Enable LDAP Module in Free Radius 3.0
Bhagwat, Shrikant
shrbhagw at med.umich.edu
Tue Sep 5 05:04:36 CEST 2017
I got LDAP Module to work & now trying to figure out Exec Module
exec {
wait = no
input_pairs = request
shell_escape = yes
output = none
timeout = 10
}
exec default {
wait = yes
output = none
#input_pairs = request
output_pairs = none
# 0 - level-2 proxy; 1 - level-2 proxy password; 2 - level-2 server; 3 - level-2 basedn; 4 - level-2 account found flag;
# 5 - level-1 kdc domain; 6 - log file name.
program = "/idm/idmt_home/PhoneFactor/Level1Factor.pl %{config:modules.ldap.identity} %{config:modules.ldap.password} %{config:modules.ldap.server} %{config:modules.ldap.basedn} not_found \
%{config:modules.ldap.level-1_kdc} %{config:modules.ldap.logFILEname}"
shell_escape = yes
}
# Phone Factor
exec phonefactor {
wait = yes
output = none
#input_pairs = request
output_pairs = none
# 0 - level-2 proxy; 1 - level-2 proxy password; 2 - level-2 server; 3 - level-2 basedn; 4 - level-2 account found flag;
# 5 - level-1 kdc domain; 6 - log file name; 7 - phone factor call back number
program = "/idm/idmt_home/PhoneFactor/PhoneFactor.pl %{config:modules.ldap.identity} %{config:modules.ldap.password} %{config:modules.ldap.server} %{config:modules.ldap.basedn} found \
%{config:modules.ldap.level-1_kdc} %{config:modules.ldap.logFILEname} %{reply:Callback-Number}"
shell_escape = yes
}
# Instantiating module "noop" from file /etc/raddb/mods-enabled/always
always noop {
rcode = "noop"
simulcount = 0
mpp = no
}
# Instantiating module "updated" from file /etc/raddb/mods-enabled/always
always updated {
rcode = "updated"
simulcount = 0
mpp = no
}
# Loaded module rlm_exec
# Instantiating module "exec" from file /etc/raddb/mods-enabled/exec
exec {
wait = no
input_pairs = "request"
shell_escape = yes
timeout = 10
}
# Instantiating module "default" from file /etc/raddb/mods-enabled/exec
exec default {
wait = yes
program = "/idm/idmt_home/PhoneFactor/Level1Factor.pl %{config:modules.ldap.identity} %{config:modules.ldap.password} %{config:modules.ldap.server} %{config:modules.ldap.basedn} not_found %{config:modules.ldap.level-1_kdc} %{config:modules.ldap.logFILEname}"
output_pairs = "none"
shell_escape = yes
}
/etc/raddb/mods-enabled/exec[32]: Invalid output list 'none'
/etc/raddb/mods-enabled/exec[32]: Instantiation failed for module "default"
Shrikant Bhagwat
Application Programmer/Analyst Sr.
Identity & Access Management Team
Health Information Technology Services (HITS)
Michigan Medicine, Formerly University of Michigan Health System, Ann Arbor, MI
Office # 734-615-2391
Cell # 734-276-6563
-----Original Message-----
From: Freeradius-Users [mailto:freeradius-users-bounces+shrbhagw=med.umich.edu at lists.freeradius.org] On Behalf Of Alan Buxey
Sent: Monday, September 04, 2017 7:10 PM
To: FreeRadius users mailing list <freeradius-users at lists.freeradius.org>
Subject: RE: Enable LDAP Module in Free Radius 3.0
Have you taken the default config and modified it as required or just copied the old config from old server (you can't do that for a migration to
3.x) . I'm not doing any further guesswork so provide config file rather than terse few lines of output
alan
On 4 Sep 2017 11:57 pm, "Bhagwat, Shrikant" <shrbhagw at med.umich.edu> wrote:
migrate-idmauth-preprod08:/etc/raddb/mods-enabled # radiusd -X
radiusd: FreeRADIUS Version 3.0.3, for host x86_64-suse-linux-gnu, built on Dec 19 2016 at 11:19 Copyright (C) 1999-2014 The FreeRADIUS server project and contributors There is NO warranty; not even for MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE You may redistribute copies of FreeRADIUS under the terms of the GNU General Public License For more information about these matters, see the file named COPYRIGHT Starting - reading configuration files ...
including dictionary file /usr/share/freeradius/dictionary including dictionary file /usr/share/freeradius/dictionary.dhcp
including dictionary file /usr/share/freeradius/dictionary.vqp
including dictionary file /etc/raddb/dictionary including configuration file /etc/raddb/radiusd.conf including configuration file /etc/raddb/proxy.conf including configuration file /etc/raddb/clients.conf including files in directory /etc/raddb/mods-enabled/ including configuration file /etc/raddb/mods-enabled/linelog including configuration file /etc/raddb/mods-enabled/expr including configuration file /etc/raddb/mods-enabled/expiration
including configuration file /etc/raddb/mods-enabled/unix including configuration file /etc/raddb/mods-enabled/always including configuration file /etc/raddb/mods-enabled/exec including configuration file /etc/raddb/mods-enabled/sradutmp including configuration file /etc/raddb/mods-enabled/radutmp including configuration file /etc/raddb/mods-enabled/eap including configuration file /etc/raddb/mods-enabled/echo including configuration file /etc/raddb/mods-enabled/soh including configuration file /etc/raddb/mods-enabled/dhcp including configuration file /etc/raddb/mods-enabled/ldap No such configuration item ..base_dn
/etc/raddb/mods-enabled/ldap[157]: Reference "${..base_dn}" not found Errors reading or parsing /etc/raddb/radiusd.conf
-----Original Message-----
From: Freeradius-Users [mailto:freeradius-users-bounces+shrbhagw=med.umich.
edu at lists.freeradius.org] On Behalf Of Alan Buxey
Sent: Monday, September 04, 2017 6:45 PM
To: FreeRadius users mailing list <freeradius-users at lists.freeradius.org>
Subject: Re: Enable LDAP Module in Free Radius 3.0
dont care about your old config.
the server clearly shows that no ldap module is being read in the mods-enabled directory - ensure you put a symlink to mods-available/ldap in there...
then, you should see is load up and no more "Ignoring "ldap" (see raddb/mods-available/README.rst)" errors...
alan
On 4 September 2017 at 22:13, Bhagwat, Shrikant <shrbhagw at med.umich.edu>
wrote:
> Hi
>
> No sure whether LDAP Module is enabled. My Radius Server supposed to
> connect to LDAP Server
>
> Below is my config freeradius 1.0
> # Lightweight Directory Access Protocol (LDAP)
> #
> # This module definition allows you to use LDAP for
> # authorization and authentication (Auth-Type := LDAP)
> #
> # See doc/rlm_ldap for description of configuration options
> # and sample authorize{} and authenticate{} blocks
> ldap ldapmed {
> server = "ldap.company.com"
> port = 636
> # defualt identity is anonymous
> identity = "cn=radius,o=services"
> password = XXXXX
> basedn = "dc=XXX,dc=XXXX"
> filter =
> "(&(uid=%{Stripped-User-Name:-%{User-Name}})(objectclass=
radiusprofile))"
> # base_filter = "(objectclass=radiusprofile)"
>
> # app config
> logFILEname = "/var/log/radius/mycompany.log"
>
> # level-1 config
> level-1_server = "ldap.company.com"
> level-1_basedn = "ou=xxx,dc=xxx,dc=xxxx"
> level-1_kdc = "xxxxx"
>
> start_tls = no
>
>
>
> radiusd -X
> radiusd: FreeRADIUS Version 3.0.3, for host x86_64-suse-linux-gnu,
> built on Dec 19 2016 at 11:19 Copyright (C) 1999-2014 The FreeRADIUS
> server project and contributors There is NO warranty; not even for
> MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE You may
> redistribute copies of FreeRADIUS under the terms of the GNU General
> Public License For more information about these matters, see the file
> named COPYRIGHT Starting - reading configuration files ...
> including dictionary file /usr/share/freeradius/dictionary including
> dictionary file /usr/share/freeradius/dictionary.dhcp
> including dictionary file /usr/share/freeradius/dictionary.vqp
> including dictionary file /etc/raddb/dictionary including
> configuration file /etc/raddb/radiusd.conf including configuration
> file /etc/raddb/proxy.conf including configuration file
> /etc/raddb/clients.conf including files in directory
> /etc/raddb/mods-enabled/ including configuration file
> /etc/raddb/mods-enabled/linelog including configuration file
> /etc/raddb/mods-enabled/expr including configuration file
> /etc/raddb/mods-enabled/expiration
> including configuration file /etc/raddb/mods-enabled/unix including
> configuration file /etc/raddb/mods-enabled/always including
> configuration file /etc/raddb/mods-enabled/exec including
> configuration file /etc/raddb/mods-enabled/sradutmp including
> configuration file /etc/raddb/mods-enabled/radutmp including
> configuration file /etc/raddb/mods-enabled/eap including configuration
> file /etc/raddb/mods-enabled/echo including configuration file
> /etc/raddb/mods-enabled/soh including configuration file
> /etc/raddb/mods-enabled/dhcp including configuration file
> /etc/raddb/mods-enabled/cache_eap including configuration file
> /etc/raddb/mods-enabled/mschap including configuration file
> /etc/raddb/mods-enabled/chap including configuration file
> /etc/raddb/mods-enabled/realm including configuration file
> /etc/raddb/mods-enabled/passwd including configuration file
> /etc/raddb/mods-enabled/digest including configuration file
> /etc/raddb/mods-enabled/preprocess
> including configuration file /etc/raddb/mods-enabled/logintime
> including configuration file /etc/raddb/mods-enabled/replicate
> including configuration file /etc/raddb/mods-enabled/detail including
> configuration file /etc/raddb/mods-enabled/ntlm_auth including
> configuration file /etc/raddb/mods-enabled/dynamic_clients
> including configuration file /etc/raddb/mods-enabled/utf8 including
> configuration file /etc/raddb/mods-enabled/detail.log
> including configuration file /etc/raddb/mods-enabled/files including
> configuration file /etc/raddb/mods-enabled/unpack including
> configuration file /etc/raddb/mods-enabled/attr_filter
> including configuration file /etc/raddb/mods-enabled/pap including
> files in directory /etc/raddb/policy.d/ including configuration file
> /etc/raddb/policy.d/eap including configuration file
> /etc/raddb/policy.d/dhcp including configuration file
> /etc/raddb/policy.d/control including configuration file
> /etc/raddb/policy.d/cui including configuration file
> /etc/raddb/policy.d/filter including configuration file
> /etc/raddb/policy.d/canonicalization
> including configuration file /etc/raddb/policy.d/accounting including
> configuration file /etc/raddb/policy.d/operator-name including files
> in directory /etc/raddb/sites-enabled/ including configuration file
> /etc/raddb/sites-enabled/default including configuration file
> /etc/raddb/sites-enabled/inner-tunnel
> main {
> security {
> allow_core_dumps = no
> }
> }
> main {
> name = "radiusd"
> prefix = "/usr"
> localstatedir = "/var"
> sbindir = "/usr/sbin"
> logdir = "/var/log/radius"
> run_dir = "/var/run/radiusd"
> libdir = "/usr/lib64/freeradius"
> radacctdir = "/var/log/radius/radacct"
> hostname_lookups = no
> max_request_time = 30
> cleanup_delay = 5
> max_requests = 1024
> pidfile = "/var/run/radiusd/radiusd.pid"
> checkrad = "/usr/sbin/checkrad"
> debug_level = 0
> proxy_requests = yes
> log {
> stripped_names = no
> auth = no
> auth_badpass = no
> auth_goodpass = no
> colourise = yes
> msg_denied = "You are already logged in - access denied"
> }
> security {
> max_attributes = 200
> reject_delay = 1
> status_server = yes
> allow_vulnerable_openssl = "no"
> }
> }
> radiusd: #### Loading Realms and Home Servers #### proxy server {
> retry_delay = 5 retry_count = 3 default_fallback = no dead_time = 120
> wake_all_if_all_dead = no } home_server localhost { ipaddr = 127.0.0.1
> port = 1812 type = "auth"
> secret = <<< secret >>>
> response_window = 20
> max_outstanding = 65536
> zombie_period = 40
> status_check = "status-server"
> ping_interval = 30
> check_interval = 30
> num_answers_to_alive = 3
> revive_interval = 120
> status_check_timeout = 4
> coa {
> irt = 2
> mrt = 16
> mrc = 5
> mrd = 30
> }
> limit {
> max_connections = 16
> max_requests = 0
> lifetime = 0
> idle_timeout = 0
> }
> }
> home_server_pool my_auth_failover {
> type = fail-over
> home_server = localhost
> }
> realm example.com {
> auth_pool = my_auth_failover
> }
> realm LOCAL {
> }
> radiusd: #### Loading Clients ####
> client localhost {
> ipaddr = 127.0.0.1
> require_message_authenticator = no
> secret = <<< secret >>>
> nas_type = "other"
> proto = "*"
> limit {
> max_connections = 16
> lifetime = 0
> idle_timeout = 30
> }
> }
> radiusd: #### Instantiating modules #### instantiate { } modules {
> # Loaded module rlm_linelog
> # Instantiating module "linelog" from file /etc/raddb/mods-enabled/
linelog
> linelog {
> filename = "/var/log/radius/linelog"
> permissions = 384
> format = "This is a log message for %{User-Name}"
> reference = "messages.%{%{Packet-Type}:-default}"
> }
> # Instantiating module "log_accounting" from file
/etc/raddb/mods-enabled/linelog
> linelog log_accounting {
> filename = "/var/log/radius/linelog-accounting"
> permissions = 384
> format = ""
> reference = "Accounting-Request.%{%{Acct-Status-Type}:-unknown}"
> }
> # Loaded module rlm_expr
> # Instantiating module "expr" from file /etc/raddb/mods-enabled/expr
> expr {
> safe_characters = "@abcdefghijklmnopqrstuvwxyzABCD
EFGHIJKLMNOPQRSTUVWXYZ0123456789.-_: /"
> }
> # Loaded module rlm_expiration
> # Instantiating module "expiration" from file
> /etc/raddb/mods-enabled/
expiration
> # Loaded module rlm_unix
> # Instantiating module "unix" from file /etc/raddb/mods-enabled/unix
> unix {
> radwtmp = "/var/log/radius/radwtmp"
> }
> # Loaded module rlm_always
> # Instantiating module "reject" from file /etc/raddb/mods-enabled/always
> always reject {
> rcode = "reject"
> simulcount = 0
> mpp = no
> }
> # Instantiating module "fail" from file /etc/raddb/mods-enabled/always
> always fail {
> rcode = "fail"
> simulcount = 0
> mpp = no
> }
> # Instantiating module "ok" from file /etc/raddb/mods-enabled/always
> always ok {
> rcode = "ok"
> simulcount = 0
> mpp = no
> }
> # Instantiating module "handled" from file
/etc/raddb/mods-enabled/always
> always handled {
> rcode = "handled"
> simulcount = 0
> mpp = no
> }
> # Instantiating module "invalid" from file
/etc/raddb/mods-enabled/always
> always invalid {
> rcode = "invalid"
> simulcount = 0
> mpp = no
> }
> # Instantiating module "userlock" from file
/etc/raddb/mods-enabled/always
> always userlock {
> rcode = "userlock"
> simulcount = 0
> mpp = no
> }
> # Instantiating module "notfound" from file
/etc/raddb/mods-enabled/always
> always notfound {
> rcode = "notfound"
> simulcount = 0
> mpp = no
> }
> # Instantiating module "noop" from file /etc/raddb/mods-enabled/always
> always noop {
> rcode = "noop"
> simulcount = 0
> mpp = no
> }
> # Instantiating module "updated" from file
/etc/raddb/mods-enabled/always
> always updated {
> rcode = "updated"
> simulcount = 0
> mpp = no
> }
> # Loaded module rlm_exec
> # Instantiating module "exec" from file /etc/raddb/mods-enabled/exec
> exec {
> wait = no
> input_pairs = "request"
> shell_escape = yes
> timeout = 10
> }
> # Loaded module rlm_radutmp
> # Instantiating module "sradutmp" from file /etc/raddb/mods-enabled/
sradutmp
> radutmp sradutmp {
> filename = "/var/log/radius/sradutmp"
> username = "%{User-Name}"
> case_sensitive = yes
> check_with_nas = yes
> permissions = 420
> caller_id = no
> }
> # Instantiating module "radutmp" from file /etc/raddb/mods-enabled/
radutmp
> radutmp {
> filename = "/var/log/radius/radutmp"
> username = "%{User-Name}"
> case_sensitive = yes
> check_with_nas = yes
> permissions = 384
> caller_id = yes
> }
> # Loaded module rlm_eap
> # Instantiating module "eap" from file /etc/raddb/mods-enabled/eap
> eap {
> default_eap_type = "md5"
> timer_expire = 60
> ignore_unknown_eap_types = no
> mod_accounting_username_bug = no
> max_sessions = 1024
> }
> # Linked to sub-module rlm_eap_md5
> # Linked to sub-module rlm_eap_leap
> # Linked to sub-module rlm_eap_gtc
> gtc {
> challenge = "Password: "
> auth_type = "PAP"
> }
> # Linked to sub-module rlm_eap_tls
> tls {
> tls = "tls-common"
> }
> tls-config tls-common {
> rsa_key_exchange = no
> dh_key_exchange = yes
> rsa_key_length = 512
> dh_key_length = 512
> verify_depth = 0
> ca_path = "/etc/raddb/certs"
> pem_file_type = yes
> private_key_file = "/etc/raddb/certs/server.pem"
> certificate_file = "/etc/raddb/certs/server.pem"
> ca_file = "/etc/raddb/certs/ca.pem"
> private_key_password = <<< secret >>>
> dh_file = "/etc/raddb/certs/dh"
> fragment_size = 1024
> include_length = yes
> check_crl = no
> cipher_list = "DEFAULT"
> ecdh_curve = "prime256v1"
> cache {
> enable = yes
> lifetime = 24
> max_entries = 255
> }
> verify {
> }
> ocsp {
> enable = no
> override_cert_url = yes
> url = "http://127.0.0.1/ocsp/"
> use_nonce = yes
> timeout = 0
> softfail = yes
> }
> }
> # Linked to sub-module rlm_eap_ttls
> ttls {
> tls = "tls-common"
> default_eap_type = "md5"
> copy_request_to_tunnel = no
> use_tunneled_reply = no
> virtual_server = "inner-tunnel"
> include_length = yes
> require_client_cert = no
> }
> Using cached TLS configuration from previous invocation
> # Linked to sub-module rlm_eap_peap
> peap {
> tls = "tls-common"
> default_method = "mschapv2"
> copy_request_to_tunnel = no
> use_tunneled_reply = no
> proxy_tunneled_request_as_eap = yes
> virtual_server = "inner-tunnel"
> soh = no
> require_client_cert = no
> }
> Using cached TLS configuration from previous invocation
> # Linked to sub-module rlm_eap_mschapv2
> mschapv2 {
> with_ntdomain_hack = no
> send_error = no
> }
> # Instantiating module "echo" from file /etc/raddb/mods-enabled/echo
> exec echo {
> wait = yes
> program = "/bin/echo %{User-Name}"
> input_pairs = "request"
> output_pairs = "reply"
> shell_escape = yes
> }
> # Loaded module rlm_soh
> # Instantiating module "soh" from file /etc/raddb/mods-enabled/soh
> soh {
> dhcp = yes
> }
> # Loaded module rlm_dhcp
> # Instantiating module "dhcp" from file /etc/raddb/mods-enabled/dhcp
> # Loaded module rlm_cache
> # Instantiating module "cache_eap" from file
/etc/raddb/mods-enabled/cache_eap
> cache cache_eap {
> key = "%{%{control:State}:-%{%{reply:State}:-%{State}}}"
> ttl = 15
> max_entries = 16384
> epoch = 0
> add_stats = no
> }
> # Loaded module rlm_mschap
> # Instantiating module "mschap" from file /etc/raddb/mods-enabled/mschap
> mschap {
> use_mppe = yes
> require_encryption = no
> require_strong = no
> with_ntdomain_hack = yes
> passchange {
> }
> allow_retry = yes
> }
> # Loaded module rlm_chap
> # Instantiating module "chap" from file /etc/raddb/mods-enabled/chap
> # Loaded module rlm_realm
> # Instantiating module "IPASS" from file /etc/raddb/mods-enabled/realm
> realm IPASS {
> format = "prefix"
> delimiter = "/"
> ignore_default = no
> ignore_null = no
> }
> # Instantiating module "suffix" from file /etc/raddb/mods-enabled/realm
> realm suffix {
> format = "suffix"
> delimiter = "@"
> ignore_default = no
> ignore_null = no
> }
> # Instantiating module "realmpercent" from file
/etc/raddb/mods-enabled/realm
> realm realmpercent {
> format = "suffix"
> delimiter = "%"
> ignore_default = no
> ignore_null = no
> }
> # Instantiating module "ntdomain" from file
/etc/raddb/mods-enabled/realm
> realm ntdomain {
> format = "prefix"
> delimiter = "\"
> ignore_default = no
> ignore_null = no
> }
> # Loaded module rlm_passwd
> # Instantiating module "etc_passwd" from file
/etc/raddb/mods-enabled/passwd
> passwd etc_passwd {
> filename = "/etc/passwd"
> format = "*User-Name:Crypt-Password:"
> delimiter = ":"
> ignore_nislike = no
> ignore_empty = yes
> allow_multiple_keys = no
> hash_size = 100
> }
> rlm_passwd: nfields: 3 keyfield 0(User-Name) listable: no
> # Loaded module rlm_digest
> # Instantiating module "digest" from file /etc/raddb/mods-enabled/digest
> # Loaded module rlm_preprocess
> # Instantiating module "preprocess" from file
> /etc/raddb/mods-enabled/
preprocess
> preprocess {
> huntgroups = "/etc/raddb/mods-config/preprocess/huntgroups"
> hints = "/etc/raddb/mods-config/preprocess/hints"
> with_ascend_hack = no
> ascend_channels_per_line = 23
> with_ntdomain_hack = no
> with_specialix_jetstream_hack = no
> with_cisco_vsa_hack = no
> with_alvarion_vsa_hack = no
> }
> reading pairlist file /etc/raddb/mods-config/preprocess/huntgroups
> reading pairlist file /etc/raddb/mods-config/preprocess/hints
> # Loaded module rlm_logintime
> # Instantiating module "logintime" from file
> /etc/raddb/mods-enabled/
logintime
> logintime {
> minimum_timeout = 60
> }
> # Loaded module rlm_replicate
> # Instantiating module "replicate" from file
> /etc/raddb/mods-enabled/
replicate
> # Loaded module rlm_detail
> # Instantiating module "detail" from file /etc/raddb/mods-enabled/detail
> detail {
> filename = "/var/log/radius/radacct/%{%{Packet-Src-IP-Address}:-%{
Packet-Src-IPv6-Address}}/detail-%Y%m%d"
> header = "%t"
> permissions = 384
> locking = no
> log_packet_header = no
> }
> # Instantiating module "ntlm_auth" from file
/etc/raddb/mods-enabled/ntlm_auth
> exec ntlm_auth {
> wait = yes
> program = "/path/to/ntlm_auth --request-nt-key --domain=MYDOMAIN
--username=%{mschap:User-Name} --password=%{User-Password}"
> shell_escape = yes
> }
> # Loaded module rlm_dynamic_clients
> # Instantiating module "dynamic_clients" from file
/etc/raddb/mods-enabled/dynamic_clients
> # Loaded module rlm_utf8
> # Instantiating module "utf8" from file /etc/raddb/mods-enabled/utf8
> # Instantiating module "auth_log" from file /etc/raddb/mods-enabled/
detail.log
> detail auth_log {
> filename = "/var/log/radius/radacct/%{%{Packet-Src-IP-Address}:-%{
Packet-Src-IPv6-Address}}/auth-detail-%Y%m%d"
> header = "%t"
> permissions = 384
> locking = no
> log_packet_header = no
> }
> rlm_detail (auth_log): 'User-Password' suppressed, will not appear in
detail output
> # Instantiating module "reply_log" from file
> /etc/raddb/mods-enabled/
detail.log
> detail reply_log {
> filename = "/var/log/radius/radacct/%{%{Packet-Src-IP-Address}:-%{
Packet-Src-IPv6-Address}}/reply-detail-%Y%m%d"
> header = "%t"
> permissions = 384
> locking = no
> log_packet_header = no
> }
> # Instantiating module "pre_proxy_log" from file
/etc/raddb/mods-enabled/detail.log
> detail pre_proxy_log {
> filename = "/var/log/radius/radacct/%{%{Packet-Src-IP-Address}:-%{
Packet-Src-IPv6-Address}}/pre-proxy-detail-%Y%m%d"
> header = "%t"
> permissions = 384
> locking = no
> log_packet_header = no
> }
> # Instantiating module "post_proxy_log" from file
/etc/raddb/mods-enabled/detail.log
> detail post_proxy_log {
> filename = "/var/log/radius/radacct/%{%{Packet-Src-IP-Address}:-%{
Packet-Src-IPv6-Address}}/post-proxy-detail-%Y%m%d"
> header = "%t"
> permissions = 384
> locking = no
> log_packet_header = no
> }
> # Loaded module rlm_files
> # Instantiating module "files" from file /etc/raddb/mods-enabled/files
> files {
> filename = "/etc/raddb/mods-config/files/authorize"
> usersfile = "/etc/raddb/mods-config/files/authorize"
> acctusersfile = "/etc/raddb/mods-config/files/accounting"
> preproxy_usersfile = "/etc/raddb/mods-config/files/pre-proxy"
> compat = "cistron"
> }
> reading pairlist file /etc/raddb/mods-config/files/authorize
> [/etc/raddb/mods-config/files/authorize]:181 Cistron compatibility
> checks
for entry DEFAULT ...
> [/etc/raddb/mods-config/files/authorize]:188 Cistron compatibility
> checks
for entry DEFAULT ...
> [/etc/raddb/mods-config/files/authorize]:195 Cistron compatibility
> checks
for entry DEFAULT ...
> reading pairlist file /etc/raddb/mods-config/files/authorize
> [/etc/raddb/mods-config/files/authorize]:181 Cistron compatibility
> checks
for entry DEFAULT ...
> [/etc/raddb/mods-config/files/authorize]:188 Cistron compatibility
> checks
for entry DEFAULT ...
> [/etc/raddb/mods-config/files/authorize]:195 Cistron compatibility
> checks
for entry DEFAULT ...
> reading pairlist file /etc/raddb/mods-config/files/accounting
> reading pairlist file /etc/raddb/mods-config/files/pre-proxy
> # Loaded module rlm_unpack
> # Instantiating module "unpack" from file /etc/raddb/mods-enabled/unpack
> # Loaded module rlm_attr_filter
> # Instantiating module "attr_filter.post-proxy" from file
/etc/raddb/mods-enabled/attr_filter
> attr_filter attr_filter.post-proxy {
> filename = "/etc/raddb/mods-config/attr_filter/post-proxy"
> key = "%{Realm}"
> relaxed = no
> }
> reading pairlist file /etc/raddb/mods-config/attr_filter/post-proxy
> # Instantiating module "attr_filter.pre-proxy" from file
/etc/raddb/mods-enabled/attr_filter
> attr_filter attr_filter.pre-proxy {
> filename = "/etc/raddb/mods-config/attr_filter/pre-proxy"
> key = "%{Realm}"
> relaxed = no
> }
> reading pairlist file /etc/raddb/mods-config/attr_filter/pre-proxy
> # Instantiating module "attr_filter.access_reject" from file
/etc/raddb/mods-enabled/attr_filter
> attr_filter attr_filter.access_reject {
> filename = "/etc/raddb/mods-config/attr_filter/access_reject"
> key = "%{User-Name}"
> relaxed = no
> }
> reading pairlist file /etc/raddb/mods-config/attr_filter/access_reject
> # Instantiating module "attr_filter.access_challenge" from file
/etc/raddb/mods-enabled/attr_filter
> attr_filter attr_filter.access_challenge {
> filename = "/etc/raddb/mods-config/attr_filter/access_challenge"
> key = "%{User-Name}"
> relaxed = no
> }
> reading pairlist file /etc/raddb/mods-config/attr_filter/access_challenge
> # Instantiating module "attr_filter.accounting_response" from file
/etc/raddb/mods-enabled/attr_filter
> attr_filter attr_filter.accounting_response {
> filename = "/etc/raddb/mods-config/attr_filter/accounting_response"
> key = "%{User-Name}"
> relaxed = no
> }
> reading pairlist file /etc/raddb/mods-config/attr_
filter/accounting_response
> # Loaded module rlm_pap
> # Instantiating module "pap" from file /etc/raddb/mods-enabled/pap
> pap {
> normalise = yes
> }
> } # modules
> radiusd: #### Loading Virtual Servers #### server { # from file
> /etc/raddb/radiusd.conf } # server server default { # from file
> /etc/raddb/sites-enabled/default # Creating Auth-Type = digest #
> Loading authenticate {...} # Loading authorize {...} Ignoring "sql"
> (see raddb/mods-available/README.rst) Ignoring "ldap" (see
> raddb/mods-available/README.rst) # Loading preacct {...} # Loading
> accounting {...} # Loading post-proxy {...} # Loading post-auth {...}
> } # server default server inner-tunnel { # from file
> /etc/raddb/sites-enabled/inner-tunnel
> # Loading authenticate {...}
> # Loading authorize {...}
> # Loading session {...}
> # Loading post-proxy {...}
> # Loading post-auth {...}
> } # server inner-tunnel
> radiusd: #### Opening IP addresses and Ports #### listen {
> type = "auth"
> ipaddr = 10.30.23.214
> port = 1812
> limit {
> max_connections = 16
> lifetime = 0
> idle_timeout = 30
> }
> }
> listen {
> type = "acct"
> ipaddr = 10.30.23.214
> port = 1813
> limit {
> max_connections = 16
> lifetime = 0
> idle_timeout = 30
> }
> }
> listen {
> type = "auth"
> ipaddr = 127.0.0.1
> port = 18120
> }
> Listening on auth address 10.30.23.214 port 1812 as server default
> Listening on acct address 10.30.23.214 port 1813 as server default
> Listening on auth address 127.0.0.1 port 18120 as server inner-tunnel
> Opening new proxy socket 'proxy address * port 0'
> Listening on proxy address * port 37421 Ready to process requests.
>
>
> **********************************************************
> Electronic Mail is not secure, may not be read every day, and should
> not be used for urgent or sensitive issues
> -
> List info/subscribe/unsubscribe? See
> http://www.freeradius.org/list/users.html
-
List info/subscribe/unsubscribe? See http://www.freeradius.org/ list/users.html
**********************************************************
Electronic Mail is not secure, may not be read every day, and should not be used for urgent or sensitive issues
-
List info/subscribe/unsubscribe? See http://www.freeradius.org/ list/users.html
-
List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html
**********************************************************
Electronic Mail is not secure, may not be read every day, and should not be used for urgent or sensitive issues
More information about the Freeradius-Users
mailing list