API tools faq
paste
Guest User

radius server logs

a guest
Apr 23rd, 2019
505
0
Never
Add comment
Not a member of Pastebin yet? Sign Up, it unlocks many cool features!
text 34.28 KB | None | 0 0
raw download clone embed print report
  1. root@radius-ave:/home/ave# freeradius -X
  2. FreeRADIUS Version 3.0.12
  3. Copyright (C) 1999-2016 The FreeRADIUS server project and contributors
  4. There is NO warranty; not even for MERCHANTABILITY or FITNESS FOR A
  5. PARTICULAR PURPOSE
  6. You may redistribute copies of FreeRADIUS under the terms of the
  7. GNU General Public License
  8. For more information about these matters, see the file named COPYRIGHT
  9. Starting - reading configuration files ...
  10. including dictionary file /usr/share/freeradius/dictionary
  11. including dictionary file /usr/share/freeradius/dictionary.dhcp
  12. including dictionary file /usr/share/freeradius/dictionary.vqp
  13. including dictionary file /etc/freeradius/3.0/dictionary
  14. including configuration file /etc/freeradius/3.0/radiusd.conf
  15. including configuration file /etc/freeradius/3.0/proxy.conf
  16. including configuration file /etc/freeradius/3.0/clients.conf
  17. including files in directory /etc/freeradius/3.0/mods-enabled/
  18. including configuration file /etc/freeradius/3.0/mods-enabled/files
  19. including configuration file /etc/freeradius/3.0/mods-enabled/echo
  20. including configuration file /etc/freeradius/3.0/mods-enabled/detail
  21. including configuration file /etc/freeradius/3.0/mods-enabled/dynamic_clients
  22. including configuration file /etc/freeradius/3.0/mods-enabled/ntlm_auth
  23. including configuration file /etc/freeradius/3.0/mods-enabled/logintime
  24. including configuration file /etc/freeradius/3.0/mods-enabled/passwd
  25. including configuration file /etc/freeradius/3.0/mods-enabled/radutmp
  26. including configuration file /etc/freeradius/3.0/mods-enabled/exec
  27. including configuration file /etc/freeradius/3.0/mods-enabled/digest
  28. including configuration file /etc/freeradius/3.0/mods-enabled/chap
  29. including configuration file /etc/freeradius/3.0/mods-enabled/attr_filter
  30. including configuration file /etc/freeradius/3.0/mods-enabled/preprocess
  31. including configuration file /etc/freeradius/3.0/mods-enabled/linelog
  32. including configuration file /etc/freeradius/3.0/mods-enabled/detail.log
  33. including configuration file /etc/freeradius/3.0/mods-enabled/expr
  34. including configuration file /etc/freeradius/3.0/mods-enabled/mschap
  35. including configuration file /etc/freeradius/3.0/mods-enabled/unpack
  36. including configuration file /etc/freeradius/3.0/mods-enabled/cache_eap
  37. including configuration file /etc/freeradius/3.0/mods-enabled/utf8
  38. including configuration file /etc/freeradius/3.0/mods-enabled/expiration
  39. including configuration file /etc/freeradius/3.0/mods-enabled/realm
  40. including configuration file /etc/freeradius/3.0/mods-enabled/always
  41. including configuration file /etc/freeradius/3.0/mods-enabled/replicate
  42. including configuration file /etc/freeradius/3.0/mods-enabled/sradutmp
  43. including configuration file /etc/freeradius/3.0/mods-enabled/eap
  44. including configuration file /etc/freeradius/3.0/mods-enabled/unix
  45. including configuration file /etc/freeradius/3.0/mods-enabled/soh
  46. including configuration file /etc/freeradius/3.0/mods-enabled/pap
  47. including files in directory /etc/freeradius/3.0/policy.d/
  48. including configuration file /etc/freeradius/3.0/policy.d/accounting
  49. including configuration file /etc/freeradius/3.0/policy.d/control
  50. including configuration file /etc/freeradius/3.0/policy.d/operator-name
  51. including configuration file /etc/freeradius/3.0/policy.d/cui
  52. including configuration file /etc/freeradius/3.0/policy.d/debug
  53. including configuration file /etc/freeradius/3.0/policy.d/abfab-tr
  54. including configuration file /etc/freeradius/3.0/policy.d/dhcp
  55. including configuration file /etc/freeradius/3.0/policy.d/filter
  56. including configuration file /etc/freeradius/3.0/policy.d/moonshot-targeted-ids
  57. including configuration file /etc/freeradius/3.0/policy.d/eap
  58. including configuration file /etc/freeradius/3.0/policy.d/canonicalization
  59. including files in directory /etc/freeradius/3.0/sites-enabled/
  60. including configuration file /etc/freeradius/3.0/sites-enabled/inner-tunnel
  61. including configuration file /etc/freeradius/3.0/sites-enabled/default
  62. main {
  63. security {
  64. user = "freerad"
  65. group = "freerad"
  66. allow_core_dumps = no
  67. }
  68. name = "freeradius"
  69. prefix = "/usr"
  70. localstatedir = "/var"
  71. logdir = "/var/log/freeradius"
  72. run_dir = "/var/run/freeradius"
  73. }
  74. main {
  75. name = "freeradius"
  76. prefix = "/usr"
  77. localstatedir = "/var"
  78. sbindir = "/usr/sbin"
  79. logdir = "/var/log/freeradius"
  80. run_dir = "/var/run/freeradius"
  81. libdir = "/usr/lib/freeradius"
  82. radacctdir = "/var/log/freeradius/radacct"
  83. hostname_lookups = no
  84. max_request_time = 30
  85. cleanup_delay = 5
  86. max_requests = 16384
  87. pidfile = "/var/run/freeradius/freeradius.pid"
  88. checkrad = "/usr/sbin/checkrad"
  89. debug_level = 0
  90. proxy_requests = yes
  91. log {
  92. stripped_names = no
  93. auth = no
  94. auth_badpass = no
  95. auth_goodpass = no
  96. colourise = yes
  97. msg_denied = "You are already logged in - access denied"
  98. }
  99. resources {
  100. }
  101. security {
  102. max_attributes = 200
  103. reject_delay = 1.000000
  104. status_server = yes
  105. }
  106. }
  107. radiusd: #### Loading Realms and Home Servers ####
  108. proxy server {
  109. retry_delay = 5
  110. retry_count = 3
  111. default_fallback = no
  112. dead_time = 120
  113. wake_all_if_all_dead = no
  114. }
  115. home_server localhost {
  116. ipaddr = 127.0.0.1
  117. port = 1812
  118. type = "auth"
  119. secret = <<< secret >>>
  120. response_window = 20.000000
  121. response_timeouts = 1
  122. max_outstanding = 65536
  123. zombie_period = 40
  124. status_check = "status-server"
  125. ping_interval = 30
  126. check_interval = 30
  127. check_timeout = 4
  128. num_answers_to_alive = 3
  129. revive_interval = 120
  130. limit {
  131. max_connections = 16
  132. max_requests = 0
  133. lifetime = 0
  134. idle_timeout = 0
  135. }
  136. coa {
  137. irt = 2
  138. mrt = 16
  139. mrc = 5
  140. mrd = 30
  141. }
  142. }
  143. home_server_pool my_auth_failover {
  144. type = fail-over
  145. home_server = localhost
  146. }
  147. realm example.com {
  148. auth_pool = my_auth_failover
  149. }
  150. realm LOCAL {
  151. }
  152. radiusd: #### Loading Clients ####
  153. client localhost {
  154. ipaddr = 127.0.0.1
  155. require_message_authenticator = no
  156. secret = <<< secret >>>
  157. nas_type = "other"
  158. proto = "*"
  159. limit {
  160. max_connections = 16
  161. lifetime = 0
  162. idle_timeout = 30
  163. }
  164. }
  165. client localhost_ipv6 {
  166. ipv6addr = ::1
  167. require_message_authenticator = no
  168. secret = <<< secret >>>
  169. limit {
  170. max_connections = 16
  171. lifetime = 0
  172. idle_timeout = 30
  173. }
  174. }
  175. client AP_pzu {
  176. ipaddr = 10.42.0.22
  177. require_message_authenticator = no
  178. secret = <<< secret >>>
  179. limit {
  180. max_connections = 16
  181. lifetime = 0
  182. idle_timeout = 30
  183. }
  184. }
  185. Debugger not attached
  186. # Creating Auth-Type = mschap
  187. # Creating Auth-Type = eap
  188. # Creating Auth-Type = PAP
  189. # Creating Auth-Type = CHAP
  190. # Creating Auth-Type = MS-CHAP
  191. # Creating Auth-Type = digest
  192. radiusd: #### Instantiating modules ####
  193. modules {
  194. # Loaded module rlm_files
  195. # Loading module "files" from file /etc/freeradius/3.0/mods-enabled/files
  196. files {
  197. filename = "/etc/freeradius/3.0/mods-config/files/authorize"
  198. acctusersfile = "/etc/freeradius/3.0/mods-config/files/accounting"
  199. preproxy_usersfile = "/etc/freeradius/3.0/mods-config/files/pre-proxy"
  200. }
  201. # Loading module "authorized_macs" from file /etc/freeradius/3.0/mods-enabled/files
  202. files authorized_macs {
  203. usersfile = "/etc/freeradius/3.0/authorized_macs"
  204. key = "%{Calling-Station-ID}"
  205. }
  206. # Loaded module rlm_exec
  207. # Loading module "echo" from file /etc/freeradius/3.0/mods-enabled/echo
  208. exec echo {
  209. wait = yes
  210. program = "/bin/echo %{User-Name}"
  211. input_pairs = "request"
  212. output_pairs = "reply"
  213. shell_escape = yes
  214. }
  215. # Loaded module rlm_detail
  216. # Loading module "detail" from file /etc/freeradius/3.0/mods-enabled/detail
  217. detail {
  218. filename = "/var/log/freeradius/radacct/%{%{Packet-Src-IP-Address}:-%{Packet-Src-IPv6-Address}}/detail-%Y%m%d"
  219. header = "%t"
  220. permissions = 384
  221. locking = no
  222. escape_filenames = no
  223. log_packet_header = no
  224. }
  225. # Loaded module rlm_dynamic_clients
  226. # Loading module "dynamic_clients" from file /etc/freeradius/3.0/mods-enabled/dynamic_clients
  227. # Loading module "ntlm_auth" from file /etc/freeradius/3.0/mods-enabled/ntlm_auth
  228. exec ntlm_auth {
  229. wait = yes
  230. program = "/path/to/ntlm_auth --request-nt-key --domain=MYDOMAIN --username=%{mschap:User-Name} --password=%{User-Password}"
  231. shell_escape = yes
  232. }
  233. # Loaded module rlm_logintime
  234. # Loading module "logintime" from file /etc/freeradius/3.0/mods-enabled/logintime
  235. logintime {
  236. minimum_timeout = 60
  237. }
  238. # Loaded module rlm_passwd
  239. # Loading module "etc_passwd" from file /etc/freeradius/3.0/mods-enabled/passwd
  240. passwd etc_passwd {
  241. filename = "/etc/passwd"
  242. format = "*User-Name:Crypt-Password:"
  243. delimiter = ":"
  244. ignore_nislike = no
  245. ignore_empty = yes
  246. allow_multiple_keys = no
  247. hash_size = 100
  248. }
  249. # Loaded module rlm_radutmp
  250. # Loading module "radutmp" from file /etc/freeradius/3.0/mods-enabled/radutmp
  251. radutmp {
  252. filename = "/var/log/freeradius/radutmp"
  253. username = "%{User-Name}"
  254. case_sensitive = yes
  255. check_with_nas = yes
  256. permissions = 384
  257. caller_id = yes
  258. }
  259. # Loading module "exec" from file /etc/freeradius/3.0/mods-enabled/exec
  260. exec {
  261. wait = no
  262. input_pairs = "request"
  263. shell_escape = yes
  264. timeout = 10
  265. }
  266. # Loaded module rlm_digest
  267. # Loading module "digest" from file /etc/freeradius/3.0/mods-enabled/digest
  268. # Loaded module rlm_chap
  269. # Loading module "chap" from file /etc/freeradius/3.0/mods-enabled/chap
  270. # Loaded module rlm_attr_filter
  271. # Loading module "attr_filter.post-proxy" from file /etc/freeradius/3.0/mods-enabled/attr_filter
  272. attr_filter attr_filter.post-proxy {
  273. filename = "/etc/freeradius/3.0/mods-config/attr_filter/post-proxy"
  274. key = "%{Realm}"
  275. relaxed = no
  276. }
  277. # Loading module "attr_filter.pre-proxy" from file /etc/freeradius/3.0/mods-enabled/attr_filter
  278. attr_filter attr_filter.pre-proxy {
  279. filename = "/etc/freeradius/3.0/mods-config/attr_filter/pre-proxy"
  280. key = "%{Realm}"
  281. relaxed = no
  282. }
  283. # Loading module "attr_filter.access_reject" from file /etc/freeradius/3.0/mods-enabled/attr_filter
  284. attr_filter attr_filter.access_reject {
  285. filename = "/etc/freeradius/3.0/mods-config/attr_filter/access_reject"
  286. key = "%{User-Name}"
  287. relaxed = no
  288. }
  289. # Loading module "attr_filter.access_challenge" from file /etc/freeradius/3.0/mods-enabled/attr_filter
  290. attr_filter attr_filter.access_challenge {
  291. filename = "/etc/freeradius/3.0/mods-config/attr_filter/access_challenge"
  292. key = "%{User-Name}"
  293. relaxed = no
  294. }
  295. # Loading module "attr_filter.accounting_response" from file /etc/freeradius/3.0/mods-enabled/attr_filter
  296. attr_filter attr_filter.accounting_response {
  297. filename = "/etc/freeradius/3.0/mods-config/attr_filter/accounting_response"
  298. key = "%{User-Name}"
  299. relaxed = no
  300. }
  301. # Loaded module rlm_preprocess
  302. # Loading module "preprocess" from file /etc/freeradius/3.0/mods-enabled/preprocess
  303. preprocess {
  304. huntgroups = "/etc/freeradius/3.0/mods-config/preprocess/huntgroups"
  305. hints = "/etc/freeradius/3.0/mods-config/preprocess/hints"
  306. with_ascend_hack = no
  307. ascend_channels_per_line = 23
  308. with_ntdomain_hack = no
  309. with_specialix_jetstream_hack = no
  310. with_cisco_vsa_hack = no
  311. with_alvarion_vsa_hack = no
  312. }
  313. # Loaded module rlm_linelog
  314. # Loading module "linelog" from file /etc/freeradius/3.0/mods-enabled/linelog
  315. linelog {
  316. filename = "/var/log/freeradius/linelog"
  317. escape_filenames = no
  318. syslog_severity = "info"
  319. permissions = 384
  320. format = "This is a log message for %{User-Name}"
  321. reference = "messages.%{%{reply:Packet-Type}:-default}"
  322. }
  323. # Loading module "log_accounting" from file /etc/freeradius/3.0/mods-enabled/linelog
  324. linelog log_accounting {
  325. filename = "/var/log/freeradius/linelog-accounting"
  326. escape_filenames = no
  327. syslog_severity = "info"
  328. permissions = 384
  329. format = ""
  330. reference = "Accounting-Request.%{%{Acct-Status-Type}:-unknown}"
  331. }
  332. # Loading module "auth_log" from file /etc/freeradius/3.0/mods-enabled/detail.log
  333. detail auth_log {
  334. filename = "/var/log/freeradius/radacct/%{%{Packet-Src-IP-Address}:-%{Packet-Src-IPv6-Address}}/auth-detail-%Y%m%d"
  335. header = "%t"
  336. permissions = 384
  337. locking = no
  338. escape_filenames = no
  339. log_packet_header = no
  340. }
  341. # Loading module "reply_log" from file /etc/freeradius/3.0/mods-enabled/detail.log
  342. detail reply_log {
  343. filename = "/var/log/freeradius/radacct/%{%{Packet-Src-IP-Address}:-%{Packet-Src-IPv6-Address}}/reply-detail-%Y%m%d"
  344. header = "%t"
  345. permissions = 384
  346. locking = no
  347. escape_filenames = no
  348. log_packet_header = no
  349. }
  350. # Loading module "pre_proxy_log" from file /etc/freeradius/3.0/mods-enabled/detail.log
  351. detail pre_proxy_log {
  352. filename = "/var/log/freeradius/radacct/%{%{Packet-Src-IP-Address}:-%{Packet-Src-IPv6-Address}}/pre-proxy-detail-%Y%m%d"
  353. header = "%t"
  354. permissions = 384
  355. locking = no
  356. escape_filenames = no
  357. log_packet_header = no
  358. }
  359. # Loading module "post_proxy_log" from file /etc/freeradius/3.0/mods-enabled/detail.log
  360. detail post_proxy_log {
  361. filename = "/var/log/freeradius/radacct/%{%{Packet-Src-IP-Address}:-%{Packet-Src-IPv6-Address}}/post-proxy-detail-%Y%m%d"
  362. header = "%t"
  363. permissions = 384
  364. locking = no
  365. escape_filenames = no
  366. log_packet_header = no
  367. }
  368. # Loaded module rlm_expr
  369. # Loading module "expr" from file /etc/freeradius/3.0/mods-enabled/expr
  370. expr {
  371. safe_characters = "@abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ0123456789.-_: /äéöüàâæçèéêëîïôœùûüaÿÄÉÖÜßÀÂÆÇÈÉÊËÎÏÔŒÙÛÜŸ"
  372. }
  373. # Loaded module rlm_mschap
  374. # Loading module "mschap" from file /etc/freeradius/3.0/mods-enabled/mschap
  375. mschap {
  376. use_mppe = yes
  377. require_encryption = no
  378. require_strong = no
  379. with_ntdomain_hack = yes
  380. passchange {
  381. }
  382. allow_retry = yes
  383. }
  384. # Loaded module rlm_unpack
  385. # Loading module "unpack" from file /etc/freeradius/3.0/mods-enabled/unpack
  386. # Loaded module rlm_cache
  387. # Loading module "cache_eap" from file /etc/freeradius/3.0/mods-enabled/cache_eap
  388. cache cache_eap {
  389. driver = "rlm_cache_rbtree"
  390. key = "%{%{control:State}:-%{%{reply:State}:-%{State}}}"
  391. ttl = 15
  392. max_entries = 0
  393. epoch = 0
  394. add_stats = no
  395. }
  396. # Loaded module rlm_utf8
  397. # Loading module "utf8" from file /etc/freeradius/3.0/mods-enabled/utf8
  398. # Loaded module rlm_expiration
  399. # Loading module "expiration" from file /etc/freeradius/3.0/mods-enabled/expiration
  400. # Loaded module rlm_realm
  401. # Loading module "IPASS" from file /etc/freeradius/3.0/mods-enabled/realm
  402. realm IPASS {
  403. format = "prefix"
  404. delimiter = "/"
  405. ignore_default = no
  406. ignore_null = no
  407. }
  408. # Loading module "suffix" from file /etc/freeradius/3.0/mods-enabled/realm
  409. realm suffix {
  410. format = "suffix"
  411. delimiter = "@"
  412. ignore_default = no
  413. ignore_null = no
  414. }
  415. # Loading module "realmpercent" from file /etc/freeradius/3.0/mods-enabled/realm
  416. realm realmpercent {
  417. format = "suffix"
  418. delimiter = "%"
  419. ignore_default = no
  420. ignore_null = no
  421. }
  422. # Loading module "ntdomain" from file /etc/freeradius/3.0/mods-enabled/realm
  423. realm ntdomain {
  424. format = "prefix"
  425. delimiter = "\\"
  426. ignore_default = no
  427. ignore_null = no
  428. }
  429. # Loaded module rlm_always
  430. # Loading module "reject" from file /etc/freeradius/3.0/mods-enabled/always
  431. always reject {
  432. rcode = "reject"
  433. simulcount = 0
  434. mpp = no
  435. }
  436. # Loading module "fail" from file /etc/freeradius/3.0/mods-enabled/always
  437. always fail {
  438. rcode = "fail"
  439. simulcount = 0
  440. mpp = no
  441. }
  442. # Loading module "ok" from file /etc/freeradius/3.0/mods-enabled/always
  443. always ok {
  444. rcode = "ok"
  445. simulcount = 0
  446. mpp = no
  447. }
  448. # Loading module "handled" from file /etc/freeradius/3.0/mods-enabled/always
  449. always handled {
  450. rcode = "handled"
  451. simulcount = 0
  452. mpp = no
  453. }
  454. # Loading module "invalid" from file /etc/freeradius/3.0/mods-enabled/always
  455. always invalid {
  456. rcode = "invalid"
  457. simulcount = 0
  458. mpp = no
  459. }
  460. # Loading module "userlock" from file /etc/freeradius/3.0/mods-enabled/always
  461. always userlock {
  462. rcode = "userlock"
  463. simulcount = 0
  464. mpp = no
  465. }
  466. # Loading module "notfound" from file /etc/freeradius/3.0/mods-enabled/always
  467. always notfound {
  468. rcode = "notfound"
  469. simulcount = 0
  470. mpp = no
  471. }
  472. # Loading module "noop" from file /etc/freeradius/3.0/mods-enabled/always
  473. always noop {
  474. rcode = "noop"
  475. simulcount = 0
  476. mpp = no
  477. }
  478. # Loading module "updated" from file /etc/freeradius/3.0/mods-enabled/always
  479. always updated {
  480. rcode = "updated"
  481. simulcount = 0
  482. mpp = no
  483. }
  484. # Loaded module rlm_replicate
  485. # Loading module "replicate" from file /etc/freeradius/3.0/mods-enabled/replicate
  486. # Loading module "sradutmp" from file /etc/freeradius/3.0/mods-enabled/sradutmp
  487. radutmp sradutmp {
  488. filename = "/var/log/freeradius/sradutmp"
  489. username = "%{User-Name}"
  490. case_sensitive = yes
  491. check_with_nas = yes
  492. permissions = 420
  493. caller_id = no
  494. }
  495. # Loaded module rlm_eap
  496. # Loading module "eap" from file /etc/freeradius/3.0/mods-enabled/eap
  497. eap {
  498. default_eap_type = "md5"
  499. timer_expire = 60
  500. ignore_unknown_eap_types = no
  501. cisco_accounting_username_bug = no
  502. max_sessions = 16384
  503. }
  504. # Loaded module rlm_unix
  505. # Loading module "unix" from file /etc/freeradius/3.0/mods-enabled/unix
  506. unix {
  507. radwtmp = "/var/log/freeradius/radwtmp"
  508. }
  509. Creating attribute Unix-Group
  510. # Loaded module rlm_soh
  511. # Loading module "soh" from file /etc/freeradius/3.0/mods-enabled/soh
  512. soh {
  513. dhcp = yes
  514. }
  515. # Loaded module rlm_pap
  516. # Loading module "pap" from file /etc/freeradius/3.0/mods-enabled/pap
  517. pap {
  518. normalise = yes
  519. }
  520. instantiate {
  521. }
  522. # Instantiating module "files" from file /etc/freeradius/3.0/mods-enabled/files
  523. reading pairlist file /etc/freeradius/3.0/mods-config/files/authorize
  524. reading pairlist file /etc/freeradius/3.0/mods-config/files/accounting
  525. reading pairlist file /etc/freeradius/3.0/mods-config/files/pre-proxy
  526. # Instantiating module "authorized_macs" from file /etc/freeradius/3.0/mods-enabled/files
  527. reading pairlist file /etc/freeradius/3.0/authorized_macs
  528. # Instantiating module "detail" from file /etc/freeradius/3.0/mods-enabled/detail
  529. # Instantiating module "logintime" from file /etc/freeradius/3.0/mods-enabled/logintime
  530. # Instantiating module "etc_passwd" from file /etc/freeradius/3.0/mods-enabled/passwd
  531. rlm_passwd: nfields: 3 keyfield 0(User-Name) listable: no
  532. # Instantiating module "attr_filter.post-proxy" from file /etc/freeradius/3.0/mods-enabled/attr_filter
  533. reading pairlist file /etc/freeradius/3.0/mods-config/attr_filter/post-proxy
  534. # Instantiating module "attr_filter.pre-proxy" from file /etc/freeradius/3.0/mods-enabled/attr_filter
  535. reading pairlist file /etc/freeradius/3.0/mods-config/attr_filter/pre-proxy
  536. # Instantiating module "attr_filter.access_reject" from file /etc/freeradius/3.0/mods-enabled/attr_filter
  537. reading pairlist file /etc/freeradius/3.0/mods-config/attr_filter/access_reject
  538. [/etc/freeradius/3.0/mods-config/attr_filter/access_reject]:11 Check item "FreeRADIUS-Response-Delay" found in filter list for realm "DEFAULT".
  539. [/etc/freeradius/3.0/mods-config/attr_filter/access_reject]:11 Check item "FreeRADIUS-Response-Delay-USec" found in filter list for realm "DEFAULT".
  540. # Instantiating module "attr_filter.access_challenge" from file /etc/freeradius/3.0/mods-enabled/attr_filter
  541. reading pairlist file /etc/freeradius/3.0/mods-config/attr_filter/access_challenge
  542. # Instantiating module "attr_filter.accounting_response" from file /etc/freeradius/3.0/mods-enabled/attr_filter
  543. reading pairlist file /etc/freeradius/3.0/mods-config/attr_filter/accounting_response
  544. # Instantiating module "preprocess" from file /etc/freeradius/3.0/mods-enabled/preprocess
  545. reading pairlist file /etc/freeradius/3.0/mods-config/preprocess/huntgroups
  546. reading pairlist file /etc/freeradius/3.0/mods-config/preprocess/hints
  547. # Instantiating module "linelog" from file /etc/freeradius/3.0/mods-enabled/linelog
  548. # Instantiating module "log_accounting" from file /etc/freeradius/3.0/mods-enabled/linelog
  549. # Instantiating module "auth_log" from file /etc/freeradius/3.0/mods-enabled/detail.log
  550. rlm_detail (auth_log): 'User-Password' suppressed, will not appear in detail output
  551. # Instantiating module "reply_log" from file /etc/freeradius/3.0/mods-enabled/detail.log
  552. # Instantiating module "pre_proxy_log" from file /etc/freeradius/3.0/mods-enabled/detail.log
  553. # Instantiating module "post_proxy_log" from file /etc/freeradius/3.0/mods-enabled/detail.log
  554. # Instantiating module "mschap" from file /etc/freeradius/3.0/mods-enabled/mschap
  555. rlm_mschap (mschap): using internal authentication
  556. # Instantiating module "cache_eap" from file /etc/freeradius/3.0/mods-enabled/cache_eap
  557. rlm_cache (cache_eap): Driver rlm_cache_rbtree (module rlm_cache_rbtree) loaded and linked
  558. # Instantiating module "expiration" from file /etc/freeradius/3.0/mods-enabled/expiration
  559. # Instantiating module "IPASS" from file /etc/freeradius/3.0/mods-enabled/realm
  560. # Instantiating module "suffix" from file /etc/freeradius/3.0/mods-enabled/realm
  561. # Instantiating module "realmpercent" from file /etc/freeradius/3.0/mods-enabled/realm
  562. # Instantiating module "ntdomain" from file /etc/freeradius/3.0/mods-enabled/realm
  563. # Instantiating module "reject" from file /etc/freeradius/3.0/mods-enabled/always
  564. # Instantiating module "fail" from file /etc/freeradius/3.0/mods-enabled/always
  565. # Instantiating module "ok" from file /etc/freeradius/3.0/mods-enabled/always
  566. # Instantiating module "handled" from file /etc/freeradius/3.0/mods-enabled/always
  567. # Instantiating module "invalid" from file /etc/freeradius/3.0/mods-enabled/always
  568. # Instantiating module "userlock" from file /etc/freeradius/3.0/mods-enabled/always
  569. # Instantiating module "notfound" from file /etc/freeradius/3.0/mods-enabled/always
  570. # Instantiating module "noop" from file /etc/freeradius/3.0/mods-enabled/always
  571. # Instantiating module "updated" from file /etc/freeradius/3.0/mods-enabled/always
  572. # Instantiating module "eap" from file /etc/freeradius/3.0/mods-enabled/eap
  573. # Linked to sub-module rlm_eap_md5
  574. # Linked to sub-module rlm_eap_leap
  575. # Linked to sub-module rlm_eap_gtc
  576. gtc {
  577. challenge = "Password: "
  578. auth_type = "PAP"
  579. }
  580. # Linked to sub-module rlm_eap_tls
  581. tls {
  582. tls = "tls-common"
  583. }
  584. tls-config tls-common {
  585. verify_depth = 0
  586. ca_path = "/etc/freeradius/3.0/certs"
  587. pem_file_type = yes
  588. private_key_file = "/etc/ssl/private/ssl-cert-snakeoil.key"
  589. certificate_file = "/etc/ssl/certs/ssl-cert-snakeoil.pem"
  590. ca_file = "/etc/ssl/certs/ca-certificates.crt"
  591. private_key_password = <<< secret >>>
  592. dh_file = "/etc/freeradius/3.0/certs/dh"
  593. fragment_size = 1024
  594. include_length = yes
  595. auto_chain = yes
  596. check_crl = no
  597. check_all_crl = no
  598. cipher_list = "DEFAULT"
  599. ecdh_curve = "prime256v1"
  600. cache {
  601. enable = yes
  602. lifetime = 24
  603. max_entries = 255
  604. }
  605. verify {
  606. skip_if_ocsp_ok = no
  607. }
  608. ocsp {
  609. enable = no
  610. override_cert_url = yes
  611. url = "http://127.0.0.1/ocsp/"
  612. use_nonce = yes
  613. timeout = 0
  614. softfail = no
  615. }
  616. }
  617. # Linked to sub-module rlm_eap_ttls
  618. ttls {
  619. tls = "tls-common"
  620. default_eap_type = "md5"
  621. copy_request_to_tunnel = no
  622. use_tunneled_reply = no
  623. virtual_server = "inner-tunnel"
  624. include_length = yes
  625. require_client_cert = no
  626. }
  627. tls: Using cached TLS configuration from previous invocation
  628. # Linked to sub-module rlm_eap_peap
  629. peap {
  630. tls = "tls-common"
  631. default_eap_type = "mschapv2"
  632. copy_request_to_tunnel = no
  633. use_tunneled_reply = no
  634. proxy_tunneled_request_as_eap = yes
  635. virtual_server = "inner-tunnel"
  636. soh = no
  637. require_client_cert = no
  638. }
  639. tls: Using cached TLS configuration from previous invocation
  640. # Linked to sub-module rlm_eap_mschapv2
  641. mschapv2 {
  642. with_ntdomain_hack = no
  643. send_error = no
  644. }
  645. # Instantiating module "pap" from file /etc/freeradius/3.0/mods-enabled/pap
  646. } # modules
  647. radiusd: #### Loading Virtual Servers ####
  648. server { # from file /etc/freeradius/3.0/sites-enabled/default
  649. # Loading authorize {...}
  650. } # server
  651. server inner-tunnel { # from file /etc/freeradius/3.0/sites-enabled/inner-tunnel
  652. # Loading authenticate {...}
  653. # Loading authorize {...}
  654. Ignoring "sql" (see raddb/mods-available/README.rst)
  655. Ignoring "ldap" (see raddb/mods-available/README.rst)
  656. # Loading session {...}
  657. # Loading post-proxy {...}
  658. # Loading post-auth {...}
  659. } # server inner-tunnel
  660. server default { # from file /etc/freeradius/3.0/sites-enabled/default
  661. # Loading authenticate {...}
  662. # Loading authorize {...}
  663. # Loading preacct {...}
  664. # Loading accounting {...}
  665. # Loading post-proxy {...}
  666. # Loading post-auth {...}
  667. } # server default
  668. radiusd: #### Opening IP addresses and Ports ####
  669. listen {
  670. type = "auth"
  671. ipaddr = 127.0.0.1
  672. port = 18120
  673. }
  674. listen {
  675. type = "auth"
  676. ipaddr = *
  677. port = 0
  678. limit {
  679. max_connections = 16
  680. lifetime = 0
  681. idle_timeout = 30
  682. }
  683. }
  684. listen {
  685. type = "acct"
  686. ipaddr = *
  687. port = 0
  688. limit {
  689. max_connections = 16
  690. lifetime = 0
  691. idle_timeout = 30
  692. }
  693. }
  694. listen {
  695. type = "auth"
  696. ipv6addr = ::
  697. port = 0
  698. limit {
  699. max_connections = 16
  700. lifetime = 0
  701. idle_timeout = 30
  702. }
  703. }
  704. listen {
  705. type = "acct"
  706. ipv6addr = ::
  707. port = 0
  708. limit {
  709. max_connections = 16
  710. lifetime = 0
  711. idle_timeout = 30
  712. }
  713. }
  714. Listening on auth address 127.0.0.1 port 18120 bound to server inner-tunnel
  715. Listening on auth address * port 1812 bound to server default
  716. Listening on acct address * port 1813 bound to server default
  717. Listening on auth address :: port 1812 bound to server default
  718. Listening on acct address :: port 1813 bound to server default
  719. Listening on proxy address * port 38361
  720. Listening on proxy address :: port 35835
  721. Ready to process requests
  722.  
  723.  
  724.  
  725.  
  726. (0) Received Access-Request Id 7 from 10.42.0.22:50057 to 10.42.0.7:1812 length 280
  727. (0) User-Name = "1A:2B:3C:4D:5E:6F"
  728. (0) User-Password = "1A:2B:3C:4D:5E:6F"
  729. (0) NAS-IP-Address = 10.42.0.22
  730. (0) NAS-Identifier = "XX-XX-XX-XX-XX-XX"
  731. (0) Called-Station-Id = "XX-XX-XX-XX-XX-XX:testtt"
  732. (0) Calling-Station-Id = "1A-2B-3C-4D-5E-6F"
  733. (0) Service-Type = Framed-User
  734. (0) NAS-Port-Type = Wireless-802.11
  735. (0) Ruckus-SSID = "testtt"
  736. (0) Ruckus-BSSID = 0xf8e71e39954c
  737. (0) Ruckus-Wlan-Id = 63
  738. (0) Ruckus-VLAN-ID = 1
  739. (0) Ruckus-SCG-CBlade-IP = 1476323384
  740. (0) Ruckus-Zone-Name = "Event"
  741. (0) Attr-26.25053.154 = 0x4e6574636f76535a
  742. (0) Ruckus-Wlan-Name = "testtt"
  743. (0) Message-Authenticator = 0xba28c539b55b127ac68f227093a5a07c
  744. (0) # Executing section authorize from file /etc/freeradius/3.0/sites-enabled/default
  745. (0) authorize {
  746. (0) policy filter_username {
  747. (0) if (&User-Name) {
  748. (0) if (&User-Name) -> TRUE
  749. (0) if (&User-Name) {
  750. (0) if (&User-Name =~ / /) {
  751. (0) if (&User-Name =~ / /) -> FALSE
  752. (0) if (&User-Name =~ /@[^@]*@/ ) {
  753. (0) if (&User-Name =~ /@[^@]*@/ ) -> FALSE
  754. (0) if (&User-Name =~ /\.\./ ) {
  755. (0) if (&User-Name =~ /\.\./ ) -> FALSE
  756. (0) if ((&User-Name =~ /@/) && (&User-Name !~ /@(.+)\.(.+)$/)) {
  757. (0) if ((&User-Name =~ /@/) && (&User-Name !~ /@(.+)\.(.+)$/)) -> FALSE
  758. (0) if (&User-Name =~ /\.$/) {
  759. (0) if (&User-Name =~ /\.$/) -> FALSE
  760. (0) if (&User-Name =~ /@\./) {
  761. (0) if (&User-Name =~ /@\./) -> FALSE
  762. (0) } # if (&User-Name) = notfound
  763. (0) } # policy filter_username = notfound
  764. (0) [preprocess] = ok
  765. (0) [chap] = noop
  766. (0) [mschap] = noop
  767. (0) [digest] = noop
  768. (0) suffix: Checking for suffix after "@"
  769. (0) suffix: No '@' in User-Name = "1A:2B:3C:4D:5E:6F", looking up realm NULL
  770. (0) suffix: No such realm "NULL"
  771. (0) [suffix] = noop
  772. (0) eap: No EAP-Message, not doing EAP
  773. (0) [eap] = noop
  774. (0) [files] = noop
  775. (0) [expiration] = noop
  776. (0) [logintime] = noop
  777. (0) pap: WARNING: No "known good" password found for the user. Not setting Auth-Type
  778. (0) pap: WARNING: Authentication will fail unless a "known good" password is available
  779. (0) [pap] = noop
  780. (0) } # authorize = ok
  781. (0) ERROR: No Auth-Type found: rejecting the user via Post-Auth-Type = Reject
  782. (0) Failed to authenticate the user
  783. (0) Using Post-Auth-Type Reject
  784. (0) # Executing group from file /etc/freeradius/3.0/sites-enabled/default
  785. (0) Post-Auth-Type REJECT {
  786. (0) attr_filter.access_reject: EXPAND %{User-Name}
  787. (0) attr_filter.access_reject: --> 1A:2B:3C:4D:5E:6F
  788. (0) attr_filter.access_reject: Matched entry DEFAULT at line 11
  789. (0) [attr_filter.access_reject] = updated
  790. (0) [eap] = noop
  791. (0) policy remove_reply_message_if_eap {
  792. (0) if (&reply:EAP-Message && &reply:Reply-Message) {
  793. (0) if (&reply:EAP-Message && &reply:Reply-Message) -> FALSE
  794. (0) else {
  795. (0) [noop] = noop
  796. (0) } # else = noop
  797. (0) } # policy remove_reply_message_if_eap = noop
  798. (0) } # Post-Auth-Type REJECT = updated
  799. (0) Delaying response for 1.000000 seconds
  800. Waking up in 0.3 seconds.
  801. Waking up in 0.6 seconds.
  802. (0) Sending delayed response
  803. (0) Sent Access-Reject Id 7 from 10.42.0.7:1812 to 10.42.0.22:50057 length 20
  804. Waking up in 3.9 seconds.
  805. (0) Cleaning up request packet ID 7 with timestamp +9
  806. Ready to process requests
  807. (1) Received Access-Request Id 6 from 10.42.0.22:32889 to 10.42.0.7:1812 length 280
  808. (1) User-Name = "1A:2B:3C:4D:5E:6F"
  809. (1) User-Password = "1A:2B:3C:4D:5E:6F"
  810. (1) NAS-IP-Address = 10.42.0.22
  811. (1) NAS-Identifier = "YY-YY-YY-YY-YY-YY"
  812. (1) Called-Station-Id = "YY-YY-YY-YY-YY-YY:testtt"
  813. (1) Calling-Station-Id = "1A-2B-3C-4D-5E-6F"
  814. (1) Service-Type = Framed-User
  815. (1) NAS-Port-Type = Wireless-802.11
  816. (1) Ruckus-SSID = "testtt"
  817. (1) Ruckus-BSSID = 0xf8e71e399548
  818. (1) Ruckus-Wlan-Id = 63
  819. (1) Ruckus-VLAN-ID = 1
  820. (1) Ruckus-SCG-CBlade-IP = 1476323384
  821. (1) Ruckus-Zone-Name = "Event"
  822. (1) Attr-26.25053.154 = 0x4e6574636f76535a
  823. (1) Ruckus-Wlan-Name = "testtt"
  824. (1) Message-Authenticator = 0x7262ece96e977691f00cd75479fa1c80
  825. (1) # Executing section authorize from file /etc/freeradius/3.0/sites-enabled/default
  826. (1) authorize {
  827. (1) policy filter_username {
  828. (1) if (&User-Name) {
  829. (1) if (&User-Name) -> TRUE
  830. (1) if (&User-Name) {
  831. (1) if (&User-Name =~ / /) {
  832. (1) if (&User-Name =~ / /) -> FALSE
  833. (1) if (&User-Name =~ /@[^@]*@/ ) {
  834. (1) if (&User-Name =~ /@[^@]*@/ ) -> FALSE
  835. (1) if (&User-Name =~ /\.\./ ) {
  836. (1) if (&User-Name =~ /\.\./ ) -> FALSE
  837. (1) if ((&User-Name =~ /@/) && (&User-Name !~ /@(.+)\.(.+)$/)) {
  838. (1) if ((&User-Name =~ /@/) && (&User-Name !~ /@(.+)\.(.+)$/)) -> FALSE
  839. (1) if (&User-Name =~ /\.$/) {
  840. (1) if (&User-Name =~ /\.$/) -> FALSE
  841. (1) if (&User-Name =~ /@\./) {
  842. (1) if (&User-Name =~ /@\./) -> FALSE
  843. (1) } # if (&User-Name) = notfound
  844. (1) } # policy filter_username = notfound
  845. (1) [preprocess] = ok
  846. (1) [chap] = noop
  847. (1) [mschap] = noop
  848. (1) [digest] = noop
  849. (1) suffix: Checking for suffix after "@"
  850. (1) suffix: No '@' in User-Name = "1A:2B:3C:4D:5E:6F", looking up realm NULL
  851. (1) suffix: No such realm "NULL"
  852. (1) [suffix] = noop
  853. (1) eap: No EAP-Message, not doing EAP
  854. (1) [eap] = noop
  855. (1) [files] = noop
  856. (1) [expiration] = noop
  857. (1) [logintime] = noop
  858. (1) pap: WARNING: No "known good" password found for the user. Not setting Auth-Type
  859. (1) pap: WARNING: Authentication will fail unless a "known good" password is available
  860. (1) [pap] = noop
  861. (1) } # authorize = ok
  862. (1) ERROR: No Auth-Type found: rejecting the user via Post-Auth-Type = Reject
  863. (1) Failed to authenticate the user
  864. (1) Using Post-Auth-Type Reject
  865. (1) # Executing group from file /etc/freeradius/3.0/sites-enabled/default
  866. (1) Post-Auth-Type REJECT {
  867. (1) attr_filter.access_reject: EXPAND %{User-Name}
  868. (1) attr_filter.access_reject: --> 1A:2B:3C:4D:5E:6F
  869. (1) attr_filter.access_reject: Matched entry DEFAULT at line 11
  870. (1) [attr_filter.access_reject] = updated
  871. (1) [eap] = noop
  872. (1) policy remove_reply_message_if_eap {
  873. (1) if (&reply:EAP-Message && &reply:Reply-Message) {
  874. (1) if (&reply:EAP-Message && &reply:Reply-Message) -> FALSE
  875. (1) else {
  876. (1) [noop] = noop
  877. (1) } # else = noop
  878. (1) } # policy remove_reply_message_if_eap = noop
  879. (1) } # Post-Auth-Type REJECT = updated
  880. (1) Delaying response for 1.000000 seconds
  881. Waking up in 0.3 seconds.
  882. Waking up in 0.6 seconds.
  883. (1) Sending delayed response
  884. (1) Sent Access-Reject Id 6 from 10.42.0.7:1812 to 10.42.0.22:32889 length 20
  885. Waking up in 3.9 seconds.
  886. (1) Cleaning up request packet ID 6 with timestamp +15
  887. Ready to process requests
Advertisement
Add Comment
Please, Sign In to add comment
Public Pastes
We use cookies for various purposes including analytics. By continuing to use Pastebin, you agree to our use of cookies as described in the Cookies Policy.  OK, I Understand
Not a member of Pastebin yet?
Sign Up, it unlocks many cool features!