December 2012 - Freeradius-Users - lists.freeradius.org

Define New Attribute
by Alexandre J. Correa (Onda) 05 Dec '12

05 Dec '12

Hello, I need to track some type of 'user group'. i´m doing this to not overload my database servers. into the radgroupreply table i need to 'create' one attribute like: Check-Bandwidth := [0,1] i added this attribute in groupreply, in my dictionary file and i can see this attribute in the 'authorization' section. How i can pass it to 'accouting' section ? maybe setting global variable for this session ? the purpose of doing this is to check if value is 1, freeradius need to track this user every interim-update, Start and Stop Packet-Type. if value is 0, freeradius skip this user from checking. ... this is the 'best' way ? if anyone has a better way.. and can share.. i´ll be thankful !! Regards, -- Sds. Alexandre Jeronimo Correa Sócio-Administrador Office: +55 34 3351 3077 Onda Internet www.onda.net.br

4 4

Logging Access-Challenge in detail log
by John Carter 05 Dec '12

05 Dec '12

Hi, We're using 2.1.12. We require a full log of everything that gets sent between a controller and freeradius. We've configured detail.log, inner-tunnel and default to log authentications and replies which work for us, but is there any way to also log Access-Challenge? I've read some very old posts that haven't helped. Thanks, John. -- John Carter Identity Networks jcarter(a)identitynetworks.com

1 0

Ubuntu package from Master branch
by Olivier Beytrison 05 Dec '12

05 Dec '12

Hi there, I'm back at work, and i'll focus myself again for the next few days to get those packages working. after commit 2a8c11646b660b0c52eab9fa8e9e8cff3603f262 which move rlm_ldap to the new config based attribute map, we need to remove ldap.attrmap from raddb/Makefile and the corresponding debian/freeradius files diff --git a/debian/freeradius.install b/debian/freeradius.install index df66779..aba570e 100644 --- a/debian/freeradius.install +++ b/debian/freeradius.install @@ -8,7 +8,6 @@ etc/freeradius/clients.conf etc/freeradius/experimental.conf etc/freeradius/hints etc/freeradius/huntgroups -etc/freeradius/ldap.attrmap etc/freeradius/mods-available/* etc/freeradius/mods-enabled/* etc/freeradius/policy.d/* diff --git a/debian/freeradius.postinst b/debian/freeradius.postinst index bb8b3d3..c878136 100755 --- a/debian/freeradius.postinst +++ b/debian/freeradius.postinst @@ -30,7 +30,6 @@ case "$1" in /etc/freeradius/proxy.conf \ /etc/freeradius/attrs.pre-proxy \ /etc/freeradius/hints \ - /etc/freeradius/ldap.attrmap \ /etc/freeradius/attrs \ /etc/freeradius/policy.txt \ /etc/freeradius/attrs.accounting_response \ diff --git a/debian/freeradius.prerm b/debian/freeradius.prerm index 201e142..a34c6de 100755 --- a/debian/freeradius.prerm +++ b/debian/freeradius.prerm @@ -16,7 +16,6 @@ case "$1" in /etc/freeradius/proxy.conf \ /etc/freeradius/attrs.pre-proxy \ /etc/freeradius/hints \ - /etc/freeradius/ldap.attrmap \ /etc/freeradius/attrs \ /etc/freeradius/policy.txt \ /etc/freeradius/attrs.accounting_response \ diff --git a/raddb/Makefile b/raddb/Makefile index a2d5eba..24de901 100644 --- a/raddb/Makefile +++ b/raddb/Makefile @@ -11,7 +11,7 @@ include ../Make.inc # FILES = acct_users attrs attrs.access_reject attrs.accounting_response \ attrs.pre-proxy clients.conf dictionary templates.conf \ - experimental.conf hints huntgroups ldap.attrmap \ + experimental.conf hints huntgroups \ policy.txt preproxy_users proxy.conf radiusd.conf trigger.conf \ users attrs.access_challenge README.rst -- Olivier Beytrison Network & Security Engineer, HES-SO Fribourg Mobile: +41 (0)78 619 73 53 Mail: olivier(a)heliosnet.org

2 1

FreeRadius Running Error
by QASIM RAO 05 Dec '12

05 Dec '12

Hi,i am facing problem in freeradius i m already using freeradius it was working fine now i re-install radius and now when i start radius with "radiusd -X" command it is giving following error please help me in this Starting - reading configuration files ...reread_config: reading radiusd.confConfig: including file: /usr/local/etc/raddb/proxy.confConfig: including file: /usr/local/etc/raddb/clients.confConfig: including file: /usr/local/etc/raddb/snmp.confConfig: including file: /usr/local/etc/raddb/eap.confConfig: including file: /usr/local/etc/raddb/sql.conf main: prefix = "/usr/local" main: localstatedir = "/usr/local/var" main: logdir = "/usr/local/var/log/radius" main: libdir = "/usr/local/lib" main: radacctdir = "/usr/local/var/log/radius/radacct" main: hostname_lookups = no main: max_request_time = 30 main: cleanup_delay = 5 main: max_requests = 1024 main: delete_blocked_requests = 0 main: port = 0 main: allow_core_dumps = no main: log_stripped_names = yes main: log_file = "/usr/local/var/log/radius/radius.log" main: log_auth = yes main: log_auth_badpass = yes main: log_auth_goodpass = yes main: pidfile = "/usr/local/var/run/radiusd/radiusd.pid" main: user = "(null)" main: group = "(null)" main: usercollide = no main: lower_user = "no" main: lower_pass = "no" main: nospace_user = "no" main: nospace_pass = "no" main: checkrad = "/usr/local/sbin/checkrad" main: proxy_requests = yes proxy: retry_delay = 5 proxy: retry_count = 3 proxy: synchronous = yes proxy: default_fallback = no proxy: dead_time = 120 proxy: post_proxy_authorize = no proxy: wake_all_if_all_dead = no security: max_attributes = 200 security: reject_delay = 0 security: status_server = no main: debug_level = 0read_config_files: reading dictionaryread_config_files: reading naslistUsing deprecated naslist file. Support for this will go away soon.read_config_files: reading clientsread_config_files: reading realmsradiusd: entering modules setupSegmentation fault ragards:Qasim

3 4

Re: Radius Code set to 2??
by Alan Buxey 05 Dec '12

05 Dec '12

You were already given an answer. AP shouldn't be sending a RADIUS access-accept to the server. Either a misconfiguration, software bug or misreading of the issue alan

1 0

AW: Re: Radius Code set to 2??
by Matthias Nagel 05 Dec '12

05 Dec '12

Hello, some APs have the option to work as a RADIUS proxy. Perhaps the AP is not actually broken, but only wrongly configured. Matthias Matthias Nagel Willy-Andreas-Allee 1, Zimmer 506 76131 Karlsruhe Telefon: +49-721-8695-1506 Mobil: +49-151-15998774 ICQ: 499797758 Skype: nagmat84Arran Cudbard-Bell <a.cudbardb(a)freeradius.org> hat geschrieben: On 4 Dec 2012, at 10:14, ashok kumar <vijayashok.ece(a)gmail.com> wrote: > Hey folks, > > I have and AP from which I get a RADIUS message with code field set to 2. It was received from on port 1812. > > Can anybody tell me the significance of this problem because when I change the APs everything works fine. I need to ascertain whether any configuration change is required on AP/ Radius server. Your AP is broken. It shouldn't be sending Access-Accepts to the RADIUS server... -Arran - List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html

4 4

Eduroam & FreeRadius not working so well
by Mike Diggins 05 Dec '12

05 Dec '12

I'm running FreeRadius 2.1.12 on RedHat 6 as an Eduroam proxy server and having problems. My cisco wireless controllers are constantly failing back and forth between the primary and secondary systems. My logs show these errors when it happens: Dec 4 19:12:18 server radiusd[32588]: Internal sanity check failed for child state Dec 4 19:12:18 server radiusd[32588]: Reply from home server x.x.x.x port 1812 - ID: 210 arrived too late for request 76479. Try increasing 'retry_delay' or 'max_request_time' Dec 4 19:13:18 server radiusd[32588]: Discarding duplicate request from client ct5508 port 32770 - ID: 148 due to unfinished request 76495 Dec 4 19:13:26 server radiusd[32588]: Discarding duplicate request from client ct5508 port 32770 - ID: 148 due to unfinished request 76495 Dec 4 19:13:34 server radiusd[32588]: Discarding duplicate request from client ct5508 port 32770 - ID: 148 due to unfinished request 76495 Dec 4 19:13:41 server radiusd[32588]: Internal sanity check failed for child state Dec 4 19:13:41 server radiusd[32588]: Reply from home server x.x.x.x port 1812 - ID: 102 arrived too late for request 76495. Try increasing 'retry_delay' or 'max_request_time' Dec 4 19:13:42 server radiusd[32588]: Discarding duplicate request from client ct5508 port 32770 - ID: 148 due to unfinished request 76495 I'm look for some advice as to what timeouts to adjust that might help with the errors. I didn't want to start changing retry_delay or max_request_time without some advice first. Any suggestions? I have no control over the Home Servers or how long a request takes to complete and I don't know what's causing the sanity check failure!? -Mike

1 0

Originating CoA
by amanda edades 04 Dec '12

04 Dec '12

Hello, I am trying to use my RADIUS server to designate user group memberships specifying QoS policies and monthly data caps. When authenticating, the server returns an AVP that tells what group a user is in, and the NAS will apply the associated QoS policies to his traffic. The RADIUS server checks if a user is over his data cap on every Access-Request and Interim-Update packet. When the user exceeds the data cap defined for his group, the RADIUS server originates a CoA and sends a new group assignment in which his traffic is throttled. Everything works fine now, but if the RADIUS server finds that a user is over his cap, it first returns its default group assignment taken from the radgroupreply table, then sends a CoA. Output from RADIUS: Sending Accounting-Response of id 122 to 127.0.0.1 port 33544 Access-Group = "Group1" WARNING: Empty pre-proxy section. Using default return values. Sending CoA-Request of id 223 to 127.0.0.1 port 3799 User-Name = "1907444" Access-Group = "ThrottledGroup" Finished request 8. So the NAS receives the default group assignment, then the throttled group assignment immediately after. To avoid confusion and transmitting unnecessary data, in the case when a data cap is exceeded, how to I prevent the RADIUS server from returning the default values from the radgroupreply table, and only send the CoA? Thank you, Amanda

2 1

Redundant Freeradius
by fknet 04 Dec '12

04 Dec '12

Hello people! Today I've just one FreeBSD server running FreeRadius +MySQL on my network and now I want to put a redundant server to prevent fails. I was thinking to use CARP protocol to have the same IP address of the main server on the backup server and do the MySQL Replication on the backup server but one friend told me that I can't replicate the radacct table for a reason that he doesn't know. My question is: Can I do the full replication of ALL MySQL tables of Freeradius? Will I have some problem if I replicate the radacct table? Thanks Fabrício

2 5

Segmentation fault
by Manuel Campana 04 Dec '12

04 Dec '12

Hello I'm quite new to freeradius and I experienced my first issue right away after trying the first attempt. If I run a quick test on localhost I get a segmentation fault Tue Dec 4 10:17:11 2012 : Debug: Listening on authentication address * port 1812 Tue Dec 4 10:17:11 2012 : Debug: Listening on accounting address * port 1813 Tue Dec 4 10:17:11 2012 : Debug: Listening on authentication address 127.0.0.1 port 18120 as server inner-tunnel Tue Dec 4 10:17:11 2012 : Debug: Listening on proxy address * port 1814 Tue Dec 4 10:17:11 2012 : Info: Ready to process requests. rad_recv: Access-Request packet from host 127.0.0.1 port 53330, id=88, length=77 User-Name = "testing" User-Password = "password" NAS-IP-Address = 127.0.1.1 NAS-Port = 0 Message-Authenticator = 0x0d49f27be8b1d4bd1f5c5345041acde7 Tue Dec 4 10:17:16 2012 : Info: # Executing section authorize from file /etc/freeradius/sites-enabled/default Tue Dec 4 10:17:16 2012 : Info: +- entering group authorize {...} Segmentation fault This si the freeradius version installed on my debian machine freeradius: FreeRADIUS Version 2.1.10, for host x86_64-pc-linux-gnu, built on Sep 11 2012 at 17:06:46 The configuration seems to be ok so I don't know why I get this. Anyone can help me? Thanks Br Manuel -- *Manuel Campana* Technical Support Engineer Accedian Networks T: 514 331 6181 x463 E: MCampana(a)Accedian.com @Accedian -- Avis de confidentialité Les informations contenues dans le présent message et dans toute pièce qui lui est jointe sont confidentielles et peuvent être protégées par le secret professionnel. Ces informations sont à l’usage exclusif de son ou de ses destinataires. Si vous recevez ce message par erreur, veuillez s’il vous plait communiquer immédiatement avec l’expéditeur et en détruire tout exemplaire. De plus, il vous est strictement interdit de le divulguer, de le distribuer ou de le reproduire sans l’autorisation de l’expéditeur. Merci. Confidentiality notice This e-mail message and any attachment hereto contain confidential information which may be privileged and which is intended for the exclusive use of its addressee(s). If you receive this message in error, please inform sender immediately and destroy any copy thereof. Furthermore, any disclosure, distribution or copying of this message and/or any attachment hereto without the consent of the sender is strictly prohibited. Thank you.

2 1