Reputation: 17
I am attempting to setup a FreeRadius Server (3.0.21) with Python Module. I just keep getting the error below when I try starting radiusd(radiusd -X):
/usr/local/Cellar/freeradius-server/3.0.21/etc/raddb/mods-config/files/authorize[1]: Parse error (check) for entry DEFAULT: Unknown or invalid value "Python" for attribute Auth-Type
Failed reading /usr/local/Cellar/freeradius-server/3.0.21/etc/raddb/mods-config/files/authorize
/usr/local/Cellar/freeradius-server/3.0.21/etc/raddb/mods-enabled/files[9]: Instantiation failed for module "files"
Also I noticed the following which I am not sure is related
# Instantiating module "python" from file /usr/local/Cellar/freeradius-server/3.0.21/etc/raddb/mods-enabled/python
Python version: 2.7.16 (default, Apr 17 2020, 18:29:03) [GCC 4.2.1 Compatible Apple LLVM 11.0.3 (clang-1103.0.29.20) (-macos10.15-objc-
*** instantiate ***
None
As per documentation, I have completed the following:
-added "DEFAULT Auth-type := python" as the first and only uncommented line in /etc/raddb/users
-added the module location to /etc/raddb/mods-enabled/python
-added the Auth-Type declarations in the site file (/etc/raddb/sites-available/default) see below.
Here are the contents of the relevant files with comments removed (these things are 99% comments) /etc/raddb/users
DEFAULT Auth-Type := python
/etc/raddb/mods-enabled/python
module = example
python_path = ${modconfdir}/${.:name}
mod_instantiate = ${.module}
#########Uncommented the following line #######
func_instantiate = instantiate
mod_detach = ${.module}
# func_detach = detach
/etc/raddb/sites-enabled/default
**authorize**
#
# If you want to have a log of authentication requests,
# un-comment the following line.
# auth_log
## Enable Python ##
python
#####
#
# The chap module will set 'Auth-Type := CHAP' if we are
# handling a CHAP request and Auth-Type has not already been set
chap
authenticate Auth-Type Pyton { python }
I also referred a similar question freeRadius Perl Module Issue regarding Perl and tried enabling Perl which works fine for me but Python doesn't work following the same steps.
and finally the verbose startup log
FreeRADIUS Version 3.0.21
Copyright (C) 1999-2019 The FreeRADIUS server project and contributors
There is NO warranty; not even for MERCHANTABILITY or FITNESS FOR A
PARTICULAR PURPOSE
You may redistribute copies of FreeRADIUS under the terms of the
GNU General Public License
For more information about these matters, see the file named COPYRIGHT
Starting - reading configuration files ...
including dictionary file /usr/local/Cellar/freeradius-server/3.0.21/share/freeradius/dictionary
including dictionary file /usr/local/Cellar/freeradius-server/3.0.21/share/freeradius/dictionary.dhcp
including dictionary file /usr/local/Cellar/freeradius-server/3.0.21/share/freeradius/dictionary.vqp
including dictionary file /usr/local/Cellar/freeradius-server/3.0.21/etc/raddb/dictionary
including configuration file /usr/local/Cellar/freeradius-server/3.0.21/etc/raddb/radiusd.conf
including configuration file /usr/local/Cellar/freeradius-server/3.0.21/etc/raddb/proxy.conf
including configuration file /usr/local/Cellar/freeradius-server/3.0.21/etc/raddb/clients.conf
including files in directory /usr/local/Cellar/freeradius-server/3.0.21/etc/raddb/sites-enabled/
including configuration file /usr/local/Cellar/freeradius-server/3.0.21/etc/raddb/sites-enabled/default
including configuration file /usr/local/Cellar/freeradius-server/3.0.21/etc/raddb/sites-enabled/inner-tunnel
main {
name = "radiusd"
prefix = "/usr/local/Cellar/freeradius-server/3.0.21"
localstatedir = "/usr/local/var"
sbindir = "/usr/local/Cellar/freeradius-server/3.0.21/bin"
logdir = "/usr/local/var/log/radius"
run_dir = "/usr/local/var/run/radiusd"
libdir = "/usr/local/Cellar/freeradius-server/3.0.21/lib"
radacctdir = "/usr/local/var/log/radius/radacct"
hostname_lookups = no
max_request_time = 30
cleanup_delay = 5
max_requests = 16384
pidfile = "/usr/local/var/run/radiusd/radiusd.pid"
checkrad = "/usr/local/Cellar/freeradius-server/3.0.21/bin/checkrad"
debug_level = 0
proxy_requests = yes
log {
stripped_names = no
auth = no
auth_badpass = no
auth_goodpass = no
colourise = yes
msg_denied = "You are already logged in - access denied"
}
resources {
}
security {
max_attributes = 200
reject_delay = 1.000000
status_server = yes
allow_vulnerable_openssl = "no"
}
}
radiusd: #### Loading Realms and Home Servers ####
proxy server {
retry_delay = 5
retry_count = 3
default_fallback = no
dead_time = 120
wake_all_if_all_dead = no
}
home_server localhost {
ipaddr = 127.0.0.1
port = 1812
type = "auth"
secret = <<< secret >>>
response_window = 20.000000
response_timeouts = 1
max_outstanding = 65536
zombie_period = 40
status_check = "status-server"
ping_interval = 30
check_interval = 30
check_timeout = 4
num_answers_to_alive = 3
revive_interval = 120
limit {
max_connections = 16
max_requests = 0
lifetime = 0
idle_timeout = 0
}
coa {
irt = 2
mrt = 16
mrc = 5
mrd = 30
}
}
home_server_pool my_auth_failover {
type = fail-over
home_server = localhost
}
realm example.com {
auth_pool = my_auth_failover
}
realm LOCAL {
}
radiusd: #### Loading Clients ####
client localhost {
ipaddr = 127.0.0.1
require_message_authenticator = no
secret = <<< secret >>>
nas_type = "other"
proto = "*"
limit {
max_connections = 16
lifetime = 0
idle_timeout = 30
}
}
client localhost_ipv6 {
ipv6addr = ::1
require_message_authenticator = no
secret = <<< secret >>
}
Found debugger attached
radiusd: #### Instantiating modules ####
modules {
# Loaded module rlm_detail
# Loading module "auth_log" from file /usr/local/Cellar/freeradius-server/3.0.21/etc/raddb/mods-enabled/detail.log
detail auth_log {
filename = "/usr/local/var/log/radius/radacct/%{%{Packet-Src-IP-Address}:-%{Packet-Src-IPv6-Address}}/auth-detail-%Y%m%d"
header = "%t"
permissions = 384
locking = no
escape_filenames = no
log_packet_header = no
}
# Loading module "reply_log"
detail reply_log {
filename = "/usr/local/var/log/radius/radacct/%{%{Packet-Src-IP-Address}:-%{Packet-Src-IPv6-Address}}/reply-detail-%Y%m%d"
header = "%t"
permissions = 384
locking = no
escape_filenames = no
log_packet_header = no
}
detail pre_proxy_log {
filename = "/usr/local/var/log/radius/radacct/%{%{Packet-Src-IP-Address}:-%{Packet-Src-IPv6-Address}}/pre-proxy-detail-%Y%m%d"
header = "%t"
permissions = 384
locking = no
escape_filenames = no
log_packet_header = no
}
# Loading module "post_proxy_log"
filename = "/usr/local/var/log/radius/radacct/%{%{Packet-Src-IP-Address}:-%{Packet-Src-IPv6-Address}}/post-proxy-detail-%Y%m%d"
header = "%t"
permissions = 384
locking = no
escape_filenames = no
log_packet_header = no
}
# Loading module "eap"
eap {
default_eap_type = "md5"
timer_expire = 60
ignore_unknown_eap_types = no
cisco_accounting_username_bug = no
max_sessions = 16384
}
# Loaded module rlm_exec
# Loading module "echo"
exec echo {
wait = yes
program = "/bin/echo %{User-Name}"
input_pairs = "request"
output_pairs = "reply"
shell_escape = yes
}
# Loaded module rlm_python
# Loading module "python" from file /usr/local/Cellar/freeradius-server/3.0.21/etc/raddb/mods-enabled/python
python {
mod_instantiate = "example"
func_instantiate = "instantiate"
mod_authorize = "example"
func_authorize = "authorize"
mod_authenticate = "example"
mod_preacct = "example"
mod_accounting = "example"
mod_checksimul = "example"
mod_pre_proxy = "example"
mod_post_proxy = "example"
mod_post_auth = "example"
mod_recv_coa = "example"
mod_send_coa = "example"
mod_detach = "example"
python_path = "/usr/local/Cellar/freeradius-server/3.0.21/etc/raddb/mods-config/python"
cext_compat = yes
pass_all_vps = no
pass_all_vps_dict = no
}
# Loaded module rlm_utf8
# Loading module "utf8"
# Loaded module rlm_ldap
# Loading module "ldap" from file /usr/local/Cellar/freeradius-server/3.0.21/etc/raddb/mods-enabled/ldap
ldap {
server = "localhost"
port = 389
identity = "cn=Directory Manager"
password = <<< secret >>>
sasl {
}
user_dn = "LDAP-UserDn"
user {
scope = "sub"
access_positive = yes
sasl {
}
}
client {
filter = "(objectClass=radiusClient)"
scope = "sub"
base_dn = "ou=people,ou=identities"
}
profile {
}
options {
ldap_debug = 40
chase_referrals = yes
rebind = yes
net_timeout = 1
res_timeout = 10
srv_timelimit = 3
idle = 60
probes = 3
interval = 3
}
tls {
start_tls = no
}
}
# Loading module "fail" from file /usr/local/Cellar/freeradius-server/3.0.21/etc/raddb/mods-enabled/always
always fail {
rcode = "fail"
simulcount = 0
mpp = no
}
# Loading module "ok" from file /usr/local/Cellar/freeradius-server/3.0.21/etc/raddb/mods-enabled/always
always ok {
rcode = "ok"
simulcount = 0
mpp = no
}
# Loading module "handled" from file /usr/local/Cellar/freeradius-server/3.0.21/etc/raddb/mods-enabled/always
always handled {
rcode = "handled"
simulcount = 0
mpp = no
}
# Loading module "userlock" from file /usr/local/Cellar/freeradius-server/3.0.21/etc/raddb/mods-enabled/always
always userlock {
rcode = "userlock"
simulcount = 0
mpp = no
}
# Loaded module rlm_perl
# Loading module "perl" from file /usr/local/Cellar/freeradius-server/3.0.21/etc/raddb/mods-enabled/perl
perl {
filename = "/usr/local/Cellar/freeradius-server/3.0.21/etc/raddb/mods-config/perl/example.pl"
func_authorize = "authorize"
func_authenticate = "authenticate"
func_post_auth = "post_auth"
func_accounting = "accounting"
func_preacct = "preacct"
func_checksimul = "checksimul"
func_detach = "detach"
func_xlat = "xlat"
func_pre_proxy = "pre_proxy"
func_post_proxy = "post_proxy"
func_recv_coa = "recv_coa"
func_send_coa = "send_coa"
perl_flags = "-T"
}
# Loaded module rlm_digest
# Loading module "digest" from file /usr/local/Cellar/freeradius-server/3.0.21/etc/raddb/mods-enabled/digest
# Loaded module rlm_date
# Loading module "date" from file /usr/local/Cellar/freeradius-server/3.0.21/etc/raddb/mods-enabled/date
date {
format = "%b %e %Y %H:%M:%S %Z"
utc = no
}
# Loading module "wispr2date" from file /usr/local/Cellar/freeradius-server/3.0.21/etc/raddb/mods-enabled/date
date wispr2date {
format = "%Y-%m-%dT%H:%M:%S"
utc = no
}
# Loaded module rlm_preprocess
# Loading module "preprocess" from file /usr/local/Cellar/freeradius-server/3.0.21/etc/raddb/mods-enabled/preprocess
preprocess {
huntgroups = "/usr/local/Cellar/freeradius-server/3.0.21/etc/raddb/mods-config/preprocess/huntgroups"
hints = "/usr/local/Cellar/freeradius-server/3.0.21/etc/raddb/mods-config/preprocess/hints"
with_ascend_hack = no
ascend_channels_per_line = 23
with_ntdomain_hack = no
with_specialix_jetstream_hack = no
with_cisco_vsa_hack = no
with_alvarion_vsa_hack = no
}
# Loaded module rlm_pap
# Loading module "pap" from file /usr/local/Cellar/freeradius-server/3.0.21/etc/raddb/mods-enabled/pap
pap {
normalise = yes
}
# Loaded module rlm_expr
# Loading module "expr" from file /usr/local/Cellar/freeradius-server/3.0.21/etc/raddb/mods-enabled/expr
expr {
safe_characters = "@abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ0123456789.-_: /äéöüàâæçèéêëîïôœùûüaÿÄÉÖÜßÀÂÆÇÈÉÊËÎÏÔŒÙÛÜŸ"
}
# Loaded module rlm_radutmp
# Loading module "radutmp" from file /usr/local/Cellar/freeradius-server/3.0.21/etc/raddb/mods-enabled/radutmp
radutmp {
filename = "/usr/local/var/log/radius/radutmp"
username = "%{User-Name}"
case_sensitive = yes
check_with_nas = yes
permissions = 384
caller_id = yes
}
# Loaded module rlm_unix
# Loading module "unix" from file /usr/local/Cellar/freeradius-server/3.0.21/etc/raddb/mods-enabled/unix
unix {
radwtmp = "/usr/local/var/log/radius/radwtmp"
}
Creating attribute Unix-Group
# Loading module "detail" from file /usr/local/Cellar/freeradius-server/3.0.21/etc/raddb/mods-enabled/detail
detail {
filename = "/usr/local/var/log/radius/radacct/%{%{Packet-Src-IP-Address}:-%{Packet-Src-IPv6-Address}}/detail-%Y%m%d"
header = "%t"
permissions = 384
locking = no
escape_filenames = no
log_packet_header = no
}
# Loaded module rlm_attr_filter
attr_filter attr_filter.post-proxy {
filename = "/usr/local/Cellar/freeradius-server/3.0.21/etc/raddb/mods-config/attr_filter/post-proxy"
key = "%{Realm}"
relaxed = no
}
# Loading module "attr_filter.pre-proxy" from file /usr/local/Cellar/freeradius-server/3.0.21/etc/raddb/mods-enabled/attr_filter
attr_filter attr_filter.pre-proxy {
filename = "/usr/local/Cellar/freeradius-server/3.0.21/etc/raddb/mods-config/attr_filter/pre-proxy"
key = "%{Realm}"
relaxed = no
}
# Loading module "attr_filter.access_reject" from file /usr/local/Cellar/freeradius-server/3.0.21/etc/raddb/mods-enabled/attr_filter
attr_filter attr_filter.access_reject {
filename = "/usr/local/Cellar/freeradius-server/3.0.21/etc/raddb/mods-config/attr_filter/access_reject"
key = "%{User-Name}"
relaxed = no
}
# Loading module "attr_filter.access_challenge" from file /usr/local/Cellar/freeradius-server/3.0.21/etc/raddb/mods-enabled/attr_filter
attr_filter attr_filter.access_challenge {
filename = "/usr/local/Cellar/freeradius-server/3.0.21/etc/raddb/mods-config/attr_filter/access_challenge"
key = "%{User-Name}"
relaxed = no
}
# Loading module "exec" from file /usr/local/Cellar/freeradius-server/3.0.21/etc/raddb/mods-enabled/exec
exec {
wait = no
input_pairs = "request"
shell_escape = yes
timeout = 10
}
# Loaded module rlm_files
# Loading module "files" from file /usr/local/Cellar/freeradius-server/3.0.21/etc/raddb/mods-enabled/files
files {
filename = "/usr/local/Cellar/freeradius-server/3.0.21/etc/raddb/mods-config/files/authorize"
acctusersfile = "/usr/local/Cellar/freeradius-server/3.0.21/etc/raddb/mods-config/files/accounting"
preproxy_usersfile = "/usr/local/Cellar/freeradius-server/3.0.21/etc/raddb/mods-config/files/pre-proxy"
}
# Loaded module rlm_replicate
# Loading module "replicate" from file /usr/local/Cellar/freeradius-server/3.0.21/etc/raddb/mods-enabled/replicate
# Loaded module rlm_chap
# Loading module "chap" from file /usr/local/Cellar/freeradius-server/3.0.21/etc/raddb/mods-enabled/chap
# Loaded module rlm_unpack
# Loading module "unpack" from file /usr/local/Cellar/freeradius-server/3.0.21/etc/raddb/mods-enabled/unpack
# Loaded module rlm_logintime
# Loading module "logintime" from file /usr/local/Cellar/freeradius-server/3.0.21/etc/raddb/mods-enabled/logintime
logintime {
minimum_timeout = 60
}
# Loaded module rlm_mschap
# Loading module "mschap" from file /usr/local/Cellar/freeradius-server/3.0.21/etc/raddb/mods-enabled/mschap
mschap {
use_mppe = yes
require_encryption = no
require_strong = no
with_ntdomain_hack = yes
passchange {
}
allow_retry = yes
winbind_retry_with_normalised_username = no
use_open_directory = yes
}
# Instantiating module "eap" from file /usr/local/Cellar/freeradius-server/3.0.21/etc/raddb/mods-enabled/eap
# Linked to sub-module rlm_eap_md5
# Linked to sub-module rlm_eap_leap
# Linked to sub-module rlm_eap_gtc
gtc {
challenge = "Password: "
auth_type = "PAP"
}
# Linked to sub-module rlm_eap_tls
tls {
tls = "tls-common"
}
tls-config tls-common {
verify_depth = 0
ca_path = "/usr/local/Cellar/freeradius-server/3.0.21/etc/raddb/certs"
pem_file_type = yes
private_key_file = "/usr/local/Cellar/freeradius-server/3.0.21/etc/raddb/certs/server.pem"
certificate_file = "/usr/local/Cellar/freeradius-server/3.0.21/etc/raddb/certs/server.pem"
ca_file = "/usr/local/Cellar/freeradius-server/3.0.21/etc/raddb/certs/ca.pem"
private_key_password = <<< secret >>>
dh_file = "/usr/local/Cellar/freeradius-server/3.0.21/etc/raddb/certs/dh"
fragment_size = 1024
include_length = yes
auto_chain = yes
check_crl = no
check_all_crl = no
cipher_list = "DEFAULT"
cipher_server_preference = no
ecdh_curve = "prime256v1"
disable_tlsv1 = yes
disable_tlsv1_1 = yes
tls_max_version = "1.2"
tls_min_version = "1.2"
cache {
enable = no
lifetime = 24
max_entries = 255
}
verify {
skip_if_ocsp_ok = no
}
ocsp {
enable = no
override_cert_url = yes
url = "http://127.0.0.1/ocsp/"
use_nonce = yes
timeout = 0
softfail = no
}
}
Please use tls_min_version and tls_max_version instead of disable_tlsv1
Please use tls_min_version and tls_max_version instead of disable_tlsv1_2
# Linked to sub-module rlm_eap_ttls
ttls {
tls = "tls-common"
default_eap_type = "md5"
copy_request_to_tunnel = no
use_tunneled_reply = no
virtual_server = "inner-tunnel"
include_length = yes
require_client_cert = no
}
tls: Using cached TLS configuration from previous invocation
# Linked to sub-module rlm_eap_peap
peap {
tls = "tls-common"
default_eap_type = "mschapv2"
copy_request_to_tunnel = no
use_tunneled_reply = no
proxy_tunneled_request_as_eap = yes
virtual_server = "inner-tunnel"
soh = no
require_client_cert = no
}
tls: Using cached TLS configuration from previous invocation
# Linked to sub-module rlm_eap_mschapv2
mschapv2 {
with_ntdomain_hack = no
send_error = no
}
# Instantiating module "python" from file /usr/local/Cellar/freeradius-server/3.0.21/etc/raddb/mods-enabled/python
Python version: 2.7.16 (default, Apr 17 2020, 18:29:03) [GCC 4.2.1 Compatible Apple LLVM 11.0.3 (clang-1103.0.29.20) (-macos10.15-objc-
*** instantiate ***
None
# Instantiating module "ldap" from file /usr/local/Cellar/freeradius-server/3.0.21/etc/raddb/mods-enabled/ldap
rlm_ldap: libldap vendor: OpenLDAP, version: 20428
accounting {
reference = "%{tolower:type.%{Acct-Status-Type}}"
}
post-auth {
reference = "."
}
rlm_ldap (ldap): Initialising connection pool
pool {
start = 5
min = 3
max = 32
spare = 10
uses = 0
lifetime = 0
cleanup_interval = 30
idle_timeout = 60
retry_delay = 30
spread = no
}
rlm_ldap (ldap): Opening additional connection (0), 1 of 32 pending slots used
rlm_ldap (ldap): Connecting to ldap://localhost:389
rlm_ldap (ldap): Waiting for bind result...
rlm_ldap (ldap): Bind successful
rlm_ldap (ldap): Opening additional connection (1), 1 of 31 pending slots used
rlm_ldap (ldap): Connecting to ldap://localhost:389
rlm_ldap (ldap): Waiting for bind result...
rlm_ldap (ldap): Bind successful
rlm_ldap (ldap): Opening additional connection (2), 1 of 30 pending slots used
rlm_ldap (ldap): Connecting to ldap://localhost:389
rlm_ldap (ldap): Waiting for bind result...
rlm_ldap (ldap): Bind successful
rlm_ldap (ldap): Opening additional connection (3), 1 of 29 pending slots used
rlm_ldap (ldap): Connecting to ldap://localhost:389
rlm_ldap (ldap): Waiting for bind result...
rlm_ldap (ldap): Bind successful
rlm_ldap (ldap): Opening additional connection (4), 1 of 28 pending slots used
rlm_ldap (ldap): Connecting to ldap://localhost:389
rlm_ldap (ldap): Waiting for bind result...
rlm_ldap (ldap): Bind successful
# Instantiating module "reject" from file /usr/local/Cellar/freeradius-server/3.0.21/etc/raddb/mods-enabled/always
# Instantiating module "fail" from file /usr/local/Cellar/freeradius-server/3.0.21/etc/raddb/mods-enabled/always
# Instantiating module "ok" from file /usr/local/Cellar/freeradius-server/3.0.21/etc/raddb/mods-enabled/always
# Instantiating module "handled" from file /usr/local/Cellar/freeradius-server/3.0.21/etc/raddb/mods-enabled/always
# Instantiating module "invalid" from file /usr/local/Cellar/freeradius-server/3.0.21/etc/raddb/mods-enabled/always
# Instantiating module "userlock" from file /usr/local/Cellar/freeradius-server/3.0.21/etc/raddb/mods-enabled/always
# Instantiating module "notfound" from file /usr/local/Cellar/freeradius-server/3.0.21/etc/raddb/mods-enabled/always
# Instantiating module "noop" from file /usr/local/Cellar/freeradius-server/3.0.21/etc/raddb/mods-enabled/always
# Instantiating module "updated" from file /usr/local/Cellar/freeradius-server/3.0.21/etc/raddb/mods-enabled/always
# Instantiating module "perl" from file /usr/local/Cellar/freeradius-server/3.0.21/etc/raddb/mods-enabled/perl
# Instantiating module "preprocess" from file /usr/local/Cellar/freeradius-server/3.0.21/etc/raddb/mods-enabled/preprocess
reading pairlist file /usr/local/Cellar/freeradius-server/3.0.21/etc/raddb/mods-config/preprocess/huntgroups
reading pairlist file /usr/local/Cellar/freeradius-server/3.0.21/etc/raddb/mods-config/preprocess/hints
# Instantiating module "pap" from file /usr/local/Cellar/freeradius-server/3.0.21/etc/raddb/mods-enabled/pap
# Instantiating module "linelog" from file /usr/local/Cellar/freeradius-server/3.0.21/etc/raddb/mods-enabled/linelog
# Instantiating module "log_accounting" from file /usr/local/Cellar/freeradius-server/3.0.21/etc/raddb/mods-enabled/linelog
# Instantiating module "detail" from file /usr/local/Cellar/freeradius-server/3.0.21/etc/raddb/mods-enabled/detail
# Instantiating module "attr_filter.post-proxy" from file /usr/local/Cellar/freeradius-server/3.0.21/etc/raddb/mods-enabled/attr_filter
reading pairlist file /usr/local/Cellar/freeradius-server/3.0.21/etc/raddb/mods-config/attr_filter/post-proxy
# Instantiating module "attr_filter.pre-proxy" from file /usr/local/Cellar/freeradius-server/3.0.21/etc/raddb/mods-enabled/attr_filter
reading pairlist file /usr/local/Cellar/freeradius-server/3.0.21/etc/raddb/mods-config/attr_filter/pre-proxy
# Instantiating module "attr_filter.access_reject" from file /usr/local/Cellar/freeradius-server/3.0.21/etc/raddb/mods-enabled/attr_filter
reading pairlist file /usr/local/Cellar/freeradius-server/3.0.21/etc/raddb/mods-config/attr_filter/access_reject
# Instantiating module "attr_filter.access_challenge" from file /usr/local/Cellar/freeradius-server/3.0.21/etc/raddb/mods-enabled/attr_filter
reading pairlist file /usr/local/Cellar/freeradius-server/3.0.21/etc/raddb/mods-config/attr_filter/access_challenge
# Instantiating module "attr_filter.accounting_response" from file /usr/local/Cellar/freeradius-server/3.0.21/etc/raddb/mods-enabled/attr_filter
reading pairlist file /usr/local/Cellar/freeradius-server/3.0.21/etc/raddb/mods-config/attr_filter/accounting_response
# Instantiating module "files" from file /usr/local/Cellar/freeradius-server/3.0.21/etc/raddb/mods-enabled/files
reading pairlist file /usr/local/Cellar/freeradius-server/3.0.21/etc/raddb/mods-config/files/authorize
/usr/local/Cellar/freeradius-server/3.0.21/etc/raddb/mods-config/files/authorize[1]: Parse error (check) for entry DEFAULT: Unknown or invalid value "Python" for attribute Auth-Type
Failed reading /usr/local/Cellar/freeradius-server/3.0.21/etc/raddb/mods-config/files/authorize
/usr/local/Cellar/freeradius-server/3.0.21/etc/raddb/mods-enabled/files[9]: Instantiation failed for module "files"
Upvotes: 0
Views: 2373
Reputation: 17
Seems, I have found the answer by following the other post
Added the following to /etc/raddb/dictionary
VALUE Auth-Type python 100
I can see now that the module is being initialised. But somehow the authentication is failing which needs bit more investigation
Test Command and output
radtest bob hello localhost 1812 testing123
Sent Access-Request Id 28 from 0.0.0.0:51983 to 127.0.0.1:1812 length 73
User-Name = "bob"
User-Password = "hello"
NAS-IP-Address = 192.168.0.236
NAS-Port = 1812
Message-Authenticator = 0x00
Cleartext-Password = "hello"
Received Access-Reject Id 28 from 127.0.0.1:1812 to 127.0.0.1:51983 length 43
Reply-Message = "Hello from rlm_python"
(0) -: Expected Access-Accept got Access-Reject
Logs from raddb
(0) Received Access-Request Id 28 from 127.0.0.1:51983 to 127.0.0.1:1812 length 73
(0) User-Name = "bob"
(0) User-Password = "hello"
(0) NAS-IP-Address = 192.168.0.236
(0) NAS-Port = 1812
(0) Message-Authenticator = 0x7d14fda6b89582a0a18ac865fc967103
(0) # Executing section authorize from file /usr/local/Cellar/freeradius-server/3.0.21/etc/raddb/sites-enabled/default
(0) authorize {
(0) policy filter_username {
(0) if (&User-Name) {
(0) if (&User-Name) -> TRUE
(0) if (&User-Name) {
(0) if (&User-Name =~ / /) {
(0) if (&User-Name =~ / /) -> FALSE
(0) if (&User-Name =~ /@[^@]*@/ ) {
(0) if (&User-Name =~ /@[^@]*@/ ) -> FALSE
(0) if (&User-Name =~ /\.\./ ) {
(0) if (&User-Name =~ /\.\./ ) -> FALSE
(0) if ((&User-Name =~ /@/) && (&User-Name !~ /@(.+)\.(.+)$/)) {
(0) if ((&User-Name =~ /@/) && (&User-Name !~ /@(.+)\.(.+)$/)) -> FALSE
(0) if (&User-Name =~ /\.$/) {
(0) if (&User-Name =~ /\.$/) -> FALSE
(0) if (&User-Name =~ /@\./) {
(0) if (&User-Name =~ /@\./) -> FALSE
(0) } # if (&User-Name) = notfound
(0) } # policy filter_username = notfound
(0) [preprocess] = ok
*** authorize ***
*** radlog call in authorize ***
(('User-Name', 'bob'), ('User-Password', 'hello'), ('NAS-IP-Address', '192.168.0.236'), ('NAS-Port', '1812'), ('Message-Authenticator', '0x7d14fda6b89582a0a18ac865fc967103'), ('Event-Timestamp', 'Jul 16 2020 09:14:33 BST'))
{}
authorize - 'reply:Reply-Message' = 'Hello from rlm_python'
authorize - 'config:Cleartext-Password' = 'hello'
(0) [python] = ok
(0) [chap] = noop
(0) [mschap] = noop
(0) [digest] = noop
(0) suffix: Checking for suffix after "@"
(0) suffix: No '@' in User-Name = "bob", looking up realm NULL
(0) suffix: No such realm "NULL"
(0) [suffix] = noop
(0) eap: No EAP-Message, not doing EAP
(0) [eap] = noop
(0) files: users: Matched entry DEFAULT at line 1
(0) [files] = ok
rlm_ldap (ldap): Closing connection (0): Hit idle_timeout, was idle for 74 seconds
rlm_ldap (ldap): Closing connection (1): Hit idle_timeout, was idle for 74 seconds
rlm_ldap (ldap): Closing connection (2): Hit idle_timeout, was idle for 74 seconds
rlm_ldap (ldap): You probably need to lower "min"
rlm_ldap (ldap): Closing connection (3): Hit idle_timeout, was idle for 74 seconds
rlm_ldap (ldap): You probably need to lower "min"
rlm_ldap (ldap): Closing connection (4): Hit idle_timeout, was idle for 74 seconds
rlm_ldap (ldap): You probably need to lower "min"
rlm_ldap (ldap): 0 of 0 connections in use. You may need to increase "spare"
rlm_ldap (ldap): Opening additional connection (5), 1 of 32 pending slots used
rlm_ldap (ldap): Connecting to ldap://localhost:389
rlm_ldap (ldap): Waiting for bind result...
rlm_ldap (ldap): Bind successful
rlm_ldap (ldap): Reserved connection (5)
(0) ldap: EXPAND (uid=%{%{Stripped-User-Name}:-%{User-Name}})
(0) ldap: --> (uid=bob)
(0) ldap: Performing search in "ou=people,ou=identities" with filter "(uid=bob)", scope "sub"
(0) ldap: Waiting for search result...
(0) ldap: Search returned no results
rlm_ldap (ldap): Released connection (5)
Need 2 more connections to reach min connections (3)
rlm_ldap (ldap): Opening additional connection (6), 1 of 31 pending slots used
rlm_ldap (ldap): Connecting to ldap://localhost:389
rlm_ldap (ldap): Waiting for bind result...
rlm_ldap (ldap): Bind successful
(0) [ldap] = notfound
(0) [expiration] = noop
(0) [logintime] = noop
(0) pap: WARNING: Auth-Type already set. Not setting to PAP
(0) [pap] = noop
(0) } # authorize = ok
(0) Found Auth-Type = python
(0) Auth-Type sub-section not found. Ignoring.
(0) # Executing group from file /usr/local/Cellar/freeradius-server/3.0.21/etc/raddb/sites-enabled/default
(0) Failed to authenticate the user
(0) Using Post-Auth-Type Reject
(0) # Executing group from file /usr/local/Cellar/freeradius-server/3.0.21/etc/raddb/sites-enabled/default
(0) Post-Auth-Type REJECT {
(0) attr_filter.access_reject: EXPAND %{User-Name}
(0) attr_filter.access_reject: --> bob
(0) attr_filter.access_reject: Matched entry DEFAULT at line 11
(0) [attr_filter.access_reject] = updated
(0) [eap] = noop
(0) policy remove_reply_message_if_eap {
(0) if (&reply:EAP-Message && &reply:Reply-Message) {
(0) if (&reply:EAP-Message && &reply:Reply-Message) -> FALSE
(0) else {
(0) [noop] = noop
(0) } # else = noop
(0) } # policy remove_reply_message_if_eap = noop
(0) } # Post-Auth-Type REJECT = updated
(0) Delaying response for 1.000000 seconds
Waking up in 0.2 seconds.
Waking up in 0.7 seconds.
(0) Sending delayed response
(0) Sent Access-Reject Id 28 from 127.0.0.1:1812 to 127.0.0.1:51983 length 43
(0) Reply-Message = "Hello from rlm_python"
Waking up in 3.9 seconds.
(0) Cleaning up request packet ID 28 with timestamp +74
Ready to process requests
Upvotes: 0