search

FreeRADIUS / freeradius-server

FreeRADIUS - A multi-protocol policy server.
http://freeradius.org
GNU General Public License v2.0
2.11k stars 1.08k forks source link

Issue with {PBKDF2_SHA256} in password header #2649

Closed w4r10-b0b closed 3 years ago

w4r10-b0b commented 5 years ago

Issue type

REMOVE THOSE WHICH DO NOT APPLY

See here for debugging instructions and how to obtain backtraces.

Defect

How to reproduce the issue

When attempting to authenticate to the FreeIPA server which uses encrypted password. Still uses PAP and does not recognise the encryption type header used.

Output of [radiusd|freeradius] -X showing issue occurring

(you may need to run [radiusd|freeradius] -fxx -l stdout if using eg RADIUS with TLS)

sudo docker run --name myradius -v /var/lib/freeradius/raddb/clients.conf:/etc/raddb/clients.conf -v /var/lib/freeradius/raddb/mods-enabled/eap:/etc/raddb/mods-enabled/eap -v /var/lib/freeradius/raddb/mods-enabled/ldap:/etc/raddb/mods-enabled/ldap -v /var/lib/freeradius/raddb/mods-enabled/chap:/etc/raddb/mods-enabled/chap -v /var/lib/freeradius/raddb/mods-enabled/pap:/etc/raddb/mods-enabled/pap -v /var/lib/freeradius/raddb/mods-enabled/mschap:/etc/raddb/mods-enabled/mschap -v /var/lib/freeradius/certs/rootCA.crt:/etc/freeradius/certs/rootCA.crt -v /var/lib/freeradius/certs/dh:/etc/freeradius/certs/dh -v /var/lib/freeradius/certs/server.crt:/etc/freeradius/certs/server.crt -v /var/lib/freeradius/certs/server.key:/etc/freeradius/certs/server.key -p 1812-1813:1812-1813/udp -p 1812-1813:1812-1813/tcp freeradius/freeradius-ser[root@ipa ~]# docker  rm myradius 

[root@ipa ~]# sudo docker run --name myradius -v /var/lib/freeradius/raddb/clients.conf:/etc/raddb/clients.conf -v /var/lib/freeradius/raddb/mods-enabled/eap:/etc/raddb/mods-enabled/eap -v /var/lib/freeradius/raddb/mods-enabled/ldap:/etc/raddb/mods-enabled/ldap -v /var/lib/freeradius/raddb/mods-enabled/chap:/etc/raddb/mods-enabled/chap -v /var/lib/freeradius/raddb/mods-enabled/pap:/etc/raddb/mods-enabled/pap -v /var/lib/freeradius/raddb/mods-enabled/mschap:/etc/raddb/mods-enabled/mschap -v /var/lib/freeradius/certs/rootCA.crt:/etc/freeradius/certs/rootCA.crt -v /var/lib/freeradius/certs/dh:/etc/freeradius/certs/dh -v /var/lib/freeradius/certs/server.crt:/etc/freeradius/certs/server.crt -v /var/lib/freeradius/certs/server.key:/etc/freeradius/certs/server.key -p 1812-1813:1812-1813/udp -p 1812-1813:1812-1813/tcp freeradius/freeradius-server -X
FreeRADIUS Version 3.0.19
Copyright (C) 1999-2019 The FreeRADIUS server project and contributors
There is NO warranty; not even for MERCHANTABILITY or FITNESS FOR A
PARTICULAR PURPOSE
You may redistribute copies of FreeRADIUS under the terms of the
GNU General Public License
For more information about these matters, see the file named COPYRIGHT
Starting - reading configuration files ...
including dictionary file /usr/share/freeradius/dictionary
including dictionary file /usr/share/freeradius/dictionary.dhcp
including dictionary file /usr/share/freeradius/dictionary.vqp
including dictionary file /etc/freeradius/dictionary
including configuration file /etc/freeradius/radiusd.conf
including configuration file /etc/freeradius/proxy.conf
including configuration file /etc/freeradius/clients.conf
including files in directory /etc/freeradius/mods-enabled/
including configuration file /etc/freeradius/mods-enabled/always
including configuration file /etc/freeradius/mods-enabled/attr_filter
including configuration file /etc/freeradius/mods-enabled/cache_eap
including configuration file /etc/freeradius/mods-enabled/chap
including configuration file /etc/freeradius/mods-enabled/date
including configuration file /etc/freeradius/mods-enabled/detail
including configuration file /etc/freeradius/mods-enabled/detail.log
including configuration file /etc/freeradius/mods-enabled/digest
including configuration file /etc/freeradius/mods-enabled/dynamic_clients
including configuration file /etc/freeradius/mods-enabled/eap
including configuration file /etc/freeradius/mods-enabled/echo
including configuration file /etc/freeradius/mods-enabled/exec
including configuration file /etc/freeradius/mods-enabled/expiration
including configuration file /etc/freeradius/mods-enabled/expr
including configuration file /etc/freeradius/mods-enabled/files
including configuration file /etc/freeradius/mods-enabled/linelog
including configuration file /etc/freeradius/mods-enabled/logintime
including configuration file /etc/freeradius/mods-enabled/mschap
including configuration file /etc/freeradius/mods-enabled/ntlm_auth
including configuration file /etc/freeradius/mods-enabled/pap
including configuration file /etc/freeradius/mods-enabled/passwd
including configuration file /etc/freeradius/mods-enabled/preprocess
including configuration file /etc/freeradius/mods-enabled/radutmp
including configuration file /etc/freeradius/mods-enabled/realm
including configuration file /etc/freeradius/mods-enabled/replicate
including configuration file /etc/freeradius/mods-enabled/soh
including configuration file /etc/freeradius/mods-enabled/sradutmp
including configuration file /etc/freeradius/mods-enabled/unix
including configuration file /etc/freeradius/mods-enabled/unpack
including configuration file /etc/freeradius/mods-enabled/utf8
including configuration file /etc/freeradius/mods-enabled/ldap
including files in directory /etc/freeradius/policy.d/
including configuration file /etc/freeradius/policy.d/abfab-tr
including configuration file /etc/freeradius/policy.d/accounting
including configuration file /etc/freeradius/policy.d/canonicalization
including configuration file /etc/freeradius/policy.d/control
including configuration file /etc/freeradius/policy.d/cui
including configuration file /etc/freeradius/policy.d/debug
including configuration file /etc/freeradius/policy.d/dhcp
including configuration file /etc/freeradius/policy.d/eap
including configuration file /etc/freeradius/policy.d/filter
including configuration file /etc/freeradius/policy.d/moonshot-targeted-ids
including configuration file /etc/freeradius/policy.d/operator-name
including configuration file /etc/freeradius/policy.d/rfc7542
including files in directory /etc/freeradius/sites-enabled/
including configuration file /etc/freeradius/sites-enabled/default
including configuration file /etc/freeradius/sites-enabled/inner-tunnel
main {
 security {
        user = "freerad"
        group = "freerad"
        allow_core_dumps = no
 }
        name = "freeradius"
        prefix = "/usr"
        localstatedir = "/var"
        logdir = "/var/log/freeradius"
        run_dir = "/var/run/freeradius"
}
main {
        name = "freeradius"
        prefix = "/usr"
        localstatedir = "/var"
        sbindir = "/usr/sbin"
        logdir = "/var/log/freeradius"
        run_dir = "/var/run/freeradius"
        libdir = "/usr/lib/freeradius"
        radacctdir = "/var/log/freeradius/radacct"
        hostname_lookups = no
        max_request_time = 30
        cleanup_delay = 5
        max_requests = 16384
        pidfile = "/var/run/freeradius/freeradius.pid"
        checkrad = "/usr/sbin/checkrad"
        debug_level = 0
        proxy_requests = yes
 log {
        stripped_names = no
        auth = no
        auth_badpass = no
        auth_goodpass = no
        colourise = yes
        msg_denied = "You are already logged in - access denied"
 }
 resources {
 }
 security {
        max_attributes = 200
        reject_delay = 1.000000
        status_server = yes
 }
}
radiusd: #### Loading Realms and Home Servers ####
 proxy server {
        retry_delay = 5
        retry_count = 3
        default_fallback = no
        dead_time = 120
        wake_all_if_all_dead = no
 }
 home_server localhost {
        ipaddr = 127.0.0.1
        port = 1812
        type = "auth"
        secret = <<< secret >>>
        response_window = 20.000000
        response_timeouts = 1
        max_outstanding = 65536
        zombie_period = 40
        status_check = "status-server"
        ping_interval = 30
        check_interval = 30
        check_timeout = 4
        num_answers_to_alive = 3
        revive_interval = 120
  limit {
        max_connections = 16
        max_requests = 0
        lifetime = 0
        idle_timeout = 0
  }
  coa {
        irt = 2
        mrt = 16
        mrc = 5
        mrd = 30
  }
 }
 home_server_pool my_auth_failover {
        type = fail-over
        home_server = localhost
 }
 realm example.com {
        auth_pool = my_auth_failover
 }
 realm LOCAL {
 }
radiusd: #### Loading Clients ####
 client emanuel-firewall {
        ipaddr = 1.1.1.1
        require_message_authenticator = no
        secret = <<< secret >>>
  limit {
        max_connections = 16
        lifetime = 0
        idle_timeout = 30
  }
 }
 client emanuel-firewall-internal {
        ipaddr = 172.16.0.1
        require_message_authenticator = no
        secret = <<< secret >>>
  limit {
        max_connections = 16
        lifetime = 0
        idle_timeout = 30
  }
 }
 client freeipa {
        ipaddr = 192.168.0.2
        require_message_authenticator = no
        secret = <<< secret >>>
  limit {
        max_connections = 16
        lifetime = 0
        idle_timeout = 30
  }
 }
Debug state unknown (cap_sys_ptrace capability not set)
systemd watchdog is disabled
 # Creating Auth-Type = mschap
 # Creating Auth-Type = digest
 # Creating Auth-Type = eap
 # Creating Auth-Type = PAP
 # Creating Auth-Type = CHAP
 # Creating Auth-Type = MS-CHAP
radiusd: #### Instantiating modules ####
 modules {
  # Loaded module rlm_always
  # Loading module "reject" from file /etc/freeradius/mods-enabled/always
  always reject {
        rcode = "reject"
        simulcount = 0
        mpp = no
  }
  # Loading module "fail" from file /etc/freeradius/mods-enabled/always
  always fail {
        rcode = "fail"
        simulcount = 0
        mpp = no
  }
  # Loading module "ok" from file /etc/freeradius/mods-enabled/always
  always ok {
        rcode = "ok"
        simulcount = 0
        mpp = no
  }
  # Loading module "handled" from file /etc/freeradius/mods-enabled/always
  always handled {
        rcode = "handled"
        simulcount = 0
        mpp = no
  }
  # Loading module "invalid" from file /etc/freeradius/mods-enabled/always
  always invalid {
        rcode = "invalid"
        simulcount = 0
        mpp = no
  }
  # Loading module "userlock" from file /etc/freeradius/mods-enabled/always
  always userlock {
        rcode = "userlock"
        simulcount = 0
        mpp = no
  }
  # Loading module "notfound" from file /etc/freeradius/mods-enabled/always
  always notfound {
        rcode = "notfound"
        simulcount = 0
        mpp = no
  }
  # Loading module "noop" from file /etc/freeradius/mods-enabled/always
  always noop {
        rcode = "noop"
        simulcount = 0
        mpp = no
  }
  # Loading module "updated" from file /etc/freeradius/mods-enabled/always
  always updated {
        rcode = "updated"
        simulcount = 0
        mpp = no
  }
  # Loaded module rlm_attr_filter
  # Loading module "attr_filter.post-proxy" from file /etc/freeradius/mods-enabled/attr_filter
  attr_filter attr_filter.post-proxy {
        filename = "/etc/freeradius/mods-config/attr_filter/post-proxy"
        key = "%{Realm}"
        relaxed = no
  }
  # Loading module "attr_filter.pre-proxy" from file /etc/freeradius/mods-enabled/attr_filter
  attr_filter attr_filter.pre-proxy {
        filename = "/etc/freeradius/mods-config/attr_filter/pre-proxy"
        key = "%{Realm}"
        relaxed = no
  }
  # Loading module "attr_filter.access_reject" from file /etc/freeradius/mods-enabled/attr_filter
  attr_filter attr_filter.access_reject {
        filename = "/etc/freeradius/mods-config/attr_filter/access_reject"
        key = "%{User-Name}"
        relaxed = no
  }
  # Loading module "attr_filter.access_challenge" from file /etc/freeradius/mods-enabled/attr_filter
  attr_filter attr_filter.access_challenge {
        filename = "/etc/freeradius/mods-config/attr_filter/access_challenge"
        key = "%{User-Name}"
        relaxed = no
  }
  # Loading module "attr_filter.accounting_response" from file /etc/freeradius/mods-enabled/attr_filter
  attr_filter attr_filter.accounting_response {
        filename = "/etc/freeradius/mods-config/attr_filter/accounting_response"
        key = "%{User-Name}"
        relaxed = no
  }
  # Loaded module rlm_cache
  # Loading module "cache_eap" from file /etc/freeradius/mods-enabled/cache_eap
  cache cache_eap {
        driver = "rlm_cache_rbtree"
        key = "%{%{control:State}:-%{%{reply:State}:-%{State}}}"
        ttl = 15
        max_entries = 0
        epoch = 0
        add_stats = no
  }
  # Loaded module rlm_chap
  # Loading module "chap" from file /etc/freeradius/mods-enabled/chap
  # Loaded module rlm_date
  # Loading module "date" from file /etc/freeradius/mods-enabled/date
  date {
        format = "%b %e %Y %H:%M:%S %Z"
        utc = no
  }
  # Loading module "wispr2date" from file /etc/freeradius/mods-enabled/date
  date wispr2date {
        format = "%Y-%m-%dT%H:%M:%S"
        utc = no
  }
  # Loaded module rlm_detail
  # Loading module "detail" from file /etc/freeradius/mods-enabled/detail
  detail {
        filename = "/var/log/freeradius/radacct/%{%{Packet-Src-IP-Address}:-%{Packet-Src-IPv6-Address}}/detail-%Y%m%d"
        header = "%t"
        permissions = 384
        locking = no
        escape_filenames = no
        log_packet_header = no
  }
  # Loading module "auth_log" from file /etc/freeradius/mods-enabled/detail.log
  detail auth_log {
        filename = "/var/log/freeradius/radacct/%{%{Packet-Src-IP-Address}:-%{Packet-Src-IPv6-Address}}/auth-detail-%Y%m%d"
        header = "%t"
        permissions = 384
        locking = no
        escape_filenames = no
        log_packet_header = no
  }
  # Loading module "reply_log" from file /etc/freeradius/mods-enabled/detail.log
  detail reply_log {
        filename = "/var/log/freeradius/radacct/%{%{Packet-Src-IP-Address}:-%{Packet-Src-IPv6-Address}}/reply-detail-%Y%m%d"
        header = "%t"
        permissions = 384
        locking = no
        escape_filenames = no
        log_packet_header = no
  }
  # Loading module "pre_proxy_log" from file /etc/freeradius/mods-enabled/detail.log
  detail pre_proxy_log {
        filename = "/var/log/freeradius/radacct/%{%{Packet-Src-IP-Address}:-%{Packet-Src-IPv6-Address}}/pre-proxy-detail-%Y%m%d"
        header = "%t"
        permissions = 384
        locking = no
        escape_filenames = no
        log_packet_header = no
  }
  # Loading module "post_proxy_log" from file /etc/freeradius/mods-enabled/detail.log
  detail post_proxy_log {
        filename = "/var/log/freeradius/radacct/%{%{Packet-Src-IP-Address}:-%{Packet-Src-IPv6-Address}}/post-proxy-detail-%Y%m%d"
        header = "%t"
        permissions = 384
        locking = no
        escape_filenames = no
        log_packet_header = no
  }
  # Loaded module rlm_digest
  # Loading module "digest" from file /etc/freeradius/mods-enabled/digest
  # Loaded module rlm_dynamic_clients
  # Loading module "dynamic_clients" from file /etc/freeradius/mods-enabled/dynamic_clients
  # Loaded module rlm_eap
  # Loading module "eap" from file /etc/freeradius/mods-enabled/eap
  eap {
        default_eap_type = "tls"
        timer_expire = 60
        ignore_unknown_eap_types = no
        cisco_accounting_username_bug = no
        max_sessions = 16384
  }
  # Loaded module rlm_exec
  # Loading module "echo" from file /etc/freeradius/mods-enabled/echo
  exec echo {
        wait = yes
        program = "/bin/echo %{User-Name}"
        input_pairs = "request"
        output_pairs = "reply"
        shell_escape = yes
  }
  # Loading module "exec" from file /etc/freeradius/mods-enabled/exec
  exec {
        wait = no
        input_pairs = "request"
        shell_escape = yes
        timeout = 10
  }
  # Loaded module rlm_expiration
  # Loading module "expiration" from file /etc/freeradius/mods-enabled/expiration
  # Loaded module rlm_expr
  # Loading module "expr" from file /etc/freeradius/mods-enabled/expr
  expr {
        safe_characters = "@abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ0123456789.-_: /äéöüàâæçèéêëîïôœùûüaÿÄÉÖÜßÀÂÆÇÈÉÊËÎÏÔŒÙÛÜŸ"
  }
  # Loaded module rlm_files
  # Loading module "files" from file /etc/freeradius/mods-enabled/files
  files {
        filename = "/etc/freeradius/mods-config/files/authorize"
        acctusersfile = "/etc/freeradius/mods-config/files/accounting"
        preproxy_usersfile = "/etc/freeradius/mods-config/files/pre-proxy"
  }
  # Loaded module rlm_linelog
  # Loading module "linelog" from file /etc/freeradius/mods-enabled/linelog
  linelog {
        filename = "/var/log/freeradius/linelog"
        escape_filenames = no
        syslog_severity = "info"
        permissions = 384
        format = "This is a log message for %{User-Name}"
        reference = "messages.%{%{reply:Packet-Type}:-default}"
  }
  # Loading module "log_accounting" from file /etc/freeradius/mods-enabled/linelog
  linelog log_accounting {
        filename = "/var/log/freeradius/linelog-accounting"
        escape_filenames = no
        syslog_severity = "info"
        permissions = 384
        format = ""
        reference = "Accounting-Request.%{%{Acct-Status-Type}:-unknown}"
  }
  # Loaded module rlm_logintime
  # Loading module "logintime" from file /etc/freeradius/mods-enabled/logintime
  logintime {
        minimum_timeout = 60
  }
  # Loaded module rlm_mschap
  # Loading module "mschap" from file /etc/freeradius/mods-enabled/mschap
  mschap {
        use_mppe = yes
        require_encryption = no
        require_strong = no
        with_ntdomain_hack = yes
        ntlm_auth = "/usr/bin/ntlm_auth --request-nt-key --username=%{%{Stripped-User-Name}:-%{%{User-Name}:-None}} --challenge=%{%{mschap:Challenge}:-00} --nt-response=%{%{mschap:NT-Response}:-00}"
   passchange {
   }
        allow_retry = yes
        winbind_retry_with_normalised_username = no
  }
  # Loading module "ntlm_auth" from file /etc/freeradius/mods-enabled/ntlm_auth
  exec ntlm_auth {
        wait = yes
        program = "/path/to/ntlm_auth --request-nt-key --domain=MYDOMAIN --username=%{mschap:User-Name} --password=%{User-Password}"
        shell_escape = yes
  }
  # Loaded module rlm_pap
  # Loading module "pap" from file /etc/freeradius/mods-enabled/pap
  pap {
        normalise = yes
  }
  # Loaded module rlm_passwd
  # Loading module "etc_passwd" from file /etc/freeradius/mods-enabled/passwd
  passwd etc_passwd {
        filename = "/etc/passwd"
        format = "*User-Name:Crypt-Password:"
        delimiter = ":"
        ignore_nislike = no
        ignore_empty = yes
        allow_multiple_keys = no
        hash_size = 100
  }
  # Loaded module rlm_preprocess
  # Loading module "preprocess" from file /etc/freeradius/mods-enabled/preprocess
  preprocess {
        huntgroups = "/etc/freeradius/mods-config/preprocess/huntgroups"
        hints = "/etc/freeradius/mods-config/preprocess/hints"
        with_ascend_hack = no
        ascend_channels_per_line = 23
        with_ntdomain_hack = no
        with_specialix_jetstream_hack = no
        with_cisco_vsa_hack = no
        with_alvarion_vsa_hack = no
  }
  # Loaded module rlm_radutmp
  # Loading module "radutmp" from file /etc/freeradius/mods-enabled/radutmp
  radutmp {
        filename = "/var/log/freeradius/radutmp"
        username = "%{User-Name}"
        case_sensitive = yes
        check_with_nas = yes
        permissions = 384
        caller_id = yes
  }
  # Loaded module rlm_realm
  # Loading module "IPASS" from file /etc/freeradius/mods-enabled/realm
  realm IPASS {
        format = "prefix"
        delimiter = "/"
        ignore_default = no
        ignore_null = no
  }
  # Loading module "suffix" from file /etc/freeradius/mods-enabled/realm
  realm suffix {
        format = "suffix"
        delimiter = "@"
        ignore_default = no
        ignore_null = no
  }
  # Loading module "bangpath" from file /etc/freeradius/mods-enabled/realm
  realm bangpath {
        format = "prefix"
        delimiter = "!"
        ignore_default = no
        ignore_null = no
  }
  # Loading module "realmpercent" from file /etc/freeradius/mods-enabled/realm
  realm realmpercent {
        format = "suffix"
        delimiter = "%"
        ignore_default = no
        ignore_null = no
  }
  # Loading module "ntdomain" from file /etc/freeradius/mods-enabled/realm
  realm ntdomain {
        format = "prefix"
        delimiter = "\\"
        ignore_default = no
        ignore_null = no
  }
  # Loaded module rlm_replicate
  # Loading module "replicate" from file /etc/freeradius/mods-enabled/replicate
  # Loaded module rlm_soh
  # Loading module "soh" from file /etc/freeradius/mods-enabled/soh
  soh {
        dhcp = yes
  }
  # Loading module "sradutmp" from file /etc/freeradius/mods-enabled/sradutmp
  radutmp sradutmp {
        filename = "/var/log/freeradius/sradutmp"
        username = "%{User-Name}"
        case_sensitive = yes
        check_with_nas = yes
        permissions = 420
        caller_id = no
  }
  # Loaded module rlm_unix
  # Loading module "unix" from file /etc/freeradius/mods-enabled/unix
  unix {
        radwtmp = "/var/log/freeradius/radwtmp"
  }
Creating attribute Unix-Group
  # Loaded module rlm_unpack
  # Loading module "unpack" from file /etc/freeradius/mods-enabled/unpack
  # Loaded module rlm_utf8
  # Loading module "utf8" from file /etc/freeradius/mods-enabled/utf8
  # Loaded module rlm_ldap
  # Loading module "ldap" from file /etc/freeradius/mods-enabled/ldap
  ldap {
        server = "ldaps://192.168.0.2"
        port = 636
        identity = "uid=binder,cn=users,cn=accounts,dc=companyx,dc=io"
        password = <<< secret >>>
   sasl {
   }
   user {
        scope = "sub"
        access_positive = yes
    sasl {
    }
   }
   group {
        filter = "(objectClass=posixGroup)"
        scope = "sub"
        name_attribute = "cn"
        membership_attribute = "memberOf"
        cacheable_name = no
        cacheable_dn = no
   }
   client {
        filter = "(objectClass=radiusClient)"
        scope = "sub"
        base_dn = "cn=users,cn=accounts,dc=companyx,dc=io"
   }
   profile {
   }
   options {
        ldap_debug = 1
        chase_referrals = yes
        rebind = yes
        net_timeout = 10
        res_timeout = 10
        srv_timelimit = 3
        idle = 60
        probes = 3
        interval = 3
   }
   tls {
        ca_file = "/etc/freeradius/certs/rootCA.crt"
        ca_path = "/etc/freeradius/certs/"
        certificate_file = "/etc/freeradius/certs/server.crt"
        private_key_file = "/etc/freeradius/certs/server.key"
        random_file = "/dev/urandom"
        start_tls = no
        require_cert = "allow"
   }
  }
Creating attribute LDAP-Group
  instantiate {
  }
  # Instantiating module "reject" from file /etc/freeradius/mods-enabled/always
  # Instantiating module "fail" from file /etc/freeradius/mods-enabled/always
  # Instantiating module "ok" from file /etc/freeradius/mods-enabled/always
  # Instantiating module "handled" from file /etc/freeradius/mods-enabled/always
  # Instantiating module "invalid" from file /etc/freeradius/mods-enabled/always
  # Instantiating module "userlock" from file /etc/freeradius/mods-enabled/always
  # Instantiating module "notfound" from file /etc/freeradius/mods-enabled/always
  # Instantiating module "noop" from file /etc/freeradius/mods-enabled/always
  # Instantiating module "updated" from file /etc/freeradius/mods-enabled/always
  # Instantiating module "attr_filter.post-proxy" from file /etc/freeradius/mods-enabled/attr_filter
reading pairlist file /etc/freeradius/mods-config/attr_filter/post-proxy
  # Instantiating module "attr_filter.pre-proxy" from file /etc/freeradius/mods-enabled/attr_filter
reading pairlist file /etc/freeradius/mods-config/attr_filter/pre-proxy
  # Instantiating module "attr_filter.access_reject" from file /etc/freeradius/mods-enabled/attr_filter
reading pairlist file /etc/freeradius/mods-config/attr_filter/access_reject
  # Instantiating module "attr_filter.access_challenge" from file /etc/freeradius/mods-enabled/attr_filter
reading pairlist file /etc/freeradius/mods-config/attr_filter/access_challenge
  # Instantiating module "attr_filter.accounting_response" from file /etc/freeradius/mods-enabled/attr_filter
reading pairlist file /etc/freeradius/mods-config/attr_filter/accounting_response
  # Instantiating module "cache_eap" from file /etc/freeradius/mods-enabled/cache_eap
rlm_cache (cache_eap): Driver rlm_cache_rbtree (module rlm_cache_rbtree) loaded and linked
  # Instantiating module "detail" from file /etc/freeradius/mods-enabled/detail
  # Instantiating module "auth_log" from file /etc/freeradius/mods-enabled/detail.log
rlm_detail (auth_log): 'User-Password' suppressed, will not appear in detail output
  # Instantiating module "reply_log" from file /etc/freeradius/mods-enabled/detail.log
  # Instantiating module "pre_proxy_log" from file /etc/freeradius/mods-enabled/detail.log
  # Instantiating module "post_proxy_log" from file /etc/freeradius/mods-enabled/detail.log
  # Instantiating module "eap" from file /etc/freeradius/mods-enabled/eap
   # Linked to sub-module rlm_eap_tls
   tls {
        tls = "tls-common"
   }
   tls-config tls-common {
        verify_depth = 0
        ca_path = "/etc/freeradius/certs"
        pem_file_type = yes
        private_key_file = "/etc/freeradius/certs/server.key"
        certificate_file = "/etc/freeradius/certs/server.crt"
        ca_file = "/etc/freeradius/certs/rootCA.crt"
        private_key_password = <<< secret >>>
        dh_file = "/etc/freeradius/certs/dh"
        fragment_size = 1024
        include_length = yes
        auto_chain = yes
        check_crl = no
        check_all_crl = no
        cipher_list = "HIGH"
        ecdh_curve = "prime256v1"
        tls_max_version = ""
        tls_min_version = "1.0"
    cache {
        enable = no
        lifetime = 24
        max_entries = 255
    }
    verify {
        skip_if_ocsp_ok = no
    }
    ocsp {
        enable = no
        override_cert_url = no
        use_nonce = yes
        timeout = 0
        softfail = no
    }
   }
   # Linked to sub-module rlm_eap_peap
   peap {
        tls = "tls-common"
        default_eap_type = "mschapv2"
        copy_request_to_tunnel = no
        use_tunneled_reply = no
        proxy_tunneled_request_as_eap = yes
        virtual_server = "inner-tunnel"
        soh = no
        require_client_cert = no
   }
tls: Using cached TLS configuration from previous invocation
   # Linked to sub-module rlm_eap_mschapv2
   mschapv2 {
        with_ntdomain_hack = no
        send_error = no
   }
  # Instantiating module "expiration" from file /etc/freeradius/mods-enabled/expiration
  # Instantiating module "files" from file /etc/freeradius/mods-enabled/files
reading pairlist file /etc/freeradius/mods-config/files/authorize
reading pairlist file /etc/freeradius/mods-config/files/accounting
reading pairlist file /etc/freeradius/mods-config/files/pre-proxy
  # Instantiating module "linelog" from file /etc/freeradius/mods-enabled/linelog
  # Instantiating module "log_accounting" from file /etc/freeradius/mods-enabled/linelog
  # Instantiating module "logintime" from file /etc/freeradius/mods-enabled/logintime
  # Instantiating module "mschap" from file /etc/freeradius/mods-enabled/mschap
rlm_mschap (mschap): authenticating by calling 'ntlm_auth'
  # Instantiating module "pap" from file /etc/freeradius/mods-enabled/pap
  # Instantiating module "etc_passwd" from file /etc/freeradius/mods-enabled/passwd
rlm_passwd: nfields: 3 keyfield 0(User-Name) listable: no
  # Instantiating module "preprocess" from file /etc/freeradius/mods-enabled/preprocess
reading pairlist file /etc/freeradius/mods-config/preprocess/huntgroups
reading pairlist file /etc/freeradius/mods-config/preprocess/hints
  # Instantiating module "IPASS" from file /etc/freeradius/mods-enabled/realm
  # Instantiating module "suffix" from file /etc/freeradius/mods-enabled/realm
  # Instantiating module "bangpath" from file /etc/freeradius/mods-enabled/realm
  # Instantiating module "realmpercent" from file /etc/freeradius/mods-enabled/realm
  # Instantiating module "ntdomain" from file /etc/freeradius/mods-enabled/realm
  # Instantiating module "ldap" from file /etc/freeradius/mods-enabled/ldap
rlm_ldap: libldap vendor: OpenLDAP, version: 20445
   accounting {
        reference = "%{tolower:type.%{Acct-Status-Type}}"
   }
   post-auth {
        reference = "."
   }
rlm_ldap (ldap): Initialising connection pool
   pool {
        start = 4
        min = 1
        max = 30
        spare = 0
        uses = 0
        lifetime = 0
        cleanup_interval = 30
        idle_timeout = 60
        retry_delay = 30
        spread = no
   }
rlm_ldap (ldap): Opening additional connection (0), 1 of 30 pending slots used
rlm_ldap (ldap): Connecting to ldaps://192.168.0.2:636
ldap_create
ldap_url_parse_ext(ldaps://192.168.0.2:636)
TLS: warning: cacertdir not implemented for gnutls
ldap_bind
ldap_simple_bind
ldap_sasl_bind
ldap_send_initial_request
ldap_new_connection 1 1 0
ldap_int_open_connection
ldap_connect_to_host: TCP 192.168.0.2:636
ldap_new_socket: 3
ldap_prepare_socket: 3
ldap_connect_to_host: Trying 192.168.0.2:636
ldap_pvt_connect: fd: 3 tm: 10 async: 0
ldap_ndelay_on: 3
attempting to connect: 
connect errno: 115
ldap_int_poll: fd: 3 tm: 10
ldap_is_sock_ready: 3
ldap_ndelay_off: 3
ldap_pvt_connect: 0
TLS: peer cert untrusted or revoked (0x42)
ldap_open_defconn: successful
ldap_send_server_request
rlm_ldap (ldap): Waiting for bind result...
ldap_result ld 0x5621465809d0 msgid 1
wait4msg ld 0x5621465809d0 msgid 1 (timeout 10000000 usec)
wait4msg continue ld 0x5621465809d0 msgid 1 all 1
** ld 0x5621465809d0 Connections:
* host: 192.168.0.2  port: 636  (default)
  refcnt: 2  status: Connected
  last used: Fri May  3 05:41:44 2019

** ld 0x5621465809d0 Outstanding Requests:
 * msgid 1,  origid 1, status InProgress
   outstanding referrals 0, parent count 0
  ld 0x5621465809d0 request count 1 (abandoned 0)
** ld 0x5621465809d0 Response Queue:
   Empty
  ld 0x5621465809d0 response count 0
ldap_chkResponseList ld 0x5621465809d0 msgid 1 all 1
ldap_chkResponseList returns ld 0x5621465809d0 NULL
ldap_int_select
read1msg: ld 0x5621465809d0 msgid 1 all 1
read1msg: ld 0x5621465809d0 msgid 1 message type bind
read1msg: ld 0x5621465809d0 0 new referrals
read1msg:  mark request completed, ld 0x5621465809d0 msgid 1
request done: ld 0x5621465809d0 msgid 1
res_errno: 0, res_error: <>, res_matched: <>
ldap_free_request (origid 1, msgid 1)
ldap_parse_result
ldap_msgfree
ldap_create
ldap_url_parse_ext(ldaps://192.168.0.2:636)
TLS: warning: cacertdir not implemented for gnutls
rlm_ldap (ldap): Bind successful
rlm_ldap (ldap): Opening additional connection (1), 1 of 29 pending slots used
rlm_ldap (ldap): Connecting to ldaps://192.168.0.2:636
ldap_bind
ldap_simple_bind
ldap_sasl_bind
ldap_send_initial_request
ldap_new_connection 1 1 0
ldap_int_open_connection
ldap_connect_to_host: TCP 192.168.0.2:636
ldap_new_socket: 4
ldap_prepare_socket: 4
ldap_connect_to_host: Trying 192.168.0.2:636
ldap_pvt_connect: fd: 4 tm: 10 async: 0
ldap_ndelay_on: 4
attempting to connect: 
connect errno: 115
ldap_int_poll: fd: 4 tm: 10
ldap_is_sock_ready: 4
ldap_ndelay_off: 4
ldap_pvt_connect: 0
TLS: peer cert untrusted or revoked (0x42)
ldap_open_defconn: successful
ldap_send_server_request
rlm_ldap (ldap): Waiting for bind result...
ldap_result ld 0x5621465ade70 msgid 1
wait4msg ld 0x5621465ade70 msgid 1 (timeout 10000000 usec)
wait4msg continue ld 0x5621465ade70 msgid 1 all 1
** ld 0x5621465ade70 Connections:
* host: 192.168.0.2  port: 636  (default)
  refcnt: 2  status: Connected
  last used: Fri May  3 05:41:44 2019

** ld 0x5621465ade70 Outstanding Requests:
 * msgid 1,  origid 1, status InProgress
   outstanding referrals 0, parent count 0
  ld 0x5621465ade70 request count 1 (abandoned 0)
** ld 0x5621465ade70 Response Queue:
   Empty
  ld 0x5621465ade70 response count 0
ldap_chkResponseList ld 0x5621465ade70 msgid 1 all 1
ldap_chkResponseList returns ld 0x5621465ade70 NULL
ldap_int_select
read1msg: ld 0x5621465ade70 msgid 1 all 1
read1msg: ld 0x5621465ade70 msgid 1 message type bind
read1msg: ld 0x5621465ade70 0 new referrals
read1msg:  mark request completed, ld 0x5621465ade70 msgid 1
request done: ld 0x5621465ade70 msgid 1
res_errno: 0, res_error: <>, res_matched: <>
ldap_free_request (origid 1, msgid 1)
ldap_parse_result
ldap_msgfree
ldap_create
ldap_url_parse_ext(ldaps://192.168.0.2:636)
TLS: warning: cacertdir not implemented for gnutls
rlm_ldap (ldap): Bind successful
rlm_ldap (ldap): Opening additional connection (2), 1 of 28 pending slots used
rlm_ldap (ldap): Connecting to ldaps://192.168.0.2:636
ldap_bind
ldap_simple_bind
ldap_sasl_bind
ldap_send_initial_request
ldap_new_connection 1 1 0
ldap_int_open_connection
ldap_connect_to_host: TCP 192.168.0.2:636
ldap_new_socket: 5
ldap_prepare_socket: 5
ldap_connect_to_host: Trying 192.168.0.2:636
ldap_pvt_connect: fd: 5 tm: 10 async: 0
ldap_ndelay_on: 5
attempting to connect: 
connect errno: 115
ldap_int_poll: fd: 5 tm: 10
ldap_is_sock_ready: 5
ldap_ndelay_off: 5
ldap_pvt_connect: 0
TLS: peer cert untrusted or revoked (0x42)
ldap_open_defconn: successful
ldap_send_server_request
ldap_result ld 0x5621465d0550 msgid 1
wait4msg ld 0x5621465d0550 msgid 1 (timeout 10000000 usec)
wait4msg continue ld 0x5621465d0550 msgid 1 all 1
** ld 0x5621465d0550 Connections:
* host: 192.168.0.2  port: 636  (default)
  refcnt: 2  status: Connected
  last used: Fri May  3 05:41:44 2019

** ld 0x5621465d0550 Outstanding Requests:
 * msgid 1,  origid 1, status InProgress
   outstanding referrals 0, parent count 0
  ld 0x5621465d0550 request count 1 (abandoned 0)
** ld 0x5621465d0550 Response Queue:
   Empty
  ld 0x5621465d0550 response count 0
ldap_chkResponseList ld 0x5621465d0550 msgid 1 all 1
ldap_chkResponseList returns ld 0x5621465d0550 NULL
ldap_int_select
rlm_ldap (ldap): Waiting for bind result...
read1msg: ld 0x5621465d0550 msgid 1 all 1
read1msg: ld 0x5621465d0550 msgid 1 message type bind
read1msg: ld 0x5621465d0550 0 new referrals
read1msg:  mark request completed, ld 0x5621465d0550 msgid 1
request done: ld 0x5621465d0550 msgid 1
res_errno: 0, res_error: <>, res_matched: <>
ldap_free_request (origid 1, msgid 1)
ldap_parse_result
ldap_msgfree
ldap_create
ldap_url_parse_ext(ldaps://192.168.0.2:636)
TLS: warning: cacertdir not implemented for gnutls
rlm_ldap (ldap): Bind successful
rlm_ldap (ldap): Opening additional connection (3), 1 of 27 pending slots used
rlm_ldap (ldap): Connecting to ldaps://192.168.0.2:636
ldap_bind
ldap_simple_bind
ldap_sasl_bind
ldap_send_initial_request
ldap_new_connection 1 1 0
ldap_int_open_connection
ldap_connect_to_host: TCP 192.168.0.2:636
ldap_new_socket: 6
ldap_prepare_socket: 6
ldap_connect_to_host: Trying 192.168.0.2:636
ldap_pvt_connect: fd: 6 tm: 10 async: 0
ldap_ndelay_on: 6
attempting to connect: 
connect errno: 115
ldap_int_poll: fd: 6 tm: 10
ldap_is_sock_ready: 6
ldap_ndelay_off: 6
ldap_pvt_connect: 0
TLS: peer cert untrusted or revoked (0x42)
ldap_open_defconn: successful
ldap_send_server_request
ldap_result ld 0x5621465ee850 msgid 1
wait4msg ld 0x5621465ee850 msgid 1 (timeout 10000000 usec)
wait4msg continue ld 0x5621465ee850 msgid 1 all 1
** ld 0x5621465ee850 Connections:
* host: 192.168.0.2  port: 636  (default)
  refcnt: 2  status: Connected
  last used: Fri May  3 05:41:44 2019

** ld 0x5621465ee850 Outstanding Requests:
 * msgid 1,  origid 1, status InProgress
   outstanding referrals 0, parent count 0
  ld 0x5621465ee850 request count 1 (abandoned 0)
** ld 0x5621465ee850 Response Queue:
   Empty
  ld 0x5621465ee850 response count 0
ldap_chkResponseList ld 0x5621465ee850 msgid 1 all 1
ldap_chkResponseList returns ld 0x5621465ee850 NULL
ldap_int_select
rlm_ldap (ldap): Waiting for bind result...
rlm_ldap (ldap): Bind successful
 } # modules
radiusd: #### Loading Virtual Servers ####
server { # from file /etc/freeradius/radiusd.conf
} # server
server default { # from file /etc/freeradius/sites-enabled/default
read1msg: ld 0x5621465ee850 msgid 1 all 1
read1msg: ld 0x5621465ee850 msgid 1 message type bind
read1msg: ld 0x5621465ee850 0 new referrals
read1msg:  mark request completed, ld 0x5621465ee850 msgid 1
request done: ld 0x5621465ee850 msgid 1
res_errno: 0, res_error: <>, res_matched: <>
ldap_free_request (origid 1, msgid 1)
ldap_parse_result
ldap_msgfree
 # Loading authenticate {...}
 # Loading authorize {...}
Ignoring "sql" (see raddb/mods-available/README.rst)
 # Loading preacct {...}
 # Loading accounting {...}
 # Loading post-proxy {...}
 # Loading post-auth {...}
} # server default
server inner-tunnel { # from file /etc/freeradius/sites-enabled/inner-tunnel
 # Loading authenticate {...}
 # Loading authorize {...}
 # Loading session {...}
 # Loading post-proxy {...}
 # Loading post-auth {...}
 # Skipping contents of 'if' as it is always 'false' -- /etc/freeradius/sites-enabled/inner-tunnel:336
} # server inner-tunnel
radiusd: #### Opening IP addresses and Ports ####
listen {
        type = "auth"
        ipaddr = *
        port = 0
   limit {
        max_connections = 16
        lifetime = 0
        idle_timeout = 30
   }
}
listen {
        type = "acct"
        ipaddr = *
        port = 0
   limit {
        max_connections = 16
        lifetime = 0
        idle_timeout = 30
   }
}
listen {
        type = "auth"
        ipv6addr = ::
        port = 0
   limit {
        max_connections = 16
        lifetime = 0
        idle_timeout = 30
   }
}
listen {
        type = "acct"
        ipv6addr = ::
        port = 0
   limit {
        max_connections = 16
        lifetime = 0
        idle_timeout = 30
   }
}
listen {
        type = "auth"
        ipaddr = 127.0.0.1
        port = 18120
}
Listening on auth address * port 1812 bound to server default
Listening on acct address * port 1813 bound to server default
Listening on auth address :: port 1812 bound to server default
Listening on acct address :: port 1813 bound to server default
Listening on auth address 127.0.0.1 port 18120 bound to server inner-tunnel
Listening on proxy address * port 42242
Listening on proxy address :: port 55528
Ready to process requests
(0) Received Access-Request Id 25 from 1.1.1.1:2997 to 192.168.0.3:1812 length 88
(0)   NAS-Identifier = "Firewall"
(0)   User-Name = "user"
(0)   User-Password = "Password123"
(0) # Executing section authorize from file /etc/freeradius/sites-enabled/default
(0)   authorize {
(0)     policy filter_username {
(0)       if (&User-Name) {
(0)       if (&User-Name)  -> TRUE
(0)       if (&User-Name)  {
(0)         if (&User-Name =~ / /) {
(0)         if (&User-Name =~ / /)  -> FALSE
(0)         if (&User-Name =~ /@[^@]*@/ ) {
(0)         if (&User-Name =~ /@[^@]*@/ )  -> FALSE
(0)         if (&User-Name =~ /\.\./ ) {
(0)         if (&User-Name =~ /\.\./ )  -> FALSE
(0)         if ((&User-Name =~ /@/) && (&User-Name !~ /@(.+)\.(.+)$/))  {
(0)         if ((&User-Name =~ /@/) && (&User-Name !~ /@(.+)\.(.+)$/))   -> FALSE
(0)         if (&User-Name =~ /\.$/)  {
(0)         if (&User-Name =~ /\.$/)   -> FALSE
(0)         if (&User-Name =~ /@\./)  {
(0)         if (&User-Name =~ /@\./)   -> FALSE
(0)       } # if (&User-Name)  = notfound
(0)     } # policy filter_username = notfound
(0)     [preprocess] = ok
(0)     [chap] = noop
(0)     [mschap] = noop
(0)     [digest] = noop
(0) suffix: Checking for suffix after "@"
(0) suffix: No '@' in User-Name = "user", looking up realm NULL
(0) suffix: No such realm "NULL"
(0)     [suffix] = noop
(0) eap: No EAP-Message, not doing EAP
(0)     [eap] = noop
(0)     [files] = noop
rlm_ldap (ldap): Reserved connection (0)
(0) ldap: EXPAND (uid=%{%{Stripped-User-Name}:-%{User-Name}})
(0) ldap:    --> (uid=user)
(0) ldap: Performing search in "cn=users,cn=accounts,dc=companyx,dc=io" with filter "(uid=user)", scope "sub"
ldap_search_ext
put_filter: "(uid=user)"
put_filter: simple
put_simple_filter: "uid=user"
ldap_send_initial_request
ldap_send_server_request
(0) ldap: Waiting for search result...
ldap_result ld 0x5621465809d0 msgid 2
wait4msg ld 0x5621465809d0 msgid 2 (timeout 10000000 usec)
wait4msg continue ld 0x5621465809d0 msgid 2 all 1
** ld 0x5621465809d0 Connections:
* host: 192.168.0.2  port: 636  (default)
  refcnt: 2  status: Connected
  last used: Fri May  3 05:42:18 2019

** ld 0x5621465809d0 Outstanding Requests:
 * msgid 2,  origid 2, status InProgress
   outstanding referrals 0, parent count 0
  ld 0x5621465809d0 request count 1 (abandoned 0)
** ld 0x5621465809d0 Response Queue:
   Empty
  ld 0x5621465809d0 response count 0
ldap_chkResponseList ld 0x5621465809d0 msgid 2 all 1
ldap_chkResponseList returns ld 0x5621465809d0 NULL
ldap_int_select
read1msg: ld 0x5621465809d0 msgid 2 all 1
read1msg: ld 0x5621465809d0 msgid 2 message type search-entry
wait4msg ld 0x5621465809d0 9 s 998961 us to go
wait4msg continue ld 0x5621465809d0 msgid 2 all 1
** ld 0x5621465809d0 Connections:
* host: 192.168.0.2  port: 636  (default)
  refcnt: 2  status: Connected
  last used: Fri May  3 05:42:18 2019

** ld 0x5621465809d0 Outstanding Requests:
 * msgid 2,  origid 2, status InProgress
   outstanding referrals 0, parent count 0
  ld 0x5621465809d0 request count 1 (abandoned 0)
** ld 0x5621465809d0 Response Queue:
 * msgid 2,  type 100
  ld 0x5621465809d0 response count 1
ldap_chkResponseList ld 0x5621465809d0 msgid 2 all 1
ldap_chkResponseList returns ld 0x5621465809d0 NULL
ldap_int_select
read1msg: ld 0x5621465809d0 msgid 2 all 1
read1msg: ld 0x5621465809d0 msgid 2 message type search-result
read1msg: ld 0x5621465809d0 0 new referrals
read1msg:  mark request completed, ld 0x5621465809d0 msgid 2
request done: ld 0x5621465809d0 msgid 2
res_errno: 0, res_error: <>, res_matched: <>
ldap_free_request (origid 2, msgid 2)
adding response ld 0x5621465809d0 msgid 2 type 101:
ldap_parse_result
ldap_get_dn
(0) ldap: User object found at DN "uid=user,cn=users,cn=accounts,dc=companyx,dc=io"
(0) ldap: Processing user attributes
ldap_get_values_len
(0) ldap: &control:Password-With-Header += '{PBKDF2_SHA256}AAAIAElQ9+kOExv12HALK9/ta+VKE79Jz9Eky+Ta0/FJZlHaAnuQm8V8ClGhX5scnZOOBriMTPAS3wnhNbKbqsybfSArRl7cFnJMeFXKhqB7aZYtk0uEWthtja+u0ZPBUvQwPrWtr2mgF6MWU5pW2qdd0VW7EJeY3bm4uaoPxFOXM5zOBNAFGgO2nYLN75I6/Wh1IESMeWp5eJ2+tNDafOwTAGOXggViGAufjkOyLYw9eS+9MkafntEHYStlUUSi16YCO+s/hvNzp9VpF0sFDDaaL7mlhevls+jG1y9FLvCSsgOHm4Frn6iACsenHwD5xaBm5nqNCXS9BIg/qCq8lxnMbOqCx7gfAGHQ84yS8MXsNbS79dXFYt2QDNFDX7M9vdKgcQumcniwlBunIbL/kB85yv7AkmjPcQ68eiEltzD9HWlJ'
ldap_get_values_len
ldap_get_values_len
ldap_get_values_len
ldap_msgfree
rlm_ldap (ldap): Released connection (0)
rlm_ldap (ldap): Closing connection (1), from 3 unused connections
ldap_free_connection 1 1
ldap_send_unbind
ldap_free_connection: actually freed
(0)     [ldap] = updated
(0)     [expiration] = noop
(0)     [logintime] = noop
(0) pap: Unknown header {{PBKDF2_SHA256}} in Password-With-Header, re-writing to Cleartext-Password
(0) pap: Removing &control:Password-With-Header
(0)     [pap] = updated
(0)   } # authorize = updated
(0) Found Auth-Type = PAP
(0) # Executing group from file /etc/freeradius/sites-enabled/default
(0)   Auth-Type PAP {
(0) pap: Login attempt with password
(0) pap: Comparing with "known good" Cleartext-Password
(0) pap: ERROR: Cleartext password does not match "known good" password
(0) pap: Passwords don't match
(0)     [pap] = reject
(0)   } # Auth-Type PAP = reject
(0) Failed to authenticate the user
(0) Using Post-Auth-Type Reject
(0) # Executing group from file /etc/freeradius/sites-enabled/default
(0)   Post-Auth-Type REJECT {
(0) attr_filter.access_reject: EXPAND %{User-Name}
(0) attr_filter.access_reject:    --> user
(0) attr_filter.access_reject: Matched entry DEFAULT at line 11
(0)     [attr_filter.access_reject] = updated
(0)     [eap] = noop
(0)     policy remove_reply_message_if_eap {
(0)       if (&reply:EAP-Message && &reply:Reply-Message) {
(0)       if (&reply:EAP-Message && &reply:Reply-Message)  -> FALSE
(0)       else {
(0)         [noop] = noop
(0)       } # else = noop
(0)     } # policy remove_reply_message_if_eap = noop
(0)   } # Post-Auth-Type REJECT = updated
(0) Delaying response for 1.000000 seconds
Waking up in 0.3 seconds.
Waking up in 0.6 seconds.
(0) Sending delayed response
(0) Sent Access-Reject Id 25 from 192.168.0.3:1812 to 1.1.1.1:2997 length 20
Waking up in 3.9 seconds.
(0) Cleaning up request packet ID 25 with timestamp +33
Ready to process requests

Full backtrace from LLDB or GDB

Unsure how to do this one

mschap.log pap.log chap.log eap.log ldap.log default.log inner-tunnel.log radconf.log

alandekok commented 5 years ago

Nothing in the documentation says we support PBKDF2_SHA256.

As always, patches are welcome.

arr2036 commented 5 years ago

We do actually have full support for this but only in master branch.

arr2036 commented 5 years ago

Supported formats are:

    /*
     *  If it doesn't begin with a $ assume
     *  It's Crypt::PBKDF2 LDAP format
     *
     *  {X-PBKDF2}<digest>:<b64 rounds>:<b64_salt>:<b64_hash>
     */

    /*
     *  Crypt::PBKDF2 Crypt format
     *
     *  $PBKDF2$<digest>:<rounds>:<b64_salt>$<b64_hash>
     */

    /*
     *  Python's passlib format
     *
     *  $pbkdf2-<digest>$<rounds>$<alt_b64_salt>$<alt_b64_hash>
     *
     *  Note: Our base64 functions also work with alt_b64
     */
arr2036 commented 5 years ago

If you can provide some documentation for your LDAP based format I'd be happy to add something to parse it

w4r10-b0b commented 5 years ago

Hi,

It appears to be using the following method from the latest Password Vault from FreeIPA: https://www.freeipa.org/page/V4/Password_Vault_2.0

Which is:

DK = PBKDF2(PRF, Password, Salt, c, dkLen) where:

PRF is a pseudorandom function of two parameters with output length hLen (e.g., a keyed HMAC) Password is the master password from which a derived key is generated Salt is a sequence of bits, known as a cryptographic salt c is the number of iterations desired dkLen is the desired bit-length of the derived key DK is the generated derived key

The site has documentation on how to do in C.

arr2036 commented 5 years ago

That site has no information on how to turn {PBKDF2_SHA256}AAAIAElQ9+kOExv12HALK9/ta+VKE79Jz9Eky+Ta0/FJZlHaAnuQm8V8ClGhX5scnZOOBriMTPAS3wnhNbKbqsybfSArRl7cFnJMeFXKhqB7aZYtk0uEWthtja+u0ZPBUvQwPrWtr2mgF6MWU5pW2qdd0VW7EJeY3bm4uaoPxFOXM5zOBNAFGgO2nYLN75I6/Wh1IESMeWp5eJ2+tNDafOwTAGOXggViGAufjkOyLYw9eS+9MkafntEHYStlUUSi16YCO+s/hvNzp9VpF0sFDDaaL7mlhevls+jG1y9FLvCSsgOHm4Frn6iACsenHwD5xaBm5nqNCXS9BIg/qCq8lxnMbOqCx7gfAGHQ84yS8MXsNbS79dXFYt2QDNFDX7M9vdKgcQumcniwlBunIbL/kB85yv7AkmjPcQ68eiEltzD9HWlJ into parameters for the PBKDF2 function, which was what I was asking for.

arr2036 commented 5 years ago

Closing due to lack of response.

cipherboy commented 5 years ago

Sorry, just saw this issue. If you're still interested in adding support...

Password Vault isn't where this is coming from. This is actually coming from 389ds's password hashing function. The contents above are the base64 encoded form of the following structure:

See the pbkdf2_sha256_pw_enc_rounds function in the 389ds source.

In the above example (converted to hex for ease):

(Thanks @tiran for your help figuring out that this wasn't Vault's problem and pointing me to 389ds).

arr2036 commented 5 years ago

Perfect, thanks for the info.

arr2036 commented 5 years ago

Looked into this more. Probably should split PBKDF2 string into components in authorize and feed that through to authenticate.

mekatum commented 4 years ago

Hi all! FreeIPA use PBKDF2_SHA256 hashes for passwords. Is there way to use FreeRADIUS with FreeIPA? How I can tune FreeRADIUS for use PBKDF2_SHA256? Now I use FreeRADIUS 3.0.17 on centos 8 and I got this error

pap: Unknown header {{PBKDF2_SHA256}} in Password-With-Header = "{PBKDF2_SHA256} <HASH_HERE>", re-writing to Cleartext-Password
Mon Jun 29 17:37:27 2020 : Debug: (0) pap: Removing &control:Password-With-Header
alandekok commented 4 years ago

FreeIPA use PBKDF2_SHA256 hashes for passwords. Is there way to use FreeRADIUS with FreeIPA? How I can tune FreeRADIUS for use PBKDF2_SHA256? Now I use FreeRADIUS 3.0.17 on centos 8 and I got this error

v3 does not (yet) support PBKDF2_SHA256. However, that functionality is in the "master" branch.

It can probably be back-ported at some point.

k-s-dean commented 4 years ago

Hi, When will this be back ported ? its been a year, and I am now just running into this issue.

Alternatively are there any workarounds ?

alandekok commented 4 years ago

When will this be back ported ? its been a year, and I am now just running into this issue.

We're happy to accept patches.

Until then, it's on our list of things to do.

k-s-dean commented 4 years ago

Thanks for the response. Id love to support the project and apply a patch but unfortunately I don't know C.

In the meantime i'm looking for a work around. You mentioned above that the Docs don't mention support for PBKDF2_SHA256.

FreeIPA supports the following hashes. CLEAR, CRYPT, CRYPT-MD5, CRYPT-SHA256, CRYPT-SHA512, MD5, PBKDF2_SHA256, SHA, SHA256, SHA384, SHA512, SMD5, SSHA, SSHA256, SSHA384, SSHA512

I don't mind downgrading the hashing algorithm FreeIPA uses to store passwords until support for this has been implemented if required but I'd prefer not to.

At the moment from what I've read from various places, im leaning towards a configuration error on my end as i'm currently upgrading from an older version of FreeRadius and integrating it with the latest release of FreeIPA.

I'll check on Monday when I'm fresh and back in the office.

Would it be better to move and further questions to the mailing list ?

Cheers

jpereira commented 4 years ago

Hi @k-s-dean,

We appreciate if you can perform your tests against the branch https://github.com/jpereira/freeradius-server/tree/v3/pbkfd2 mentioned in https://github.com/FreeRADIUS/freeradius-server/pull/3660

Thanks for the response. Id love to support the project and apply a patch but unfortunately I don't know C.

In the meantime i'm looking for a work around. You mentioned above that the Docs don't mention support for PBKDF2_SHA256.

FreeIPA supports the following hashes. CLEAR, CRYPT, CRYPT-MD5, CRYPT-SHA256, CRYPT-SHA512, MD5, PBKDF2_SHA256, SHA, SHA256, SHA384, SHA512, SMD5, SSHA, SSHA256, SSHA384, SSHA512

I don't mind downgrading the hashing algorithm FreeIPA uses to store passwords until support for this has been implemented if required but I'd prefer not to.

At the moment from what I've read from various places, im leaning towards a configuration error on my end as i'm currently upgrading from an older version of FreeRadius and integrating it with the latest release of FreeIPA.

I'll check on Monday when I'm fresh and back in the office.

Would it be better to move and further questions to the mailing list ?

Cheers

k-s-dean commented 4 years ago

@jpereira

I'll get on that ASAP.

Cheers

jpereira commented 4 years ago

btw, @k-s-dean the support was merged into the v3.0.x branch. Please, if you don't mind perform your tests against branch v3.0.x https://github.com/FreeRADIUS/freeradius-server/archive/v3.0.x.zip

flymia commented 3 years ago

@jpereira Hi there,

how is the latest status on this? Is it implemented in the latest Github release version (3.0.21)?

We are also using FreeIPA as LDAP and we need to authenticate users against "PBKDF2_SHA256". The Debian package (version: 3.0.17+dfsg-1.1) does not support this.

If it is supported by 3.0.21 I'd compile a newer version myself.

Cheers

k-s-dean commented 3 years ago

@flymia you can grab the 3.0.21 docker image and use that. I don't think the support for it is in that version as that is what I'm running, but someone else might be able to give you an exact answer.

I never got round to testing this due to other commitments, but my time has now been freed up so I'll hopefully be able to test this very soon.

alandekok commented 3 years ago

Jorge's comment was September 2020. 3.0.21 was released months earlier, in March 2020. The resulting math should be straightforward.

stertingen commented 3 years ago

According to http://lists.freeradius.org/pipermail/freeradius-users/2021-April/099715.html, PBKDF2_SHA256 is still not supported as of version 3.0.23.

As precisely this password hash function is interesting for FreeIPA integration (and the title of this issue specifies PBKDF2_SHA256), I would propose to re-open this issue.

alandekok commented 3 years ago

@stertingen We're happy to take patches. Until then, there are unfortunately higher priority items.

B5JohnSheridan commented 1 week ago

I just stumbled across this rather old ticket and while some PBKDF2 for HMAC SHA2/SHA3 has been added, the IPA default of PBKDF2_SHA512 (and ..._SHA256 etc.) is still not supported. We are also using IPA/389 directory server and have a user database with this method and tried to use it has a backend for WPA2 Enterprise, but as it seems it would require adding another PW with a different hash.

Any chance that those get added?

alandekok commented 1 week ago

@B5JohnSheridan Patches are always welcome. It's likely <100 lines of code.