FreeRadius server not starting in 2.4.4



  • Hello,

    Today I installed fresh pfsense 2.4.4 and restored backup file taken from 2.4.3p1. Everything is okay. But FreeRadius server doesn't start. What do I have to do?
    By the way, there is a new option in Radius in System / User Manager / Authentication Servers.
    RADIUS NAS IP Attribute (WAN, LAN, OPT1). WAN is selected by default. What is it and which true interface should be selected?



  • @emammadov said in FreeRadius server not starting in 2.4.4:

    NAS IP Attribute

    this is the interface ip address you set in FreeRADIUS/Interfaces.
    As for it not starting up, there was a bug in older version of freeradius, try checking for updates.
    Also check output of radiusd -X



  • Thank you for your answer. We have wan, lan (192.168.2.0/24), op1 (192.168.4.0/24). Servers are in 192.168.2.0/24 network and employees are in 192.168.4.0/24 network. We access pfsense url either https://192.168.2.1 and https://192.168.4.1. I didn't exactly understand which one should I choose. Do I have to remove and install freeradius to work it properly?



  • Go under System > Package Manager you should see icon next to freeradius package to update it.
    Just choose any interface ip, if the nas (like a wireless access point) is on 192.168.4.0/24 network then pick 192.168.4.1
    If you are just using freeradius for just pfsense login then you can choose 192.168.2.1
    You can also add both if you like under FreeRADIUS > Interfaces and pick lan or opt1 you like in auth server. Make sure to set correct port (1812 for auth and 1813 for accounting)



  • There is no update for freeradius. I just uninstalled radius, didn't restart pfsense and installed radus again. But it didn't work either. Radius server doesn't start.



  • go into Diagnostics > Command Prompt
    under "Execute Shell Command" enter this command and hit execute: radiusd -X
    what are the errors you getting in the output?



  • I entered this command in shell, but it loaded too long and gave this error: 504 Gateway Time-out
    nginx

    I loggen in pfsense again and saw Radius serve started, if I stop and start again, it doesn't start. Now the output of this command are as following, it is too long.

    FreeRADIUS Version 3.0.17
    Copyright (C) 1999-2017 The FreeRADIUS server project and contributors
    There is NO warranty; not even for MERCHANTABILITY or FITNESS FOR A
    PARTICULAR PURPOSE
    You may redistribute copies of FreeRADIUS under the terms of the
    GNU General Public License
    For more information about these matters, see the file named COPYRIGHT
    Starting - reading configuration files ...
    including dictionary file /usr/local/share/freeradius/dictionary
    including dictionary file /usr/local/share/freeradius/dictionary.dhcp
    including dictionary file /usr/local/share/freeradius/dictionary.vqp
    including dictionary file /usr/local/etc/raddb/dictionary
    including configuration file /usr/local/etc/raddb/radiusd.conf
    including configuration file /usr/local/etc/raddb/clients.conf
    including files in directory /usr/local/etc/raddb/mods-enabled/
    including configuration file /usr/local/etc/raddb/mods-enabled/unpack
    including configuration file /usr/local/etc/raddb/mods-enabled/utf8
    including configuration file /usr/local/etc/raddb/mods-enabled/dynamic_clients
    including configuration file /usr/local/etc/raddb/mods-enabled/replicate
    including configuration file /usr/local/etc/raddb/mods-enabled/googleauth
    including configuration file /usr/local/etc/raddb/mods-enabled/datacounter_acct
    including configuration file /usr/local/etc/raddb/mods-enabled/soh
    including configuration file /usr/local/etc/raddb/mods-enabled/digest
    including configuration file /usr/local/etc/raddb/mods-enabled/motp
    including configuration file /usr/local/etc/raddb/mods-enabled/linelog
    including configuration file /usr/local/etc/raddb/mods-enabled/mschap
    including configuration file /usr/local/etc/raddb/mods-enabled/echo
    including configuration file /usr/local/etc/raddb/mods-enabled/radutmp
    including configuration file /usr/local/etc/raddb/mods-enabled/logintime
    including configuration file /usr/local/etc/raddb/mods-enabled/detail
    including configuration file /usr/local/etc/raddb/mods-enabled/realm
    including configuration file /usr/local/etc/raddb/mods-enabled/passwd
    including configuration file /usr/local/etc/raddb/mods-enabled/expiration
    including configuration file /usr/local/etc/raddb/mods-enabled/unix
    including configuration file /usr/local/etc/raddb/mods-enabled/exec
    including configuration file /usr/local/etc/raddb/mods-enabled/preprocess
    including configuration file /usr/local/etc/raddb/mods-enabled/always
    including configuration file /usr/local/etc/raddb/mods-enabled/counter
    including configuration file /usr/local/etc/raddb/mods-enabled/files
    including configuration file /usr/local/etc/raddb/mods-enabled/cache_eap
    including configuration file /usr/local/etc/raddb/mods-enabled/eap
    including configuration file /usr/local/etc/raddb/mods-enabled/expr
    including configuration file /usr/local/etc/raddb/mods-enabled/attr_filter
    including configuration file /usr/local/etc/raddb/mods-enabled/detail.log
    including configuration file /usr/local/etc/raddb/mods-enabled/pap
    including configuration file /usr/local/etc/raddb/mods-enabled/sradutmp
    including configuration file /usr/local/etc/raddb/mods-enabled/date
    including configuration file /usr/local/etc/raddb/mods-enabled/chap
    including files in directory /usr/local/etc/raddb/policy.d/
    including configuration file /usr/local/etc/raddb/policy.d/cui
    including configuration file /usr/local/etc/raddb/policy.d/eap
    including configuration file /usr/local/etc/raddb/policy.d/debug
    including configuration file /usr/local/etc/raddb/policy.d/abfab-tr
    including configuration file /usr/local/etc/raddb/policy.d/canonicalization
    including configuration file /usr/local/etc/raddb/policy.d/control
    including configuration file /usr/local/etc/raddb/policy.d/filter
    including configuration file /usr/local/etc/raddb/policy.d/moonshot-targeted-ids
    including configuration file /usr/local/etc/raddb/policy.d/operator-name
    including configuration file /usr/local/etc/raddb/policy.d/accounting
    including configuration file /usr/local/etc/raddb/policy.d/dhcp
    including configuration file /usr/local/etc/raddb/policy.d/pfs_custom_policies
    including files in directory /usr/local/etc/raddb/sites-enabled/
    including configuration file /usr/local/etc/raddb/sites-enabled/default
    including configuration file /usr/local/etc/raddb/sites-enabled/inner-tunnel-peap
    including configuration file /usr/local/etc/raddb/sites-enabled/inner-tunnel-ttls
    main {
     security {
     	allow_core_dumps = no
     }
    	name = "radiusd"
    	prefix = "/usr/local"
    	localstatedir = "/var"
    	logdir = "/var/log"
    	run_dir = "/var/run"
    }
    main {
    	name = "radiusd"
    	prefix = "/usr/local"
    	localstatedir = "/var"
    	sbindir = "/usr/local/sbin"
    	logdir = "/var/log"
    	run_dir = "/var/run"
    	libdir = "/usr/local/lib/freeradius-3.0.17"
    	radacctdir = "/var/log/radacct"
    	hostname_lookups = no
    	max_request_time = 30
    	cleanup_delay = 5
    	max_requests = 1024
    	pidfile = "/var/run/radiusd.pid"
    	checkrad = "/usr/local/sbin/checkrad"
    	debug_level = 0
    	proxy_requests = yes
     log {
     	stripped_names = no
     	auth = yes
     	auth_badpass = no
     	auth_goodpass = no
     	msg_badpass = ""
     	msg_goodpass = ""
     	colourise = yes
     	msg_denied = "You are already logged in - access denied"
     }
     resources {
     }
     security {
     	max_attributes = 200
     	reject_delay = 1.000000
     	status_server = no
     }
    }
    radiusd: #### Loading Realms and Home Servers ####
    radiusd: #### Loading Clients ####
     client pfsense {
     	ipaddr = 127.0.0.1
     	require_message_authenticator = no
     	secret = <<< secret >>>
     	nas_type = "other"
     	proto = "udp"
      limit {
      	max_connections = 16
      	lifetime = 0
      	idle_timeout = 30
      }
     }
    Debugger not attached
     # Creating Auth-Type = mschap
     # Creating Auth-Type = digest
     # Creating Auth-Type = eap
     # Creating Auth-Type = PAP
     # Creating Auth-Type = CHAP
     # Creating Auth-Type = MS-CHAP
     # Creating Auth-Type = MOTP
     # Creating Auth-Type = GOOGLEAUTH
     # Creating Autz-Type = Status-Server
     # Creating Acct-Type = Status-Server
    radiusd: #### Instantiating modules ####
     modules {
      # Loaded module rlm_unpack
      # Loading module "unpack" from file /usr/local/etc/raddb/mods-enabled/unpack
      # Loaded module rlm_utf8
      # Loading module "utf8" from file /usr/local/etc/raddb/mods-enabled/utf8
      # Loaded module rlm_dynamic_clients
      # Loading module "dynamic_clients" from file /usr/local/etc/raddb/mods-enabled/dynamic_clients
      # Loaded module rlm_replicate
      # Loading module "replicate" from file /usr/local/etc/raddb/mods-enabled/replicate
      # Loaded module rlm_exec
      # Loading module "googleauth" from file /usr/local/etc/raddb/mods-enabled/googleauth
      exec googleauth {
      	wait = yes
      	program = "/usr/local/etc/raddb/scripts/googleauth.py %{request:User-Name} %{reply:MOTP-Init-Secret} %{reply:MOTP-PIN} %{request:User-Password}"
      	shell_escape = yes
      }
      # Loading module "datacounterdaily" from file /usr/local/etc/raddb/mods-enabled/datacounter_acct
      exec datacounterdaily {
      	wait = yes
      	program = "/bin/sh /usr/local/etc/raddb/scripts/datacounter_acct.sh %{request:User-Name} daily %{request:Acct-Input-Octets} %{request:Acct-Output-Octets} %{request:Acct-Status-Type} %{request:Acct-Session-Id}"
      	shell_escape = yes
      }
      # Loading module "datacounterweekly" from file /usr/local/etc/raddb/mods-enabled/datacounter_acct
      exec datacounterweekly {
      	wait = yes
      	program = "/bin/sh /usr/local/etc/raddb/scripts/datacounter_acct.sh %{request:User-Name} weekly %{request:Acct-Input-Octets} %{request:Acct-Output-Octets} %{request:Acct-Status-Type} %{request:Acct-Session-Id}"
      	shell_escape = yes
      }
      # Loading module "datacountermonthly" from file /usr/local/etc/raddb/mods-enabled/datacounter_acct
      exec datacountermonthly {
      	wait = yes
      	program = "/bin/sh /usr/local/etc/raddb/scripts/datacounter_acct.sh %{request:User-Name} monthly %{request:Acct-Input-Octets} %{request:Acct-Output-Octets} %{request:Acct-Status-Type} %{request:Acct-Session-Id}"
      	shell_escape = yes
      }
      # Loading module "datacounterforever" from file /usr/local/etc/raddb/mods-enabled/datacounter_acct
      exec datacounterforever {
      	wait = yes
      	program = "/bin/sh /usr/local/etc/raddb/scripts/datacounter_acct.sh %{request:User-Name} forever %{request:Acct-Input-Octets} %{request:Acct-Output-Octets} %{request:Acct-Status-Type} %{request:Acct-Session-Id}"
      	shell_escape = yes
      }
      # Loaded module rlm_soh
      # Loading module "soh" from file /usr/local/etc/raddb/mods-enabled/soh
      soh {
      	dhcp = yes
      }
      # Loaded module rlm_digest
      # Loading module "digest" from file /usr/local/etc/raddb/mods-enabled/digest
      # Loading module "motp" from file /usr/local/etc/raddb/mods-enabled/motp
      exec motp {
      	wait = yes
      	program = "/usr/local/bin/bash /usr/local/etc/raddb/scripts/otpverify.sh %{request:User-Name} %{request:User-Password} %{reply:MOTP-Init-Secret} %{reply:MOTP-PIN} %{reply:MOTP-Offset}"
      	shell_escape = yes
      }
      # Loaded module rlm_linelog
      # Loading module "linelog" from file /usr/local/etc/raddb/mods-enabled/linelog
      linelog {
      	filename = "/var/log/linelog"
      	escape_filenames = no
      	syslog_severity = "info"
      	permissions = 384
      	format = "This is a log message for %{User-Name}"
      	reference = "messages.%{%{reply:Packet-Type}:-default}"
      }
      # Loading module "log_accounting" from file /usr/local/etc/raddb/mods-enabled/linelog
      linelog log_accounting {
      	filename = "/var/log/linelog-accounting"
      	escape_filenames = no
      	syslog_severity = "info"
      	permissions = 384
      	format = ""
      	reference = "Accounting-Request.%{%{Acct-Status-Type}:-unknown}"
      }
      # Loaded module rlm_mschap
      # Loading module "mschap" from file /usr/local/etc/raddb/mods-enabled/mschap
      mschap {
      	use_mppe = yes
      	require_encryption = no
      	require_strong = no
      	with_ntdomain_hack = yes
       passchange {
       }
      	allow_retry = yes
      	winbind_retry_with_normalised_username = no
      }
      # Loading module "echo" from file /usr/local/etc/raddb/mods-enabled/echo
      exec echo {
      	wait = yes
      	program = "/bin/echo %{User-Name}"
      	input_pairs = "request"
      	output_pairs = "reply"
      	shell_escape = yes
      }
      # Loaded module rlm_radutmp
      # Loading module "radutmp" from file /usr/local/etc/raddb/mods-enabled/radutmp
      radutmp {
      	filename = "/var/log/radutmp"
      	username = "%{User-Name}"
      	case_sensitive = yes
      	check_with_nas = yes
      	permissions = 384
      	caller_id = yes
      }
      # Loaded module rlm_logintime
      # Loading module "logintime" from file /usr/local/etc/raddb/mods-enabled/logintime
      logintime {
      	minimum_timeout = 60
      }
      # Loaded module rlm_detail
      # Loading module "detail" from file /usr/local/etc/raddb/mods-enabled/detail
      detail {
      	filename = "/var/log/radacct/%{%{Packet-Src-IP-Address}:-%{Packet-Src-IPv6-Address}}/detail-%Y%m%d"
      	header = "%t"
      	permissions = 384
      	locking = no
      	escape_filenames = no
      	log_packet_header = no
      }
      # Loaded module rlm_realm
      # Loading module "IPASS" from file /usr/local/etc/raddb/mods-enabled/realm
      realm IPASS {
      	format = "prefix"
      	delimiter = "/"
      	ignore_default = no
      	ignore_null = yes
      }
      # Loading module "suffix" from file /usr/local/etc/raddb/mods-enabled/realm
      realm suffix {
      	format = "suffix"
      	delimiter = "@"
      	ignore_default = no
      	ignore_null = yes
      }
      # Loading module "realmpercent" from file /usr/local/etc/raddb/mods-enabled/realm
      realm realmpercent {
      	format = "suffix"
      	delimiter = "%"
      	ignore_default = no
      	ignore_null = yes
      }
      # Loading module "ntdomain" from file /usr/local/etc/raddb/mods-enabled/realm
      realm ntdomain {
      	format = "prefix"
      	delimiter = "\"
      	ignore_default = no
      	ignore_null = yes
      }
      # Loaded module rlm_passwd
      # Loading module "etc_passwd" from file /usr/local/etc/raddb/mods-enabled/passwd
      passwd etc_passwd {
      	filename = "/etc/passwd"
      	format = "*User-Name:Crypt-Password:"
      	delimiter = ":"
      	ignore_nislike = no
      	ignore_empty = yes
      	allow_multiple_keys = no
      	hash_size = 100
      }
      # Loaded module rlm_expiration
      # Loading module "expiration" from file /usr/local/etc/raddb/mods-enabled/expiration
      # Loaded module rlm_unix
      # Loading module "unix" from file /usr/local/etc/raddb/mods-enabled/unix
      unix {
      	radwtmp = "/var/log/radwtmp"
      }
    Creating attribute Unix-Group
      # Loading module "exec" from file /usr/local/etc/raddb/mods-enabled/exec
      exec {
      	wait = no
      	input_pairs = "request"
      	shell_escape = yes
      	timeout = 10
      }
      # Loaded module rlm_preprocess
      # Loading module "preprocess" from file /usr/local/etc/raddb/mods-enabled/preprocess
      preprocess {
      	huntgroups = "/usr/local/etc/raddb/mods-config/preprocess/huntgroups"
      	hints = "/usr/local/etc/raddb/mods-config/preprocess/hints"
      	with_ascend_hack = no
      	ascend_channels_per_line = 23
      	with_ntdomain_hack = no
      	with_specialix_jetstream_hack = no
      	with_cisco_vsa_hack = no
      	with_alvarion_vsa_hack = no
      }
      # Loaded module rlm_always
      # Loading module "reject" from file /usr/local/etc/raddb/mods-enabled/always
      always reject {
      	rcode = "reject"
      	simulcount = 0
      	mpp = no
      }
      # Loading module "fail" from file /usr/local/etc/raddb/mods-enabled/always
      always fail {
      	rcode = "fail"
      	simulcount = 0
      	mpp = no
      }
      # Loading module "ok" from file /usr/local/etc/raddb/mods-enabled/always
      always ok {
      	rcode = "ok"
      	simulcount = 0
      	mpp = no
      }
      # Loading module "handled" from file /usr/local/etc/raddb/mods-enabled/always
      always handled {
      	rcode = "handled"
      	simulcount = 0
      	mpp = no
      }
      # Loading module "invalid" from file /usr/local/etc/raddb/mods-enabled/always
      always invalid {
      	rcode = "invalid"
      	simulcount = 0
      	mpp = no
      }
      # Loading module "userlock" from file /usr/local/etc/raddb/mods-enabled/always
      always userlock {
      	rcode = "userlock"
      	simulcount = 0
      	mpp = no
      }
      # Loading module "notfound" from file /usr/local/etc/raddb/mods-enabled/always
      always notfound {
      	rcode = "notfound"
      	simulcount = 0
      	mpp = no
      }
      # Loading module "noop" from file /usr/local/etc/raddb/mods-enabled/always
      always noop {
      	rcode = "noop"
      	simulcount = 0
      	mpp = no
      }
      # Loading module "updated" from file /usr/local/etc/raddb/mods-enabled/always
      always updated {
      	rcode = "updated"
      	simulcount = 0
      	mpp = no
      }
      # Loaded module rlm_counter
      # Loading module "daily" from file /usr/local/etc/raddb/mods-enabled/counter
      counter daily {
      	filename = "/var/log/radacct/timecounter/db.daily"
      	key = "User-Name"
      	reset = "daily"
      	count_attribute = "Acct-Session-Time"
      	counter_name = "Daily-Session-Time"
      	check_name = "Max-Daily-Session"
      	reply_name = "Session-Timeout"
      	cache_size = 5000
      }
      # Loading module "weekly" from file /usr/local/etc/raddb/mods-enabled/counter
      counter weekly {
      	filename = "/var/log/radacct/timecounter/db.weekly"
      	key = "User-Name"
      	reset = "weekly"
      	count_attribute = "Acct-Session-Time"
      	counter_name = "Weekly-Session-Time"
      	check_name = "Max-Weekly-Session"
      	reply_name = "Session-Timeout"
      	cache_size = 5000
      }
      # Loading module "monthly" from file /usr/local/etc/raddb/mods-enabled/counter
      counter monthly {
      	filename = "/var/log/radacct/timecounter/db.monthly"
      	key = "User-Name"
      	reset = "monthly"
      	count_attribute = "Acct-Session-Time"
      	counter_name = "Monthly-Session-Time"
      	check_name = "Max-Monthly-Session"
      	reply_name = "Session-Timeout"
      	cache_size = 5000
      }
      # Loading module "forever" from file /usr/local/etc/raddb/mods-enabled/counter
      counter forever {
      	filename = "/var/log/radacct/timecounter/db.forever"
      	key = "User-Name"
      	reset = "never"
      	count_attribute = "Acct-Session-Time"
      	counter_name = "Forever-Session-Time"
      	check_name = "Max-Forever-Session"
      	reply_name = "Session-Timeout"
      	cache_size = 5000
      }
      # Loaded module rlm_files
      # Loading module "files" from file /usr/local/etc/raddb/mods-enabled/files
      files {
      	filename = "/usr/local/etc/raddb/mods-config/files/authorize"
      	acctusersfile = "/usr/local/etc/raddb/mods-config/files/accounting"
      	preproxy_usersfile = "/usr/local/etc/raddb/mods-config/files/pre-proxy"
      }
      # Loaded module rlm_cache
      # Loading module "cache_eap" from file /usr/local/etc/raddb/mods-enabled/cache_eap
      cache cache_eap {
      	driver = "rlm_cache_rbtree"
      	key = "%{%{control:State}:-%{%{reply:State}:-%{State}}}"
      	ttl = 15
      	max_entries = 0
      	epoch = 0
      	add_stats = no
      }
      # Loaded module rlm_eap
      # Loading module "eap" from file /usr/local/etc/raddb/mods-enabled/eap
      eap {
      	default_eap_type = "mschapv2"
      	timer_expire = 60
      	ignore_unknown_eap_types = no
      	cisco_accounting_username_bug = no
      	max_sessions = 4096
      }
      # Loaded module rlm_expr
      # Loading module "expr" from file /usr/local/etc/raddb/mods-enabled/expr
      expr {
      	safe_characters = "@abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ0123456789.-_: /äéöüàâæçèéêëîïôœùûüaÿÄÉÖÜßÀÂÆÇÈÉÊËÎÏÔŒÙÛÜŸ"
      }
      # Loaded module rlm_attr_filter
      # Loading module "attr_filter.post-proxy" from file /usr/local/etc/raddb/mods-enabled/attr_filter
      attr_filter attr_filter.post-proxy {
      	filename = "/usr/local/etc/raddb/mods-config/attr_filter/post-proxy"
      	key = "%{Realm}"
      	relaxed = no
      }
      # Loading module "attr_filter.pre-proxy" from file /usr/local/etc/raddb/mods-enabled/attr_filter
      attr_filter attr_filter.pre-proxy {
      	filename = "/usr/local/etc/raddb/mods-config/attr_filter/pre-proxy"
      	key = "%{Realm}"
      	relaxed = no
      }
      # Loading module "attr_filter.access_reject" from file /usr/local/etc/raddb/mods-enabled/attr_filter
      attr_filter attr_filter.access_reject {
      	filename = "/usr/local/etc/raddb/mods-config/attr_filter/access_reject"
      	key = "%{User-Name}"
      	relaxed = no
      }
      # Loading module "attr_filter.access_challenge" from file /usr/local/etc/raddb/mods-enabled/attr_filter
      attr_filter attr_filter.access_challenge {
      	filename = "/usr/local/etc/raddb/mods-config/attr_filter/access_challenge"
      	key = "%{User-Name}"
      	relaxed = no
      }
      # Loading module "attr_filter.accounting_response" from file /usr/local/etc/raddb/mods-enabled/attr_filter
      attr_filter attr_filter.accounting_response {
      	filename = "/usr/local/etc/raddb/mods-config/attr_filter/accounting_response"
      	key = "%{User-Name}"
      	relaxed = no
      }
      # Loading module "auth_log" from file /usr/local/etc/raddb/mods-enabled/detail.log
      detail auth_log {
      	filename = "/var/log/radacct/%{%{Packet-Src-IP-Address}:-%{Packet-Src-IPv6-Address}}/auth-detail-%Y%m%d"
      	header = "%t"
      	permissions = 384
      	locking = no
      	escape_filenames = no
      	log_packet_header = no
      }
      # Loading module "reply_log" from file /usr/local/etc/raddb/mods-enabled/detail.log
      detail reply_log {
      	filename = "/var/log/radacct/%{%{Packet-Src-IP-Address}:-%{Packet-Src-IPv6-Address}}/reply-detail-%Y%m%d"
      	header = "%t"
      	permissions = 384
      	locking = no
      	escape_filenames = no
      	log_packet_header = no
      }
      # Loading module "pre_proxy_log" from file /usr/local/etc/raddb/mods-enabled/detail.log
      detail pre_proxy_log {
      	filename = "/var/log/radacct/%{%{Packet-Src-IP-Address}:-%{Packet-Src-IPv6-Address}}/pre-proxy-detail-%Y%m%d"
      	header = "%t"
      	permissions = 384
      	locking = no
      	escape_filenames = no
      	log_packet_header = no
      }
      # Loading module "post_proxy_log" from file /usr/local/etc/raddb/mods-enabled/detail.log
      detail post_proxy_log {
      	filename = "/var/log/radacct/%{%{Packet-Src-IP-Address}:-%{Packet-Src-IPv6-Address}}/post-proxy-detail-%Y%m%d"
      	header = "%t"
      	permissions = 384
      	locking = no
      	escape_filenames = no
      	log_packet_header = no
      }
      # Loaded module rlm_pap
      # Loading module "pap" from file /usr/local/etc/raddb/mods-enabled/pap
      pap {
      	normalise = yes
      }
      # Loading module "sradutmp" from file /usr/local/etc/raddb/mods-enabled/sradutmp
      radutmp sradutmp {
      	filename = "/var/log/sradutmp"
      	username = "%{User-Name}"
      	case_sensitive = yes
      	check_with_nas = yes
      	permissions = 420
      	caller_id = no
      }
      # Loaded module rlm_date
      # Loading module "date" from file /usr/local/etc/raddb/mods-enabled/date
      date {
      	format = "%b %e %Y %H:%M:%S %Z"
      	utc = no
      }
      # Loaded module rlm_chap
      # Loading module "chap" from file /usr/local/etc/raddb/mods-enabled/chap
      instantiate {
      # Instantiating module "expiration" from file /usr/local/etc/raddb/mods-enabled/expiration
      # Instantiating module "logintime" from file /usr/local/etc/raddb/mods-enabled/logintime
      # Instantiating module "daily" from file /usr/local/etc/raddb/mods-enabled/counter
    rlm_counter: Current Time: 1539678732 [2018-10-16 12:32:12], Next reset 1539720000 [2018-10-17 00:00:00]
    rlm_counter: add_defaults: Start
    rlm_counter: DEFAULT1 set to 1539720000
    rlm_counter: DEFAULT2 set to 1539678732
    rlm_counter: add_defaults: End
      # Instantiating module "weekly" from file /usr/local/etc/raddb/mods-enabled/counter
    rlm_counter: Current Time: 1539678732 [2018-10-16 12:32:12], Next reset 1540065600 [2018-10-21 00:00:00]
    rlm_counter: add_defaults: Start
    rlm_counter: DEFAULT1 set to 1540065600
    rlm_counter: DEFAULT2 set to 1539678732
    rlm_counter: add_defaults: End
      # Instantiating module "monthly" from file /usr/local/etc/raddb/mods-enabled/counter
    rlm_counter: Current Time: 1539678732 [2018-10-16 12:32:12], Next reset 1541016000 [2018-11-01 00:00:00]
    rlm_counter: add_defaults: Start
    rlm_counter: DEFAULT1 set to 1541016000
    rlm_counter: DEFAULT2 set to 1539678732
    rlm_counter: add_defaults: End
      # Instantiating module "forever" from file /usr/local/etc/raddb/mods-enabled/counter
    rlm_counter: Current Time: 1539678732 [2018-10-16 12:32:12], Next reset 0 [2018-10-16 12:00:00]
    rlm_counter: add_defaults: Start
    rlm_counter: DEFAULT1 set to 0
    rlm_counter: DEFAULT2 set to 1539678732
    rlm_counter: add_defaults: End
      }
      # Instantiating module "linelog" from file /usr/local/etc/raddb/mods-enabled/linelog
      # Instantiating module "log_accounting" from file /usr/local/etc/raddb/mods-enabled/linelog
      # Instantiating module "mschap" from file /usr/local/etc/raddb/mods-enabled/mschap
    rlm_mschap (mschap): using internal authentication
      # Instantiating module "detail" from file /usr/local/etc/raddb/mods-enabled/detail
      # Instantiating module "IPASS" from file /usr/local/etc/raddb/mods-enabled/realm
      # Instantiating module "suffix" from file /usr/local/etc/raddb/mods-enabled/realm
      # Instantiating module "realmpercent" from file /usr/local/etc/raddb/mods-enabled/realm
      # Instantiating module "ntdomain" from file /usr/local/etc/raddb/mods-enabled/realm
      # Instantiating module "etc_passwd" from file /usr/local/etc/raddb/mods-enabled/passwd
    rlm_passwd: nfields: 3 keyfield 0(User-Name) listable: no
      # Instantiating module "preprocess" from file /usr/local/etc/raddb/mods-enabled/preprocess
    reading pairlist file /usr/local/etc/raddb/mods-config/preprocess/huntgroups
    reading pairlist file /usr/local/etc/raddb/mods-config/preprocess/hints
      # Instantiating module "reject" from file /usr/local/etc/raddb/mods-enabled/always
      # Instantiating module "fail" from file /usr/local/etc/raddb/mods-enabled/always
      # Instantiating module "ok" from file /usr/local/etc/raddb/mods-enabled/always
      # Instantiating module "handled" from file /usr/local/etc/raddb/mods-enabled/always
      # Instantiating module "invalid" from file /usr/local/etc/raddb/mods-enabled/always
      # Instantiating module "userlock" from file /usr/local/etc/raddb/mods-enabled/always
      # Instantiating module "notfound" from file /usr/local/etc/raddb/mods-enabled/always
      # Instantiating module "noop" from file /usr/local/etc/raddb/mods-enabled/always
      # Instantiating module "updated" from file /usr/local/etc/raddb/mods-enabled/always
      # Instantiating module "files" from file /usr/local/etc/raddb/mods-enabled/files
    reading pairlist file /usr/local/etc/raddb/mods-config/files/authorize
    reading pairlist file /usr/local/etc/raddb/mods-config/files/accounting
    reading pairlist file /usr/local/etc/raddb/mods-config/files/pre-proxy
      # Instantiating module "cache_eap" from file /usr/local/etc/raddb/mods-enabled/cache_eap
    rlm_cache (cache_eap): Driver rlm_cache_rbtree (module rlm_cache_rbtree) loaded and linked
      # Instantiating module "eap" from file /usr/local/etc/raddb/mods-enabled/eap
       # Linked to sub-module rlm_eap_md5
       # Linked to sub-module rlm_eap_leap
       # Linked to sub-module rlm_eap_gtc
       gtc {
       	challenge = "Password: "
       	auth_type = "PAP"
       }
       # Linked to sub-module rlm_eap_tls
       tls {
       	tls = "tls-common"
       }
       tls-config tls-common {
       	verify_depth = 0
       	ca_path = "/usr/local/etc/raddb/certs"
       	pem_file_type = yes
       	private_key_file = "/usr/local/etc/raddb/certs/server_key.pem"
       	certificate_file = "/usr/local/etc/raddb/certs/server_cert.pem"
       	ca_file = "/usr/local/etc/raddb/certs/ca_cert.pem"
       	dh_file = "/usr/local/etc/raddb/certs/dh"
       	random_file = "/dev/urandom"
       	fragment_size = 1024
       	include_length = yes
       	auto_chain = yes
       	check_crl = no
       	check_all_crl = no
       	cipher_list = "DEFAULT"
       	cipher_server_preference = no
       	ecdh_curve = "prime256v1"
       	tls_max_version = ""
       	tls_min_version = "1.0"
        cache {
        	enable = no
        	lifetime = 24
        	max_entries = 255
        }
        verify {
        	skip_if_ocsp_ok = no
        }
        ocsp {
        	enable = no
        	override_cert_url = no
        	url = "http://127.0.0.1/ocsp/"
        	use_nonce = yes
        	timeout = 0
        	softfail = no
        }
       }
       # Linked to sub-module rlm_eap_ttls
       ttls {
       	tls = "tls-common"
       	default_eap_type = "md5"
       	copy_request_to_tunnel = no
       	use_tunneled_reply = no
       	virtual_server = "inner-tunnel-ttls"
       	include_length = yes
       	require_client_cert = no
       }
    tls: Using cached TLS configuration from previous invocation
       # Linked to sub-module rlm_eap_peap
       peap {
       	tls = "tls-common"
       	default_eap_type = "mschapv2"
       	copy_request_to_tunnel = no
       	use_tunneled_reply = no
       	proxy_tunneled_request_as_eap = yes
       	virtual_server = "inner-tunnel-peap"
       	soh = no
       	require_client_cert = no
       }
    tls: Using cached TLS configuration from previous invocation
       # Linked to sub-module rlm_eap_mschapv2
       mschapv2 {
       	with_ntdomain_hack = no
       	send_error = no
       }
      # Instantiating module "attr_filter.post-proxy" from file /usr/local/etc/raddb/mods-enabled/attr_filter
    reading pairlist file /usr/local/etc/raddb/mods-config/attr_filter/post-proxy
      # Instantiating module "attr_filter.pre-proxy" from file /usr/local/etc/raddb/mods-enabled/attr_filter
    reading pairlist file /usr/local/etc/raddb/mods-config/attr_filter/pre-proxy
      # Instantiating module "attr_filter.access_reject" from file /usr/local/etc/raddb/mods-enabled/attr_filter
    reading pairlist file /usr/local/etc/raddb/mods-config/attr_filter/access_reject
    [/usr/local/etc/raddb/mods-config/attr_filter/access_reject]:11 Check item "FreeRADIUS-Response-Delay" 	found in filter list for realm "DEFAULT".
    [/usr/local/etc/raddb/mods-config/attr_filter/access_reject]:11 Check item "FreeRADIUS-Response-Delay-USec" 	found in filter list for realm "DEFAULT".
      # Instantiating module "attr_filter.access_challenge" from file /usr/local/etc/raddb/mods-enabled/attr_filter
    reading pairlist file /usr/local/etc/raddb/mods-config/attr_filter/access_challenge
      # Instantiating module "attr_filter.accounting_response" from file /usr/local/etc/raddb/mods-enabled/attr_filter
    reading pairlist file /usr/local/etc/raddb/mods-config/attr_filter/accounting_response
      # Instantiating module "auth_log" from file /usr/local/etc/raddb/mods-enabled/detail.log
    rlm_detail (auth_log): 'User-Password' suppressed, will not appear in detail output
      # Instantiating module "reply_log" from file /usr/local/etc/raddb/mods-enabled/detail.log
      # Instantiating module "pre_proxy_log" from file /usr/local/etc/raddb/mods-enabled/detail.log
      # Instantiating module "post_proxy_log" from file /usr/local/etc/raddb/mods-enabled/detail.log
      # Instantiating module "pap" from file /usr/local/etc/raddb/mods-enabled/pap
     } # modules
    radiusd: #### Loading Virtual Servers ####
    server { # from file /usr/local/etc/raddb/radiusd.conf
    } # server
    server default { # from file /usr/local/etc/raddb/sites-enabled/default
     # Loading authenticate {...}
     # Loading authorize {...}
     # Loading preacct {...}
     # Loading accounting {...}
     # Loading session {...}
     # Loading pre-proxy {...}
     # Loading post-proxy {...}
     # Loading post-auth {...}
    } # server default
    server inner-tunnel-peap { # from file /usr/local/etc/raddb/sites-enabled/inner-tunnel-peap
     # Loading authenticate {...}
     # Loading authorize {...}
    Ignoring "sql" (see raddb/mods-available/README.rst)
    Ignoring "ldap" (see raddb/mods-available/README.rst)
     # Loading session {...}
     # Loading post-proxy {...}
     # Loading post-auth {...}
    } # server inner-tunnel-peap
    server inner-tunnel-ttls { # from file /usr/local/etc/raddb/sites-enabled/inner-tunnel-ttls
     # Loading authenticate {...}
     # Loading authorize {...}
     # Loading session {...}
     # Loading post-proxy {...}
     # Loading post-auth {...}
    } # server inner-tunnel-ttls
    radiusd: #### Opening IP addresses and Ports ####
    listen {
      	type = "auth"
      	ipaddr = *
      	port = 1812
    Failed binding to auth address * port 1812 bound to server default: Address already in use
    /usr/local/etc/raddb/sites-enabled/default[2]: Error binding to port for 0.0.0.0 port 1812
    


  • it really shouldn't do that. Enable ssh for now (you can disable it later) under "System" > "Advanced" and hit save.
    If you are on windows install ssh program like putty. Enter the ip address of pfsense and hit open. login with your pfsense username/password. When connected to ssh, select option 8 for shell. and try radiusd -X again.



  • @emammadov ignore the last post, we got the output we wanted. i think i know what is wrong, what is the ip address set for auth under Services > FreeRADIUS > Interfaces

    It should be either 192.168.4.1 or 192.168.2.1



  • I deleted * from interfaces and added 192.168.2.1 and 192.168.4.1, but it didn't help too. My screenshots and output from ssh are as following. I have used radius for pfsense webgui in 2.4.3p1.

    0_1539681859463_1.jpg
    0_1539681864534_2.jpg
    0_1539681869419_3.jpg
    0_1539681873433_4.jpg

    Enter an option: 8
    
    [2.4.4-RELEASE][admin@pfsense.smart.az]/root: radiusd -X
    FreeRADIUS Version 3.0.17
    Copyright (C) 1999-2017 The FreeRADIUS server project and contributors
    There is NO warranty; not even for MERCHANTABILITY or FITNESS FOR A
    PARTICULAR PURPOSE
    You may redistribute copies of FreeRADIUS under the terms of the
    GNU General Public License
    For more information about these matters, see the file named COPYRIGHT
    Starting - reading configuration files ...
    including dictionary file /usr/local/share/freeradius/dictionary
    including dictionary file /usr/local/share/freeradius/dictionary.dhcp
    including dictionary file /usr/local/share/freeradius/dictionary.vqp
    including dictionary file /usr/local/etc/raddb/dictionary
    including configuration file /usr/local/etc/raddb/radiusd.conf
    including configuration file /usr/local/etc/raddb/clients.conf
    including files in directory /usr/local/etc/raddb/mods-enabled/
    including configuration file /usr/local/etc/raddb/mods-enabled/unpack
    including configuration file /usr/local/etc/raddb/mods-enabled/utf8
    including configuration file /usr/local/etc/raddb/mods-enabled/dynamic_clients
    including configuration file /usr/local/etc/raddb/mods-enabled/replicate
    including configuration file /usr/local/etc/raddb/mods-enabled/googleauth
    including configuration file /usr/local/etc/raddb/mods-enabled/datacounter_acct
    including configuration file /usr/local/etc/raddb/mods-enabled/soh
    including configuration file /usr/local/etc/raddb/mods-enabled/digest
    including configuration file /usr/local/etc/raddb/mods-enabled/motp
    including configuration file /usr/local/etc/raddb/mods-enabled/linelog
    including configuration file /usr/local/etc/raddb/mods-enabled/mschap
    including configuration file /usr/local/etc/raddb/mods-enabled/echo
    including configuration file /usr/local/etc/raddb/mods-enabled/radutmp
    including configuration file /usr/local/etc/raddb/mods-enabled/logintime
    including configuration file /usr/local/etc/raddb/mods-enabled/detail
    including configuration file /usr/local/etc/raddb/mods-enabled/realm
    including configuration file /usr/local/etc/raddb/mods-enabled/passwd
    including configuration file /usr/local/etc/raddb/mods-enabled/expiration
    including configuration file /usr/local/etc/raddb/mods-enabled/unix
    including configuration file /usr/local/etc/raddb/mods-enabled/exec
    including configuration file /usr/local/etc/raddb/mods-enabled/preprocess
    including configuration file /usr/local/etc/raddb/mods-enabled/always
    including configuration file /usr/local/etc/raddb/mods-enabled/counter
    including configuration file /usr/local/etc/raddb/mods-enabled/files
    including configuration file /usr/local/etc/raddb/mods-enabled/cache_eap
    including configuration file /usr/local/etc/raddb/mods-enabled/eap
    including configuration file /usr/local/etc/raddb/mods-enabled/expr
    including configuration file /usr/local/etc/raddb/mods-enabled/attr_filter
    including configuration file /usr/local/etc/raddb/mods-enabled/detail.log
    including configuration file /usr/local/etc/raddb/mods-enabled/pap
    including configuration file /usr/local/etc/raddb/mods-enabled/sradutmp
    including configuration file /usr/local/etc/raddb/mods-enabled/date
    including configuration file /usr/local/etc/raddb/mods-enabled/chap
    including files in directory /usr/local/etc/raddb/policy.d/
    including configuration file /usr/local/etc/raddb/policy.d/cui
    including configuration file /usr/local/etc/raddb/policy.d/eap
    including configuration file /usr/local/etc/raddb/policy.d/debug
    including configuration file /usr/local/etc/raddb/policy.d/abfab-tr
    including configuration file /usr/local/etc/raddb/policy.d/canonicalization
    including configuration file /usr/local/etc/raddb/policy.d/control
    including configuration file /usr/local/etc/raddb/policy.d/filter
    including configuration file /usr/local/etc/raddb/policy.d/moonshot-targeted-ids
    including configuration file /usr/local/etc/raddb/policy.d/operator-name
    including configuration file /usr/local/etc/raddb/policy.d/accounting
    including configuration file /usr/local/etc/raddb/policy.d/dhcp
    including configuration file /usr/local/etc/raddb/policy.d/pfs_custom_policies
    including files in directory /usr/local/etc/raddb/sites-enabled/
    including configuration file /usr/local/etc/raddb/sites-enabled/default
    including configuration file /usr/local/etc/raddb/sites-enabled/inner-tunnel-peap
    including configuration file /usr/local/etc/raddb/sites-enabled/inner-tunnel-ttls
    main {
     security {
            allow_core_dumps = no
     }
            name = "radiusd"
            prefix = "/usr/local"
            localstatedir = "/var"
            logdir = "/var/log"
            run_dir = "/var/run"
    }
    main {
            name = "radiusd"
            prefix = "/usr/local"
            localstatedir = "/var"
            sbindir = "/usr/local/sbin"
            logdir = "/var/log"
            run_dir = "/var/run"
            libdir = "/usr/local/lib/freeradius-3.0.17"
            radacctdir = "/var/log/radacct"
            hostname_lookups = no
            max_request_time = 30
            cleanup_delay = 5
            max_requests = 1024
            pidfile = "/var/run/radiusd.pid"
            checkrad = "/usr/local/sbin/checkrad"
            debug_level = 0
            proxy_requests = yes
     log {
            stripped_names = no
            auth = yes
            auth_badpass = no
            auth_goodpass = no
            msg_badpass = ""
            msg_goodpass = ""
            colourise = yes
            msg_denied = "You are already logged in - access denied"
     }
     resources {
     }
     security {
            max_attributes = 200
            reject_delay = 1.000000
            status_server = no
     }
    }
    radiusd: #### Loading Realms and Home Servers ####
    radiusd: #### Loading Clients ####
     client pfsense {
            ipaddr = 127.0.0.1
            require_message_authenticator = no
            secret = <<< secret >>>
            nas_type = "other"
            proto = "udp"
      limit {
            max_connections = 16
            lifetime = 0
            idle_timeout = 30
      }
     }
    Debugger not attached
     # Creating Auth-Type = mschap
     # Creating Auth-Type = digest
     # Creating Auth-Type = eap
     # Creating Auth-Type = PAP
     # Creating Auth-Type = CHAP
     # Creating Auth-Type = MS-CHAP
     # Creating Auth-Type = MOTP
     # Creating Auth-Type = GOOGLEAUTH
     # Creating Autz-Type = Status-Server
     # Creating Acct-Type = Status-Server
    radiusd: #### Instantiating modules ####
     modules {
      # Loaded module rlm_unpack
      # Loading module "unpack" from file /usr/local/etc/raddb/mods-enabled/unpack
      # Loaded module rlm_utf8
      # Loading module "utf8" from file /usr/local/etc/raddb/mods-enabled/utf8
      # Loaded module rlm_dynamic_clients
      # Loading module "dynamic_clients" from file /usr/local/etc/raddb/mods-enabled/dynamic_clients
      # Loaded module rlm_replicate
      # Loading module "replicate" from file /usr/local/etc/raddb/mods-enabled/replicate
      # Loaded module rlm_exec
      # Loading module "googleauth" from file /usr/local/etc/raddb/mods-enabled/googleauth
      exec googleauth {
            wait = yes
            program = "/usr/local/etc/raddb/scripts/googleauth.py %{request:User-Name} %{reply:MOTP-Init-Secret} %{reply:MOTP-PIN} %{request:User-Password}"
            shell_escape = yes
      }
      # Loading module "datacounterdaily" from file /usr/local/etc/raddb/mods-enabled/datacounter_acct
      exec datacounterdaily {
            wait = yes
            program = "/bin/sh /usr/local/etc/raddb/scripts/datacounter_acct.sh %{request:User-Name} daily %{request:Acct-Input-Octets} %{request:Acct-Output-Octets} %{request:Acct-Status-Type} %{request:Acct-Session-Id}"
            shell_escape = yes
      }
      # Loading module "datacounterweekly" from file /usr/local/etc/raddb/mods-enabled/datacounter_acct
      exec datacounterweekly {
            wait = yes
            program = "/bin/sh /usr/local/etc/raddb/scripts/datacounter_acct.sh %{request:User-Name} weekly %{request:Acct-Input-Octets} %{request:Acct-Output-Octets} %{request:Acct-Status-Type} %{request:Acct-Session-Id}"
            shell_escape = yes
      }
      # Loading module "datacountermonthly" from file /usr/local/etc/raddb/mods-enabled/datacounter_acct
      exec datacountermonthly {
            wait = yes
            program = "/bin/sh /usr/local/etc/raddb/scripts/datacounter_acct.sh %{request:User-Name} monthly %{request:Acct-Input-Octets} %{request:Acct-Output-Octets} %{request:Acct-Status-Type} %{request:Acct-Session-Id}"
            shell_escape = yes
      }
      # Loading module "datacounterforever" from file /usr/local/etc/raddb/mods-enabled/datacounter_acct
      exec datacounterforever {
            wait = yes
            program = "/bin/sh /usr/local/etc/raddb/scripts/datacounter_acct.sh %{request:User-Name} forever %{request:Acct-Input-Octets} %{request:Acct-Output-Octets} %{request:Acct-Status-Type} %{request:Acct-Session-Id}"
            shell_escape = yes
      }
      # Loaded module rlm_soh
      # Loading module "soh" from file /usr/local/etc/raddb/mods-enabled/soh
      soh {
            dhcp = yes
      }
      # Loaded module rlm_digest
      # Loading module "digest" from file /usr/local/etc/raddb/mods-enabled/digest
      # Loading module "motp" from file /usr/local/etc/raddb/mods-enabled/motp
      exec motp {
            wait = yes
            program = "/usr/local/bin/bash /usr/local/etc/raddb/scripts/otpverify.sh %{request:User-Name} %{request:User-Password} %{reply:MOTP-Init-Secret} %{reply:MOTP-PIN} %{reply:MOTP-Offset}"
            shell_escape = yes
      }
      # Loaded module rlm_linelog
      # Loading module "linelog" from file /usr/local/etc/raddb/mods-enabled/linelog
      linelog {
            filename = "/var/log/linelog"
            escape_filenames = no
            syslog_severity = "info"
            permissions = 384
            format = "This is a log message for %{User-Name}"
            reference = "messages.%{%{reply:Packet-Type}:-default}"
      }
      # Loading module "log_accounting" from file /usr/local/etc/raddb/mods-enabled/linelog
      linelog log_accounting {
            filename = "/var/log/linelog-accounting"
            escape_filenames = no
            syslog_severity = "info"
            permissions = 384
            format = ""
            reference = "Accounting-Request.%{%{Acct-Status-Type}:-unknown}"
      }
      # Loaded module rlm_mschap
      # Loading module "mschap" from file /usr/local/etc/raddb/mods-enabled/mschap
      mschap {
            use_mppe = yes
            require_encryption = no
            require_strong = no
            with_ntdomain_hack = yes
       passchange {
       }
            allow_retry = yes
            winbind_retry_with_normalised_username = no
      }
      # Loading module "echo" from file /usr/local/etc/raddb/mods-enabled/echo
      exec echo {
            wait = yes
            program = "/bin/echo %{User-Name}"
            input_pairs = "request"
            output_pairs = "reply"
            shell_escape = yes
      }
      # Loaded module rlm_radutmp
      # Loading module "radutmp" from file /usr/local/etc/raddb/mods-enabled/radutmp
      radutmp {
            filename = "/var/log/radutmp"
            username = "%{User-Name}"
            case_sensitive = yes
            check_with_nas = yes
            permissions = 384
            caller_id = yes
      }
      # Loaded module rlm_logintime
      # Loading module "logintime" from file /usr/local/etc/raddb/mods-enabled/logintime
      logintime {
            minimum_timeout = 60
      }
      # Loaded module rlm_detail
      # Loading module "detail" from file /usr/local/etc/raddb/mods-enabled/detail
      detail {
            filename = "/var/log/radacct/%{%{Packet-Src-IP-Address}:-%{Packet-Src-IPv6-Address}}/detail-%Y%m%d"
            header = "%t"
            permissions = 384
            locking = no
            escape_filenames = no
            log_packet_header = no
      }
      # Loaded module rlm_realm
      # Loading module "IPASS" from file /usr/local/etc/raddb/mods-enabled/realm
      realm IPASS {
            format = "prefix"
            delimiter = "/"
            ignore_default = no
            ignore_null = yes
      }
      # Loading module "suffix" from file /usr/local/etc/raddb/mods-enabled/realm
      realm suffix {
            format = "suffix"
            delimiter = "@"
            ignore_default = no
            ignore_null = yes
      }
      # Loading module "realmpercent" from file /usr/local/etc/raddb/mods-enabled/realm
      realm realmpercent {
            format = "suffix"
            delimiter = "%"
            ignore_default = no
            ignore_null = yes
      }
      # Loading module "ntdomain" from file /usr/local/etc/raddb/mods-enabled/realm
      realm ntdomain {
            format = "prefix"
            delimiter = "\"
            ignore_default = no
            ignore_null = yes
      }
      # Loaded module rlm_passwd
      # Loading module "etc_passwd" from file /usr/local/etc/raddb/mods-enabled/passwd
      passwd etc_passwd {
            filename = "/etc/passwd"
            format = "*User-Name:Crypt-Password:"
            delimiter = ":"
            ignore_nislike = no
            ignore_empty = yes
            allow_multiple_keys = no
            hash_size = 100
      }
      # Loaded module rlm_expiration
      # Loading module "expiration" from file /usr/local/etc/raddb/mods-enabled/expiration
      # Loaded module rlm_unix
      # Loading module "unix" from file /usr/local/etc/raddb/mods-enabled/unix
      unix {
            radwtmp = "/var/log/radwtmp"
      }
    Creating attribute Unix-Group
      # Loading module "exec" from file /usr/local/etc/raddb/mods-enabled/exec
      exec {
            wait = no
            input_pairs = "request"
            shell_escape = yes
            timeout = 10
      }
      # Loaded module rlm_preprocess
      # Loading module "preprocess" from file /usr/local/etc/raddb/mods-enabled/preprocess
      preprocess {
            huntgroups = "/usr/local/etc/raddb/mods-config/preprocess/huntgroups"
            hints = "/usr/local/etc/raddb/mods-config/preprocess/hints"
            with_ascend_hack = no
            ascend_channels_per_line = 23
            with_ntdomain_hack = no
            with_specialix_jetstream_hack = no
            with_cisco_vsa_hack = no
            with_alvarion_vsa_hack = no
      }
      # Loaded module rlm_always
      # Loading module "reject" from file /usr/local/etc/raddb/mods-enabled/always
      always reject {
            rcode = "reject"
            simulcount = 0
            mpp = no
      }
      # Loading module "fail" from file /usr/local/etc/raddb/mods-enabled/always
      always fail {
            rcode = "fail"
            simulcount = 0
            mpp = no
      }
      # Loading module "ok" from file /usr/local/etc/raddb/mods-enabled/always
      always ok {
            rcode = "ok"
            simulcount = 0
            mpp = no
      }
      # Loading module "handled" from file /usr/local/etc/raddb/mods-enabled/always
      always handled {
            rcode = "handled"
            simulcount = 0
            mpp = no
      }
      # Loading module "invalid" from file /usr/local/etc/raddb/mods-enabled/always
      always invalid {
            rcode = "invalid"
            simulcount = 0
            mpp = no
      }
      # Loading module "userlock" from file /usr/local/etc/raddb/mods-enabled/always
      always userlock {
            rcode = "userlock"
            simulcount = 0
            mpp = no
      }
      # Loading module "notfound" from file /usr/local/etc/raddb/mods-enabled/always
      always notfound {
            rcode = "notfound"
            simulcount = 0
            mpp = no
      }
      # Loading module "noop" from file /usr/local/etc/raddb/mods-enabled/always
      always noop {
            rcode = "noop"
            simulcount = 0
            mpp = no
      }
      # Loading module "updated" from file /usr/local/etc/raddb/mods-enabled/always
      always updated {
            rcode = "updated"
            simulcount = 0
            mpp = no
      }
      # Loaded module rlm_counter
      # Loading module "daily" from file /usr/local/etc/raddb/mods-enabled/counter
      counter daily {
            filename = "/var/log/radacct/timecounter/db.daily"
            key = "User-Name"
            reset = "daily"
            count_attribute = "Acct-Session-Time"
            counter_name = "Daily-Session-Time"
            check_name = "Max-Daily-Session"
            reply_name = "Session-Timeout"
            cache_size = 5000
      }
      # Loading module "weekly" from file /usr/local/etc/raddb/mods-enabled/counter
      counter weekly {
            filename = "/var/log/radacct/timecounter/db.weekly"
            key = "User-Name"
            reset = "weekly"
            count_attribute = "Acct-Session-Time"
            counter_name = "Weekly-Session-Time"
            check_name = "Max-Weekly-Session"
            reply_name = "Session-Timeout"
            cache_size = 5000
      }
      # Loading module "monthly" from file /usr/local/etc/raddb/mods-enabled/counter
      counter monthly {
            filename = "/var/log/radacct/timecounter/db.monthly"
            key = "User-Name"
            reset = "monthly"
            count_attribute = "Acct-Session-Time"
            counter_name = "Monthly-Session-Time"
            check_name = "Max-Monthly-Session"
            reply_name = "Session-Timeout"
            cache_size = 5000
      }
      # Loading module "forever" from file /usr/local/etc/raddb/mods-enabled/counter
      counter forever {
            filename = "/var/log/radacct/timecounter/db.forever"
            key = "User-Name"
            reset = "never"
            count_attribute = "Acct-Session-Time"
            counter_name = "Forever-Session-Time"
            check_name = "Max-Forever-Session"
            reply_name = "Session-Timeout"
            cache_size = 5000
      }
      # Loaded module rlm_files
      # Loading module "files" from file /usr/local/etc/raddb/mods-enabled/files
      files {
            filename = "/usr/local/etc/raddb/mods-config/files/authorize"
            acctusersfile = "/usr/local/etc/raddb/mods-config/files/accounting"
            preproxy_usersfile = "/usr/local/etc/raddb/mods-config/files/pre-proxy"
      }
      # Loaded module rlm_cache
      # Loading module "cache_eap" from file /usr/local/etc/raddb/mods-enabled/cache_eap
      cache cache_eap {
            driver = "rlm_cache_rbtree"
            key = "%{%{control:State}:-%{%{reply:State}:-%{State}}}"
            ttl = 15
            max_entries = 0
            epoch = 0
            add_stats = no
      }
      # Loaded module rlm_eap
      # Loading module "eap" from file /usr/local/etc/raddb/mods-enabled/eap
      eap {
            default_eap_type = "mschapv2"
            timer_expire = 60
            ignore_unknown_eap_types = no
            cisco_accounting_username_bug = no
            max_sessions = 4096
      }
      # Loaded module rlm_expr
      # Loading module "expr" from file /usr/local/etc/raddb/mods-enabled/expr
      expr {
            safe_characters = "@abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ0123456789.-_: /äéöüàâæçèéêëîïôœùûüaÿÄÉÖÜßÀÂÆÇÈÉÊËÎÏÔŒÙÛÜŸ"
      }
      # Loaded module rlm_attr_filter
      # Loading module "attr_filter.post-proxy" from file /usr/local/etc/raddb/mods-enabled/attr_filter
      attr_filter attr_filter.post-proxy {
            filename = "/usr/local/etc/raddb/mods-config/attr_filter/post-proxy"
            key = "%{Realm}"
            relaxed = no
      }
      # Loading module "attr_filter.pre-proxy" from file /usr/local/etc/raddb/mods-enabled/attr_filter
      attr_filter attr_filter.pre-proxy {
            filename = "/usr/local/etc/raddb/mods-config/attr_filter/pre-proxy"
            key = "%{Realm}"
            relaxed = no
      }
      # Loading module "attr_filter.access_reject" from file /usr/local/etc/raddb/mods-enabled/attr_filter
      attr_filter attr_filter.access_reject {
            filename = "/usr/local/etc/raddb/mods-config/attr_filter/access_reject"
            key = "%{User-Name}"
            relaxed = no
      }
      # Loading module "attr_filter.access_challenge" from file /usr/local/etc/raddb/mods-enabled/attr_filter
      attr_filter attr_filter.access_challenge {
            filename = "/usr/local/etc/raddb/mods-config/attr_filter/access_challenge"
            key = "%{User-Name}"
            relaxed = no
      }
      # Loading module "attr_filter.accounting_response" from file /usr/local/etc/raddb/mods-enabled/attr_filter
      attr_filter attr_filter.accounting_response {
            filename = "/usr/local/etc/raddb/mods-config/attr_filter/accounting_response"
            key = "%{User-Name}"
            relaxed = no
      }
      # Loading module "auth_log" from file /usr/local/etc/raddb/mods-enabled/detail.log
      detail auth_log {
            filename = "/var/log/radacct/%{%{Packet-Src-IP-Address}:-%{Packet-Src-IPv6-Address}}/auth-detail-%Y%m%d"
            header = "%t"
            permissions = 384
            locking = no
            escape_filenames = no
            log_packet_header = no
      }
      # Loading module "reply_log" from file /usr/local/etc/raddb/mods-enabled/detail.log
      detail reply_log {
            filename = "/var/log/radacct/%{%{Packet-Src-IP-Address}:-%{Packet-Src-IPv6-Address}}/reply-detail-%Y%m%d"
            header = "%t"
            permissions = 384
            locking = no
            escape_filenames = no
            log_packet_header = no
      }
      # Loading module "pre_proxy_log" from file /usr/local/etc/raddb/mods-enabled/detail.log
      detail pre_proxy_log {
            filename = "/var/log/radacct/%{%{Packet-Src-IP-Address}:-%{Packet-Src-IPv6-Address}}/pre-proxy-detail-%Y%m%d"
            header = "%t"
            permissions = 384
            locking = no
            escape_filenames = no
            log_packet_header = no
      }
      # Loading module "post_proxy_log" from file /usr/local/etc/raddb/mods-enabled/detail.log
      detail post_proxy_log {
            filename = "/var/log/radacct/%{%{Packet-Src-IP-Address}:-%{Packet-Src-IPv6-Address}}/post-proxy-detail-%Y%m%d"
            header = "%t"
            permissions = 384
            locking = no
            escape_filenames = no
            log_packet_header = no
      }
      # Loaded module rlm_pap
      # Loading module "pap" from file /usr/local/etc/raddb/mods-enabled/pap
      pap {
            normalise = yes
      }
      # Loading module "sradutmp" from file /usr/local/etc/raddb/mods-enabled/sradutmp
      radutmp sradutmp {
            filename = "/var/log/sradutmp"
            username = "%{User-Name}"
            case_sensitive = yes
            check_with_nas = yes
            permissions = 420
            caller_id = no
      }
      # Loaded module rlm_date
      # Loading module "date" from file /usr/local/etc/raddb/mods-enabled/date
      date {
            format = "%b %e %Y %H:%M:%S %Z"
            utc = no
      }
      # Loaded module rlm_chap
      # Loading module "chap" from file /usr/local/etc/raddb/mods-enabled/chap
      instantiate {
      # Instantiating module "expiration" from file /usr/local/etc/raddb/mods-enabled/expiration
      # Instantiating module "logintime" from file /usr/local/etc/raddb/mods-enabled/logintime
      # Instantiating module "daily" from file /usr/local/etc/raddb/mods-enabled/counter
    rlm_counter: Current Time: 1539681453 [2018-10-16 13:17:33], Next reset 1539720000 [2018-10-17 00:00:00]
    rlm_counter: add_defaults: Start
    rlm_counter: DEFAULT1 set to 1539720000
    rlm_counter: DEFAULT2 set to 1539681453
    rlm_counter: add_defaults: End
      # Instantiating module "weekly" from file /usr/local/etc/raddb/mods-enabled/counter
    rlm_counter: Current Time: 1539681453 [2018-10-16 13:17:33], Next reset 1540065600 [2018-10-21 00:00:00]
    rlm_counter: add_defaults: Start
    rlm_counter: DEFAULT1 set to 1540065600
    rlm_counter: DEFAULT2 set to 1539681453
    rlm_counter: add_defaults: End
      # Instantiating module "monthly" from file /usr/local/etc/raddb/mods-enabled/counter
    rlm_counter: Current Time: 1539681453 [2018-10-16 13:17:33], Next reset 1541016000 [2018-11-01 00:00:00]
    rlm_counter: add_defaults: Start
    rlm_counter: DEFAULT1 set to 1541016000
    rlm_counter: DEFAULT2 set to 1539681453
    rlm_counter: add_defaults: End
      # Instantiating module "forever" from file /usr/local/etc/raddb/mods-enabled/counter
    rlm_counter: Current Time: 1539681453 [2018-10-16 13:17:33], Next reset 0 [2018-10-16 13:00:00]
    rlm_counter: add_defaults: Start
    rlm_counter: DEFAULT1 set to 0
    rlm_counter: DEFAULT2 set to 1539681453
    rlm_counter: add_defaults: End
      }
      # Instantiating module "linelog" from file /usr/local/etc/raddb/mods-enabled/linelog
      # Instantiating module "log_accounting" from file /usr/local/etc/raddb/mods-enabled/linelog
      # Instantiating module "mschap" from file /usr/local/etc/raddb/mods-enabled/mschap
    rlm_mschap (mschap): using internal authentication
      # Instantiating module "detail" from file /usr/local/etc/raddb/mods-enabled/detail
      # Instantiating module "IPASS" from file /usr/local/etc/raddb/mods-enabled/realm
      # Instantiating module "suffix" from file /usr/local/etc/raddb/mods-enabled/realm
      # Instantiating module "realmpercent" from file /usr/local/etc/raddb/mods-enabled/realm
      # Instantiating module "ntdomain" from file /usr/local/etc/raddb/mods-enabled/realm
      # Instantiating module "etc_passwd" from file /usr/local/etc/raddb/mods-enabled/passwd
    rlm_passwd: nfields: 3 keyfield 0(User-Name) listable: no
      # Instantiating module "preprocess" from file /usr/local/etc/raddb/mods-enabled/preprocess
    reading pairlist file /usr/local/etc/raddb/mods-config/preprocess/huntgroups
    reading pairlist file /usr/local/etc/raddb/mods-config/preprocess/hints
      # Instantiating module "reject" from file /usr/local/etc/raddb/mods-enabled/always
      # Instantiating module "fail" from file /usr/local/etc/raddb/mods-enabled/always
      # Instantiating module "ok" from file /usr/local/etc/raddb/mods-enabled/always
      # Instantiating module "handled" from file /usr/local/etc/raddb/mods-enabled/always
      # Instantiating module "invalid" from file /usr/local/etc/raddb/mods-enabled/always
      # Instantiating module "userlock" from file /usr/local/etc/raddb/mods-enabled/always
      # Instantiating module "notfound" from file /usr/local/etc/raddb/mods-enabled/always
      # Instantiating module "noop" from file /usr/local/etc/raddb/mods-enabled/always
      # Instantiating module "updated" from file /usr/local/etc/raddb/mods-enabled/always
      # Instantiating module "files" from file /usr/local/etc/raddb/mods-enabled/files
    reading pairlist file /usr/local/etc/raddb/mods-config/files/authorize
    reading pairlist file /usr/local/etc/raddb/mods-config/files/accounting
    reading pairlist file /usr/local/etc/raddb/mods-config/files/pre-proxy
      # Instantiating module "cache_eap" from file /usr/local/etc/raddb/mods-enabled/cache_eap
    rlm_cache (cache_eap): Driver rlm_cache_rbtree (module rlm_cache_rbtree) loaded and linked
      # Instantiating module "eap" from file /usr/local/etc/raddb/mods-enabled/eap
       # Linked to sub-module rlm_eap_md5
       # Linked to sub-module rlm_eap_leap
       # Linked to sub-module rlm_eap_gtc
       gtc {
            challenge = "Password: "
            auth_type = "PAP"
       }
       # Linked to sub-module rlm_eap_tls
       tls {
            tls = "tls-common"
       }
       tls-config tls-common {
            verify_depth = 0
            ca_path = "/usr/local/etc/raddb/certs"
            pem_file_type = yes
            private_key_file = "/usr/local/etc/raddb/certs/server_key.pem"
            certificate_file = "/usr/local/etc/raddb/certs/server_cert.pem"
            ca_file = "/usr/local/etc/raddb/certs/ca_cert.pem"
            dh_file = "/usr/local/etc/raddb/certs/dh"
            random_file = "/dev/urandom"
            fragment_size = 1024
            include_length = yes
            auto_chain = yes
            check_crl = no
            check_all_crl = no
            cipher_list = "DEFAULT"
            cipher_server_preference = no
            ecdh_curve = "prime256v1"
            tls_max_version = ""
            tls_min_version = "1.0"
        cache {
            enable = no
            lifetime = 24
            max_entries = 255
        }
        verify {
            skip_if_ocsp_ok = no
        }
        ocsp {
            enable = no
            override_cert_url = no
            url = "http://127.0.0.1/ocsp/"
            use_nonce = yes
            timeout = 0
            softfail = no
        }
       }
       # Linked to sub-module rlm_eap_ttls
       ttls {
            tls = "tls-common"
            default_eap_type = "md5"
            copy_request_to_tunnel = no
            use_tunneled_reply = no
            virtual_server = "inner-tunnel-ttls"
            include_length = yes
            require_client_cert = no
       }
    tls: Using cached TLS configuration from previous invocation
       # Linked to sub-module rlm_eap_peap
       peap {
            tls = "tls-common"
            default_eap_type = "mschapv2"
            copy_request_to_tunnel = no
            use_tunneled_reply = no
            proxy_tunneled_request_as_eap = yes
            virtual_server = "inner-tunnel-peap"
            soh = no
            require_client_cert = no
       }
    tls: Using cached TLS configuration from previous invocation
       # Linked to sub-module rlm_eap_mschapv2
       mschapv2 {
            with_ntdomain_hack = no
            send_error = no
       }
      # Instantiating module "attr_filter.post-proxy" from file /usr/local/etc/raddb/mods-enabled/attr_filter
    reading pairlist file /usr/local/etc/raddb/mods-config/attr_filter/post-proxy
      # Instantiating module "attr_filter.pre-proxy" from file /usr/local/etc/raddb/mods-enabled/attr_filter
    reading pairlist file /usr/local/etc/raddb/mods-config/attr_filter/pre-proxy
      # Instantiating module "attr_filter.access_reject" from file /usr/local/etc/raddb/mods-enabled/attr_filter
    reading pairlist file /usr/local/etc/raddb/mods-config/attr_filter/access_reject
    [/usr/local/etc/raddb/mods-config/attr_filter/access_reject]:11 Check item "FreeRADIUS-Response-Delay"  found in filter list for realm "DEFAULT".
    [/usr/local/etc/raddb/mods-config/attr_filter/access_reject]:11 Check item "FreeRADIUS-Response-Delay-USec"     found in filter list for realm "DEFAULT".
      # Instantiating module "attr_filter.access_challenge" from file /usr/local/etc/raddb/mods-enabled/attr_filter
    reading pairlist file /usr/local/etc/raddb/mods-config/attr_filter/access_challenge
      # Instantiating module "attr_filter.accounting_response" from file /usr/local/etc/raddb/mods-enabled/attr_filter
    reading pairlist file /usr/local/etc/raddb/mods-config/attr_filter/accounting_response
      # Instantiating module "auth_log" from file /usr/local/etc/raddb/mods-enabled/detail.log
    rlm_detail (auth_log): 'User-Password' suppressed, will not appear in detail output
      # Instantiating module "reply_log" from file /usr/local/etc/raddb/mods-enabled/detail.log
      # Instantiating module "pre_proxy_log" from file /usr/local/etc/raddb/mods-enabled/detail.log
      # Instantiating module "post_proxy_log" from file /usr/local/etc/raddb/mods-enabled/detail.log
      # Instantiating module "pap" from file /usr/local/etc/raddb/mods-enabled/pap
     } # modules
    radiusd: #### Loading Virtual Servers ####
    server { # from file /usr/local/etc/raddb/radiusd.conf
    } # server
    server default { # from file /usr/local/etc/raddb/sites-enabled/default
     # Loading authenticate {...}
     # Loading authorize {...}
     # Loading preacct {...}
     # Loading accounting {...}
     # Loading session {...}
     # Loading pre-proxy {...}
     # Loading post-proxy {...}
     # Loading post-auth {...}
    } # server default
    server inner-tunnel-peap { # from file /usr/local/etc/raddb/sites-enabled/inner-tunnel-peap
     # Loading authenticate {...}
     # Loading authorize {...}
    Ignoring "sql" (see raddb/mods-available/README.rst)
    Ignoring "ldap" (see raddb/mods-available/README.rst)
     # Loading session {...}
     # Loading post-proxy {...}
     # Loading post-auth {...}
    } # server inner-tunnel-peap
    server inner-tunnel-ttls { # from file /usr/local/etc/raddb/sites-enabled/inner-tunnel-ttls
     # Loading authenticate {...}
     # Loading authorize {...}
     # Loading session {...}
     # Loading post-proxy {...}
     # Loading post-auth {...}
    } # server inner-tunnel-ttls
    radiusd: #### Opening IP addresses and Ports ####
    listen {
            type = "auth"
            ipaddr = 192.168.2.1
            port = 1812
    }
    listen {
            type = "auth"
            ipaddr = 192.168.4.1
            port = 1812
    }
    listen {
            type = "auth"
            ipaddr = 127.0.0.1
            port = 18128
    }
    listen {
            type = "auth"
            ipaddr = 127.0.0.1
            port = 18127
    }
    Listening on auth address 192.168.2.1 port 1812 bound to server default
    Listening on auth address 192.168.4.1 port 1812 bound to server default
    Listening on auth address 127.0.0.1 port 18128 bound to server inner-tunnel-peap
    Listening on auth address 127.0.0.1 port 18127 bound to server inner-tunnel-ttls
    Ready to process requests
    
    
    

    After executing this command radius server starts automatically, but if I stop and start or restart it again, it doesn't start.



  • @emammadov said in FreeRadius server not starting in 2.4.4:

    Ready to process requests

    that message indicates that the server is working just fine.

    for some reason when you restart the server, it is already running (bound to the port).



  • Though when executing this command radius server starts automatically, after a while it stops itself.



  • oh, did u leave the ssh running after executing the command?
    radiusd -X just runs radius in debug mode in foreground. and it exists as soon as you close the ssh window.
    it is not the solution to your problem, just a way to figure out what is going on here.
    Check Diagnostics > Sockets and it will show 192.168.2.1:1812 and 192.168.4.1:1812 running even if radius shows up as stopped on services page. Strange, but maybe someone with better knowledge knows why it is not restarting properly.

    But now that you mention it stopping all of a sudden, indicates that it is also crashing, again you would need to look at logs to know exactly why it is crashing.



  • I looked at Check Diagnostics > Sockets and there is no 192.168.2.1:1812 and 192.168.4.1:1812 running. Currently radius stopped automatically. I started Radius with executing radiusd -X again, now I see these entries in Socket.

    oot radiusd 64486 12 udp4 192.168.2.1:1812 :
    root radiusd 64486 13 udp4 192.168.4.1:1812 :
    root radiusd 64486 14 udp4 127.0.0.1:18128 :
    root radiusd 64486 15 udp4 127.0.0.1:18127 :
    root sshd 31260 3 tcp4 192.168.2.1:33426 192.168.4.10:7792



  • @emammadov okay so when you try to start it, it works but it just stops automatically? can you check Status > System Logs for any radius messages? or if you have it logging to /var/log/radius.log can you do this in ssh:
    cat /var/log/radius.log to see messages when the program exists.

    don't use radiusd -X to start freeradius, do it in Status > Services page.



  • I run cat /var/log/radius.log, but there is no log entries inside this file. There is no logs in System Logs either.

    CLOG▒!▒▒[2.4.4-RELEASE][admin@pfsense.smart.az]/var/log: cat radius.log
    [2.4.4-RELEASE][admin@pfsense.smart.az]/var/log:
    


  • @emammadov Go into Services > FreeRADIUS > Settings
    Select "RADIUS Logging Destination" to /var/log/radius.log and set "RADIUS Logging" to enable and then hit save.
    Go to Status > Services and try to start freeradius again.
    Check the log file again.



  • I did as you said, but there is no logs in that file again.

    0_1539687630486_1.jpg
    0_1539687634894_2.jpg



  • it seems freeradius is working fine in debug mode but something is preventing freeradius from starting normally. Can you try restarting pfsense and check if it makes any logs?



  • I will restart pfsense after work tonight, because there are many employees working now at our company.



  • Removed freeradius, restarted pfsense and then reinstall freeradius, it began to work. Thank you very much,