Cisco SG 350x Grundkonfiguration

#
78:00:9E:xx:xx:xx Auth-Type := EAP, User-Password:= "78:00:xx:xx:xx:xx"  
Tunnel-Type = "VLAN",  
Tunnel-Medium-Type = "IEEE-802",  
Tunnel-Private-Group-ID = "10"  
#

Job for freeradius.service failed because the control process exited with error code.
See "systemctl status freeradius.service" and "journalctl -xe" for details.  

-- Subject: Unit process exited
-- Defined-By: systemd
-- Support: https://www.debian.org/support
--
-- An ExecStartPre= process belonging to unit freeradius.service has exited.
--
-- The process' exit code is 'exited' and its exit status is 1.  
Okt 05 14:29:07 Blackberry systemd[1]: freeradius.service: Failed with result 'exit-code'.  
-- Subject: Unit failed
-- Defined-By: systemd
-- Support: https://www.debian.org/support
--
-- The unit freeradius.service has entered the 'failed' state with result 'exit-code'.  
Okt 05 14:29:07 Blackberry systemd[1]: Failed to start FreeRADIUS multi-protocol policy server.
-- Subject: A start job for unit freeradius.service has failed
-- Defined-By: systemd
-- Support: https://www.debian.org/support
--
-- A start job for unit freeradius.service has finished with a failure.
--
-- The job identifier is 23777 and the job result is failed.

reading pairlist file /etc/freeradius/3.0/mods-config/files/authorize
/etc/freeradius/3.0/mods-config/files/authorize[223]: Parse error (check) for entry Tunnel-Type: Invalid attribute name
Failed reading /etc/freeradius/3.0/mods-config/files/authorize
/etc/freeradius/3.0/mods-enabled/files[9]: Instantiation failed for module "files"  

2147483351	2019-Oct-05 18:23:32	Notice	%RADIUSSERVER-N-AUTHFAILURE: Authentication Failure, User: 78:00:9E:xx:xx:xx, dot1x; NAS: 172.16.1.1; Reason: Not supported EAP Method  

(3) Received Access-Request Id 6 from 172.16.1.10:49205 to 172.16.50.100:1812 length 147
Dropping packet without response because of error: Received packet from 172.16.1.10 with invalid Message                      -Authenticator!  (Shared secret is incorrect.)

(0) Received Access-Request Id 12 from 172.16.1.10:49205 to 172.16.50.100:1812 length 163
(0)   NAS-IP-Address = 172.16.1.10
(0)   NAS-Port-Type = Ethernet
(0)   NAS-Port = 2
(0)   User-Name = "28:80:xx:xx:xx:xx"  
(0)   User-Password = "28:80:xx:xx:xx:xx"  
(0)   Service-Type = Call-Check
(0)   Acct-Session-Id = "05000013"  
(0)   Called-Station-Id = "C4-C6-xx-xx-xx-xx"  
(0)   Calling-Station-Id = "28-80-23-xx-xx-xx"  
(0)   Message-Authenticator = 0x75654636ca4adc9efe3bb0e89abaa8fd
(0) # Executing section authorize from file /etc/freeradius/3.0/sites-enabled/default
(0)   authorize {
(0)     policy filter_username {
(0)       if (&User-Name) {
(0)       if (&User-Name)  -> TRUE
(0)       if (&User-Name)  {
(0)         if (&User-Name =~ / /) {
(0)         if (&User-Name =~ / /)  -> FALSE
(0)         if (&User-Name =~ /@[^@]*@/ ) {
(0)         if (&User-Name =~ /@[^@]*@/ )  -> FALSE
(0)         if (&User-Name =~ /\.\./ ) {
(0)         if (&User-Name =~ /\.\./ )  -> FALSE
(0)         if ((&User-Name =~ /@/) && (&User-Name !~ /@(.+)\.(.+)$/))  {
(0)         if ((&User-Name =~ /@/) && (&User-Name !~ /@(.+)\.(.+)$/))   -> FALSE
(0)         if (&User-Name =~ /\.$/)  {
(0)         if (&User-Name =~ /\.$/)   -> FALSE
(0)         if (&User-Name =~ /@\./)  {
(0)         if (&User-Name =~ /@\./)   -> FALSE
(0)       } # if (&User-Name)  = notfound
(0)     } # policy filter_username = notfound
(0)     [preprocess] = ok
(0)     [chap] = noop
(0)     [mschap] = noop
(0)     [digest] = noop
(0) suffix: Checking for suffix after "@"  
(0) suffix: No '@' in User-Name = "28:80:xx:xx:xx:xx", looking up realm NULL  
(0) suffix: No such realm "NULL"  
(0)     [suffix] = noop
(0) eap: No EAP-Message, not doing EAP
(0)     [eap] = noop
(0)     [files] = noop
(0)     [expiration] = noop
(0)     [logintime] = noop
(0) pap: WARNING: No "known good" password found for the user.  Not setting Auth-Type  
(0) pap: WARNING: Authentication will fail unless a "known good" password is available  
(0)     [pap] = noop
(0)   } # authorize = ok
(0) ERROR: No Auth-Type found: rejecting the user via Post-Auth-Type = Reject
(0) Failed to authenticate the user
(0) Using Post-Auth-Type Reject
(0) # Executing group from file /etc/freeradius/3.0/sites-enabled/default
(0)   Post-Auth-Type REJECT {
(0) attr_filter.access_reject: EXPAND %{User-Name}
(0) attr_filter.access_reject:    --> 28:80:xx:xx:xx:xx
(0) attr_filter.access_reject: Matched entry DEFAULT at line 11
(0)     [attr_filter.access_reject] = updated
(0)     [eap] = noop
(0)     policy remove_reply_message_if_eap {
(0)       if (&reply:EAP-Message && &reply:Reply-Message) {
(0)       if (&reply:EAP-Message && &reply:Reply-Message)  -> FALSE
(0)       else {
(0)         [noop] = noop
(0)       } # else = noop
(0)     } # policy remove_reply_message_if_eap = noop
(0)   } # Post-Auth-Type REJECT = updated
(0) Delaying response for 1.000000 seconds
Waking up in 0.3 seconds.
Waking up in 0.6 seconds.
(0) Sending delayed response
(0) Sent Access-Reject Id 12 from 172.16.50.100:1812 to 172.16.1.10:49205 length 20
Waking up in 3.9 seconds.
(0) Cleaning up request packet ID 12 with timestamp +20
Ready to process requests

#
# Rewrite called station id attribute into a standard format.
#
rewrite_calling_station_id {
        if (Calling-Station-Id =~ /([0-9a-f]{2})[-:]?([0-9a-f]{2})[-:.]?([0-9a-f]{2})[-:]?([0-9a-f]{2})[-:.]?([0-9a-f]{2})[-:]?([0-9a-f]{2})/i) {
                update request {
                        Calling-Station-Id := "%{tolower:%{1}-%{2}-%{3}-%{4}-%{5}-%{6}}"  
                }
        }
        else {
                noop
        }
}

files authorized_macs {
        # The default key attribute to use for matches.  The content
        # of this attribute is used to match the "name" of the 
        # entry.
        key = "%{Calling-Station-ID}"  

        usersfile = ${confdir}/authorized_macs

        #  If you want to use the old Cistron 'users' file 
        #  with FreeRADIUS, you should change the next line
        #  to 'compat = cistron'.  You can the copy your 'users' 
        #  file from Cistron.
        compat = no
}

00-11-22-33-44-55
        Reply-Message = "Device with MAC Address %{Calling-Station-Id} authorized  for network access"  

authorize {
        preprocess

        # If cleaning up the Calling-Station-Id...
        rewrite_calling_station_id

        # Now check against the authorized_macs file
        authorized_macs

        if (!ok) {
                # No match was found, so reject
                reject
        }
        else {
                # The MAC address was found, so update Auth-Type
                # to accept this auth.
                update control {
                        Auth-Type := Accept
                }
        }
}

45. (0) pap: WARNING: No "known good" password found for the user.  Not setting Auth-Type  
46. (0) pap: WARNING: Authentication will fail unless a "known good" password is available  

78:00:9E:xx:xx:xx Auth-Type := EAP, User-Password:= "78:00:xx:xx:xx:xx"  

Encrypted — A key is used to encrypt communications by using MD5. To use encryption, enter the key in encrypted form.
Plaintext — If you do not have an encrypted key string (from another device), enter the key string in plaintext mode. The encrypted key string is generated and displayed.

Ready to process requests
(0) Received Access-Request Id 0 from 172.16.10.20:53894 to 172.16.50.100:1812 length 49
(0)   User-Name = "Christian"  
(0)   User-Password = "Schetti"  
(0) # Executing section authorize from file /etc/freeradius/3.0/sites-enabled/default
(0)   authorize {
(0)     policy filter_username {
(0)       if (&User-Name) {
(0)       if (&User-Name)  -> TRUE
(0)       if (&User-Name)  {
(0)         if (&User-Name =~ / /) {
(0)         if (&User-Name =~ / /)  -> FALSE
(0)         if (&User-Name =~ /@[^@]*@/ ) {
(0)         if (&User-Name =~ /@[^@]*@/ )  -> FALSE
(0)         if (&User-Name =~ /\.\./ ) {
(0)         if (&User-Name =~ /\.\./ )  -> FALSE
(0)         if ((&User-Name =~ /@/) && (&User-Name !~ /@(.+)\.(.+)$/))  {
(0)         if ((&User-Name =~ /@/) && (&User-Name !~ /@(.+)\.(.+)$/))   -> FALSE
(0)         if (&User-Name =~ /\.$/)  {
(0)         if (&User-Name =~ /\.$/)   -> FALSE
(0)         if (&User-Name =~ /@\./)  {
(0)         if (&User-Name =~ /@\./)   -> FALSE
(0)       } # if (&User-Name)  = notfound
(0)     } # policy filter_username = notfound
(0)     [preprocess] = ok
(0)     [chap] = noop
(0)     [mschap] = noop
(0)     [digest] = noop
(0) suffix: Checking for suffix after "@"  
(0) suffix: No '@' in User-Name = "Christian", looking up realm NULL  
(0) suffix: No such realm "NULL"  
(0)     [suffix] = noop
(0) eap: No EAP-Message, not doing EAP
(0)     [eap] = noop
(0)     [files] = noop
(0) sql: EXPAND %{User-Name}
(0) sql:    --> Christian
(0) sql: SQL-User-Name set to 'Christian'  
rlm_sql (sql): Reserved connection (0)
(0) sql: EXPAND SELECT id, username, attribute, value, op FROM radcheck WHERE username = '%{SQL-User-Name}' ORDER BY id  
(0) sql:    --> SELECT id, username, attribute, value, op FROM radcheck WHERE username = 'Christian' ORDER BY id  
(0) sql: Executing select query: SELECT id, username, attribute, value, op FROM radcheck WHERE username = 'Christian' ORDER BY id  
(0) sql: EXPAND SELECT groupname FROM radusergroup WHERE username = '%{SQL-User-Name}' ORDER BY priority  
(0) sql:    --> SELECT groupname FROM radusergroup WHERE username = 'Christian' ORDER BY priority  
(0) sql: Executing select query: SELECT groupname FROM radusergroup WHERE username = 'Christian' ORDER BY priority  
(0) sql: User not found in any groups
rlm_sql (sql): Released connection (0)
Need 5 more connections to reach 10 spares
rlm_sql (sql): Opening additional connection (5), 1 of 27 pending slots used
(0)     [sql] = notfound
(0)     [expiration] = noop
(0)     [logintime] = noop
(0) pap: WARNING: No "known good" password found for the user.  Not setting Auth-Type  
(0) pap: WARNING: Authentication will fail unless a "known good" password is available  
(0)     [pap] = noop
(0)   } # authorize = ok
(0) ERROR: No Auth-Type found: rejecting the user via Post-Auth-Type = Reject
(0) Failed to authenticate the user
(0) Using Post-Auth-Type Reject
(0) # Executing group from file /etc/freeradius/3.0/sites-enabled/default
(0)   Post-Auth-Type REJECT {
(0) sql: EXPAND .query
(0) sql:    --> .query
(0) sql: Using query template 'query'  
rlm_sql (sql): Reserved connection (1)
(0) sql: EXPAND %{User-Name}
(0) sql:    --> Christian
(0) sql: SQL-User-Name set to 'Christian'  
(0) sql: EXPAND INSERT INTO radpostauth (username, pass, reply, authdate) VALUES ( '%{SQL-User-Name}', '%{%{User-Password}:-%{Chap-Password}}', '%{reply:Packet-Type}', '%S')  
(0) sql:    --> INSERT INTO radpostauth (username, pass, reply, authdate) VALUES ( 'Christian', 'Schetti', 'Access-Reject', '2019-10-07 20:10:04')  
(0) sql: Executing query: INSERT INTO radpostauth (username, pass, reply, authdate) VALUES ( 'Christian', 'Schetti', 'Access-Reject', '2019-10-07 20:10:04')  
(0) sql: SQL query returned: success
(0) sql: 1 record(s) updated
rlm_sql (sql): Released connection (1)
(0)     [sql] = ok
(0) attr_filter.access_reject: EXPAND %{User-Name}
(0) attr_filter.access_reject:    --> Christian
(0) attr_filter.access_reject: Matched entry DEFAULT at line 11
(0)     [attr_filter.access_reject] = updated
(0)     [eap] = noop
(0)     policy remove_reply_message_if_eap {
(0)       if (&reply:EAP-Message && &reply:Reply-Message) {
(0)       if (&reply:EAP-Message && &reply:Reply-Message)  -> FALSE
(0)       else {
(0)         [noop] = noop
(0)       } # else = noop
(0)     } # policy remove_reply_message_if_eap = noop
(0)   } # Post-Auth-Type REJECT = updated
(0) Delaying response for 1.000000 seconds
Waking up in 0.3 seconds.
Waking up in 0.6 seconds.
(0) Sending delayed response
(0) Sent Access-Reject Id 0 from 172.16.50.100:1812 to 172.16.10.20:53894 length 20
Waking up in 3.9 seconds.
(0) Cleaning up request packet ID 0 with timestamp +24
Ready to process requests

# Datenbank anlegen
CREATE DATABASE radius;
#
# User anlegen
CREATE USER 'radius'@'%';  
SET PASSWORD FOR 'radius'@'%' = PASSWORD('geheim');  
#
# Leserechte vergeben
GRANT SELECT ON radius.* TO 'radius'@'%';  
#
# Schreibrechte gezielt vergeben
GRANT ALL on radius.radacct TO 'radius'@'%';  
GRANT ALL on radius.radpostauth TO 'radius'@'%';  
FLUSH PRIVILEGES;

# /etc/freeradius/3.0/mods-available/sql
#
# Change driver = "rlm_sql_null" to driver = "rlm_sql_mysql"  
# Change dialect = "sqlite" to dialect = "mysql"  
# Uncomment server, port, login and password by removing # from the beginning of the line, 
# as well as changing password = "radpass" to password = "radiuspassword".  
# Uncomment the read_clients = yes line, by removing the # at the beginning of the line.
#
# Sym-Link für SQL anlegen
# cd mods-enabled
#
 
# SQL auskommentieren
#	
# sites-available/default:
# in the authorize{} section.
#
# sites-available/inner-tunnel:
# in "authorize {}" section  
# in "accounting{}" section (to tell FreeRADIUS to store accounting records in SQL as well.)  
# in "session{}" section (Simultaneous-Use detection!)  
# in " post-auth{}" section (to log all Authentication attempts to SQL)  

2147483157	2019-Oct-21 19:24:53	Warning	%STP-W-PORTSTATUS: gi1/0/29: STP status Forwarding   
2147483160	2019-Oct-21 19:24:51	Warning	%STP-W-PORTSTATUS: gi1/0/20: STP status Forwarding   

	pool {
		#  Connections to create during module instantiation.
		#  If the server cannot create specified number of
		#  connections during instantiation it will exit.
		#  Set to 0 to allow the server to start without the
		#  database being available.
		start = ${thread[pool].start_servers}

		#  Minimum number of connections to keep open
		min = ${thread[pool].min_spare_servers}

		#  Maximum number of connections
		#
		#  If these connections are all in use and a new one
		#  is requested, the request will NOT get a connection.
		#
		#  Setting 'max' to LESS than the number of threads means  
		#  that some threads may starve, and you will see errors
		#  like 'No connections available and at max connection limit'  
		#
		#  Setting 'max' to MORE than the number of threads means  
		#  that there are more connections than necessary.
		max = ${thread[pool].max_servers}

		#  Spare connections to be left idle
		#
		#  NOTE: Idle connections WILL be closed if "idle_timeout"  
		#  is set.  This should be less than or equal to "max" above.  
		spare = ${thread[pool].max_spare_servers}

		#  Number of uses before the connection is closed
		#
		#  0 means "infinite"  
		uses = 0

		#  The number of seconds to wait after the server tries
		#  to open a connection, and fails.  During this time,
		#  no new connections will be opened.
		retry_delay = 30

		# The lifetime (in seconds) of the connection
		lifetime = 0

		#  idle timeout (in seconds).  A connection which is
		#  unused for this length of time will be closed.
		idle_timeout = 60

		#  NOTE: All configuration settings are enforced.  If a
		#  connection is closed because of "idle_timeout",  
		#  "uses", or "lifetime", then the total number of  
		#  connections MAY fall below "min".  When that  
		#  happens, it will open a new connection.  It will
		#  also log a WARNING message.
		#
		#  The solution is to either lower the "min" connections,  
		#  or increase lifetime/idle_timeout.
	}