|
1
|
FreeRADIUS Version 3.0.22
|
|
2
|
Copyright (C) 1999-2021 The FreeRADIUS server project and contributors
|
|
3
|
There is NO warranty; not even for MERCHANTABILITY or FITNESS FOR A
|
|
4
|
PARTICULAR PURPOSE
|
|
5
|
You may redistribute copies of FreeRADIUS under the terms of the
|
|
6
|
GNU General Public License
|
|
7
|
For more information about these matters, see the file named COPYRIGHT
|
|
8
|
Starting - reading configuration files ...
|
|
9
|
including dictionary file /usr/local/share/freeradius/dictionary
|
|
10
|
including dictionary file /usr/local/share/freeradius/dictionary.dhcp
|
|
11
|
including dictionary file /usr/local/share/freeradius/dictionary.vqp
|
|
12
|
including dictionary file /usr/local/etc/raddb/dictionary
|
|
13
|
including configuration file /usr/local/etc/raddb/radiusd.conf
|
|
14
|
including configuration file /usr/local/etc/raddb/clients.conf
|
|
15
|
including files in directory /usr/local/etc/raddb/mods-enabled/
|
|
16
|
including configuration file /usr/local/etc/raddb/mods-enabled/attr_filter
|
|
17
|
including configuration file /usr/local/etc/raddb/mods-enabled/cache_eap
|
|
18
|
including configuration file /usr/local/etc/raddb/mods-enabled/chap
|
|
19
|
including configuration file /usr/local/etc/raddb/mods-enabled/date
|
|
20
|
including configuration file /usr/local/etc/raddb/mods-enabled/detail
|
|
21
|
including configuration file /usr/local/etc/raddb/mods-enabled/detail.log
|
|
22
|
including configuration file /usr/local/etc/raddb/mods-enabled/digest
|
|
23
|
including configuration file /usr/local/etc/raddb/mods-enabled/dynamic_clients
|
|
24
|
including configuration file /usr/local/etc/raddb/mods-enabled/eap
|
|
25
|
including configuration file /usr/local/etc/raddb/mods-enabled/echo
|
|
26
|
including configuration file /usr/local/etc/raddb/mods-enabled/exec
|
|
27
|
including configuration file /usr/local/etc/raddb/mods-enabled/expiration
|
|
28
|
including configuration file /usr/local/etc/raddb/mods-enabled/expr
|
|
29
|
including configuration file /usr/local/etc/raddb/mods-enabled/files
|
|
30
|
including configuration file /usr/local/etc/raddb/mods-enabled/linelog
|
|
31
|
including configuration file /usr/local/etc/raddb/mods-enabled/logintime
|
|
32
|
including configuration file /usr/local/etc/raddb/mods-enabled/mschap
|
|
33
|
including configuration file /usr/local/etc/raddb/mods-enabled/realm
|
|
34
|
including configuration file /usr/local/etc/raddb/mods-enabled/pap
|
|
35
|
including configuration file /usr/local/etc/raddb/mods-enabled/passwd
|
|
36
|
including configuration file /usr/local/etc/raddb/mods-enabled/preprocess
|
|
37
|
including configuration file /usr/local/etc/raddb/mods-enabled/radutmp
|
|
38
|
including configuration file /usr/local/etc/raddb/mods-enabled/sql
|
|
39
|
including configuration file /usr/local/etc/raddb/mods-config/sql/main/mysql/queries.conf
|
|
40
|
including configuration file /usr/local/etc/raddb/mods-enabled/replicate
|
|
41
|
including configuration file /usr/local/etc/raddb/mods-enabled/soh
|
|
42
|
including configuration file /usr/local/etc/raddb/mods-enabled/sradutmp
|
|
43
|
including configuration file /usr/local/etc/raddb/mods-enabled/unix
|
|
44
|
including configuration file /usr/local/etc/raddb/mods-enabled/unpack
|
|
45
|
including configuration file /usr/local/etc/raddb/mods-enabled/utf8
|
|
46
|
including configuration file /usr/local/etc/raddb/mods-enabled/always
|
|
47
|
including configuration file /usr/local/etc/raddb/mods-enabled/motp
|
|
48
|
including configuration file /usr/local/etc/raddb/mods-enabled/googleauth
|
|
49
|
including configuration file /usr/local/etc/raddb/mods-enabled/datacounter_acct
|
|
50
|
including configuration file /usr/local/etc/raddb/mods-enabled/sqlcounter
|
|
51
|
including configuration file /usr/local/etc/raddb/mods-config/sql/counter/mysql/dailycounter.conf
|
|
52
|
including configuration file /usr/local/etc/raddb/mods-config/sql/counter/mysql/monthlycounter.conf
|
|
53
|
including configuration file /usr/local/etc/raddb/mods-config/sql/counter/mysql/noresetcounter.conf
|
|
54
|
including configuration file /usr/local/etc/raddb/mods-config/sql/counter/mysql/expire_on_login.conf
|
|
55
|
including files in directory /usr/local/etc/raddb/policy.d/
|
|
56
|
including configuration file /usr/local/etc/raddb/policy.d/accounting
|
|
57
|
including configuration file /usr/local/etc/raddb/policy.d/canonicalization
|
|
58
|
including configuration file /usr/local/etc/raddb/policy.d/control
|
|
59
|
including configuration file /usr/local/etc/raddb/policy.d/cui
|
|
60
|
including configuration file /usr/local/etc/raddb/policy.d/debug
|
|
61
|
including configuration file /usr/local/etc/raddb/policy.d/dhcp
|
|
62
|
including configuration file /usr/local/etc/raddb/policy.d/eap
|
|
63
|
including configuration file /usr/local/etc/raddb/policy.d/filter
|
|
64
|
including configuration file /usr/local/etc/raddb/policy.d/moonshot-targeted-ids
|
|
65
|
including configuration file /usr/local/etc/raddb/policy.d/operator-name
|
|
66
|
including configuration file /usr/local/etc/raddb/policy.d/rfc7542
|
|
67
|
including configuration file /usr/local/etc/raddb/policy.d/abfab-tr
|
|
68
|
including configuration file /usr/local/etc/raddb/policy.d/pfs_custom_policies
|
|
69
|
including files in directory /usr/local/etc/raddb/sites-enabled/
|
|
70
|
including configuration file /usr/local/etc/raddb/sites-enabled/default
|
|
71
|
including configuration file /usr/local/etc/raddb/sites-enabled/inner-tunnel-ttls
|
|
72
|
including configuration file /usr/local/etc/raddb/sites-enabled/inner-tunnel-peap
|
|
73
|
main {
|
|
74
|
security {
|
|
75
|
allow_core_dumps = no
|
|
76
|
}
|
|
77
|
name = "radiusd"
|
|
78
|
prefix = "/usr/local"
|
|
79
|
localstatedir = "/var"
|
|
80
|
logdir = "/var/log"
|
|
81
|
run_dir = "/var/run"
|
|
82
|
}
|
|
83
|
main {
|
|
84
|
name = "radiusd"
|
|
85
|
prefix = "/usr/local"
|
|
86
|
localstatedir = "/var"
|
|
87
|
sbindir = "/usr/local/sbin"
|
|
88
|
logdir = "/var/log"
|
|
89
|
run_dir = "/var/run"
|
|
90
|
libdir = "/usr/local/lib/freeradius-3.0.22"
|
|
91
|
radacctdir = "/var/log/radacct"
|
|
92
|
hostname_lookups = no
|
|
93
|
max_request_time = 30
|
|
94
|
cleanup_delay = 5
|
|
95
|
max_requests = 1024
|
|
96
|
pidfile = "/var/run/radiusd.pid"
|
|
97
|
checkrad = "/usr/local/sbin/checkrad"
|
|
98
|
debug_level = 0
|
|
99
|
proxy_requests = yes
|
|
100
|
log {
|
|
101
|
stripped_names = no
|
|
102
|
auth = yes
|
|
103
|
auth_badpass = no
|
|
104
|
auth_goodpass = no
|
|
105
|
msg_badpass = ""
|
|
106
|
msg_goodpass = ""
|
|
107
|
colourise = yes
|
|
108
|
msg_denied = "You are already logged in - access denied"
|
|
109
|
}
|
|
110
|
resources {
|
|
111
|
}
|
|
112
|
security {
|
|
113
|
max_attributes = 200
|
|
114
|
reject_delay = 1.000000
|
|
115
|
status_server = no
|
|
116
|
}
|
|
117
|
}
|
|
118
|
radiusd: #### Loading Realms and Home Servers ####
|
|
119
|
radiusd: #### Loading Clients ####
|
|
120
|
client pfsense {
|
|
121
|
ipaddr = 127.0.0.1
|
|
122
|
require_message_authenticator = no
|
|
123
|
secret = <<< secret >>>
|
|
124
|
shortname = "pfsense"
|
|
125
|
limit {
|
|
126
|
max_connections = 16
|
|
127
|
lifetime = 0
|
|
128
|
idle_timeout = 30
|
|
129
|
}
|
|
130
|
}
|
|
131
|
Debugger not attached
|
|
132
|
# Creating Auth-Type = mschap
|
|
133
|
# Creating Auth-Type = digest
|
|
134
|
# Creating Auth-Type = eap
|
|
135
|
# Creating Auth-Type = PAP
|
|
136
|
# Creating Auth-Type = CHAP
|
|
137
|
# Creating Auth-Type = MS-CHAP
|
|
138
|
# Creating Auth-Type = MOTP
|
|
139
|
# Creating Auth-Type = GOOGLEAUTH
|
|
140
|
# Creating Autz-Type = Status-Server
|
|
141
|
# Creating Acct-Type = Status-Server
|
|
142
|
radiusd: #### Instantiating modules ####
|
|
143
|
modules {
|
|
144
|
# Loaded module rlm_attr_filter
|
|
145
|
# Loading module "attr_filter.post-proxy" from file /usr/local/etc/raddb/mods-enabled/attr_filter
|
|
146
|
attr_filter attr_filter.post-proxy {
|
|
147
|
filename = "/usr/local/etc/raddb/mods-config/attr_filter/post-proxy"
|
|
148
|
key = "%{Realm}"
|
|
149
|
relaxed = no
|
|
150
|
}
|
|
151
|
# Loading module "attr_filter.pre-proxy" from file /usr/local/etc/raddb/mods-enabled/attr_filter
|
|
152
|
attr_filter attr_filter.pre-proxy {
|
|
153
|
filename = "/usr/local/etc/raddb/mods-config/attr_filter/pre-proxy"
|
|
154
|
key = "%{Realm}"
|
|
155
|
relaxed = no
|
|
156
|
}
|
|
157
|
# Loading module "attr_filter.access_reject" from file /usr/local/etc/raddb/mods-enabled/attr_filter
|
|
158
|
attr_filter attr_filter.access_reject {
|
|
159
|
filename = "/usr/local/etc/raddb/mods-config/attr_filter/access_reject"
|
|
160
|
key = "%{User-Name}"
|
|
161
|
relaxed = no
|
|
162
|
}
|
|
163
|
# Loading module "attr_filter.access_challenge" from file /usr/local/etc/raddb/mods-enabled/attr_filter
|
|
164
|
attr_filter attr_filter.access_challenge {
|
|
165
|
filename = "/usr/local/etc/raddb/mods-config/attr_filter/access_challenge"
|
|
166
|
key = "%{User-Name}"
|
|
167
|
relaxed = no
|
|
168
|
}
|
|
169
|
# Loading module "attr_filter.accounting_response" from file /usr/local/etc/raddb/mods-enabled/attr_filter
|
|
170
|
attr_filter attr_filter.accounting_response {
|
|
171
|
filename = "/usr/local/etc/raddb/mods-config/attr_filter/accounting_response"
|
|
172
|
key = "%{User-Name}"
|
|
173
|
relaxed = no
|
|
174
|
}
|
|
175
|
# Loading module "attr_filter.coa" from file /usr/local/etc/raddb/mods-enabled/attr_filter
|
|
176
|
attr_filter attr_filter.coa {
|
|
177
|
filename = "/usr/local/etc/raddb/mods-config/attr_filter/coa"
|
|
178
|
key = "%{User-Name}"
|
|
179
|
relaxed = no
|
|
180
|
}
|
|
181
|
# Loaded module rlm_cache
|
|
182
|
# Loading module "cache_eap" from file /usr/local/etc/raddb/mods-enabled/cache_eap
|
|
183
|
cache cache_eap {
|
|
184
|
driver = "rlm_cache_rbtree"
|
|
185
|
key = "%{%{control:State}:-%{%{reply:State}:-%{State}}}"
|
|
186
|
ttl = 15
|
|
187
|
max_entries = 0
|
|
188
|
epoch = 0
|
|
189
|
add_stats = no
|
|
190
|
}
|
|
191
|
# Loaded module rlm_chap
|
|
192
|
# Loading module "chap" from file /usr/local/etc/raddb/mods-enabled/chap
|
|
193
|
# Loaded module rlm_date
|
|
194
|
# Loading module "date" from file /usr/local/etc/raddb/mods-enabled/date
|
|
195
|
date {
|
|
196
|
format = "%b %e %Y %H:%M:%S %Z"
|
|
197
|
utc = no
|
|
198
|
}
|
|
199
|
# Loading module "wispr2date" from file /usr/local/etc/raddb/mods-enabled/date
|
|
200
|
date wispr2date {
|
|
201
|
format = "%Y-%m-%dT%H:%M:%S"
|
|
202
|
utc = no
|
|
203
|
}
|
|
204
|
# Loaded module rlm_detail
|
|
205
|
# Loading module "detail" from file /usr/local/etc/raddb/mods-enabled/detail
|
|
206
|
detail {
|
|
207
|
filename = "/var/log/radacct/%{%{Packet-Src-IP-Address}:-%{Packet-Src-IPv6-Address}}/detail-%Y%m%d"
|
|
208
|
header = "%t"
|
|
209
|
permissions = 384
|
|
210
|
locking = no
|
|
211
|
escape_filenames = no
|
|
212
|
log_packet_header = no
|
|
213
|
}
|
|
214
|
# Loading module "auth_log" from file /usr/local/etc/raddb/mods-enabled/detail.log
|
|
215
|
detail auth_log {
|
|
216
|
filename = "/var/log/radacct/%{%{Packet-Src-IP-Address}:-%{Packet-Src-IPv6-Address}}/auth-detail-%Y%m%d"
|
|
217
|
header = "%t"
|
|
218
|
permissions = 384
|
|
219
|
locking = no
|
|
220
|
escape_filenames = no
|
|
221
|
log_packet_header = no
|
|
222
|
}
|
|
223
|
# Loading module "reply_log" from file /usr/local/etc/raddb/mods-enabled/detail.log
|
|
224
|
detail reply_log {
|
|
225
|
filename = "/var/log/radacct/%{%{Packet-Src-IP-Address}:-%{Packet-Src-IPv6-Address}}/reply-detail-%Y%m%d"
|
|
226
|
header = "%t"
|
|
227
|
permissions = 384
|
|
228
|
locking = no
|
|
229
|
escape_filenames = no
|
|
230
|
log_packet_header = no
|
|
231
|
}
|
|
232
|
# Loading module "pre_proxy_log" from file /usr/local/etc/raddb/mods-enabled/detail.log
|
|
233
|
detail pre_proxy_log {
|
|
234
|
filename = "/var/log/radacct/%{%{Packet-Src-IP-Address}:-%{Packet-Src-IPv6-Address}}/pre-proxy-detail-%Y%m%d"
|
|
235
|
header = "%t"
|
|
236
|
permissions = 384
|
|
237
|
locking = no
|
|
238
|
escape_filenames = no
|
|
239
|
log_packet_header = no
|
|
240
|
}
|
|
241
|
# Loading module "post_proxy_log" from file /usr/local/etc/raddb/mods-enabled/detail.log
|
|
242
|
detail post_proxy_log {
|
|
243
|
filename = "/var/log/radacct/%{%{Packet-Src-IP-Address}:-%{Packet-Src-IPv6-Address}}/post-proxy-detail-%Y%m%d"
|
|
244
|
header = "%t"
|
|
245
|
permissions = 384
|
|
246
|
locking = no
|
|
247
|
escape_filenames = no
|
|
248
|
log_packet_header = no
|
|
249
|
}
|
|
250
|
# Loaded module rlm_digest
|
|
251
|
# Loading module "digest" from file /usr/local/etc/raddb/mods-enabled/digest
|
|
252
|
# Loaded module rlm_dynamic_clients
|
|
253
|
# Loading module "dynamic_clients" from file /usr/local/etc/raddb/mods-enabled/dynamic_clients
|
|
254
|
# Loaded module rlm_eap
|
|
255
|
# Loading module "eap" from file /usr/local/etc/raddb/mods-enabled/eap
|
|
256
|
eap {
|
|
257
|
default_eap_type = "md5"
|
|
258
|
timer_expire = 60
|
|
259
|
ignore_unknown_eap_types = no
|
|
260
|
cisco_accounting_username_bug = no
|
|
261
|
max_sessions = 4096
|
|
262
|
}
|
|
263
|
# Loaded module rlm_exec
|
|
264
|
# Loading module "echo" from file /usr/local/etc/raddb/mods-enabled/echo
|
|
265
|
exec echo {
|
|
266
|
wait = yes
|
|
267
|
program = "/bin/echo %{User-Name}"
|
|
268
|
input_pairs = "request"
|
|
269
|
output_pairs = "reply"
|
|
270
|
shell_escape = yes
|
|
271
|
}
|
|
272
|
# Loading module "exec" from file /usr/local/etc/raddb/mods-enabled/exec
|
|
273
|
exec {
|
|
274
|
wait = no
|
|
275
|
input_pairs = "request"
|
|
276
|
shell_escape = yes
|
|
277
|
timeout = 10
|
|
278
|
}
|
|
279
|
# Loaded module rlm_expiration
|
|
280
|
# Loading module "expiration" from file /usr/local/etc/raddb/mods-enabled/expiration
|
|
281
|
# Loaded module rlm_expr
|
|
282
|
# Loading module "expr" from file /usr/local/etc/raddb/mods-enabled/expr
|
|
283
|
expr {
|
|
284
|
safe_characters = "@abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ0123456789.-_: /äéöüàâæçèéêëîïôœùûüaÿÄÉÖÜßÀÂÆÇÈÉÊËÎÏÔŒÙÛÜŸ"
|
|
285
|
}
|
|
286
|
# Loaded module rlm_files
|
|
287
|
# Loading module "files" from file /usr/local/etc/raddb/mods-enabled/files
|
|
288
|
files {
|
|
289
|
filename = "/usr/local/etc/raddb/mods-config/files/authorize"
|
|
290
|
acctusersfile = "/usr/local/etc/raddb/mods-config/files/accounting"
|
|
291
|
preproxy_usersfile = "/usr/local/etc/raddb/mods-config/files/pre-proxy"
|
|
292
|
}
|
|
293
|
# Loaded module rlm_linelog
|
|
294
|
# Loading module "linelog" from file /usr/local/etc/raddb/mods-enabled/linelog
|
|
295
|
linelog {
|
|
296
|
filename = "/var/log/linelog"
|
|
297
|
escape_filenames = no
|
|
298
|
syslog_severity = "info"
|
|
299
|
permissions = 384
|
|
300
|
format = "This is a log message for %{User-Name}"
|
|
301
|
reference = "messages.%{%{reply:Packet-Type}:-default}"
|
|
302
|
}
|
|
303
|
# Loading module "log_accounting" from file /usr/local/etc/raddb/mods-enabled/linelog
|
|
304
|
linelog log_accounting {
|
|
305
|
filename = "/var/log/linelog-accounting"
|
|
306
|
escape_filenames = no
|
|
307
|
syslog_severity = "info"
|
|
308
|
permissions = 384
|
|
309
|
format = ""
|
|
310
|
reference = "Accounting-Request.%{%{Acct-Status-Type}:-unknown}"
|
|
311
|
}
|
|
312
|
# Loaded module rlm_logintime
|
|
313
|
# Loading module "logintime" from file /usr/local/etc/raddb/mods-enabled/logintime
|
|
314
|
logintime {
|
|
315
|
minimum_timeout = 60
|
|
316
|
}
|
|
317
|
# Loaded module rlm_mschap
|
|
318
|
# Loading module "mschap" from file /usr/local/etc/raddb/mods-enabled/mschap
|
|
319
|
mschap {
|
|
320
|
use_mppe = yes
|
|
321
|
require_encryption = no
|
|
322
|
require_strong = no
|
|
323
|
with_ntdomain_hack = yes
|
|
324
|
passchange {
|
|
325
|
}
|
|
326
|
allow_retry = yes
|
|
327
|
winbind_retry_with_normalised_username = no
|
|
328
|
}
|
|
329
|
# Loaded module rlm_realm
|
|
330
|
# Loading module "IPASS" from file /usr/local/etc/raddb/mods-enabled/realm
|
|
331
|
realm IPASS {
|
|
332
|
format = "prefix"
|
|
333
|
delimiter = "/"
|
|
334
|
ignore_default = no
|
|
335
|
ignore_null = yes
|
|
336
|
}
|
|
337
|
# Loading module "suffix" from file /usr/local/etc/raddb/mods-enabled/realm
|
|
338
|
realm suffix {
|
|
339
|
format = "suffix"
|
|
340
|
delimiter = "@"
|
|
341
|
ignore_default = no
|
|
342
|
ignore_null = yes
|
|
343
|
}
|
|
344
|
# Loading module "realmpercent" from file /usr/local/etc/raddb/mods-enabled/realm
|
|
345
|
realm realmpercent {
|
|
346
|
format = "suffix"
|
|
347
|
delimiter = "%"
|
|
348
|
ignore_default = no
|
|
349
|
ignore_null = yes
|
|
350
|
}
|
|
351
|
# Loading module "ntdomain" from file /usr/local/etc/raddb/mods-enabled/realm
|
|
352
|
realm ntdomain {
|
|
353
|
format = "prefix"
|
|
354
|
delimiter = "\"
|
|
355
|
ignore_default = no
|
|
356
|
ignore_null = yes
|
|
357
|
}
|
|
358
|
# Loaded module rlm_pap
|
|
359
|
# Loading module "pap" from file /usr/local/etc/raddb/mods-enabled/pap
|
|
360
|
pap {
|
|
361
|
normalise = yes
|
|
362
|
}
|
|
363
|
# Loaded module rlm_passwd
|
|
364
|
# Loading module "etc_passwd" from file /usr/local/etc/raddb/mods-enabled/passwd
|
|
365
|
passwd etc_passwd {
|
|
366
|
filename = "/etc/passwd"
|
|
367
|
format = "*User-Name:Crypt-Password:"
|
|
368
|
delimiter = ":"
|
|
369
|
ignore_nislike = no
|
|
370
|
ignore_empty = yes
|
|
371
|
allow_multiple_keys = no
|
|
372
|
hash_size = 100
|
|
373
|
}
|
|
374
|
# Loaded module rlm_preprocess
|
|
375
|
# Loading module "preprocess" from file /usr/local/etc/raddb/mods-enabled/preprocess
|
|
376
|
preprocess {
|
|
377
|
huntgroups = "/usr/local/etc/raddb/mods-config/preprocess/huntgroups"
|
|
378
|
hints = "/usr/local/etc/raddb/mods-config/preprocess/hints"
|
|
379
|
with_ascend_hack = no
|
|
380
|
ascend_channels_per_line = 23
|
|
381
|
with_ntdomain_hack = no
|
|
382
|
with_specialix_jetstream_hack = no
|
|
383
|
with_cisco_vsa_hack = no
|
|
384
|
with_alvarion_vsa_hack = no
|
|
385
|
}
|
|
386
|
# Loaded module rlm_radutmp
|
|
387
|
# Loading module "radutmp" from file /usr/local/etc/raddb/mods-enabled/radutmp
|
|
388
|
radutmp {
|
|
389
|
filename = "/var/log/radutmp"
|
|
390
|
username = "%{User-Name}"
|
|
391
|
case_sensitive = yes
|
|
392
|
check_with_nas = yes
|
|
393
|
permissions = 384
|
|
394
|
caller_id = yes
|
|
395
|
}
|
|
396
|
# Loaded module rlm_sql
|
|
397
|
# Loading module "sql1" from file /usr/local/etc/raddb/mods-enabled/sql
|
|
398
|
sql sql1 {
|
|
399
|
driver = "rlm_sql_mysql"
|
|
400
|
server = "10.168.0.194"
|
|
401
|
port = 3306
|
|
402
|
login = "radius"
|
|
403
|
password = <<< secret >>>
|
|
404
|
radius_db = "radius"
|
|
405
|
read_groups = yes
|
|
406
|
read_profiles = yes
|
|
407
|
read_clients = yes
|
|
408
|
delete_stale_sessions = yes
|
|
409
|
sql_user_name = "%{User-Name}"
|
|
410
|
logfile = "/var/log/sqltrace.sql"
|
|
411
|
default_user_profile = ""
|
|
412
|
client_query = "SELECT id, nasname, shortname, type, secret, server FROM nas"
|
|
413
|
authorize_check_query = "SELECT id, username, attribute, value, op FROM radcheck WHERE username = '%{SQL-User-Name}' ORDER BY id"
|
|
414
|
authorize_reply_query = "SELECT id, username, attribute, value, op FROM radreply WHERE username = '%{SQL-User-Name}' ORDER BY id"
|
|
415
|
authorize_group_check_query = "SELECT id, groupname, attribute, Value, op FROM radgroupcheck WHERE groupname = '%{sql1-SQL-Group}' ORDER BY id"
|
|
416
|
authorize_group_reply_query = "SELECT id, groupname, attribute, value, op FROM radgroupreply WHERE groupname = '%{sql1-SQL-Group}' ORDER BY id"
|
|
417
|
group_membership_query = "SELECT groupname FROM radusergroup WHERE username = '%{SQL-User-Name}' ORDER BY priority"
|
|
418
|
simul_count_query = "SELECT COUNT(*) FROM radacct WHERE username = '%{SQL-User-Name}' AND acctstoptime IS NULL"
|
|
419
|
simul_verify_query = "SELECT radacctid, acctsessionid, username, nasipaddress, nasportid, framedipaddress, callingstationid, framedprotocol FROM radacct WHERE username = '%{SQL-User-Name}' AND acctstoptime IS NULL"
|
|
420
|
safe_characters = "@abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ0123456789.-_: /"
|
|
421
|
auto_escape = no
|
|
422
|
accounting {
|
|
423
|
reference = "%{tolower:type.%{%{Acct-Status-Type}:-%{Request-Processing-Stage}}.query}"
|
|
424
|
type {
|
|
425
|
accounting-on {
|
|
426
|
query = "UPDATE radacct SET acctstoptime = FROM_UNIXTIME(%{%{integer:Event-Timestamp}:-%l}), acctsessiontime = '%{%{integer:Event-Timestamp}:-%l}' - UNIX_TIMESTAMP(acctstarttime), acctterminatecause = '%{%{Acct-Terminate-Cause}:-NAS-Reboot}' WHERE acctstoptime IS NULL AND nasipaddress = '%{NAS-IP-Address}' AND acctstarttime <= FROM_UNIXTIME(%{%{integer:Event-Timestamp}:-%l})"
|
|
427
|
}
|
|
428
|
accounting-off {
|
|
429
|
query = "UPDATE radacct SET acctstoptime = FROM_UNIXTIME(%{%{integer:Event-Timestamp}:-%l}), acctsessiontime = '%{%{integer:Event-Timestamp}:-%l}' - UNIX_TIMESTAMP(acctstarttime), acctterminatecause = '%{%{Acct-Terminate-Cause}:-NAS-Reboot}' WHERE acctstoptime IS NULL AND nasipaddress = '%{NAS-IP-Address}' AND acctstarttime <= FROM_UNIXTIME(%{%{integer:Event-Timestamp}:-%l})"
|
|
430
|
}
|
|
431
|
start {
|
|
432
|
query = "INSERT INTO radacct (acctsessionid, acctuniqueid, username, realm, nasipaddress, nasportid, nasporttype, acctstarttime, acctupdatetime, acctstoptime, acctsessiontime, acctauthentic, connectinfo_start, connectinfo_stop, acctinputoctets, acctoutputoctets, calledstationid, callingstationid, acctterminatecause, servicetype, framedprotocol, framedipaddress, framedipv6address, framedipv6prefix, framedinterfaceid, delegatedipv6prefix) VALUES ('%{Acct-Session-Id}', '%{Acct-Unique-Session-Id}', '%{SQL-User-Name}', '%{Realm}', '%{NAS-IP-Address}', '%{%{NAS-Port-ID}:-%{NAS-Port}}', '%{NAS-Port-Type}', FROM_UNIXTIME(%{%{integer:Event-Timestamp}:-%l}), FROM_UNIXTIME(%{%{integer:Event-Timestamp}:-%l}), NULL, '0', '%{Acct-Authentic}', '%{Connect-Info}', '', '0', '0', '%{Called-Station-Id}', '%{Calling-Station-Id}', '', '%{Service-Type}', '%{Framed-Protocol}', '%{Framed-IP-Address}', '%{Framed-IPv6-Address}', '%{Framed-IPv6-Prefix}', '%{Framed-Interface-Id}', '%{Delegated-IPv6-Prefix}')"
|
|
433
|
}
|
|
434
|
interim-update {
|
|
435
|
query = "UPDATE radacct SET acctupdatetime = (@acctupdatetime_old:=acctupdatetime), acctupdatetime = FROM_UNIXTIME(%{%{integer:Event-Timestamp}:-%l}), acctinterval = %{%{integer:Event-Timestamp}:-%l} - UNIX_TIMESTAMP(@acctupdatetime_old), framedipaddress = '%{Framed-IP-Address}', framedipv6address = '%{Framed-IPv6-Address}', framedipv6prefix = '%{Framed-IPv6-Prefix}', framedinterfaceid = '%{Framed-Interface-Id}', delegatedipv6prefix = '%{Delegated-IPv6-Prefix}', acctsessiontime = %{%{Acct-Session-Time}:-NULL}, acctinputoctets = '%{%{Acct-Input-Gigawords}:-0}' << 32 | '%{%{Acct-Input-Octets}:-0}', acctoutputoctets = '%{%{Acct-Output-Gigawords}:-0}' << 32 | '%{%{Acct-Output-Octets}:-0}' WHERE AcctUniqueId = '%{Acct-Unique-Session-Id}'"
|
|
436
|
}
|
|
437
|
stop {
|
|
438
|
query = "UPDATE radacct SET acctstoptime = FROM_UNIXTIME(%{%{integer:Event-Timestamp}:-%l}), acctsessiontime = %{%{Acct-Session-Time}:-NULL}, acctinputoctets = '%{%{Acct-Input-Gigawords}:-0}' << 32 | '%{%{Acct-Input-Octets}:-0}', acctoutputoctets = '%{%{Acct-Output-Gigawords}:-0}' << 32 | '%{%{Acct-Output-Octets}:-0}', acctterminatecause = '%{Acct-Terminate-Cause}', connectinfo_stop = '%{Connect-Info}' WHERE AcctUniqueId = '%{Acct-Unique-Session-Id}'"
|
|
439
|
}
|
|
440
|
}
|
|
441
|
}
|
|
442
|
post-auth {
|
|
443
|
reference = ".query"
|
|
444
|
query = "INSERT INTO radpostauth (username, pass, reply, authdate) VALUES ( '%{SQL-User-Name}', '%{%{User-Password}:-%{Chap-Password}}', '%{reply:Packet-Type}', '%S.%M')"
|
|
445
|
}
|
|
446
|
}
|
|
447
|
rlm_sql (sql1): Driver rlm_sql_mysql (module rlm_sql_mysql) loaded and linked
|
|
448
|
Creating attribute sql1-SQL-Group
|
|
449
|
# Loaded module rlm_replicate
|
|
450
|
# Loading module "replicate" from file /usr/local/etc/raddb/mods-enabled/replicate
|
|
451
|
# Loaded module rlm_soh
|
|
452
|
# Loading module "soh" from file /usr/local/etc/raddb/mods-enabled/soh
|
|
453
|
soh {
|
|
454
|
dhcp = yes
|
|
455
|
}
|
|
456
|
# Loading module "sradutmp" from file /usr/local/etc/raddb/mods-enabled/sradutmp
|
|
457
|
radutmp sradutmp {
|
|
458
|
filename = "/var/log/sradutmp"
|
|
459
|
username = "%{User-Name}"
|
|
460
|
case_sensitive = yes
|
|
461
|
check_with_nas = yes
|
|
462
|
permissions = 420
|
|
463
|
caller_id = no
|
|
464
|
}
|
|
465
|
# Loaded module rlm_unix
|
|
466
|
# Loading module "unix" from file /usr/local/etc/raddb/mods-enabled/unix
|
|
467
|
unix {
|
|
468
|
radwtmp = "/var/log/radwtmp"
|
|
469
|
}
|
|
470
|
Creating attribute Unix-Group
|
|
471
|
# Loaded module rlm_unpack
|
|
472
|
# Loading module "unpack" from file /usr/local/etc/raddb/mods-enabled/unpack
|
|
473
|
# Loaded module rlm_utf8
|
|
474
|
# Loading module "utf8" from file /usr/local/etc/raddb/mods-enabled/utf8
|
|
475
|
# Loaded module rlm_always
|
|
476
|
# Loading module "reject" from file /usr/local/etc/raddb/mods-enabled/always
|
|
477
|
always reject {
|
|
478
|
rcode = "reject"
|
|
479
|
simulcount = 0
|
|
480
|
mpp = no
|
|
481
|
}
|
|
482
|
# Loading module "fail" from file /usr/local/etc/raddb/mods-enabled/always
|
|
483
|
always fail {
|
|
484
|
rcode = "fail"
|
|
485
|
simulcount = 0
|
|
486
|
mpp = no
|
|
487
|
}
|
|
488
|
# Loading module "ok" from file /usr/local/etc/raddb/mods-enabled/always
|
|
489
|
always ok {
|
|
490
|
rcode = "ok"
|
|
491
|
simulcount = 0
|
|
492
|
mpp = no
|
|
493
|
}
|
|
494
|
# Loading module "handled" from file /usr/local/etc/raddb/mods-enabled/always
|
|
495
|
always handled {
|
|
496
|
rcode = "handled"
|
|
497
|
simulcount = 0
|
|
498
|
mpp = no
|
|
499
|
}
|
|
500
|
# Loading module "invalid" from file /usr/local/etc/raddb/mods-enabled/always
|
|
501
|
always invalid {
|
|
502
|
rcode = "invalid"
|
|
503
|
simulcount = 0
|
|
504
|
mpp = no
|
|
505
|
}
|
|
506
|
# Loading module "userlock" from file /usr/local/etc/raddb/mods-enabled/always
|
|
507
|
always userlock {
|
|
508
|
rcode = "userlock"
|
|
509
|
simulcount = 0
|
|
510
|
mpp = no
|
|
511
|
}
|
|
512
|
# Loading module "notfound" from file /usr/local/etc/raddb/mods-enabled/always
|
|
513
|
always notfound {
|
|
514
|
rcode = "notfound"
|
|
515
|
simulcount = 0
|
|
516
|
mpp = no
|
|
517
|
}
|
|
518
|
# Loading module "noop" from file /usr/local/etc/raddb/mods-enabled/always
|
|
519
|
always noop {
|
|
520
|
rcode = "noop"
|
|
521
|
simulcount = 0
|
|
522
|
mpp = no
|
|
523
|
}
|
|
524
|
# Loading module "updated" from file /usr/local/etc/raddb/mods-enabled/always
|
|
525
|
always updated {
|
|
526
|
rcode = "updated"
|
|
527
|
simulcount = 0
|
|
528
|
mpp = no
|
|
529
|
}
|
|
530
|
# Loading module "motp" from file /usr/local/etc/raddb/mods-enabled/motp
|
|
531
|
exec motp {
|
|
532
|
wait = yes
|
|
533
|
program = "/usr/local/bin/bash /usr/local/etc/raddb/scripts/otpverify.sh %{request:User-Name} %{request:User-Password} %{reply:MOTP-Init-Secret} %{reply:MOTP-PIN} %{reply:MOTP-Offset}"
|
|
534
|
shell_escape = yes
|
|
535
|
}
|
|
536
|
# Loading module "googleauth" from file /usr/local/etc/raddb/mods-enabled/googleauth
|
|
537
|
exec googleauth {
|
|
538
|
wait = yes
|
|
539
|
program = "/usr/local/etc/raddb/scripts/googleauth.py %{request:User-Name} %{reply:MOTP-Init-Secret} %{reply:MOTP-PIN} %{request:User-Password}"
|
|
540
|
shell_escape = yes
|
|
541
|
}
|
|
542
|
# Loading module "datacounterdaily" from file /usr/local/etc/raddb/mods-enabled/datacounter_acct
|
|
543
|
exec datacounterdaily {
|
|
544
|
wait = yes
|
|
545
|
program = "/bin/sh /usr/local/etc/raddb/scripts/datacounter_acct.sh %{request:User-Name} daily %{request:Acct-Input-Octets} %{request:Acct-Output-Octets} %{request:Acct-Status-Type} %{request:Acct-Session-Id}"
|
|
546
|
shell_escape = yes
|
|
547
|
}
|
|
548
|
# Loading module "datacounterweekly" from file /usr/local/etc/raddb/mods-enabled/datacounter_acct
|
|
549
|
exec datacounterweekly {
|
|
550
|
wait = yes
|
|
551
|
program = "/bin/sh /usr/local/etc/raddb/scripts/datacounter_acct.sh %{request:User-Name} weekly %{request:Acct-Input-Octets} %{request:Acct-Output-Octets} %{request:Acct-Status-Type} %{request:Acct-Session-Id}"
|
|
552
|
shell_escape = yes
|
|
553
|
}
|
|
554
|
# Loading module "datacountermonthly" from file /usr/local/etc/raddb/mods-enabled/datacounter_acct
|
|
555
|
exec datacountermonthly {
|
|
556
|
wait = yes
|
|
557
|
program = "/bin/sh /usr/local/etc/raddb/scripts/datacounter_acct.sh %{request:User-Name} monthly %{request:Acct-Input-Octets} %{request:Acct-Output-Octets} %{request:Acct-Status-Type} %{request:Acct-Session-Id}"
|
|
558
|
shell_escape = yes
|
|
559
|
}
|
|
560
|
# Loading module "datacounterforever" from file /usr/local/etc/raddb/mods-enabled/datacounter_acct
|
|
561
|
exec datacounterforever {
|
|
562
|
wait = yes
|
|
563
|
program = "/bin/sh /usr/local/etc/raddb/scripts/datacounter_acct.sh %{request:User-Name} forever %{request:Acct-Input-Octets} %{request:Acct-Output-Octets} %{request:Acct-Status-Type} %{request:Acct-Session-Id}"
|
|
564
|
shell_escape = yes
|
|
565
|
}
|
|
566
|
# Loaded module rlm_sqlcounter
|
|
567
|
# Loading module "dailycounter" from file /usr/local/etc/raddb/mods-enabled/sqlcounter
|
|
568
|
sqlcounter dailycounter {
|
|
569
|
sql_module_instance = "sql"
|
|
570
|
key = "User-Name"
|
|
571
|
query = "SELECT SUM(acctsessiontime - GREATEST((%%b - UNIX_TIMESTAMP(acctstarttime)), 0)) FROM radacct WHERE username = '%{User-Name}' AND UNIX_TIMESTAMP(acctstarttime) + acctsessiontime > '%%b'"
|
|
572
|
reset = "daily"
|
|
573
|
counter_name = "Daily-Session-Time"
|
|
574
|
check_name = "Max-Daily-Session"
|
|
575
|
reply_name = "Session-Timeout"
|
|
576
|
}
|
|
577
|
# Loading module "monthlycounter" from file /usr/local/etc/raddb/mods-enabled/sqlcounter
|
|
578
|
sqlcounter monthlycounter {
|
|
579
|
sql_module_instance = "sql"
|
|
580
|
key = "User-Name"
|
|
581
|
query = "SELECT SUM(acctsessiontime - GREATEST((%%b - UNIX_TIMESTAMP(acctstarttime)), 0)) FROM radacct WHERE username='%{User-Name}' AND UNIX_TIMESTAMP(acctstarttime) + acctsessiontime > '%%b'"
|
|
582
|
reset = "monthly"
|
|
583
|
counter_name = "Monthly-Session-Time"
|
|
584
|
check_name = "Max-Monthly-Session"
|
|
585
|
reply_name = "Session-Timeout"
|
|
586
|
}
|
|
587
|
# Loading module "noresetcounter" from file /usr/local/etc/raddb/mods-enabled/sqlcounter
|
|
588
|
sqlcounter noresetcounter {
|
|
589
|
sql_module_instance = "sql"
|
|
590
|
key = "User-Name"
|
|
591
|
query = "SELECT IFNULL(SUM(AcctSessionTime),0) FROM radacct WHERE UserName='%{User-Name}'"
|
|
592
|
reset = "never"
|
|
593
|
counter_name = "Max-All-Session-Time"
|
|
594
|
check_name = "Max-All-Session"
|
|
595
|
reply_name = "Session-Timeout"
|
|
596
|
}
|
|
597
|
# Loading module "expire_on_login" from file /usr/local/etc/raddb/mods-enabled/sqlcounter
|
|
598
|
sqlcounter expire_on_login {
|
|
599
|
sql_module_instance = "sql"
|
|
600
|
key = "User-Name"
|
|
601
|
query = "SELECT IFNULL( MAX(TIME_TO_SEC(TIMEDIFF(NOW(), acctstarttime))),0) FROM radacct WHERE UserName='%{User-Name}' ORDER BY acctstarttime LIMIT 1;"
|
|
602
|
reset = "never"
|
|
603
|
counter_name = "Expire-After-Initial-Login"
|
|
604
|
check_name = "Expire-After"
|
|
605
|
reply_name = "Session-Timeout"
|
|
606
|
}
|
|
607
|
instantiate {
|
|
608
|
# Instantiating module "expiration" from file /usr/local/etc/raddb/mods-enabled/expiration
|
|
609
|
# Instantiating module "logintime" from file /usr/local/etc/raddb/mods-enabled/logintime
|
|
610
|
# Instantiating module "sql1" from file /usr/local/etc/raddb/mods-enabled/sql
|
|
611
|
rlm_sql_mysql: libmysql version: 5.7.34
|
|
612
|
mysql {
|
|
613
|
tls {
|
|
614
|
tls_required = no
|
|
615
|
check_cert = no
|
|
616
|
check_cert_cn = no
|
|
617
|
}
|
|
618
|
warnings = "auto"
|
|
619
|
}
|
|
620
|
rlm_sql (sql1): Attempting to connect to database "radius"
|
|
621
|
rlm_sql (sql1): Initialising connection pool
|
|
622
|
pool {
|
|
623
|
start = 5
|
|
624
|
min = 3
|
|
625
|
max = 5
|
|
626
|
spare = 10
|
|
627
|
uses = 0
|
|
628
|
lifetime = 0
|
|
629
|
cleanup_interval = 30
|
|
630
|
idle_timeout = 60
|
|
631
|
retry_delay = 60
|
|
632
|
spread = no
|
|
633
|
}
|
|
634
|
Ignoring "spare = 10", forcing to "spare = 2"
|
|
635
|
rlm_sql (sql1): Opening additional connection (0), 1 of 5 pending slots used
|
|
636
|
rlm_sql_mysql: Starting connect to MySQL server
|
|
637
|
rlm_sql_mysql: Connected to database 'radius' on 10.168.0.194 via TCP/IP, server version 5.5.5-10.5.8-MariaDB, protocol version 10
|
|
638
|
rlm_sql (sql1): Opening additional connection (1), 1 of 4 pending slots used
|
|
639
|
rlm_sql_mysql: Starting connect to MySQL server
|
|
640
|
rlm_sql_mysql: Connected to database 'radius' on 10.168.0.194 via TCP/IP, server version 5.5.5-10.5.8-MariaDB, protocol version 10
|
|
641
|
rlm_sql (sql1): Opening additional connection (2), 1 of 3 pending slots used
|
|
642
|
rlm_sql_mysql: Starting connect to MySQL server
|
|
643
|
rlm_sql_mysql: Connected to database 'radius' on 10.168.0.194 via TCP/IP, server version 5.5.5-10.5.8-MariaDB, protocol version 10
|
|
644
|
rlm_sql (sql1): Opening additional connection (3), 1 of 2 pending slots used
|
|
645
|
rlm_sql_mysql: Starting connect to MySQL server
|
|
646
|
rlm_sql_mysql: Connected to database 'radius' on 10.168.0.194 via TCP/IP, server version 5.5.5-10.5.8-MariaDB, protocol version 10
|
|
647
|
rlm_sql (sql1): Opening additional connection (4), 1 of 1 pending slots used
|
|
648
|
rlm_sql_mysql: Starting connect to MySQL server
|
|
649
|
rlm_sql_mysql: Connected to database 'radius' on 10.168.0.194 via TCP/IP, server version 5.5.5-10.5.8-MariaDB, protocol version 10
|
|
650
|
rlm_sql (sql1): Processing generate_sql_clients
|
|
651
|
rlm_sql (sql1) in generate_sql_clients: query is SELECT id, nasname, shortname, type, secret, server FROM nas
|
|
652
|
rlm_sql (sql1): Reserved connection (0)
|
|
653
|
rlm_sql (sql1): Executing select query: SELECT id, nasname, shortname, type, secret, server FROM nas
|
|
654
|
rlm_sql (sql1): Adding client 10.168.0.194 (devil) to global clients list
|
|
655
|
rlm_sql (10.168.0.194): Client "devil" (sql1) added
|
|
656
|
rlm_sql (sql1): Released connection (0)
|
|
657
|
}
|
|
658
|
# Instantiating module "attr_filter.post-proxy" from file /usr/local/etc/raddb/mods-enabled/attr_filter
|
|
659
|
reading pairlist file /usr/local/etc/raddb/mods-config/attr_filter/post-proxy
|
|
660
|
# Instantiating module "attr_filter.pre-proxy" from file /usr/local/etc/raddb/mods-enabled/attr_filter
|
|
661
|
reading pairlist file /usr/local/etc/raddb/mods-config/attr_filter/pre-proxy
|
|
662
|
# Instantiating module "attr_filter.access_reject" from file /usr/local/etc/raddb/mods-enabled/attr_filter
|
|
663
|
reading pairlist file /usr/local/etc/raddb/mods-config/attr_filter/access_reject
|
|
664
|
# Instantiating module "attr_filter.access_challenge" from file /usr/local/etc/raddb/mods-enabled/attr_filter
|
|
665
|
reading pairlist file /usr/local/etc/raddb/mods-config/attr_filter/access_challenge
|
|
666
|
# Instantiating module "attr_filter.accounting_response" from file /usr/local/etc/raddb/mods-enabled/attr_filter
|
|
667
|
reading pairlist file /usr/local/etc/raddb/mods-config/attr_filter/accounting_response
|
|
668
|
# Instantiating module "attr_filter.coa" from file /usr/local/etc/raddb/mods-enabled/attr_filter
|
|
669
|
reading pairlist file /usr/local/etc/raddb/mods-config/attr_filter/coa
|
|
670
|
# Instantiating module "cache_eap" from file /usr/local/etc/raddb/mods-enabled/cache_eap
|
|
671
|
rlm_cache (cache_eap): Driver rlm_cache_rbtree (module rlm_cache_rbtree) loaded and linked
|
|
672
|
# Instantiating module "detail" from file /usr/local/etc/raddb/mods-enabled/detail
|
|
673
|
# Instantiating module "auth_log" from file /usr/local/etc/raddb/mods-enabled/detail.log
|
|
674
|
rlm_detail (auth_log): 'User-Password' suppressed, will not appear in detail output
|
|
675
|
# Instantiating module "reply_log" from file /usr/local/etc/raddb/mods-enabled/detail.log
|
|
676
|
# Instantiating module "pre_proxy_log" from file /usr/local/etc/raddb/mods-enabled/detail.log
|
|
677
|
# Instantiating module "post_proxy_log" from file /usr/local/etc/raddb/mods-enabled/detail.log
|
|
678
|
# Instantiating module "eap" from file /usr/local/etc/raddb/mods-enabled/eap
|
|
679
|
# Linked to sub-module rlm_eap_md5
|
|
680
|
# Linked to sub-module rlm_eap_gtc
|
|
681
|
gtc {
|
|
682
|
challenge = "Password: "
|
|
683
|
auth_type = "PAP"
|
|
684
|
}
|
|
685
|
# Linked to sub-module rlm_eap_tls
|
|
686
|
tls {
|
|
687
|
tls = "tls-common"
|
|
688
|
}
|
|
689
|
tls-config tls-common {
|
|
690
|
verify_depth = 0
|
|
691
|
ca_path = "/usr/local/etc/raddb/certs"
|
|
692
|
pem_file_type = yes
|
|
693
|
private_key_file = "/usr/local/etc/raddb/certs/server_key.pem"
|
|
694
|
certificate_file = "/usr/local/etc/raddb/certs/server_cert.pem"
|
|
695
|
ca_file = "/usr/local/etc/raddb/certs/ca_cert.pem"
|
|
696
|
dh_file = "/usr/local/etc/raddb/certs/dh"
|
|
697
|
random_file = "/dev/urandom"
|
|
698
|
fragment_size = 1024
|
|
699
|
include_length = yes
|
|
700
|
auto_chain = yes
|
|
701
|
check_crl = no
|
|
702
|
check_all_crl = no
|
|
703
|
ca_path_reload_interval = 0
|
|
704
|
cipher_list = "DEFAULT"
|
|
705
|
cipher_server_preference = no
|
|
706
|
ecdh_curve = "prime256v1"
|
|
707
|
tls_min_version = "1.0"
|
|
708
|
cache {
|
|
709
|
enable = no
|
|
710
|
lifetime = 24
|
|
711
|
max_entries = 255
|
|
712
|
}
|
|
713
|
verify {
|
|
714
|
skip_if_ocsp_ok = no
|
|
715
|
}
|
|
716
|
ocsp {
|
|
717
|
enable = no
|
|
718
|
override_cert_url = no
|
|
719
|
url = "http://127.0.0.1/ocsp/"
|
|
720
|
use_nonce = yes
|
|
721
|
timeout = 0
|
|
722
|
softfail = no
|
|
723
|
}
|
|
724
|
}
|
|
725
|
# Linked to sub-module rlm_eap_ttls
|
|
726
|
ttls {
|
|
727
|
tls = "tls-common"
|
|
728
|
default_eap_type = "md5"
|
|
729
|
copy_request_to_tunnel = no
|
|
730
|
use_tunneled_reply = no
|
|
731
|
virtual_server = "inner-tunnel-ttls"
|
|
732
|
include_length = yes
|
|
733
|
require_client_cert = no
|
|
734
|
}
|
|
735
|
tls: Using cached TLS configuration from previous invocation
|
|
736
|
# Linked to sub-module rlm_eap_peap
|
|
737
|
peap {
|
|
738
|
tls = "tls-common"
|
|
739
|
default_eap_type = "mschapv2"
|
|
740
|
copy_request_to_tunnel = no
|
|
741
|
use_tunneled_reply = no
|
|
742
|
proxy_tunneled_request_as_eap = yes
|
|
743
|
virtual_server = "inner-tunnel-peap"
|
|
744
|
soh = no
|
|
745
|
require_client_cert = no
|
|
746
|
}
|
|
747
|
tls: Using cached TLS configuration from previous invocation
|
|
748
|
# Linked to sub-module rlm_eap_mschapv2
|
|
749
|
mschapv2 {
|
|
750
|
with_ntdomain_hack = no
|
|
751
|
send_error = no
|
|
752
|
}
|
|
753
|
# Instantiating module "files" from file /usr/local/etc/raddb/mods-enabled/files
|
|
754
|
reading pairlist file /usr/local/etc/raddb/mods-config/files/authorize
|
|
755
|
reading pairlist file /usr/local/etc/raddb/mods-config/files/accounting
|
|
756
|
reading pairlist file /usr/local/etc/raddb/mods-config/files/pre-proxy
|
|
757
|
# Instantiating module "linelog" from file /usr/local/etc/raddb/mods-enabled/linelog
|
|
758
|
# Instantiating module "log_accounting" from file /usr/local/etc/raddb/mods-enabled/linelog
|
|
759
|
# Instantiating module "mschap" from file /usr/local/etc/raddb/mods-enabled/mschap
|
|
760
|
rlm_mschap (mschap): using internal authentication
|
|
761
|
# Instantiating module "IPASS" from file /usr/local/etc/raddb/mods-enabled/realm
|
|
762
|
# Instantiating module "suffix" from file /usr/local/etc/raddb/mods-enabled/realm
|
|
763
|
# Instantiating module "realmpercent" from file /usr/local/etc/raddb/mods-enabled/realm
|
|
764
|
# Instantiating module "ntdomain" from file /usr/local/etc/raddb/mods-enabled/realm
|
|
765
|
# Instantiating module "pap" from file /usr/local/etc/raddb/mods-enabled/pap
|
|
766
|
# Instantiating module "etc_passwd" from file /usr/local/etc/raddb/mods-enabled/passwd
|
|
767
|
rlm_passwd: nfields: 3 keyfield 0(User-Name) listable: no
|
|
768
|
# Instantiating module "preprocess" from file /usr/local/etc/raddb/mods-enabled/preprocess
|
|
769
|
reading pairlist file /usr/local/etc/raddb/mods-config/preprocess/huntgroups
|
|
770
|
reading pairlist file /usr/local/etc/raddb/mods-config/preprocess/hints
|
|
771
|
# Instantiating module "reject" from file /usr/local/etc/raddb/mods-enabled/always
|
|
772
|
# Instantiating module "fail" from file /usr/local/etc/raddb/mods-enabled/always
|
|
773
|
# Instantiating module "ok" from file /usr/local/etc/raddb/mods-enabled/always
|
|
774
|
# Instantiating module "handled" from file /usr/local/etc/raddb/mods-enabled/always
|
|
775
|
# Instantiating module "invalid" from file /usr/local/etc/raddb/mods-enabled/always
|
|
776
|
# Instantiating module "userlock" from file /usr/local/etc/raddb/mods-enabled/always
|
|
777
|
# Instantiating module "notfound" from file /usr/local/etc/raddb/mods-enabled/always
|
|
778
|
# Instantiating module "noop" from file /usr/local/etc/raddb/mods-enabled/always
|
|
779
|
# Instantiating module "updated" from file /usr/local/etc/raddb/mods-enabled/always
|
|
780
|
# Instantiating module "dailycounter" from file /usr/local/etc/raddb/mods-enabled/sqlcounter
|
|
781
|
rlm_sqlcounter: Current Time: 1629792140 [2021-08-24 11:02:20], Prev reset 1629752400 [2021-08-24 00:00:00]
|
|
782
|
# Instantiating module "monthlycounter" from file /usr/local/etc/raddb/mods-enabled/sqlcounter
|
|
783
|
rlm_sqlcounter: Current Time: 1629792140 [2021-08-24 11:02:20], Prev reset 1627765200 [2021-08-01 00:00:00]
|
|
784
|
# Instantiating module "noresetcounter" from file /usr/local/etc/raddb/mods-enabled/sqlcounter
|
|
785
|
rlm_sqlcounter: Current Time: 1629792140 [2021-08-24 11:02:20], Prev reset 0 [2021-08-24 11:00:00]
|
|
786
|
# Instantiating module "expire_on_login" from file /usr/local/etc/raddb/mods-enabled/sqlcounter
|
|
787
|
rlm_sqlcounter: Current Time: 1629792140 [2021-08-24 11:02:20], Prev reset 0 [2021-08-24 11:00:00]
|
|
788
|
} # modules
|
|
789
|
radiusd: #### Loading Virtual Servers ####
|
|
790
|
server { # from file /usr/local/etc/raddb/radiusd.conf
|
|
791
|
} # server
|
|
792
|
server default { # from file /usr/local/etc/raddb/sites-enabled/default
|
|
793
|
# Loading authenticate {...}
|
|
794
|
Compiling Auth-Type PAP for attr Auth-Type
|
|
795
|
Compiling Auth-Type CHAP for attr Auth-Type
|
|
796
|
Compiling Auth-Type MS-CHAP for attr Auth-Type
|
|
797
|
Compiling Auth-Type MOTP for attr Auth-Type
|
|
798
|
Compiling Auth-Type GOOGLEAUTH for attr Auth-Type
|
|
799
|
# Loading authorize {...}
|
|
800
|
Compiling Autz-Type Status-Server for attr Autz-Type
|
|
801
|
# Loading preacct {...}
|
|
802
|
# Loading accounting {...}
|
|
803
|
Compiling Acct-Type Status-Server for attr Acct-Type
|
|
804
|
# Loading session {...}
|
|
805
|
# Loading pre-proxy {...}
|
|
806
|
# Loading post-proxy {...}
|
|
807
|
# Loading post-auth {...}
|
|
808
|
Compiling Post-Auth-Type REJECT for attr Post-Auth-Type
|
|
809
|
Compiling Post-Auth-Type Challenge for attr Post-Auth-Type
|
|
810
|
} # server default
|
|
811
|
server inner-tunnel-ttls { # from file /usr/local/etc/raddb/sites-enabled/inner-tunnel-ttls
|
|
812
|
# Loading authenticate {...}
|
|
813
|
Compiling Auth-Type PAP for attr Auth-Type
|
|
814
|
Compiling Auth-Type CHAP for attr Auth-Type
|
|
815
|
Compiling Auth-Type MS-CHAP for attr Auth-Type
|
|
816
|
# Loading authorize {...}
|
|
817
|
Ignoring "sql" (see raddb/mods-available/README.rst)
|
|
818
|
Ignoring "ldap" (see raddb/mods-available/README.rst)
|
|
819
|
# Loading session {...}
|
|
820
|
# Loading post-proxy {...}
|
|
821
|
# Loading post-auth {...}
|
|
822
|
# Skipping contents of 'if' as it is always 'false' -- /usr/local/etc/raddb/sites-enabled/inner-tunnel-ttls:63
|
|
823
|
Compiling Post-Auth-Type REJECT for attr Post-Auth-Type
|
|
824
|
} # server inner-tunnel-ttls
|
|
825
|
server inner-tunnel-peap { # from file /usr/local/etc/raddb/sites-enabled/inner-tunnel-peap
|
|
826
|
# Loading authenticate {...}
|
|
827
|
Compiling Auth-Type PAP for attr Auth-Type
|
|
828
|
Compiling Auth-Type CHAP for attr Auth-Type
|
|
829
|
Compiling Auth-Type MS-CHAP for attr Auth-Type
|
|
830
|
# Loading authorize {...}
|
|
831
|
# Loading session {...}
|
|
832
|
# Loading post-proxy {...}
|
|
833
|
# Loading post-auth {...}
|
|
834
|
# Skipping contents of 'if' as it is always 'false' -- /usr/local/etc/raddb/sites-enabled/inner-tunnel-peap:63
|
|
835
|
Compiling Post-Auth-Type REJECT for attr Post-Auth-Type
|
|
836
|
} # server inner-tunnel-peap
|
|
837
|
radiusd: #### Opening IP addresses and Ports ####
|
|
838
|
listen {
|
|
839
|
type = "auth"
|
|
840
|
ipaddr = 10.168.0.41
|
|
841
|
port = 1812
|
|
842
|
client pfsense {
|
|
843
|
ipaddr = 127.0.0.1
|
|
844
|
require_message_authenticator = no
|
|
845
|
secret = <<< secret >>>
|
|
846
|
shortname = "pfsense"
|
|
847
|
limit {
|
|
848
|
max_connections = 16
|
|
849
|
lifetime = 0
|
|
850
|
idle_timeout = 30
|
|
851
|
}
|
|
852
|
}
|
|
853
|
Ignoring duplicate client 127.0.0.1
|
|
854
|
}
|
|
855
|
listen {
|
|
856
|
type = "acct"
|
|
857
|
ipaddr = 10.168.0.41
|
|
858
|
port = 1813
|
|
859
|
}
|
|
860
|
listen {
|
|
861
|
type = "auth"
|
|
862
|
ipaddr = 127.0.0.1
|
|
863
|
port = 18127
|
|
864
|
}
|
|
865
|
listen {
|
|
866
|
type = "auth"
|
|
867
|
ipaddr = 127.0.0.1
|
|
868
|
port = 18128
|
|
869
|
}
|
|
870
|
Listening on auth address 10.168.0.41 port 1812 bound to server default
|
|
871
|
Listening on acct address 10.168.0.41 port 1813 bound to server default
|
|
872
|
Listening on auth address 127.0.0.1 port 18127 bound to server inner-tunnel-ttls
|
|
873
|
Listening on auth address 127.0.0.1 port 18128 bound to server inner-tunnel-peap
|
|
874
|
Ready to process requests
|
|
875
|
Ignoring request to auth address 10.168.0.41 port 1812 bound to server default from unknown client 10.168.0.194 port 43844 proto udp
|
|
876
|
Ready to process requests
|