Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Issue with {PBKDF2_SHA256} in password header #2649

Open
cyb3rc0d3 opened this issue May 3, 2019 · 9 comments

Comments

Projects
None yet
4 participants
@cyb3rc0d3
Copy link

commented May 3, 2019

Issue type

  • Questions about the server or its usage MUST be posted to the users mailing list. If you post those issues here, they will be closed and locked. Repeat offenders will be BANNED.
  • Remote security exploits MUST be sent to security@freeradius.org.

REMOVE THOSE WHICH DO NOT APPLY

  • Defect - Crash or memory corruption.
  • Defect - Non compliance with a standards document, or incorrect API usage.
  • Defect - Unexpected behaviour (obvious or verified by project member).

See here for debugging instructions and how to obtain backtraces.

Defect

How to reproduce the issue

When attempting to authenticate to the FreeIPA server which uses encrypted password. Still uses PAP and does not recognise the encryption type header used.

Output of [radiusd|freeradius] -X showing issue occurring

(you may need to run [radiusd|freeradius] -fxx -l stdout if using eg RADIUS with TLS)

sudo docker run --name myradius -v /var/lib/freeradius/raddb/clients.conf:/etc/raddb/clients.conf -v /var/lib/freeradius/raddb/mods-enabled/eap:/etc/raddb/mods-enabled/eap -v /var/lib/freeradius/raddb/mods-enabled/ldap:/etc/raddb/mods-enabled/ldap -v /var/lib/freeradius/raddb/mods-enabled/chap:/etc/raddb/mods-enabled/chap -v /var/lib/freeradius/raddb/mods-enabled/pap:/etc/raddb/mods-enabled/pap -v /var/lib/freeradius/raddb/mods-enabled/mschap:/etc/raddb/mods-enabled/mschap -v /var/lib/freeradius/certs/rootCA.crt:/etc/freeradius/certs/rootCA.crt -v /var/lib/freeradius/certs/dh:/etc/freeradius/certs/dh -v /var/lib/freeradius/certs/server.crt:/etc/freeradius/certs/server.crt -v /var/lib/freeradius/certs/server.key:/etc/freeradius/certs/server.key -p 1812-1813:1812-1813/udp -p 1812-1813:1812-1813/tcp freeradius/freeradius-ser[root@ipa ~]# docker  rm myradius 






[root@ipa ~]# sudo docker run --name myradius -v /var/lib/freeradius/raddb/clients.conf:/etc/raddb/clients.conf -v /var/lib/freeradius/raddb/mods-enabled/eap:/etc/raddb/mods-enabled/eap -v /var/lib/freeradius/raddb/mods-enabled/ldap:/etc/raddb/mods-enabled/ldap -v /var/lib/freeradius/raddb/mods-enabled/chap:/etc/raddb/mods-enabled/chap -v /var/lib/freeradius/raddb/mods-enabled/pap:/etc/raddb/mods-enabled/pap -v /var/lib/freeradius/raddb/mods-enabled/mschap:/etc/raddb/mods-enabled/mschap -v /var/lib/freeradius/certs/rootCA.crt:/etc/freeradius/certs/rootCA.crt -v /var/lib/freeradius/certs/dh:/etc/freeradius/certs/dh -v /var/lib/freeradius/certs/server.crt:/etc/freeradius/certs/server.crt -v /var/lib/freeradius/certs/server.key:/etc/freeradius/certs/server.key -p 1812-1813:1812-1813/udp -p 1812-1813:1812-1813/tcp freeradius/freeradius-server -X
FreeRADIUS Version 3.0.19
Copyright (C) 1999-2019 The FreeRADIUS server project and contributors
There is NO warranty; not even for MERCHANTABILITY or FITNESS FOR A
PARTICULAR PURPOSE
You may redistribute copies of FreeRADIUS under the terms of the
GNU General Public License
For more information about these matters, see the file named COPYRIGHT
Starting - reading configuration files ...
including dictionary file /usr/share/freeradius/dictionary
including dictionary file /usr/share/freeradius/dictionary.dhcp
including dictionary file /usr/share/freeradius/dictionary.vqp
including dictionary file /etc/freeradius/dictionary
including configuration file /etc/freeradius/radiusd.conf
including configuration file /etc/freeradius/proxy.conf
including configuration file /etc/freeradius/clients.conf
including files in directory /etc/freeradius/mods-enabled/
including configuration file /etc/freeradius/mods-enabled/always
including configuration file /etc/freeradius/mods-enabled/attr_filter
including configuration file /etc/freeradius/mods-enabled/cache_eap
including configuration file /etc/freeradius/mods-enabled/chap
including configuration file /etc/freeradius/mods-enabled/date
including configuration file /etc/freeradius/mods-enabled/detail
including configuration file /etc/freeradius/mods-enabled/detail.log
including configuration file /etc/freeradius/mods-enabled/digest
including configuration file /etc/freeradius/mods-enabled/dynamic_clients
including configuration file /etc/freeradius/mods-enabled/eap
including configuration file /etc/freeradius/mods-enabled/echo
including configuration file /etc/freeradius/mods-enabled/exec
including configuration file /etc/freeradius/mods-enabled/expiration
including configuration file /etc/freeradius/mods-enabled/expr
including configuration file /etc/freeradius/mods-enabled/files
including configuration file /etc/freeradius/mods-enabled/linelog
including configuration file /etc/freeradius/mods-enabled/logintime
including configuration file /etc/freeradius/mods-enabled/mschap
including configuration file /etc/freeradius/mods-enabled/ntlm_auth
including configuration file /etc/freeradius/mods-enabled/pap
including configuration file /etc/freeradius/mods-enabled/passwd
including configuration file /etc/freeradius/mods-enabled/preprocess
including configuration file /etc/freeradius/mods-enabled/radutmp
including configuration file /etc/freeradius/mods-enabled/realm
including configuration file /etc/freeradius/mods-enabled/replicate
including configuration file /etc/freeradius/mods-enabled/soh
including configuration file /etc/freeradius/mods-enabled/sradutmp
including configuration file /etc/freeradius/mods-enabled/unix
including configuration file /etc/freeradius/mods-enabled/unpack
including configuration file /etc/freeradius/mods-enabled/utf8
including configuration file /etc/freeradius/mods-enabled/ldap
including files in directory /etc/freeradius/policy.d/
including configuration file /etc/freeradius/policy.d/abfab-tr
including configuration file /etc/freeradius/policy.d/accounting
including configuration file /etc/freeradius/policy.d/canonicalization
including configuration file /etc/freeradius/policy.d/control
including configuration file /etc/freeradius/policy.d/cui
including configuration file /etc/freeradius/policy.d/debug
including configuration file /etc/freeradius/policy.d/dhcp
including configuration file /etc/freeradius/policy.d/eap
including configuration file /etc/freeradius/policy.d/filter
including configuration file /etc/freeradius/policy.d/moonshot-targeted-ids
including configuration file /etc/freeradius/policy.d/operator-name
including configuration file /etc/freeradius/policy.d/rfc7542
including files in directory /etc/freeradius/sites-enabled/
including configuration file /etc/freeradius/sites-enabled/default
including configuration file /etc/freeradius/sites-enabled/inner-tunnel
main {
 security {
        user = "freerad"
        group = "freerad"
        allow_core_dumps = no
 }
        name = "freeradius"
        prefix = "/usr"
        localstatedir = "/var"
        logdir = "/var/log/freeradius"
        run_dir = "/var/run/freeradius"
}
main {
        name = "freeradius"
        prefix = "/usr"
        localstatedir = "/var"
        sbindir = "/usr/sbin"
        logdir = "/var/log/freeradius"
        run_dir = "/var/run/freeradius"
        libdir = "/usr/lib/freeradius"
        radacctdir = "/var/log/freeradius/radacct"
        hostname_lookups = no
        max_request_time = 30
        cleanup_delay = 5
        max_requests = 16384
        pidfile = "/var/run/freeradius/freeradius.pid"
        checkrad = "/usr/sbin/checkrad"
        debug_level = 0
        proxy_requests = yes
 log {
        stripped_names = no
        auth = no
        auth_badpass = no
        auth_goodpass = no
        colourise = yes
        msg_denied = "You are already logged in - access denied"
 }
 resources {
 }
 security {
        max_attributes = 200
        reject_delay = 1.000000
        status_server = yes
 }
}
radiusd: #### Loading Realms and Home Servers ####
 proxy server {
        retry_delay = 5
        retry_count = 3
        default_fallback = no
        dead_time = 120
        wake_all_if_all_dead = no
 }
 home_server localhost {
        ipaddr = 127.0.0.1
        port = 1812
        type = "auth"
        secret = <<< secret >>>
        response_window = 20.000000
        response_timeouts = 1
        max_outstanding = 65536
        zombie_period = 40
        status_check = "status-server"
        ping_interval = 30
        check_interval = 30
        check_timeout = 4
        num_answers_to_alive = 3
        revive_interval = 120
  limit {
        max_connections = 16
        max_requests = 0
        lifetime = 0
        idle_timeout = 0
  }
  coa {
        irt = 2
        mrt = 16
        mrc = 5
        mrd = 30
  }
 }
 home_server_pool my_auth_failover {
        type = fail-over
        home_server = localhost
 }
 realm example.com {
        auth_pool = my_auth_failover
 }
 realm LOCAL {
 }
radiusd: #### Loading Clients ####
 client emanuel-firewall {
        ipaddr = 1.1.1.1
        require_message_authenticator = no
        secret = <<< secret >>>
  limit {
        max_connections = 16
        lifetime = 0
        idle_timeout = 30
  }
 }
 client emanuel-firewall-internal {
        ipaddr = 172.16.0.1
        require_message_authenticator = no
        secret = <<< secret >>>
  limit {
        max_connections = 16
        lifetime = 0
        idle_timeout = 30
  }
 }
 client freeipa {
        ipaddr = 192.168.0.2
        require_message_authenticator = no
        secret = <<< secret >>>
  limit {
        max_connections = 16
        lifetime = 0
        idle_timeout = 30
  }
 }
Debug state unknown (cap_sys_ptrace capability not set)
systemd watchdog is disabled
 # Creating Auth-Type = mschap
 # Creating Auth-Type = digest
 # Creating Auth-Type = eap
 # Creating Auth-Type = PAP
 # Creating Auth-Type = CHAP
 # Creating Auth-Type = MS-CHAP
radiusd: #### Instantiating modules ####
 modules {
  # Loaded module rlm_always
  # Loading module "reject" from file /etc/freeradius/mods-enabled/always
  always reject {
        rcode = "reject"
        simulcount = 0
        mpp = no
  }
  # Loading module "fail" from file /etc/freeradius/mods-enabled/always
  always fail {
        rcode = "fail"
        simulcount = 0
        mpp = no
  }
  # Loading module "ok" from file /etc/freeradius/mods-enabled/always
  always ok {
        rcode = "ok"
        simulcount = 0
        mpp = no
  }
  # Loading module "handled" from file /etc/freeradius/mods-enabled/always
  always handled {
        rcode = "handled"
        simulcount = 0
        mpp = no
  }
  # Loading module "invalid" from file /etc/freeradius/mods-enabled/always
  always invalid {
        rcode = "invalid"
        simulcount = 0
        mpp = no
  }
  # Loading module "userlock" from file /etc/freeradius/mods-enabled/always
  always userlock {
        rcode = "userlock"
        simulcount = 0
        mpp = no
  }
  # Loading module "notfound" from file /etc/freeradius/mods-enabled/always
  always notfound {
        rcode = "notfound"
        simulcount = 0
        mpp = no
  }
  # Loading module "noop" from file /etc/freeradius/mods-enabled/always
  always noop {
        rcode = "noop"
        simulcount = 0
        mpp = no
  }
  # Loading module "updated" from file /etc/freeradius/mods-enabled/always
  always updated {
        rcode = "updated"
        simulcount = 0
        mpp = no
  }
  # Loaded module rlm_attr_filter
  # Loading module "attr_filter.post-proxy" from file /etc/freeradius/mods-enabled/attr_filter
  attr_filter attr_filter.post-proxy {
        filename = "/etc/freeradius/mods-config/attr_filter/post-proxy"
        key = "%{Realm}"
        relaxed = no
  }
  # Loading module "attr_filter.pre-proxy" from file /etc/freeradius/mods-enabled/attr_filter
  attr_filter attr_filter.pre-proxy {
        filename = "/etc/freeradius/mods-config/attr_filter/pre-proxy"
        key = "%{Realm}"
        relaxed = no
  }
  # Loading module "attr_filter.access_reject" from file /etc/freeradius/mods-enabled/attr_filter
  attr_filter attr_filter.access_reject {
        filename = "/etc/freeradius/mods-config/attr_filter/access_reject"
        key = "%{User-Name}"
        relaxed = no
  }
  # Loading module "attr_filter.access_challenge" from file /etc/freeradius/mods-enabled/attr_filter
  attr_filter attr_filter.access_challenge {
        filename = "/etc/freeradius/mods-config/attr_filter/access_challenge"
        key = "%{User-Name}"
        relaxed = no
  }
  # Loading module "attr_filter.accounting_response" from file /etc/freeradius/mods-enabled/attr_filter
  attr_filter attr_filter.accounting_response {
        filename = "/etc/freeradius/mods-config/attr_filter/accounting_response"
        key = "%{User-Name}"
        relaxed = no
  }
  # Loaded module rlm_cache
  # Loading module "cache_eap" from file /etc/freeradius/mods-enabled/cache_eap
  cache cache_eap {
        driver = "rlm_cache_rbtree"
        key = "%{%{control:State}:-%{%{reply:State}:-%{State}}}"
        ttl = 15
        max_entries = 0
        epoch = 0
        add_stats = no
  }
  # Loaded module rlm_chap
  # Loading module "chap" from file /etc/freeradius/mods-enabled/chap
  # Loaded module rlm_date
  # Loading module "date" from file /etc/freeradius/mods-enabled/date
  date {
        format = "%b %e %Y %H:%M:%S %Z"
        utc = no
  }
  # Loading module "wispr2date" from file /etc/freeradius/mods-enabled/date
  date wispr2date {
        format = "%Y-%m-%dT%H:%M:%S"
        utc = no
  }
  # Loaded module rlm_detail
  # Loading module "detail" from file /etc/freeradius/mods-enabled/detail
  detail {
        filename = "/var/log/freeradius/radacct/%{%{Packet-Src-IP-Address}:-%{Packet-Src-IPv6-Address}}/detail-%Y%m%d"
        header = "%t"
        permissions = 384
        locking = no
        escape_filenames = no
        log_packet_header = no
  }
  # Loading module "auth_log" from file /etc/freeradius/mods-enabled/detail.log
  detail auth_log {
        filename = "/var/log/freeradius/radacct/%{%{Packet-Src-IP-Address}:-%{Packet-Src-IPv6-Address}}/auth-detail-%Y%m%d"
        header = "%t"
        permissions = 384
        locking = no
        escape_filenames = no
        log_packet_header = no
  }
  # Loading module "reply_log" from file /etc/freeradius/mods-enabled/detail.log
  detail reply_log {
        filename = "/var/log/freeradius/radacct/%{%{Packet-Src-IP-Address}:-%{Packet-Src-IPv6-Address}}/reply-detail-%Y%m%d"
        header = "%t"
        permissions = 384
        locking = no
        escape_filenames = no
        log_packet_header = no
  }
  # Loading module "pre_proxy_log" from file /etc/freeradius/mods-enabled/detail.log
  detail pre_proxy_log {
        filename = "/var/log/freeradius/radacct/%{%{Packet-Src-IP-Address}:-%{Packet-Src-IPv6-Address}}/pre-proxy-detail-%Y%m%d"
        header = "%t"
        permissions = 384
        locking = no
        escape_filenames = no
        log_packet_header = no
  }
  # Loading module "post_proxy_log" from file /etc/freeradius/mods-enabled/detail.log
  detail post_proxy_log {
        filename = "/var/log/freeradius/radacct/%{%{Packet-Src-IP-Address}:-%{Packet-Src-IPv6-Address}}/post-proxy-detail-%Y%m%d"
        header = "%t"
        permissions = 384
        locking = no
        escape_filenames = no
        log_packet_header = no
  }
  # Loaded module rlm_digest
  # Loading module "digest" from file /etc/freeradius/mods-enabled/digest
  # Loaded module rlm_dynamic_clients
  # Loading module "dynamic_clients" from file /etc/freeradius/mods-enabled/dynamic_clients
  # Loaded module rlm_eap
  # Loading module "eap" from file /etc/freeradius/mods-enabled/eap
  eap {
        default_eap_type = "tls"
        timer_expire = 60
        ignore_unknown_eap_types = no
        cisco_accounting_username_bug = no
        max_sessions = 16384
  }
  # Loaded module rlm_exec
  # Loading module "echo" from file /etc/freeradius/mods-enabled/echo
  exec echo {
        wait = yes
        program = "/bin/echo %{User-Name}"
        input_pairs = "request"
        output_pairs = "reply"
        shell_escape = yes
  }
  # Loading module "exec" from file /etc/freeradius/mods-enabled/exec
  exec {
        wait = no
        input_pairs = "request"
        shell_escape = yes
        timeout = 10
  }
  # Loaded module rlm_expiration
  # Loading module "expiration" from file /etc/freeradius/mods-enabled/expiration
  # Loaded module rlm_expr
  # Loading module "expr" from file /etc/freeradius/mods-enabled/expr
  expr {
        safe_characters = "@abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ0123456789.-_: /äéöüàâæçèéêëîïôœùûüaÿÄÉÖÜßÀÂÆÇÈÉÊËÎÏÔŒÙÛÜŸ"
  }
  # Loaded module rlm_files
  # Loading module "files" from file /etc/freeradius/mods-enabled/files
  files {
        filename = "/etc/freeradius/mods-config/files/authorize"
        acctusersfile = "/etc/freeradius/mods-config/files/accounting"
        preproxy_usersfile = "/etc/freeradius/mods-config/files/pre-proxy"
  }
  # Loaded module rlm_linelog
  # Loading module "linelog" from file /etc/freeradius/mods-enabled/linelog
  linelog {
        filename = "/var/log/freeradius/linelog"
        escape_filenames = no
        syslog_severity = "info"
        permissions = 384
        format = "This is a log message for %{User-Name}"
        reference = "messages.%{%{reply:Packet-Type}:-default}"
  }
  # Loading module "log_accounting" from file /etc/freeradius/mods-enabled/linelog
  linelog log_accounting {
        filename = "/var/log/freeradius/linelog-accounting"
        escape_filenames = no
        syslog_severity = "info"
        permissions = 384
        format = ""
        reference = "Accounting-Request.%{%{Acct-Status-Type}:-unknown}"
  }
  # Loaded module rlm_logintime
  # Loading module "logintime" from file /etc/freeradius/mods-enabled/logintime
  logintime {
        minimum_timeout = 60
  }
  # Loaded module rlm_mschap
  # Loading module "mschap" from file /etc/freeradius/mods-enabled/mschap
  mschap {
        use_mppe = yes
        require_encryption = no
        require_strong = no
        with_ntdomain_hack = yes
        ntlm_auth = "/usr/bin/ntlm_auth --request-nt-key --username=%{%{Stripped-User-Name}:-%{%{User-Name}:-None}} --challenge=%{%{mschap:Challenge}:-00} --nt-response=%{%{mschap:NT-Response}:-00}"
   passchange {
   }
        allow_retry = yes
        winbind_retry_with_normalised_username = no
  }
  # Loading module "ntlm_auth" from file /etc/freeradius/mods-enabled/ntlm_auth
  exec ntlm_auth {
        wait = yes
        program = "/path/to/ntlm_auth --request-nt-key --domain=MYDOMAIN --username=%{mschap:User-Name} --password=%{User-Password}"
        shell_escape = yes
  }
  # Loaded module rlm_pap
  # Loading module "pap" from file /etc/freeradius/mods-enabled/pap
  pap {
        normalise = yes
  }
  # Loaded module rlm_passwd
  # Loading module "etc_passwd" from file /etc/freeradius/mods-enabled/passwd
  passwd etc_passwd {
        filename = "/etc/passwd"
        format = "*User-Name:Crypt-Password:"
        delimiter = ":"
        ignore_nislike = no
        ignore_empty = yes
        allow_multiple_keys = no
        hash_size = 100
  }
  # Loaded module rlm_preprocess
  # Loading module "preprocess" from file /etc/freeradius/mods-enabled/preprocess
  preprocess {
        huntgroups = "/etc/freeradius/mods-config/preprocess/huntgroups"
        hints = "/etc/freeradius/mods-config/preprocess/hints"
        with_ascend_hack = no
        ascend_channels_per_line = 23
        with_ntdomain_hack = no
        with_specialix_jetstream_hack = no
        with_cisco_vsa_hack = no
        with_alvarion_vsa_hack = no
  }
  # Loaded module rlm_radutmp
  # Loading module "radutmp" from file /etc/freeradius/mods-enabled/radutmp
  radutmp {
        filename = "/var/log/freeradius/radutmp"
        username = "%{User-Name}"
        case_sensitive = yes
        check_with_nas = yes
        permissions = 384
        caller_id = yes
  }
  # Loaded module rlm_realm
  # Loading module "IPASS" from file /etc/freeradius/mods-enabled/realm
  realm IPASS {
        format = "prefix"
        delimiter = "/"
        ignore_default = no
        ignore_null = no
  }
  # Loading module "suffix" from file /etc/freeradius/mods-enabled/realm
  realm suffix {
        format = "suffix"
        delimiter = "@"
        ignore_default = no
        ignore_null = no
  }
  # Loading module "bangpath" from file /etc/freeradius/mods-enabled/realm
  realm bangpath {
        format = "prefix"
        delimiter = "!"
        ignore_default = no
        ignore_null = no
  }
  # Loading module "realmpercent" from file /etc/freeradius/mods-enabled/realm
  realm realmpercent {
        format = "suffix"
        delimiter = "%"
        ignore_default = no
        ignore_null = no
  }
  # Loading module "ntdomain" from file /etc/freeradius/mods-enabled/realm
  realm ntdomain {
        format = "prefix"
        delimiter = "\\"
        ignore_default = no
        ignore_null = no
  }
  # Loaded module rlm_replicate
  # Loading module "replicate" from file /etc/freeradius/mods-enabled/replicate
  # Loaded module rlm_soh
  # Loading module "soh" from file /etc/freeradius/mods-enabled/soh
  soh {
        dhcp = yes
  }
  # Loading module "sradutmp" from file /etc/freeradius/mods-enabled/sradutmp
  radutmp sradutmp {
        filename = "/var/log/freeradius/sradutmp"
        username = "%{User-Name}"
        case_sensitive = yes
        check_with_nas = yes
        permissions = 420
        caller_id = no
  }
  # Loaded module rlm_unix
  # Loading module "unix" from file /etc/freeradius/mods-enabled/unix
  unix {
        radwtmp = "/var/log/freeradius/radwtmp"
  }
Creating attribute Unix-Group
  # Loaded module rlm_unpack
  # Loading module "unpack" from file /etc/freeradius/mods-enabled/unpack
  # Loaded module rlm_utf8
  # Loading module "utf8" from file /etc/freeradius/mods-enabled/utf8
  # Loaded module rlm_ldap
  # Loading module "ldap" from file /etc/freeradius/mods-enabled/ldap
  ldap {
        server = "ldaps://192.168.0.2"
        port = 636
        identity = "uid=binder,cn=users,cn=accounts,dc=companyx,dc=io"
        password = <<< secret >>>
   sasl {
   }
   user {
        scope = "sub"
        access_positive = yes
    sasl {
    }
   }
   group {
        filter = "(objectClass=posixGroup)"
        scope = "sub"
        name_attribute = "cn"
        membership_attribute = "memberOf"
        cacheable_name = no
        cacheable_dn = no
   }
   client {
        filter = "(objectClass=radiusClient)"
        scope = "sub"
        base_dn = "cn=users,cn=accounts,dc=companyx,dc=io"
   }
   profile {
   }
   options {
        ldap_debug = 1
        chase_referrals = yes
        rebind = yes
        net_timeout = 10
        res_timeout = 10
        srv_timelimit = 3
        idle = 60
        probes = 3
        interval = 3
   }
   tls {
        ca_file = "/etc/freeradius/certs/rootCA.crt"
        ca_path = "/etc/freeradius/certs/"
        certificate_file = "/etc/freeradius/certs/server.crt"
        private_key_file = "/etc/freeradius/certs/server.key"
        random_file = "/dev/urandom"
        start_tls = no
        require_cert = "allow"
   }
  }
Creating attribute LDAP-Group
  instantiate {
  }
  # Instantiating module "reject" from file /etc/freeradius/mods-enabled/always
  # Instantiating module "fail" from file /etc/freeradius/mods-enabled/always
  # Instantiating module "ok" from file /etc/freeradius/mods-enabled/always
  # Instantiating module "handled" from file /etc/freeradius/mods-enabled/always
  # Instantiating module "invalid" from file /etc/freeradius/mods-enabled/always
  # Instantiating module "userlock" from file /etc/freeradius/mods-enabled/always
  # Instantiating module "notfound" from file /etc/freeradius/mods-enabled/always
  # Instantiating module "noop" from file /etc/freeradius/mods-enabled/always
  # Instantiating module "updated" from file /etc/freeradius/mods-enabled/always
  # Instantiating module "attr_filter.post-proxy" from file /etc/freeradius/mods-enabled/attr_filter
reading pairlist file /etc/freeradius/mods-config/attr_filter/post-proxy
  # Instantiating module "attr_filter.pre-proxy" from file /etc/freeradius/mods-enabled/attr_filter
reading pairlist file /etc/freeradius/mods-config/attr_filter/pre-proxy
  # Instantiating module "attr_filter.access_reject" from file /etc/freeradius/mods-enabled/attr_filter
reading pairlist file /etc/freeradius/mods-config/attr_filter/access_reject
  # Instantiating module "attr_filter.access_challenge" from file /etc/freeradius/mods-enabled/attr_filter
reading pairlist file /etc/freeradius/mods-config/attr_filter/access_challenge
  # Instantiating module "attr_filter.accounting_response" from file /etc/freeradius/mods-enabled/attr_filter
reading pairlist file /etc/freeradius/mods-config/attr_filter/accounting_response
  # Instantiating module "cache_eap" from file /etc/freeradius/mods-enabled/cache_eap
rlm_cache (cache_eap): Driver rlm_cache_rbtree (module rlm_cache_rbtree) loaded and linked
  # Instantiating module "detail" from file /etc/freeradius/mods-enabled/detail
  # Instantiating module "auth_log" from file /etc/freeradius/mods-enabled/detail.log
rlm_detail (auth_log): 'User-Password' suppressed, will not appear in detail output
  # Instantiating module "reply_log" from file /etc/freeradius/mods-enabled/detail.log
  # Instantiating module "pre_proxy_log" from file /etc/freeradius/mods-enabled/detail.log
  # Instantiating module "post_proxy_log" from file /etc/freeradius/mods-enabled/detail.log
  # Instantiating module "eap" from file /etc/freeradius/mods-enabled/eap
   # Linked to sub-module rlm_eap_tls
   tls {
        tls = "tls-common"
   }
   tls-config tls-common {
        verify_depth = 0
        ca_path = "/etc/freeradius/certs"
        pem_file_type = yes
        private_key_file = "/etc/freeradius/certs/server.key"
        certificate_file = "/etc/freeradius/certs/server.crt"
        ca_file = "/etc/freeradius/certs/rootCA.crt"
        private_key_password = <<< secret >>>
        dh_file = "/etc/freeradius/certs/dh"
        fragment_size = 1024
        include_length = yes
        auto_chain = yes
        check_crl = no
        check_all_crl = no
        cipher_list = "HIGH"
        ecdh_curve = "prime256v1"
        tls_max_version = ""
        tls_min_version = "1.0"
    cache {
        enable = no
        lifetime = 24
        max_entries = 255
    }
    verify {
        skip_if_ocsp_ok = no
    }
    ocsp {
        enable = no
        override_cert_url = no
        use_nonce = yes
        timeout = 0
        softfail = no
    }
   }
   # Linked to sub-module rlm_eap_peap
   peap {
        tls = "tls-common"
        default_eap_type = "mschapv2"
        copy_request_to_tunnel = no
        use_tunneled_reply = no
        proxy_tunneled_request_as_eap = yes
        virtual_server = "inner-tunnel"
        soh = no
        require_client_cert = no
   }
tls: Using cached TLS configuration from previous invocation
   # Linked to sub-module rlm_eap_mschapv2
   mschapv2 {
        with_ntdomain_hack = no
        send_error = no
   }
  # Instantiating module "expiration" from file /etc/freeradius/mods-enabled/expiration
  # Instantiating module "files" from file /etc/freeradius/mods-enabled/files
reading pairlist file /etc/freeradius/mods-config/files/authorize
reading pairlist file /etc/freeradius/mods-config/files/accounting
reading pairlist file /etc/freeradius/mods-config/files/pre-proxy
  # Instantiating module "linelog" from file /etc/freeradius/mods-enabled/linelog
  # Instantiating module "log_accounting" from file /etc/freeradius/mods-enabled/linelog
  # Instantiating module "logintime" from file /etc/freeradius/mods-enabled/logintime
  # Instantiating module "mschap" from file /etc/freeradius/mods-enabled/mschap
rlm_mschap (mschap): authenticating by calling 'ntlm_auth'
  # Instantiating module "pap" from file /etc/freeradius/mods-enabled/pap
  # Instantiating module "etc_passwd" from file /etc/freeradius/mods-enabled/passwd
rlm_passwd: nfields: 3 keyfield 0(User-Name) listable: no
  # Instantiating module "preprocess" from file /etc/freeradius/mods-enabled/preprocess
reading pairlist file /etc/freeradius/mods-config/preprocess/huntgroups
reading pairlist file /etc/freeradius/mods-config/preprocess/hints
  # Instantiating module "IPASS" from file /etc/freeradius/mods-enabled/realm
  # Instantiating module "suffix" from file /etc/freeradius/mods-enabled/realm
  # Instantiating module "bangpath" from file /etc/freeradius/mods-enabled/realm
  # Instantiating module "realmpercent" from file /etc/freeradius/mods-enabled/realm
  # Instantiating module "ntdomain" from file /etc/freeradius/mods-enabled/realm
  # Instantiating module "ldap" from file /etc/freeradius/mods-enabled/ldap
rlm_ldap: libldap vendor: OpenLDAP, version: 20445
   accounting {
        reference = "%{tolower:type.%{Acct-Status-Type}}"
   }
   post-auth {
        reference = "."
   }
rlm_ldap (ldap): Initialising connection pool
   pool {
        start = 4
        min = 1
        max = 30
        spare = 0
        uses = 0
        lifetime = 0
        cleanup_interval = 30
        idle_timeout = 60
        retry_delay = 30
        spread = no
   }
rlm_ldap (ldap): Opening additional connection (0), 1 of 30 pending slots used
rlm_ldap (ldap): Connecting to ldaps://192.168.0.2:636
ldap_create
ldap_url_parse_ext(ldaps://192.168.0.2:636)
TLS: warning: cacertdir not implemented for gnutls
ldap_bind
ldap_simple_bind
ldap_sasl_bind
ldap_send_initial_request
ldap_new_connection 1 1 0
ldap_int_open_connection
ldap_connect_to_host: TCP 192.168.0.2:636
ldap_new_socket: 3
ldap_prepare_socket: 3
ldap_connect_to_host: Trying 192.168.0.2:636
ldap_pvt_connect: fd: 3 tm: 10 async: 0
ldap_ndelay_on: 3
attempting to connect: 
connect errno: 115
ldap_int_poll: fd: 3 tm: 10
ldap_is_sock_ready: 3
ldap_ndelay_off: 3
ldap_pvt_connect: 0
TLS: peer cert untrusted or revoked (0x42)
ldap_open_defconn: successful
ldap_send_server_request
rlm_ldap (ldap): Waiting for bind result...
ldap_result ld 0x5621465809d0 msgid 1
wait4msg ld 0x5621465809d0 msgid 1 (timeout 10000000 usec)
wait4msg continue ld 0x5621465809d0 msgid 1 all 1
** ld 0x5621465809d0 Connections:
* host: 192.168.0.2  port: 636  (default)
  refcnt: 2  status: Connected
  last used: Fri May  3 05:41:44 2019


** ld 0x5621465809d0 Outstanding Requests:
 * msgid 1,  origid 1, status InProgress
   outstanding referrals 0, parent count 0
  ld 0x5621465809d0 request count 1 (abandoned 0)
** ld 0x5621465809d0 Response Queue:
   Empty
  ld 0x5621465809d0 response count 0
ldap_chkResponseList ld 0x5621465809d0 msgid 1 all 1
ldap_chkResponseList returns ld 0x5621465809d0 NULL
ldap_int_select
read1msg: ld 0x5621465809d0 msgid 1 all 1
read1msg: ld 0x5621465809d0 msgid 1 message type bind
read1msg: ld 0x5621465809d0 0 new referrals
read1msg:  mark request completed, ld 0x5621465809d0 msgid 1
request done: ld 0x5621465809d0 msgid 1
res_errno: 0, res_error: <>, res_matched: <>
ldap_free_request (origid 1, msgid 1)
ldap_parse_result
ldap_msgfree
ldap_create
ldap_url_parse_ext(ldaps://192.168.0.2:636)
TLS: warning: cacertdir not implemented for gnutls
rlm_ldap (ldap): Bind successful
rlm_ldap (ldap): Opening additional connection (1), 1 of 29 pending slots used
rlm_ldap (ldap): Connecting to ldaps://192.168.0.2:636
ldap_bind
ldap_simple_bind
ldap_sasl_bind
ldap_send_initial_request
ldap_new_connection 1 1 0
ldap_int_open_connection
ldap_connect_to_host: TCP 192.168.0.2:636
ldap_new_socket: 4
ldap_prepare_socket: 4
ldap_connect_to_host: Trying 192.168.0.2:636
ldap_pvt_connect: fd: 4 tm: 10 async: 0
ldap_ndelay_on: 4
attempting to connect: 
connect errno: 115
ldap_int_poll: fd: 4 tm: 10
ldap_is_sock_ready: 4
ldap_ndelay_off: 4
ldap_pvt_connect: 0
TLS: peer cert untrusted or revoked (0x42)
ldap_open_defconn: successful
ldap_send_server_request
rlm_ldap (ldap): Waiting for bind result...
ldap_result ld 0x5621465ade70 msgid 1
wait4msg ld 0x5621465ade70 msgid 1 (timeout 10000000 usec)
wait4msg continue ld 0x5621465ade70 msgid 1 all 1
** ld 0x5621465ade70 Connections:
* host: 192.168.0.2  port: 636  (default)
  refcnt: 2  status: Connected
  last used: Fri May  3 05:41:44 2019


** ld 0x5621465ade70 Outstanding Requests:
 * msgid 1,  origid 1, status InProgress
   outstanding referrals 0, parent count 0
  ld 0x5621465ade70 request count 1 (abandoned 0)
** ld 0x5621465ade70 Response Queue:
   Empty
  ld 0x5621465ade70 response count 0
ldap_chkResponseList ld 0x5621465ade70 msgid 1 all 1
ldap_chkResponseList returns ld 0x5621465ade70 NULL
ldap_int_select
read1msg: ld 0x5621465ade70 msgid 1 all 1
read1msg: ld 0x5621465ade70 msgid 1 message type bind
read1msg: ld 0x5621465ade70 0 new referrals
read1msg:  mark request completed, ld 0x5621465ade70 msgid 1
request done: ld 0x5621465ade70 msgid 1
res_errno: 0, res_error: <>, res_matched: <>
ldap_free_request (origid 1, msgid 1)
ldap_parse_result
ldap_msgfree
ldap_create
ldap_url_parse_ext(ldaps://192.168.0.2:636)
TLS: warning: cacertdir not implemented for gnutls
rlm_ldap (ldap): Bind successful
rlm_ldap (ldap): Opening additional connection (2), 1 of 28 pending slots used
rlm_ldap (ldap): Connecting to ldaps://192.168.0.2:636
ldap_bind
ldap_simple_bind
ldap_sasl_bind
ldap_send_initial_request
ldap_new_connection 1 1 0
ldap_int_open_connection
ldap_connect_to_host: TCP 192.168.0.2:636
ldap_new_socket: 5
ldap_prepare_socket: 5
ldap_connect_to_host: Trying 192.168.0.2:636
ldap_pvt_connect: fd: 5 tm: 10 async: 0
ldap_ndelay_on: 5
attempting to connect: 
connect errno: 115
ldap_int_poll: fd: 5 tm: 10
ldap_is_sock_ready: 5
ldap_ndelay_off: 5
ldap_pvt_connect: 0
TLS: peer cert untrusted or revoked (0x42)
ldap_open_defconn: successful
ldap_send_server_request
ldap_result ld 0x5621465d0550 msgid 1
wait4msg ld 0x5621465d0550 msgid 1 (timeout 10000000 usec)
wait4msg continue ld 0x5621465d0550 msgid 1 all 1
** ld 0x5621465d0550 Connections:
* host: 192.168.0.2  port: 636  (default)
  refcnt: 2  status: Connected
  last used: Fri May  3 05:41:44 2019


** ld 0x5621465d0550 Outstanding Requests:
 * msgid 1,  origid 1, status InProgress
   outstanding referrals 0, parent count 0
  ld 0x5621465d0550 request count 1 (abandoned 0)
** ld 0x5621465d0550 Response Queue:
   Empty
  ld 0x5621465d0550 response count 0
ldap_chkResponseList ld 0x5621465d0550 msgid 1 all 1
ldap_chkResponseList returns ld 0x5621465d0550 NULL
ldap_int_select
rlm_ldap (ldap): Waiting for bind result...
read1msg: ld 0x5621465d0550 msgid 1 all 1
read1msg: ld 0x5621465d0550 msgid 1 message type bind
read1msg: ld 0x5621465d0550 0 new referrals
read1msg:  mark request completed, ld 0x5621465d0550 msgid 1
request done: ld 0x5621465d0550 msgid 1
res_errno: 0, res_error: <>, res_matched: <>
ldap_free_request (origid 1, msgid 1)
ldap_parse_result
ldap_msgfree
ldap_create
ldap_url_parse_ext(ldaps://192.168.0.2:636)
TLS: warning: cacertdir not implemented for gnutls
rlm_ldap (ldap): Bind successful
rlm_ldap (ldap): Opening additional connection (3), 1 of 27 pending slots used
rlm_ldap (ldap): Connecting to ldaps://192.168.0.2:636
ldap_bind
ldap_simple_bind
ldap_sasl_bind
ldap_send_initial_request
ldap_new_connection 1 1 0
ldap_int_open_connection
ldap_connect_to_host: TCP 192.168.0.2:636
ldap_new_socket: 6
ldap_prepare_socket: 6
ldap_connect_to_host: Trying 192.168.0.2:636
ldap_pvt_connect: fd: 6 tm: 10 async: 0
ldap_ndelay_on: 6
attempting to connect: 
connect errno: 115
ldap_int_poll: fd: 6 tm: 10
ldap_is_sock_ready: 6
ldap_ndelay_off: 6
ldap_pvt_connect: 0
TLS: peer cert untrusted or revoked (0x42)
ldap_open_defconn: successful
ldap_send_server_request
ldap_result ld 0x5621465ee850 msgid 1
wait4msg ld 0x5621465ee850 msgid 1 (timeout 10000000 usec)
wait4msg continue ld 0x5621465ee850 msgid 1 all 1
** ld 0x5621465ee850 Connections:
* host: 192.168.0.2  port: 636  (default)
  refcnt: 2  status: Connected
  last used: Fri May  3 05:41:44 2019


** ld 0x5621465ee850 Outstanding Requests:
 * msgid 1,  origid 1, status InProgress
   outstanding referrals 0, parent count 0
  ld 0x5621465ee850 request count 1 (abandoned 0)
** ld 0x5621465ee850 Response Queue:
   Empty
  ld 0x5621465ee850 response count 0
ldap_chkResponseList ld 0x5621465ee850 msgid 1 all 1
ldap_chkResponseList returns ld 0x5621465ee850 NULL
ldap_int_select
rlm_ldap (ldap): Waiting for bind result...
rlm_ldap (ldap): Bind successful
 } # modules
radiusd: #### Loading Virtual Servers ####
server { # from file /etc/freeradius/radiusd.conf
} # server
server default { # from file /etc/freeradius/sites-enabled/default
read1msg: ld 0x5621465ee850 msgid 1 all 1
read1msg: ld 0x5621465ee850 msgid 1 message type bind
read1msg: ld 0x5621465ee850 0 new referrals
read1msg:  mark request completed, ld 0x5621465ee850 msgid 1
request done: ld 0x5621465ee850 msgid 1
res_errno: 0, res_error: <>, res_matched: <>
ldap_free_request (origid 1, msgid 1)
ldap_parse_result
ldap_msgfree
 # Loading authenticate {...}
 # Loading authorize {...}
Ignoring "sql" (see raddb/mods-available/README.rst)
 # Loading preacct {...}
 # Loading accounting {...}
 # Loading post-proxy {...}
 # Loading post-auth {...}
} # server default
server inner-tunnel { # from file /etc/freeradius/sites-enabled/inner-tunnel
 # Loading authenticate {...}
 # Loading authorize {...}
 # Loading session {...}
 # Loading post-proxy {...}
 # Loading post-auth {...}
 # Skipping contents of 'if' as it is always 'false' -- /etc/freeradius/sites-enabled/inner-tunnel:336
} # server inner-tunnel
radiusd: #### Opening IP addresses and Ports ####
listen {
        type = "auth"
        ipaddr = *
        port = 0
   limit {
        max_connections = 16
        lifetime = 0
        idle_timeout = 30
   }
}
listen {
        type = "acct"
        ipaddr = *
        port = 0
   limit {
        max_connections = 16
        lifetime = 0
        idle_timeout = 30
   }
}
listen {
        type = "auth"
        ipv6addr = ::
        port = 0
   limit {
        max_connections = 16
        lifetime = 0
        idle_timeout = 30
   }
}
listen {
        type = "acct"
        ipv6addr = ::
        port = 0
   limit {
        max_connections = 16
        lifetime = 0
        idle_timeout = 30
   }
}
listen {
        type = "auth"
        ipaddr = 127.0.0.1
        port = 18120
}
Listening on auth address * port 1812 bound to server default
Listening on acct address * port 1813 bound to server default
Listening on auth address :: port 1812 bound to server default
Listening on acct address :: port 1813 bound to server default
Listening on auth address 127.0.0.1 port 18120 bound to server inner-tunnel
Listening on proxy address * port 42242
Listening on proxy address :: port 55528
Ready to process requests
(0) Received Access-Request Id 25 from 1.1.1.1:2997 to 192.168.0.3:1812 length 88
(0)   NAS-Identifier = "Firewall"
(0)   User-Name = "user"
(0)   User-Password = "Password123"
(0) # Executing section authorize from file /etc/freeradius/sites-enabled/default
(0)   authorize {
(0)     policy filter_username {
(0)       if (&User-Name) {
(0)       if (&User-Name)  -> TRUE
(0)       if (&User-Name)  {
(0)         if (&User-Name =~ / /) {
(0)         if (&User-Name =~ / /)  -> FALSE
(0)         if (&User-Name =~ /@[^@]*@/ ) {
(0)         if (&User-Name =~ /@[^@]*@/ )  -> FALSE
(0)         if (&User-Name =~ /\.\./ ) {
(0)         if (&User-Name =~ /\.\./ )  -> FALSE
(0)         if ((&User-Name =~ /@/) && (&User-Name !~ /@(.+)\.(.+)$/))  {
(0)         if ((&User-Name =~ /@/) && (&User-Name !~ /@(.+)\.(.+)$/))   -> FALSE
(0)         if (&User-Name =~ /\.$/)  {
(0)         if (&User-Name =~ /\.$/)   -> FALSE
(0)         if (&User-Name =~ /@\./)  {
(0)         if (&User-Name =~ /@\./)   -> FALSE
(0)       } # if (&User-Name)  = notfound
(0)     } # policy filter_username = notfound
(0)     [preprocess] = ok
(0)     [chap] = noop
(0)     [mschap] = noop
(0)     [digest] = noop
(0) suffix: Checking for suffix after "@"
(0) suffix: No '@' in User-Name = "user", looking up realm NULL
(0) suffix: No such realm "NULL"
(0)     [suffix] = noop
(0) eap: No EAP-Message, not doing EAP
(0)     [eap] = noop
(0)     [files] = noop
rlm_ldap (ldap): Reserved connection (0)
(0) ldap: EXPAND (uid=%{%{Stripped-User-Name}:-%{User-Name}})
(0) ldap:    --> (uid=user)
(0) ldap: Performing search in "cn=users,cn=accounts,dc=companyx,dc=io" with filter "(uid=user)", scope "sub"
ldap_search_ext
put_filter: "(uid=user)"
put_filter: simple
put_simple_filter: "uid=user"
ldap_send_initial_request
ldap_send_server_request
(0) ldap: Waiting for search result...
ldap_result ld 0x5621465809d0 msgid 2
wait4msg ld 0x5621465809d0 msgid 2 (timeout 10000000 usec)
wait4msg continue ld 0x5621465809d0 msgid 2 all 1
** ld 0x5621465809d0 Connections:
* host: 192.168.0.2  port: 636  (default)
  refcnt: 2  status: Connected
  last used: Fri May  3 05:42:18 2019


** ld 0x5621465809d0 Outstanding Requests:
 * msgid 2,  origid 2, status InProgress
   outstanding referrals 0, parent count 0
  ld 0x5621465809d0 request count 1 (abandoned 0)
** ld 0x5621465809d0 Response Queue:
   Empty
  ld 0x5621465809d0 response count 0
ldap_chkResponseList ld 0x5621465809d0 msgid 2 all 1
ldap_chkResponseList returns ld 0x5621465809d0 NULL
ldap_int_select
read1msg: ld 0x5621465809d0 msgid 2 all 1
read1msg: ld 0x5621465809d0 msgid 2 message type search-entry
wait4msg ld 0x5621465809d0 9 s 998961 us to go
wait4msg continue ld 0x5621465809d0 msgid 2 all 1
** ld 0x5621465809d0 Connections:
* host: 192.168.0.2  port: 636  (default)
  refcnt: 2  status: Connected
  last used: Fri May  3 05:42:18 2019


** ld 0x5621465809d0 Outstanding Requests:
 * msgid 2,  origid 2, status InProgress
   outstanding referrals 0, parent count 0
  ld 0x5621465809d0 request count 1 (abandoned 0)
** ld 0x5621465809d0 Response Queue:
 * msgid 2,  type 100
  ld 0x5621465809d0 response count 1
ldap_chkResponseList ld 0x5621465809d0 msgid 2 all 1
ldap_chkResponseList returns ld 0x5621465809d0 NULL
ldap_int_select
read1msg: ld 0x5621465809d0 msgid 2 all 1
read1msg: ld 0x5621465809d0 msgid 2 message type search-result
read1msg: ld 0x5621465809d0 0 new referrals
read1msg:  mark request completed, ld 0x5621465809d0 msgid 2
request done: ld 0x5621465809d0 msgid 2
res_errno: 0, res_error: <>, res_matched: <>
ldap_free_request (origid 2, msgid 2)
adding response ld 0x5621465809d0 msgid 2 type 101:
ldap_parse_result
ldap_get_dn
(0) ldap: User object found at DN "uid=user,cn=users,cn=accounts,dc=companyx,dc=io"
(0) ldap: Processing user attributes
ldap_get_values_len
(0) ldap: &control:Password-With-Header += '{PBKDF2_SHA256}AAAIAElQ9+kOExv12HALK9/ta+VKE79Jz9Eky+Ta0/FJZlHaAnuQm8V8ClGhX5scnZOOBriMTPAS3wnhNbKbqsybfSArRl7cFnJMeFXKhqB7aZYtk0uEWthtja+u0ZPBUvQwPrWtr2mgF6MWU5pW2qdd0VW7EJeY3bm4uaoPxFOXM5zOBNAFGgO2nYLN75I6/Wh1IESMeWp5eJ2+tNDafOwTAGOXggViGAufjkOyLYw9eS+9MkafntEHYStlUUSi16YCO+s/hvNzp9VpF0sFDDaaL7mlhevls+jG1y9FLvCSsgOHm4Frn6iACsenHwD5xaBm5nqNCXS9BIg/qCq8lxnMbOqCx7gfAGHQ84yS8MXsNbS79dXFYt2QDNFDX7M9vdKgcQumcniwlBunIbL/kB85yv7AkmjPcQ68eiEltzD9HWlJ'
ldap_get_values_len
ldap_get_values_len
ldap_get_values_len
ldap_msgfree
rlm_ldap (ldap): Released connection (0)
rlm_ldap (ldap): Closing connection (1), from 3 unused connections
ldap_free_connection 1 1
ldap_send_unbind
ldap_free_connection: actually freed
(0)     [ldap] = updated
(0)     [expiration] = noop
(0)     [logintime] = noop
(0) pap: Unknown header {{PBKDF2_SHA256}} in Password-With-Header, re-writing to Cleartext-Password
(0) pap: Removing &control:Password-With-Header
(0)     [pap] = updated
(0)   } # authorize = updated
(0) Found Auth-Type = PAP
(0) # Executing group from file /etc/freeradius/sites-enabled/default
(0)   Auth-Type PAP {
(0) pap: Login attempt with password
(0) pap: Comparing with "known good" Cleartext-Password
(0) pap: ERROR: Cleartext password does not match "known good" password
(0) pap: Passwords don't match
(0)     [pap] = reject
(0)   } # Auth-Type PAP = reject
(0) Failed to authenticate the user
(0) Using Post-Auth-Type Reject
(0) # Executing group from file /etc/freeradius/sites-enabled/default
(0)   Post-Auth-Type REJECT {
(0) attr_filter.access_reject: EXPAND %{User-Name}
(0) attr_filter.access_reject:    --> user
(0) attr_filter.access_reject: Matched entry DEFAULT at line 11
(0)     [attr_filter.access_reject] = updated
(0)     [eap] = noop
(0)     policy remove_reply_message_if_eap {
(0)       if (&reply:EAP-Message && &reply:Reply-Message) {
(0)       if (&reply:EAP-Message && &reply:Reply-Message)  -> FALSE
(0)       else {
(0)         [noop] = noop
(0)       } # else = noop
(0)     } # policy remove_reply_message_if_eap = noop
(0)   } # Post-Auth-Type REJECT = updated
(0) Delaying response for 1.000000 seconds
Waking up in 0.3 seconds.
Waking up in 0.6 seconds.
(0) Sending delayed response
(0) Sent Access-Reject Id 25 from 192.168.0.3:1812 to 1.1.1.1:2997 length 20
Waking up in 3.9 seconds.
(0) Cleaning up request packet ID 25 with timestamp +33
Ready to process requests

Full backtrace from LLDB or GDB

Unsure how to do this one

mschap.log
pap.log
chap.log
eap.log
ldap.log
default.log
inner-tunnel.log
radconf.log

@alandekok

This comment has been minimized.

Copy link
Member

commented May 3, 2019

Nothing in the documentation says we support PBKDF2_SHA256.

As always, patches are welcome.

@alandekok alandekok closed this May 3, 2019

@arr2036

This comment has been minimized.

Copy link
Member

commented May 3, 2019

We do actually have full support for this but only in master branch.

@arr2036

This comment has been minimized.

Copy link
Member

commented May 3, 2019

Supported formats are:

	/*
	 *	If it doesn't begin with a $ assume
	 *	It's Crypt::PBKDF2 LDAP format
	 *
	 *	{X-PBKDF2}<digest>:<b64 rounds>:<b64_salt>:<b64_hash>
	 */

	/*
	 *	Crypt::PBKDF2 Crypt format
	 *
	 *	$PBKDF2$<digest>:<rounds>:<b64_salt>$<b64_hash>
	 */

	/*
	 *	Python's passlib format
	 *
	 *	$pbkdf2-<digest>$<rounds>$<alt_b64_salt>$<alt_b64_hash>
	 *
	 *	Note: Our base64 functions also work with alt_b64
	 */
@arr2036

This comment has been minimized.

Copy link
Member

commented May 3, 2019

If you can provide some documentation for your LDAP based format I'd be happy to add something to parse it

@arr2036 arr2036 reopened this May 3, 2019

@cyb3rc0d3

This comment has been minimized.

Copy link
Author

commented May 5, 2019

Hi,

It appears to be using the following method from the latest Password Vault from FreeIPA:
https://www.freeipa.org/page/V4/Password_Vault_2.0

Which is:

DK = PBKDF2(PRF, Password, Salt, c, dkLen)
where:

PRF is a pseudorandom function of two parameters with output length hLen (e.g., a keyed HMAC)
Password is the master password from which a derived key is generated
Salt is a sequence of bits, known as a cryptographic salt
c is the number of iterations desired
dkLen is the desired bit-length of the derived key
DK is the generated derived key

The site has documentation on how to do in C.

@arr2036

This comment has been minimized.

Copy link
Member

commented May 6, 2019

That site has no information on how to turn {PBKDF2_SHA256}AAAIAElQ9+kOExv12HALK9/ta+VKE79Jz9Eky+Ta0/FJZlHaAnuQm8V8ClGhX5scnZOOBriMTPAS3wnhNbKbqsybfSArRl7cFnJMeFXKhqB7aZYtk0uEWthtja+u0ZPBUvQwPrWtr2mgF6MWU5pW2qdd0VW7EJeY3bm4uaoPxFOXM5zOBNAFGgO2nYLN75I6/Wh1IESMeWp5eJ2+tNDafOwTAGOXggViGAufjkOyLYw9eS+9MkafntEHYStlUUSi16YCO+s/hvNzp9VpF0sFDDaaL7mlhevls+jG1y9FLvCSsgOHm4Frn6iACsenHwD5xaBm5nqNCXS9BIg/qCq8lxnMbOqCx7gfAGHQ84yS8MXsNbS79dXFYt2QDNFDX7M9vdKgcQumcniwlBunIbL/kB85yv7AkmjPcQ68eiEltzD9HWlJ into parameters for the PBKDF2 function, which was what I was asking for.

@arr2036

This comment has been minimized.

Copy link
Member

commented May 15, 2019

Closing due to lack of response.

@arr2036 arr2036 closed this May 15, 2019

@cipherboy

This comment has been minimized.

Copy link
Contributor

commented May 15, 2019

Sorry, just saw this issue. If you're still interested in adding support...

Password Vault isn't where this is coming from. This is actually coming from 389ds's password hashing function. The contents above are the base64 encoded form of the following structure:

  • 4 bytes number of iterations (big endian/network order)
  • 64 bytes salt
  • then the hash (PBKDF2_HASH_LENGTH == 256 bytes).
  • PRF = HMAC-SHA256

See the pbkdf2_sha256_pw_enc_rounds function in the 389ds source.

In the above example (converted to hex for ease):

  • iterations = 00000800 = 2048
  • salt = 4950f7e90e131bf5d8700b2bdfed6be54a13bf49cfd124cbe4dad3f1496651da027b909bc57c0a51a15f9b1c9d938e06b88c4cf012df09e135b29baacc9b7d20
  • hash = 2b465edc16724c7855ca86a07b69962d934b845ad86d8dafaed193c152f4303eb5adaf69a017a316539a56daa75dd155bb109798ddb9b8b9aa0fc45397339cce04d0051a03b69d82cdef923afd687520448c796a79789dbeb4d0da7cec13006397820562180b9f8e43b22d8c3d792fbd32469f9ed107612b655144a2d7a6023beb3f86f373a7d569174b050c369a2fb9a585ebe5b3e8c6d72f452ef092b203879b816b9fa8800ac7a71f00f9c5a066e67a8d0974bd04883fa82abc9719cc6cea82c7b81f0061d0f38c92f0c5ec35b4bbf5d5c562dd900cd1435fb33dbdd2a0710ba67278b0941ba721b2ff901f39cafec09268cf710ebc7a2125b730fd1d6949

(Thanks @tiran for your help figuring out that this wasn't Vault's problem and pointing me to 389ds).

@arr2036 arr2036 reopened this May 15, 2019

@arr2036

This comment has been minimized.

Copy link
Member

commented May 15, 2019

Perfect, thanks for the info.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
You can’t perform that action at this time.