Navigation

    Netgate Discussion Forum
    • Register
    • Login
    • Search
    • Categories
    • Recent
    • Tags
    • Popular
    • Users
    • Search

    Pfsense/Freeradius: Ignoring request to auth address ...

    pfSense Packages
    5
    9
    4729
    Loading More Posts
    • Oldest to Newest
    • Newest to Oldest
    • Most Votes
    Reply
    • Reply as topic
    Log in to reply
    This topic has been deleted. Only users with topic management privileges can see it.
    • J
      joriz last edited by

      Hello All,

      I'm using FreeRadius in Pfsense for Mac Address Authentication to authenticate specific Wifi devices connected to Ruckus Virtual Smartzone.
      This gives me the possibility to determine in which vlan the device will connect, based on the given vlan ID. (Dynamic Vlan)

      In Ruckus Virtual Smartzone i have configured 1 SSID (MacAddressOnly) with authentication "Mac Address" + WPA2 encryption.
      The Pfsense box with FreeRadius is configured as Authentication Server.

      In Pfsense i have configured 10.0.90.0 als Client IP Address in NAS / Clients. 10.0.90.0 is the network of the Wifi AP's/Controller. The Client Shared Secret matches.

      When i try to connect to the SSID i get the different kind of error messages:

      • On the Ruckus Controller: failed to join WLAN, due to authentication failure.
      • On the Pfsense box when running Radiusd -X: Ignore Request to auth address 10.0.0.252 port 1812 bound to server default from unknown client 10.0.90.10 (which is the Wifi AP) port 41949 proto UDP
      • On the Wireless device (Iphone) Incorrect password for network.

      The WPA2 passphrase is correct, and the Mac Address is also correct.

      I've tried with other Wireless devices, rebooted the Pfsense and Ruckus box.
      This was working before but suddenly it stopped and i don't know why? I have updated the Pfsense box to 2.4.4-RELEASE-p2 some time ago, but i can't confirm it stopped working since then.

      Configuration Details Pfsense Box:
      radiusd.conf

      /usr/local/etc/raddb/radiusd.conf
      prefix = /usr/local
      exec_prefix = ${prefix}
      sysconfdir = ${prefix}/etc
      localstatedir = /var
      sbindir = ${exec_prefix}/sbin
      logdir = ${localstatedir}/log
      raddbdir = ${sysconfdir}/raddb
      radacctdir = ${logdir}/radacct
      name = radiusd
      confdir = ${raddbdir}
      modconfdir = ${confdir}/mods-config
      certdir = ${confdir}/certs
      cadir = ${confdir}/certs
      run_dir = ${localstatedir}/run
      db_dir = ${raddbdir}
      libdir = /usr/local/lib/freeradius-3.0.17
      pidfile = ${run_dir}/${name}.pid
      max_request_time = 30
      cleanup_delay = 5
      max_requests = 1024
      hostname_lookups = no
      regular_expressions = yes
      extended_expressions = yes
      
      log {
      	destination = syslog
      	colourise = yes
      	file = ${logdir}/radius.log
      	syslog_facility = daemon
      	stripped_names = no
      	auth = yes
      	auth_badpass = yes
      	auth_goodpass = yes
      	msg_goodpass = ""
      	msg_badpass = ""
      	msg_denied = "You are already logged in - access denied"
      }
      
      checkrad = ${sbindir}/checkrad
      security {
      	allow_core_dumps = no
      	max_attributes = 200
      	reject_delay = 1
      	status_server = no
      	# Disable this check since it may not be accurate due to how FreeBSD patches OpenSSL
      	allow_vulnerable_openssl = yes
      }
      
      $INCLUDE  clients.conf
      thread pool {
      	start_servers = 5
      	max_servers = 32
      	min_spare_servers = 3
      	max_spare_servers = 10
      	max_queue_size = 65536
      	max_requests_per_server = 0
      	auto_limit_acct = no
      }
      
      modules {
      	$INCLUDE ${confdir}/mods-enabled/
      }
      
      instantiate {
      	exec
      	expr
      	expiration
      	logintime
      	### Dis-/Enable sql instatiate
      	#sql
      	daily
      	weekly
      	monthly
      	forever
      }
      policy {
      	$INCLUDE policy.d/
      }
      $INCLUDE sites-enabled/
      

      eap

      /usr/local/etc/raddb/mods-enabled/eap
      ### EAP
      eap {
      	default_eap_type = mschapv2
      	timer_expire     = 60
      	ignore_unknown_eap_types = no
      	cisco_accounting_username_bug = no
      	max_sessions = 4096
      
      ### DISABLED WEAK EAP TYPES MD5, GTC, LEAP ###
      
      #	pwd {
      #		group = 19
      #		server_id = theserver@example.com
      #		fragment_size = 1020
      #		virtual_server = "inner-tunnel"
      #	}
      
      	tls-config tls-common {
      		# private_key_password = whatever
      		private_key_file = ${certdir}/server_key.pem
      		certificate_file = ${certdir}/server_cert.pem
      		ca_path = ${confdir}/certs
      		ca_file = ${ca_path}/ca_cert.pem
      	#	auto_chain = yes
      	#	psk_identity = "test"
      	#	psk_hexphrase = "036363823"
      		dh_file = ${certdir}/dh
      		random_file = /dev/urandom
      		fragment_size = 1024
      		include_length = yes
      		check_crl = no
      		### check_cert_issuer = "/C=GB/ST=Berkshire/L=Newbury/O=My Company Ltd/emailAddress=test@mycomp.com/CN=myca" ###
      		### check_cert_cn = %{User-Name} ###
      		cipher_list = "DEFAULT"
      		cipher_server_preference = no
      #		disable_tlsv1_2 = no
      		ecdh_curve = "prime256v1"
      		cache {
      			enable = no
      			lifetime = 24
      			max_entries = 255
      			#name = "EAP module"
      			#persist_dir = "/tlscache"
      		}
      		verify {
      	#		skip_if_ocsp_ok = no
      	#		tmpdir = /tmp/radiusd
      	#		client = "/path/to/openssl verify -CApath ${..ca_path} %{TLS-Client-Cert-Filename}"
      		}
      		ocsp {
      			enable = no
      			override_cert_url = no
      			url = "http://127.0.0.1/ocsp/"
      			# use_nonce = yes
      			# timeout = 0
      			# softfail = no
      		}
      	}
      	tls {
      		tls = tls-common
      	#	virtual_server = check-eap-tls
      	}
      	ttls {
      		tls = tls-common
      		default_eap_type = mschapv2
      		copy_request_to_tunnel = no
      		include_length = yes
      	#	require_client_cert = yes
      		virtual_server = "inner-tunnel-ttls"
      		#use_tunneled_reply is deprecated, new method happens in virtual-server
      	}	### end ttls
      	peap {
      		tls = tls-common
      		default_eap_type = mschapv2
      		copy_request_to_tunnel = no
      	#	proxy_tunneled_request_as_eap = yes
      	#	require_client_cert = yes
      ### MS SoH Server is disabled ###
      
      		virtual_server = "inner-tunnel-peap"
      		#use_tunneled_reply is deprecated, new method happens in virtual-server
      	}
      	mschapv2 {
      #		send_error = no
      #		identity = "FreeRADIUS"
      	}
      #	fast {
      #		tls = tls-common
      #		pac_lifetime = 604800
      #		authority_identity = "1234"
      #		pac_opaque_key = "0123456789abcdef0123456789ABCDEF"
      #		virtual_server = inner-tunnel
      #	}
      }
      

      clients.conf

      /usr/local/etc/raddb/clients.conf
      
      client "Ruckus" {
      	ipaddr = 10.0.90.0
      	proto = udp
      	secret = 'test'
      	require_message_authenticator = no
      	nas_type = other
      	### login = !root ###
      	### password = someadminpass ###
      	limit {
      		max_connections = 16
      		lifetime = 0
      		idle_timeout = 30
      	}
      }
      

      macs

      /usr/local/etc/raddb/authorized_macs
      
      7c-d1-c3-6c-ab-2a Cleartext-Password := "7c-d1-c3-6c-ab-2a"
      	
      	Tunnel-Type = VLAN,
      	Tunnel-Medium-Type = IEEE-802,
      	Tunnel-Private-Group-ID = "80"
      

      virtual-server-default

      /usr/local/etc/raddb/sites-enabled/default
      server default {
      listen {
      	type = auth
      	ipaddr = 10.0.0.252
      	port = 1812
      }
      
      authorize {
      #	filter_username
      #	filter_password
      	preprocess
      #	operator-name
      #	cui
      ##### AUTHORIZE FOR PLAIN MAC-AUTH IS DISABLED #####
      #	auth_log
      	chap
      	mschap
      	digest
      #	wimax
      #	IPASS
      	suffix
      	ntdomain
      	eap {
      		ok = return
      #		updated = return
      	}
      #	unix
      	files
      	### sql DISABLED ###
      	daily
      	weekly
      	monthly
      	forever
      #	smbpasswd
      ### ldap ###
      	# Formerly checkval
      	if (&request:Calling-Station-Id == &control:Calling-Station-Id) {
      		ok
      	}
      	expiration
      	logintime
      	pap
      	Autz-Type Status-Server {
      
      	}
      }
      
      authenticate {
      	Auth-Type PAP {
      		pap
      	}
      	Auth-Type CHAP {
      		chap
      	}
      	Auth-Type MS-CHAP {
      		mschap
      	}
      	mschap
      	Auth-Type MOTP {
      		motp
      	}
      	Auth-Type GOOGLEAUTH {
      		googleauth
      	}
      	digest
      #	pam
      #	unix
      
      	#Auth-Type LDAP {
      		#ldap
      		#### ldap2 disabled ###
      	#}
      
      	eap
      #	Auth-Type eap {
      #		eap {
      #			handled = 1
      #		}
      #		if (handled && (Response-Packet-Type == Access-Challenge)) {
      #			attr_filter.access_challenge.post-auth
      #			handled  # override the "updated" code from attr_filter
      #		}
      #	}
      }
      
      preacct {
      	preprocess
      ##### ACCOUNTING FOR PLAIN MAC-AUTH DISABLED #####
      #	acct_counters64
      	update request {
      		&FreeRADIUS-Acct-Session-Start-Time = "%{expr: %l - %{%{Acct-Session-Time}:-0} - %{%{Acct-Delay-Time}:-0}}"
      	}
      acct_unique
      #	IPASS
      	suffix
      	ntdomain
      	files
      }
      
      accounting {
      #	cui
      	detail
      	### This makes it possible to run the datacounter_acct module only on accounting-stop and interim-updates
      	if ((request:Acct-Status-Type == Stop) || (request:Acct-Status-Type == Interim-Update)) {
      		datacounterdaily
      		datacounterweekly
      		datacountermonthly
      		datacounterforever
      	}
      #	unix
      	radutmp
      #	sradutmp
      #	main_pool
      	### sql DISABLED ###
      	daily
      	weekly
      	monthly
      	forever
      #	if (noop) {
      #		ok
      #	}
      #	pgsql-voip
      	exec
      	attr_filter.accounting_response
      	Acct-Type Status-Server {
      
      	}
      }
      
      session {
      #	radutmp
      	radutmp
      }
      
      post-auth {
      #	if (!&reply:State) {
      #		update reply {
      #			State := "0x%{randstr:16h}"
      #		}
      #	}
      	update {
      		&reply: += &session-state:
      	}
      #	main_pool
      #	cui
      #	reply_log
      ### sql DISABLED ###
      #	ldap
      	exec
      #	wimax
      #	update reply {
      #		Reply-Message += "%{TLS-Cert-Serial}"
      #		Reply-Message += "%{TLS-Cert-Expiration}"
      #		Reply-Message += "%{TLS-Cert-Subject}"
      #		Reply-Message += "%{TLS-Cert-Issuer}"
      #		Reply-Message += "%{TLS-Cert-Common-Name}"
      #		Reply-Message += "%{TLS-Cert-Subject-Alt-Name-Email}"
      #
      #		Reply-Message += "%{TLS-Client-Cert-Serial}"
      #		Reply-Message += "%{TLS-Client-Cert-Expiration}"
      #		Reply-Message += "%{TLS-Client-Cert-Subject}"
      #		Reply-Message += "%{TLS-Client-Cert-Issuer}"
      #		Reply-Message += "%{TLS-Client-Cert-Common-Name}"
      #		Reply-Message += "%{TLS-Client-Cert-Subject-Alt-Name-Email}"
      #	}
      #	insert_acct_class
      #	if (&reply:EAP-Session-Id) {
      #		update reply {
      #			EAP-Key-Name := &reply:EAP-Session-Id
      #		}
      #	}
      	remove_reply_message_if_eap
      	Post-Auth-Type REJECT {
      		# log failed authentications in SQL, too.
      		# sql
      		attr_filter.access_reject
      		eap
      		remove_reply_message_if_eap
      	}
      	Post-Auth-Type Challenge {
      
      	}
      }
      
      pre-proxy {
      #	operator-name
      #	cui
      #	files
      	attr_filter.pre-proxy
      #	pre_proxy_log
      }
      
      post-proxy {
      
      #	post_proxy_log
      	attr_filter.post-proxy
      	eap
      #	Post-Proxy-Type Fail-Accounting {
      #			detail
      #	}
      }
      }
      
      1 Reply Last reply Reply Quote 0
      • NogBadTheBad
        NogBadTheBad last edited by

        Run radsniff -x from the console, you may see something that points to the issue

        Andy

        1 x Netgate SG-4860 - 3 x Linksys LGS308P - 1 x Aruba InstantOn AP22

        J 1 Reply Last reply Reply Quote 0
        • J
          joriz @NogBadTheBad last edited by

          @NogBadTheBad It looks like the NAS client is sending an Access-Request 3 times but FreeRadius is not replying.

          Gertjan 1 Reply Last reply Reply Quote 0
          • Gertjan
            Gertjan @joriz last edited by Gertjan

            @joriz said in Pfsense/Freeradius: Ignoring request to auth address ...:

            @NogBadTheBad It looks like the NAS client is sending an Access-Request 3 times but FreeRadius is not replying.

            ??

            radiusd -X
            

            starts the FreeRadius server.
            So, it shows what it does, and it shows what it receives. And also what it sends back.
            If FreeRadius receives a "Access-Request" it will do something with it. I don't think that "let neglect that one" is what really happens.

            Instead of saying : "it looks like", I propose a little Cut&Paste exercise so we can see what you think you see.

            edit :
            Again :
            First : stop FreeRadius in the GUI.
            Connect to the console, and use option 8. Typically, use a SSH client to do this - or the "cable".
            Now run

            radiusd -X
            

            (capital X !)

            No "help me" PM's please. Use the forum.

            1 Reply Last reply Reply Quote 0
            • J
              joriz last edited by

              Sorry for the missing Cut&Paste. Here we go.

              radsnif -X

              2019-05-31 15:57:20.171507 (4) ** rtx ** Access-Request Id 0 em1:10.0.90.11:32885 -> 10.0.0.252:1812 +21.832
              	User-Name = "78-67-d7-1b-11-d9"
              	User-Password = "q]\263\000k\245\235\206CVd\243~u\216q\225\305\344\361ȫ\243\364\345\001\235\316t\023ݶ"
              	NAS-IP-Address = 10.0.90.11
              	Service-Type = Framed-User
              	Called-Station-Id = "94-F6-65-1C-8B-E9:Known MAC Addresses"
              	Calling-Station-Id = "78-67-D7-1B-11-D9"
              	NAS-Identifier = "94-F6-65-1C-8B-E9"
              	NAS-Port-Type = Wireless-802.11
              	Message-Authenticator = 0xe8a4f5d9e469664a40dbf0c40ca2e3ec
              	Ruckus-SSID = "MacAddressOnly"
              	Ruckus-Wlan-Id = 8
              	Ruckus-Location = "Upstairs"
              	Ruckus-SCG-CBlade-IP = 167790081
              	Ruckus-VLAN-ID = 1
              	Ruckus-BSSID = 0x94f6651c8be9
              	Authenticator-Field = 0x1be4d02595e926202612051b1d9c5f01
              2019-05-31 15:57:25.371507 (4) ** norsp ** Access-Request Id 0 em1:10.0.90.11:32885 -> 10.0.0.252:1812
              2019-05-31 15:57:25.371507 (4) Cleaning up request packet ID 0
              

              radiusd -X

              FreeRADIUS Version 3.0.17
              Copyright (C) 1999-2017 The FreeRADIUS server project and contributors
              There is NO warranty; not even for MERCHANTABILITY or FITNESS FOR A
              PARTICULAR PURPOSE
              You may redistribute copies of FreeRADIUS under the terms of the
              GNU General Public License
              For more information about these matters, see the file named COPYRIGHT
              Starting - reading configuration files ...
              including dictionary file /usr/local/share/freeradius/dictionary
              including dictionary file /usr/local/share/freeradius/dictionary.dhcp
              including dictionary file /usr/local/share/freeradius/dictionary.vqp
              including dictionary file /usr/local/etc/raddb/dictionary
              including configuration file /usr/local/etc/raddb/radiusd.conf
              including configuration file /usr/local/etc/raddb/clients.conf
              including files in directory /usr/local/etc/raddb/mods-enabled/
              including configuration file /usr/local/etc/raddb/mods-enabled/attr_filter
              including configuration file /usr/local/etc/raddb/mods-enabled/cache_eap
              including configuration file /usr/local/etc/raddb/mods-enabled/chap
              including configuration file /usr/local/etc/raddb/mods-enabled/date
              including configuration file /usr/local/etc/raddb/mods-enabled/detail
              including configuration file /usr/local/etc/raddb/mods-enabled/detail.log
              including configuration file /usr/local/etc/raddb/mods-enabled/digest
              including configuration file /usr/local/etc/raddb/mods-enabled/dynamic_clients
              including configuration file /usr/local/etc/raddb/mods-enabled/eap
              including configuration file /usr/local/etc/raddb/mods-enabled/echo
              including configuration file /usr/local/etc/raddb/mods-enabled/exec
              including configuration file /usr/local/etc/raddb/mods-enabled/expiration
              including configuration file /usr/local/etc/raddb/mods-enabled/expr
              including configuration file /usr/local/etc/raddb/mods-enabled/files
              including configuration file /usr/local/etc/raddb/mods-enabled/linelog
              including configuration file /usr/local/etc/raddb/mods-enabled/logintime
              including configuration file /usr/local/etc/raddb/mods-enabled/mschap
              including configuration file /usr/local/etc/raddb/mods-enabled/realm
              including configuration file /usr/local/etc/raddb/mods-enabled/pap
              including configuration file /usr/local/etc/raddb/mods-enabled/passwd
              including configuration file /usr/local/etc/raddb/mods-enabled/preprocess
              including configuration file /usr/local/etc/raddb/mods-enabled/radutmp
              including configuration file /usr/local/etc/raddb/mods-enabled/counter
              including configuration file /usr/local/etc/raddb/mods-enabled/replicate
              including configuration file /usr/local/etc/raddb/mods-enabled/soh
              including configuration file /usr/local/etc/raddb/mods-enabled/sradutmp
              including configuration file /usr/local/etc/raddb/mods-enabled/unix
              including configuration file /usr/local/etc/raddb/mods-enabled/always
              including configuration file /usr/local/etc/raddb/mods-enabled/unpack
              including configuration file /usr/local/etc/raddb/mods-enabled/utf8
              including configuration file /usr/local/etc/raddb/mods-enabled/motp
              including configuration file /usr/local/etc/raddb/mods-enabled/googleauth
              including configuration file /usr/local/etc/raddb/mods-enabled/datacounter_acct
              including files in directory /usr/local/etc/raddb/policy.d/
              including configuration file /usr/local/etc/raddb/policy.d/accounting
              including configuration file /usr/local/etc/raddb/policy.d/canonicalization
              including configuration file /usr/local/etc/raddb/policy.d/control
              including configuration file /usr/local/etc/raddb/policy.d/cui
              including configuration file /usr/local/etc/raddb/policy.d/debug
              including configuration file /usr/local/etc/raddb/policy.d/dhcp
              including configuration file /usr/local/etc/raddb/policy.d/eap
              including configuration file /usr/local/etc/raddb/policy.d/filter
              including configuration file /usr/local/etc/raddb/policy.d/moonshot-targeted-ids
              including configuration file /usr/local/etc/raddb/policy.d/operator-name
              including configuration file /usr/local/etc/raddb/policy.d/abfab-tr
              including configuration file /usr/local/etc/raddb/policy.d/pfs_custom_policies
              including files in directory /usr/local/etc/raddb/sites-enabled/
              including configuration file /usr/local/etc/raddb/sites-enabled/default
              including configuration file /usr/local/etc/raddb/sites-enabled/inner-tunnel-ttls
              including configuration file /usr/local/etc/raddb/sites-enabled/inner-tunnel-peap
              main {
               security {
               	allow_core_dumps = no
               }
              	name = "radiusd"
              	prefix = "/usr/local"
              	localstatedir = "/var"
              	logdir = "/var/log"
              	run_dir = "/var/run"
              }
              main {
              	name = "radiusd"
              	prefix = "/usr/local"
              	localstatedir = "/var"
              	sbindir = "/usr/local/sbin"
              	logdir = "/var/log"
              	run_dir = "/var/run"
              	libdir = "/usr/local/lib/freeradius-3.0.17"
              	radacctdir = "/var/log/radacct"
              	hostname_lookups = no
              	max_request_time = 30
              	cleanup_delay = 5
              	max_requests = 1024
              	pidfile = "/var/run/radiusd.pid"
              	checkrad = "/usr/local/sbin/checkrad"
              	debug_level = 0
              	proxy_requests = yes
               log {
               	stripped_names = no
               	auth = yes
               	auth_badpass = yes
               	auth_goodpass = yes
               	msg_badpass = ""
               	msg_goodpass = ""
               	colourise = yes
               	msg_denied = "You are already logged in - access denied"
               }
               resources {
               }
               security {
               	max_attributes = 200
               	reject_delay = 1.000000
               	status_server = no
               }
              }
              radiusd: #### Loading Realms and Home Servers ####
              radiusd: #### Loading Clients ####
               client RuckusAP {
               	ipaddr = 10.0.90.0
               	require_message_authenticator = no
               	secret = <<< secret >>>
               	nas_type = "other"
               	proto = "udp"
                limit {
                	max_connections = 16
                	lifetime = 0
                	idle_timeout = 30
                }
               }
              Debugger not attached
               # Creating Auth-Type = mschap
               # Creating Auth-Type = digest
               # Creating Auth-Type = eap
               # Creating Auth-Type = PAP
               # Creating Auth-Type = CHAP
               # Creating Auth-Type = MS-CHAP
               # Creating Auth-Type = MOTP
               # Creating Auth-Type = GOOGLEAUTH
               # Creating Autz-Type = Status-Server
               # Creating Acct-Type = Status-Server
              radiusd: #### Instantiating modules ####
               modules {
                # Loaded module rlm_attr_filter
                # Loading module "attr_filter.post-proxy" from file /usr/local/etc/raddb/mods-enabled/attr_filter
                attr_filter attr_filter.post-proxy {
                	filename = "/usr/local/etc/raddb/mods-config/attr_filter/post-proxy"
                	key = "%{Realm}"
                	relaxed = no
                }
                # Loading module "attr_filter.pre-proxy" from file /usr/local/etc/raddb/mods-enabled/attr_filter
                attr_filter attr_filter.pre-proxy {
                	filename = "/usr/local/etc/raddb/mods-config/attr_filter/pre-proxy"
                	key = "%{Realm}"
                	relaxed = no
                }
                # Loading module "attr_filter.access_reject" from file /usr/local/etc/raddb/mods-enabled/attr_filter
                attr_filter attr_filter.access_reject {
                	filename = "/usr/local/etc/raddb/mods-config/attr_filter/access_reject"
                	key = "%{User-Name}"
                	relaxed = no
                }
                # Loading module "attr_filter.access_challenge" from file /usr/local/etc/raddb/mods-enabled/attr_filter
                attr_filter attr_filter.access_challenge {
                	filename = "/usr/local/etc/raddb/mods-config/attr_filter/access_challenge"
                	key = "%{User-Name}"
                	relaxed = no
                }
                # Loading module "attr_filter.accounting_response" from file /usr/local/etc/raddb/mods-enabled/attr_filter
                attr_filter attr_filter.accounting_response {
                	filename = "/usr/local/etc/raddb/mods-config/attr_filter/accounting_response"
                	key = "%{User-Name}"
                	relaxed = no
                }
                # Loaded module rlm_cache
                # Loading module "cache_eap" from file /usr/local/etc/raddb/mods-enabled/cache_eap
                cache cache_eap {
                	driver = "rlm_cache_rbtree"
                	key = "%{%{control:State}:-%{%{reply:State}:-%{State}}}"
                	ttl = 15
                	max_entries = 0
                	epoch = 0
                	add_stats = no
                }
                # Loaded module rlm_chap
                # Loading module "chap" from file /usr/local/etc/raddb/mods-enabled/chap
                # Loaded module rlm_date
                # Loading module "date" from file /usr/local/etc/raddb/mods-enabled/date
                date {
                	format = "%b %e %Y %H:%M:%S %Z"
                	utc = no
                }
                # Loaded module rlm_detail
                # Loading module "detail" from file /usr/local/etc/raddb/mods-enabled/detail
                detail {
                	filename = "/var/log/radacct/%{%{Packet-Src-IP-Address}:-%{Packet-Src-IPv6-Address}}/detail-%Y%m%d"
                	header = "%t"
                	permissions = 384
                	locking = no
                	escape_filenames = no
                	log_packet_header = no
                }
                # Loading module "auth_log" from file /usr/local/etc/raddb/mods-enabled/detail.log
                detail auth_log {
                	filename = "/var/log/radacct/%{%{Packet-Src-IP-Address}:-%{Packet-Src-IPv6-Address}}/auth-detail-%Y%m%d"
                	header = "%t"
                	permissions = 384
                	locking = no
                	escape_filenames = no
                	log_packet_header = no
                }
                # Loading module "reply_log" from file /usr/local/etc/raddb/mods-enabled/detail.log
                detail reply_log {
                	filename = "/var/log/radacct/%{%{Packet-Src-IP-Address}:-%{Packet-Src-IPv6-Address}}/reply-detail-%Y%m%d"
                	header = "%t"
                	permissions = 384
                	locking = no
                	escape_filenames = no
                	log_packet_header = no
                }
                # Loading module "pre_proxy_log" from file /usr/local/etc/raddb/mods-enabled/detail.log
                detail pre_proxy_log {
                	filename = "/var/log/radacct/%{%{Packet-Src-IP-Address}:-%{Packet-Src-IPv6-Address}}/pre-proxy-detail-%Y%m%d"
                	header = "%t"
                	permissions = 384
                	locking = no
                	escape_filenames = no
                	log_packet_header = no
                }
                # Loading module "post_proxy_log" from file /usr/local/etc/raddb/mods-enabled/detail.log
                detail post_proxy_log {
                	filename = "/var/log/radacct/%{%{Packet-Src-IP-Address}:-%{Packet-Src-IPv6-Address}}/post-proxy-detail-%Y%m%d"
                	header = "%t"
                	permissions = 384
                	locking = no
                	escape_filenames = no
                	log_packet_header = no
                }
                # Loaded module rlm_digest
                # Loading module "digest" from file /usr/local/etc/raddb/mods-enabled/digest
                # Loaded module rlm_dynamic_clients
                # Loading module "dynamic_clients" from file /usr/local/etc/raddb/mods-enabled/dynamic_clients
                # Loaded module rlm_eap
                # Loading module "eap" from file /usr/local/etc/raddb/mods-enabled/eap
                eap {
                	default_eap_type = "mschapv2"
                	timer_expire = 60
                	ignore_unknown_eap_types = no
                	cisco_accounting_username_bug = no
                	max_sessions = 4096
                }
                # Loaded module rlm_exec
                # Loading module "echo" from file /usr/local/etc/raddb/mods-enabled/echo
                exec echo {
                	wait = yes
                	program = "/bin/echo %{User-Name}"
                	input_pairs = "request"
                	output_pairs = "reply"
                	shell_escape = yes
                }
                # Loading module "exec" from file /usr/local/etc/raddb/mods-enabled/exec
                exec {
                	wait = no
                	input_pairs = "request"
                	shell_escape = yes
                	timeout = 10
                }
                # Loaded module rlm_expiration
                # Loading module "expiration" from file /usr/local/etc/raddb/mods-enabled/expiration
                # Loaded module rlm_expr
                # Loading module "expr" from file /usr/local/etc/raddb/mods-enabled/expr
                expr {
                	safe_characters = "@abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ0123456789.-_: /äéöüàâæçèéêëîïôœùûüaÿÄÉÖÜßÀÂÆÇÈÉÊËÎÏÔŒÙÛÜŸ"
                }
                # Loaded module rlm_files
                # Loading module "files" from file /usr/local/etc/raddb/mods-enabled/files
                files {
                	filename = "/usr/local/etc/raddb/mods-config/files/authorize"
                	acctusersfile = "/usr/local/etc/raddb/mods-config/files/accounting"
                	preproxy_usersfile = "/usr/local/etc/raddb/mods-config/files/pre-proxy"
                }
                # Loaded module rlm_linelog
                # Loading module "linelog" from file /usr/local/etc/raddb/mods-enabled/linelog
                linelog {
                	filename = "/var/log/linelog"
                	escape_filenames = no
                	syslog_severity = "info"
                	permissions = 384
                	format = "This is a log message for %{User-Name}"
                	reference = "messages.%{%{reply:Packet-Type}:-default}"
                }
                # Loading module "log_accounting" from file /usr/local/etc/raddb/mods-enabled/linelog
                linelog log_accounting {
                	filename = "/var/log/linelog-accounting"
                	escape_filenames = no
                	syslog_severity = "info"
                	permissions = 384
                	format = ""
                	reference = "Accounting-Request.%{%{Acct-Status-Type}:-unknown}"
                }
                # Loaded module rlm_logintime
                # Loading module "logintime" from file /usr/local/etc/raddb/mods-enabled/logintime
                logintime {
                	minimum_timeout = 60
                }
                # Loaded module rlm_mschap
                # Loading module "mschap" from file /usr/local/etc/raddb/mods-enabled/mschap
                mschap {
                	use_mppe = yes
                	require_encryption = no
                	require_strong = no
                	with_ntdomain_hack = yes
                 passchange {
                 }
                	allow_retry = yes
                	winbind_retry_with_normalised_username = no
                }
                # Loaded module rlm_realm
                # Loading module "IPASS" from file /usr/local/etc/raddb/mods-enabled/realm
                realm IPASS {
                	format = "prefix"
                	delimiter = "/"
                	ignore_default = no
                	ignore_null = yes
                }
                # Loading module "suffix" from file /usr/local/etc/raddb/mods-enabled/realm
                realm suffix {
                	format = "suffix"
                	delimiter = "@"
                	ignore_default = no
                	ignore_null = yes
                }
                # Loading module "realmpercent" from file /usr/local/etc/raddb/mods-enabled/realm
                realm realmpercent {
                	format = "suffix"
                	delimiter = "%"
                	ignore_default = no
                	ignore_null = yes
                }
                # Loading module "ntdomain" from file /usr/local/etc/raddb/mods-enabled/realm
                realm ntdomain {
                	format = "prefix"
                	delimiter = "\"
                	ignore_default = no
                	ignore_null = yes
                }
                # Loaded module rlm_pap
                # Loading module "pap" from file /usr/local/etc/raddb/mods-enabled/pap
                pap {
                	normalise = yes
                }
                # Loaded module rlm_passwd
                # Loading module "etc_passwd" from file /usr/local/etc/raddb/mods-enabled/passwd
                passwd etc_passwd {
                	filename = "/etc/passwd"
                	format = "*User-Name:Crypt-Password:"
                	delimiter = ":"
                	ignore_nislike = no
                	ignore_empty = yes
                	allow_multiple_keys = no
                	hash_size = 100
                }
                # Loaded module rlm_preprocess
                # Loading module "preprocess" from file /usr/local/etc/raddb/mods-enabled/preprocess
                preprocess {
                	huntgroups = "/usr/local/etc/raddb/mods-config/preprocess/huntgroups"
                	hints = "/usr/local/etc/raddb/mods-config/preprocess/hints"
                	with_ascend_hack = no
                	ascend_channels_per_line = 23
                	with_ntdomain_hack = no
                	with_specialix_jetstream_hack = no
                	with_cisco_vsa_hack = no
                	with_alvarion_vsa_hack = no
                }
                # Loaded module rlm_radutmp
                # Loading module "radutmp" from file /usr/local/etc/raddb/mods-enabled/radutmp
                radutmp {
                	filename = "/var/log/radutmp"
                	username = "%{User-Name}"
                	case_sensitive = yes
                	check_with_nas = yes
                	permissions = 384
                	caller_id = yes
                }
                # Loaded module rlm_counter
                # Loading module "daily" from file /usr/local/etc/raddb/mods-enabled/counter
                counter daily {
                	filename = "/var/log/radacct/timecounter/db.daily"
                	key = "User-Name"
                	reset = "daily"
                	count_attribute = "Acct-Session-Time"
                	counter_name = "Daily-Session-Time"
                	check_name = "Max-Daily-Session"
                	reply_name = "Session-Timeout"
                	cache_size = 5000
                }
                # Loading module "weekly" from file /usr/local/etc/raddb/mods-enabled/counter
                counter weekly {
                	filename = "/var/log/radacct/timecounter/db.weekly"
                	key = "User-Name"
                	reset = "weekly"
                	count_attribute = "Acct-Session-Time"
                	counter_name = "Weekly-Session-Time"
                	check_name = "Max-Weekly-Session"
                	reply_name = "Session-Timeout"
                	cache_size = 5000
                }
                # Loading module "monthly" from file /usr/local/etc/raddb/mods-enabled/counter
                counter monthly {
                	filename = "/var/log/radacct/timecounter/db.monthly"
                	key = "User-Name"
                	reset = "monthly"
                	count_attribute = "Acct-Session-Time"
                	counter_name = "Monthly-Session-Time"
                	check_name = "Max-Monthly-Session"
                	reply_name = "Session-Timeout"
                	cache_size = 5000
                }
                # Loading module "forever" from file /usr/local/etc/raddb/mods-enabled/counter
                counter forever {
                	filename = "/var/log/radacct/timecounter/db.forever"
                	key = "User-Name"
                	reset = "never"
                	count_attribute = "Acct-Session-Time"
                	counter_name = "Forever-Session-Time"
                	check_name = "Max-Forever-Session"
                	reply_name = "Session-Timeout"
                	cache_size = 5000
                }
                # Loaded module rlm_replicate
                # Loading module "replicate" from file /usr/local/etc/raddb/mods-enabled/replicate
                # Loaded module rlm_soh
                # Loading module "soh" from file /usr/local/etc/raddb/mods-enabled/soh
                soh {
                	dhcp = yes
                }
                # Loading module "sradutmp" from file /usr/local/etc/raddb/mods-enabled/sradutmp
                radutmp sradutmp {
                	filename = "/var/log/sradutmp"
                	username = "%{User-Name}"
                	case_sensitive = yes
                	check_with_nas = yes
                	permissions = 420
                	caller_id = no
                }
                # Loaded module rlm_unix
                # Loading module "unix" from file /usr/local/etc/raddb/mods-enabled/unix
                unix {
                	radwtmp = "/var/log/radwtmp"
                }
              Creating attribute Unix-Group
                # Loaded module rlm_always
                # Loading module "reject" from file /usr/local/etc/raddb/mods-enabled/always
                always reject {
                	rcode = "reject"
                	simulcount = 0
                	mpp = no
                }
                # Loading module "fail" from file /usr/local/etc/raddb/mods-enabled/always
                always fail {
                	rcode = "fail"
                	simulcount = 0
                	mpp = no
                }
                # Loading module "ok" from file /usr/local/etc/raddb/mods-enabled/always
                always ok {
                	rcode = "ok"
                	simulcount = 0
                	mpp = no
                }
                # Loading module "handled" from file /usr/local/etc/raddb/mods-enabled/always
                always handled {
                	rcode = "handled"
                	simulcount = 0
                	mpp = no
                }
                # Loading module "invalid" from file /usr/local/etc/raddb/mods-enabled/always
                always invalid {
                	rcode = "invalid"
                	simulcount = 0
                	mpp = no
                }
                # Loading module "userlock" from file /usr/local/etc/raddb/mods-enabled/always
                always userlock {
                	rcode = "userlock"
                	simulcount = 0
                	mpp = no
                }
                # Loading module "notfound" from file /usr/local/etc/raddb/mods-enabled/always
                always notfound {
                	rcode = "notfound"
                	simulcount = 0
                	mpp = no
                }
                # Loading module "noop" from file /usr/local/etc/raddb/mods-enabled/always
                always noop {
                	rcode = "noop"
                	simulcount = 0
                	mpp = no
                }
                # Loading module "updated" from file /usr/local/etc/raddb/mods-enabled/always
                always updated {
                	rcode = "updated"
                	simulcount = 0
                	mpp = no
                }
                # Loaded module rlm_unpack
                # Loading module "unpack" from file /usr/local/etc/raddb/mods-enabled/unpack
                # Loaded module rlm_utf8
                # Loading module "utf8" from file /usr/local/etc/raddb/mods-enabled/utf8
                # Loading module "motp" from file /usr/local/etc/raddb/mods-enabled/motp
                exec motp {
                	wait = yes
                	program = "/usr/local/bin/bash /usr/local/etc/raddb/scripts/otpverify.sh %{request:User-Name} %{request:User-Password} %{reply:MOTP-Init-Secret} %{reply:MOTP-PIN} %{reply:MOTP-Offset}"
                	shell_escape = yes
                }
                # Loading module "googleauth" from file /usr/local/etc/raddb/mods-enabled/googleauth
                exec googleauth {
                	wait = yes
                	program = "/usr/local/etc/raddb/scripts/googleauth.py %{request:User-Name} %{reply:MOTP-Init-Secret} %{reply:MOTP-PIN} %{request:User-Password}"
                	shell_escape = yes
                }
                # Loading module "datacounterdaily" from file /usr/local/etc/raddb/mods-enabled/datacounter_acct
                exec datacounterdaily {
                	wait = yes
                	program = "/bin/sh /usr/local/etc/raddb/scripts/datacounter_acct.sh %{request:User-Name} daily %{request:Acct-Input-Octets} %{request:Acct-Output-Octets} %{request:Acct-Status-Type} %{request:Acct-Session-Id}"
                	shell_escape = yes
                }
                # Loading module "datacounterweekly" from file /usr/local/etc/raddb/mods-enabled/datacounter_acct
                exec datacounterweekly {
                	wait = yes
                	program = "/bin/sh /usr/local/etc/raddb/scripts/datacounter_acct.sh %{request:User-Name} weekly %{request:Acct-Input-Octets} %{request:Acct-Output-Octets} %{request:Acct-Status-Type} %{request:Acct-Session-Id}"
                	shell_escape = yes
                }
                # Loading module "datacountermonthly" from file /usr/local/etc/raddb/mods-enabled/datacounter_acct
                exec datacountermonthly {
                	wait = yes
                	program = "/bin/sh /usr/local/etc/raddb/scripts/datacounter_acct.sh %{request:User-Name} monthly %{request:Acct-Input-Octets} %{request:Acct-Output-Octets} %{request:Acct-Status-Type} %{request:Acct-Session-Id}"
                	shell_escape = yes
                }
                # Loading module "datacounterforever" from file /usr/local/etc/raddb/mods-enabled/datacounter_acct
                exec datacounterforever {
                	wait = yes
                	program = "/bin/sh /usr/local/etc/raddb/scripts/datacounter_acct.sh %{request:User-Name} forever %{request:Acct-Input-Octets} %{request:Acct-Output-Octets} %{request:Acct-Status-Type} %{request:Acct-Session-Id}"
                	shell_escape = yes
                }
                instantiate {
                # Instantiating module "expiration" from file /usr/local/etc/raddb/mods-enabled/expiration
                # Instantiating module "logintime" from file /usr/local/etc/raddb/mods-enabled/logintime
                # Instantiating module "daily" from file /usr/local/etc/raddb/mods-enabled/counter
              rlm_counter: Current Time: 1559310885 [2019-05-31 15:54:45], Next reset 1559340000 [2019-06-01 00:00:00]
              rlm_counter: add_defaults: Start
              rlm_counter: DEFAULT1 set to 1559340000
              rlm_counter: DEFAULT2 set to 1559310885
              rlm_counter: add_defaults: End
                # Instantiating module "weekly" from file /usr/local/etc/raddb/mods-enabled/counter
              rlm_counter: Current Time: 1559310885 [2019-05-31 15:54:45], Next reset 1559426400 [2019-06-02 00:00:00]
              rlm_counter: add_defaults: Start
              rlm_counter: DEFAULT1 set to 1559426400
              rlm_counter: DEFAULT2 set to 1559310885
              rlm_counter: add_defaults: End
                # Instantiating module "monthly" from file /usr/local/etc/raddb/mods-enabled/counter
              rlm_counter: Current Time: 1559310885 [2019-05-31 15:54:45], Next reset 1559340000 [2019-06-01 00:00:00]
              rlm_counter: add_defaults: Start
              rlm_counter: DEFAULT1 set to 1559340000
              rlm_counter: DEFAULT2 set to 1559310885
              rlm_counter: add_defaults: End
                # Instantiating module "forever" from file /usr/local/etc/raddb/mods-enabled/counter
              rlm_counter: Current Time: 1559310885 [2019-05-31 15:54:45], Next reset 0 [2019-05-31 15:00:00]
              rlm_counter: add_defaults: Start
              rlm_counter: DEFAULT1 set to 0
              rlm_counter: DEFAULT2 set to 1559310885
              rlm_counter: add_defaults: End
                }
                # Instantiating module "attr_filter.post-proxy" from file /usr/local/etc/raddb/mods-enabled/attr_filter
              reading pairlist file /usr/local/etc/raddb/mods-config/attr_filter/post-proxy
                # Instantiating module "attr_filter.pre-proxy" from file /usr/local/etc/raddb/mods-enabled/attr_filter
              reading pairlist file /usr/local/etc/raddb/mods-config/attr_filter/pre-proxy
                # Instantiating module "attr_filter.access_reject" from file /usr/local/etc/raddb/mods-enabled/attr_filter
              reading pairlist file /usr/local/etc/raddb/mods-config/attr_filter/access_reject
              [/usr/local/etc/raddb/mods-config/attr_filter/access_reject]:11 Check item "FreeRADIUS-Response-Delay" 	found in filter list for realm "DEFAULT".
              [/usr/local/etc/raddb/mods-config/attr_filter/access_reject]:11 Check item "FreeRADIUS-Response-Delay-USec" 	found in filter list for realm "DEFAULT".
                # Instantiating module "attr_filter.access_challenge" from file /usr/local/etc/raddb/mods-enabled/attr_filter
              reading pairlist file /usr/local/etc/raddb/mods-config/attr_filter/access_challenge
                # Instantiating module "attr_filter.accounting_response" from file /usr/local/etc/raddb/mods-enabled/attr_filter
              reading pairlist file /usr/local/etc/raddb/mods-config/attr_filter/accounting_response
                # Instantiating module "cache_eap" from file /usr/local/etc/raddb/mods-enabled/cache_eap
              rlm_cache (cache_eap): Driver rlm_cache_rbtree (module rlm_cache_rbtree) loaded and linked
                # Instantiating module "detail" from file /usr/local/etc/raddb/mods-enabled/detail
                # Instantiating module "auth_log" from file /usr/local/etc/raddb/mods-enabled/detail.log
              rlm_detail (auth_log): 'User-Password' suppressed, will not appear in detail output
                # Instantiating module "reply_log" from file /usr/local/etc/raddb/mods-enabled/detail.log
                # Instantiating module "pre_proxy_log" from file /usr/local/etc/raddb/mods-enabled/detail.log
                # Instantiating module "post_proxy_log" from file /usr/local/etc/raddb/mods-enabled/detail.log
                # Instantiating module "eap" from file /usr/local/etc/raddb/mods-enabled/eap
                 # Linked to sub-module rlm_eap_tls
                 tls {
                 	tls = "tls-common"
                 }
                 tls-config tls-common {
                 	verify_depth = 0
                 	ca_path = "/usr/local/etc/raddb/certs"
                 	pem_file_type = yes
                 	private_key_file = "/usr/local/etc/raddb/certs/server_key.pem"
                 	certificate_file = "/usr/local/etc/raddb/certs/server_cert.pem"
                 	ca_file = "/usr/local/etc/raddb/certs/ca_cert.pem"
                 	dh_file = "/usr/local/etc/raddb/certs/dh"
                 	random_file = "/dev/urandom"
                 	fragment_size = 1024
                 	include_length = yes
                 	auto_chain = yes
                 	check_crl = no
                 	check_all_crl = no
                 	cipher_list = "DEFAULT"
                 	cipher_server_preference = no
                 	ecdh_curve = "prime256v1"
                 	tls_max_version = ""
                 	tls_min_version = "1.0"
                  cache {
                  	enable = no
                  	lifetime = 24
                  	max_entries = 255
                  }
                  verify {
                  	skip_if_ocsp_ok = no
                  }
                  ocsp {
                  	enable = no
                  	override_cert_url = no
                  	url = "http://127.0.0.1/ocsp/"
                  	use_nonce = yes
                  	timeout = 0
                  	softfail = no
                  }
                 }
                 # Linked to sub-module rlm_eap_ttls
                 ttls {
                 	tls = "tls-common"
                 	default_eap_type = "mschapv2"
                 	copy_request_to_tunnel = no
                 	use_tunneled_reply = no
                 	virtual_server = "inner-tunnel-ttls"
                 	include_length = yes
                 	require_client_cert = no
                 }
              tls: Using cached TLS configuration from previous invocation
                 # Linked to sub-module rlm_eap_peap
                 peap {
                 	tls = "tls-common"
                 	default_eap_type = "mschapv2"
                 	copy_request_to_tunnel = no
                 	use_tunneled_reply = no
                 	proxy_tunneled_request_as_eap = yes
                 	virtual_server = "inner-tunnel-peap"
                 	soh = no
                 	require_client_cert = no
                 }
              tls: Using cached TLS configuration from previous invocation
                 # Linked to sub-module rlm_eap_mschapv2
                 mschapv2 {
                 	with_ntdomain_hack = no
                 	send_error = no
                 }
                # Instantiating module "files" from file /usr/local/etc/raddb/mods-enabled/files
              reading pairlist file /usr/local/etc/raddb/mods-config/files/authorize
              reading pairlist file /usr/local/etc/raddb/mods-config/files/accounting
              reading pairlist file /usr/local/etc/raddb/mods-config/files/pre-proxy
                # Instantiating module "linelog" from file /usr/local/etc/raddb/mods-enabled/linelog
                # Instantiating module "log_accounting" from file /usr/local/etc/raddb/mods-enabled/linelog
                # Instantiating module "mschap" from file /usr/local/etc/raddb/mods-enabled/mschap
              rlm_mschap (mschap): using internal authentication
                # Instantiating module "IPASS" from file /usr/local/etc/raddb/mods-enabled/realm
                # Instantiating module "suffix" from file /usr/local/etc/raddb/mods-enabled/realm
                # Instantiating module "realmpercent" from file /usr/local/etc/raddb/mods-enabled/realm
                # Instantiating module "ntdomain" from file /usr/local/etc/raddb/mods-enabled/realm
                # Instantiating module "pap" from file /usr/local/etc/raddb/mods-enabled/pap
                # Instantiating module "etc_passwd" from file /usr/local/etc/raddb/mods-enabled/passwd
              rlm_passwd: nfields: 3 keyfield 0(User-Name) listable: no
                # Instantiating module "preprocess" from file /usr/local/etc/raddb/mods-enabled/preprocess
              reading pairlist file /usr/local/etc/raddb/mods-config/preprocess/huntgroups
              reading pairlist file /usr/local/etc/raddb/mods-config/preprocess/hints
                # Instantiating module "reject" from file /usr/local/etc/raddb/mods-enabled/always
                # Instantiating module "fail" from file /usr/local/etc/raddb/mods-enabled/always
                # Instantiating module "ok" from file /usr/local/etc/raddb/mods-enabled/always
                # Instantiating module "handled" from file /usr/local/etc/raddb/mods-enabled/always
                # Instantiating module "invalid" from file /usr/local/etc/raddb/mods-enabled/always
                # Instantiating module "userlock" from file /usr/local/etc/raddb/mods-enabled/always
                # Instantiating module "notfound" from file /usr/local/etc/raddb/mods-enabled/always
                # Instantiating module "noop" from file /usr/local/etc/raddb/mods-enabled/always
                # Instantiating module "updated" from file /usr/local/etc/raddb/mods-enabled/always
               } # modules
              radiusd: #### Loading Virtual Servers ####
              server { # from file /usr/local/etc/raddb/radiusd.conf
              } # server
              server default { # from file /usr/local/etc/raddb/sites-enabled/default
               # Loading authenticate {...}
               # Loading authorize {...}
               # Loading preacct {...}
               # Loading accounting {...}
               # Loading session {...}
               # Loading pre-proxy {...}
               # Loading post-proxy {...}
               # Loading post-auth {...}
              } # server default
              server inner-tunnel-ttls { # from file /usr/local/etc/raddb/sites-enabled/inner-tunnel-ttls
               # Loading authenticate {...}
               # Loading authorize {...}
              Ignoring "sql" (see raddb/mods-available/README.rst)
              Ignoring "ldap" (see raddb/mods-available/README.rst)
               # Loading session {...}
               # Loading post-proxy {...}
               # Loading post-auth {...}
              } # server inner-tunnel-ttls
              server inner-tunnel-peap { # from file /usr/local/etc/raddb/sites-enabled/inner-tunnel-peap
               # Loading authenticate {...}
               # Loading authorize {...}
               # Loading session {...}
               # Loading post-proxy {...}
               # Loading post-auth {...}
              } # server inner-tunnel-peap
              radiusd: #### Opening IP addresses and Ports ####
              listen {
                	type = "auth"
                	ipaddr = 10.0.0.252
                	port = 1812
              }
              listen {
                	type = "auth"
                	ipaddr = 127.0.0.1
                	port = 18127
              }
              listen {
                	type = "auth"
                	ipaddr = 127.0.0.1
                	port = 18128
              }
              Listening on auth address 10.0.0.252 port 1812 bound to server default
              Listening on auth address 127.0.0.1 port 18127 bound to server inner-tunnel-ttls
              Listening on auth address 127.0.0.1 port 18128 bound to server inner-tunnel-peap
              Ready to process requests
              
              Ignoring request to auth address 10.0.0.252 port 1812 bound to server default from unknown client 10.0.90.11 port 32885 proto udp
              Ready to process requests
              Ignoring request to auth address 10.0.0.252 port 1812 bound to server default from unknown client 10.0.90.11 port 32885 proto udp
              Ready to process requests
              Ignoring request to auth address 10.0.0.252 port 1812 bound to server default from unknown client 10.0.90.11 port 32885 proto udp
              Ready to process requests
              
              1 Reply Last reply Reply Quote 0
              • johnpoz
                johnpoz LAYER 8 Global Moderator last edited by

                @joriz said in Pfsense/Freeradius: Ignoring request to auth address ...:

                from unknown client 10.0.90.11

                Says right there what your problem is ;)

                Did you setup the client in freerad?

                clients.png

                An intelligent man is sometimes forced to be drunk to spend time with his fools
                If you get confused: Listen to the Music Play
                Please don't Chat/PM me for help, unless mod related
                SG-4860 22.05 | Lab VMs CE 2.6, 2.7

                1 Reply Last reply Reply Quote 0
                • kiokoman
                  kiokoman LAYER 8 last edited by kiokoman

                  i was testing this on a VM and i've come to the same conclusion of @joriz :)
                  You say "In Pfsense i have configured 10.0.90.0"
                  this is the problem
                  You must add nas/client with ip 10.0.90.11 and so on

                  ̿' ̿'\̵͇̿̿\з=(◕_◕)=ε/̵͇̿̿/'̿'̿ ̿
                  Please do not use chat/PM to ask for help
                  we must focus on silencing this @guest character. we must make up lies and alter the copyrights !
                  Don't forget to Upvote with the 👍 button for any post you find to be helpful.

                  J 1 Reply Last reply Reply Quote 0
                  • J
                    joriz @kiokoman last edited by

                    @kiokoman Thank you for testing this.
                    I have added every AP as a NAS client and now it works again.
                    Something must have been changed with the newer FreeRadius modules because 10.0.90.0 was working for many years...

                    Thank you everyone. I learned alot.

                    1 Reply Last reply Reply Quote 0
                    • johnpoz
                      johnpoz LAYER 8 Global Moderator last edited by

                      I have been using the freerad package on pfsense for years, for sure since May of 2014 when got first unifi AP.. And for sure you had to setup nas client for it to work... I distinctly recall doing testing and having to put that in place.

                      An intelligent man is sometimes forced to be drunk to spend time with his fools
                      If you get confused: Listen to the Music Play
                      Please don't Chat/PM me for help, unless mod related
                      SG-4860 22.05 | Lab VMs CE 2.6, 2.7

                      1 Reply Last reply Reply Quote 0
                      • First post
                        Last post