Hi, I use freeradius 2.0.2, and people can use either ttls or peap as they want (or can). I'd want to know if it's possible to see what EAP method are using users through radius logs... Thanks in advance -- -- Open Kairos http://www.openkairos.com Watch More TV http://sebelk.blogspot.com Sergio Belkin -
You can log EAP-Type attribute with rlm_perl. Ivan Kalik Kalik Informatika ISP Dana 24/6/2008, "Sergio Belkin" <sebelk@gmail.com> piše:
Hi,
I use freeradius 2.0.2, and people can use either ttls or peap as they want (or can). I'd want to know if it's possible to see what EAP method are using users through radius logs...
Thanks in advance
-- -- Open Kairos http://www.openkairos.com Watch More TV http://sebelk.blogspot.com Sergio Belkin - - List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html
I have no idea about how to use rlm_perl, would you recommend me some documentation or usage example? Thanks in advance! 2008/6/24 Ivan Kalik <tnt@kalik.net>:
You can log EAP-Type attribute with rlm_perl.
Ivan Kalik Kalik Informatika ISP
Dana 24/6/2008, "Sergio Belkin" <sebelk@gmail.com> piše:
Hi,
I use freeradius 2.0.2, and people can use either ttls or peap as they want (or can). I'd want to know if it's possible to see what EAP method are using users through radius logs...
Thanks in advance
-- -- Open Kairos http://www.openkairos.com Watch More TV http://sebelk.blogspot.com Sergio Belkin - - List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html
- List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html
-- -- Open Kairos http://www.openkairos.com Watch More TV http://sebelk.blogspot.com Sergio Belkin -
2008/6/24 Sergio Belkin <sebelk@gmail.com>:
I have no idea about how to use rlm_perl, would you recommend me some documentation or usage example?
Thanks in advance!
2008/6/24 Ivan Kalik <tnt@kalik.net>:
You can log EAP-Type attribute with rlm_perl.
Ivan Kalik Kalik Informatika ISP
Dana 24/6/2008, "Sergio Belkin" <sebelk@gmail.com> piše:
Hi,
I use freeradius 2.0.2, and people can use either ttls or peap as they want (or can). I'd want to know if it's possible to see what EAP method are using users through radius logs...
Thanks in advance
-- -- Open Kairos http://www.openkairos.com Watch More TV http://sebelk.blogspot.com Sergio Belkin - - List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html
- List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html
-- -- Open Kairos http://www.openkairos.com Watch More TV http://sebelk.blogspot.com Sergio Belkin -
-- -- Open Kairos http://www.openkairos.com Watch More TV http://sebelk.blogspot.com Sergio Belkin -
You can find information about rlm_perl using Google, wiki on freeradius website or file search on the computer where freeradius is installed. Ivan Kalik Kalik Informatika ISP Dana 24/6/2008, "Sergio Belkin" <sebelk@gmail.com> piše:
I have no idea about how to use rlm_perl, would you recommend me some documentation or usage example?
Thanks in advance!
2008/6/24 Ivan Kalik <tnt@kalik.net>:
You can log EAP-Type attribute with rlm_perl.
Ivan Kalik Kalik Informatika ISP
Dana 24/6/2008, "Sergio Belkin" <sebelk@gmail.com> piše:
Hi,
I use freeradius 2.0.2, and people can use either ttls or peap as they want (or can). I'd want to know if it's possible to see what EAP method are using users through radius logs...
Thanks in advance
-- -- Open Kairos http://www.openkairos.com Watch More TV http://sebelk.blogspot.com Sergio Belkin - - List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html
- List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html
-- -- Open Kairos http://www.openkairos.com Watch More TV http://sebelk.blogspot.com Sergio Belkin -
- List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html
Sergio Belkin wrote:
I use freeradius 2.0.2, and people can use either ttls or peap as they want (or can). I'd want to know if it's possible to see what EAP method are using users through radius logs...
The EAP type is available in the EAP-Type attribute. You can use it just like anything else: %{EAP-Type} ... Alan DeKok.
2008/6/25 Alan DeKok <aland@deployingradius.com>:
Sergio Belkin wrote:
I use freeradius 2.0.2, and people can use either ttls or peap as they want (or can). I'd want to know if it's possible to see what EAP method are using users through radius logs...
The EAP type is available in the EAP-Type attribute. You can use it just like anything else: %{EAP-Type} ...
Alan, Do I need to use rlm_perl anyway?
Alan DeKok. - List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html
-- -- Open Kairos http://www.openkairos.com Watch More TV http://sebelk.blogspot.com Sergio Belkin -
2008/6/26 Alan DeKok <aland@deployingradius.com>:
Sergio Belkin wrote:
Alan, Do I need to use rlm_perl anyway?
No. The EAP-Type attribute is added by the EAP module. Once the attribute is there, it can be used, edited, updated, etc. just like User-Name, or NAS-IP-Address.
Alan DeKok.
I edited so radiusd.conf: detailfile = ${radacctdir}/%{Client-IP-Address}/auth-detail-%Y%m%d%{EAP-Type} and added "EAP-Message =* ANY" to attrs file, but I see no difference (any file witt a new name wasn't created) What am I doing wrong? -- -- Open Kairos http://www.openkairos.com Watch More TV http://sebelk.blogspot.com Sergio Belkin -
Sergio Belkin wrote:
I edited so radiusd.conf:
detailfile = ${radacctdir}/%{Client-IP-Address}/auth-detail-%Y%m%d%{EAP-Type}
and added "EAP-Message =* ANY" to attrs file, but I see no difference (any file witt a new name wasn't created)
What am I doing wrong?
You are running auth_log BEFORE eap? Alan DeKok.
2008/6/26 Alan DeKok <aland@deployingradius.com>:
Sergio Belkin wrote:
I edited so radiusd.conf:
detailfile = ${radacctdir}/%{Client-IP-Address}/auth-detail-%Y%m%d%{EAP-Type}
and added "EAP-Message =* ANY" to attrs file, but I see no difference (any file witt a new name wasn't created)
What am I doing wrong?
You are running auth_log BEFORE eap?
Alan DeKok.
I have the following in sites-enabled/default : authorize { preprocess auth_log chap mschap suffix eap { ok = return } unix files ldap expiration logintime pap } -- -- Open Kairos http://www.openkairos.com Watch More TV http://sebelk.blogspot.com Sergio Belkin -
Sergio Belkin wrote:
What am I doing wrong? You are running auth_log BEFORE eap?
Alan DeKok. I have the following in sites-enabled/default :
Which has auth_log BEFORE eap, which is WRONG. How do you expect to log the EAP type when the EAP module hasn't been run yet? Alan DeKok.
2008/6/26 Alan DeKok <aland@deployingradius.com>:
Sergio Belkin wrote:
What am I doing wrong? You are running auth_log BEFORE eap?
Alan DeKok. I have the following in sites-enabled/default :
Which has auth_log BEFORE eap, which is WRONG.
How do you expect to log the EAP type when the EAP module hasn't been run yet?
Alan DeKok. -
OK, but this the *default* order in the file I didn't know that order matters in this case. I've changed order and this the debug output: FreeRADIUS Version 2.0.2, for host x86_64-unknown-linux-gnu, built on Mar 5 2008 at 16:09:30 Copyright (C) 1999-2008 The FreeRADIUS server project and contributors. There is NO warranty; not even for MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. You may redistribute copies of FreeRADIUS under the terms of the GNU General Public License. Starting - reading configuration files ... including configuration file /etc/raddb/radiusd.conf including configuration file /etc/raddb/proxy.conf including configuration file /etc/raddb/clients.conf including configuration file /etc/raddb/snmp.conf including configuration file /etc/raddb/eap.conf including configuration file /etc/raddb/sql.conf including configuration file /etc/raddb/sql/mysql/dialup.conf including configuration file /etc/raddb/sql/mysql/counter.conf including configuration file /etc/raddb/policy.conf including files in directory /etc/raddb/sites-enabled/ including configuration file /etc/raddb/sites-enabled/default including dictionary file /etc/raddb/dictionary main { prefix = "/usr" localstatedir = "/var" logdir = "/var/log/radius" libdir = "/usr/lib" radacctdir = "/var/log/radius/radacct" hostname_lookups = no max_request_time = 30 cleanup_delay = 5 max_requests = 1024 allow_core_dumps = no pidfile = "/var/run/radiusd/radiusd.pid" user = "radiusd" group = "radiusd" checkrad = "/usr/sbin/checkrad" debug_level = 0 proxy_requests = no security { max_attributes = 200 reject_delay = 1 status_server = yes } } client localhost { ipaddr = 127.0.0.1 require_message_authenticator = no secret = "testing123" nastype = "other" } client 10.30.0.101 { require_message_authenticator = no secret = "stopnene-Green-22" shortname = "oficina" } client 10.128.255.100 { require_message_authenticator = no secret = "stopnene-Red-3" shortname = "DOWNI-PB" } client 10.128.255.10 { require_message_authenticator = no secret = "stopnene-Red-3" shortname = "DOWNI-SS" } client 10.128.255.11 { require_message_authenticator = no secret = "stopnene-Red-3" shortname = "DOWNI-1" } client 10.128.255.12 { require_message_authenticator = no secret = "stopnene-Red-3" shortname = "DOWNI-2" } client 10.128.255.13 { require_message_authenticator = no secret = "stopnene-Red-3" shortname = "DOWNI-3" } client 10.128.255.14 { require_message_authenticator = no secret = "stopnene-Red-3" shortname = "DOWNI-4" } client 10.128.255.15 { require_message_authenticator = no secret = "stopnene-Red-3" shortname = "DOWNI-5" } client 10.128.255.16 { require_message_authenticator = no secret = "stopnene-Red-3" shortname = "DOWNI-6" } client 10.128.255.17 { require_message_authenticator = no secret = "stopnene-Red-3" shortname = "DOWNI-7" } client 10.128.255.80 { require_message_authenticator = no secret = "stopnene-Red-398952" shortname = "DOWNVIII-PB" } client 10.128.255.81 { require_message_authenticator = no secret = "stopnene-Red-398952" shortname = "DOWNVIII-I" } client 10.128.255.82 { require_message_authenticator = no secret = "stopnene-Red-398952" shortname = "DOWNVIII-II" } client 10.128.255.83 { require_message_authenticator = no secret = "stopnene-Red-398952" shortname = "DOWNVIII-III" } client 10.128.255.84 { require_message_authenticator = no secret = "stopnene-Red-398952" shortname = "DOWNVIII-IV" } client 10.128.255.85 { require_message_authenticator = no secret = "stopnene-Red-398952" shortname = "DOWNVIII-V" } client 10.128.255.86 { require_message_authenticator = no secret = "stopnene-Red-398952" shortname = "10.128.255.86" } client 10.128.255.87 { require_message_authenticator = no secret = "stopnene-Red-398952" } client 201.231.128.53 { require_message_authenticator = no secret = "stopnene-Green-22" shortname = "Pa" } client 200.123.132.1 { require_message_authenticator = no secret = "stopnene-black-54" shortname = "Ma" } client 201.216.227.201 { require_message_authenticator = no secret = "stopnene-blue-246692" shortname = "Che" } radiusd: #### Loading Realms and Home Servers #### proxy server { retry_delay = 5 retry_count = 3 default_fallback = no dead_time = 120 wake_all_if_all_dead = no } home_server localhost { ipaddr = 127.0.0.1 port = 1812 type = "auth" secret = "testing123" response_window = 20 max_outstanding = 65536 zombie_period = 40 status_check = "status-server" ping_check = "none" ping_interval = 30 check_interval = 30 num_answers_to_alive = 3 num_pings_to_alive = 3 revive_interval = 120 status_check_timeout = 4 } home_server_pool my_auth_failover { type = fail-over home_server = localhost } realm example.com { auth_pool = my_auth_failover } realm LOCAL { } radiusd: #### Instantiating modules #### instantiate { Module: Linked to module rlm_exec Module: Instantiating exec exec { wait = yes input_pairs = "request" shell_escape = yes } Module: Linked to module rlm_expr Module: Instantiating expr Module: Linked to module rlm_expiration Module: Instantiating expiration expiration { reply-message = "Password Has Expired " } Module: Linked to module rlm_logintime Module: Instantiating logintime logintime { reply-message = "You are calling outside your allowed timespan " minimum-timeout = 60 } } radiusd: #### Loading Virtual Servers #### server { modules { Module: Checking authenticate {...} for more modules to load Module: Linked to module rlm_pap Module: Instantiating pap pap { encryption_scheme = "auto" auto_header = yes } Module: Linked to module rlm_chap Module: Instantiating chap Module: Linked to module rlm_mschap Module: Instantiating mschap mschap { use_mppe = yes require_encryption = no require_strong = no with_ntdomain_hack = no } Module: Linked to module rlm_unix Module: Instantiating unix unix { radwtmp = "/var/log/radius/radwtmp" } Module: Linked to module rlm_ldap Module: Instantiating ldap ldap { server = "ldap.cadorna.edu" port = 636 password = "soyouwanttocrackgetitaway" identity = "cn=freeradius,ou=applications,dc=cadorna,dc=edu" net_timeout = 1 timeout = 4 timelimit = 3 tls_mode = no start_tls = no tls_require_cert = "allow" tls { start_tls = no cacertfile = "/etc/raddb/cacert.pem" randfile = "/dev/urandom" require_cert = "allow" } basedn = "ou=people,dc=cadorna,dc=edu" filter = "(uid=%{Stripped-User-Name:-%{User-Name}})" base_filter = "(objectclass=radiusprofile)" auto_header = no access_attr = "radiusAllowed" access_attr_used_for_allow = yes groupname_attribute = "cn" groupmembership_filter = "(|(&(objectClass=GroupOfNames)(member=%{Ldap-UserDn}))(&(objectClass=GroupOfUniqueNames)(uniquemember=%{Ldap-UserDn})))" dictionary_mapping = "/etc/raddb/ldap.attrmap" ldap_debug = 0 ldap_connections_number = 5 compare_check_items = no do_xlat = yes set_auth_type = yes } rlm_ldap: Registering ldap_groupcmp for Ldap-Group rlm_ldap: Registering ldap_xlat with xlat_name ldap rlm_ldap: reading ldap<->radius mappings from file /etc/raddb/ldap.attrmap rlm_ldap: LDAP radiusCheckItem mapped to RADIUS $GENERIC$ rlm_ldap: LDAP radiusReplyItem mapped to RADIUS $GENERIC$ rlm_ldap: LDAP radiusPassword mapped to RADIUS Cleartext-Password rlm_ldap: LDAP radiusAuthType mapped to RADIUS Auth-Type rlm_ldap: LDAP radiusSimultaneousUse mapped to RADIUS Simultaneous-Use rlm_ldap: LDAP radiusCalledStationId mapped to RADIUS Called-Station-Id rlm_ldap: LDAP radiusCallingStationId mapped to RADIUS Calling-Station-Id rlm_ldap: LDAP lmPassword mapped to RADIUS LM-Password rlm_ldap: LDAP ntPassword mapped to RADIUS NT-Password rlm_ldap: LDAP sambaLmPassword mapped to RADIUS LM-Password rlm_ldap: LDAP sambaNtPassword mapped to RADIUS NT-Password rlm_ldap: LDAP acctFlags mapped to RADIUS SMB-Account-CTRL-TEXT rlm_ldap: LDAP radiusExpiration mapped to RADIUS Expiration rlm_ldap: LDAP radiusNASIpAddress mapped to RADIUS NAS-IP-Address rlm_ldap: LDAP radiusServiceType mapped to RADIUS Service-Type rlm_ldap: LDAP radiusFramedProtocol mapped to RADIUS Framed-Protocol rlm_ldap: LDAP radiusFramedIPAddress mapped to RADIUS Framed-IP-Address rlm_ldap: LDAP radiusFramedIPNetmask mapped to RADIUS Framed-IP-Netmask rlm_ldap: LDAP radiusFramedRoute mapped to RADIUS Framed-Route rlm_ldap: LDAP radiusFramedRouting mapped to RADIUS Framed-Routing rlm_ldap: LDAP radiusFilterId mapped to RADIUS Filter-Id rlm_ldap: LDAP radiusFramedMTU mapped to RADIUS Framed-MTU rlm_ldap: LDAP radiusFramedCompression mapped to RADIUS Framed-Compression rlm_ldap: LDAP radiusLoginIPHost mapped to RADIUS Login-IP-Host rlm_ldap: LDAP radiusLoginService mapped to RADIUS Login-Service rlm_ldap: LDAP radiusLoginTCPPort mapped to RADIUS Login-TCP-Port rlm_ldap: LDAP radiusCallbackNumber mapped to RADIUS Callback-Number rlm_ldap: LDAP radiusCallbackId mapped to RADIUS Callback-Id rlm_ldap: LDAP radiusFramedIPXNetwork mapped to RADIUS Framed-IPX-Network rlm_ldap: LDAP radiusClass mapped to RADIUS Class rlm_ldap: LDAP radiusSessionTimeout mapped to RADIUS Session-Timeout rlm_ldap: LDAP radiusIdleTimeout mapped to RADIUS Idle-Timeout rlm_ldap: LDAP radiusTerminationAction mapped to RADIUS Termination-Action rlm_ldap: LDAP radiusLoginLATService mapped to RADIUS Login-LAT-Service rlm_ldap: LDAP radiusLoginLATNode mapped to RADIUS Login-LAT-Node rlm_ldap: LDAP radiusLoginLATGroup mapped to RADIUS Login-LAT-Group rlm_ldap: LDAP radiusFramedAppleTalkLink mapped to RADIUS Framed-AppleTalk-Link rlm_ldap: LDAP radiusFramedAppleTalkNetwork mapped to RADIUS Framed-AppleTalk-Network rlm_ldap: LDAP radiusFramedAppleTalkZone mapped to RADIUS Framed-AppleTalk-Zone rlm_ldap: LDAP radiusPortLimit mapped to RADIUS Port-Limit rlm_ldap: LDAP radiusLoginLATPort mapped to RADIUS Login-LAT-Port rlm_ldap: LDAP radiusReplyMessage mapped to RADIUS Reply-Message conns: 0xcffb0a0 Module: Linked to module rlm_eap Module: Instantiating eap eap { default_eap_type = "ttls" timer_expire = 60 ignore_unknown_eap_types = no cisco_accounting_username_bug = no } Module: Linked to sub-module rlm_eap_md5 Module: Instantiating eap-md5 Module: Linked to sub-module rlm_eap_leap Module: Instantiating eap-leap Module: Linked to sub-module rlm_eap_gtc Module: Instantiating eap-gtc gtc { challenge = "Password: " auth_type = "PAP" } Module: Linked to sub-module rlm_eap_tls Module: Instantiating eap-tls tls { rsa_key_exchange = no dh_key_exchange = yes rsa_key_length = 512 dh_key_length = 512 verify_depth = 0 pem_file_type = yes private_key_file = "/etc/pki/tls/certs/ips-spectrum-key.pem" certificate_file = "/etc/pki/tls/certs/ips-spectrum-crt.pem" CA_file = "/etc/pki/tls/certs/ips-ca-bundle.crt" dh_file = "/etc/raddb/certs/dh" random_file = "/etc/raddb/certs/random" fragment_size = 1024 include_length = yes check_crl = no cipher_list = "DEFAULT" } Module: Linked to sub-module rlm_eap_ttls Module: Instantiating eap-ttls ttls { default_eap_type = "md5" copy_request_to_tunnel = no use_tunneled_reply = no } Module: Linked to sub-module rlm_eap_peap Module: Instantiating eap-peap peap { default_eap_type = "mschapv2" copy_request_to_tunnel = no use_tunneled_reply = no proxy_tunneled_request_as_eap = yes } Module: Linked to sub-module rlm_eap_mschapv2 Module: Instantiating eap-mschapv2 mschapv2 { with_ntdomain_hack = no } Module: Checking authorize {...} for more modules to load Module: Linked to module rlm_preprocess Module: Instantiating preprocess preprocess { huntgroups = "/etc/raddb/huntgroups" hints = "/etc/raddb/hints" with_ascend_hack = no ascend_channels_per_line = 23 with_ntdomain_hack = no with_specialix_jetstream_hack = no with_cisco_vsa_hack = no with_alvarion_vsa_hack = no } Module: Linked to module rlm_detail Module: Instantiating auth_log detail auth_log { detailfile = "/var/log/radius/radacct/%{Client-IP-Address}/auth-detail-%Y%m%d%{EAP-Type}" header = "%t" detailperm = 384 dirperm = 493 locking = no log_packet_header = no } Module: Linked to module rlm_realm Module: Instantiating suffix realm suffix { format = "suffix" delimiter = "@" ignore_default = no ignore_null = no } Module: Linked to module rlm_files Module: Instantiating files files { usersfile = "/etc/raddb/users" acctusersfile = "/etc/raddb/acct_users" preproxy_usersfile = "/etc/raddb/preproxy_users" compat = "no" } Module: Checking preacct {...} for more modules to load Module: Linked to module rlm_acct_unique Module: Instantiating acct_unique acct_unique { key = "User-Name, Acct-Session-Id, NAS-IP-Address, Client-IP-Address, NAS-Port" } Module: Checking accounting {...} for more modules to load Module: Instantiating detail detail { detailfile = "/var/log/radius/radacct/%{Client-IP-Address}/detail-%Y%m%d" header = "%t" detailperm = 384 dirperm = 493 locking = no log_packet_header = no } Module: Linked to module rlm_radutmp Module: Instantiating radutmp radutmp { filename = "/var/log/radius/radutmp" username = "%{User-Name}" case_sensitive = yes check_with_nas = yes perm = 384 callerid = yes } Module: Linked to module rlm_attr_filter Module: Instantiating attr_filter.accounting_response attr_filter attr_filter.accounting_response { attrsfile = "/etc/raddb/attrs.accounting_response" key = "%{User-Name}" } Module: Checking session {...} for more modules to load Module: Checking post-proxy {...} for more modules to load Module: Checking post-auth {...} for more modules to load Module: Instantiating attr_filter.access_reject attr_filter attr_filter.access_reject { attrsfile = "/etc/raddb/attrs.access_reject" key = "%{User-Name}" } } } radiusd: #### Opening IP addresses and Ports #### listen { type = "auth" ipaddr = 10.96.213.5 port = 0 } listen { type = "acct" ipaddr = 10.96.213.5 port = 0 } Listening on authentication address 10.96.213.5 port 1812 Listening on accounting address 10.96.213.5 port 1813 Ready to process requests. -- -- Open Kairos http://www.openkairos.com Watch More TV http://sebelk.blogspot.com Sergio Belkin -
Please, any idea? Still I have log filenames such as: auth-detail-20080630 and say nothing about eap method and contains something like: Mon Jun 30 08:32:26 2008 Packet-Type = Access-Request User-Name = "anonymous" NAS-IP-Address = 10.128.255.84 Called-Station-Id = "001d7edc23a2" Calling-Station-Id = "001b773a9ab2" NAS-Identifier = "001d7edc23a2" NAS-Port = 18 Framed-MTU = 1400 NAS-Port-Type = Wireless-802.11 EAP-Message = 0x0200000e01616e6f6e796d6f7573 Message-Authenticator = 0x9919cd335c2d96b125469208dd722a9d .... Thanks in advance 2008/6/26 Sergio Belkin <sebelk@gmail.com>:
2008/6/26 Alan DeKok <aland@deployingradius.com>:
Sergio Belkin wrote:
What am I doing wrong? You are running auth_log BEFORE eap?
Alan DeKok. I have the following in sites-enabled/default :
Which has auth_log BEFORE eap, which is WRONG.
How do you expect to log the EAP type when the EAP module hasn't been run yet?
Alan DeKok. -
OK, but this the *default* order in the file I didn't know that order matters in this case.
I've changed order and this the debug output:
FreeRADIUS Version 2.0.2, for host x86_64-unknown-linux-gnu, built on Mar 5 2008 at 16:09:30 Copyright (C) 1999-2008 The FreeRADIUS server project and contributors. There is NO warranty; not even for MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. You may redistribute copies of FreeRADIUS under the terms of the GNU General Public License. Starting - reading configuration files ... including configuration file /etc/raddb/radiusd.conf including configuration file /etc/raddb/proxy.conf including configuration file /etc/raddb/clients.conf including configuration file /etc/raddb/snmp.conf including configuration file /etc/raddb/eap.conf including configuration file /etc/raddb/sql.conf including configuration file /etc/raddb/sql/mysql/dialup.conf including configuration file /etc/raddb/sql/mysql/counter.conf including configuration file /etc/raddb/policy.conf including files in directory /etc/raddb/sites-enabled/ including configuration file /etc/raddb/sites-enabled/default including dictionary file /etc/raddb/dictionary main { prefix = "/usr" localstatedir = "/var" logdir = "/var/log/radius" libdir = "/usr/lib" radacctdir = "/var/log/radius/radacct" hostname_lookups = no max_request_time = 30 cleanup_delay = 5 max_requests = 1024 allow_core_dumps = no pidfile = "/var/run/radiusd/radiusd.pid" user = "radiusd" group = "radiusd" checkrad = "/usr/sbin/checkrad" debug_level = 0 proxy_requests = no security { max_attributes = 200 reject_delay = 1 status_server = yes } } client localhost { ipaddr = 127.0.0.1 require_message_authenticator = no secret = "testing123" nastype = "other" } client 10.30.0.101 { require_message_authenticator = no secret = "stopnene-Green-22" shortname = "oficina" } client 10.128.255.100 { require_message_authenticator = no secret = "stopnene-Red-3" shortname = "DOWNI-PB" } client 10.128.255.10 { require_message_authenticator = no secret = "stopnene-Red-3" shortname = "DOWNI-SS" } client 10.128.255.11 { require_message_authenticator = no secret = "stopnene-Red-3" shortname = "DOWNI-1" } client 10.128.255.12 { require_message_authenticator = no secret = "stopnene-Red-3" shortname = "DOWNI-2" } client 10.128.255.13 { require_message_authenticator = no secret = "stopnene-Red-3" shortname = "DOWNI-3" } client 10.128.255.14 { require_message_authenticator = no secret = "stopnene-Red-3" shortname = "DOWNI-4" } client 10.128.255.15 { require_message_authenticator = no secret = "stopnene-Red-3" shortname = "DOWNI-5" } client 10.128.255.16 { require_message_authenticator = no secret = "stopnene-Red-3" shortname = "DOWNI-6" } client 10.128.255.17 { require_message_authenticator = no secret = "stopnene-Red-3" shortname = "DOWNI-7" } client 10.128.255.80 { require_message_authenticator = no secret = "stopnene-Red-398952" shortname = "DOWNVIII-PB" } client 10.128.255.81 { require_message_authenticator = no secret = "stopnene-Red-398952" shortname = "DOWNVIII-I" } client 10.128.255.82 { require_message_authenticator = no secret = "stopnene-Red-398952" shortname = "DOWNVIII-II" } client 10.128.255.83 { require_message_authenticator = no secret = "stopnene-Red-398952" shortname = "DOWNVIII-III" } client 10.128.255.84 { require_message_authenticator = no secret = "stopnene-Red-398952" shortname = "DOWNVIII-IV" } client 10.128.255.85 { require_message_authenticator = no secret = "stopnene-Red-398952" shortname = "DOWNVIII-V" } client 10.128.255.86 { require_message_authenticator = no secret = "stopnene-Red-398952" shortname = "10.128.255.86" } client 10.128.255.87 { require_message_authenticator = no secret = "stopnene-Red-398952" } client 201.231.128.53 { require_message_authenticator = no secret = "stopnene-Green-22" shortname = "Pa" } client 200.123.132.1 { require_message_authenticator = no secret = "stopnene-black-54" shortname = "Ma" } client 201.216.227.201 { require_message_authenticator = no secret = "stopnene-blue-246692" shortname = "Che" } radiusd: #### Loading Realms and Home Servers #### proxy server { retry_delay = 5 retry_count = 3 default_fallback = no dead_time = 120 wake_all_if_all_dead = no } home_server localhost { ipaddr = 127.0.0.1 port = 1812 type = "auth" secret = "testing123" response_window = 20 max_outstanding = 65536 zombie_period = 40 status_check = "status-server" ping_check = "none" ping_interval = 30 check_interval = 30 num_answers_to_alive = 3 num_pings_to_alive = 3 revive_interval = 120 status_check_timeout = 4 } home_server_pool my_auth_failover { type = fail-over home_server = localhost } realm example.com { auth_pool = my_auth_failover } realm LOCAL { } radiusd: #### Instantiating modules #### instantiate { Module: Linked to module rlm_exec Module: Instantiating exec exec { wait = yes input_pairs = "request" shell_escape = yes } Module: Linked to module rlm_expr Module: Instantiating expr Module: Linked to module rlm_expiration Module: Instantiating expiration expiration { reply-message = "Password Has Expired " } Module: Linked to module rlm_logintime Module: Instantiating logintime logintime { reply-message = "You are calling outside your allowed timespan " minimum-timeout = 60 } } radiusd: #### Loading Virtual Servers #### server { modules { Module: Checking authenticate {...} for more modules to load Module: Linked to module rlm_pap Module: Instantiating pap pap { encryption_scheme = "auto" auto_header = yes } Module: Linked to module rlm_chap Module: Instantiating chap Module: Linked to module rlm_mschap Module: Instantiating mschap mschap { use_mppe = yes require_encryption = no require_strong = no with_ntdomain_hack = no } Module: Linked to module rlm_unix Module: Instantiating unix unix { radwtmp = "/var/log/radius/radwtmp" } Module: Linked to module rlm_ldap Module: Instantiating ldap ldap { server = "ldap.cadorna.edu" port = 636 password = "soyouwanttocrackgetitaway" identity = "cn=freeradius,ou=applications,dc=cadorna,dc=edu" net_timeout = 1 timeout = 4 timelimit = 3 tls_mode = no start_tls = no tls_require_cert = "allow" tls { start_tls = no cacertfile = "/etc/raddb/cacert.pem" randfile = "/dev/urandom" require_cert = "allow" } basedn = "ou=people,dc=cadorna,dc=edu" filter = "(uid=%{Stripped-User-Name:-%{User-Name}})" base_filter = "(objectclass=radiusprofile)" auto_header = no access_attr = "radiusAllowed" access_attr_used_for_allow = yes groupname_attribute = "cn" groupmembership_filter = "(|(&(objectClass=GroupOfNames)(member=%{Ldap-UserDn}))(&(objectClass=GroupOfUniqueNames)(uniquemember=%{Ldap-UserDn})))" dictionary_mapping = "/etc/raddb/ldap.attrmap" ldap_debug = 0 ldap_connections_number = 5 compare_check_items = no do_xlat = yes set_auth_type = yes } rlm_ldap: Registering ldap_groupcmp for Ldap-Group rlm_ldap: Registering ldap_xlat with xlat_name ldap rlm_ldap: reading ldap<->radius mappings from file /etc/raddb/ldap.attrmap rlm_ldap: LDAP radiusCheckItem mapped to RADIUS $GENERIC$ rlm_ldap: LDAP radiusReplyItem mapped to RADIUS $GENERIC$ rlm_ldap: LDAP radiusPassword mapped to RADIUS Cleartext-Password rlm_ldap: LDAP radiusAuthType mapped to RADIUS Auth-Type rlm_ldap: LDAP radiusSimultaneousUse mapped to RADIUS Simultaneous-Use rlm_ldap: LDAP radiusCalledStationId mapped to RADIUS Called-Station-Id rlm_ldap: LDAP radiusCallingStationId mapped to RADIUS Calling-Station-Id rlm_ldap: LDAP lmPassword mapped to RADIUS LM-Password rlm_ldap: LDAP ntPassword mapped to RADIUS NT-Password rlm_ldap: LDAP sambaLmPassword mapped to RADIUS LM-Password rlm_ldap: LDAP sambaNtPassword mapped to RADIUS NT-Password rlm_ldap: LDAP acctFlags mapped to RADIUS SMB-Account-CTRL-TEXT rlm_ldap: LDAP radiusExpiration mapped to RADIUS Expiration rlm_ldap: LDAP radiusNASIpAddress mapped to RADIUS NAS-IP-Address rlm_ldap: LDAP radiusServiceType mapped to RADIUS Service-Type rlm_ldap: LDAP radiusFramedProtocol mapped to RADIUS Framed-Protocol rlm_ldap: LDAP radiusFramedIPAddress mapped to RADIUS Framed-IP-Address rlm_ldap: LDAP radiusFramedIPNetmask mapped to RADIUS Framed-IP-Netmask rlm_ldap: LDAP radiusFramedRoute mapped to RADIUS Framed-Route rlm_ldap: LDAP radiusFramedRouting mapped to RADIUS Framed-Routing rlm_ldap: LDAP radiusFilterId mapped to RADIUS Filter-Id rlm_ldap: LDAP radiusFramedMTU mapped to RADIUS Framed-MTU rlm_ldap: LDAP radiusFramedCompression mapped to RADIUS Framed-Compression rlm_ldap: LDAP radiusLoginIPHost mapped to RADIUS Login-IP-Host rlm_ldap: LDAP radiusLoginService mapped to RADIUS Login-Service rlm_ldap: LDAP radiusLoginTCPPort mapped to RADIUS Login-TCP-Port rlm_ldap: LDAP radiusCallbackNumber mapped to RADIUS Callback-Number rlm_ldap: LDAP radiusCallbackId mapped to RADIUS Callback-Id rlm_ldap: LDAP radiusFramedIPXNetwork mapped to RADIUS Framed-IPX-Network rlm_ldap: LDAP radiusClass mapped to RADIUS Class rlm_ldap: LDAP radiusSessionTimeout mapped to RADIUS Session-Timeout rlm_ldap: LDAP radiusIdleTimeout mapped to RADIUS Idle-Timeout rlm_ldap: LDAP radiusTerminationAction mapped to RADIUS Termination-Action rlm_ldap: LDAP radiusLoginLATService mapped to RADIUS Login-LAT-Service rlm_ldap: LDAP radiusLoginLATNode mapped to RADIUS Login-LAT-Node rlm_ldap: LDAP radiusLoginLATGroup mapped to RADIUS Login-LAT-Group rlm_ldap: LDAP radiusFramedAppleTalkLink mapped to RADIUS Framed-AppleTalk-Link rlm_ldap: LDAP radiusFramedAppleTalkNetwork mapped to RADIUS Framed-AppleTalk-Network rlm_ldap: LDAP radiusFramedAppleTalkZone mapped to RADIUS Framed-AppleTalk-Zone rlm_ldap: LDAP radiusPortLimit mapped to RADIUS Port-Limit rlm_ldap: LDAP radiusLoginLATPort mapped to RADIUS Login-LAT-Port rlm_ldap: LDAP radiusReplyMessage mapped to RADIUS Reply-Message conns: 0xcffb0a0 Module: Linked to module rlm_eap Module: Instantiating eap eap { default_eap_type = "ttls" timer_expire = 60 ignore_unknown_eap_types = no cisco_accounting_username_bug = no } Module: Linked to sub-module rlm_eap_md5 Module: Instantiating eap-md5 Module: Linked to sub-module rlm_eap_leap Module: Instantiating eap-leap Module: Linked to sub-module rlm_eap_gtc Module: Instantiating eap-gtc gtc { challenge = "Password: " auth_type = "PAP" } Module: Linked to sub-module rlm_eap_tls Module: Instantiating eap-tls tls { rsa_key_exchange = no dh_key_exchange = yes rsa_key_length = 512 dh_key_length = 512 verify_depth = 0 pem_file_type = yes private_key_file = "/etc/pki/tls/certs/ips-spectrum-key.pem" certificate_file = "/etc/pki/tls/certs/ips-spectrum-crt.pem" CA_file = "/etc/pki/tls/certs/ips-ca-bundle.crt" dh_file = "/etc/raddb/certs/dh" random_file = "/etc/raddb/certs/random" fragment_size = 1024 include_length = yes check_crl = no cipher_list = "DEFAULT" } Module: Linked to sub-module rlm_eap_ttls Module: Instantiating eap-ttls ttls { default_eap_type = "md5" copy_request_to_tunnel = no use_tunneled_reply = no } Module: Linked to sub-module rlm_eap_peap Module: Instantiating eap-peap peap { default_eap_type = "mschapv2" copy_request_to_tunnel = no use_tunneled_reply = no proxy_tunneled_request_as_eap = yes } Module: Linked to sub-module rlm_eap_mschapv2 Module: Instantiating eap-mschapv2 mschapv2 { with_ntdomain_hack = no } Module: Checking authorize {...} for more modules to load Module: Linked to module rlm_preprocess Module: Instantiating preprocess preprocess { huntgroups = "/etc/raddb/huntgroups" hints = "/etc/raddb/hints" with_ascend_hack = no ascend_channels_per_line = 23 with_ntdomain_hack = no with_specialix_jetstream_hack = no with_cisco_vsa_hack = no with_alvarion_vsa_hack = no } Module: Linked to module rlm_detail Module: Instantiating auth_log detail auth_log { detailfile = "/var/log/radius/radacct/%{Client-IP-Address}/auth-detail-%Y%m%d%{EAP-Type}" header = "%t" detailperm = 384 dirperm = 493 locking = no log_packet_header = no } Module: Linked to module rlm_realm Module: Instantiating suffix realm suffix { format = "suffix" delimiter = "@" ignore_default = no ignore_null = no } Module: Linked to module rlm_files Module: Instantiating files files { usersfile = "/etc/raddb/users" acctusersfile = "/etc/raddb/acct_users" preproxy_usersfile = "/etc/raddb/preproxy_users" compat = "no" } Module: Checking preacct {...} for more modules to load Module: Linked to module rlm_acct_unique Module: Instantiating acct_unique acct_unique { key = "User-Name, Acct-Session-Id, NAS-IP-Address, Client-IP-Address, NAS-Port" } Module: Checking accounting {...} for more modules to load Module: Instantiating detail detail { detailfile = "/var/log/radius/radacct/%{Client-IP-Address}/detail-%Y%m%d" header = "%t" detailperm = 384 dirperm = 493 locking = no log_packet_header = no } Module: Linked to module rlm_radutmp Module: Instantiating radutmp radutmp { filename = "/var/log/radius/radutmp" username = "%{User-Name}" case_sensitive = yes check_with_nas = yes perm = 384 callerid = yes } Module: Linked to module rlm_attr_filter Module: Instantiating attr_filter.accounting_response attr_filter attr_filter.accounting_response { attrsfile = "/etc/raddb/attrs.accounting_response" key = "%{User-Name}" } Module: Checking session {...} for more modules to load Module: Checking post-proxy {...} for more modules to load Module: Checking post-auth {...} for more modules to load Module: Instantiating attr_filter.access_reject attr_filter attr_filter.access_reject { attrsfile = "/etc/raddb/attrs.access_reject" key = "%{User-Name}" } } } radiusd: #### Opening IP addresses and Ports #### listen { type = "auth" ipaddr = 10.96.213.5 port = 0 } listen { type = "acct" ipaddr = 10.96.213.5 port = 0 } Listening on authentication address 10.96.213.5 port 1812 Listening on accounting address 10.96.213.5 port 1813 Ready to process requests.
-- -- Open Kairos http://www.openkairos.com Watch More TV http://sebelk.blogspot.com Sergio Belkin -
-- -- Open Kairos http://www.openkairos.com Watch More TV http://sebelk.blogspot.com Sergio Belkin -
participants (3)
-
Alan DeKok -
Ivan Kalik -
Sergio Belkin