When using DOUBLE_QUOTED_STRING, passwords with '\"' may not work
Hi! When using DOUBLE_QUOTED_STRING, passwords with '\"' may not work. Register a user in ActiveDirectory with the password "pass\"word@2022", the following LDAP settings. === # cat /usr/local/etc/raddb/mods-enabled/ldap1 ldap { server = '192.168.1.6' identity = 'cn=tkt10886-3,cn=users,dc=srv2022,dc=rdd-osaka,dc=soliton,dc=example,dc=jp' password = "pass\"word@2022" base_dn = 'dc=srv2022,dc=rdd-osaka,dc=soliton,dc=example,dc=jp' === When attempting to start the RADIUS service in this state, a syntax error occurred. ===== # /usr/local/sbin/radiusd -X FreeRADIUS Version 3.2.3 Copyright (C) 1999-2022 The FreeRADIUS server project and contributors There is NO warranty; not even for MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE You may redistribute copies of FreeRADIUS under the terms of the GNU General Public License For more information about these matters, see the file named COPYRIGHT Starting - reading configuration files ... including dictionary file /usr/local/share/freeradius/dictionary including dictionary file /usr/local/share/freeradius/dictionary.dhcp including dictionary file /usr/local/share/freeradius/dictionary.vqp including dictionary file /usr/local/etc/raddb/dictionary including configuration file /usr/local/etc/raddb/radiusd.conf including configuration file /usr/local/etc/raddb/proxy.conf including configuration file /usr/local/etc/raddb/clients.conf including files in directory /usr/local/etc/raddb/mods-enabled/ including configuration file /usr/local/etc/raddb/mods-enabled/dynamic_clients including configuration file /usr/local/etc/raddb/mods-enabled/realm including configuration file /usr/local/etc/raddb/mods-enabled/chap including configuration file /usr/local/etc/raddb/mods-enabled/utf8 including configuration file /usr/local/etc/raddb/mods-enabled/date including configuration file /usr/local/etc/raddb/mods-enabled/exec including configuration file /usr/local/etc/raddb/mods-enabled/unix including configuration file /usr/local/etc/raddb/mods-enabled/expr including configuration file /usr/local/etc/raddb/mods-enabled/totp including configuration file /usr/local/etc/raddb/mods-enabled/always including configuration file /usr/local/etc/raddb/mods-enabled/preprocess including configuration file /usr/local/etc/raddb/mods-enabled/ldap1 /usr/local/etc/raddb/mods-enabled/ldap1[4]: Syntax error: Expected comma after 'pass\\': word@2022" Errors reading or parsing /usr/local/etc/raddb/radiusd.conf ===== We also tried several patterns and summarised the results. Password | Configration | Result -------------------|-----------------------|------- pass"word@2022 | "pass\"word@2022" | OK pass\"word@2022 | "pass\\"word@2022" | Syntax error pass\\"word@2022 | "pass\\\"word@2022" | OK pass\\\"word@2022 | "pass\\\\"word@2022" | Syntax error As mentioned above, a Syntax Error occurs when '\' is an even number in the configuration. After investigating the cause of this, it appears that there is a problem with the determination of '˶' in the following section. === /* * Convert backslash-quote to quote, but * leave everything else alone. */ if (p[1] == quote) { /* convert '\'' --> ' */ p++; } else { if (buflen < 2) { fr_strerror_printf("Truncated input"); return T_INVALID; } *(s++) = *(p++); } *(s++) = *(p++); } === This problem was solved by changing the above section as follows. === } else { /* * Convert backslash-quote to quote, but * leave everything else alone. */ if (p[1] == quote) { /* convert '\'' --> ' */ if (p[2] != '\0') { p++; } } *(s++) = *(p++); } === Is this the right approach? Any advice would be appreciated.
On Sep 10, 2023, at 7:59 PM, 平林 哲 <Satoshi.Hirabayashi@soliton.co.jp> wrote:
When using DOUBLE_QUOTED_STRING, passwords with '\"' may not work.
They should work everywhere. They're just double quoted strings, and the rules are the same pretty much everywhere.
Register a user in ActiveDirectory with the password "pass\"word@2022", the following LDAP settings.
=== # cat /usr/local/etc/raddb/mods-enabled/ldap1 ldap { server = '192.168.1.6' identity = 'cn=tkt10886-3,cn=users,dc=srv2022,dc=rdd-osaka,dc=soliton,dc=example,dc=jp' password = "pass\"word@2022"
That works when I test it.
We also tried several patterns and summarised the results.
Password | Configration | Result -------------------|-----------------------|------- pass"word@2022 | "pass\"word@2022" | OK
Yes, the rules for double quoted strings are the same everywhere. If you want a double quote inside of a double quoted string, you have to escape it with a backslash: \"
pass\"word@2022 | "pass\\"word@2022" | Syntax error
Yes, that doesn't work. It's not supposed work, and it shouldn't work. That string is parsed as: "pass\\" and then word@2022" This is how escaping works with backslashes in all languages which support double quoted strings.
pass\\"word@2022 | "pass\\\"word@2022" | OK
Yes, the two backslashes are un-escaped to one backslash. And then the \" is converted to " This is how all double-quoted strings work.
pass\\\"word@2022 | "pass\\\\"word@2022" | Syntax error
As mentioned above, a Syntax Error occurs when '\' is an even number in the configuration.
Yes. Because if you have an even number of backslashes, every double-backslash is un-escaped to one backslash. And then if the parser sees a double quote after that, the double quote is interpreted as the end of the double quoted string.
Is this the right approach?
No.
Any advice would be appreciated.
See the rules for escaping in double quoted strings. This is the same for all languages, including the shell. Try passing those string to the shell: $ echo "pass\"word@2022" pass"word@2022 $ echo pass\\"word@2022" pass\word@2022 $ echo "pass\\\"word@2022" pass\"word@2022 $ echo "pass\\\\"word@2022" And that one doesn't output anything, because she shell is waiting for final quote. That final string is parsed as: " --> start double quoted string pass --> 4 characters \\ --> one \ \\ --> another \ " --> end of the double quoted string word@2022 --> more text " --> start of new double quoted string. Alan DeKok.
On 2023/09/11 9:13, Alan DeKok wrote:
On Sep 10, 2023, at 7:59 PM, 平林 哲 <Satoshi.Hirabayashi@soliton.co.jp> wrote:
=== # cat /usr/local/etc/raddb/mods-enabled/ldap1 ldap { server = '192.168.1.6' identity = 'cn=tkt10886-3,cn=users,dc=srv2022,dc=rdd-osaka,dc=soliton,dc=example,dc=jp' password = "pass\"word@2022"
That works when I test it.
sorry. I had made a mistake. The following settings cause the error: === # cat /usr/local/etc/raddb/mods-enabled/ldap1 ldap { server = '192.168.1.6' identity = 'cn=tkt10886-3,cn=users,dc=srv2022,dc=rdd-osaka,dc=soliton,dc=example,dc=jp' password = "pass\\"word@2022" base_dn = 'dc=srv2022,dc=rdd-osaka,dc=soliton,dc=example,dc=jp' ===
pass\\"word@2022 | "pass\\\"word@2022" | OK
Yes, the two backslashes are un-escaped to one backslash. And then the \" is converted to "
This is how all double-quoted strings work.
That's how FreeRADIUS currently works. However, it behaves differently in the shell. === $ echo "pass\\\"word@2022" pass\"word@2022 === Maybe the two backslashes need to be escaped into one backslash?
We also tried several patterns and summarised the results.
Password | Configration | Result -------------------|-----------------------|------- pass"word@2022 | "pass\"word@2022" | OK
Yes, the rules for double quoted strings are the same everywhere. If you want a double quote inside of a double quoted string, you have to escape it with a backslash: \"
pass\"word@2022 | "pass\\"word@2022" | Syntax error
Yes, that doesn't work. It's not supposed work, and it shouldn't work.
That string is parsed as:
"pass\\"
and then
word@2022"
This is how escaping works with backslashes in all languages which support double quoted strings.
pass\\"word@2022 | "pass\\\"word@2022" | OK
Yes, the two backslashes are un-escaped to one backslash. And then the \" is converted to "
This is how all double-quoted strings work.
pass\\\"word@2022 | "pass\\\\"word@2022" | Syntax error
As mentioned above, a Syntax Error occurs when '\' is an even number in the configuration.
Yes. Because if you have an even number of backslashes, every double-backslash is un-escaped to one backslash. And then if the parser sees a double quote after that, the double quote is interpreted as the end of the double quoted string.
Is this the right approach?
No.
Any advice would be appreciated.
See the rules for escaping in double quoted strings. This is the same for all languages, including the shell. Try passing those string to the shell:
$ echo "pass\"word@2022" pass"word@2022
$ echo pass\\"word@2022" pass\word@2022
$ echo "pass\\\"word@2022" pass\"word@2022
$ echo "pass\\\\"word@2022"
And that one doesn't output anything, because she shell is waiting for final quote.
That final string is parsed as:
" --> start double quoted string pass --> 4 characters \\ --> one \ \\ --> another \ " --> end of the double quoted string word@2022 --> more text " --> start of new double quoted string.
Alan DeKok.
- List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html
On Sep 10, 2023, at 9:16 PM, 平林 哲 <Satoshi.Hirabayashi@soliton.co.jp> wrote:
=== # cat /usr/local/etc/raddb/mods-enabled/ldap1 ldap { server = '192.168.1.6' identity = 'cn=tkt10886-3,cn=users,dc=srv2022,dc=rdd-osaka,dc=soliton,dc=example,dc=jp' password = "pass\\"word@2022"
Two backslashes.
However, it behaves differently in the shell.
=== $ echo "pass\\\"word@2022"
Three backslashes.
pass\"word@2022 ===
Use three backslashes with FreeRADIUS, and it will work.
Maybe the two backslashes need to be escaped into one backslash?
I explained the rules for double-quoted strings. They're the same for all double quoted strings in FreeRADIUS, and in the shell. If you want a " in the middle of a double quoted string, you have to escape it: \" If you want a \ in the middle of a double quoted string, you have to escape it: \\ Which means that if you want *both* a " and a \ in a double quoted string, you need to have an *odd* number of backslashes. All you need to do is count the number of backslashes. Even *and* there's a quote in the middle of the string? Parse error. Odd number of backslashes? It's fine. Alan DeKok.
I think what he means is: The actual password (unescaped) is pass\\"word@2022. In the Shell you would need five(!) backslashes. In Freeradius only three (I didn't test this though). echo "pass\\\\\"word@2022" pass\\"word@2022 Cheers On 11.09.23 11:10, Alan DeKok wrote:
On Sep 10, 2023, at 9:16 PM, 平林 哲 <Satoshi.Hirabayashi@soliton.co.jp> wrote:
=== # cat /usr/local/etc/raddb/mods-enabled/ldap1 ldap { server = '192.168.1.6' identity = 'cn=tkt10886-3,cn=users,dc=srv2022,dc=rdd-osaka,dc=soliton,dc=example,dc=jp' password = "pass\\"word@2022" Two backslashes.
However, it behaves differently in the shell.
=== $ echo "pass\\\"word@2022" Three backslashes.
pass\"word@2022 === Use three backslashes with FreeRADIUS, and it will work.
Maybe the two backslashes need to be escaped into one backslash? I explained the rules for double-quoted strings. They're the same for all double quoted strings in FreeRADIUS, and in the shell.
If you want a " in the middle of a double quoted string, you have to escape it: \"
If you want a \ in the middle of a double quoted string, you have to escape it: \\
Which means that if you want *both* a " and a \ in a double quoted string, you need to have an *odd* number of backslashes.
All you need to do is count the number of backslashes. Even *and* there's a quote in the middle of the string? Parse error. Odd number of backslashes? It's fine.
Alan DeKok.
- List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html
On Sep 11, 2023, at 7:45 AM, g4-lisz@tonarchiv.ch wrote:
I think what he means is:
I'm not sure what's going on. The examples I've seen disagree with each other, hence my confusion. The rules for double quoted strings are simple. They're the same in pretty much all languages which take double quoted strings. The rules in FreeRADIUS haven't changed since the project started. Alan DeKok.
Maybe the two backslashes need to be escaped into one backslash?
I explained the rules for double-quoted strings. They're the same for all double quoted strings in FreeRADIUS, and in the shell.
If you want a " in the middle of a double quoted string, you have to escape it: \"
If you want a \ in the middle of a double quoted string, you have to escape it: \\
Which means that if you want *both* a " and a \ in a double quoted string, you need to have an *odd* number of backslashes.
All you need to do is count the number of backslashes. Even *and* there's a quote in the middle of the string? Parse error. Odd number of backslashes? It's fine.
OK. I understand the configuration. Please let me confirm the password to be sent next. Register a user in ActiveDirectory with the password "pass\"word@2022", the following LDAP settings. === ldap { server = '192.168.1.6' identity = 'cn=tkt10886-5,cn=users,dc=srv2022,dc=rdd-osaka,dc=soliton,dc=example,dc=jp' password = "pass\\\"word@2022" === If you start with this configuration, the password verification will fail. === # /usr/local/sbin/radiusd -X FreeRADIUS Version 3.2.3 Copyright (C) 1999-2022 The FreeRADIUS server project and contributors There is NO warranty; not even for MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE You may redistribute copies of FreeRADIUS under the terms of the GNU General Public License For more information about these matters, see the file named COPYRIGHT Starting - reading configuration files ... including dictionary file /usr/local/share/freeradius/dictionary including dictionary file /usr/local/share/freeradius/dictionary.dhcp including dictionary file /usr/local/share/freeradius/dictionary.vqp including dictionary file /usr/local/etc/raddb/dictionary including configuration file /usr/local/etc/raddb/radiusd.conf including configuration file /usr/local/etc/raddb/proxy.conf including configuration file /usr/local/etc/raddb/clients.conf including files in directory /usr/local/etc/raddb/mods-enabled/ including configuration file /usr/local/etc/raddb/mods-enabled/dynamic_clients including configuration file /usr/local/etc/raddb/mods-enabled/realm including configuration file /usr/local/etc/raddb/mods-enabled/chap including configuration file /usr/local/etc/raddb/mods-enabled/utf8 including configuration file /usr/local/etc/raddb/mods-enabled/date including configuration file /usr/local/etc/raddb/mods-enabled/exec including configuration file /usr/local/etc/raddb/mods-enabled/unix including configuration file /usr/local/etc/raddb/mods-enabled/expr including configuration file /usr/local/etc/raddb/mods-enabled/totp including configuration file /usr/local/etc/raddb/mods-enabled/always including configuration file /usr/local/etc/raddb/mods-enabled/preprocess including configuration file /usr/local/etc/raddb/mods-enabled/ldap1 including configuration file /usr/local/etc/raddb/mods-enabled/logintime including configuration file /usr/local/etc/raddb/mods-enabled/files including configuration file /usr/local/etc/raddb/mods-enabled/radutmp including configuration file /usr/local/etc/raddb/mods-enabled/ntlm_auth including configuration file /usr/local/etc/raddb/mods-enabled/digest including configuration file /usr/local/etc/raddb/mods-enabled/sradutmp including configuration file /usr/local/etc/raddb/mods-enabled/replicate including configuration file /usr/local/etc/raddb/mods-enabled/unpack including configuration file /usr/local/etc/raddb/mods-enabled/detail.log including configuration file /usr/local/etc/raddb/mods-enabled/soh including configuration file /usr/local/etc/raddb/mods-enabled/detail including configuration file /usr/local/etc/raddb/mods-enabled/attr_filter including configuration file /usr/local/etc/raddb/mods-enabled/linelog including configuration file /usr/local/etc/raddb/mods-enabled/expiration including configuration file /usr/local/etc/raddb/mods-enabled/eap including configuration file /usr/local/etc/raddb/mods-enabled/pap including configuration file /usr/local/etc/raddb/mods-enabled/passwd including configuration file /usr/local/etc/raddb/mods-enabled/echo including configuration file /usr/local/etc/raddb/mods-enabled/mschap including files in directory /usr/local/etc/raddb/policy.d/ including configuration file /usr/local/etc/raddb/policy.d/accounting including configuration file /usr/local/etc/raddb/policy.d/abfab-tr including configuration file /usr/local/etc/raddb/policy.d/rfc7542 including configuration file /usr/local/etc/raddb/policy.d/cui including configuration file /usr/local/etc/raddb/policy.d/filter including configuration file /usr/local/etc/raddb/policy.d/canonicalization including configuration file /usr/local/etc/raddb/policy.d/dhcp including configuration file /usr/local/etc/raddb/policy.d/operator-name including configuration file /usr/local/etc/raddb/policy.d/debug including configuration file /usr/local/etc/raddb/policy.d/eap including configuration file /usr/local/etc/raddb/policy.d/control including configuration file /usr/local/etc/raddb/policy.d/moonshot-targeted-ids including files in directory /usr/local/etc/raddb/sites-enabled/ including configuration file /usr/local/etc/raddb/sites-enabled/default including configuration file /usr/local/etc/raddb/sites-enabled/inner-tunnel main { security { allow_core_dumps = no } name = "radiusd" prefix = "/usr/local" localstatedir = "/usr/local/var" logdir = "/usr/local/var/log/radius" run_dir = "/usr/local/var/run/radiusd" } main { name = "radiusd" prefix = "/usr/local" localstatedir = "/usr/local/var" sbindir = "/usr/local/sbin" logdir = "/usr/local/var/log/radius" run_dir = "/usr/local/var/run/radiusd" libdir = "/usr/local/lib" radacctdir = "/usr/local/var/log/radius/radacct" hostname_lookups = no max_request_time = 30 cleanup_delay = 5 max_requests = 16384 postauth_client_lost = no pidfile = "/usr/local/var/run/radiusd/radiusd.pid" checkrad = "/usr/local/sbin/checkrad" debug_level = 0 proxy_requests = yes log { stripped_names = no auth = no auth_badpass = no auth_goodpass = no colourise = yes msg_denied = "You are already logged in - access denied" } resources { } security { max_attributes = 200 reject_delay = 1.000000 status_server = yes allow_vulnerable_openssl = "no" } } radiusd: #### Loading Realms and Home Servers #### proxy server { retry_delay = 5 retry_count = 3 default_fallback = no dead_time = 120 wake_all_if_all_dead = no } home_server localhost { nonblock = no ipaddr = 127.0.0.1 port = 1812 type = "auth" secret = <<< secret >>> response_window = 20.000000 response_timeouts = 1 max_outstanding = 65536 zombie_period = 40 status_check = "status-server" ping_interval = 30 check_interval = 30 check_timeout = 4 num_answers_to_alive = 3 revive_interval = 120 limit { max_connections = 16 max_requests = 0 lifetime = 0 idle_timeout = 0 } coa { irt = 2 mrt = 16 mrc = 5 mrd = 30 } recv_coa { } } home_server_pool my_auth_failover { type = fail-over home_server = localhost } realm example.com { auth_pool = my_auth_failover } realm LOCAL { } radiusd: #### Loading Clients #### client localhost { ipaddr = 127.0.0.1 require_message_authenticator = no secret = <<< secret >>> nas_type = "other" proto = "*" limit { max_connections = 16 lifetime = 0 idle_timeout = 30 } } client localhost_ipv6 { ipv6addr = ::1 require_message_authenticator = no secret = <<< secret >>> limit { max_connections = 16 lifetime = 0 idle_timeout = 30 } } client naeps245 { ipaddr = 192.168.1.245 require_message_authenticator = no secret = <<< secret >>> limit { max_connections = 16 lifetime = 0 idle_timeout = 30 } } Debugger not attached # Creating Auth-Type = mschap # Creating Auth-Type = digest # Creating Auth-Type = eap # Creating Auth-Type = PAP # Creating Auth-Type = CHAP # Creating Auth-Type = MS-CHAP # Creating Autz-Type = New-TLS-Connection # Creating Post-Auth-Type = Client-Lost radiusd: #### Instantiating modules #### modules { # Loaded module rlm_dynamic_clients # Loading module "dynamic_clients" from file /usr/local/etc/raddb/mods-enabled/dynamic_clients # Loaded module rlm_realm # Loading module "IPASS" from file /usr/local/etc/raddb/mods-enabled/realm realm IPASS { format = "prefix" delimiter = "/" ignore_default = no ignore_null = no } # Loading module "suffix" from file /usr/local/etc/raddb/mods-enabled/realm realm suffix { format = "suffix" delimiter = "@" ignore_default = no ignore_null = no } # Loading module "bangpath" from file /usr/local/etc/raddb/mods-enabled/realm realm bangpath { format = "prefix" delimiter = "!" ignore_default = no ignore_null = no } # Loading module "realmpercent" from file /usr/local/etc/raddb/mods-enabled/realm realm realmpercent { format = "suffix" delimiter = "%" ignore_default = no ignore_null = no } # Loading module "ntdomain" from file /usr/local/etc/raddb/mods-enabled/realm realm ntdomain { format = "prefix" delimiter = "\\" ignore_default = no ignore_null = no } # Loaded module rlm_chap # Loading module "chap" from file /usr/local/etc/raddb/mods-enabled/chap # Loaded module rlm_utf8 # Loading module "utf8" from file /usr/local/etc/raddb/mods-enabled/utf8 # Loaded module rlm_date # Loading module "date" from file /usr/local/etc/raddb/mods-enabled/date date { format = "%b %e %Y %H:%M:%S %Z" utc = no } # Loading module "wispr2date" from file /usr/local/etc/raddb/mods-enabled/date date wispr2date { format = "%Y-%m-%dT%H:%M:%S" utc = no } # Loaded module rlm_exec # Loading module "exec" from file /usr/local/etc/raddb/mods-enabled/exec exec { wait = no input_pairs = "request" shell_escape = yes timeout = 10 } # Loaded module rlm_unix # Loading module "unix" from file /usr/local/etc/raddb/mods-enabled/unix unix { radwtmp = "/usr/local/var/log/radius/radwtmp" } Creating attribute Unix-Group # Loaded module rlm_expr # Loading module "expr" from file /usr/local/etc/raddb/mods-enabled/expr expr { safe_characters = "@abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ0123456789.-_: /aeouaaaceeeeiio?uuuayAEOUsAAACEEEEIIO?UUU?" } # Loaded module rlm_always # Loading module "reject" from file /usr/local/etc/raddb/mods-enabled/always always reject { rcode = "reject" simulcount = 0 mpp = no } # Loading module "fail" from file /usr/local/etc/raddb/mods-enabled/always always fail { rcode = "fail" simulcount = 0 mpp = no } # Loading module "ok" from file /usr/local/etc/raddb/mods-enabled/always always ok { rcode = "ok" simulcount = 0 mpp = no } # Loading module "handled" from file /usr/local/etc/raddb/mods-enabled/always always handled { rcode = "handled" simulcount = 0 mpp = no } # Loading module "invalid" from file /usr/local/etc/raddb/mods-enabled/always always invalid { rcode = "invalid" simulcount = 0 mpp = no } # Loading module "userlock" from file /usr/local/etc/raddb/mods-enabled/always always userlock { rcode = "userlock" simulcount = 0 mpp = no } # Loading module "notfound" from file /usr/local/etc/raddb/mods-enabled/always always notfound { rcode = "notfound" simulcount = 0 mpp = no } # Loading module "noop" from file /usr/local/etc/raddb/mods-enabled/always always noop { rcode = "noop" simulcount = 0 mpp = no } # Loading module "updated" from file /usr/local/etc/raddb/mods-enabled/always always updated { rcode = "updated" simulcount = 0 mpp = no } # Loaded module rlm_preprocess # Loading module "preprocess" from file /usr/local/etc/raddb/mods-enabled/preprocess preprocess { huntgroups = "/usr/local/etc/raddb/mods-config/preprocess/huntgroups" hints = "/usr/local/etc/raddb/mods-config/preprocess/hints" with_ascend_hack = no ascend_channels_per_line = 23 with_ntdomain_hack = no with_specialix_jetstream_hack = no with_cisco_vsa_hack = no with_alvarion_vsa_hack = no } # Loaded module rlm_ldap # Loading module "ldap" from file /usr/local/etc/raddb/mods-enabled/ldap1 ldap { server = "192.168.1.6" identity = "cn=tkt10886-5,cn=users,dc=srv2022,dc=rdd-osaka,dc=soliton,dc=example,dc=jp" password = <<< secret >>> sasl { } user_dn = "LDAP-UserDn" user { scope = "sub" access_positive = yes sasl { } } group { scope = "sub" name_attribute = "cn" cacheable_name = no cacheable_dn = no allow_dangling_group_ref = no } client { scope = "sub" base_dn = "" } profile { } options { ldap_debug = 0 net_timeout = 10 res_timeout = 20 srv_timelimit = 20 idle = 60 probes = 3 interval = 30 } tls { check_crl = no start_tls = no } } Creating attribute LDAP-Group # Loaded module rlm_logintime # Loading module "logintime" from file /usr/local/etc/raddb/mods-enabled/logintime logintime { minimum_timeout = 60 } # Loaded module rlm_files # Loading module "files" from file /usr/local/etc/raddb/mods-enabled/files files { filename = "/usr/local/etc/raddb/mods-config/files/authorize" acctusersfile = "/usr/local/etc/raddb/mods-config/files/accounting" preproxy_usersfile = "/usr/local/etc/raddb/mods-config/files/pre-proxy" } # Loaded module rlm_radutmp # Loading module "radutmp" from file /usr/local/etc/raddb/mods-enabled/radutmp radutmp { filename = "/usr/local/var/log/radius/radutmp" username = "%{User-Name}" case_sensitive = yes check_with_nas = yes permissions = 384 caller_id = yes } # Loading module "ntlm_auth" from file /usr/local/etc/raddb/mods-enabled/ntlm_auth exec ntlm_auth { wait = yes program = "/path/to/ntlm_auth --request-nt-key --domain=MYDOMAIN --username=%{mschap:User-Name} --password=%{User-Password}" shell_escape = yes } # Loaded module rlm_digest # Loading module "digest" from file /usr/local/etc/raddb/mods-enabled/digest # Loading module "sradutmp" from file /usr/local/etc/raddb/mods-enabled/sradutmp radutmp sradutmp { filename = "/usr/local/var/log/radius/sradutmp" username = "%{User-Name}" case_sensitive = yes check_with_nas = yes permissions = 420 caller_id = no } # Loaded module rlm_replicate # Loading module "replicate" from file /usr/local/etc/raddb/mods-enabled/replicate # Loaded module rlm_unpack # Loading module "unpack" from file /usr/local/etc/raddb/mods-enabled/unpack # Loaded module rlm_detail # Loading module "auth_log" from file /usr/local/etc/raddb/mods-enabled/detail.log detail auth_log { filename = "/usr/local/var/log/radius/radacct/%{%{Packet-Src-IP-Address}:-%{Packet-Src-IPv6-Address}}/auth-detail-%Y%m%d" header = "%t" permissions = 384 locking = no escape_filenames = no log_packet_header = no } # Loading module "reply_log" from file /usr/local/etc/raddb/mods-enabled/detail.log detail reply_log { filename = "/usr/local/var/log/radius/radacct/%{%{Packet-Src-IP-Address}:-%{Packet-Src-IPv6-Address}}/reply-detail-%Y%m%d" header = "%t" permissions = 384 locking = no escape_filenames = no log_packet_header = no } # Loading module "pre_proxy_log" from file /usr/local/etc/raddb/mods-enabled/detail.log detail pre_proxy_log { filename = "/usr/local/var/log/radius/radacct/%{%{Packet-Src-IP-Address}:-%{Packet-Src-IPv6-Address}}/pre-proxy-detail-%Y%m%d" header = "%t" permissions = 384 locking = no escape_filenames = no log_packet_header = no } # Loading module "post_proxy_log" from file /usr/local/etc/raddb/mods-enabled/detail.log detail post_proxy_log { filename = "/usr/local/var/log/radius/radacct/%{%{Packet-Src-IP-Address}:-%{Packet-Src-IPv6-Address}}/post-proxy-detail-%Y%m%d" header = "%t" permissions = 384 locking = no escape_filenames = no log_packet_header = no } # Loaded module rlm_soh # Loading module "soh" from file /usr/local/etc/raddb/mods-enabled/soh soh { dhcp = yes } # Loading module "detail" from file /usr/local/etc/raddb/mods-enabled/detail detail { filename = "/usr/local/var/log/radius/radacct/%{%{Packet-Src-IP-Address}:-%{Packet-Src-IPv6-Address}}/detail-%Y%m%d" header = "%t" permissions = 384 locking = no escape_filenames = no log_packet_header = no } # Loaded module rlm_attr_filter # Loading module "attr_filter.post-proxy" from file /usr/local/etc/raddb/mods-enabled/attr_filter attr_filter attr_filter.post-proxy { filename = "/usr/local/etc/raddb/mods-config/attr_filter/post-proxy" key = "%{Realm}" relaxed = no } # Loading module "attr_filter.pre-proxy" from file /usr/local/etc/raddb/mods-enabled/attr_filter attr_filter attr_filter.pre-proxy { filename = "/usr/local/etc/raddb/mods-config/attr_filter/pre-proxy" key = "%{Realm}" relaxed = no } # Loading module "attr_filter.access_reject" from file /usr/local/etc/raddb/mods-enabled/attr_filter attr_filter attr_filter.access_reject { filename = "/usr/local/etc/raddb/mods-config/attr_filter/access_reject" key = "%{User-Name}" relaxed = no } # Loading module "attr_filter.access_challenge" from file /usr/local/etc/raddb/mods-enabled/attr_filter attr_filter attr_filter.access_challenge { filename = "/usr/local/etc/raddb/mods-config/attr_filter/access_challenge" key = "%{User-Name}" relaxed = no } # Loading module "attr_filter.accounting_response" from file /usr/local/etc/raddb/mods-enabled/attr_filter attr_filter attr_filter.accounting_response { filename = "/usr/local/etc/raddb/mods-config/attr_filter/accounting_response" key = "%{User-Name}" relaxed = no } # Loading module "attr_filter.coa" from file /usr/local/etc/raddb/mods-enabled/attr_filter attr_filter attr_filter.coa { filename = "/usr/local/etc/raddb/mods-config/attr_filter/coa" key = "%{User-Name}" relaxed = no } # Loaded module rlm_linelog # Loading module "linelog" from file /usr/local/etc/raddb/mods-enabled/linelog linelog { filename = "/usr/local/var/log/radius/linelog" escape_filenames = no syslog_severity = "info" permissions = 384 format = "This is a log message for %{User-Name}" reference = "messages.%{%{reply:Packet-Type}:-default}" } # Loading module "log_accounting" from file /usr/local/etc/raddb/mods-enabled/linelog linelog log_accounting { filename = "/usr/local/var/log/radius/linelog-accounting" escape_filenames = no syslog_severity = "info" permissions = 384 format = "" reference = "Accounting-Request.%{%{Acct-Status-Type}:-unknown}" } # Loaded module rlm_expiration # Loading module "expiration" from file /usr/local/etc/raddb/mods-enabled/expiration # Loaded module rlm_eap # Loading module "eap" from file /usr/local/etc/raddb/mods-enabled/eap eap { default_eap_type = "md5" timer_expire = 60 max_eap_type = 52 ignore_unknown_eap_types = no cisco_accounting_username_bug = no max_sessions = 16384 } # Loaded module rlm_pap # Loading module "pap" from file /usr/local/etc/raddb/mods-enabled/pap pap { normalise = yes } # Loaded module rlm_passwd # Loading module "etc_passwd" from file /usr/local/etc/raddb/mods-enabled/passwd passwd etc_passwd { filename = "/etc/passwd" format = "*User-Name:Crypt-Password:" delimiter = ":" ignore_nislike = no ignore_empty = yes allow_multiple_keys = no hash_size = 100 } # Loading module "echo" from file /usr/local/etc/raddb/mods-enabled/echo exec echo { wait = yes program = "/bin/echo %{User-Name}" input_pairs = "request" output_pairs = "reply" shell_escape = yes } # Loaded module rlm_mschap # Loading module "mschap" from file /usr/local/etc/raddb/mods-enabled/mschap mschap { use_mppe = yes require_encryption = no require_strong = no with_ntdomain_hack = yes passchange { } allow_retry = yes winbind_retry_with_normalised_username = no } instantiate { } # Instantiating module "IPASS" from file /usr/local/etc/raddb/mods-enabled/realm # Instantiating module "suffix" from file /usr/local/etc/raddb/mods-enabled/realm # Instantiating module "bangpath" from file /usr/local/etc/raddb/mods-enabled/realm # Instantiating module "realmpercent" from file /usr/local/etc/raddb/mods-enabled/realm # Instantiating module "ntdomain" from file /usr/local/etc/raddb/mods-enabled/realm # Instantiating module "reject" from file /usr/local/etc/raddb/mods-enabled/always # Instantiating module "fail" from file /usr/local/etc/raddb/mods-enabled/always # Instantiating module "ok" from file /usr/local/etc/raddb/mods-enabled/always # Instantiating module "handled" from file /usr/local/etc/raddb/mods-enabled/always # Instantiating module "invalid" from file /usr/local/etc/raddb/mods-enabled/always # Instantiating module "userlock" from file /usr/local/etc/raddb/mods-enabled/always # Instantiating module "notfound" from file /usr/local/etc/raddb/mods-enabled/always # Instantiating module "noop" from file /usr/local/etc/raddb/mods-enabled/always # Instantiating module "updated" from file /usr/local/etc/raddb/mods-enabled/always # Instantiating module "preprocess" from file /usr/local/etc/raddb/mods-enabled/preprocess reading pairlist file /usr/local/etc/raddb/mods-config/preprocess/huntgroups reading pairlist file /usr/local/etc/raddb/mods-config/preprocess/hints # Instantiating module "ldap" from file /usr/local/etc/raddb/mods-enabled/ldap1 rlm_ldap: libldap vendor: OpenLDAP, version: 20457 rlm_ldap (ldap): Couldn't find configuration for accounting, will return NOOP for calls from this section rlm_ldap (ldap): Couldn't find configuration for post-auth, will return NOOP for calls from this section !!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!! !! libldap is using GnuTLS, while FreeRADIUS is using OpenSSL !! There may be random issues with TLS connections due to this conflict. !! The server may also crash. !! See https://wiki.freeradius.org/modules/Rlm_ldap for more information. !!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!! rlm_ldap (ldap): Initialising connection pool pool { start = 5 min = 3 max = 32 spare = 10 uses = 0 lifetime = 0 cleanup_interval = 30 idle_timeout = 60 retry_delay = 30 max_retries = 5 spread = no } rlm_ldap (ldap): Opening additional connection (0), 1 of 32 pending slots used rlm_ldap (ldap): Connecting to ldap://192.168.1.6:389 rlm_ldap (ldap): Waiting for bind result... rlm_ldap (ldap): Bind credentials incorrect: Invalid credentials rlm_ldap (ldap): Server said: 80090308: LdapErr: DSID-0C090569, comment: AcceptSecurityContext error, data 52e, v4f7c. rlm_ldap (ldap): Opening connection failed (0) rlm_ldap (ldap): Removing connection pool /usr/local/etc/raddb/mods-enabled/ldap1[1]: Instantiation failed for module "ldap" root@debian11-hira:/usr/local/etc/raddb# /usr/local/sbin/radiusd -X FreeRADIUS Version 3.2.3 Copyright (C) 1999-2022 The FreeRADIUS server project and contributors There is NO warranty; not even for MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE You may redistribute copies of FreeRADIUS under the terms of the GNU General Public License For more information about these matters, see the file named COPYRIGHT Starting - reading configuration files ... including dictionary file /usr/local/share/freeradius/dictionary including dictionary file /usr/local/share/freeradius/dictionary.dhcp including dictionary file /usr/local/share/freeradius/dictionary.vqp including dictionary file /usr/local/etc/raddb/dictionary including configuration file /usr/local/etc/raddb/radiusd.conf including configuration file /usr/local/etc/raddb/proxy.conf including configuration file /usr/local/etc/raddb/clients.conf including files in directory /usr/local/etc/raddb/mods-enabled/ including configuration file /usr/local/etc/raddb/mods-enabled/dynamic_clients including configuration file /usr/local/etc/raddb/mods-enabled/realm including configuration file /usr/local/etc/raddb/mods-enabled/chap including configuration file /usr/local/etc/raddb/mods-enabled/utf8 including configuration file /usr/local/etc/raddb/mods-enabled/date including configuration file /usr/local/etc/raddb/mods-enabled/exec including configuration file /usr/local/etc/raddb/mods-enabled/unix including configuration file /usr/local/etc/raddb/mods-enabled/expr including configuration file /usr/local/etc/raddb/mods-enabled/totp including configuration file /usr/local/etc/raddb/mods-enabled/always including configuration file /usr/local/etc/raddb/mods-enabled/preprocess including configuration file /usr/local/etc/raddb/mods-enabled/ldap1 including configuration file /usr/local/etc/raddb/mods-enabled/logintime including configuration file /usr/local/etc/raddb/mods-enabled/files including configuration file /usr/local/etc/raddb/mods-enabled/radutmp including configuration file /usr/local/etc/raddb/mods-enabled/ntlm_auth including configuration file /usr/local/etc/raddb/mods-enabled/digest including configuration file /usr/local/etc/raddb/mods-enabled/sradutmp including configuration file /usr/local/etc/raddb/mods-enabled/replicate including configuration file /usr/local/etc/raddb/mods-enabled/unpack including configuration file /usr/local/etc/raddb/mods-enabled/detail.log including configuration file /usr/local/etc/raddb/mods-enabled/soh including configuration file /usr/local/etc/raddb/mods-enabled/detail including configuration file /usr/local/etc/raddb/mods-enabled/attr_filter including configuration file /usr/local/etc/raddb/mods-enabled/linelog including configuration file /usr/local/etc/raddb/mods-enabled/expiration including configuration file /usr/local/etc/raddb/mods-enabled/eap including configuration file /usr/local/etc/raddb/mods-enabled/pap including configuration file /usr/local/etc/raddb/mods-enabled/passwd including configuration file /usr/local/etc/raddb/mods-enabled/echo including configuration file /usr/local/etc/raddb/mods-enabled/mschap including files in directory /usr/local/etc/raddb/policy.d/ including configuration file /usr/local/etc/raddb/policy.d/accounting including configuration file /usr/local/etc/raddb/policy.d/abfab-tr including configuration file /usr/local/etc/raddb/policy.d/rfc7542 including configuration file /usr/local/etc/raddb/policy.d/cui including configuration file /usr/local/etc/raddb/policy.d/filter including configuration file /usr/local/etc/raddb/policy.d/canonicalization including configuration file /usr/local/etc/raddb/policy.d/dhcp including configuration file /usr/local/etc/raddb/policy.d/operator-name including configuration file /usr/local/etc/raddb/policy.d/debug including configuration file /usr/local/etc/raddb/policy.d/eap including configuration file /usr/local/etc/raddb/policy.d/control including configuration file /usr/local/etc/raddb/policy.d/moonshot-targeted-ids including files in directory /usr/local/etc/raddb/sites-enabled/ including configuration file /usr/local/etc/raddb/sites-enabled/default including configuration file /usr/local/etc/raddb/sites-enabled/inner-tunnel main { security { allow_core_dumps = no } name = "radiusd" prefix = "/usr/local" localstatedir = "/usr/local/var" logdir = "/usr/local/var/log/radius" run_dir = "/usr/local/var/run/radiusd" } main { name = "radiusd" prefix = "/usr/local" localstatedir = "/usr/local/var" sbindir = "/usr/local/sbin" logdir = "/usr/local/var/log/radius" run_dir = "/usr/local/var/run/radiusd" libdir = "/usr/local/lib" radacctdir = "/usr/local/var/log/radius/radacct" hostname_lookups = no max_request_time = 30 cleanup_delay = 5 max_requests = 16384 postauth_client_lost = no pidfile = "/usr/local/var/run/radiusd/radiusd.pid" checkrad = "/usr/local/sbin/checkrad" debug_level = 0 proxy_requests = yes log { stripped_names = no auth = no auth_badpass = no auth_goodpass = no colourise = yes msg_denied = "You are already logged in - access denied" } resources { } security { max_attributes = 200 reject_delay = 1.000000 status_server = yes allow_vulnerable_openssl = "no" } } radiusd: #### Loading Realms and Home Servers #### proxy server { retry_delay = 5 retry_count = 3 default_fallback = no dead_time = 120 wake_all_if_all_dead = no } home_server localhost { nonblock = no ipaddr = 127.0.0.1 port = 1812 type = "auth" secret = <<< secret >>> response_window = 20.000000 response_timeouts = 1 max_outstanding = 65536 zombie_period = 40 status_check = "status-server" ping_interval = 30 check_interval = 30 check_timeout = 4 num_answers_to_alive = 3 revive_interval = 120 limit { max_connections = 16 max_requests = 0 lifetime = 0 idle_timeout = 0 } coa { irt = 2 mrt = 16 mrc = 5 mrd = 30 } recv_coa { } } home_server_pool my_auth_failover { type = fail-over home_server = localhost } realm example.com { auth_pool = my_auth_failover } realm LOCAL { } radiusd: #### Loading Clients #### client localhost { ipaddr = 127.0.0.1 require_message_authenticator = no secret = <<< secret >>> nas_type = "other" proto = "*" limit { max_connections = 16 lifetime = 0 idle_timeout = 30 } } client localhost_ipv6 { ipv6addr = ::1 require_message_authenticator = no secret = <<< secret >>> limit { max_connections = 16 lifetime = 0 idle_timeout = 30 } } client naeps245 { ipaddr = 192.168.1.245 require_message_authenticator = no secret = <<< secret >>> limit { max_connections = 16 lifetime = 0 idle_timeout = 30 } } Debugger not attached # Creating Auth-Type = mschap # Creating Auth-Type = digest # Creating Auth-Type = eap # Creating Auth-Type = PAP # Creating Auth-Type = CHAP # Creating Auth-Type = MS-CHAP # Creating Autz-Type = New-TLS-Connection # Creating Post-Auth-Type = Client-Lost radiusd: #### Instantiating modules #### modules { # Loaded module rlm_dynamic_clients # Loading module "dynamic_clients" from file /usr/local/etc/raddb/mods-enabled/dynamic_clients # Loaded module rlm_realm # Loading module "IPASS" from file /usr/local/etc/raddb/mods-enabled/realm realm IPASS { format = "prefix" delimiter = "/" ignore_default = no ignore_null = no } # Loading module "suffix" from file /usr/local/etc/raddb/mods-enabled/realm realm suffix { format = "suffix" delimiter = "@" ignore_default = no ignore_null = no } # Loading module "bangpath" from file /usr/local/etc/raddb/mods-enabled/realm realm bangpath { format = "prefix" delimiter = "!" ignore_default = no ignore_null = no } # Loading module "realmpercent" from file /usr/local/etc/raddb/mods-enabled/realm realm realmpercent { format = "suffix" delimiter = "%" ignore_default = no ignore_null = no } # Loading module "ntdomain" from file /usr/local/etc/raddb/mods-enabled/realm realm ntdomain { format = "prefix" delimiter = "\\" ignore_default = no ignore_null = no } # Loaded module rlm_chap # Loading module "chap" from file /usr/local/etc/raddb/mods-enabled/chap # Loaded module rlm_utf8 # Loading module "utf8" from file /usr/local/etc/raddb/mods-enabled/utf8 # Loaded module rlm_date # Loading module "date" from file /usr/local/etc/raddb/mods-enabled/date date { format = "%b %e %Y %H:%M:%S %Z" utc = no } # Loading module "wispr2date" from file /usr/local/etc/raddb/mods-enabled/date date wispr2date { format = "%Y-%m-%dT%H:%M:%S" utc = no } # Loaded module rlm_exec # Loading module "exec" from file /usr/local/etc/raddb/mods-enabled/exec exec { wait = no input_pairs = "request" shell_escape = yes timeout = 10 } # Loaded module rlm_unix # Loading module "unix" from file /usr/local/etc/raddb/mods-enabled/unix unix { radwtmp = "/usr/local/var/log/radius/radwtmp" } Creating attribute Unix-Group # Loaded module rlm_expr # Loading module "expr" from file /usr/local/etc/raddb/mods-enabled/expr expr { safe_characters = "@abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ0123456789.-_: /aeouaaaceeeeiio?uuuayAEOUsAAACEEEEIIO?UUU?" } # Loaded module rlm_always # Loading module "reject" from file /usr/local/etc/raddb/mods-enabled/always always reject { rcode = "reject" simulcount = 0 mpp = no } # Loading module "fail" from file /usr/local/etc/raddb/mods-enabled/always always fail { rcode = "fail" simulcount = 0 mpp = no } # Loading module "ok" from file /usr/local/etc/raddb/mods-enabled/always always ok { rcode = "ok" simulcount = 0 mpp = no } # Loading module "handled" from file /usr/local/etc/raddb/mods-enabled/always always handled { rcode = "handled" simulcount = 0 mpp = no } # Loading module "invalid" from file /usr/local/etc/raddb/mods-enabled/always always invalid { rcode = "invalid" simulcount = 0 mpp = no } # Loading module "userlock" from file /usr/local/etc/raddb/mods-enabled/always always userlock { rcode = "userlock" simulcount = 0 mpp = no } # Loading module "notfound" from file /usr/local/etc/raddb/mods-enabled/always always notfound { rcode = "notfound" simulcount = 0 mpp = no } # Loading module "noop" from file /usr/local/etc/raddb/mods-enabled/always always noop { rcode = "noop" simulcount = 0 mpp = no } # Loading module "updated" from file /usr/local/etc/raddb/mods-enabled/always always updated { rcode = "updated" simulcount = 0 mpp = no } # Loaded module rlm_preprocess # Loading module "preprocess" from file /usr/local/etc/raddb/mods-enabled/preprocess preprocess { huntgroups = "/usr/local/etc/raddb/mods-config/preprocess/huntgroups" hints = "/usr/local/etc/raddb/mods-config/preprocess/hints" with_ascend_hack = no ascend_channels_per_line = 23 with_ntdomain_hack = no with_specialix_jetstream_hack = no with_cisco_vsa_hack = no with_alvarion_vsa_hack = no } # Loaded module rlm_ldap # Loading module "ldap" from file /usr/local/etc/raddb/mods-enabled/ldap1 ldap { server = "192.168.1.6" identity = "cn=tkt10886-5,cn=users,dc=srv2022,dc=rdd-osaka,dc=soliton,dc=example,dc=jp" password = <<< secret >>> sasl { } user_dn = "LDAP-UserDn" user { scope = "sub" access_positive = yes sasl { } } group { scope = "sub" name_attribute = "cn" cacheable_name = no cacheable_dn = no allow_dangling_group_ref = no } client { scope = "sub" base_dn = "" } profile { } options { ldap_debug = 0 net_timeout = 10 res_timeout = 20 srv_timelimit = 20 idle = 60 probes = 3 interval = 30 } tls { check_crl = no start_tls = no } } Creating attribute LDAP-Group # Loaded module rlm_logintime # Loading module "logintime" from file /usr/local/etc/raddb/mods-enabled/logintime logintime { minimum_timeout = 60 } # Loaded module rlm_files # Loading module "files" from file /usr/local/etc/raddb/mods-enabled/files files { filename = "/usr/local/etc/raddb/mods-config/files/authorize" acctusersfile = "/usr/local/etc/raddb/mods-config/files/accounting" preproxy_usersfile = "/usr/local/etc/raddb/mods-config/files/pre-proxy" } # Loaded module rlm_radutmp # Loading module "radutmp" from file /usr/local/etc/raddb/mods-enabled/radutmp radutmp { filename = "/usr/local/var/log/radius/radutmp" username = "%{User-Name}" case_sensitive = yes check_with_nas = yes permissions = 384 caller_id = yes } # Loading module "ntlm_auth" from file /usr/local/etc/raddb/mods-enabled/ntlm_auth exec ntlm_auth { wait = yes program = "/path/to/ntlm_auth --request-nt-key --domain=MYDOMAIN --username=%{mschap:User-Name} --password=%{User-Password}" shell_escape = yes } # Loaded module rlm_digest # Loading module "digest" from file /usr/local/etc/raddb/mods-enabled/digest # Loading module "sradutmp" from file /usr/local/etc/raddb/mods-enabled/sradutmp radutmp sradutmp { filename = "/usr/local/var/log/radius/sradutmp" username = "%{User-Name}" case_sensitive = yes check_with_nas = yes permissions = 420 caller_id = no } # Loaded module rlm_replicate # Loading module "replicate" from file /usr/local/etc/raddb/mods-enabled/replicate # Loaded module rlm_unpack # Loading module "unpack" from file /usr/local/etc/raddb/mods-enabled/unpack # Loaded module rlm_detail # Loading module "auth_log" from file /usr/local/etc/raddb/mods-enabled/detail.log detail auth_log { filename = "/usr/local/var/log/radius/radacct/%{%{Packet-Src-IP-Address}:-%{Packet-Src-IPv6-Address}}/auth-detail-%Y%m%d" header = "%t" permissions = 384 locking = no escape_filenames = no log_packet_header = no } # Loading module "reply_log" from file /usr/local/etc/raddb/mods-enabled/detail.log detail reply_log { filename = "/usr/local/var/log/radius/radacct/%{%{Packet-Src-IP-Address}:-%{Packet-Src-IPv6-Address}}/reply-detail-%Y%m%d" header = "%t" permissions = 384 locking = no escape_filenames = no log_packet_header = no } # Loading module "pre_proxy_log" from file /usr/local/etc/raddb/mods-enabled/detail.log detail pre_proxy_log { filename = "/usr/local/var/log/radius/radacct/%{%{Packet-Src-IP-Address}:-%{Packet-Src-IPv6-Address}}/pre-proxy-detail-%Y%m%d" header = "%t" permissions = 384 locking = no escape_filenames = no log_packet_header = no } # Loading module "post_proxy_log" from file /usr/local/etc/raddb/mods-enabled/detail.log detail post_proxy_log { filename = "/usr/local/var/log/radius/radacct/%{%{Packet-Src-IP-Address}:-%{Packet-Src-IPv6-Address}}/post-proxy-detail-%Y%m%d" header = "%t" permissions = 384 locking = no escape_filenames = no log_packet_header = no } # Loaded module rlm_soh # Loading module "soh" from file /usr/local/etc/raddb/mods-enabled/soh soh { dhcp = yes } # Loading module "detail" from file /usr/local/etc/raddb/mods-enabled/detail detail { filename = "/usr/local/var/log/radius/radacct/%{%{Packet-Src-IP-Address}:-%{Packet-Src-IPv6-Address}}/detail-%Y%m%d" header = "%t" permissions = 384 locking = no escape_filenames = no log_packet_header = no } # Loaded module rlm_attr_filter # Loading module "attr_filter.post-proxy" from file /usr/local/etc/raddb/mods-enabled/attr_filter attr_filter attr_filter.post-proxy { filename = "/usr/local/etc/raddb/mods-config/attr_filter/post-proxy" key = "%{Realm}" relaxed = no } # Loading module "attr_filter.pre-proxy" from file /usr/local/etc/raddb/mods-enabled/attr_filter attr_filter attr_filter.pre-proxy { filename = "/usr/local/etc/raddb/mods-config/attr_filter/pre-proxy" key = "%{Realm}" relaxed = no } # Loading module "attr_filter.access_reject" from file /usr/local/etc/raddb/mods-enabled/attr_filter attr_filter attr_filter.access_reject { filename = "/usr/local/etc/raddb/mods-config/attr_filter/access_reject" key = "%{User-Name}" relaxed = no } # Loading module "attr_filter.access_challenge" from file /usr/local/etc/raddb/mods-enabled/attr_filter attr_filter attr_filter.access_challenge { filename = "/usr/local/etc/raddb/mods-config/attr_filter/access_challenge" key = "%{User-Name}" relaxed = no } # Loading module "attr_filter.accounting_response" from file /usr/local/etc/raddb/mods-enabled/attr_filter attr_filter attr_filter.accounting_response { filename = "/usr/local/etc/raddb/mods-config/attr_filter/accounting_response" key = "%{User-Name}" relaxed = no } # Loading module "attr_filter.coa" from file /usr/local/etc/raddb/mods-enabled/attr_filter attr_filter attr_filter.coa { filename = "/usr/local/etc/raddb/mods-config/attr_filter/coa" key = "%{User-Name}" relaxed = no } # Loaded module rlm_linelog # Loading module "linelog" from file /usr/local/etc/raddb/mods-enabled/linelog linelog { filename = "/usr/local/var/log/radius/linelog" escape_filenames = no syslog_severity = "info" permissions = 384 format = "This is a log message for %{User-Name}" reference = "messages.%{%{reply:Packet-Type}:-default}" } # Loading module "log_accounting" from file /usr/local/etc/raddb/mods-enabled/linelog linelog log_accounting { filename = "/usr/local/var/log/radius/linelog-accounting" escape_filenames = no syslog_severity = "info" permissions = 384 format = "" reference = "Accounting-Request.%{%{Acct-Status-Type}:-unknown}" } # Loaded module rlm_expiration # Loading module "expiration" from file /usr/local/etc/raddb/mods-enabled/expiration # Loaded module rlm_eap # Loading module "eap" from file /usr/local/etc/raddb/mods-enabled/eap eap { default_eap_type = "md5" timer_expire = 60 max_eap_type = 52 ignore_unknown_eap_types = no cisco_accounting_username_bug = no max_sessions = 16384 } # Loaded module rlm_pap # Loading module "pap" from file /usr/local/etc/raddb/mods-enabled/pap pap { normalise = yes } # Loaded module rlm_passwd # Loading module "etc_passwd" from file /usr/local/etc/raddb/mods-enabled/passwd passwd etc_passwd { filename = "/etc/passwd" format = "*User-Name:Crypt-Password:" delimiter = ":" ignore_nislike = no ignore_empty = yes allow_multiple_keys = no hash_size = 100 } # Loading module "echo" from file /usr/local/etc/raddb/mods-enabled/echo exec echo { wait = yes program = "/bin/echo %{User-Name}" input_pairs = "request" output_pairs = "reply" shell_escape = yes } # Loaded module rlm_mschap # Loading module "mschap" from file /usr/local/etc/raddb/mods-enabled/mschap mschap { use_mppe = yes require_encryption = no require_strong = no with_ntdomain_hack = yes passchange { } allow_retry = yes winbind_retry_with_normalised_username = no } instantiate { } # Instantiating module "IPASS" from file /usr/local/etc/raddb/mods-enabled/realm # Instantiating module "suffix" from file /usr/local/etc/raddb/mods-enabled/realm # Instantiating module "bangpath" from file /usr/local/etc/raddb/mods-enabled/realm # Instantiating module "realmpercent" from file /usr/local/etc/raddb/mods-enabled/realm # Instantiating module "ntdomain" from file /usr/local/etc/raddb/mods-enabled/realm # Instantiating module "reject" from file /usr/local/etc/raddb/mods-enabled/always # Instantiating module "fail" from file /usr/local/etc/raddb/mods-enabled/always # Instantiating module "ok" from file /usr/local/etc/raddb/mods-enabled/always # Instantiating module "handled" from file /usr/local/etc/raddb/mods-enabled/always # Instantiating module "invalid" from file /usr/local/etc/raddb/mods-enabled/always # Instantiating module "userlock" from file /usr/local/etc/raddb/mods-enabled/always # Instantiating module "notfound" from file /usr/local/etc/raddb/mods-enabled/always # Instantiating module "noop" from file /usr/local/etc/raddb/mods-enabled/always # Instantiating module "updated" from file /usr/local/etc/raddb/mods-enabled/always # Instantiating module "preprocess" from file /usr/local/etc/raddb/mods-enabled/preprocess reading pairlist file /usr/local/etc/raddb/mods-config/preprocess/huntgroups reading pairlist file /usr/local/etc/raddb/mods-config/preprocess/hints # Instantiating module "ldap" from file /usr/local/etc/raddb/mods-enabled/ldap1 rlm_ldap: libldap vendor: OpenLDAP, version: 20457 rlm_ldap (ldap): Couldn't find configuration for accounting, will return NOOP for calls from this section rlm_ldap (ldap): Couldn't find configuration for post-auth, will return NOOP for calls from this section !!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!! !! libldap is using GnuTLS, while FreeRADIUS is using OpenSSL !! There may be random issues with TLS connections due to this conflict. !! The server may also crash. !! See https://wiki.freeradius.org/modules/Rlm_ldap for more information. !!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!! rlm_ldap (ldap): Initialising connection pool pool { start = 5 min = 3 max = 32 spare = 10 uses = 0 lifetime = 0 cleanup_interval = 30 idle_timeout = 60 retry_delay = 30 max_retries = 5 spread = no } rlm_ldap (ldap): Opening additional connection (0), 1 of 32 pending slots used rlm_ldap (ldap): Connecting to ldap://192.168.1.6:389 rlm_ldap (ldap): Waiting for bind result... rlm_ldap (ldap): Bind credentials incorrect: Invalid credentials rlm_ldap (ldap): Server said: 80090308: LdapErr: DSID-0C090569, comment: AcceptSecurityContext error, data 52e, v4f7c. rlm_ldap (ldap): Opening connection failed (0) rlm_ldap (ldap): Removing connection pool /usr/local/etc/raddb/mods-enabled/ldap1[1]: Instantiation failed for module "ldap" === Checking the packet at this time with wireshark, we can confirm that `pass\"word@2022` is used as the password. === Lightweight Directory Access Protocol LDAPMessage bindRequest(1) "cn=tkt10886-5,cn=users,dc=srv2022,dc=rdd-osaka,dc=soliton,dc=example,dc=jp" simple messageID: 1 protocolOp: bindRequest (0) bindRequest version: 3 name: cn=tkt10886-5,cn=users,dc=srv2022,dc=rdd-osaka,dc=soliton,dc=example,dc=jp authentication: simple (0) simple: pass\\"word@2022 [Response In: 8] === What should I do in this case? On 2023/09/11 18:10, Alan DeKok wrote:
On Sep 10, 2023, at 9:16 PM, 平林 哲 <Satoshi.Hirabayashi@soliton.co.jp> wrote:
=== # cat /usr/local/etc/raddb/mods-enabled/ldap1 ldap { server = '192.168.1.6' identity = 'cn=tkt10886-3,cn=users,dc=srv2022,dc=rdd-osaka,dc=soliton,dc=example,dc=jp' password = "pass\\"word@2022"
Two backslashes.
However, it behaves differently in the shell.
=== $ echo "pass\\\"word@2022"
Three backslashes.
pass\"word@2022 ===
Use three backslashes with FreeRADIUS, and it will work.
Maybe the two backslashes need to be escaped into one backslash?
I explained the rules for double-quoted strings. They're the same for all double quoted strings in FreeRADIUS, and in the shell.
If you want a " in the middle of a double quoted string, you have to escape it: \"
If you want a \ in the middle of a double quoted string, you have to escape it: \\
Which means that if you want *both* a " and a \ in a double quoted string, you need to have an *odd* number of backslashes.
All you need to do is count the number of backslashes. Even *and* there's a quote in the middle of the string? Parse error. Odd number of backslashes? It's fine.
Alan DeKok.
- List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html
sorry. There was a mistake when pasting. I will correct it below. Checking the packet at this time with wireshark, we can confirm that `pass\\"word@2022` is used as the password. === Lightweight Directory Access Protocol LDAPMessage bindRequest(1) "cn=tkt10886-5,cn=users,dc=srv2022,dc=rdd-osaka,dc=soliton,dc=example,dc=jp" simple messageID: 1 protocolOp: bindRequest (0) bindRequest version: 3 name: cn=tkt10886-5,cn=users,dc=srv2022,dc=rdd-osaka,dc=soliton,dc=example,dc=jp authentication: simple (0) simple: pass\\"word@2022 [Response In: 8] === What should I do in this case? On 2023/09/12 9:59, 平林 哲 wrote:
Maybe the two backslashes need to be escaped into one backslash?
I explained the rules for double-quoted strings. They're the same for all double quoted strings in FreeRADIUS, and in the shell.
If you want a " in the middle of a double quoted string, you have to escape it: \"
If you want a \ in the middle of a double quoted string, you have to escape it: \\
Which means that if you want *both* a " and a \ in a double quoted string, you need to have an *odd* number of backslashes.
All you need to do is count the number of backslashes. Even *and* there's a quote in the middle of the string? Parse error. Odd number of backslashes? It's fine.
OK.
I understand the configuration.
Please let me confirm the password to be sent next.
Register a user in ActiveDirectory with the password "pass\"word@2022", the following LDAP settings.
=== ldap { server = '192.168.1.6' identity = 'cn=tkt10886-5,cn=users,dc=srv2022,dc=rdd-osaka,dc=soliton,dc=example,dc=jp' password = "pass\\\"word@2022" ===
If you start with this configuration, the password verification will fail.
=== # /usr/local/sbin/radiusd -X FreeRADIUS Version 3.2.3 Copyright (C) 1999-2022 The FreeRADIUS server project and contributors There is NO warranty; not even for MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE You may redistribute copies of FreeRADIUS under the terms of the GNU General Public License For more information about these matters, see the file named COPYRIGHT Starting - reading configuration files ... including dictionary file /usr/local/share/freeradius/dictionary including dictionary file /usr/local/share/freeradius/dictionary.dhcp including dictionary file /usr/local/share/freeradius/dictionary.vqp including dictionary file /usr/local/etc/raddb/dictionary including configuration file /usr/local/etc/raddb/radiusd.conf including configuration file /usr/local/etc/raddb/proxy.conf including configuration file /usr/local/etc/raddb/clients.conf including files in directory /usr/local/etc/raddb/mods-enabled/ including configuration file /usr/local/etc/raddb/mods-enabled/dynamic_clients including configuration file /usr/local/etc/raddb/mods-enabled/realm including configuration file /usr/local/etc/raddb/mods-enabled/chap including configuration file /usr/local/etc/raddb/mods-enabled/utf8 including configuration file /usr/local/etc/raddb/mods-enabled/date including configuration file /usr/local/etc/raddb/mods-enabled/exec including configuration file /usr/local/etc/raddb/mods-enabled/unix including configuration file /usr/local/etc/raddb/mods-enabled/expr including configuration file /usr/local/etc/raddb/mods-enabled/totp including configuration file /usr/local/etc/raddb/mods-enabled/always including configuration file /usr/local/etc/raddb/mods-enabled/preprocess including configuration file /usr/local/etc/raddb/mods-enabled/ldap1 including configuration file /usr/local/etc/raddb/mods-enabled/logintime including configuration file /usr/local/etc/raddb/mods-enabled/files including configuration file /usr/local/etc/raddb/mods-enabled/radutmp including configuration file /usr/local/etc/raddb/mods-enabled/ntlm_auth including configuration file /usr/local/etc/raddb/mods-enabled/digest including configuration file /usr/local/etc/raddb/mods-enabled/sradutmp including configuration file /usr/local/etc/raddb/mods-enabled/replicate including configuration file /usr/local/etc/raddb/mods-enabled/unpack including configuration file /usr/local/etc/raddb/mods-enabled/detail.log including configuration file /usr/local/etc/raddb/mods-enabled/soh including configuration file /usr/local/etc/raddb/mods-enabled/detail including configuration file /usr/local/etc/raddb/mods-enabled/attr_filter including configuration file /usr/local/etc/raddb/mods-enabled/linelog including configuration file /usr/local/etc/raddb/mods-enabled/expiration including configuration file /usr/local/etc/raddb/mods-enabled/eap including configuration file /usr/local/etc/raddb/mods-enabled/pap including configuration file /usr/local/etc/raddb/mods-enabled/passwd including configuration file /usr/local/etc/raddb/mods-enabled/echo including configuration file /usr/local/etc/raddb/mods-enabled/mschap including files in directory /usr/local/etc/raddb/policy.d/ including configuration file /usr/local/etc/raddb/policy.d/accounting including configuration file /usr/local/etc/raddb/policy.d/abfab-tr including configuration file /usr/local/etc/raddb/policy.d/rfc7542 including configuration file /usr/local/etc/raddb/policy.d/cui including configuration file /usr/local/etc/raddb/policy.d/filter including configuration file /usr/local/etc/raddb/policy.d/canonicalization including configuration file /usr/local/etc/raddb/policy.d/dhcp including configuration file /usr/local/etc/raddb/policy.d/operator-name including configuration file /usr/local/etc/raddb/policy.d/debug including configuration file /usr/local/etc/raddb/policy.d/eap including configuration file /usr/local/etc/raddb/policy.d/control including configuration file /usr/local/etc/raddb/policy.d/moonshot-targeted-ids including files in directory /usr/local/etc/raddb/sites-enabled/ including configuration file /usr/local/etc/raddb/sites-enabled/default including configuration file /usr/local/etc/raddb/sites-enabled/inner-tunnel main { security { allow_core_dumps = no } name = "radiusd" prefix = "/usr/local" localstatedir = "/usr/local/var" logdir = "/usr/local/var/log/radius" run_dir = "/usr/local/var/run/radiusd" } main { name = "radiusd" prefix = "/usr/local" localstatedir = "/usr/local/var" sbindir = "/usr/local/sbin" logdir = "/usr/local/var/log/radius" run_dir = "/usr/local/var/run/radiusd" libdir = "/usr/local/lib" radacctdir = "/usr/local/var/log/radius/radacct" hostname_lookups = no max_request_time = 30 cleanup_delay = 5 max_requests = 16384 postauth_client_lost = no pidfile = "/usr/local/var/run/radiusd/radiusd.pid" checkrad = "/usr/local/sbin/checkrad" debug_level = 0 proxy_requests = yes log { stripped_names = no auth = no auth_badpass = no auth_goodpass = no colourise = yes msg_denied = "You are already logged in - access denied" } resources { } security { max_attributes = 200 reject_delay = 1.000000 status_server = yes allow_vulnerable_openssl = "no" } } radiusd: #### Loading Realms and Home Servers #### proxy server { retry_delay = 5 retry_count = 3 default_fallback = no dead_time = 120 wake_all_if_all_dead = no } home_server localhost { nonblock = no ipaddr = 127.0.0.1 port = 1812 type = "auth" secret = <<< secret >>> response_window = 20.000000 response_timeouts = 1 max_outstanding = 65536 zombie_period = 40 status_check = "status-server" ping_interval = 30 check_interval = 30 check_timeout = 4 num_answers_to_alive = 3 revive_interval = 120 limit { max_connections = 16 max_requests = 0 lifetime = 0 idle_timeout = 0 } coa { irt = 2 mrt = 16 mrc = 5 mrd = 30 } recv_coa { } } home_server_pool my_auth_failover { type = fail-over home_server = localhost } realm example.com { auth_pool = my_auth_failover } realm LOCAL { } radiusd: #### Loading Clients #### client localhost { ipaddr = 127.0.0.1 require_message_authenticator = no secret = <<< secret >>> nas_type = "other" proto = "*" limit { max_connections = 16 lifetime = 0 idle_timeout = 30 } } client localhost_ipv6 { ipv6addr = ::1 require_message_authenticator = no secret = <<< secret >>> limit { max_connections = 16 lifetime = 0 idle_timeout = 30 } } client naeps245 { ipaddr = 192.168.1.245 require_message_authenticator = no secret = <<< secret >>> limit { max_connections = 16 lifetime = 0 idle_timeout = 30 } } Debugger not attached # Creating Auth-Type = mschap # Creating Auth-Type = digest # Creating Auth-Type = eap # Creating Auth-Type = PAP # Creating Auth-Type = CHAP # Creating Auth-Type = MS-CHAP # Creating Autz-Type = New-TLS-Connection # Creating Post-Auth-Type = Client-Lost radiusd: #### Instantiating modules #### modules { # Loaded module rlm_dynamic_clients # Loading module "dynamic_clients" from file /usr/local/etc/raddb/mods-enabled/dynamic_clients # Loaded module rlm_realm # Loading module "IPASS" from file /usr/local/etc/raddb/mods-enabled/realm realm IPASS { format = "prefix" delimiter = "/" ignore_default = no ignore_null = no } # Loading module "suffix" from file /usr/local/etc/raddb/mods-enabled/realm realm suffix { format = "suffix" delimiter = "@" ignore_default = no ignore_null = no } # Loading module "bangpath" from file /usr/local/etc/raddb/mods-enabled/realm realm bangpath { format = "prefix" delimiter = "!" ignore_default = no ignore_null = no } # Loading module "realmpercent" from file /usr/local/etc/raddb/mods-enabled/realm realm realmpercent { format = "suffix" delimiter = "%" ignore_default = no ignore_null = no } # Loading module "ntdomain" from file /usr/local/etc/raddb/mods-enabled/realm realm ntdomain { format = "prefix" delimiter = "\\" ignore_default = no ignore_null = no } # Loaded module rlm_chap # Loading module "chap" from file /usr/local/etc/raddb/mods-enabled/chap # Loaded module rlm_utf8 # Loading module "utf8" from file /usr/local/etc/raddb/mods-enabled/utf8 # Loaded module rlm_date # Loading module "date" from file /usr/local/etc/raddb/mods-enabled/date date { format = "%b %e %Y %H:%M:%S %Z" utc = no } # Loading module "wispr2date" from file /usr/local/etc/raddb/mods-enabled/date date wispr2date { format = "%Y-%m-%dT%H:%M:%S" utc = no } # Loaded module rlm_exec # Loading module "exec" from file /usr/local/etc/raddb/mods-enabled/exec exec { wait = no input_pairs = "request" shell_escape = yes timeout = 10 } # Loaded module rlm_unix # Loading module "unix" from file /usr/local/etc/raddb/mods-enabled/unix unix { radwtmp = "/usr/local/var/log/radius/radwtmp" } Creating attribute Unix-Group # Loaded module rlm_expr # Loading module "expr" from file /usr/local/etc/raddb/mods-enabled/expr expr { safe_characters = "@abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ0123456789.-_: /aeouaaaceeeeiio?uuuayAEOUsAAACEEEEIIO?UUU?" } # Loaded module rlm_always # Loading module "reject" from file /usr/local/etc/raddb/mods-enabled/always always reject { rcode = "reject" simulcount = 0 mpp = no } # Loading module "fail" from file /usr/local/etc/raddb/mods-enabled/always always fail { rcode = "fail" simulcount = 0 mpp = no } # Loading module "ok" from file /usr/local/etc/raddb/mods-enabled/always always ok { rcode = "ok" simulcount = 0 mpp = no } # Loading module "handled" from file /usr/local/etc/raddb/mods-enabled/always always handled { rcode = "handled" simulcount = 0 mpp = no } # Loading module "invalid" from file /usr/local/etc/raddb/mods-enabled/always always invalid { rcode = "invalid" simulcount = 0 mpp = no } # Loading module "userlock" from file /usr/local/etc/raddb/mods-enabled/always always userlock { rcode = "userlock" simulcount = 0 mpp = no } # Loading module "notfound" from file /usr/local/etc/raddb/mods-enabled/always always notfound { rcode = "notfound" simulcount = 0 mpp = no } # Loading module "noop" from file /usr/local/etc/raddb/mods-enabled/always always noop { rcode = "noop" simulcount = 0 mpp = no } # Loading module "updated" from file /usr/local/etc/raddb/mods-enabled/always always updated { rcode = "updated" simulcount = 0 mpp = no } # Loaded module rlm_preprocess # Loading module "preprocess" from file /usr/local/etc/raddb/mods-enabled/preprocess preprocess { huntgroups = "/usr/local/etc/raddb/mods-config/preprocess/huntgroups" hints = "/usr/local/etc/raddb/mods-config/preprocess/hints" with_ascend_hack = no ascend_channels_per_line = 23 with_ntdomain_hack = no with_specialix_jetstream_hack = no with_cisco_vsa_hack = no with_alvarion_vsa_hack = no } # Loaded module rlm_ldap # Loading module "ldap" from file /usr/local/etc/raddb/mods-enabled/ldap1 ldap { server = "192.168.1.6" identity = "cn=tkt10886-5,cn=users,dc=srv2022,dc=rdd-osaka,dc=soliton,dc=example,dc=jp" password = <<< secret >>> sasl { } user_dn = "LDAP-UserDn" user { scope = "sub" access_positive = yes sasl { } } group { scope = "sub" name_attribute = "cn" cacheable_name = no cacheable_dn = no allow_dangling_group_ref = no } client { scope = "sub" base_dn = "" } profile { } options { ldap_debug = 0 net_timeout = 10 res_timeout = 20 srv_timelimit = 20 idle = 60 probes = 3 interval = 30 } tls { check_crl = no start_tls = no } } Creating attribute LDAP-Group # Loaded module rlm_logintime # Loading module "logintime" from file /usr/local/etc/raddb/mods-enabled/logintime logintime { minimum_timeout = 60 } # Loaded module rlm_files # Loading module "files" from file /usr/local/etc/raddb/mods-enabled/files files { filename = "/usr/local/etc/raddb/mods-config/files/authorize" acctusersfile = "/usr/local/etc/raddb/mods-config/files/accounting" preproxy_usersfile = "/usr/local/etc/raddb/mods-config/files/pre-proxy" } # Loaded module rlm_radutmp # Loading module "radutmp" from file /usr/local/etc/raddb/mods-enabled/radutmp radutmp { filename = "/usr/local/var/log/radius/radutmp" username = "%{User-Name}" case_sensitive = yes check_with_nas = yes permissions = 384 caller_id = yes } # Loading module "ntlm_auth" from file /usr/local/etc/raddb/mods-enabled/ntlm_auth exec ntlm_auth { wait = yes program = "/path/to/ntlm_auth --request-nt-key --domain=MYDOMAIN --username=%{mschap:User-Name} --password=%{User-Password}" shell_escape = yes } # Loaded module rlm_digest # Loading module "digest" from file /usr/local/etc/raddb/mods-enabled/digest # Loading module "sradutmp" from file /usr/local/etc/raddb/mods-enabled/sradutmp radutmp sradutmp { filename = "/usr/local/var/log/radius/sradutmp" username = "%{User-Name}" case_sensitive = yes check_with_nas = yes permissions = 420 caller_id = no } # Loaded module rlm_replicate # Loading module "replicate" from file /usr/local/etc/raddb/mods-enabled/replicate # Loaded module rlm_unpack # Loading module "unpack" from file /usr/local/etc/raddb/mods-enabled/unpack # Loaded module rlm_detail # Loading module "auth_log" from file /usr/local/etc/raddb/mods-enabled/detail.log detail auth_log { filename = "/usr/local/var/log/radius/radacct/%{%{Packet-Src-IP-Address}:-%{Packet-Src-IPv6-Address}}/auth-detail-%Y%m%d" header = "%t" permissions = 384 locking = no escape_filenames = no log_packet_header = no } # Loading module "reply_log" from file /usr/local/etc/raddb/mods-enabled/detail.log detail reply_log { filename = "/usr/local/var/log/radius/radacct/%{%{Packet-Src-IP-Address}:-%{Packet-Src-IPv6-Address}}/reply-detail-%Y%m%d" header = "%t" permissions = 384 locking = no escape_filenames = no log_packet_header = no } # Loading module "pre_proxy_log" from file /usr/local/etc/raddb/mods-enabled/detail.log detail pre_proxy_log { filename = "/usr/local/var/log/radius/radacct/%{%{Packet-Src-IP-Address}:-%{Packet-Src-IPv6-Address}}/pre-proxy-detail-%Y%m%d" header = "%t" permissions = 384 locking = no escape_filenames = no log_packet_header = no } # Loading module "post_proxy_log" from file /usr/local/etc/raddb/mods-enabled/detail.log detail post_proxy_log { filename = "/usr/local/var/log/radius/radacct/%{%{Packet-Src-IP-Address}:-%{Packet-Src-IPv6-Address}}/post-proxy-detail-%Y%m%d" header = "%t" permissions = 384 locking = no escape_filenames = no log_packet_header = no } # Loaded module rlm_soh # Loading module "soh" from file /usr/local/etc/raddb/mods-enabled/soh soh { dhcp = yes } # Loading module "detail" from file /usr/local/etc/raddb/mods-enabled/detail detail { filename = "/usr/local/var/log/radius/radacct/%{%{Packet-Src-IP-Address}:-%{Packet-Src-IPv6-Address}}/detail-%Y%m%d" header = "%t" permissions = 384 locking = no escape_filenames = no log_packet_header = no } # Loaded module rlm_attr_filter # Loading module "attr_filter.post-proxy" from file /usr/local/etc/raddb/mods-enabled/attr_filter attr_filter attr_filter.post-proxy { filename = "/usr/local/etc/raddb/mods-config/attr_filter/post-proxy" key = "%{Realm}" relaxed = no } # Loading module "attr_filter.pre-proxy" from file /usr/local/etc/raddb/mods-enabled/attr_filter attr_filter attr_filter.pre-proxy { filename = "/usr/local/etc/raddb/mods-config/attr_filter/pre-proxy" key = "%{Realm}" relaxed = no } # Loading module "attr_filter.access_reject" from file /usr/local/etc/raddb/mods-enabled/attr_filter attr_filter attr_filter.access_reject { filename = "/usr/local/etc/raddb/mods-config/attr_filter/access_reject" key = "%{User-Name}" relaxed = no } # Loading module "attr_filter.access_challenge" from file /usr/local/etc/raddb/mods-enabled/attr_filter attr_filter attr_filter.access_challenge { filename = "/usr/local/etc/raddb/mods-config/attr_filter/access_challenge" key = "%{User-Name}" relaxed = no } # Loading module "attr_filter.accounting_response" from file /usr/local/etc/raddb/mods-enabled/attr_filter attr_filter attr_filter.accounting_response { filename = "/usr/local/etc/raddb/mods-config/attr_filter/accounting_response" key = "%{User-Name}" relaxed = no } # Loading module "attr_filter.coa" from file /usr/local/etc/raddb/mods-enabled/attr_filter attr_filter attr_filter.coa { filename = "/usr/local/etc/raddb/mods-config/attr_filter/coa" key = "%{User-Name}" relaxed = no } # Loaded module rlm_linelog # Loading module "linelog" from file /usr/local/etc/raddb/mods-enabled/linelog linelog { filename = "/usr/local/var/log/radius/linelog" escape_filenames = no syslog_severity = "info" permissions = 384 format = "This is a log message for %{User-Name}" reference = "messages.%{%{reply:Packet-Type}:-default}" } # Loading module "log_accounting" from file /usr/local/etc/raddb/mods-enabled/linelog linelog log_accounting { filename = "/usr/local/var/log/radius/linelog-accounting" escape_filenames = no syslog_severity = "info" permissions = 384 format = "" reference = "Accounting-Request.%{%{Acct-Status-Type}:-unknown}" } # Loaded module rlm_expiration # Loading module "expiration" from file /usr/local/etc/raddb/mods-enabled/expiration # Loaded module rlm_eap # Loading module "eap" from file /usr/local/etc/raddb/mods-enabled/eap eap { default_eap_type = "md5" timer_expire = 60 max_eap_type = 52 ignore_unknown_eap_types = no cisco_accounting_username_bug = no max_sessions = 16384 } # Loaded module rlm_pap # Loading module "pap" from file /usr/local/etc/raddb/mods-enabled/pap pap { normalise = yes } # Loaded module rlm_passwd # Loading module "etc_passwd" from file /usr/local/etc/raddb/mods-enabled/passwd passwd etc_passwd { filename = "/etc/passwd" format = "*User-Name:Crypt-Password:" delimiter = ":" ignore_nislike = no ignore_empty = yes allow_multiple_keys = no hash_size = 100 } # Loading module "echo" from file /usr/local/etc/raddb/mods-enabled/echo exec echo { wait = yes program = "/bin/echo %{User-Name}" input_pairs = "request" output_pairs = "reply" shell_escape = yes } # Loaded module rlm_mschap # Loading module "mschap" from file /usr/local/etc/raddb/mods-enabled/mschap mschap { use_mppe = yes require_encryption = no require_strong = no with_ntdomain_hack = yes passchange { } allow_retry = yes winbind_retry_with_normalised_username = no } instantiate { } # Instantiating module "IPASS" from file /usr/local/etc/raddb/mods-enabled/realm # Instantiating module "suffix" from file /usr/local/etc/raddb/mods-enabled/realm # Instantiating module "bangpath" from file /usr/local/etc/raddb/mods-enabled/realm # Instantiating module "realmpercent" from file /usr/local/etc/raddb/mods-enabled/realm # Instantiating module "ntdomain" from file /usr/local/etc/raddb/mods-enabled/realm # Instantiating module "reject" from file /usr/local/etc/raddb/mods-enabled/always # Instantiating module "fail" from file /usr/local/etc/raddb/mods-enabled/always # Instantiating module "ok" from file /usr/local/etc/raddb/mods-enabled/always # Instantiating module "handled" from file /usr/local/etc/raddb/mods-enabled/always # Instantiating module "invalid" from file /usr/local/etc/raddb/mods-enabled/always # Instantiating module "userlock" from file /usr/local/etc/raddb/mods-enabled/always # Instantiating module "notfound" from file /usr/local/etc/raddb/mods-enabled/always # Instantiating module "noop" from file /usr/local/etc/raddb/mods-enabled/always # Instantiating module "updated" from file /usr/local/etc/raddb/mods-enabled/always # Instantiating module "preprocess" from file /usr/local/etc/raddb/mods-enabled/preprocess reading pairlist file /usr/local/etc/raddb/mods-config/preprocess/huntgroups reading pairlist file /usr/local/etc/raddb/mods-config/preprocess/hints # Instantiating module "ldap" from file /usr/local/etc/raddb/mods-enabled/ldap1 rlm_ldap: libldap vendor: OpenLDAP, version: 20457 rlm_ldap (ldap): Couldn't find configuration for accounting, will return NOOP for calls from this section rlm_ldap (ldap): Couldn't find configuration for post-auth, will return NOOP for calls from this section !!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!! !! libldap is using GnuTLS, while FreeRADIUS is using OpenSSL !! There may be random issues with TLS connections due to this conflict. !! The server may also crash. !! See https://wiki.freeradius.org/modules/Rlm_ldap for more information. !!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!! rlm_ldap (ldap): Initialising connection pool pool { start = 5 min = 3 max = 32 spare = 10 uses = 0 lifetime = 0 cleanup_interval = 30 idle_timeout = 60 retry_delay = 30 max_retries = 5 spread = no } rlm_ldap (ldap): Opening additional connection (0), 1 of 32 pending slots used rlm_ldap (ldap): Connecting to ldap://192.168.1.6:389 rlm_ldap (ldap): Waiting for bind result... rlm_ldap (ldap): Bind credentials incorrect: Invalid credentials rlm_ldap (ldap): Server said: 80090308: LdapErr: DSID-0C090569, comment: AcceptSecurityContext error, data 52e, v4f7c. rlm_ldap (ldap): Opening connection failed (0) rlm_ldap (ldap): Removing connection pool /usr/local/etc/raddb/mods-enabled/ldap1[1]: Instantiation failed for module "ldap" root@debian11-hira:/usr/local/etc/raddb# /usr/local/sbin/radiusd -X FreeRADIUS Version 3.2.3 Copyright (C) 1999-2022 The FreeRADIUS server project and contributors There is NO warranty; not even for MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE You may redistribute copies of FreeRADIUS under the terms of the GNU General Public License For more information about these matters, see the file named COPYRIGHT Starting - reading configuration files ... including dictionary file /usr/local/share/freeradius/dictionary including dictionary file /usr/local/share/freeradius/dictionary.dhcp including dictionary file /usr/local/share/freeradius/dictionary.vqp including dictionary file /usr/local/etc/raddb/dictionary including configuration file /usr/local/etc/raddb/radiusd.conf including configuration file /usr/local/etc/raddb/proxy.conf including configuration file /usr/local/etc/raddb/clients.conf including files in directory /usr/local/etc/raddb/mods-enabled/ including configuration file /usr/local/etc/raddb/mods-enabled/dynamic_clients including configuration file /usr/local/etc/raddb/mods-enabled/realm including configuration file /usr/local/etc/raddb/mods-enabled/chap including configuration file /usr/local/etc/raddb/mods-enabled/utf8 including configuration file /usr/local/etc/raddb/mods-enabled/date including configuration file /usr/local/etc/raddb/mods-enabled/exec including configuration file /usr/local/etc/raddb/mods-enabled/unix including configuration file /usr/local/etc/raddb/mods-enabled/expr including configuration file /usr/local/etc/raddb/mods-enabled/totp including configuration file /usr/local/etc/raddb/mods-enabled/always including configuration file /usr/local/etc/raddb/mods-enabled/preprocess including configuration file /usr/local/etc/raddb/mods-enabled/ldap1 including configuration file /usr/local/etc/raddb/mods-enabled/logintime including configuration file /usr/local/etc/raddb/mods-enabled/files including configuration file /usr/local/etc/raddb/mods-enabled/radutmp including configuration file /usr/local/etc/raddb/mods-enabled/ntlm_auth including configuration file /usr/local/etc/raddb/mods-enabled/digest including configuration file /usr/local/etc/raddb/mods-enabled/sradutmp including configuration file /usr/local/etc/raddb/mods-enabled/replicate including configuration file /usr/local/etc/raddb/mods-enabled/unpack including configuration file /usr/local/etc/raddb/mods-enabled/detail.log including configuration file /usr/local/etc/raddb/mods-enabled/soh including configuration file /usr/local/etc/raddb/mods-enabled/detail including configuration file /usr/local/etc/raddb/mods-enabled/attr_filter including configuration file /usr/local/etc/raddb/mods-enabled/linelog including configuration file /usr/local/etc/raddb/mods-enabled/expiration including configuration file /usr/local/etc/raddb/mods-enabled/eap including configuration file /usr/local/etc/raddb/mods-enabled/pap including configuration file /usr/local/etc/raddb/mods-enabled/passwd including configuration file /usr/local/etc/raddb/mods-enabled/echo including configuration file /usr/local/etc/raddb/mods-enabled/mschap including files in directory /usr/local/etc/raddb/policy.d/ including configuration file /usr/local/etc/raddb/policy.d/accounting including configuration file /usr/local/etc/raddb/policy.d/abfab-tr including configuration file /usr/local/etc/raddb/policy.d/rfc7542 including configuration file /usr/local/etc/raddb/policy.d/cui including configuration file /usr/local/etc/raddb/policy.d/filter including configuration file /usr/local/etc/raddb/policy.d/canonicalization including configuration file /usr/local/etc/raddb/policy.d/dhcp including configuration file /usr/local/etc/raddb/policy.d/operator-name including configuration file /usr/local/etc/raddb/policy.d/debug including configuration file /usr/local/etc/raddb/policy.d/eap including configuration file /usr/local/etc/raddb/policy.d/control including configuration file /usr/local/etc/raddb/policy.d/moonshot-targeted-ids including files in directory /usr/local/etc/raddb/sites-enabled/ including configuration file /usr/local/etc/raddb/sites-enabled/default including configuration file /usr/local/etc/raddb/sites-enabled/inner-tunnel main { security { allow_core_dumps = no } name = "radiusd" prefix = "/usr/local" localstatedir = "/usr/local/var" logdir = "/usr/local/var/log/radius" run_dir = "/usr/local/var/run/radiusd" } main { name = "radiusd" prefix = "/usr/local" localstatedir = "/usr/local/var" sbindir = "/usr/local/sbin" logdir = "/usr/local/var/log/radius" run_dir = "/usr/local/var/run/radiusd" libdir = "/usr/local/lib" radacctdir = "/usr/local/var/log/radius/radacct" hostname_lookups = no max_request_time = 30 cleanup_delay = 5 max_requests = 16384 postauth_client_lost = no pidfile = "/usr/local/var/run/radiusd/radiusd.pid" checkrad = "/usr/local/sbin/checkrad" debug_level = 0 proxy_requests = yes log { stripped_names = no auth = no auth_badpass = no auth_goodpass = no colourise = yes msg_denied = "You are already logged in - access denied" } resources { } security { max_attributes = 200 reject_delay = 1.000000 status_server = yes allow_vulnerable_openssl = "no" } } radiusd: #### Loading Realms and Home Servers #### proxy server { retry_delay = 5 retry_count = 3 default_fallback = no dead_time = 120 wake_all_if_all_dead = no } home_server localhost { nonblock = no ipaddr = 127.0.0.1 port = 1812 type = "auth" secret = <<< secret >>> response_window = 20.000000 response_timeouts = 1 max_outstanding = 65536 zombie_period = 40 status_check = "status-server" ping_interval = 30 check_interval = 30 check_timeout = 4 num_answers_to_alive = 3 revive_interval = 120 limit { max_connections = 16 max_requests = 0 lifetime = 0 idle_timeout = 0 } coa { irt = 2 mrt = 16 mrc = 5 mrd = 30 } recv_coa { } } home_server_pool my_auth_failover { type = fail-over home_server = localhost } realm example.com { auth_pool = my_auth_failover } realm LOCAL { } radiusd: #### Loading Clients #### client localhost { ipaddr = 127.0.0.1 require_message_authenticator = no secret = <<< secret >>> nas_type = "other" proto = "*" limit { max_connections = 16 lifetime = 0 idle_timeout = 30 } } client localhost_ipv6 { ipv6addr = ::1 require_message_authenticator = no secret = <<< secret >>> limit { max_connections = 16 lifetime = 0 idle_timeout = 30 } } client naeps245 { ipaddr = 192.168.1.245 require_message_authenticator = no secret = <<< secret >>> limit { max_connections = 16 lifetime = 0 idle_timeout = 30 } } Debugger not attached # Creating Auth-Type = mschap # Creating Auth-Type = digest # Creating Auth-Type = eap # Creating Auth-Type = PAP # Creating Auth-Type = CHAP # Creating Auth-Type = MS-CHAP # Creating Autz-Type = New-TLS-Connection # Creating Post-Auth-Type = Client-Lost radiusd: #### Instantiating modules #### modules { # Loaded module rlm_dynamic_clients # Loading module "dynamic_clients" from file /usr/local/etc/raddb/mods-enabled/dynamic_clients # Loaded module rlm_realm # Loading module "IPASS" from file /usr/local/etc/raddb/mods-enabled/realm realm IPASS { format = "prefix" delimiter = "/" ignore_default = no ignore_null = no } # Loading module "suffix" from file /usr/local/etc/raddb/mods-enabled/realm realm suffix { format = "suffix" delimiter = "@" ignore_default = no ignore_null = no } # Loading module "bangpath" from file /usr/local/etc/raddb/mods-enabled/realm realm bangpath { format = "prefix" delimiter = "!" ignore_default = no ignore_null = no } # Loading module "realmpercent" from file /usr/local/etc/raddb/mods-enabled/realm realm realmpercent { format = "suffix" delimiter = "%" ignore_default = no ignore_null = no } # Loading module "ntdomain" from file /usr/local/etc/raddb/mods-enabled/realm realm ntdomain { format = "prefix" delimiter = "\\" ignore_default = no ignore_null = no } # Loaded module rlm_chap # Loading module "chap" from file /usr/local/etc/raddb/mods-enabled/chap # Loaded module rlm_utf8 # Loading module "utf8" from file /usr/local/etc/raddb/mods-enabled/utf8 # Loaded module rlm_date # Loading module "date" from file /usr/local/etc/raddb/mods-enabled/date date { format = "%b %e %Y %H:%M:%S %Z" utc = no } # Loading module "wispr2date" from file /usr/local/etc/raddb/mods-enabled/date date wispr2date { format = "%Y-%m-%dT%H:%M:%S" utc = no } # Loaded module rlm_exec # Loading module "exec" from file /usr/local/etc/raddb/mods-enabled/exec exec { wait = no input_pairs = "request" shell_escape = yes timeout = 10 } # Loaded module rlm_unix # Loading module "unix" from file /usr/local/etc/raddb/mods-enabled/unix unix { radwtmp = "/usr/local/var/log/radius/radwtmp" } Creating attribute Unix-Group # Loaded module rlm_expr # Loading module "expr" from file /usr/local/etc/raddb/mods-enabled/expr expr { safe_characters = "@abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ0123456789.-_: /aeouaaaceeeeiio?uuuayAEOUsAAACEEEEIIO?UUU?" } # Loaded module rlm_always # Loading module "reject" from file /usr/local/etc/raddb/mods-enabled/always always reject { rcode = "reject" simulcount = 0 mpp = no } # Loading module "fail" from file /usr/local/etc/raddb/mods-enabled/always always fail { rcode = "fail" simulcount = 0 mpp = no } # Loading module "ok" from file /usr/local/etc/raddb/mods-enabled/always always ok { rcode = "ok" simulcount = 0 mpp = no } # Loading module "handled" from file /usr/local/etc/raddb/mods-enabled/always always handled { rcode = "handled" simulcount = 0 mpp = no } # Loading module "invalid" from file /usr/local/etc/raddb/mods-enabled/always always invalid { rcode = "invalid" simulcount = 0 mpp = no } # Loading module "userlock" from file /usr/local/etc/raddb/mods-enabled/always always userlock { rcode = "userlock" simulcount = 0 mpp = no } # Loading module "notfound" from file /usr/local/etc/raddb/mods-enabled/always always notfound { rcode = "notfound" simulcount = 0 mpp = no } # Loading module "noop" from file /usr/local/etc/raddb/mods-enabled/always always noop { rcode = "noop" simulcount = 0 mpp = no } # Loading module "updated" from file /usr/local/etc/raddb/mods-enabled/always always updated { rcode = "updated" simulcount = 0 mpp = no } # Loaded module rlm_preprocess # Loading module "preprocess" from file /usr/local/etc/raddb/mods-enabled/preprocess preprocess { huntgroups = "/usr/local/etc/raddb/mods-config/preprocess/huntgroups" hints = "/usr/local/etc/raddb/mods-config/preprocess/hints" with_ascend_hack = no ascend_channels_per_line = 23 with_ntdomain_hack = no with_specialix_jetstream_hack = no with_cisco_vsa_hack = no with_alvarion_vsa_hack = no } # Loaded module rlm_ldap # Loading module "ldap" from file /usr/local/etc/raddb/mods-enabled/ldap1 ldap { server = "192.168.1.6" identity = "cn=tkt10886-5,cn=users,dc=srv2022,dc=rdd-osaka,dc=soliton,dc=example,dc=jp" password = <<< secret >>> sasl { } user_dn = "LDAP-UserDn" user { scope = "sub" access_positive = yes sasl { } } group { scope = "sub" name_attribute = "cn" cacheable_name = no cacheable_dn = no allow_dangling_group_ref = no } client { scope = "sub" base_dn = "" } profile { } options { ldap_debug = 0 net_timeout = 10 res_timeout = 20 srv_timelimit = 20 idle = 60 probes = 3 interval = 30 } tls { check_crl = no start_tls = no } } Creating attribute LDAP-Group # Loaded module rlm_logintime # Loading module "logintime" from file /usr/local/etc/raddb/mods-enabled/logintime logintime { minimum_timeout = 60 } # Loaded module rlm_files # Loading module "files" from file /usr/local/etc/raddb/mods-enabled/files files { filename = "/usr/local/etc/raddb/mods-config/files/authorize" acctusersfile = "/usr/local/etc/raddb/mods-config/files/accounting" preproxy_usersfile = "/usr/local/etc/raddb/mods-config/files/pre-proxy" } # Loaded module rlm_radutmp # Loading module "radutmp" from file /usr/local/etc/raddb/mods-enabled/radutmp radutmp { filename = "/usr/local/var/log/radius/radutmp" username = "%{User-Name}" case_sensitive = yes check_with_nas = yes permissions = 384 caller_id = yes } # Loading module "ntlm_auth" from file /usr/local/etc/raddb/mods-enabled/ntlm_auth exec ntlm_auth { wait = yes program = "/path/to/ntlm_auth --request-nt-key --domain=MYDOMAIN --username=%{mschap:User-Name} --password=%{User-Password}" shell_escape = yes } # Loaded module rlm_digest # Loading module "digest" from file /usr/local/etc/raddb/mods-enabled/digest # Loading module "sradutmp" from file /usr/local/etc/raddb/mods-enabled/sradutmp radutmp sradutmp { filename = "/usr/local/var/log/radius/sradutmp" username = "%{User-Name}" case_sensitive = yes check_with_nas = yes permissions = 420 caller_id = no } # Loaded module rlm_replicate # Loading module "replicate" from file /usr/local/etc/raddb/mods-enabled/replicate # Loaded module rlm_unpack # Loading module "unpack" from file /usr/local/etc/raddb/mods-enabled/unpack # Loaded module rlm_detail # Loading module "auth_log" from file /usr/local/etc/raddb/mods-enabled/detail.log detail auth_log { filename = "/usr/local/var/log/radius/radacct/%{%{Packet-Src-IP-Address}:-%{Packet-Src-IPv6-Address}}/auth-detail-%Y%m%d" header = "%t" permissions = 384 locking = no escape_filenames = no log_packet_header = no } # Loading module "reply_log" from file /usr/local/etc/raddb/mods-enabled/detail.log detail reply_log { filename = "/usr/local/var/log/radius/radacct/%{%{Packet-Src-IP-Address}:-%{Packet-Src-IPv6-Address}}/reply-detail-%Y%m%d" header = "%t" permissions = 384 locking = no escape_filenames = no log_packet_header = no } # Loading module "pre_proxy_log" from file /usr/local/etc/raddb/mods-enabled/detail.log detail pre_proxy_log { filename = "/usr/local/var/log/radius/radacct/%{%{Packet-Src-IP-Address}:-%{Packet-Src-IPv6-Address}}/pre-proxy-detail-%Y%m%d" header = "%t" permissions = 384 locking = no escape_filenames = no log_packet_header = no } # Loading module "post_proxy_log" from file /usr/local/etc/raddb/mods-enabled/detail.log detail post_proxy_log { filename = "/usr/local/var/log/radius/radacct/%{%{Packet-Src-IP-Address}:-%{Packet-Src-IPv6-Address}}/post-proxy-detail-%Y%m%d" header = "%t" permissions = 384 locking = no escape_filenames = no log_packet_header = no } # Loaded module rlm_soh # Loading module "soh" from file /usr/local/etc/raddb/mods-enabled/soh soh { dhcp = yes } # Loading module "detail" from file /usr/local/etc/raddb/mods-enabled/detail detail { filename = "/usr/local/var/log/radius/radacct/%{%{Packet-Src-IP-Address}:-%{Packet-Src-IPv6-Address}}/detail-%Y%m%d" header = "%t" permissions = 384 locking = no escape_filenames = no log_packet_header = no } # Loaded module rlm_attr_filter # Loading module "attr_filter.post-proxy" from file /usr/local/etc/raddb/mods-enabled/attr_filter attr_filter attr_filter.post-proxy { filename = "/usr/local/etc/raddb/mods-config/attr_filter/post-proxy" key = "%{Realm}" relaxed = no } # Loading module "attr_filter.pre-proxy" from file /usr/local/etc/raddb/mods-enabled/attr_filter attr_filter attr_filter.pre-proxy { filename = "/usr/local/etc/raddb/mods-config/attr_filter/pre-proxy" key = "%{Realm}" relaxed = no } # Loading module "attr_filter.access_reject" from file /usr/local/etc/raddb/mods-enabled/attr_filter attr_filter attr_filter.access_reject { filename = "/usr/local/etc/raddb/mods-config/attr_filter/access_reject" key = "%{User-Name}" relaxed = no } # Loading module "attr_filter.access_challenge" from file /usr/local/etc/raddb/mods-enabled/attr_filter attr_filter attr_filter.access_challenge { filename = "/usr/local/etc/raddb/mods-config/attr_filter/access_challenge" key = "%{User-Name}" relaxed = no } # Loading module "attr_filter.accounting_response" from file /usr/local/etc/raddb/mods-enabled/attr_filter attr_filter attr_filter.accounting_response { filename = "/usr/local/etc/raddb/mods-config/attr_filter/accounting_response" key = "%{User-Name}" relaxed = no } # Loading module "attr_filter.coa" from file /usr/local/etc/raddb/mods-enabled/attr_filter attr_filter attr_filter.coa { filename = "/usr/local/etc/raddb/mods-config/attr_filter/coa" key = "%{User-Name}" relaxed = no } # Loaded module rlm_linelog # Loading module "linelog" from file /usr/local/etc/raddb/mods-enabled/linelog linelog { filename = "/usr/local/var/log/radius/linelog" escape_filenames = no syslog_severity = "info" permissions = 384 format = "This is a log message for %{User-Name}" reference = "messages.%{%{reply:Packet-Type}:-default}" } # Loading module "log_accounting" from file /usr/local/etc/raddb/mods-enabled/linelog linelog log_accounting { filename = "/usr/local/var/log/radius/linelog-accounting" escape_filenames = no syslog_severity = "info" permissions = 384 format = "" reference = "Accounting-Request.%{%{Acct-Status-Type}:-unknown}" } # Loaded module rlm_expiration # Loading module "expiration" from file /usr/local/etc/raddb/mods-enabled/expiration # Loaded module rlm_eap # Loading module "eap" from file /usr/local/etc/raddb/mods-enabled/eap eap { default_eap_type = "md5" timer_expire = 60 max_eap_type = 52 ignore_unknown_eap_types = no cisco_accounting_username_bug = no max_sessions = 16384 } # Loaded module rlm_pap # Loading module "pap" from file /usr/local/etc/raddb/mods-enabled/pap pap { normalise = yes } # Loaded module rlm_passwd # Loading module "etc_passwd" from file /usr/local/etc/raddb/mods-enabled/passwd passwd etc_passwd { filename = "/etc/passwd" format = "*User-Name:Crypt-Password:" delimiter = ":" ignore_nislike = no ignore_empty = yes allow_multiple_keys = no hash_size = 100 } # Loading module "echo" from file /usr/local/etc/raddb/mods-enabled/echo exec echo { wait = yes program = "/bin/echo %{User-Name}" input_pairs = "request" output_pairs = "reply" shell_escape = yes } # Loaded module rlm_mschap # Loading module "mschap" from file /usr/local/etc/raddb/mods-enabled/mschap mschap { use_mppe = yes require_encryption = no require_strong = no with_ntdomain_hack = yes passchange { } allow_retry = yes winbind_retry_with_normalised_username = no } instantiate { } # Instantiating module "IPASS" from file /usr/local/etc/raddb/mods-enabled/realm # Instantiating module "suffix" from file /usr/local/etc/raddb/mods-enabled/realm # Instantiating module "bangpath" from file /usr/local/etc/raddb/mods-enabled/realm # Instantiating module "realmpercent" from file /usr/local/etc/raddb/mods-enabled/realm # Instantiating module "ntdomain" from file /usr/local/etc/raddb/mods-enabled/realm # Instantiating module "reject" from file /usr/local/etc/raddb/mods-enabled/always # Instantiating module "fail" from file /usr/local/etc/raddb/mods-enabled/always # Instantiating module "ok" from file /usr/local/etc/raddb/mods-enabled/always # Instantiating module "handled" from file /usr/local/etc/raddb/mods-enabled/always # Instantiating module "invalid" from file /usr/local/etc/raddb/mods-enabled/always # Instantiating module "userlock" from file /usr/local/etc/raddb/mods-enabled/always # Instantiating module "notfound" from file /usr/local/etc/raddb/mods-enabled/always # Instantiating module "noop" from file /usr/local/etc/raddb/mods-enabled/always # Instantiating module "updated" from file /usr/local/etc/raddb/mods-enabled/always # Instantiating module "preprocess" from file /usr/local/etc/raddb/mods-enabled/preprocess reading pairlist file /usr/local/etc/raddb/mods-config/preprocess/huntgroups reading pairlist file /usr/local/etc/raddb/mods-config/preprocess/hints # Instantiating module "ldap" from file /usr/local/etc/raddb/mods-enabled/ldap1 rlm_ldap: libldap vendor: OpenLDAP, version: 20457 rlm_ldap (ldap): Couldn't find configuration for accounting, will return NOOP for calls from this section rlm_ldap (ldap): Couldn't find configuration for post-auth, will return NOOP for calls from this section !!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!! !! libldap is using GnuTLS, while FreeRADIUS is using OpenSSL !! There may be random issues with TLS connections due to this conflict. !! The server may also crash. !! See https://wiki.freeradius.org/modules/Rlm_ldap for more information. !!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!! rlm_ldap (ldap): Initialising connection pool pool { start = 5 min = 3 max = 32 spare = 10 uses = 0 lifetime = 0 cleanup_interval = 30 idle_timeout = 60 retry_delay = 30 max_retries = 5 spread = no } rlm_ldap (ldap): Opening additional connection (0), 1 of 32 pending slots used rlm_ldap (ldap): Connecting to ldap://192.168.1.6:389 rlm_ldap (ldap): Waiting for bind result... rlm_ldap (ldap): Bind credentials incorrect: Invalid credentials rlm_ldap (ldap): Server said: 80090308: LdapErr: DSID-0C090569, comment: AcceptSecurityContext error, data 52e, v4f7c. rlm_ldap (ldap): Opening connection failed (0) rlm_ldap (ldap): Removing connection pool /usr/local/etc/raddb/mods-enabled/ldap1[1]: Instantiation failed for module "ldap" ===
Checking the packet at this time with wireshark, we can confirm that `pass\"word@2022` is used as the password.
=== Lightweight Directory Access Protocol LDAPMessage bindRequest(1) "cn=tkt10886-5,cn=users,dc=srv2022,dc=rdd-osaka,dc=soliton,dc=example,dc=jp" simple messageID: 1 protocolOp: bindRequest (0) bindRequest version: 3 name: cn=tkt10886-5,cn=users,dc=srv2022,dc=rdd-osaka,dc=soliton,dc=example,dc=jp authentication: simple (0) simple: pass\\"word@2022 [Response In: 8] ===
What should I do in this case?
On 2023/09/11 18:10, Alan DeKok wrote:
On Sep 10, 2023, at 9:16 PM, 平林 哲 <Satoshi.Hirabayashi@soliton.co.jp> wrote:
=== # cat /usr/local/etc/raddb/mods-enabled/ldap1 ldap { server = '192.168.1.6' identity = 'cn=tkt10886-3,cn=users,dc=srv2022,dc=rdd-osaka,dc=soliton,dc=example,dc=jp' password = "pass\\"word@2022"
Two backslashes.
However, it behaves differently in the shell.
=== $ echo "pass\\\"word@2022"
Three backslashes.
pass\"word@2022 ===
Use three backslashes with FreeRADIUS, and it will work.
Maybe the two backslashes need to be escaped into one backslash?
I explained the rules for double-quoted strings. They're the same for all double quoted strings in FreeRADIUS, and in the shell.
If you want a " in the middle of a double quoted string, you have to escape it: \"
If you want a \ in the middle of a double quoted string, you have to escape it: \\
Which means that if you want *both* a " and a \ in a double quoted string, you need to have an *odd* number of backslashes.
All you need to do is count the number of backslashes. Even *and* there's a quote in the middle of the string? Parse error. Odd number of backslashes? It's fine.
Alan DeKok.
- List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html
I think everyone lost track. As Alain said, it's exactly like in the Shell etc. If the UNESCAPED password is pass\\"word@2022 the escaped password should be pass\\\\\"word@2022 (5 backslashes). September 12, 2023 6:36 AM, "平林 哲" <Satoshi.Hirabayashi@soliton.co.jp> wrote:
sorry. There was a mistake when pasting.
I will correct it below.
Checking the packet at this time with wireshark, we can confirm that `pass\\"word@2022` is used as the password.
=== Lightweight Directory Access Protocol LDAPMessage bindRequest(1) "cn=tkt10886-5,cn=users,dc=srv2022,dc=rdd-osaka,dc=soliton,dc=example,dc=jp" simple messageID: 1 protocolOp: bindRequest (0) bindRequest version: 3 name: cn=tkt10886-5,cn=users,dc=srv2022,dc=rdd-osaka,dc=soliton,dc=example,dc=jp authentication: simple (0) simple: pass\\"word@2022 [Response In: 8] ===
What should I do in this case?
On 2023/09/12 9:59, 平林 哲 wrote:
Maybe the two backslashes need to be escaped into one backslash?
I explained the rules for double-quoted strings. They're the same for all double quoted strings in FreeRADIUS, and in the shell.
If you want a " in the middle of a double quoted string, you have to escape it: \"
If you want a \ in the middle of a double quoted string, you have to escape it: \\
Which means that if you want *both* a " and a \ in a double quoted string, you need to have an *odd* number of backslashes.
All you need to do is count the number of backslashes. Even *and* there's a quote in the middle of the string? Parse error. Odd number of backslashes? It's fine.
OK.
I understand the configuration.
Please let me confirm the password to be sent next.
Register a user in ActiveDirectory with the password "pass\"word@2022", the following LDAP settings.
=== ldap { server = '192.168.1.6' identity = 'cn=tkt10886-5,cn=users,dc=srv2022,dc=rdd-osaka,dc=soliton,dc=example,dc=jp' password = "pass\\\"word@2022" ===
If you start with this configuration, the password verification will fail.
=== # /usr/local/sbin/radiusd -X FreeRADIUS Version 3.2.3 Copyright (C) 1999-2022 The FreeRADIUS server project and contributors There is NO warranty; not even for MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE You may redistribute copies of FreeRADIUS under the terms of the GNU General Public License For more information about these matters, see the file named COPYRIGHT Starting - reading configuration files ... including dictionary file /usr/local/share/freeradius/dictionary including dictionary file /usr/local/share/freeradius/dictionary.dhcp including dictionary file /usr/local/share/freeradius/dictionary.vqp including dictionary file /usr/local/etc/raddb/dictionary including configuration file /usr/local/etc/raddb/radiusd.conf including configuration file /usr/local/etc/raddb/proxy.conf including configuration file /usr/local/etc/raddb/clients.conf including files in directory /usr/local/etc/raddb/mods-enabled/ including configuration file /usr/local/etc/raddb/mods-enabled/dynamic_clients including configuration file /usr/local/etc/raddb/mods-enabled/realm including configuration file /usr/local/etc/raddb/mods-enabled/chap including configuration file /usr/local/etc/raddb/mods-enabled/utf8 including configuration file /usr/local/etc/raddb/mods-enabled/date including configuration file /usr/local/etc/raddb/mods-enabled/exec including configuration file /usr/local/etc/raddb/mods-enabled/unix including configuration file /usr/local/etc/raddb/mods-enabled/expr including configuration file /usr/local/etc/raddb/mods-enabled/totp including configuration file /usr/local/etc/raddb/mods-enabled/always including configuration file /usr/local/etc/raddb/mods-enabled/preprocess including configuration file /usr/local/etc/raddb/mods-enabled/ldap1 including configuration file /usr/local/etc/raddb/mods-enabled/logintime including configuration file /usr/local/etc/raddb/mods-enabled/files including configuration file /usr/local/etc/raddb/mods-enabled/radutmp including configuration file /usr/local/etc/raddb/mods-enabled/ntlm_auth including configuration file /usr/local/etc/raddb/mods-enabled/digest including configuration file /usr/local/etc/raddb/mods-enabled/sradutmp including configuration file /usr/local/etc/raddb/mods-enabled/replicate including configuration file /usr/local/etc/raddb/mods-enabled/unpack including configuration file /usr/local/etc/raddb/mods-enabled/detail.log including configuration file /usr/local/etc/raddb/mods-enabled/soh including configuration file /usr/local/etc/raddb/mods-enabled/detail including configuration file /usr/local/etc/raddb/mods-enabled/attr_filter including configuration file /usr/local/etc/raddb/mods-enabled/linelog including configuration file /usr/local/etc/raddb/mods-enabled/expiration including configuration file /usr/local/etc/raddb/mods-enabled/eap including configuration file /usr/local/etc/raddb/mods-enabled/pap including configuration file /usr/local/etc/raddb/mods-enabled/passwd including configuration file /usr/local/etc/raddb/mods-enabled/echo including configuration file /usr/local/etc/raddb/mods-enabled/mschap including files in directory /usr/local/etc/raddb/policy.d/ including configuration file /usr/local/etc/raddb/policy.d/accounting including configuration file /usr/local/etc/raddb/policy.d/abfab-tr including configuration file /usr/local/etc/raddb/policy.d/rfc7542 including configuration file /usr/local/etc/raddb/policy.d/cui including configuration file /usr/local/etc/raddb/policy.d/filter including configuration file /usr/local/etc/raddb/policy.d/canonicalization including configuration file /usr/local/etc/raddb/policy.d/dhcp including configuration file /usr/local/etc/raddb/policy.d/operator-name including configuration file /usr/local/etc/raddb/policy.d/debug including configuration file /usr/local/etc/raddb/policy.d/eap including configuration file /usr/local/etc/raddb/policy.d/control including configuration file /usr/local/etc/raddb/policy.d/moonshot-targeted-ids including files in directory /usr/local/etc/raddb/sites-enabled/ including configuration file /usr/local/etc/raddb/sites-enabled/default including configuration file /usr/local/etc/raddb/sites-enabled/inner-tunnel main { security { allow_core_dumps = no } name = "radiusd" prefix = "/usr/local" localstatedir = "/usr/local/var" logdir = "/usr/local/var/log/radius" run_dir = "/usr/local/var/run/radiusd" } main { name = "radiusd" prefix = "/usr/local" localstatedir = "/usr/local/var" sbindir = "/usr/local/sbin" logdir = "/usr/local/var/log/radius" run_dir = "/usr/local/var/run/radiusd" libdir = "/usr/local/lib" radacctdir = "/usr/local/var/log/radius/radacct" hostname_lookups = no max_request_time = 30 cleanup_delay = 5 max_requests = 16384 postauth_client_lost = no pidfile = "/usr/local/var/run/radiusd/radiusd.pid" checkrad = "/usr/local/sbin/checkrad" debug_level = 0 proxy_requests = yes log { stripped_names = no auth = no auth_badpass = no auth_goodpass = no colourise = yes msg_denied = "You are already logged in - access denied" } resources { } security { max_attributes = 200 reject_delay = 1.000000 status_server = yes allow_vulnerable_openssl = "no" } } radiusd: #### Loading Realms and Home Servers #### proxy server { retry_delay = 5 retry_count = 3 default_fallback = no dead_time = 120 wake_all_if_all_dead = no } home_server localhost { nonblock = no ipaddr = 127.0.0.1 port = 1812 type = "auth" secret = <<< secret >>> response_window = 20.000000 response_timeouts = 1 max_outstanding = 65536 zombie_period = 40 status_check = "status-server" ping_interval = 30 check_interval = 30 check_timeout = 4 num_answers_to_alive = 3 revive_interval = 120 limit { max_connections = 16 max_requests = 0 lifetime = 0 idle_timeout = 0 } coa { irt = 2 mrt = 16 mrc = 5 mrd = 30 } recv_coa { } } home_server_pool my_auth_failover { type = fail-over home_server = localhost } realm example.com { auth_pool = my_auth_failover } realm LOCAL { } radiusd: #### Loading Clients #### client localhost { ipaddr = 127.0.0.1 require_message_authenticator = no secret = <<< secret >>> nas_type = "other" proto = "*" limit { max_connections = 16 lifetime = 0 idle_timeout = 30 } } client localhost_ipv6 { ipv6addr = ::1 require_message_authenticator = no secret = <<< secret >>> limit { max_connections = 16 lifetime = 0 idle_timeout = 30 } } client naeps245 { ipaddr = 192.168.1.245 require_message_authenticator = no secret = <<< secret >>> limit { max_connections = 16 lifetime = 0 idle_timeout = 30 } } Debugger not attached # Creating Auth-Type = mschap # Creating Auth-Type = digest # Creating Auth-Type = eap # Creating Auth-Type = PAP # Creating Auth-Type = CHAP # Creating Auth-Type = MS-CHAP # Creating Autz-Type = New-TLS-Connection # Creating Post-Auth-Type = Client-Lost radiusd: #### Instantiating modules #### modules { # Loaded module rlm_dynamic_clients # Loading module "dynamic_clients" from file /usr/local/etc/raddb/mods-enabled/dynamic_clients # Loaded module rlm_realm # Loading module "IPASS" from file /usr/local/etc/raddb/mods-enabled/realm realm IPASS { format = "prefix" delimiter = "/" ignore_default = no ignore_null = no } # Loading module "suffix" from file /usr/local/etc/raddb/mods-enabled/realm realm suffix { format = "suffix" delimiter = "@" ignore_default = no ignore_null = no } # Loading module "bangpath" from file /usr/local/etc/raddb/mods-enabled/realm realm bangpath { format = "prefix" delimiter = "!" ignore_default = no ignore_null = no } # Loading module "realmpercent" from file /usr/local/etc/raddb/mods-enabled/realm realm realmpercent { format = "suffix" delimiter = "%" ignore_default = no ignore_null = no } # Loading module "ntdomain" from file /usr/local/etc/raddb/mods-enabled/realm realm ntdomain { format = "prefix" delimiter = "\\" ignore_default = no ignore_null = no } # Loaded module rlm_chap # Loading module "chap" from file /usr/local/etc/raddb/mods-enabled/chap # Loaded module rlm_utf8 # Loading module "utf8" from file /usr/local/etc/raddb/mods-enabled/utf8 # Loaded module rlm_date # Loading module "date" from file /usr/local/etc/raddb/mods-enabled/date date { format = "%b %e %Y %H:%M:%S %Z" utc = no } # Loading module "wispr2date" from file /usr/local/etc/raddb/mods-enabled/date date wispr2date { format = "%Y-%m-%dT%H:%M:%S" utc = no } # Loaded module rlm_exec # Loading module "exec" from file /usr/local/etc/raddb/mods-enabled/exec exec { wait = no input_pairs = "request" shell_escape = yes timeout = 10 } # Loaded module rlm_unix # Loading module "unix" from file /usr/local/etc/raddb/mods-enabled/unix unix { radwtmp = "/usr/local/var/log/radius/radwtmp" } Creating attribute Unix-Group # Loaded module rlm_expr # Loading module "expr" from file /usr/local/etc/raddb/mods-enabled/expr expr { safe_characters = "@abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ0123456789.-_: /aeouaaaceeeeiio?uuuayAEOUsAAACEEEEIIO?UUU?" } # Loaded module rlm_always # Loading module "reject" from file /usr/local/etc/raddb/mods-enabled/always always reject { rcode = "reject" simulcount = 0 mpp = no } # Loading module "fail" from file /usr/local/etc/raddb/mods-enabled/always always fail { rcode = "fail" simulcount = 0 mpp = no } # Loading module "ok" from file /usr/local/etc/raddb/mods-enabled/always always ok { rcode = "ok" simulcount = 0 mpp = no } # Loading module "handled" from file /usr/local/etc/raddb/mods-enabled/always always handled { rcode = "handled" simulcount = 0 mpp = no } # Loading module "invalid" from file /usr/local/etc/raddb/mods-enabled/always always invalid { rcode = "invalid" simulcount = 0 mpp = no } # Loading module "userlock" from file /usr/local/etc/raddb/mods-enabled/always always userlock { rcode = "userlock" simulcount = 0 mpp = no } # Loading module "notfound" from file /usr/local/etc/raddb/mods-enabled/always always notfound { rcode = "notfound" simulcount = 0 mpp = no } # Loading module "noop" from file /usr/local/etc/raddb/mods-enabled/always always noop { rcode = "noop" simulcount = 0 mpp = no } # Loading module "updated" from file /usr/local/etc/raddb/mods-enabled/always always updated { rcode = "updated" simulcount = 0 mpp = no } # Loaded module rlm_preprocess # Loading module "preprocess" from file /usr/local/etc/raddb/mods-enabled/preprocess preprocess { huntgroups = "/usr/local/etc/raddb/mods-config/preprocess/huntgroups" hints = "/usr/local/etc/raddb/mods-config/preprocess/hints" with_ascend_hack = no ascend_channels_per_line = 23 with_ntdomain_hack = no with_specialix_jetstream_hack = no with_cisco_vsa_hack = no with_alvarion_vsa_hack = no } # Loaded module rlm_ldap # Loading module "ldap" from file /usr/local/etc/raddb/mods-enabled/ldap1 ldap { server = "192.168.1.6" identity = "cn=tkt10886-5,cn=users,dc=srv2022,dc=rdd-osaka,dc=soliton,dc=example,dc=jp" password = <<< secret >>> sasl { } user_dn = "LDAP-UserDn" user { scope = "sub" access_positive = yes sasl { } } group { scope = "sub" name_attribute = "cn" cacheable_name = no cacheable_dn = no allow_dangling_group_ref = no } client { scope = "sub" base_dn = "" } profile { } options { ldap_debug = 0 net_timeout = 10 res_timeout = 20 srv_timelimit = 20 idle = 60 probes = 3 interval = 30 } tls { check_crl = no start_tls = no } } Creating attribute LDAP-Group # Loaded module rlm_logintime # Loading module "logintime" from file /usr/local/etc/raddb/mods-enabled/logintime logintime { minimum_timeout = 60 } # Loaded module rlm_files # Loading module "files" from file /usr/local/etc/raddb/mods-enabled/files files { filename = "/usr/local/etc/raddb/mods-config/files/authorize" acctusersfile = "/usr/local/etc/raddb/mods-config/files/accounting" preproxy_usersfile = "/usr/local/etc/raddb/mods-config/files/pre-proxy" } # Loaded module rlm_radutmp # Loading module "radutmp" from file /usr/local/etc/raddb/mods-enabled/radutmp radutmp { filename = "/usr/local/var/log/radius/radutmp" username = "%{User-Name}" case_sensitive = yes check_with_nas = yes permissions = 384 caller_id = yes } # Loading module "ntlm_auth" from file /usr/local/etc/raddb/mods-enabled/ntlm_auth exec ntlm_auth { wait = yes program = "/path/to/ntlm_auth --request-nt-key --domain=MYDOMAIN --username=%{mschap:User-Name} --password=%{User-Password}" shell_escape = yes } # Loaded module rlm_digest # Loading module "digest" from file /usr/local/etc/raddb/mods-enabled/digest # Loading module "sradutmp" from file /usr/local/etc/raddb/mods-enabled/sradutmp radutmp sradutmp { filename = "/usr/local/var/log/radius/sradutmp" username = "%{User-Name}" case_sensitive = yes check_with_nas = yes permissions = 420 caller_id = no } # Loaded module rlm_replicate # Loading module "replicate" from file /usr/local/etc/raddb/mods-enabled/replicate # Loaded module rlm_unpack # Loading module "unpack" from file /usr/local/etc/raddb/mods-enabled/unpack # Loaded module rlm_detail # Loading module "auth_log" from file /usr/local/etc/raddb/mods-enabled/detail.log detail auth_log { filename = "/usr/local/var/log/radius/radacct/%{%{Packet-Src-IP-Address}:-%{Packet-Src-IPv6-Address}}/auth-deta l-%Y%m%d" header = "%t" permissions = 384 locking = no escape_filenames = no log_packet_header = no } # Loading module "reply_log" from file /usr/local/etc/raddb/mods-enabled/detail.log detail reply_log { filename = "/usr/local/var/log/radius/radacct/%{%{Packet-Src-IP-Address}:-%{Packet-Src-IPv6-Address}}/reply-det il-%Y%m%d" header = "%t" permissions = 384 locking = no escape_filenames = no log_packet_header = no } # Loading module "pre_proxy_log" from file /usr/local/etc/raddb/mods-enabled/detail.log detail pre_proxy_log { filename = "/usr/local/var/log/radius/radacct/%{%{Packet-Src-IP-Address}:-%{Packet-Src-IPv6-Address}}/pre-proxy detail-%Y%m%d" header = "%t" permissions = 384 locking = no escape_filenames = no log_packet_header = no } # Loading module "post_proxy_log" from file /usr/local/etc/raddb/mods-enabled/detail.log detail post_proxy_log { filename = "/usr/local/var/log/radius/radacct/%{%{Packet-Src-IP-Address}:-%{Packet-Src-IPv6-Address}}/post-prox -detail-%Y%m%d" header = "%t" permissions = 384 locking = no escape_filenames = no log_packet_header = no } # Loaded module rlm_soh # Loading module "soh" from file /usr/local/etc/raddb/mods-enabled/soh soh { dhcp = yes } # Loading module "detail" from file /usr/local/etc/raddb/mods-enabled/detail detail { filename = "/usr/local/var/log/radius/radacct/%{%{Packet-Src-IP-Address}:-%{Packet-Src-IPv6-Address}}/detail-%Y m%d" header = "%t" permissions = 384 locking = no escape_filenames = no log_packet_header = no } # Loaded module rlm_attr_filter # Loading module "attr_filter.post-proxy" from file /usr/local/etc/raddb/mods-enabled/attr_filter attr_filter attr_filter.post-proxy { filename = "/usr/local/etc/raddb/mods-config/attr_filter/post-proxy" key = "%{Realm}" relaxed = no } # Loading module "attr_filter.pre-proxy" from file /usr/local/etc/raddb/mods-enabled/attr_filter attr_filter attr_filter.pre-proxy { filename = "/usr/local/etc/raddb/mods-config/attr_filter/pre-proxy" key = "%{Realm}" relaxed = no } # Loading module "attr_filter.access_reject" from file /usr/local/etc/raddb/mods-enabled/attr_filter attr_filter attr_filter.access_reject { filename = "/usr/local/etc/raddb/mods-config/attr_filter/access_reject" key = "%{User-Name}" relaxed = no } # Loading module "attr_filter.access_challenge" from file /usr/local/etc/raddb/mods-enabled/attr_filter attr_filter attr_filter.access_challenge { filename = "/usr/local/etc/raddb/mods-config/attr_filter/access_challenge" key = "%{User-Name}" relaxed = no } # Loading module "attr_filter.accounting_response" from file /usr/local/etc/raddb/mods-enabled/attr_filter attr_filter attr_filter.accounting_response { filename = "/usr/local/etc/raddb/mods-config/attr_filter/accounting_response" key = "%{User-Name}" relaxed = no } # Loading module "attr_filter.coa" from file /usr/local/etc/raddb/mods-enabled/attr_filter attr_filter attr_filter.coa { filename = "/usr/local/etc/raddb/mods-config/attr_filter/coa" key = "%{User-Name}" relaxed = no } # Loaded module rlm_linelog # Loading module "linelog" from file /usr/local/etc/raddb/mods-enabled/linelog linelog { filename = "/usr/local/var/log/radius/linelog" escape_filenames = no syslog_severity = "info" permissions = 384 format = "This is a log message for %{User-Name}" reference = "messages.%{%{reply:Packet-Type}:-default}" } # Loading module "log_accounting" from file /usr/local/etc/raddb/mods-enabled/linelog linelog log_accounting { filename = "/usr/local/var/log/radius/linelog-accounting" escape_filenames = no syslog_severity = "info" permissions = 384 format = "" reference = "Accounting-Request.%{%{Acct-Status-Type}:-unknown}" } # Loaded module rlm_expiration # Loading module "expiration" from file /usr/local/etc/raddb/mods-enabled/expiration # Loaded module rlm_eap # Loading module "eap" from file /usr/local/etc/raddb/mods-enabled/eap eap { default_eap_type = "md5" timer_expire = 60 max_eap_type = 52 ignore_unknown_eap_types = no cisco_accounting_username_bug = no max_sessions = 16384 } # Loaded module rlm_pap # Loading module "pap" from file /usr/local/etc/raddb/mods-enabled/pap pap { normalise = yes } # Loaded module rlm_passwd # Loading module "etc_passwd" from file /usr/local/etc/raddb/mods-enabled/passwd passwd etc_passwd { filename = "/etc/passwd" format = "*User-Name:Crypt-Password:" delimiter = ":" ignore_nislike = no ignore_empty = yes allow_multiple_keys = no hash_size = 100 } # Loading module "echo" from file /usr/local/etc/raddb/mods-enabled/echo exec echo { wait = yes program = "/bin/echo %{User-Name}" input_pairs = "request" output_pairs = "reply" shell_escape = yes } # Loaded module rlm_mschap # Loading module "mschap" from file /usr/local/etc/raddb/mods-enabled/mschap mschap { use_mppe = yes require_encryption = no require_strong = no with_ntdomain_hack = yes passchange { } allow_retry = yes winbind_retry_with_normalised_username = no } instantiate { } # Instantiating module "IPASS" from file /usr/local/etc/raddb/mods-enabled/realm # Instantiating module "suffix" from file /usr/local/etc/raddb/mods-enabled/realm # Instantiating module "bangpath" from file /usr/local/etc/raddb/mods-enabled/realm # Instantiating module "realmpercent" from file /usr/local/etc/raddb/mods-enabled/realm # Instantiating module "ntdomain" from file /usr/local/etc/raddb/mods-enabled/realm # Instantiating module "reject" from file /usr/local/etc/raddb/mods-enabled/always # Instantiating module "fail" from file /usr/local/etc/raddb/mods-enabled/always # Instantiating module "ok" from file /usr/local/etc/raddb/mods-enabled/always # Instantiating module "handled" from file /usr/local/etc/raddb/mods-enabled/always # Instantiating module "invalid" from file /usr/local/etc/raddb/mods-enabled/always # Instantiating module "userlock" from file /usr/local/etc/raddb/mods-enabled/always # Instantiating module "notfound" from file /usr/local/etc/raddb/mods-enabled/always # Instantiating module "noop" from file /usr/local/etc/raddb/mods-enabled/always # Instantiating module "updated" from file /usr/local/etc/raddb/mods-enabled/always # Instantiating module "preprocess" from file /usr/local/etc/raddb/mods-enabled/preprocess reading pairlist file /usr/local/etc/raddb/mods-config/preprocess/huntgroups reading pairlist file /usr/local/etc/raddb/mods-config/preprocess/hints # Instantiating module "ldap" from file /usr/local/etc/raddb/mods-enabled/ldap1 rlm_ldap: libldap vendor: OpenLDAP, version: 20457 rlm_ldap (ldap): Couldn't find configuration for accounting, will return NOOP for calls from this section rlm_ldap (ldap): Couldn't find configuration for post-auth, will return NOOP for calls from this section !!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!! !! libldap is using GnuTLS, while FreeRADIUS is using OpenSSL !! There may be random issues with TLS connections due to this conflict. !! The server may also crash. !! See https://wiki.freeradius.org/modules/Rlm_ldap for more information. !!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!! rlm_ldap (ldap): Initialising connection pool pool { start = 5 min = 3 max = 32 spare = 10 uses = 0 lifetime = 0 cleanup_interval = 30 idle_timeout = 60 retry_delay = 30 max_retries = 5 spread = no } rlm_ldap (ldap): Opening additional connection (0), 1 of 32 pending slots used rlm_ldap (ldap): Connecting to ldap://192.168.1.6:389 rlm_ldap (ldap): Waiting for bind result... rlm_ldap (ldap): Bind credentials incorrect: Invalid credentials rlm_ldap (ldap): Server said: 80090308: LdapErr: DSID-0C090569, comment: AcceptSecurityContext error, data 52e, v4f7c. rlm_ldap (ldap): Opening connection failed (0) rlm_ldap (ldap): Removing connection pool /usr/local/etc/raddb/mods-enabled/ldap1[1]: Instantiation failed for module "ldap" root@debian11-hira:/usr/local/etc/raddb# /usr/local/sbin/radiusd -X FreeRADIUS Version 3.2.3 Copyright (C) 1999-2022 The FreeRADIUS server project and contributors There is NO warranty; not even for MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE You may redistribute copies of FreeRADIUS under the terms of the GNU General Public License For more information about these matters, see the file named COPYRIGHT Starting - reading configuration files ... including dictionary file /usr/local/share/freeradius/dictionary including dictionary file /usr/local/share/freeradius/dictionary.dhcp including dictionary file /usr/local/share/freeradius/dictionary.vqp including dictionary file /usr/local/etc/raddb/dictionary including configuration file /usr/local/etc/raddb/radiusd.conf including configuration file /usr/local/etc/raddb/proxy.conf including configuration file /usr/local/etc/raddb/clients.conf including files in directory /usr/local/etc/raddb/mods-enabled/ including configuration file /usr/local/etc/raddb/mods-enabled/dynamic_clients including configuration file /usr/local/etc/raddb/mods-enabled/realm including configuration file /usr/local/etc/raddb/mods-enabled/chap including configuration file /usr/local/etc/raddb/mods-enabled/utf8 including configuration file /usr/local/etc/raddb/mods-enabled/date including configuration file /usr/local/etc/raddb/mods-enabled/exec including configuration file /usr/local/etc/raddb/mods-enabled/unix including configuration file /usr/local/etc/raddb/mods-enabled/expr including configuration file /usr/local/etc/raddb/mods-enabled/totp including configuration file /usr/local/etc/raddb/mods-enabled/always including configuration file /usr/local/etc/raddb/mods-enabled/preprocess including configuration file /usr/local/etc/raddb/mods-enabled/ldap1 including configuration file /usr/local/etc/raddb/mods-enabled/logintime including configuration file /usr/local/etc/raddb/mods-enabled/files including configuration file /usr/local/etc/raddb/mods-enabled/radutmp including configuration file /usr/local/etc/raddb/mods-enabled/ntlm_auth including configuration file /usr/local/etc/raddb/mods-enabled/digest including configuration file /usr/local/etc/raddb/mods-enabled/sradutmp including configuration file /usr/local/etc/raddb/mods-enabled/replicate including configuration file /usr/local/etc/raddb/mods-enabled/unpack including configuration file /usr/local/etc/raddb/mods-enabled/detail.log including configuration file /usr/local/etc/raddb/mods-enabled/soh including configuration file /usr/local/etc/raddb/mods-enabled/detail including configuration file /usr/local/etc/raddb/mods-enabled/attr_filter including configuration file /usr/local/etc/raddb/mods-enabled/linelog including configuration file /usr/local/etc/raddb/mods-enabled/expiration including configuration file /usr/local/etc/raddb/mods-enabled/eap including configuration file /usr/local/etc/raddb/mods-enabled/pap including configuration file /usr/local/etc/raddb/mods-enabled/passwd including configuration file /usr/local/etc/raddb/mods-enabled/echo including configuration file /usr/local/etc/raddb/mods-enabled/mschap including files in directory /usr/local/etc/raddb/policy.d/ including configuration file /usr/local/etc/raddb/policy.d/accounting including configuration file /usr/local/etc/raddb/policy.d/abfab-tr including configuration file /usr/local/etc/raddb/policy.d/rfc7542 including configuration file /usr/local/etc/raddb/policy.d/cui including configuration file /usr/local/etc/raddb/policy.d/filter including configuration file /usr/local/etc/raddb/policy.d/canonicalization including configuration file /usr/local/etc/raddb/policy.d/dhcp including configuration file /usr/local/etc/raddb/policy.d/operator-name including configuration file /usr/local/etc/raddb/policy.d/debug including configuration file /usr/local/etc/raddb/policy.d/eap including configuration file /usr/local/etc/raddb/policy.d/control including configuration file /usr/local/etc/raddb/policy.d/moonshot-targeted-ids including files in directory /usr/local/etc/raddb/sites-enabled/ including configuration file /usr/local/etc/raddb/sites-enabled/default including configuration file /usr/local/etc/raddb/sites-enabled/inner-tunnel main { security { allow_core_dumps = no } name = "radiusd" prefix = "/usr/local" localstatedir = "/usr/local/var" logdir = "/usr/local/var/log/radius" run_dir = "/usr/local/var/run/radiusd" } main { name = "radiusd" prefix = "/usr/local" localstatedir = "/usr/local/var" sbindir = "/usr/local/sbin" logdir = "/usr/local/var/log/radius" run_dir = "/usr/local/var/run/radiusd" libdir = "/usr/local/lib" radacctdir = "/usr/local/var/log/radius/radacct" hostname_lookups = no max_request_time = 30 cleanup_delay = 5 max_requests = 16384 postauth_client_lost = no pidfile = "/usr/local/var/run/radiusd/radiusd.pid" checkrad = "/usr/local/sbin/checkrad" debug_level = 0 proxy_requests = yes log { stripped_names = no auth = no auth_badpass = no auth_goodpass = no colourise = yes msg_denied = "You are already logged in - access denied" } resources { } security { max_attributes = 200 reject_delay = 1.000000 status_server = yes allow_vulnerable_openssl = "no" } } radiusd: #### Loading Realms and Home Servers #### proxy server { retry_delay = 5 retry_count = 3 default_fallback = no dead_time = 120 wake_all_if_all_dead = no } home_server localhost { nonblock = no ipaddr = 127.0.0.1 port = 1812 type = "auth" secret = <<< secret >>> response_window = 20.000000 response_timeouts = 1 max_outstanding = 65536 zombie_period = 40 status_check = "status-server" ping_interval = 30 check_interval = 30 check_timeout = 4 num_answers_to_alive = 3 revive_interval = 120 limit { max_connections = 16 max_requests = 0 lifetime = 0 idle_timeout = 0 } coa { irt = 2 mrt = 16 mrc = 5 mrd = 30 } recv_coa { } } home_server_pool my_auth_failover { type = fail-over home_server = localhost } realm example.com { auth_pool = my_auth_failover } realm LOCAL { } radiusd: #### Loading Clients #### client localhost { ipaddr = 127.0.0.1 require_message_authenticator = no secret = <<< secret >>> nas_type = "other" proto = "*" limit { max_connections = 16 lifetime = 0 idle_timeout = 30 } } client localhost_ipv6 { ipv6addr = ::1 require_message_authenticator = no secret = <<< secret >>> limit { max_connections = 16 lifetime = 0 idle_timeout = 30 } } client naeps245 { ipaddr = 192.168.1.245 require_message_authenticator = no secret = <<< secret >>> limit { max_connections = 16 lifetime = 0 idle_timeout = 30 } } Debugger not attached # Creating Auth-Type = mschap # Creating Auth-Type = digest # Creating Auth-Type = eap # Creating Auth-Type = PAP # Creating Auth-Type = CHAP # Creating Auth-Type = MS-CHAP # Creating Autz-Type = New-TLS-Connection # Creating Post-Auth-Type = Client-Lost radiusd: #### Instantiating modules #### modules { # Loaded module rlm_dynamic_clients # Loading module "dynamic_clients" from file /usr/local/etc/raddb/mods-enabled/dynamic_clients # Loaded module rlm_realm # Loading module "IPASS" from file /usr/local/etc/raddb/mods-enabled/realm realm IPASS { format = "prefix" delimiter = "/" ignore_default = no ignore_null = no } # Loading module "suffix" from file /usr/local/etc/raddb/mods-enabled/realm realm suffix { format = "suffix" delimiter = "@" ignore_default = no ignore_null = no } # Loading module "bangpath" from file /usr/local/etc/raddb/mods-enabled/realm realm bangpath { format = "prefix" delimiter = "!" ignore_default = no ignore_null = no } # Loading module "realmpercent" from file /usr/local/etc/raddb/mods-enabled/realm realm realmpercent { format = "suffix" delimiter = "%" ignore_default = no ignore_null = no } # Loading module "ntdomain" from file /usr/local/etc/raddb/mods-enabled/realm realm ntdomain { format = "prefix" delimiter = "\\" ignore_default = no ignore_null = no } # Loaded module rlm_chap # Loading module "chap" from file /usr/local/etc/raddb/mods-enabled/chap # Loaded module rlm_utf8 # Loading module "utf8" from file /usr/local/etc/raddb/mods-enabled/utf8 # Loaded module rlm_date # Loading module "date" from file /usr/local/etc/raddb/mods-enabled/date date { format = "%b %e %Y %H:%M:%S %Z" utc = no } # Loading module "wispr2date" from file /usr/local/etc/raddb/mods-enabled/date date wispr2date { format = "%Y-%m-%dT%H:%M:%S" utc = no } # Loaded module rlm_exec # Loading module "exec" from file /usr/local/etc/raddb/mods-enabled/exec exec { wait = no input_pairs = "request" shell_escape = yes timeout = 10 } # Loaded module rlm_unix # Loading module "unix" from file /usr/local/etc/raddb/mods-enabled/unix unix { radwtmp = "/usr/local/var/log/radius/radwtmp" } Creating attribute Unix-Group # Loaded module rlm_expr # Loading module "expr" from file /usr/local/etc/raddb/mods-enabled/expr expr { safe_characters = "@abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ0123456789.-_: /aeouaaaceeeeiio?uuuayAEOUsAAACEEEEIIO?UUU?" } # Loaded module rlm_always # Loading module "reject" from file /usr/local/etc/raddb/mods-enabled/always always reject { rcode = "reject" simulcount = 0 mpp = no } # Loading module "fail" from file /usr/local/etc/raddb/mods-enabled/always always fail { rcode = "fail" simulcount = 0 mpp = no } # Loading module "ok" from file /usr/local/etc/raddb/mods-enabled/always always ok { rcode = "ok" simulcount = 0 mpp = no } # Loading module "handled" from file /usr/local/etc/raddb/mods-enabled/always always handled { rcode = "handled" simulcount = 0 mpp = no } # Loading module "invalid" from file /usr/local/etc/raddb/mods-enabled/always always invalid { rcode = "invalid" simulcount = 0 mpp = no } # Loading module "userlock" from file /usr/local/etc/raddb/mods-enabled/always always userlock { rcode = "userlock" simulcount = 0 mpp = no } # Loading module "notfound" from file /usr/local/etc/raddb/mods-enabled/always always notfound { rcode = "notfound" simulcount = 0 mpp = no } # Loading module "noop" from file /usr/local/etc/raddb/mods-enabled/always always noop { rcode = "noop" simulcount = 0 mpp = no } # Loading module "updated" from file /usr/local/etc/raddb/mods-enabled/always always updated { rcode = "updated" simulcount = 0 mpp = no } # Loaded module rlm_preprocess # Loading module "preprocess" from file /usr/local/etc/raddb/mods-enabled/preprocess preprocess { huntgroups = "/usr/local/etc/raddb/mods-config/preprocess/huntgroups" hints = "/usr/local/etc/raddb/mods-config/preprocess/hints" with_ascend_hack = no ascend_channels_per_line = 23 with_ntdomain_hack = no with_specialix_jetstream_hack = no with_cisco_vsa_hack = no with_alvarion_vsa_hack = no } # Loaded module rlm_ldap # Loading module "ldap" from file /usr/local/etc/raddb/mods-enabled/ldap1 ldap { server = "192.168.1.6" identity = "cn=tkt10886-5,cn=users,dc=srv2022,dc=rdd-osaka,dc=soliton,dc=example,dc=jp" password = <<< secret >>> sasl { } user_dn = "LDAP-UserDn" user { scope = "sub" access_positive = yes sasl { } } group { scope = "sub" name_attribute = "cn" cacheable_name = no cacheable_dn = no allow_dangling_group_ref = no } client { scope = "sub" base_dn = "" } profile { } options { ldap_debug = 0 net_timeout = 10 res_timeout = 20 srv_timelimit = 20 idle = 60 probes = 3 interval = 30 } tls { check_crl = no start_tls = no } } Creating attribute LDAP-Group # Loaded module rlm_logintime # Loading module "logintime" from file /usr/local/etc/raddb/mods-enabled/logintime logintime { minimum_timeout = 60 } # Loaded module rlm_files # Loading module "files" from file /usr/local/etc/raddb/mods-enabled/files files { filename = "/usr/local/etc/raddb/mods-config/files/authorize" acctusersfile = "/usr/local/etc/raddb/mods-config/files/accounting" preproxy_usersfile = "/usr/local/etc/raddb/mods-config/files/pre-proxy" } # Loaded module rlm_radutmp # Loading module "radutmp" from file /usr/local/etc/raddb/mods-enabled/radutmp radutmp { filename = "/usr/local/var/log/radius/radutmp" username = "%{User-Name}" case_sensitive = yes check_with_nas = yes permissions = 384 caller_id = yes } # Loading module "ntlm_auth" from file /usr/local/etc/raddb/mods-enabled/ntlm_auth exec ntlm_auth { wait = yes program = "/path/to/ntlm_auth --request-nt-key --domain=MYDOMAIN --username=%{mschap:User-Name} --password=%{User-Password}" shell_escape = yes } # Loaded module rlm_digest # Loading module "digest" from file /usr/local/etc/raddb/mods-enabled/digest # Loading module "sradutmp" from file /usr/local/etc/raddb/mods-enabled/sradutmp radutmp sradutmp { filename = "/usr/local/var/log/radius/sradutmp" username = "%{User-Name}" case_sensitive = yes check_with_nas = yes permissions = 420 caller_id = no } # Loaded module rlm_replicate # Loading module "replicate" from file /usr/local/etc/raddb/mods-enabled/replicate # Loaded module rlm_unpack # Loading module "unpack" from file /usr/local/etc/raddb/mods-enabled/unpack # Loaded module rlm_detail # Loading module "auth_log" from file /usr/local/etc/raddb/mods-enabled/detail.log detail auth_log { filename = "/usr/local/var/log/radius/radacct/%{%{Packet-Src-IP-Address}:-%{Packet-Src-IPv6-Address}}/auth-deta l-%Y%m%d" header = "%t" permissions = 384 locking = no escape_filenames = no log_packet_header = no } # Loading module "reply_log" from file /usr/local/etc/raddb/mods-enabled/detail.log detail reply_log { filename = "/usr/local/var/log/radius/radacct/%{%{Packet-Src-IP-Address}:-%{Packet-Src-IPv6-Address}}/reply-det il-%Y%m%d" header = "%t" permissions = 384 locking = no escape_filenames = no log_packet_header = no } # Loading module "pre_proxy_log" from file /usr/local/etc/raddb/mods-enabled/detail.log detail pre_proxy_log { filename = "/usr/local/var/log/radius/radacct/%{%{Packet-Src-IP-Address}:-%{Packet-Src-IPv6-Address}}/pre-proxy detail-%Y%m%d" header = "%t" permissions = 384 locking = no escape_filenames = no log_packet_header = no } # Loading module "post_proxy_log" from file /usr/local/etc/raddb/mods-enabled/detail.log detail post_proxy_log { filename = "/usr/local/var/log/radius/radacct/%{%{Packet-Src-IP-Address}:-%{Packet-Src-IPv6-Address}}/post-prox -detail-%Y%m%d" header = "%t" permissions = 384 locking = no escape_filenames = no log_packet_header = no } # Loaded module rlm_soh # Loading module "soh" from file /usr/local/etc/raddb/mods-enabled/soh soh { dhcp = yes } # Loading module "detail" from file /usr/local/etc/raddb/mods-enabled/detail detail { filename = "/usr/local/var/log/radius/radacct/%{%{Packet-Src-IP-Address}:-%{Packet-Src-IPv6-Address}}/detail-%Y m%d" header = "%t" permissions = 384 locking = no escape_filenames = no log_packet_header = no } # Loaded module rlm_attr_filter # Loading module "attr_filter.post-proxy" from file /usr/local/etc/raddb/mods-enabled/attr_filter attr_filter attr_filter.post-proxy { filename = "/usr/local/etc/raddb/mods-config/attr_filter/post-proxy" key = "%{Realm}" relaxed = no } # Loading module "attr_filter.pre-proxy" from file /usr/local/etc/raddb/mods-enabled/attr_filter attr_filter attr_filter.pre-proxy { filename = "/usr/local/etc/raddb/mods-config/attr_filter/pre-proxy" key = "%{Realm}" relaxed = no } # Loading module "attr_filter.access_reject" from file /usr/local/etc/raddb/mods-enabled/attr_filter attr_filter attr_filter.access_reject { filename = "/usr/local/etc/raddb/mods-config/attr_filter/access_reject" key = "%{User-Name}" relaxed = no } # Loading module "attr_filter.access_challenge" from file /usr/local/etc/raddb/mods-enabled/attr_filter attr_filter attr_filter.access_challenge { filename = "/usr/local/etc/raddb/mods-config/attr_filter/access_challenge" key = "%{User-Name}" relaxed = no } # Loading module "attr_filter.accounting_response" from file /usr/local/etc/raddb/mods-enabled/attr_filter attr_filter attr_filter.accounting_response { filename = "/usr/local/etc/raddb/mods-config/attr_filter/accounting_response" key = "%{User-Name}" relaxed = no } # Loading module "attr_filter.coa" from file /usr/local/etc/raddb/mods-enabled/attr_filter attr_filter attr_filter.coa { filename = "/usr/local/etc/raddb/mods-config/attr_filter/coa" key = "%{User-Name}" relaxed = no } # Loaded module rlm_linelog # Loading module "linelog" from file /usr/local/etc/raddb/mods-enabled/linelog linelog { filename = "/usr/local/var/log/radius/linelog" escape_filenames = no syslog_severity = "info" permissions = 384 format = "This is a log message for %{User-Name}" reference = "messages.%{%{reply:Packet-Type}:-default}" } # Loading module "log_accounting" from file /usr/local/etc/raddb/mods-enabled/linelog linelog log_accounting { filename = "/usr/local/var/log/radius/linelog-accounting" escape_filenames = no syslog_severity = "info" permissions = 384 format = "" reference = "Accounting-Request.%{%{Acct-Status-Type}:-unknown}" } # Loaded module rlm_expiration # Loading module "expiration" from file /usr/local/etc/raddb/mods-enabled/expiration # Loaded module rlm_eap # Loading module "eap" from file /usr/local/etc/raddb/mods-enabled/eap eap { default_eap_type = "md5" timer_expire = 60 max_eap_type = 52 ignore_unknown_eap_types = no cisco_accounting_username_bug = no max_sessions = 16384 } # Loaded module rlm_pap # Loading module "pap" from file /usr/local/etc/raddb/mods-enabled/pap pap { normalise = yes } # Loaded module rlm_passwd # Loading module "etc_passwd" from file /usr/local/etc/raddb/mods-enabled/passwd passwd etc_passwd { filename = "/etc/passwd" format = "*User-Name:Crypt-Password:" delimiter = ":" ignore_nislike = no ignore_empty = yes allow_multiple_keys = no hash_size = 100 } # Loading module "echo" from file /usr/local/etc/raddb/mods-enabled/echo exec echo { wait = yes program = "/bin/echo %{User-Name}" input_pairs = "request" output_pairs = "reply" shell_escape = yes } # Loaded module rlm_mschap # Loading module "mschap" from file /usr/local/etc/raddb/mods-enabled/mschap mschap { use_mppe = yes require_encryption = no require_strong = no with_ntdomain_hack = yes passchange { } allow_retry = yes winbind_retry_with_normalised_username = no } instantiate { } # Instantiating module "IPASS" from file /usr/local/etc/raddb/mods-enabled/realm # Instantiating module "suffix" from file /usr/local/etc/raddb/mods-enabled/realm # Instantiating module "bangpath" from file /usr/local/etc/raddb/mods-enabled/realm # Instantiating module "realmpercent" from file /usr/local/etc/raddb/mods-enabled/realm # Instantiating module "ntdomain" from file /usr/local/etc/raddb/mods-enabled/realm # Instantiating module "reject" from file /usr/local/etc/raddb/mods-enabled/always # Instantiating module "fail" from file /usr/local/etc/raddb/mods-enabled/always # Instantiating module "ok" from file /usr/local/etc/raddb/mods-enabled/always # Instantiating module "handled" from file /usr/local/etc/raddb/mods-enabled/always # Instantiating module "invalid" from file /usr/local/etc/raddb/mods-enabled/always # Instantiating module "userlock" from file /usr/local/etc/raddb/mods-enabled/always # Instantiating module "notfound" from file /usr/local/etc/raddb/mods-enabled/always # Instantiating module "noop" from file /usr/local/etc/raddb/mods-enabled/always # Instantiating module "updated" from file /usr/local/etc/raddb/mods-enabled/always # Instantiating module "preprocess" from file /usr/local/etc/raddb/mods-enabled/preprocess reading pairlist file /usr/local/etc/raddb/mods-config/preprocess/huntgroups reading pairlist file /usr/local/etc/raddb/mods-config/preprocess/hints # Instantiating module "ldap" from file /usr/local/etc/raddb/mods-enabled/ldap1 rlm_ldap: libldap vendor: OpenLDAP, version: 20457 rlm_ldap (ldap): Couldn't find configuration for accounting, will return NOOP for calls from this section rlm_ldap (ldap): Couldn't find configuration for post-auth, will return NOOP for calls from this section !!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!! !! libldap is using GnuTLS, while FreeRADIUS is using OpenSSL !! There may be random issues with TLS connections due to this conflict. !! The server may also crash. !! See https://wiki.freeradius.org/modules/Rlm_ldap for more information. !!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!! rlm_ldap (ldap): Initialising connection pool pool { start = 5 min = 3 max = 32 spare = 10 uses = 0 lifetime = 0 cleanup_interval = 30 idle_timeout = 60 retry_delay = 30 max_retries = 5 spread = no } rlm_ldap (ldap): Opening additional connection (0), 1 of 32 pending slots used rlm_ldap (ldap): Connecting to ldap://192.168.1.6:389 rlm_ldap (ldap): Waiting for bind result... rlm_ldap (ldap): Bind credentials incorrect: Invalid credentials rlm_ldap (ldap): Server said: 80090308: LdapErr: DSID-0C090569, comment: AcceptSecurityContext error, data 52e, v4f7c. rlm_ldap (ldap): Opening connection failed (0) rlm_ldap (ldap): Removing connection pool /usr/local/etc/raddb/mods-enabled/ldap1[1]: Instantiation failed for module "ldap" ===
Checking the packet at this time with wireshark, we can confirm that `pass\"word@2022` is used as the password.
=== Lightweight Directory Access Protocol LDAPMessage bindRequest(1) "cn=tkt10886-5,cn=users,dc=srv2022,dc=rdd-osaka,dc=soliton,dc=example,dc=jp" simple messageID: 1 protocolOp: bindRequest (0) bindRequest version: 3 name: cn=tkt10886-5,cn=users,dc=srv2022,dc=rdd-osaka,dc=soliton,dc=example,dc=jp authentication: simple (0) simple: pass\\"word@2022 [Response In: 8] ===
What should I do in this case?
On 2023/09/11 18:10, Alan DeKok wrote:
On Sep 10, 2023, at 9:16 PM, 平林 哲 <Satoshi.Hirabayashi@soliton.co.jp> wrote:
=== # cat /usr/local/etc/raddb/mods-enabled/ldap1 ldap { server = '192.168.1.6' identity = 'cn=tkt10886-3,cn=users,dc=srv2022,dc=rdd-osaka,dc=soliton,dc=example,dc=jp' password = "pass\\"word@2022"
Two backslashes.
However, it behaves differently in the shell.
=== $ echo "pass\\\"word@2022"
Three backslashes.
pass\"word@2022 ===
Use three backslashes with FreeRADIUS, and it will work.
Maybe the two backslashes need to be escaped into one backslash?
I explained the rules for double-quoted strings. They're the same for all double quoted strings in FreeRADIUS, and in the shell.
If you want a " in the middle of a double quoted string, you have to escape it: \"
If you want a \ in the middle of a double quoted string, you have to escape it: \\
Which means that if you want *both* a " and a \ in a double quoted string, you need to have an *odd* number of backslashes.
All you need to do is count the number of backslashes. Even *and* there's a quote in the middle of the string? Parse error. Odd number of backslashes? It's fine.
Alan DeKok.
- List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html
- List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html
I set pass\\\"word@2022 (three backslashes) in the configuration file to
send the unescaped password pass\"word@2022.
password = "pass\\\"word@2022"
However, when I check the LDAP packet with Wireshark, it sends
pass\\"word@2022 and the authentication fails.
Is this phenomenon unique to my environment?
> If the UNESCAPED password is pass\\"word@2022 the escaped password
should be pass\\\\\"word@2022 (5 backslashes).
When I set pass\\\\\"word@2022 (5 backslashes) in the settings,
pass\\\\"word@2022 was sent.
password = "pass\\\\\"word@2022"
How can I send pass\"word@2022 in an LDAP packet?
On 2023/09/12 15:48, g4-lisz@tonarchiv.ch wrote:
> I think everyone lost track.
>
> As Alain said, it's exactly like in the Shell etc.
>
> If the UNESCAPED password is pass\\"word@2022 the escaped password should be pass\\\\\"word@2022 (5 backslashes).
>
> September 12, 2023 6:36 AM, "平林 哲" <Satoshi.Hirabayashi@soliton.co.jp> wrote:
>
>> sorry.
>> There was a mistake when pasting.
>>
>> I will correct it below.
>>
>> Checking the packet at this time with wireshark, we can confirm that
>> `pass\\"word@2022` is used as the password.
>>
>> ===
>> Lightweight Directory Access Protocol
>> LDAPMessage bindRequest(1)
>> "cn=tkt10886-5,cn=users,dc=srv2022,dc=rdd-osaka,dc=soliton,dc=example,dc=jp"
>> simple
>> messageID: 1
>> protocolOp: bindRequest (0)
>> bindRequest
>> version: 3
>> name:
>> cn=tkt10886-5,cn=users,dc=srv2022,dc=rdd-osaka,dc=soliton,dc=example,dc=jp
>> authentication: simple (0)
>> simple: pass\\"word@2022
>> [Response In: 8]
>> ===
>>
>> What should I do in this case?
>>
>> On 2023/09/12 9:59, 平林 哲 wrote:
>>
>>>>> Maybe the two backslashes need to be escaped into one backslash?
>>>>
>>>> I explained the rules for double-quoted strings. They're the same
>>> for all double quoted strings in FreeRADIUS, and in the shell.
>>>>
>>>> If you want a " in the middle of a double quoted string, you have
>>> to escape it: \"
>>>>
>>>> If you want a \ in the middle of a double quoted string, you have
>>> to escape it: \\
>>>>
>>>> Which means that if you want *both* a " and a \ in a double quoted
>>> string, you need to have an *odd* number of backslashes.
>>>>
>>>> All you need to do is count the number of backslashes. Even *and*
>>> there's a quote in the middle of the string? Parse error. Odd number
>>> of backslashes? It's fine.
>>>
>>> OK.
>>>
>>> I understand the configuration.
>>>
>>> Please let me confirm the password to be sent next.
>>>
>>> Register a user in ActiveDirectory with the password "pass\"word@2022",
>>> the following LDAP settings.
>>>
>>> ===
>>> ldap {
>>> server = '192.168.1.6'
>>> identity =
>>> 'cn=tkt10886-5,cn=users,dc=srv2022,dc=rdd-osaka,dc=soliton,dc=example,dc=jp'
>>> password = "pass\\\"word@2022"
>>> ===
>>>
>>> If you start with this configuration, the password verification will fail.
>>>
>>> ===
>>> # /usr/local/sbin/radiusd -X
>>> FreeRADIUS Version 3.2.3
>>> Copyright (C) 1999-2022 The FreeRADIUS server project and contributors
>>> There is NO warranty; not even for MERCHANTABILITY or FITNESS FOR A
>>> PARTICULAR PURPOSE
>>> You may redistribute copies of FreeRADIUS under the terms of the
>>> GNU General Public License
>>> For more information about these matters, see the file named COPYRIGHT
>>> Starting - reading configuration files ...
>>> including dictionary file /usr/local/share/freeradius/dictionary
>>> including dictionary file /usr/local/share/freeradius/dictionary.dhcp
>>> including dictionary file /usr/local/share/freeradius/dictionary.vqp
>>> including dictionary file /usr/local/etc/raddb/dictionary
>>> including configuration file /usr/local/etc/raddb/radiusd.conf
>>> including configuration file /usr/local/etc/raddb/proxy.conf
>>> including configuration file /usr/local/etc/raddb/clients.conf
>>> including files in directory /usr/local/etc/raddb/mods-enabled/
>>> including configuration file
>>> /usr/local/etc/raddb/mods-enabled/dynamic_clients
>>> including configuration file /usr/local/etc/raddb/mods-enabled/realm
>>> including configuration file /usr/local/etc/raddb/mods-enabled/chap
>>> including configuration file /usr/local/etc/raddb/mods-enabled/utf8
>>> including configuration file /usr/local/etc/raddb/mods-enabled/date
>>> including configuration file /usr/local/etc/raddb/mods-enabled/exec
>>> including configuration file /usr/local/etc/raddb/mods-enabled/unix
>>> including configuration file /usr/local/etc/raddb/mods-enabled/expr
>>> including configuration file /usr/local/etc/raddb/mods-enabled/totp
>>> including configuration file /usr/local/etc/raddb/mods-enabled/always
>>> including configuration file /usr/local/etc/raddb/mods-enabled/preprocess
>>> including configuration file /usr/local/etc/raddb/mods-enabled/ldap1
>>> including configuration file /usr/local/etc/raddb/mods-enabled/logintime
>>> including configuration file /usr/local/etc/raddb/mods-enabled/files
>>> including configuration file /usr/local/etc/raddb/mods-enabled/radutmp
>>> including configuration file /usr/local/etc/raddb/mods-enabled/ntlm_auth
>>> including configuration file /usr/local/etc/raddb/mods-enabled/digest
>>> including configuration file /usr/local/etc/raddb/mods-enabled/sradutmp
>>> including configuration file /usr/local/etc/raddb/mods-enabled/replicate
>>> including configuration file /usr/local/etc/raddb/mods-enabled/unpack
>>> including configuration file /usr/local/etc/raddb/mods-enabled/detail.log
>>> including configuration file /usr/local/etc/raddb/mods-enabled/soh
>>> including configuration file /usr/local/etc/raddb/mods-enabled/detail
>>> including configuration file /usr/local/etc/raddb/mods-enabled/attr_filter
>>> including configuration file /usr/local/etc/raddb/mods-enabled/linelog
>>> including configuration file /usr/local/etc/raddb/mods-enabled/expiration
>>> including configuration file /usr/local/etc/raddb/mods-enabled/eap
>>> including configuration file /usr/local/etc/raddb/mods-enabled/pap
>>> including configuration file /usr/local/etc/raddb/mods-enabled/passwd
>>> including configuration file /usr/local/etc/raddb/mods-enabled/echo
>>> including configuration file /usr/local/etc/raddb/mods-enabled/mschap
>>> including files in directory /usr/local/etc/raddb/policy.d/
>>> including configuration file /usr/local/etc/raddb/policy.d/accounting
>>> including configuration file /usr/local/etc/raddb/policy.d/abfab-tr
>>> including configuration file /usr/local/etc/raddb/policy.d/rfc7542
>>> including configuration file /usr/local/etc/raddb/policy.d/cui
>>> including configuration file /usr/local/etc/raddb/policy.d/filter
>>> including configuration file /usr/local/etc/raddb/policy.d/canonicalization
>>> including configuration file /usr/local/etc/raddb/policy.d/dhcp
>>> including configuration file /usr/local/etc/raddb/policy.d/operator-name
>>> including configuration file /usr/local/etc/raddb/policy.d/debug
>>> including configuration file /usr/local/etc/raddb/policy.d/eap
>>> including configuration file /usr/local/etc/raddb/policy.d/control
>>> including configuration file
>>> /usr/local/etc/raddb/policy.d/moonshot-targeted-ids
>>> including files in directory /usr/local/etc/raddb/sites-enabled/
>>> including configuration file /usr/local/etc/raddb/sites-enabled/default
>>> including configuration file
>>> /usr/local/etc/raddb/sites-enabled/inner-tunnel
>>> main {
>>> security {
>>> allow_core_dumps = no
>>> }
>>> name = "radiusd"
>>> prefix = "/usr/local"
>>> localstatedir = "/usr/local/var"
>>> logdir = "/usr/local/var/log/radius"
>>> run_dir = "/usr/local/var/run/radiusd"
>>> }
>>> main {
>>> name = "radiusd"
>>> prefix = "/usr/local"
>>> localstatedir = "/usr/local/var"
>>> sbindir = "/usr/local/sbin"
>>> logdir = "/usr/local/var/log/radius"
>>> run_dir = "/usr/local/var/run/radiusd"
>>> libdir = "/usr/local/lib"
>>> radacctdir = "/usr/local/var/log/radius/radacct"
>>> hostname_lookups = no
>>> max_request_time = 30
>>> cleanup_delay = 5
>>> max_requests = 16384
>>> postauth_client_lost = no
>>> pidfile = "/usr/local/var/run/radiusd/radiusd.pid"
>>> checkrad = "/usr/local/sbin/checkrad"
>>> debug_level = 0
>>> proxy_requests = yes
>>> log {
>>> stripped_names = no
>>> auth = no
>>> auth_badpass = no
>>> auth_goodpass = no
>>> colourise = yes
>>> msg_denied = "You are already logged in - access denied"
>>> }
>>> resources {
>>> }
>>> security {
>>> max_attributes = 200
>>> reject_delay = 1.000000
>>> status_server = yes
>>> allow_vulnerable_openssl = "no"
>>> }
>>> }
>>> radiusd: #### Loading Realms and Home Servers ####
>>> proxy server {
>>> retry_delay = 5
>>> retry_count = 3
>>> default_fallback = no
>>> dead_time = 120
>>> wake_all_if_all_dead = no
>>> }
>>> home_server localhost {
>>> nonblock = no
>>> ipaddr = 127.0.0.1
>>> port = 1812
>>> type = "auth"
>>> secret = <<< secret >>>
>>> response_window = 20.000000
>>> response_timeouts = 1
>>> max_outstanding = 65536
>>> zombie_period = 40
>>> status_check = "status-server"
>>> ping_interval = 30
>>> check_interval = 30
>>> check_timeout = 4
>>> num_answers_to_alive = 3
>>> revive_interval = 120
>>> limit {
>>> max_connections = 16
>>> max_requests = 0
>>> lifetime = 0
>>> idle_timeout = 0
>>> }
>>> coa {
>>> irt = 2
>>> mrt = 16
>>> mrc = 5
>>> mrd = 30
>>> }
>>> recv_coa {
>>> }
>>> }
>>> home_server_pool my_auth_failover {
>>> type = fail-over
>>> home_server = localhost
>>> }
>>> realm example.com {
>>> auth_pool = my_auth_failover
>>> }
>>> realm LOCAL {
>>> }
>>> radiusd: #### Loading Clients ####
>>> client localhost {
>>> ipaddr = 127.0.0.1
>>> require_message_authenticator = no
>>> secret = <<< secret >>>
>>> nas_type = "other"
>>> proto = "*"
>>> limit {
>>> max_connections = 16
>>> lifetime = 0
>>> idle_timeout = 30
>>> }
>>> }
>>> client localhost_ipv6 {
>>> ipv6addr = ::1
>>> require_message_authenticator = no
>>> secret = <<< secret >>>
>>> limit {
>>> max_connections = 16
>>> lifetime = 0
>>> idle_timeout = 30
>>> }
>>> }
>>> client naeps245 {
>>> ipaddr = 192.168.1.245
>>> require_message_authenticator = no
>>> secret = <<< secret >>>
>>> limit {
>>> max_connections = 16
>>> lifetime = 0
>>> idle_timeout = 30
>>> }
>>> }
>>> Debugger not attached
>>> # Creating Auth-Type = mschap
>>> # Creating Auth-Type = digest
>>> # Creating Auth-Type = eap
>>> # Creating Auth-Type = PAP
>>> # Creating Auth-Type = CHAP
>>> # Creating Auth-Type = MS-CHAP
>>> # Creating Autz-Type = New-TLS-Connection
>>> # Creating Post-Auth-Type = Client-Lost
>>> radiusd: #### Instantiating modules ####
>>> modules {
>>> # Loaded module rlm_dynamic_clients
>>> # Loading module "dynamic_clients" from file
>>> /usr/local/etc/raddb/mods-enabled/dynamic_clients
>>> # Loaded module rlm_realm
>>> # Loading module "IPASS" from file
>>> /usr/local/etc/raddb/mods-enabled/realm
>>> realm IPASS {
>>> format = "prefix"
>>> delimiter = "/"
>>> ignore_default = no
>>> ignore_null = no
>>> }
>>> # Loading module "suffix" from file
>>> /usr/local/etc/raddb/mods-enabled/realm
>>> realm suffix {
>>> format = "suffix"
>>> delimiter = "@"
>>> ignore_default = no
>>> ignore_null = no
>>> }
>>> # Loading module "bangpath" from file
>>> /usr/local/etc/raddb/mods-enabled/realm
>>> realm bangpath {
>>> format = "prefix"
>>> delimiter = "!"
>>> ignore_default = no
>>> ignore_null = no
>>> }
>>> # Loading module "realmpercent" from file
>>> /usr/local/etc/raddb/mods-enabled/realm
>>> realm realmpercent {
>>> format = "suffix"
>>> delimiter = "%"
>>> ignore_default = no
>>> ignore_null = no
>>> }
>>> # Loading module "ntdomain" from file
>>> /usr/local/etc/raddb/mods-enabled/realm
>>> realm ntdomain {
>>> format = "prefix"
>>> delimiter = "\\"
>>> ignore_default = no
>>> ignore_null = no
>>> }
>>> # Loaded module rlm_chap
>>> # Loading module "chap" from file /usr/local/etc/raddb/mods-enabled/chap
>>> # Loaded module rlm_utf8
>>> # Loading module "utf8" from file /usr/local/etc/raddb/mods-enabled/utf8
>>> # Loaded module rlm_date
>>> # Loading module "date" from file /usr/local/etc/raddb/mods-enabled/date
>>> date {
>>> format = "%b %e %Y %H:%M:%S %Z"
>>> utc = no
>>> }
>>> # Loading module "wispr2date" from file
>>> /usr/local/etc/raddb/mods-enabled/date
>>> date wispr2date {
>>> format = "%Y-%m-%dT%H:%M:%S"
>>> utc = no
>>> }
>>> # Loaded module rlm_exec
>>> # Loading module "exec" from file /usr/local/etc/raddb/mods-enabled/exec
>>> exec {
>>> wait = no
>>> input_pairs = "request"
>>> shell_escape = yes
>>> timeout = 10
>>> }
>>> # Loaded module rlm_unix
>>> # Loading module "unix" from file /usr/local/etc/raddb/mods-enabled/unix
>>> unix {
>>> radwtmp = "/usr/local/var/log/radius/radwtmp"
>>> }
>>> Creating attribute Unix-Group
>>> # Loaded module rlm_expr
>>> # Loading module "expr" from file /usr/local/etc/raddb/mods-enabled/expr
>>> expr {
>>> safe_characters =
>>> "@abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ0123456789.-_:
>>> /aeouaaaceeeeiio?uuuayAEOUsAAACEEEEIIO?UUU?"
>>> }
>>> # Loaded module rlm_always
>>> # Loading module "reject" from file
>>> /usr/local/etc/raddb/mods-enabled/always
>>> always reject {
>>> rcode = "reject"
>>> simulcount = 0
>>> mpp = no
>>> }
>>> # Loading module "fail" from file
>>> /usr/local/etc/raddb/mods-enabled/always
>>> always fail {
>>> rcode = "fail"
>>> simulcount = 0
>>> mpp = no
>>> }
>>> # Loading module "ok" from file /usr/local/etc/raddb/mods-enabled/always
>>> always ok {
>>> rcode = "ok"
>>> simulcount = 0
>>> mpp = no
>>> }
>>> # Loading module "handled" from file
>>> /usr/local/etc/raddb/mods-enabled/always
>>> always handled {
>>> rcode = "handled"
>>> simulcount = 0
>>> mpp = no
>>> }
>>> # Loading module "invalid" from file
>>> /usr/local/etc/raddb/mods-enabled/always
>>> always invalid {
>>> rcode = "invalid"
>>> simulcount = 0
>>> mpp = no
>>> }
>>> # Loading module "userlock" from file
>>> /usr/local/etc/raddb/mods-enabled/always
>>> always userlock {
>>> rcode = "userlock"
>>> simulcount = 0
>>> mpp = no
>>> }
>>> # Loading module "notfound" from file
>>> /usr/local/etc/raddb/mods-enabled/always
>>> always notfound {
>>> rcode = "notfound"
>>> simulcount = 0
>>> mpp = no
>>> }
>>> # Loading module "noop" from file
>>> /usr/local/etc/raddb/mods-enabled/always
>>> always noop {
>>> rcode = "noop"
>>> simulcount = 0
>>> mpp = no
>>> }
>>> # Loading module "updated" from file
>>> /usr/local/etc/raddb/mods-enabled/always
>>> always updated {
>>> rcode = "updated"
>>> simulcount = 0
>>> mpp = no
>>> }
>>> # Loaded module rlm_preprocess
>>> # Loading module "preprocess" from file
>>> /usr/local/etc/raddb/mods-enabled/preprocess
>>> preprocess {
>>> huntgroups =
>>> "/usr/local/etc/raddb/mods-config/preprocess/huntgroups"
>>> hints = "/usr/local/etc/raddb/mods-config/preprocess/hints"
>>> with_ascend_hack = no
>>> ascend_channels_per_line = 23
>>> with_ntdomain_hack = no
>>> with_specialix_jetstream_hack = no
>>> with_cisco_vsa_hack = no
>>> with_alvarion_vsa_hack = no
>>> }
>>> # Loaded module rlm_ldap
>>> # Loading module "ldap" from file
>>> /usr/local/etc/raddb/mods-enabled/ldap1
>>> ldap {
>>> server = "192.168.1.6"
>>> identity =
>>> "cn=tkt10886-5,cn=users,dc=srv2022,dc=rdd-osaka,dc=soliton,dc=example,dc=jp"
>>> password = <<< secret >>>
>>> sasl {
>>> }
>>> user_dn = "LDAP-UserDn"
>>> user {
>>> scope = "sub"
>>> access_positive = yes
>>> sasl {
>>> }
>>> }
>>> group {
>>> scope = "sub"
>>> name_attribute = "cn"
>>> cacheable_name = no
>>> cacheable_dn = no
>>> allow_dangling_group_ref = no
>>> }
>>> client {
>>> scope = "sub"
>>> base_dn = ""
>>> }
>>> profile {
>>> }
>>> options {
>>> ldap_debug = 0
>>> net_timeout = 10
>>> res_timeout = 20
>>> srv_timelimit = 20
>>> idle = 60
>>> probes = 3
>>> interval = 30
>>> }
>>> tls {
>>> check_crl = no
>>> start_tls = no
>>> }
>>> }
>>> Creating attribute LDAP-Group
>>> # Loaded module rlm_logintime
>>> # Loading module "logintime" from file
>>> /usr/local/etc/raddb/mods-enabled/logintime
>>> logintime {
>>> minimum_timeout = 60
>>> }
>>> # Loaded module rlm_files
>>> # Loading module "files" from file
>>> /usr/local/etc/raddb/mods-enabled/files
>>> files {
>>> filename = "/usr/local/etc/raddb/mods-config/files/authorize"
>>> acctusersfile =
>>> "/usr/local/etc/raddb/mods-config/files/accounting"
>>> preproxy_usersfile =
>>> "/usr/local/etc/raddb/mods-config/files/pre-proxy"
>>> }
>>> # Loaded module rlm_radutmp
>>> # Loading module "radutmp" from file
>>> /usr/local/etc/raddb/mods-enabled/radutmp
>>> radutmp {
>>> filename = "/usr/local/var/log/radius/radutmp"
>>> username = "%{User-Name}"
>>> case_sensitive = yes
>>> check_with_nas = yes
>>> permissions = 384
>>> caller_id = yes
>>> }
>>> # Loading module "ntlm_auth" from file
>>> /usr/local/etc/raddb/mods-enabled/ntlm_auth
>>> exec ntlm_auth {
>>> wait = yes
>>> program = "/path/to/ntlm_auth --request-nt-key
>>> --domain=MYDOMAIN --username=%{mschap:User-Name}
>>> --password=%{User-Password}"
>>> shell_escape = yes
>>> }
>>> # Loaded module rlm_digest
>>> # Loading module "digest" from file
>>> /usr/local/etc/raddb/mods-enabled/digest
>>> # Loading module "sradutmp" from file
>>> /usr/local/etc/raddb/mods-enabled/sradutmp
>>> radutmp sradutmp {
>>> filename = "/usr/local/var/log/radius/sradutmp"
>>> username = "%{User-Name}"
>>> case_sensitive = yes
>>> check_with_nas = yes
>>> permissions = 420
>>> caller_id = no
>>> }
>>> # Loaded module rlm_replicate
>>> # Loading module "replicate" from file
>>> /usr/local/etc/raddb/mods-enabled/replicate
>>> # Loaded module rlm_unpack
>>> # Loading module "unpack" from file
>>> /usr/local/etc/raddb/mods-enabled/unpack
>>> # Loaded module rlm_detail
>>> # Loading module "auth_log" from file
>>> /usr/local/etc/raddb/mods-enabled/detail.log
>>> detail auth_log {
>>> filename =
>>> "/usr/local/var/log/radius/radacct/%{%{Packet-Src-IP-Address}:-%{Packet-Src-IPv6-Address}}/auth-deta
>>> l-%Y%m%d"
>>> header = "%t"
>>> permissions = 384
>>> locking = no
>>> escape_filenames = no
>>> log_packet_header = no
>>> }
>>> # Loading module "reply_log" from file
>>> /usr/local/etc/raddb/mods-enabled/detail.log
>>> detail reply_log {
>>> filename =
>>> "/usr/local/var/log/radius/radacct/%{%{Packet-Src-IP-Address}:-%{Packet-Src-IPv6-Address}}/reply-det
>>> il-%Y%m%d"
>>> header = "%t"
>>> permissions = 384
>>> locking = no
>>> escape_filenames = no
>>> log_packet_header = no
>>> }
>>> # Loading module "pre_proxy_log" from file
>>> /usr/local/etc/raddb/mods-enabled/detail.log
>>> detail pre_proxy_log {
>>> filename =
>>> "/usr/local/var/log/radius/radacct/%{%{Packet-Src-IP-Address}:-%{Packet-Src-IPv6-Address}}/pre-proxy
>>> detail-%Y%m%d"
>>> header = "%t"
>>> permissions = 384
>>> locking = no
>>> escape_filenames = no
>>> log_packet_header = no
>>> }
>>> # Loading module "post_proxy_log" from file
>>> /usr/local/etc/raddb/mods-enabled/detail.log
>>> detail post_proxy_log {
>>> filename =
>>> "/usr/local/var/log/radius/radacct/%{%{Packet-Src-IP-Address}:-%{Packet-Src-IPv6-Address}}/post-prox
>>> -detail-%Y%m%d"
>>> header = "%t"
>>> permissions = 384
>>> locking = no
>>> escape_filenames = no
>>> log_packet_header = no
>>> }
>>> # Loaded module rlm_soh
>>> # Loading module "soh" from file /usr/local/etc/raddb/mods-enabled/soh
>>> soh {
>>> dhcp = yes
>>> }
>>> # Loading module "detail" from file
>>> /usr/local/etc/raddb/mods-enabled/detail
>>> detail {
>>> filename =
>>> "/usr/local/var/log/radius/radacct/%{%{Packet-Src-IP-Address}:-%{Packet-Src-IPv6-Address}}/detail-%Y
>>> m%d"
>>> header = "%t"
>>> permissions = 384
>>> locking = no
>>> escape_filenames = no
>>> log_packet_header = no
>>> }
>>> # Loaded module rlm_attr_filter
>>> # Loading module "attr_filter.post-proxy" from file
>>> /usr/local/etc/raddb/mods-enabled/attr_filter
>>> attr_filter attr_filter.post-proxy {
>>> filename =
>>> "/usr/local/etc/raddb/mods-config/attr_filter/post-proxy"
>>> key = "%{Realm}"
>>> relaxed = no
>>> }
>>> # Loading module "attr_filter.pre-proxy" from file
>>> /usr/local/etc/raddb/mods-enabled/attr_filter
>>> attr_filter attr_filter.pre-proxy {
>>> filename =
>>> "/usr/local/etc/raddb/mods-config/attr_filter/pre-proxy"
>>> key = "%{Realm}"
>>> relaxed = no
>>> }
>>> # Loading module "attr_filter.access_reject" from file
>>> /usr/local/etc/raddb/mods-enabled/attr_filter
>>> attr_filter attr_filter.access_reject {
>>> filename =
>>> "/usr/local/etc/raddb/mods-config/attr_filter/access_reject"
>>> key = "%{User-Name}"
>>> relaxed = no
>>> }
>>> # Loading module "attr_filter.access_challenge" from file
>>> /usr/local/etc/raddb/mods-enabled/attr_filter
>>> attr_filter attr_filter.access_challenge {
>>> filename =
>>> "/usr/local/etc/raddb/mods-config/attr_filter/access_challenge"
>>> key = "%{User-Name}"
>>> relaxed = no
>>> }
>>> # Loading module "attr_filter.accounting_response" from file
>>> /usr/local/etc/raddb/mods-enabled/attr_filter
>>> attr_filter attr_filter.accounting_response {
>>> filename =
>>> "/usr/local/etc/raddb/mods-config/attr_filter/accounting_response"
>>> key = "%{User-Name}"
>>> relaxed = no
>>> }
>>> # Loading module "attr_filter.coa" from file
>>> /usr/local/etc/raddb/mods-enabled/attr_filter
>>> attr_filter attr_filter.coa {
>>> filename = "/usr/local/etc/raddb/mods-config/attr_filter/coa"
>>> key = "%{User-Name}"
>>> relaxed = no
>>> }
>>> # Loaded module rlm_linelog
>>> # Loading module "linelog" from file
>>> /usr/local/etc/raddb/mods-enabled/linelog
>>> linelog {
>>> filename = "/usr/local/var/log/radius/linelog"
>>> escape_filenames = no
>>> syslog_severity = "info"
>>> permissions = 384
>>> format = "This is a log message for %{User-Name}"
>>> reference = "messages.%{%{reply:Packet-Type}:-default}"
>>> }
>>> # Loading module "log_accounting" from file
>>> /usr/local/etc/raddb/mods-enabled/linelog
>>> linelog log_accounting {
>>> filename = "/usr/local/var/log/radius/linelog-accounting"
>>> escape_filenames = no
>>> syslog_severity = "info"
>>> permissions = 384
>>> format = ""
>>> reference = "Accounting-Request.%{%{Acct-Status-Type}:-unknown}"
>>> }
>>> # Loaded module rlm_expiration
>>> # Loading module "expiration" from file
>>> /usr/local/etc/raddb/mods-enabled/expiration
>>> # Loaded module rlm_eap
>>> # Loading module "eap" from file /usr/local/etc/raddb/mods-enabled/eap
>>> eap {
>>> default_eap_type = "md5"
>>> timer_expire = 60
>>> max_eap_type = 52
>>> ignore_unknown_eap_types = no
>>> cisco_accounting_username_bug = no
>>> max_sessions = 16384
>>> }
>>> # Loaded module rlm_pap
>>> # Loading module "pap" from file /usr/local/etc/raddb/mods-enabled/pap
>>> pap {
>>> normalise = yes
>>> }
>>> # Loaded module rlm_passwd
>>> # Loading module "etc_passwd" from file
>>> /usr/local/etc/raddb/mods-enabled/passwd
>>> passwd etc_passwd {
>>> filename = "/etc/passwd"
>>> format = "*User-Name:Crypt-Password:"
>>> delimiter = ":"
>>> ignore_nislike = no
>>> ignore_empty = yes
>>> allow_multiple_keys = no
>>> hash_size = 100
>>> }
>>> # Loading module "echo" from file /usr/local/etc/raddb/mods-enabled/echo
>>> exec echo {
>>> wait = yes
>>> program = "/bin/echo %{User-Name}"
>>> input_pairs = "request"
>>> output_pairs = "reply"
>>> shell_escape = yes
>>> }
>>> # Loaded module rlm_mschap
>>> # Loading module "mschap" from file
>>> /usr/local/etc/raddb/mods-enabled/mschap
>>> mschap {
>>> use_mppe = yes
>>> require_encryption = no
>>> require_strong = no
>>> with_ntdomain_hack = yes
>>> passchange {
>>> }
>>> allow_retry = yes
>>> winbind_retry_with_normalised_username = no
>>> }
>>> instantiate {
>>> }
>>> # Instantiating module "IPASS" from file
>>> /usr/local/etc/raddb/mods-enabled/realm
>>> # Instantiating module "suffix" from file
>>> /usr/local/etc/raddb/mods-enabled/realm
>>> # Instantiating module "bangpath" from file
>>> /usr/local/etc/raddb/mods-enabled/realm
>>> # Instantiating module "realmpercent" from file
>>> /usr/local/etc/raddb/mods-enabled/realm
>>> # Instantiating module "ntdomain" from file
>>> /usr/local/etc/raddb/mods-enabled/realm
>>> # Instantiating module "reject" from file
>>> /usr/local/etc/raddb/mods-enabled/always
>>> # Instantiating module "fail" from file
>>> /usr/local/etc/raddb/mods-enabled/always
>>> # Instantiating module "ok" from file
>>> /usr/local/etc/raddb/mods-enabled/always
>>> # Instantiating module "handled" from file
>>> /usr/local/etc/raddb/mods-enabled/always
>>> # Instantiating module "invalid" from file
>>> /usr/local/etc/raddb/mods-enabled/always
>>> # Instantiating module "userlock" from file
>>> /usr/local/etc/raddb/mods-enabled/always
>>> # Instantiating module "notfound" from file
>>> /usr/local/etc/raddb/mods-enabled/always
>>> # Instantiating module "noop" from file
>>> /usr/local/etc/raddb/mods-enabled/always
>>> # Instantiating module "updated" from file
>>> /usr/local/etc/raddb/mods-enabled/always
>>> # Instantiating module "preprocess" from file
>>> /usr/local/etc/raddb/mods-enabled/preprocess
>>> reading pairlist file
>>> /usr/local/etc/raddb/mods-config/preprocess/huntgroups
>>> reading pairlist file /usr/local/etc/raddb/mods-config/preprocess/hints
>>> # Instantiating module "ldap" from file
>>> /usr/local/etc/raddb/mods-enabled/ldap1
>>> rlm_ldap: libldap vendor: OpenLDAP, version: 20457
>>> rlm_ldap (ldap): Couldn't find configuration for accounting, will return
>>> NOOP for calls from this section
>>> rlm_ldap (ldap): Couldn't find configuration for post-auth, will return
>>> NOOP for calls from this section
>>> !!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
>>> !! libldap is using GnuTLS, while FreeRADIUS is using OpenSSL
>>> !! There may be random issues with TLS connections due to this conflict.
>>> !! The server may also crash.
>>> !! See https://wiki.freeradius.org/modules/Rlm_ldap for more information.
>>> !!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
>>> rlm_ldap (ldap): Initialising connection pool
>>> pool {
>>> start = 5
>>> min = 3
>>> max = 32
>>> spare = 10
>>> uses = 0
>>> lifetime = 0
>>> cleanup_interval = 30
>>> idle_timeout = 60
>>> retry_delay = 30
>>> max_retries = 5
>>> spread = no
>>> }
>>> rlm_ldap (ldap): Opening additional connection (0), 1 of 32 pending
>>> slots used
>>> rlm_ldap (ldap): Connecting to ldap://192.168.1.6:389
>>> rlm_ldap (ldap): Waiting for bind result...
>>> rlm_ldap (ldap): Bind credentials incorrect: Invalid credentials
>>> rlm_ldap (ldap): Server said: 80090308: LdapErr: DSID-0C090569, comment:
>>> AcceptSecurityContext error, data 52e, v4f7c.
>>> rlm_ldap (ldap): Opening connection failed (0)
>>> rlm_ldap (ldap): Removing connection pool
>>> /usr/local/etc/raddb/mods-enabled/ldap1[1]: Instantiation failed for
>>> module "ldap"
>>> root@debian11-hira:/usr/local/etc/raddb# /usr/local/sbin/radiusd -X
>>> FreeRADIUS Version 3.2.3
>>> Copyright (C) 1999-2022 The FreeRADIUS server project and contributors
>>> There is NO warranty; not even for MERCHANTABILITY or FITNESS FOR A
>>> PARTICULAR PURPOSE
>>> You may redistribute copies of FreeRADIUS under the terms of the
>>> GNU General Public License
>>> For more information about these matters, see the file named COPYRIGHT
>>> Starting - reading configuration files ...
>>> including dictionary file /usr/local/share/freeradius/dictionary
>>> including dictionary file /usr/local/share/freeradius/dictionary.dhcp
>>> including dictionary file /usr/local/share/freeradius/dictionary.vqp
>>> including dictionary file /usr/local/etc/raddb/dictionary
>>> including configuration file /usr/local/etc/raddb/radiusd.conf
>>> including configuration file /usr/local/etc/raddb/proxy.conf
>>> including configuration file /usr/local/etc/raddb/clients.conf
>>> including files in directory /usr/local/etc/raddb/mods-enabled/
>>> including configuration file
>>> /usr/local/etc/raddb/mods-enabled/dynamic_clients
>>> including configuration file /usr/local/etc/raddb/mods-enabled/realm
>>> including configuration file /usr/local/etc/raddb/mods-enabled/chap
>>> including configuration file /usr/local/etc/raddb/mods-enabled/utf8
>>> including configuration file /usr/local/etc/raddb/mods-enabled/date
>>> including configuration file /usr/local/etc/raddb/mods-enabled/exec
>>> including configuration file /usr/local/etc/raddb/mods-enabled/unix
>>> including configuration file /usr/local/etc/raddb/mods-enabled/expr
>>> including configuration file /usr/local/etc/raddb/mods-enabled/totp
>>> including configuration file /usr/local/etc/raddb/mods-enabled/always
>>> including configuration file /usr/local/etc/raddb/mods-enabled/preprocess
>>> including configuration file /usr/local/etc/raddb/mods-enabled/ldap1
>>> including configuration file /usr/local/etc/raddb/mods-enabled/logintime
>>> including configuration file /usr/local/etc/raddb/mods-enabled/files
>>> including configuration file /usr/local/etc/raddb/mods-enabled/radutmp
>>> including configuration file /usr/local/etc/raddb/mods-enabled/ntlm_auth
>>> including configuration file /usr/local/etc/raddb/mods-enabled/digest
>>> including configuration file /usr/local/etc/raddb/mods-enabled/sradutmp
>>> including configuration file /usr/local/etc/raddb/mods-enabled/replicate
>>> including configuration file /usr/local/etc/raddb/mods-enabled/unpack
>>> including configuration file /usr/local/etc/raddb/mods-enabled/detail.log
>>> including configuration file /usr/local/etc/raddb/mods-enabled/soh
>>> including configuration file /usr/local/etc/raddb/mods-enabled/detail
>>> including configuration file /usr/local/etc/raddb/mods-enabled/attr_filter
>>> including configuration file /usr/local/etc/raddb/mods-enabled/linelog
>>> including configuration file /usr/local/etc/raddb/mods-enabled/expiration
>>> including configuration file /usr/local/etc/raddb/mods-enabled/eap
>>> including configuration file /usr/local/etc/raddb/mods-enabled/pap
>>> including configuration file /usr/local/etc/raddb/mods-enabled/passwd
>>> including configuration file /usr/local/etc/raddb/mods-enabled/echo
>>> including configuration file /usr/local/etc/raddb/mods-enabled/mschap
>>> including files in directory /usr/local/etc/raddb/policy.d/
>>> including configuration file /usr/local/etc/raddb/policy.d/accounting
>>> including configuration file /usr/local/etc/raddb/policy.d/abfab-tr
>>> including configuration file /usr/local/etc/raddb/policy.d/rfc7542
>>> including configuration file /usr/local/etc/raddb/policy.d/cui
>>> including configuration file /usr/local/etc/raddb/policy.d/filter
>>> including configuration file /usr/local/etc/raddb/policy.d/canonicalization
>>> including configuration file /usr/local/etc/raddb/policy.d/dhcp
>>> including configuration file /usr/local/etc/raddb/policy.d/operator-name
>>> including configuration file /usr/local/etc/raddb/policy.d/debug
>>> including configuration file /usr/local/etc/raddb/policy.d/eap
>>> including configuration file /usr/local/etc/raddb/policy.d/control
>>> including configuration file
>>> /usr/local/etc/raddb/policy.d/moonshot-targeted-ids
>>> including files in directory /usr/local/etc/raddb/sites-enabled/
>>> including configuration file /usr/local/etc/raddb/sites-enabled/default
>>> including configuration file
>>> /usr/local/etc/raddb/sites-enabled/inner-tunnel
>>> main {
>>> security {
>>> allow_core_dumps = no
>>> }
>>> name = "radiusd"
>>> prefix = "/usr/local"
>>> localstatedir = "/usr/local/var"
>>> logdir = "/usr/local/var/log/radius"
>>> run_dir = "/usr/local/var/run/radiusd"
>>> }
>>> main {
>>> name = "radiusd"
>>> prefix = "/usr/local"
>>> localstatedir = "/usr/local/var"
>>> sbindir = "/usr/local/sbin"
>>> logdir = "/usr/local/var/log/radius"
>>> run_dir = "/usr/local/var/run/radiusd"
>>> libdir = "/usr/local/lib"
>>> radacctdir = "/usr/local/var/log/radius/radacct"
>>> hostname_lookups = no
>>> max_request_time = 30
>>> cleanup_delay = 5
>>> max_requests = 16384
>>> postauth_client_lost = no
>>> pidfile = "/usr/local/var/run/radiusd/radiusd.pid"
>>> checkrad = "/usr/local/sbin/checkrad"
>>> debug_level = 0
>>> proxy_requests = yes
>>> log {
>>> stripped_names = no
>>> auth = no
>>> auth_badpass = no
>>> auth_goodpass = no
>>> colourise = yes
>>> msg_denied = "You are already logged in - access denied"
>>> }
>>> resources {
>>> }
>>> security {
>>> max_attributes = 200
>>> reject_delay = 1.000000
>>> status_server = yes
>>> allow_vulnerable_openssl = "no"
>>> }
>>> }
>>> radiusd: #### Loading Realms and Home Servers ####
>>> proxy server {
>>> retry_delay = 5
>>> retry_count = 3
>>> default_fallback = no
>>> dead_time = 120
>>> wake_all_if_all_dead = no
>>> }
>>> home_server localhost {
>>> nonblock = no
>>> ipaddr = 127.0.0.1
>>> port = 1812
>>> type = "auth"
>>> secret = <<< secret >>>
>>> response_window = 20.000000
>>> response_timeouts = 1
>>> max_outstanding = 65536
>>> zombie_period = 40
>>> status_check = "status-server"
>>> ping_interval = 30
>>> check_interval = 30
>>> check_timeout = 4
>>> num_answers_to_alive = 3
>>> revive_interval = 120
>>> limit {
>>> max_connections = 16
>>> max_requests = 0
>>> lifetime = 0
>>> idle_timeout = 0
>>> }
>>> coa {
>>> irt = 2
>>> mrt = 16
>>> mrc = 5
>>> mrd = 30
>>> }
>>> recv_coa {
>>> }
>>> }
>>> home_server_pool my_auth_failover {
>>> type = fail-over
>>> home_server = localhost
>>> }
>>> realm example.com {
>>> auth_pool = my_auth_failover
>>> }
>>> realm LOCAL {
>>> }
>>> radiusd: #### Loading Clients ####
>>> client localhost {
>>> ipaddr = 127.0.0.1
>>> require_message_authenticator = no
>>> secret = <<< secret >>>
>>> nas_type = "other"
>>> proto = "*"
>>> limit {
>>> max_connections = 16
>>> lifetime = 0
>>> idle_timeout = 30
>>> }
>>> }
>>> client localhost_ipv6 {
>>> ipv6addr = ::1
>>> require_message_authenticator = no
>>> secret = <<< secret >>>
>>> limit {
>>> max_connections = 16
>>> lifetime = 0
>>> idle_timeout = 30
>>> }
>>> }
>>> client naeps245 {
>>> ipaddr = 192.168.1.245
>>> require_message_authenticator = no
>>> secret = <<< secret >>>
>>> limit {
>>> max_connections = 16
>>> lifetime = 0
>>> idle_timeout = 30
>>> }
>>> }
>>> Debugger not attached
>>> # Creating Auth-Type = mschap
>>> # Creating Auth-Type = digest
>>> # Creating Auth-Type = eap
>>> # Creating Auth-Type = PAP
>>> # Creating Auth-Type = CHAP
>>> # Creating Auth-Type = MS-CHAP
>>> # Creating Autz-Type = New-TLS-Connection
>>> # Creating Post-Auth-Type = Client-Lost
>>> radiusd: #### Instantiating modules ####
>>> modules {
>>> # Loaded module rlm_dynamic_clients
>>> # Loading module "dynamic_clients" from file
>>> /usr/local/etc/raddb/mods-enabled/dynamic_clients
>>> # Loaded module rlm_realm
>>> # Loading module "IPASS" from file
>>> /usr/local/etc/raddb/mods-enabled/realm
>>> realm IPASS {
>>> format = "prefix"
>>> delimiter = "/"
>>> ignore_default = no
>>> ignore_null = no
>>> }
>>> # Loading module "suffix" from file
>>> /usr/local/etc/raddb/mods-enabled/realm
>>> realm suffix {
>>> format = "suffix"
>>> delimiter = "@"
>>> ignore_default = no
>>> ignore_null = no
>>> }
>>> # Loading module "bangpath" from file
>>> /usr/local/etc/raddb/mods-enabled/realm
>>> realm bangpath {
>>> format = "prefix"
>>> delimiter = "!"
>>> ignore_default = no
>>> ignore_null = no
>>> }
>>> # Loading module "realmpercent" from file
>>> /usr/local/etc/raddb/mods-enabled/realm
>>> realm realmpercent {
>>> format = "suffix"
>>> delimiter = "%"
>>> ignore_default = no
>>> ignore_null = no
>>> }
>>> # Loading module "ntdomain" from file
>>> /usr/local/etc/raddb/mods-enabled/realm
>>> realm ntdomain {
>>> format = "prefix"
>>> delimiter = "\\"
>>> ignore_default = no
>>> ignore_null = no
>>> }
>>> # Loaded module rlm_chap
>>> # Loading module "chap" from file /usr/local/etc/raddb/mods-enabled/chap
>>> # Loaded module rlm_utf8
>>> # Loading module "utf8" from file /usr/local/etc/raddb/mods-enabled/utf8
>>> # Loaded module rlm_date
>>> # Loading module "date" from file /usr/local/etc/raddb/mods-enabled/date
>>> date {
>>> format = "%b %e %Y %H:%M:%S %Z"
>>> utc = no
>>> }
>>> # Loading module "wispr2date" from file
>>> /usr/local/etc/raddb/mods-enabled/date
>>> date wispr2date {
>>> format = "%Y-%m-%dT%H:%M:%S"
>>> utc = no
>>> }
>>> # Loaded module rlm_exec
>>> # Loading module "exec" from file /usr/local/etc/raddb/mods-enabled/exec
>>> exec {
>>> wait = no
>>> input_pairs = "request"
>>> shell_escape = yes
>>> timeout = 10
>>> }
>>> # Loaded module rlm_unix
>>> # Loading module "unix" from file /usr/local/etc/raddb/mods-enabled/unix
>>> unix {
>>> radwtmp = "/usr/local/var/log/radius/radwtmp"
>>> }
>>> Creating attribute Unix-Group
>>> # Loaded module rlm_expr
>>> # Loading module "expr" from file /usr/local/etc/raddb/mods-enabled/expr
>>> expr {
>>> safe_characters =
>>> "@abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ0123456789.-_:
>>> /aeouaaaceeeeiio?uuuayAEOUsAAACEEEEIIO?UUU?"
>>> }
>>> # Loaded module rlm_always
>>> # Loading module "reject" from file
>>> /usr/local/etc/raddb/mods-enabled/always
>>> always reject {
>>> rcode = "reject"
>>> simulcount = 0
>>> mpp = no
>>> }
>>> # Loading module "fail" from file
>>> /usr/local/etc/raddb/mods-enabled/always
>>> always fail {
>>> rcode = "fail"
>>> simulcount = 0
>>> mpp = no
>>> }
>>> # Loading module "ok" from file /usr/local/etc/raddb/mods-enabled/always
>>> always ok {
>>> rcode = "ok"
>>> simulcount = 0
>>> mpp = no
>>> }
>>> # Loading module "handled" from file
>>> /usr/local/etc/raddb/mods-enabled/always
>>> always handled {
>>> rcode = "handled"
>>> simulcount = 0
>>> mpp = no
>>> }
>>> # Loading module "invalid" from file
>>> /usr/local/etc/raddb/mods-enabled/always
>>> always invalid {
>>> rcode = "invalid"
>>> simulcount = 0
>>> mpp = no
>>> }
>>> # Loading module "userlock" from file
>>> /usr/local/etc/raddb/mods-enabled/always
>>> always userlock {
>>> rcode = "userlock"
>>> simulcount = 0
>>> mpp = no
>>> }
>>> # Loading module "notfound" from file
>>> /usr/local/etc/raddb/mods-enabled/always
>>> always notfound {
>>> rcode = "notfound"
>>> simulcount = 0
>>> mpp = no
>>> }
>>> # Loading module "noop" from file
>>> /usr/local/etc/raddb/mods-enabled/always
>>> always noop {
>>> rcode = "noop"
>>> simulcount = 0
>>> mpp = no
>>> }
>>> # Loading module "updated" from file
>>> /usr/local/etc/raddb/mods-enabled/always
>>> always updated {
>>> rcode = "updated"
>>> simulcount = 0
>>> mpp = no
>>> }
>>> # Loaded module rlm_preprocess
>>> # Loading module "preprocess" from file
>>> /usr/local/etc/raddb/mods-enabled/preprocess
>>> preprocess {
>>> huntgroups =
>>> "/usr/local/etc/raddb/mods-config/preprocess/huntgroups"
>>> hints = "/usr/local/etc/raddb/mods-config/preprocess/hints"
>>> with_ascend_hack = no
>>> ascend_channels_per_line = 23
>>> with_ntdomain_hack = no
>>> with_specialix_jetstream_hack = no
>>> with_cisco_vsa_hack = no
>>> with_alvarion_vsa_hack = no
>>> }
>>> # Loaded module rlm_ldap
>>> # Loading module "ldap" from file
>>> /usr/local/etc/raddb/mods-enabled/ldap1
>>> ldap {
>>> server = "192.168.1.6"
>>> identity =
>>> "cn=tkt10886-5,cn=users,dc=srv2022,dc=rdd-osaka,dc=soliton,dc=example,dc=jp"
>>> password = <<< secret >>>
>>> sasl {
>>> }
>>> user_dn = "LDAP-UserDn"
>>> user {
>>> scope = "sub"
>>> access_positive = yes
>>> sasl {
>>> }
>>> }
>>> group {
>>> scope = "sub"
>>> name_attribute = "cn"
>>> cacheable_name = no
>>> cacheable_dn = no
>>> allow_dangling_group_ref = no
>>> }
>>> client {
>>> scope = "sub"
>>> base_dn = ""
>>> }
>>> profile {
>>> }
>>> options {
>>> ldap_debug = 0
>>> net_timeout = 10
>>> res_timeout = 20
>>> srv_timelimit = 20
>>> idle = 60
>>> probes = 3
>>> interval = 30
>>> }
>>> tls {
>>> check_crl = no
>>> start_tls = no
>>> }
>>> }
>>> Creating attribute LDAP-Group
>>> # Loaded module rlm_logintime
>>> # Loading module "logintime" from file
>>> /usr/local/etc/raddb/mods-enabled/logintime
>>> logintime {
>>> minimum_timeout = 60
>>> }
>>> # Loaded module rlm_files
>>> # Loading module "files" from file
>>> /usr/local/etc/raddb/mods-enabled/files
>>> files {
>>> filename = "/usr/local/etc/raddb/mods-config/files/authorize"
>>> acctusersfile =
>>> "/usr/local/etc/raddb/mods-config/files/accounting"
>>> preproxy_usersfile =
>>> "/usr/local/etc/raddb/mods-config/files/pre-proxy"
>>> }
>>> # Loaded module rlm_radutmp
>>> # Loading module "radutmp" from file
>>> /usr/local/etc/raddb/mods-enabled/radutmp
>>> radutmp {
>>> filename = "/usr/local/var/log/radius/radutmp"
>>> username = "%{User-Name}"
>>> case_sensitive = yes
>>> check_with_nas = yes
>>> permissions = 384
>>> caller_id = yes
>>> }
>>> # Loading module "ntlm_auth" from file
>>> /usr/local/etc/raddb/mods-enabled/ntlm_auth
>>> exec ntlm_auth {
>>> wait = yes
>>> program = "/path/to/ntlm_auth --request-nt-key
>>> --domain=MYDOMAIN --username=%{mschap:User-Name}
>>> --password=%{User-Password}"
>>> shell_escape = yes
>>> }
>>> # Loaded module rlm_digest
>>> # Loading module "digest" from file
>>> /usr/local/etc/raddb/mods-enabled/digest
>>> # Loading module "sradutmp" from file
>>> /usr/local/etc/raddb/mods-enabled/sradutmp
>>> radutmp sradutmp {
>>> filename = "/usr/local/var/log/radius/sradutmp"
>>> username = "%{User-Name}"
>>> case_sensitive = yes
>>> check_with_nas = yes
>>> permissions = 420
>>> caller_id = no
>>> }
>>> # Loaded module rlm_replicate
>>> # Loading module "replicate" from file
>>> /usr/local/etc/raddb/mods-enabled/replicate
>>> # Loaded module rlm_unpack
>>> # Loading module "unpack" from file
>>> /usr/local/etc/raddb/mods-enabled/unpack
>>> # Loaded module rlm_detail
>>> # Loading module "auth_log" from file
>>> /usr/local/etc/raddb/mods-enabled/detail.log
>>> detail auth_log {
>>> filename =
>>> "/usr/local/var/log/radius/radacct/%{%{Packet-Src-IP-Address}:-%{Packet-Src-IPv6-Address}}/auth-deta
>>> l-%Y%m%d"
>>> header = "%t"
>>> permissions = 384
>>> locking = no
>>> escape_filenames = no
>>> log_packet_header = no
>>> }
>>> # Loading module "reply_log" from file
>>> /usr/local/etc/raddb/mods-enabled/detail.log
>>> detail reply_log {
>>> filename =
>>> "/usr/local/var/log/radius/radacct/%{%{Packet-Src-IP-Address}:-%{Packet-Src-IPv6-Address}}/reply-det
>>> il-%Y%m%d"
>>> header = "%t"
>>> permissions = 384
>>> locking = no
>>> escape_filenames = no
>>> log_packet_header = no
>>> }
>>> # Loading module "pre_proxy_log" from file
>>> /usr/local/etc/raddb/mods-enabled/detail.log
>>> detail pre_proxy_log {
>>> filename =
>>> "/usr/local/var/log/radius/radacct/%{%{Packet-Src-IP-Address}:-%{Packet-Src-IPv6-Address}}/pre-proxy
>>> detail-%Y%m%d"
>>> header = "%t"
>>> permissions = 384
>>> locking = no
>>> escape_filenames = no
>>> log_packet_header = no
>>> }
>>> # Loading module "post_proxy_log" from file
>>> /usr/local/etc/raddb/mods-enabled/detail.log
>>> detail post_proxy_log {
>>> filename =
>>> "/usr/local/var/log/radius/radacct/%{%{Packet-Src-IP-Address}:-%{Packet-Src-IPv6-Address}}/post-prox
>>> -detail-%Y%m%d"
>>> header = "%t"
>>> permissions = 384
>>> locking = no
>>> escape_filenames = no
>>> log_packet_header = no
>>> }
>>> # Loaded module rlm_soh
>>> # Loading module "soh" from file /usr/local/etc/raddb/mods-enabled/soh
>>> soh {
>>> dhcp = yes
>>> }
>>> # Loading module "detail" from file
>>> /usr/local/etc/raddb/mods-enabled/detail
>>> detail {
>>> filename =
>>> "/usr/local/var/log/radius/radacct/%{%{Packet-Src-IP-Address}:-%{Packet-Src-IPv6-Address}}/detail-%Y
>>> m%d"
>>> header = "%t"
>>> permissions = 384
>>> locking = no
>>> escape_filenames = no
>>> log_packet_header = no
>>> }
>>> # Loaded module rlm_attr_filter
>>> # Loading module "attr_filter.post-proxy" from file
>>> /usr/local/etc/raddb/mods-enabled/attr_filter
>>> attr_filter attr_filter.post-proxy {
>>> filename =
>>> "/usr/local/etc/raddb/mods-config/attr_filter/post-proxy"
>>> key = "%{Realm}"
>>> relaxed = no
>>> }
>>> # Loading module "attr_filter.pre-proxy" from file
>>> /usr/local/etc/raddb/mods-enabled/attr_filter
>>> attr_filter attr_filter.pre-proxy {
>>> filename =
>>> "/usr/local/etc/raddb/mods-config/attr_filter/pre-proxy"
>>> key = "%{Realm}"
>>> relaxed = no
>>> }
>>> # Loading module "attr_filter.access_reject" from file
>>> /usr/local/etc/raddb/mods-enabled/attr_filter
>>> attr_filter attr_filter.access_reject {
>>> filename =
>>> "/usr/local/etc/raddb/mods-config/attr_filter/access_reject"
>>> key = "%{User-Name}"
>>> relaxed = no
>>> }
>>> # Loading module "attr_filter.access_challenge" from file
>>> /usr/local/etc/raddb/mods-enabled/attr_filter
>>> attr_filter attr_filter.access_challenge {
>>> filename =
>>> "/usr/local/etc/raddb/mods-config/attr_filter/access_challenge"
>>> key = "%{User-Name}"
>>> relaxed = no
>>> }
>>> # Loading module "attr_filter.accounting_response" from file
>>> /usr/local/etc/raddb/mods-enabled/attr_filter
>>> attr_filter attr_filter.accounting_response {
>>> filename =
>>> "/usr/local/etc/raddb/mods-config/attr_filter/accounting_response"
>>> key = "%{User-Name}"
>>> relaxed = no
>>> }
>>> # Loading module "attr_filter.coa" from file
>>> /usr/local/etc/raddb/mods-enabled/attr_filter
>>> attr_filter attr_filter.coa {
>>> filename = "/usr/local/etc/raddb/mods-config/attr_filter/coa"
>>> key = "%{User-Name}"
>>> relaxed = no
>>> }
>>> # Loaded module rlm_linelog
>>> # Loading module "linelog" from file
>>> /usr/local/etc/raddb/mods-enabled/linelog
>>> linelog {
>>> filename = "/usr/local/var/log/radius/linelog"
>>> escape_filenames = no
>>> syslog_severity = "info"
>>> permissions = 384
>>> format = "This is a log message for %{User-Name}"
>>> reference = "messages.%{%{reply:Packet-Type}:-default}"
>>> }
>>> # Loading module "log_accounting" from file
>>> /usr/local/etc/raddb/mods-enabled/linelog
>>> linelog log_accounting {
>>> filename = "/usr/local/var/log/radius/linelog-accounting"
>>> escape_filenames = no
>>> syslog_severity = "info"
>>> permissions = 384
>>> format = ""
>>> reference = "Accounting-Request.%{%{Acct-Status-Type}:-unknown}"
>>> }
>>> # Loaded module rlm_expiration
>>> # Loading module "expiration" from file
>>> /usr/local/etc/raddb/mods-enabled/expiration
>>> # Loaded module rlm_eap
>>> # Loading module "eap" from file /usr/local/etc/raddb/mods-enabled/eap
>>> eap {
>>> default_eap_type = "md5"
>>> timer_expire = 60
>>> max_eap_type = 52
>>> ignore_unknown_eap_types = no
>>> cisco_accounting_username_bug = no
>>> max_sessions = 16384
>>> }
>>> # Loaded module rlm_pap
>>> # Loading module "pap" from file /usr/local/etc/raddb/mods-enabled/pap
>>> pap {
>>> normalise = yes
>>> }
>>> # Loaded module rlm_passwd
>>> # Loading module "etc_passwd" from file
>>> /usr/local/etc/raddb/mods-enabled/passwd
>>> passwd etc_passwd {
>>> filename = "/etc/passwd"
>>> format = "*User-Name:Crypt-Password:"
>>> delimiter = ":"
>>> ignore_nislike = no
>>> ignore_empty = yes
>>> allow_multiple_keys = no
>>> hash_size = 100
>>> }
>>> # Loading module "echo" from file /usr/local/etc/raddb/mods-enabled/echo
>>> exec echo {
>>> wait = yes
>>> program = "/bin/echo %{User-Name}"
>>> input_pairs = "request"
>>> output_pairs = "reply"
>>> shell_escape = yes
>>> }
>>> # Loaded module rlm_mschap
>>> # Loading module "mschap" from file
>>> /usr/local/etc/raddb/mods-enabled/mschap
>>> mschap {
>>> use_mppe = yes
>>> require_encryption = no
>>> require_strong = no
>>> with_ntdomain_hack = yes
>>> passchange {
>>> }
>>> allow_retry = yes
>>> winbind_retry_with_normalised_username = no
>>> }
>>> instantiate {
>>> }
>>> # Instantiating module "IPASS" from file
>>> /usr/local/etc/raddb/mods-enabled/realm
>>> # Instantiating module "suffix" from file
>>> /usr/local/etc/raddb/mods-enabled/realm
>>> # Instantiating module "bangpath" from file
>>> /usr/local/etc/raddb/mods-enabled/realm
>>> # Instantiating module "realmpercent" from file
>>> /usr/local/etc/raddb/mods-enabled/realm
>>> # Instantiating module "ntdomain" from file
>>> /usr/local/etc/raddb/mods-enabled/realm
>>> # Instantiating module "reject" from file
>>> /usr/local/etc/raddb/mods-enabled/always
>>> # Instantiating module "fail" from file
>>> /usr/local/etc/raddb/mods-enabled/always
>>> # Instantiating module "ok" from file
>>> /usr/local/etc/raddb/mods-enabled/always
>>> # Instantiating module "handled" from file
>>> /usr/local/etc/raddb/mods-enabled/always
>>> # Instantiating module "invalid" from file
>>> /usr/local/etc/raddb/mods-enabled/always
>>> # Instantiating module "userlock" from file
>>> /usr/local/etc/raddb/mods-enabled/always
>>> # Instantiating module "notfound" from file
>>> /usr/local/etc/raddb/mods-enabled/always
>>> # Instantiating module "noop" from file
>>> /usr/local/etc/raddb/mods-enabled/always
>>> # Instantiating module "updated" from file
>>> /usr/local/etc/raddb/mods-enabled/always
>>> # Instantiating module "preprocess" from file
>>> /usr/local/etc/raddb/mods-enabled/preprocess
>>> reading pairlist file
>>> /usr/local/etc/raddb/mods-config/preprocess/huntgroups
>>> reading pairlist file /usr/local/etc/raddb/mods-config/preprocess/hints
>>> # Instantiating module "ldap" from file
>>> /usr/local/etc/raddb/mods-enabled/ldap1
>>> rlm_ldap: libldap vendor: OpenLDAP, version: 20457
>>> rlm_ldap (ldap): Couldn't find configuration for accounting, will return
>>> NOOP for calls from this section
>>> rlm_ldap (ldap): Couldn't find configuration for post-auth, will return
>>> NOOP for calls from this section
>>> !!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
>>> !! libldap is using GnuTLS, while FreeRADIUS is using OpenSSL
>>> !! There may be random issues with TLS connections due to this conflict.
>>> !! The server may also crash.
>>> !! See https://wiki.freeradius.org/modules/Rlm_ldap for more information.
>>> !!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
>>> rlm_ldap (ldap): Initialising connection pool
>>> pool {
>>> start = 5
>>> min = 3
>>> max = 32
>>> spare = 10
>>> uses = 0
>>> lifetime = 0
>>> cleanup_interval = 30
>>> idle_timeout = 60
>>> retry_delay = 30
>>> max_retries = 5
>>> spread = no
>>> }
>>> rlm_ldap (ldap): Opening additional connection (0), 1 of 32 pending
>>> slots used
>>> rlm_ldap (ldap): Connecting to ldap://192.168.1.6:389
>>> rlm_ldap (ldap): Waiting for bind result...
>>> rlm_ldap (ldap): Bind credentials incorrect: Invalid credentials
>>> rlm_ldap (ldap): Server said: 80090308: LdapErr: DSID-0C090569, comment:
>>> AcceptSecurityContext error, data 52e, v4f7c.
>>> rlm_ldap (ldap): Opening connection failed (0)
>>> rlm_ldap (ldap): Removing connection pool
>>> /usr/local/etc/raddb/mods-enabled/ldap1[1]: Instantiation failed for
>>> module "ldap"
>>> ===
>>>
>>> Checking the packet at this time with wireshark, we can confirm that
>>> `pass\"word@2022` is used as the password.
>>>
>>> ===
>>> Lightweight Directory Access Protocol
>>> LDAPMessage bindRequest(1)
>>> "cn=tkt10886-5,cn=users,dc=srv2022,dc=rdd-osaka,dc=soliton,dc=example,dc=jp" simple
>>> messageID: 1
>>> protocolOp: bindRequest (0)
>>> bindRequest
>>> version: 3
>>> name:
>>> cn=tkt10886-5,cn=users,dc=srv2022,dc=rdd-osaka,dc=soliton,dc=example,dc=jp
>>> authentication: simple (0)
>>> simple: pass\\"word@2022
>>> [Response In: 8]
>>> ===
>>>
>>> What should I do in this case?
>>>
>>> On 2023/09/11 18:10, Alan DeKok wrote:
>>>> On Sep 10, 2023, at 9:16 PM, 平林 哲
>>>> <Satoshi.Hirabayashi@soliton.co.jp> wrote:
>>>
>>> ===
>>> # cat /usr/local/etc/raddb/mods-enabled/ldap1
>>> ldap {
>>> server = '192.168.1.6'
>>> identity =
>>> 'cn=tkt10886-3,cn=users,dc=srv2022,dc=rdd-osaka,dc=soliton,dc=example,dc=jp'
>>> password = "pass\\"word@2022"
>>>> Two backslashes.
>>>
>>> However, it behaves differently in the shell.
>>>
>>> ===
>>> $ echo "pass\\\"word@2022"
>>>> Three backslashes.
>>>
>>> pass\"word@2022
>>> ===
>>>> Use three backslashes with FreeRADIUS, and it will work.
>>>
>>> Maybe the two backslashes need to be escaped into one backslash?
>>>> I explained the rules for double-quoted strings. They're the same
>>>> for all double quoted strings in FreeRADIUS, and in the shell.
>>>>
>>>> If you want a " in the middle of a double quoted string, you have
>>>> to escape it: \"
>>>>
>>>> If you want a \ in the middle of a double quoted string, you have
>>>> to escape it: \\
>>>>
>>>> Which means that if you want *both* a " and a \ in a double quoted
>>>> string, you need to have an *odd* number of backslashes.
>>>>
>>>> All you need to do is count the number of backslashes. Even *and*
>>>> there's a quote in the middle of the string? Parse error. Odd number
>>>> of backslashes? It's fine.
>>>>
>>>> Alan DeKok.
>>>>
>>>> -
>>>> List info/subscribe/unsubscribe? See
>>>> http://www.freeradius.org/list/users.html
>>
>> -
>> List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html
> -
> List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html
September 13, 2023 1:53 AM, "平林 哲" <Satoshi.Hirabayashi@soliton.co.jp> wrote:
I set pass\\\"word@2022 (three backslashes) in the configuration file to send the unescaped password pass\"word@2022.
password = "pass\\\"word@2022"
However, when I check the LDAP packet with Wireshark, it sends pass\\"word@2022 and the authentication fails.
Is this phenomenon unique to my environment?
You are right, I could reproduce this behavior. It seems that in module config string types, the backslashes themselves don't need to be escaped! Hence a the UNESCAPED password some\password can remain unescaped. password = "some\password". So it should work with this: password = "pass\\"word@2022" The first backslash stands as it is. The second escapes the double quote. Or you simply use single quotes: password = 'pass\"word@2022'
So it should work with this:
password = "pass\\"word@2022"
The first backslash stands as it is. The second escapes the double quote.
This setting will result in a syntax error. This is the first one I posted. Summary of results. | Configration | Result | Passwords in packets |-----------------------|----------------|--------------------- | "pass\"word@2022" | OK | pass"word@2022 | "pass\\"word@2022" | Syntax error | - | "pass\\\"word@2022" | OK | pass\\"word@2022 | "pass\\\\"word@2022" | Syntax error | - | "pass\\\\\"word@2022" | OK | pass\\\\"word@2022 I feel that this behaviour is not correct. Is there any way to correct this behaviour?
Or you simply use single quotes:
password = 'pass\"word@2022'
thank you. I understand that it can be used by using single quotes. On 2023/09/13 11:55, g4-lisz@tonarchiv.ch wrote:
September 13, 2023 1:53 AM, "平林 哲" <Satoshi.Hirabayashi@soliton.co.jp> wrote:
I set pass\\\"word@2022 (three backslashes) in the configuration file to send the unescaped password pass\"word@2022.
password = "pass\\\"word@2022"
However, when I check the LDAP packet with Wireshark, it sends pass\\"word@2022 and the authentication fails.
Is this phenomenon unique to my environment?
You are right, I could reproduce this behavior. It seems that in module config string types, the backslashes themselves don't need to be escaped! Hence a the UNESCAPED password some\password can remain unescaped. password = "some\password".
So it should work with this:
password = "pass\\"word@2022"
The first backslash stands as it is. The second escapes the double quote.
Or you simply use single quotes:
password = 'pass\"word@2022'
On Sep 12, 2023, at 11:31 PM, 平林 哲 <Satoshi.Hirabayashi@soliton.co.jp> wrote:
Summary of results.
You keep posting this. Why? Doing that means you're stuck on one part of the problem. You should instead work towards understanding the problem, which is more likely to lead you to a solution.
I feel that this behaviour is not correct.
You're wrong. I explained why. Go back and read the messages.
Is there any way to correct this behaviour?
You have source code. You can fix it if you don't like the behavior. We are not going to change the behavior of FreeRADIUS for everyone on the planet because you don't agree with 30+ year-old rules on string quoting and escaping. Alan DeKok.
Alan, but he's right! The behavior is really not as one would expect. At least different from a shell and C: "some\word" in config => some\word "some\\word" in config => some\\word "some\\\"word" in config => some\\"word (in a shell or C this would be the one) So how to escape some\"word? "some\\"word" in config => syntax error It only works with single quotes... Cheers September 13, 2023 1:35 PM, "Alan DeKok" <aland@deployingradius.com> wrote:
On Sep 12, 2023, at 11:31 PM, 平林 哲 <Satoshi.Hirabayashi@soliton.co.jp> wrote:
Summary of results.
You keep posting this. Why?
Doing that means you're stuck on one part of the problem. You should instead work towards understanding the problem, which is more likely to lead you to a solution.
I feel that this behaviour is not correct.
You're wrong. I explained why. Go back and read the messages.
Is there any way to correct this behaviour?
You have source code. You can fix it if you don't like the behavior.
We are not going to change the behavior of FreeRADIUS for everyone on the planet because you don't agree with 30+ year-old rules on string quoting and escaping.
Alan DeKok.
P.S. IMHO this behavior comes from getthing() in src/lib/token.c September 13, 2023 2:00 PM, g4-lisz@tonarchiv.ch wrote:
Alan,
but he's right! The behavior is really not as one would expect. At least different from a shell and C:
"some\word" in config => some\word "some\\word" in config => some\\word
"some\\\"word" in config => some\\"word (in a shell or C this would be the one)
So how to escape some\"word? "some\\"word" in config => syntax error
It only works with single quotes...
Cheers
September 13, 2023 1:35 PM, "Alan DeKok" <aland@deployingradius.com> wrote:
On Sep 12, 2023, at 11:31 PM, 平林 哲 <Satoshi.Hirabayashi@soliton.co.jp> wrote:
Summary of results.
You keep posting this. Why?
Doing that means you're stuck on one part of the problem. You should instead work towards understanding the problem, which is more likely to lead you to a solution.
I feel that this behaviour is not correct.
You're wrong. I explained why. Go back and read the messages.
Is there any way to correct this behaviour?
You have source code. You can fix it if you don't like the behavior.
We are not going to change the behavior of FreeRADIUS for everyone on the planet because you don't agree with 30+ year-old rules on string quoting and escaping.
Alan DeKok.
- List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html
Thank you g4-lisz for all the follow-up. It was very helpful. On 2023/09/13 22:09, g4-lisz@tonarchiv.ch wrote: > P.S. IMHO this behavior comes from getthing() in src/lib/token.c > > September 13, 2023 2:00 PM, g4-lisz@tonarchiv.ch wrote: > >> Alan, >> >> but he's right! The behavior is really not as one would expect. At least different from a shell and >> C: >> >> "some\word" in config => some\word >> "some\\word" in config => some\\word >> >> "some\\\"word" in config => some\\"word (in a shell or C this would be the one) >> >> So how to escape some\"word? >> "some\\"word" in config => syntax error >> >> It only works with single quotes... >> >> Cheers >> >> September 13, 2023 1:35 PM, "Alan DeKok" <aland@deployingradius.com> wrote: >> >>> On Sep 12, 2023, at 11:31 PM, 平林 哲 <Satoshi.Hirabayashi@soliton.co.jp> wrote: >>> >>>> Summary of results. >>> >>> You keep posting this. Why? >>> >>> Doing that means you're stuck on one part of the problem. You should instead work towards >>> understanding the problem, which is more likely to lead you to a solution. >>> >>>> I feel that this behaviour is not correct. >>> >>> You're wrong. I explained why. Go back and read the messages. >>> >>>> Is there any way to correct this behaviour? >>> >>> You have source code. You can fix it if you don't like the behavior. >>> >>> We are not going to change the behavior of FreeRADIUS for everyone on the planet because you don't >>> agree with 30+ year-old rules on string quoting and escaping. >>> >>> Alan DeKok. >> >> - >> List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html > - > List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html
On Sep 13, 2023, at 8:00 AM, g4-lisz@tonarchiv.ch wrote:
but he's right! The behavior is really not as one would expect. At least different from a shell and C:
"some\word" in config => some\word "some\\word" in config => some\\word
As I posted earlier, I don't see that when I do the same tests. So either you're running a very old / buggy version, or something else is going on. Alan DeKok.
On 13.09.23 16:06, Alan DeKok wrote:
On Sep 13, 2023, at 8:00 AM, g4-lisz@tonarchiv.ch wrote:
but he's right! The behavior is really not as one would expect. At least different from a shell and C:
"some\word" in config => some\word "some\\word" in config => some\\word
As I posted earlier, I don't see that when I do the same tests.
So either you're running a very old / buggy version, or something else is going on.
I can confirm this on AlmaLinux 9.2, latest updates, running freeradius-3.2.3-1.el9.x86_64 from the official repo. I change the password in mods-available/ldap: password = "some\\\"word" which should match the password some\"word I start tcpdump to capture the packets between the test machine and the ldap server. When I start radiusd it fails, which is correct, because I didn't change the password of my ldap server. Checking the capture with wireshark I can see the following password authentication: simple (0) simple: some\\"word hex dump: 0000 73 6f 6d 65 5c 5c 22 77 6f 72 64 So there are really two backslashes followed by the ". Now, of course, the question is how the ldap server interprets this text. It's my understanding, the LDAPv3 RFC4511 says it's utf-8 and if I am not mistaken, "\\" does not bear any special meaning, so it should really be interpreted as password some\\"word I don't have AD, thus I didn't test further... -Gerald
September 13, 2023 4:06 PM, "Alan DeKok" <aland@deployingradius.com> wrote:
So either you're running a very old / buggy version, or something else is going on.
Freshly compiled from master. Now I get this: In module config: "some\\\"word" => output "some\\\\\\"word" Now I have to admit that I didn't test this with the ldap module. But this is the value that gets logged in radius.log for config string parameters when using backslashes inside double quotes.
config: ldap { ... password = "some\\\"word" } V3.2.x (from Git today): Wed Sep 13 17:58:36 2023 : Debug: Loaded rlm_ldap, checking if it's valid Wed Sep 13 17:58:36 2023 : Debug: # Loaded module rlm_ldap Wed Sep 13 17:58:36 2023 : Debug: # Loading module "ldap" from file /opt/cpr_V3/etc/raddb/mods-enabled/ldap Wed Sep 13 17:58:36 2023 : Debug: ldap { Wed Sep 13 17:58:36 2023 : Debug: server = "localhost" Wed Sep 13 17:58:36 2023 : Debug: password = "some\\"word" Wed Sep 13 17:58:36 2023 : Debug: sasl { Wed Sep 13 17:58:36 2023 : Debug: } master: Wed Sep 13 18:27:41 2023: Debug : Loaded module rlm_ldap Wed Sep 13 18:27:41 2023: Debug : ldap { Wed Sep 13 18:27:41 2023: Debug : server = 'localhost' Wed Sep 13 18:27:41 2023: Debug : password = "some\\\\\\"word" Wed Sep 13 18:27:41 2023: Debug : sasl { Wed Sep 13 18:27:41 2023: Debug : } On 13.09.23 17:28, g4-lisz@tonarchiv.ch wrote:
September 13, 2023 4:06 PM, "Alan DeKok" <aland@deployingradius.com> wrote:
So either you're running a very old / buggy version, or something else is going on.
Freshly compiled from master. Now I get this:
In module config: "some\\\"word" => output "some\\\\\\"word"
Now I have to admit that I didn't test this with the ldap module. But this is the value that gets logged in radius.log for config string parameters when using backslashes inside double quotes. - List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html
On Sep 13, 2023, at 12:30 PM, g4-lisz@tonarchiv.ch wrote:
config:
ldap { ... password = "some\\\"word" }
V3.2.x (from Git today):
Wed Sep 13 17:58:36 2023 : Debug: Loaded rlm_ldap, checking if it's valid Wed Sep 13 17:58:36 2023 : Debug: # Loaded module rlm_ldap Wed Sep 13 17:58:36 2023 : Debug: # Loading module "ldap" from file /opt/cpr_V3/etc/raddb/mods-enabled/ldap Wed Sep 13 17:58:36 2023 : Debug: ldap { Wed Sep 13 17:58:36 2023 : Debug: server = "localhost" Wed Sep 13 17:58:36 2023 : Debug: password = "some\\"word"
That's wrong.
master:
Wed Sep 13 18:27:41 2023: Debug : Loaded module rlm_ldap Wed Sep 13 18:27:41 2023: Debug : ldap { Wed Sep 13 18:27:41 2023: Debug : server = 'localhost' Wed Sep 13 18:27:41 2023: Debug : password = "some\\\\\\"word"
That's worse, I think. I'll take a look. My other tests showed the backslashes working as expected, so I'm not sure what's going on here. Alan DeKok.
Hi Alan thank your for your reply. Now I also did the test with TCP sniffing. Things look a bit different but still not as expected: ~> tcpdump -i lo -A port ldap | grep some Master: f.D$f.D$02...`-.....cn=admin,dc=example,dc=org..some\\\"word V3.2.x: f...f...01...`,.....cn=admin,dc=example,dc=org..some\\"word As it seems, logging adds one more level of escaping in V4 / master... Cheers Till September 13, 2023 7:12 PM, "Alan DeKok" <aland@deployingradius.com> wrote:
On Sep 13, 2023, at 12:30 PM, g4-lisz@tonarchiv.ch wrote:
config:
ldap { ... password = "some\\\"word" }
V3.2.x (from Git today):
Wed Sep 13 17:58:36 2023 : Debug: Loaded rlm_ldap, checking if it's valid Wed Sep 13 17:58:36 2023 : Debug: # Loaded module rlm_ldap Wed Sep 13 17:58:36 2023 : Debug: # Loading module "ldap" from file /opt/cpr_V3/etc/raddb/mods-enabled/ldap Wed Sep 13 17:58:36 2023 : Debug: ldap { Wed Sep 13 17:58:36 2023 : Debug: server = "localhost" Wed Sep 13 17:58:36 2023 : Debug: password = "some\\"word"
That's wrong.
master:
Wed Sep 13 18:27:41 2023: Debug : Loaded module rlm_ldap Wed Sep 13 18:27:41 2023: Debug : ldap { Wed Sep 13 18:27:41 2023: Debug : server = 'localhost' Wed Sep 13 18:27:41 2023: Debug : password = "some\\\\\\"word"
That's worse, I think.
I'll take a look.
My other tests showed the backslashes working as expected, so I'm not sure what's going on here.
Alan DeKok.
- List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html
I've pushed a fix to v3.2.x. Please test https://github.com/FreeRADIUS/freeradius-server/commit/0c6d48394867e2d26709e... Alan DeKok.
September 14, 2023 1:40 PM, "Alan DeKok" <aland@deployingradius.com> wrote:
I've pushed a fix to v3.2.x. Please test
https://github.com/FreeRADIUS/freeradius-server/commit/0c6d48394867e2d26709e...
Alan DeKok.
I can confirm that it works now as expected: config: password = "some\"word" ==> some"word config: password = "some\\\"word" ==> some\"word config: password = "some\\\\\"word" ==> some\\"word Thank your very much! Till
On 2023/09/14 20:40, Alan DeKok wrote:
I've pushed a fix to v3.2.x. Please test
https://github.com/FreeRADIUS/freeradius-server/commit/0c6d48394867e2d26709e...
Alan DeKok.
Alan, thank you very match. We have confirmed that it works correctly. Sorry the report was not accurate.
participants (4)
-
Alan DeKok -
g4-lisz＠tonarchiv.ch -
Gerald Vogt -
平林 哲