a matter of 5 minutes. It looks like you don't have a standard LDAP schema, and you're not an LDAP expert. The combination makes it hard for us to help you remotely. Alan DeKok.
Dear Matt / Alex Thanks both for your help. The issue seems complicated .. and not sure why! This is slapcat (section ttester3): dn: cn=ttester3,cn=SeminaryAdmin,ou=SeminaryOU,dc=seminary,dc=local sn: Testing cn: ttester3 objectClass: inetOrgPerson objectClass: organizationalPerson objectClass: person objectClass: top structuralObjectClass: inetOrgPerson entryUUID: 42d2e1a8-fd6e-1035-856f-63ec2ba52e12 creatorsName: cn=admin,dc=seminary,dc=local createTimestamp: 20160823111245Z userPassword:: e1NTSEF9NExWWWZkcjNEN01WZTE4WVhRdytBaXhWOVhkYjJwbGM= uid: ttester3 description: Authenticated at 2016-08-23 13:27:32 entryCSN: 20160823112732.246710Z#000000#000#000000 modifyTimestamp: 20160823112732Z memberOf: cn=SeminaryAdmin,ou=SeminaryOU,dc=seminary,dc=local modifiersName: cn=admin,dc=seminary,dc=local My schema is pretty basic and very very vanilla. Am ready to restart from scratch if you have some useful tutorials :) Thanks Matthew Pulis web: www.matthewpulis.info mob: +356 79539404 On Tue, Aug 23, 2016 at 2:18 PM, Matthew Pulis <mpulis@gmail.com> wrote:
Hi
Unfortunately both cn and uid give the same result :( Was testing before and tried both combinations - hence the flawed paste.
Matthew Pulis web: www.matthewpulis.info mob: +356 79539404
On Tue, Aug 23, 2016 at 1:42 PM, <A.L.M.Buxey@lboro.ac.uk> wrote:
hi,
from a quick glance.....
your ldapsearch is using cn=ttester3
your FressRADIUS is using uid=ttester3
alan
On Tue, Aug 23, 2016 at 04:47:53PM +0200, Matthew Pulis wrote:
This is slapcat (section ttester3):
dn: cn=ttester3,cn=SeminaryAdmin,ou=SeminaryOU,dc=seminary,dc=local sn: Testing cn: ttester3 objectClass: inetOrgPerson objectClass: organizationalPerson objectClass: person objectClass: top structuralObjectClass: inetOrgPerson entryUUID: 42d2e1a8-fd6e-1035-856f-63ec2ba52e12 creatorsName: cn=admin,dc=seminary,dc=local createTimestamp: 20160823111245Z userPassword:: e1NTSEF9NExWWWZkcjNEN01WZTE4WVhRdytBaXhWOVhkYjJwbGM= uid: ttester3 description: Authenticated at 2016-08-23 13:27:32 entryCSN: 20160823112732.246710Z#000000#000#000000 modifyTimestamp: 20160823112732Z memberOf: cn=SeminaryAdmin,ou=SeminaryOU,dc=seminary,dc=local
OK, so memberOf is there.
modifiersName: cn=admin,dc=seminary,dc=local
...but your debug output shows it can't be found:
(0) Checking user object's memberOf attributes (0) Performing unfiltered search in "cn=ttester3,cn=SeminaryAdmin,ou=SeminaryOU,dc=seminary,dc=local", scope "base" (0) Waiting for search result... (0) No group membership attribute(s) found in user object
which would indicate there is a permission error - the user you are binding as doesn't have access to read the memberOf attribute. I don't think slapcat cares about permissions (so it can read everything)? - so not as helpful as ldapsearch. When the ldapsearch command I sent earlier (or similar) returns the memberOf attribute, you should be fine. Until then, it's an OpenLDAP config issue and nothing to do with FreeRADIUS. Matthew -- Matthew Newton, Ph.D. <mcn4@leicester.ac.uk> Systems Specialist, Infrastructure Services, I.T. Services, University of Leicester, Leicester LE1 7RH, United Kingdom For IT help contact helpdesk extn. 2253, <ithelp@le.ac.uk>
On Tue, Aug 23, 2016 at 01:32:30PM +0200, Matthew Pulis wrote:
radius@daloradius:~$ ldapsearch -h localhost -b dc=seminary,dc=local -s sub '(cn=ttester3)' ismemberOf -D "cn=admin,dc=seminary,dc=local" -w PASS
should be "memberOf", not "ismemberOf".
# extended LDIF # # LDAPv3 # base <dc=seminary,dc=local> with scope subtree # filter: (cn=ttester3) # requesting: ismemberOf #
# ttester3, SeminaryAdmin, SeminaryOU, seminary.local dn: cn=ttester3,cn=SeminaryAdmin,ou=SeminaryOU,dc=seminary,dc=local
# search result search: 2 result: 0 Success
# numResponses: 2 # numEntries: 1
What is the output from the following? ldapsearch -h localhost -b dc=seminary,dc=local -s sub '(cn=ttester3)' memberOf -D "cn=admin,dc=seminary,dc=local" -w PASS Does it include a memberOf attribute? If not, then you need to look at OpenLDAP again. Matthew -- Matthew Newton, Ph.D. <mcn4@leicester.ac.uk> Systems Specialist, Infrastructure Services, I.T. Services, University of Leicester, Leicester LE1 7RH, United Kingdom For IT help contact helpdesk extn. 2253, <ithelp@le.ac.uk>
Hi all It works!! Finally :) many many thanks to you Matthew and Alan! Much appreciated :) Am pasting all the logs here for future reference if someone is in the same situation like me! :) One needs to add the memberOf overlay, add the member attribute to the group and the memberOf of the user should be auto populated :) radius@daloradius:~$ radtest ttester3 openldap localhost 1812 testing456 Sent Access-Request Id 81 from 0.0.0.0:59558 to 127.0.0.1:1812 length 78 User-Name = "ttester3" User-Password = "openldap" NAS-IP-Address = 127.0.1.1 NAS-Port = 1812 Message-Authenticator = 0x00 Cleartext-Password = "openldap" Received Access-Accept Id 81 from 127.0.0.1:1812 to 0.0.0.0:0 length 36 Tunnel-Type:0 = VLAN Tunnel-Medium-Type:0 = 802 Tunnel-Private-Group-Id:0 = "12" radius@daloradius:~$ ldapsearch -h localhost -D "cn=admin,dc=seminary,dc=local" -b "cn=SeminaryAdmin,ou=SeminaryOU,dc=seminary,dc=local" -w PASS # extended LDIF # # LDAPv3 # base <cn=SeminaryAdmin,ou=SeminaryOU,dc=seminary,dc=local> with scope subtree # filter: (objectclass=*) # requesting: ALL # # SeminaryAdmin, SeminaryOU, seminary.local dn: cn=SeminaryAdmin,ou=SeminaryOU,dc=seminary,dc=local objectClass: groupOfNames cn: SeminaryAdmin description: All users in SeminaryAdmin member: cn=ttester3,cn=SeminaryAdmin,ou=SeminaryOU,dc=seminary,dc=local <================== MEMBER member: cn=ttester4,cn=SeminaryAdmin,ou=SeminaryOU,dc=seminary,dc=local # ttester3, SeminaryAdmin, SeminaryOU, seminary.local dn: cn=ttester3,cn=SeminaryAdmin,ou=SeminaryOU,dc=seminary,dc=local sn: Testing cn: ttester3 objectClass: inetOrgPerson objectClass: organizationalPerson objectClass: person objectClass: top userPassword:: e1NTSEF9NExWWWZkcjNEN01WZTE4WVhRdytBaXhWOVhkYjJwbGM= uid: ttester3 description: Authenticated at 2016-08-23 13:27:32 <============== NO MEMBEROF # ttester4, SeminaryAdmin, SeminaryOU, seminary.local dn: cn=ttester4,cn=SeminaryAdmin,ou=SeminaryOU,dc=seminary,dc=local uid: ttester3 description: Authenticated at 2016-08-23 13:27:32 sn: Testing cn: ttester4 objectClass: inetOrgPerson objectClass: organizationalPerson objectClass: person objectClass: top userPassword:: e1NTSEF9NExWWWZkcjNEN01WZTE4WVhRdytBaXhWOVhkYjJwbGM= # search result search: 2 result: 0 Success # numResponses: 4 # numEntries: 3 radius@daloradius:~$ radius@daloradius:~$ ldapsearch -h localhost -b dc=seminary,dc=local -s sub '(cn=ttester3)' memberOf -D "cn=admin,dc=seminary,dc=local" -w PASS # extended LDIF # # LDAPv3 # base <dc=seminary,dc=local> with scope subtree # filter: (cn=ttester3) # requesting: memberOf # # ttester3, SeminaryAdmin, SeminaryOU, seminary.local dn: cn=ttester3,cn=SeminaryAdmin,ou=SeminaryOU,dc=seminary,dc=local memberOf: cn=SeminaryAdmin,ou=SeminaryOU,dc=seminary,dc=local <========= MEMBER OF # search result search: 2 result: 0 Success # numResponses: 2 # numEntries: 1 radius@daloradius:~$ ldapsearch -h localhost -b dc=seminary,dc=local -s sub '(cn=ttester3)' memberOf -D "cn=admin,dc=seminary,dc=local" -w PASS # extended LDIF # # LDAPv3 # base <dc=seminary,dc=local> with scope subtree # filter: (cn=ttester3) # requesting: memberOf # # ttester3, SeminaryAdmin, SeminaryOU, seminary.local dn: cn=ttester3,cn=SeminaryAdmin,ou=SeminaryOU,dc=seminary,dc=local memberOf: cn=SeminaryAdmin,ou=SeminaryOU,dc=seminary,dc=local <========= MEMBEROF # search result search: 2 result: 0 Success # numResponses: 2 # numEntries: 1 radius@daloradius:~$ and the freeradius log: radius@daloradius:~$ sudo freeradius -X [sudo] password for radius: Server was built with: accounting : yes authentication : yes ascend-binary-attributes : yes coa : yes control-socket : yes detail : yes dhcp : yes dynamic-clients : yes osfc2 : no proxy : yes regex-pcre : no regex-posix : yes regex-posix-extended : yes session-management : yes stats : yes tcp : yes threads : yes tls : yes unlang : yes vmps : yes developer : no Server core libs: freeradius-server : 3.0.11 talloc : 2.0.* ssl : 1.0.2g release Endianness: little Compilation flags: cppflags : -Wdate-time -D_FORTIFY_SOURCE=2 cflags : -I/build/freeradius-G88Mfz/freeradius-3.0.11 -I/build/freeradius-G88Mfz/freeradius-3.0.11/src -include /build/freeradius-G88Mfz/freeradius-3.0.11/src/freeradius-devel/autoconf.h -include /build/freeradius-G88Mfz/freeradius-3.0.11/src/freeradius-devel/build.h -include /build/freeradius-G88Mfz/freeradius-3.0.11/src/freeradius-devel/features.h -include /build/freeradius-G88Mfz/freeradius-3.0.11/src/freeradius-devel/radpaths.h -fno-strict-aliasing -g -O2 -fstack-protector-strong -Wformat -Werror=format-security -O2 -Wall -std=c99 -D_GNU_SOURCE -D_REENTRANT -D_POSIX_PTHREAD_SEMANTICS -DOPENSSL_NO_KRB5 -DNDEBUG -DIS_MODULE=1 ldflags : -Wl,-Bsymbolic-functions -Wl,-z,relro libs : -lcrypto -lssl -ltalloc -lcap -lnsl -lresolv -ldl -lpthread -lreadline Copyright (C) 1999-2016 The FreeRADIUS server project and contributors There is NO warranty; not even for MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE You may redistribute copies of FreeRADIUS under the terms of the GNU General Public License For more information about these matters, see the file named COPYRIGHT Starting - reading configuration files ... including dictionary file /usr/share/freeradius/dictionary including dictionary file /usr/share/freeradius/dictionary.dhcp including dictionary file /usr/share/freeradius/dictionary.vqp including dictionary file /etc/freeradius/dictionary including configuration file /etc/freeradius/radiusd.conf including configuration file /etc/freeradius/proxy.conf including configuration file /etc/freeradius/clients.conf including files in directory /etc/freeradius/mods-enabled/ including configuration file /etc/freeradius/mods-enabled/mschap including configuration file /etc/freeradius/mods-enabled/always including configuration file /etc/freeradius/mods-enabled/soh including configuration file /etc/freeradius/mods-enabled/eap including configuration file /etc/freeradius/mods-enabled/dynamic_clients including configuration file /etc/freeradius/mods-enabled/logintime including configuration file /etc/freeradius/mods-enabled/exec including configuration file /etc/freeradius/mods-enabled/realm including configuration file /etc/freeradius/mods-enabled/utf8 including configuration file /etc/freeradius/mods-enabled/echo including configuration file /etc/freeradius/mods-enabled/unix including configuration file /etc/freeradius/mods-enabled/detail.log including configuration file /etc/freeradius/mods-enabled/expr including configuration file /etc/freeradius/mods-enabled/ntlm_auth including configuration file /etc/freeradius/mods-enabled/pap including configuration file /etc/freeradius/mods-enabled/ldap including configuration file /etc/freeradius/mods-enabled/digest including configuration file /etc/freeradius/mods-enabled/files including configuration file /etc/freeradius/mods-enabled/preprocess including configuration file /etc/freeradius/mods-enabled/cache_eap including configuration file /etc/freeradius/mods-enabled/detail including configuration file /etc/freeradius/mods-enabled/expiration including configuration file /etc/freeradius/mods-enabled/chap including configuration file /etc/freeradius/mods-enabled/sradutmp including configuration file /etc/freeradius/mods-enabled/radutmp including configuration file /etc/freeradius/mods-enabled/passwd including configuration file /etc/freeradius/mods-enabled/linelog including configuration file /etc/freeradius/mods-enabled/unpack including configuration file /etc/freeradius/mods-enabled/attr_filter including configuration file /etc/freeradius/mods-enabled/replicate including files in directory /etc/freeradius/policy.d/ including configuration file /etc/freeradius/policy.d/filter including configuration file /etc/freeradius/policy.d/control including configuration file /etc/freeradius/policy.d/canonicalization including configuration file /etc/freeradius/policy.d/eap including configuration file /etc/freeradius/policy.d/debug including configuration file /etc/freeradius/policy.d/dhcp including configuration file /etc/freeradius/policy.d/accounting including configuration file /etc/freeradius/policy.d/abfab-tr including configuration file /etc/freeradius/policy.d/cui including configuration file /etc/freeradius/policy.d/operator-name including files in directory /etc/freeradius/sites-enabled/ including configuration file /etc/freeradius/sites-enabled/inner-tunnel including configuration file /etc/freeradius/sites-enabled/default main { security { user = "freerad" group = "freerad" allow_core_dumps = no } name = "freeradius" prefix = "/usr" localstatedir = "/var" logdir = "/var/log/freeradius" run_dir = "/var/run/freeradius" } main { name = "freeradius" prefix = "/usr" localstatedir = "/var" sbindir = "/usr/sbin" logdir = "/var/log/freeradius" run_dir = "/var/run/freeradius" libdir = "/usr/lib/freeradius" radacctdir = "/var/log/freeradius/radacct" hostname_lookups = no max_request_time = 30 cleanup_delay = 5 max_requests = 16384 pidfile = "/var/run/freeradius/freeradius.pid" checkrad = "/usr/sbin/checkrad" debug_level = 0 proxy_requests = yes log { stripped_names = no auth = no auth_badpass = no auth_goodpass = no colourise = yes msg_denied = "You are already logged in - access denied" } resources { } security { max_attributes = 200 reject_delay = 1.000000 status_server = yes } } radiusd: #### Loading Realms and Home Servers #### proxy server { retry_delay = 5 retry_count = 3 default_fallback = no dead_time = 120 wake_all_if_all_dead = no } home_server localhost { ipaddr = 127.0.0.1 port = 1812 type = "auth" secret = <<< secret >>> response_window = 20.000000 response_timeouts = 1 max_outstanding = 65536 zombie_period = 40 status_check = "status-server" ping_interval = 30 check_interval = 30 check_timeout = 4 num_answers_to_alive = 3 revive_interval = 120 limit { max_connections = 16 max_requests = 0 lifetime = 0 idle_timeout = 0 } coa { irt = 2 mrt = 16 mrc = 5 mrd = 30 } } home_server_pool my_auth_failover { type = fail-over home_server = localhost } realm example.com { auth_pool = my_auth_failover } realm LOCAL { } radiusd: #### Loading Clients #### client localhost { ipaddr = 127.0.0.1 require_message_authenticator = no secret = <<< secret >>> nas_type = "other" proto = "*" limit { max_connections = 16 lifetime = 0 idle_timeout = 30 } } client localhost_ipv6 { ipv6addr = ::1 require_message_authenticator = no secret = <<< secret >>> limit { max_connections = 16 lifetime = 0 idle_timeout = 30 } } client 192.168.100.0/24 { require_message_authenticator = no secret = <<< secret >>> shortname = "NAS" limit { max_connections = 16 lifetime = 0 idle_timeout = 30 } } No 'ipaddr' or 'ipv4addr' or 'ipv6addr' field found in client 192.168.100.0/24. Please fix your configuration Support for old-style clients will be removed in a future release Debugger not attached # Creating Auth-Type = PAP # Creating Auth-Type = CHAP # Creating Auth-Type = MS-CHAP # Creating Auth-Type = eap # Creating Auth-Type = digest radiusd: #### Instantiating modules #### modules { # Loaded module rlm_mschap # Loading module "mschap" from file /etc/freeradius/mods-enabled/mschap mschap { use_mppe = yes require_encryption = no require_strong = no with_ntdomain_hack = yes passchange { } allow_retry = yes } # Loaded module rlm_always # Loading module "reject" from file /etc/freeradius/mods-enabled/always always reject { rcode = "reject" simulcount = 0 mpp = no } # Loading module "fail" from file /etc/freeradius/mods-enabled/always always fail { rcode = "fail" simulcount = 0 mpp = no } # Loading module "ok" from file /etc/freeradius/mods-enabled/always always ok { rcode = "ok" simulcount = 0 mpp = no } # Loading module "handled" from file /etc/freeradius/mods-enabled/always always handled { rcode = "handled" simulcount = 0 mpp = no } # Loading module "invalid" from file /etc/freeradius/mods-enabled/always always invalid { rcode = "invalid" simulcount = 0 mpp = no } # Loading module "userlock" from file /etc/freeradius/mods-enabled/always always userlock { rcode = "userlock" simulcount = 0 mpp = no } # Loading module "notfound" from file /etc/freeradius/mods-enabled/always always notfound { rcode = "notfound" simulcount = 0 mpp = no } # Loading module "noop" from file /etc/freeradius/mods-enabled/always always noop { rcode = "noop" simulcount = 0 mpp = no } # Loading module "updated" from file /etc/freeradius/mods-enabled/always always updated { rcode = "updated" simulcount = 0 mpp = no } # Loaded module rlm_soh # Loading module "soh" from file /etc/freeradius/mods-enabled/soh soh { dhcp = yes } # Loaded module rlm_eap # Loading module "eap" from file /etc/freeradius/mods-enabled/eap eap { default_eap_type = "md5" timer_expire = 60 ignore_unknown_eap_types = no cisco_accounting_username_bug = no max_sessions = 16384 } # Loaded module rlm_dynamic_clients # Loading module "dynamic_clients" from file /etc/freeradius/mods-enabled/dynamic_clients # Loaded module rlm_logintime # Loading module "logintime" from file /etc/freeradius/mods-enabled/logintime logintime { minimum_timeout = 60 } # Loaded module rlm_exec # Loading module "exec" from file /etc/freeradius/mods-enabled/exec exec { wait = no input_pairs = "request" shell_escape = yes timeout = 10 } # Loaded module rlm_realm # Loading module "IPASS" from file /etc/freeradius/mods-enabled/realm realm IPASS { format = "prefix" delimiter = "/" ignore_default = no ignore_null = no } # Loading module "suffix" from file /etc/freeradius/mods-enabled/realm realm suffix { format = "suffix" delimiter = "@" ignore_default = no ignore_null = no } # Loading module "realmpercent" from file /etc/freeradius/mods-enabled/realm realm realmpercent { format = "suffix" delimiter = "%" ignore_default = no ignore_null = no } # Loading module "ntdomain" from file /etc/freeradius/mods-enabled/realm realm ntdomain { format = "prefix" delimiter = "\\" ignore_default = no ignore_null = no } # Loaded module rlm_utf8 # Loading module "utf8" from file /etc/freeradius/mods-enabled/utf8 # Loading module "echo" from file /etc/freeradius/mods-enabled/echo exec echo { wait = yes program = "/bin/echo %{User-Name}" input_pairs = "request" output_pairs = "reply" shell_escape = yes } # Loaded module rlm_unix # Loading module "unix" from file /etc/freeradius/mods-enabled/unix unix { radwtmp = "/var/log/freeradius/radwtmp" } Creating attribute Unix-Group # Loaded module rlm_detail # Loading module "auth_log" from file /etc/freeradius/mods-enabled/detail.log detail auth_log { filename = "/var/log/freeradius/radacct/%{%{Packet-Src-IP-Address}:-%{Packet-Src-IPv6-Address}}/auth-detail-%Y%m%d" header = "%t" permissions = 384 locking = no escape_filenames = no log_packet_header = no } # Loading module "reply_log" from file /etc/freeradius/mods-enabled/detail.log detail reply_log { filename = "/var/log/freeradius/radacct/%{%{Packet-Src-IP-Address}:-%{Packet-Src-IPv6-Address}}/reply-detail-%Y%m%d" header = "%t" permissions = 384 locking = no escape_filenames = no log_packet_header = no } # Loading module "pre_proxy_log" from file /etc/freeradius/mods-enabled/detail.log detail pre_proxy_log { filename = "/var/log/freeradius/radacct/%{%{Packet-Src-IP-Address}:-%{Packet-Src-IPv6-Address}}/pre-proxy-detail-%Y%m%d" header = "%t" permissions = 384 locking = no escape_filenames = no log_packet_header = no } # Loading module "post_proxy_log" from file /etc/freeradius/mods-enabled/detail.log detail post_proxy_log { filename = "/var/log/freeradius/radacct/%{%{Packet-Src-IP-Address}:-%{Packet-Src-IPv6-Address}}/post-proxy-detail-%Y%m%d" header = "%t" permissions = 384 locking = no escape_filenames = no log_packet_header = no } # Loaded module rlm_expr # Loading module "expr" from file /etc/freeradius/mods-enabled/expr expr { safe_characters = "@abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ0123456789.-_: /äéöüàâæçèéêëîïôœùûüaÿÄÉÖÜßÀÂÆÇÈÉÊËÎÏÔŒÙÛÜŸ" } # Loading module "ntlm_auth" from file /etc/freeradius/mods-enabled/ntlm_auth exec ntlm_auth { wait = yes program = "/path/to/ntlm_auth --request-nt-key --domain=MYDOMAIN --username=%{mschap:User-Name} --password=%{User-Password}" shell_escape = yes } # Loaded module rlm_pap # Loading module "pap" from file /etc/freeradius/mods-enabled/pap pap { normalise = yes } # Loaded module rlm_ldap # Loading module "ldap" from file /etc/freeradius/mods-enabled/ldap ldap { server = "localhost" identity = "cn=admin,dc=seminary,dc=local" password = <<< secret >>> sasl { } user { scope = "sub" access_positive = yes sasl { } } group { filter = "(objectClass=posixGroup)" scope = "sub" name_attribute = "cn" membership_attribute = "memberOf" cacheable_name = no cacheable_dn = no } client { filter = "(objectClass=radiusClient)" scope = "sub" base_dn = "ou=SeminaryOU,dc=seminary,dc=local" } profile { } options { ldap_debug = 40 chase_referrals = yes rebind = yes net_timeout = 1 res_timeout = 10 srv_timelimit = 3 idle = 60 probes = 3 interval = 3 } tls { start_tls = no } } Creating attribute LDAP-Group # Loaded module rlm_digest # Loading module "digest" from file /etc/freeradius/mods-enabled/digest # Loaded module rlm_files # Loading module "files" from file /etc/freeradius/mods-enabled/files files { filename = "/etc/freeradius/mods-config/files/authorize" acctusersfile = "/etc/freeradius/mods-config/files/accounting" preproxy_usersfile = "/etc/freeradius/mods-config/files/pre-proxy" } # Loaded module rlm_preprocess # Loading module "preprocess" from file /etc/freeradius/mods-enabled/preprocess preprocess { huntgroups = "/etc/freeradius/mods-config/preprocess/huntgroups" hints = "/etc/freeradius/mods-config/preprocess/hints" with_ascend_hack = no ascend_channels_per_line = 23 with_ntdomain_hack = no with_specialix_jetstream_hack = no with_cisco_vsa_hack = no with_alvarion_vsa_hack = no } # Loaded module rlm_cache # Loading module "cache_eap" from file /etc/freeradius/mods-enabled/cache_eap cache cache_eap { driver = "rlm_cache_rbtree" key = "%{%{control:State}:-%{%{reply:State}:-%{State}}}" ttl = 15 max_entries = 0 epoch = 0 add_stats = no } # Loading module "detail" from file /etc/freeradius/mods-enabled/detail detail { filename = "/var/log/freeradius/radacct/%{%{Packet-Src-IP-Address}:-%{Packet-Src-IPv6-Address}}/detail-%Y%m%d" header = "%t" permissions = 384 locking = no escape_filenames = no log_packet_header = no } # Loaded module rlm_expiration # Loading module "expiration" from file /etc/freeradius/mods-enabled/expiration # Loaded module rlm_chap # Loading module "chap" from file /etc/freeradius/mods-enabled/chap # Loaded module rlm_radutmp # Loading module "sradutmp" from file /etc/freeradius/mods-enabled/sradutmp radutmp sradutmp { filename = "/var/log/freeradius/sradutmp" username = "%{User-Name}" case_sensitive = yes check_with_nas = yes permissions = 420 caller_id = no } # Loading module "radutmp" from file /etc/freeradius/mods-enabled/radutmp radutmp { filename = "/var/log/freeradius/radutmp" username = "%{User-Name}" case_sensitive = yes check_with_nas = yes permissions = 384 caller_id = yes } # Loaded module rlm_passwd # Loading module "etc_passwd" from file /etc/freeradius/mods-enabled/passwd passwd etc_passwd { filename = "/etc/passwd" format = "*User-Name:Crypt-Password:" delimiter = ":" ignore_nislike = no ignore_empty = yes allow_multiple_keys = no hash_size = 100 } # Loaded module rlm_linelog # Loading module "linelog" from file /etc/freeradius/mods-enabled/linelog linelog { filename = "/var/log/freeradius/linelog" escape_filenames = no syslog_severity = "info" permissions = 384 format = "This is a log message for %{User-Name}" reference = "messages.%{%{reply:Packet-Type}:-default}" } # Loading module "log_accounting" from file /etc/freeradius/mods-enabled/linelog linelog log_accounting { filename = "/var/log/freeradius/linelog-accounting" escape_filenames = no syslog_severity = "info" permissions = 384 format = "" reference = "Accounting-Request.%{%{Acct-Status-Type}:-unknown}" } # Loaded module rlm_unpack # Loading module "unpack" from file /etc/freeradius/mods-enabled/unpack # Loaded module rlm_attr_filter # Loading module "attr_filter.post-proxy" from file /etc/freeradius/mods-enabled/attr_filter attr_filter attr_filter.post-proxy { filename = "/etc/freeradius/mods-config/attr_filter/post-proxy" key = "%{Realm}" relaxed = no } # Loading module "attr_filter.pre-proxy" from file /etc/freeradius/mods-enabled/attr_filter attr_filter attr_filter.pre-proxy { filename = "/etc/freeradius/mods-config/attr_filter/pre-proxy" key = "%{Realm}" relaxed = no } # Loading module "attr_filter.access_reject" from file /etc/freeradius/mods-enabled/attr_filter attr_filter attr_filter.access_reject { filename = "/etc/freeradius/mods-config/attr_filter/access_reject" key = "%{User-Name}" relaxed = no } # Loading module "attr_filter.access_challenge" from file /etc/freeradius/mods-enabled/attr_filter attr_filter attr_filter.access_challenge { filename = "/etc/freeradius/mods-config/attr_filter/access_challenge" key = "%{User-Name}" relaxed = no } # Loading module "attr_filter.accounting_response" from file /etc/freeradius/mods-enabled/attr_filter attr_filter attr_filter.accounting_response { filename = "/etc/freeradius/mods-config/attr_filter/accounting_response" key = "%{User-Name}" relaxed = no } # Loaded module rlm_replicate # Loading module "replicate" from file /etc/freeradius/mods-enabled/replicate instantiate { } # Instantiating module "mschap" from file /etc/freeradius/mods-enabled/mschap rlm_mschap (mschap): using internal authentication # Instantiating module "reject" from file /etc/freeradius/mods-enabled/always # Instantiating module "fail" from file /etc/freeradius/mods-enabled/always # Instantiating module "ok" from file /etc/freeradius/mods-enabled/always # Instantiating module "handled" from file /etc/freeradius/mods-enabled/always # Instantiating module "invalid" from file /etc/freeradius/mods-enabled/always # Instantiating module "userlock" from file /etc/freeradius/mods-enabled/always # Instantiating module "notfound" from file /etc/freeradius/mods-enabled/always # Instantiating module "noop" from file /etc/freeradius/mods-enabled/always # Instantiating module "updated" from file /etc/freeradius/mods-enabled/always # Instantiating module "eap" from file /etc/freeradius/mods-enabled/eap # Linked to sub-module rlm_eap_md5 # Linked to sub-module rlm_eap_leap # Linked to sub-module rlm_eap_gtc gtc { challenge = "Password: " auth_type = "PAP" } # Linked to sub-module rlm_eap_tls tls { tls = "tls-common" } tls-config tls-common { verify_depth = 0 ca_path = "/etc/freeradius/certs" pem_file_type = yes private_key_file = "/etc/freeradius/certs/server.pem" certificate_file = "/etc/freeradius/certs/server.pem" ca_file = "/etc/freeradius/certs/ca.pem" private_key_password = <<< secret >>> dh_file = "/etc/freeradius/certs/dh" fragment_size = 1024 include_length = yes auto_chain = yes check_crl = no check_all_crl = no cipher_list = "DEFAULT" ecdh_curve = "prime256v1" cache { enable = yes lifetime = 24 max_entries = 255 } verify { skip_if_ocsp_ok = no } ocsp { enable = no override_cert_url = yes url = "http://127.0.0.1/ocsp/" use_nonce = yes timeout = 0 softfail = no } } # Linked to sub-module rlm_eap_ttls ttls { tls = "tls-common" default_eap_type = "md5" copy_request_to_tunnel = no use_tunneled_reply = no virtual_server = "inner-tunnel" include_length = yes require_client_cert = no } tls: Using cached TLS configuration from previous invocation # Linked to sub-module rlm_eap_peap peap { tls = "tls-common" default_eap_type = "mschapv2" copy_request_to_tunnel = no use_tunneled_reply = no proxy_tunneled_request_as_eap = yes virtual_server = "inner-tunnel" soh = no require_client_cert = no } tls: Using cached TLS configuration from previous invocation # Linked to sub-module rlm_eap_mschapv2 mschapv2 { with_ntdomain_hack = no send_error = no } # Instantiating module "logintime" from file /etc/freeradius/mods-enabled/logintime # Instantiating module "IPASS" from file /etc/freeradius/mods-enabled/realm # Instantiating module "suffix" from file /etc/freeradius/mods-enabled/realm # Instantiating module "realmpercent" from file /etc/freeradius/mods-enabled/realm # Instantiating module "ntdomain" from file /etc/freeradius/mods-enabled/realm # Instantiating module "auth_log" from file /etc/freeradius/mods-enabled/detail.log rlm_detail (auth_log): 'User-Password' suppressed, will not appear in detail output # Instantiating module "reply_log" from file /etc/freeradius/mods-enabled/detail.log # Instantiating module "pre_proxy_log" from file /etc/freeradius/mods-enabled/detail.log # Instantiating module "post_proxy_log" from file /etc/freeradius/mods-enabled/detail.log # Instantiating module "pap" from file /etc/freeradius/mods-enabled/pap # Instantiating module "ldap" from file /etc/freeradius/mods-enabled/ldap rlm_ldap: libldap vendor: OpenLDAP, version: 20442 accounting { reference = "%{tolower:type.%{Acct-Status-Type}}" } post-auth { reference = "." } rlm_ldap (ldap): Initialising connection pool pool { start = 5 min = 3 max = 32 spare = 10 uses = 0 lifetime = 0 cleanup_interval = 30 idle_timeout = 60 retry_delay = 30 spread = no } rlm_ldap (ldap): Opening additional connection (0), 1 of 32 pending slots used rlm_ldap (ldap): Connecting to ldap://localhost:389 rlm_ldap (ldap): Waiting for bind result... rlm_ldap (ldap): Bind successful rlm_ldap (ldap): Opening additional connection (1), 1 of 31 pending slots used rlm_ldap (ldap): Connecting to ldap://localhost:389 rlm_ldap (ldap): Waiting for bind result... rlm_ldap (ldap): Bind successful rlm_ldap (ldap): Opening additional connection (2), 1 of 30 pending slots used rlm_ldap (ldap): Connecting to ldap://localhost:389 rlm_ldap (ldap): Waiting for bind result... rlm_ldap (ldap): Bind successful rlm_ldap (ldap): Opening additional connection (3), 1 of 29 pending slots used rlm_ldap (ldap): Connecting to ldap://localhost:389 rlm_ldap (ldap): Waiting for bind result... rlm_ldap (ldap): Bind successful rlm_ldap (ldap): Opening additional connection (4), 1 of 28 pending slots used rlm_ldap (ldap): Connecting to ldap://localhost:389 rlm_ldap (ldap): Waiting for bind result... rlm_ldap (ldap): Bind successful # Instantiating module "files" from file /etc/freeradius/mods-enabled/files reading pairlist file /etc/freeradius/mods-config/files/authorize reading pairlist file /etc/freeradius/mods-config/files/accounting reading pairlist file /etc/freeradius/mods-config/files/pre-proxy # Instantiating module "preprocess" from file /etc/freeradius/mods-enabled/preprocess reading pairlist file /etc/freeradius/mods-config/preprocess/huntgroups reading pairlist file /etc/freeradius/mods-config/preprocess/hints # Instantiating module "cache_eap" from file /etc/freeradius/mods-enabled/cache_eap rlm_cache (cache_eap): Driver rlm_cache_rbtree (module rlm_cache_rbtree) loaded and linked # Instantiating module "detail" from file /etc/freeradius/mods-enabled/detail # Instantiating module "expiration" from file /etc/freeradius/mods-enabled/expiration # Instantiating module "etc_passwd" from file /etc/freeradius/mods-enabled/passwd rlm_passwd: nfields: 3 keyfield 0(User-Name) listable: no # Instantiating module "linelog" from file /etc/freeradius/mods-enabled/linelog # Instantiating module "log_accounting" from file /etc/freeradius/mods-enabled/linelog # Instantiating module "attr_filter.post-proxy" from file /etc/freeradius/mods-enabled/attr_filter reading pairlist file /etc/freeradius/mods-config/attr_filter/post-proxy # Instantiating module "attr_filter.pre-proxy" from file /etc/freeradius/mods-enabled/attr_filter reading pairlist file /etc/freeradius/mods-config/attr_filter/pre-proxy # Instantiating module "attr_filter.access_reject" from file /etc/freeradius/mods-enabled/attr_filter reading pairlist file /etc/freeradius/mods-config/attr_filter/access_reject [/etc/freeradius/mods-config/attr_filter/access_reject]:11 Check item "FreeRADIUS-Response-Delay" found in filter list for realm "DEFAULT". [/etc/freeradius/mods-config/attr_filter/access_reject]:11 Check item "FreeRADIUS-Response-Delay-USec" found in filter list for realm "DEFAULT". # Instantiating module "attr_filter.access_challenge" from file /etc/freeradius/mods-enabled/attr_filter reading pairlist file /etc/freeradius/mods-config/attr_filter/access_challenge # Instantiating module "attr_filter.accounting_response" from file /etc/freeradius/mods-enabled/attr_filter reading pairlist file /etc/freeradius/mods-config/attr_filter/accounting_response } # modules radiusd: #### Loading Virtual Servers #### server { # from file /etc/freeradius/radiusd.conf } # server server inner-tunnel { # from file /etc/freeradius/sites-enabled/inner-tunnel # Loading authenticate {...} # Loading authorize {...} # Loading session {...} # Loading post-proxy {...} # Loading post-auth {...} Ignoring "sql" (see raddb/mods-available/README.rst) } # server inner-tunnel server default { # from file /etc/freeradius/sites-enabled/default # Loading authenticate {...} # Loading authorize {...} # Loading preacct {...} # Loading accounting {...} # Loading post-proxy {...} # Loading post-auth {...} } # server default radiusd: #### Opening IP addresses and Ports #### listen { type = "auth" ipaddr = 127.0.0.1 port = 18120 } listen { type = "auth" ipaddr = * port = 0 limit { max_connections = 16 lifetime = 0 idle_timeout = 30 } } listen { type = "acct" ipaddr = * port = 0 limit { max_connections = 16 lifetime = 0 idle_timeout = 30 } } listen { type = "auth" ipv6addr = :: port = 0 limit { max_connections = 16 lifetime = 0 idle_timeout = 30 } } listen { type = "acct" ipv6addr = :: port = 0 limit { max_connections = 16 lifetime = 0 idle_timeout = 30 } } Listening on auth address 127.0.0.1 port 18120 bound to server inner-tunnel Listening on auth address * port 1812 bound to server default Listening on acct address * port 1813 bound to server default Listening on auth address :: port 1812 bound to server default Listening on acct address :: port 1813 bound to server default Listening on proxy address * port 43117 Listening on proxy address :: port 60030 Ready to process requests (0) Received Access-Request Id 81 from 127.0.0.1:59558 to 127.0.0.1:1812 length 78 (0) User-Name = "ttester3" (0) User-Password = "openldap" (0) NAS-IP-Address = 127.0.1.1 (0) NAS-Port = 1812 (0) Message-Authenticator = 0x244c711d7ed72119acefc7a5b5517ca8 (0) # Executing section authorize from file /etc/freeradius/sites-enabled/default (0) authorize { (0) policy filter_username { (0) if (&User-Name) { (0) if (&User-Name) -> TRUE (0) if (&User-Name) { (0) if (&User-Name =~ / /) { (0) if (&User-Name =~ / /) -> FALSE (0) if (&User-Name =~ /@[^@]*@/ ) { (0) if (&User-Name =~ /@[^@]*@/ ) -> FALSE (0) if (&User-Name =~ /\.\./ ) { (0) if (&User-Name =~ /\.\./ ) -> FALSE (0) if ((&User-Name =~ /@/) && (&User-Name !~ /@(.+)\.(.+)$/)) { (0) if ((&User-Name =~ /@/) && (&User-Name !~ /@(.+)\.(.+)$/)) -> FALSE (0) if (&User-Name =~ /\.$/) { (0) if (&User-Name =~ /\.$/) -> FALSE (0) if (&User-Name =~ /@\./) { (0) if (&User-Name =~ /@\./) -> FALSE (0) } # if (&User-Name) = notfound (0) } # policy filter_username = notfound (0) if (Ldap-Group == "SeminaryAdmin") { (0) Searching for user in group "SeminaryAdmin" rlm_ldap (ldap): Reserved connection (0) (0) EXPAND (uid=%{%{Stripped-User-Name}:-%{User-Name}}) (0) --> (uid=ttester3) (0) Performing search in "ou=SeminaryOU,dc=seminary,dc=local" with filter "(uid=ttester3)", scope "sub" (0) Waiting for search result... (0) User object found at DN "cn=ttester3,cn=SeminaryAdmin,ou=SeminaryOU,dc=seminary,dc=local" (0) Checking user object's memberOf attributes (0) Performing unfiltered search in "cn=ttester3,cn=SeminaryAdmin,ou=SeminaryOU,dc=seminary,dc=local", scope "base" (0) Waiting for search result... (0) Processing memberOf value "cn=SeminaryAdmin,ou=SeminaryOU,dc=seminary,dc=local" as a DN (0) Resolving group DN "cn=SeminaryAdmin,ou=SeminaryOU,dc=seminary,dc=local" to group name (0) Performing unfiltered search in "cn=SeminaryAdmin,ou=SeminaryOU,dc=seminary,dc=local", scope "base" (0) Waiting for search result... (0) Group DN "cn=SeminaryAdmin,ou=SeminaryOU,dc=seminary,dc=local" resolves to name "SeminaryAdmin" (0) User found in group "SeminaryAdmin". Comparison between membership: name (resolved from DN "cn=SeminaryAdmin,ou=SeminaryOU,dc=seminary,dc=local"), check: name rlm_ldap (ldap): Released connection (0) rlm_ldap (ldap): Need 5 more connections to reach 10 spares rlm_ldap (ldap): Opening additional connection (5), 1 of 27 pending slots used rlm_ldap (ldap): Connecting to ldap://localhost:389 rlm_ldap (ldap): Waiting for bind result... rlm_ldap (ldap): Bind successful (0) if (Ldap-Group == "SeminaryAdmin") -> TRUE (0) if (Ldap-Group == "SeminaryAdmin") { (0) [ok] = ok (0) } # if (Ldap-Group == "SeminaryAdmin") = ok (0) [preprocess] = ok (0) [chap] = noop (0) [mschap] = noop (0) suffix: Checking for suffix after "@" (0) suffix: No '@' in User-Name = "ttester3", looking up realm NULL (0) suffix: No such realm "NULL" (0) [suffix] = noop (0) eap: No EAP-Message, not doing EAP (0) [eap] = noop (0) [files] = noop rlm_ldap (ldap): Reserved connection (1) (0) ldap: EXPAND (uid=%{%{Stripped-User-Name}:-%{User-Name}}) (0) ldap: --> (uid=ttester3) (0) ldap: Performing search in "ou=SeminaryOU,dc=seminary,dc=local" with filter "(uid=ttester3)", scope "sub" (0) ldap: Waiting for search result... (0) ldap: User object found at DN "cn=ttester3,cn=SeminaryAdmin,ou=SeminaryOU,dc=seminary,dc=local" (0) ldap: Processing user attributes (0) ldap: control:Password-With-Header += '{SSHA}4LVYfdr3D7MVe18YXQw+AixV9Xdb2plc' rlm_ldap (ldap): Released connection (1) (0) [ldap] = updated (0) [expiration] = noop (0) [logintime] = noop (0) pap: Converted: Password-With-Header -> SSHA1-Password (0) pap: Removing &control:Password-With-Header (0) pap: Normalizing SSHA1-Password from base64 encoding, 32 bytes -> 24 bytes (0) [pap] = updated (0) } # authorize = updated (0) Found Auth-Type = PAP (0) # Executing group from file /etc/freeradius/sites-enabled/default (0) Auth-Type PAP { (0) pap: Login attempt with password (0) pap: Comparing with "known-good" SSHA-Password (0) pap: User authenticated successfully (0) [pap] = ok (0) } # Auth-Type PAP = ok (0) # Executing section post-auth from file /etc/freeradius/sites-enabled/default (0) post-auth { (0) update { (0) No attributes updated (0) } # update = noop (0) if (Ldap-Group == "cn=SeminaryAdmin,ou=SeminaryOU,dc=seminary,dc=local") { (0) Searching for user in group "cn=SeminaryAdmin,ou=SeminaryOU,dc=seminary,dc=local" rlm_ldap (ldap): Reserved connection (2) (0) Using user DN from request "cn=ttester3,cn=SeminaryAdmin,ou=SeminaryOU,dc=seminary,dc=local" (0) Checking user object's memberOf attributes (0) Performing unfiltered search in "cn=ttester3,cn=SeminaryAdmin,ou=SeminaryOU,dc=seminary,dc=local", scope "base" (0) Waiting for search result... (0) Processing memberOf value "cn=SeminaryAdmin,ou=SeminaryOU,dc=seminary,dc=local" as a DN (0) User found in group DN "cn=SeminaryAdmin,ou=SeminaryOU,dc=seminary,dc=local". Comparison between membership: dn, check: dn rlm_ldap (ldap): Released connection (2) (0) if (Ldap-Group == "cn=SeminaryAdmin,ou=SeminaryOU,dc=seminary,dc=local") -> TRUE (0) if (Ldap-Group == "cn=SeminaryAdmin,ou=SeminaryOU,dc=seminary,dc=local") { (0) update reply { (0) Tunnel-Type := VLAN (0) Tunnel-Medium-Type := 802 (0) Tunnel-Private-Group-ID := "12" (0) } # update reply = noop (0) } # if (Ldap-Group == "cn=SeminaryAdmin,ou=SeminaryOU,dc=seminary,dc=local") = noop (0) ldap: EXPAND . (0) ldap: --> . (0) ldap: EXPAND Authenticated at %S (0) ldap: --> Authenticated at 2016-08-23 17:21:50 rlm_ldap (ldap): Reserved connection (3) (0) ldap: Using user DN from request "cn=ttester3,cn=SeminaryAdmin,ou=SeminaryOU,dc=seminary,dc=local" (0) ldap: Modifying object with DN "cn=ttester3,cn=SeminaryAdmin,ou=SeminaryOU,dc=seminary,dc=local" (0) ldap: Waiting for modify result... rlm_ldap (ldap): Released connection (3) (0) [ldap] = ok (0) [exec] = noop (0) policy remove_reply_message_if_eap { (0) if (&reply:EAP-Message && &reply:Reply-Message) { (0) if (&reply:EAP-Message && &reply:Reply-Message) -> FALSE (0) else { (0) [noop] = noop (0) } # else = noop (0) } # policy remove_reply_message_if_eap = noop (0) } # post-auth = ok (0) Sent Access-Accept Id 81 from 127.0.0.1:1812 to 127.0.0.1:59558 length 0 (0) Tunnel-Type := VLAN (0) Tunnel-Medium-Type := 802 (0) Tunnel-Private-Group-Id := "12" (0) Finished request Waking up in 4.9 seconds. (0) Cleaning up request packet ID 81 with timestamp +4 Ready to process requests
participants (4)
-
A.L.M.Buxey＠lboro.ac.uk -
Alan DeKok -
Matthew Newton -
Matthew Pulis