October 2014 - Freeradius-Users - lists.freeradius.org

CallingStationId not attribute stores the MAC address
by Cleiton Rodrigues de Souza 24 Oct '14

24 Oct '14

Good morning, according to the manual CallingStationId freeradius attribute refers to the MAC address of the client, so it should be stored in the database such attribute, yet being saved it is the IP address of the client. Does anyone know what this might be and how can I solve this problem? I wish it were stored the MAC address for the attribute CallingStationId! -- --------------------------------------------------------------------------------------------- Cordialmente, Cleiton R. de Souza

2 2

Conditional statements in dialup.conf?
by James Wood 23 Oct '14

23 Oct '14

Hi All, I'm wondering if you can advise on the best way to deal with the below. On all NAS's apart from Mikrotik routers, when the radius accounting packets are sent, the correct figures are in the Acct-Input-Octets and Acct-Output-Octets respectively. When using Mikrotik, they switch those around (i.e. the download octets are upload and vice versa), and because I use an SQL DB, it means that the values are also stored the wrong way round, as the queries in dialup.conf are fixed to insert in to the same columns. So, I'm looking to detect a Mikrotik accounting request and then change the columns round so that the DB is always correct. I've tried doing this inside the dialup.conf but not sure it accepts conditional statements inside there. (I use other conditional statements in sites-enabled/default etc, so have an understanding on that in general). --------------------------------- if (Mikrotik-Host-IP) { accounting_start_query = " \ INSERT INTO ${acct_table1} \ (acctsessionid, acctuniqueid, username, \ realm, nasipaddress, nasportid, \ nasporttype, acctstarttime, acctstoptime, \ acctsessiontime, acctauthentic, connectinfo_start, \ connectinfo_stop, acctoutputoctets, acctinputoctets, \ calledstationid, callingstationid, acctterminatecause, \ servicetype, framedprotocol, framedipaddress, \ acctstartdelay, acctstopdelay, xascendsessionsvrkey) \ VALUES \ ('%{Acct-Session-Id}', '%{Acct-Unique-Session-Id}', \ '%{SQL-User-Name}', \ '%{Realm}', '%{NAS-IP-Address}', '%{NAS-Port}', \ '%{NAS-Port-Type}', '%S', NULL, \ '0', '%{Acct-Authentic}', '%{Connect-Info}', \ '', '0', '0', \ REPLACE(SUBSTRING('%{Called-Station-Id}',1,17),':','-'), \ REPLACE(SUBSTRING('%{Calling-Station-Id}',1,17),':','-'), '', \ '%{Service-Type}', '%{Framed-Protocol}', '%{Framed-IP-Address}', \ '%{%{Acct-Delay-Time}:-0}', '0', '%{X-Ascend-Session-Svr-Key}')" } else { accounting_start_query = " \ INSERT INTO ${acct_table1} \ (acctsessionid, acctuniqueid, username, \ realm, nasipaddress, nasportid, \ nasporttype, acctstarttime, acctstoptime, \ acctsessiontime, acctauthentic, connectinfo_start, \ connectinfo_stop, acctinputoctets, acctoutputoctets, \ calledstationid, callingstationid, acctterminatecause, \ servicetype, framedprotocol, framedipaddress, \ acctstartdelay, acctstopdelay, xascendsessionsvrkey) \ VALUES \ ('%{Acct-Session-Id}', '%{Acct-Unique-Session-Id}', \ '%{SQL-User-Name}', \ '%{Realm}', '%{NAS-IP-Address}', '%{NAS-Port}', \ '%{NAS-Port-Type}', '%S', NULL, \ '0', '%{Acct-Authentic}', '%{Connect-Info}', \ '', '0', '0', \ REPLACE(SUBSTRING('%{Called-Station-Id}',1,17),':','-'), \ REPLACE(SUBSTRING('%{Calling-Station-Id}',1,17),':','-'), '', \ '%{Service-Type}', '%{Framed-Protocol}', '%{Framed-IP-Address}', \ '%{%{Acct-Delay-Time}:-0}', '0', '%{X-Ascend-Session-Svr-Key}')" } ------------------------------------- This doesn't work; it throws a config error strangely, which goes away if I comment out the if statement. [.] Wed Oct 22 07:59:28 2014 : Debug: including configuration file /usr/local/etc/raddb/sql.conf Wed Oct 22 07:59:28 2014 : Debug: including configuration file /usr/local/etc/raddb/sql/mysql/dialup.conf Wed Oct 22 07:59:28 2014 : Debug: WARNING: No such configuration item acct_table1 Wed Oct 22 07:59:28 2014 : Error: /usr/local/etc/raddb/sql/mysql/dialup.conf[165]: Reference " UPDATE ${acct_table1} SET framedipaddress = '%{Framed-IP-Address}', acctsessiontime = '%{Acct-Session-Time}', acctoutputoctets = '%{%{Acct-Input-Gigawords}:-0}' << 32 | '%{%{Acct-Input-Octets}:-0}', acctinputoctets = '%{%{Acct-Output-Gigawords}:-0}' << 32 | '%{%{Acct-Output-Octets}:-0}' WHERE acctsessionid = '%{Acct-Session-Id}' AND username = '%{SQL-User-Name}' AND nasipaddress = '%{NAS-IP-Address}'" not found Wed Oct 22 07:59:28 2014 : Error: Errors reading /usr/local/etc/raddb/radiusd.conf If I'm doing it wrong can you point me in the direction of how else to change the incoming request so that I can switch the download/upload values for Mikrotik? Thanks, James

2 5

Discarding duplicate request error
by Alex Gregory 22 Oct '14

22 Oct '14

Getting the following error in the logs when in debug mode that I did not see before: Received Access-Request Id 1 from x.x.x.x:32775 to 10.11.1.102:1814 length 159 (4) Discarding duplicate request from client allhosts port 32775 - ID: 1 due to delayed response Is this anything to be worried about? My allhosts section looks like this: client allhosts { ipaddr = * secret = blah proto = * require_message_authenticator = no nas_type = other } freeradius -x output: root@radius:/etc/init.d# /usr/local/sbin/radiusd -X radiusd: FreeRADIUS Version 3.0.4, for host x86_64-unknown-linux-gnu, built on Sep 25 2014 at 20:37:45 Copyright (C) 1999-2014 The FreeRADIUS server project and contributors There is NO warranty; not even for MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE You may redistribute copies of FreeRADIUS under the terms of the GNU General Public License For more information about these matters, see the file named COPYRIGHT Starting - reading configuration files ... including dictionary file /usr/local/share/freeradius/dictionary including dictionary file /usr/local/share/freeradius/dictionary.dhcp including dictionary file /usr/local/share/freeradius/dictionary.vqp including dictionary file /usr/local/etc/raddb/dictionary including configuration file /usr/local/etc/raddb/radiusd.conf including configuration file /usr/local/etc/raddb/proxy.conf including configuration file /usr/local/etc/raddb/clients.conf including files in directory /usr/local/etc/raddb/mods-enabled/ including configuration file /usr/local/etc/raddb/mods-enabled/mschap including configuration file /usr/local/etc/raddb/mods-enabled/passwd including configuration file /usr/local/etc/raddb/mods-enabled/digest including configuration file /usr/local/etc/raddb/mods-enabled/dhcp including configuration file /usr/local/etc/raddb/mods-enabled/eap including configuration file /usr/local/etc/raddb/mods-enabled/realm including configuration file /usr/local/etc/raddb/mods-enabled/echo including configuration file /usr/local/etc/raddb/mods-enabled/utf8 including configuration file /usr/local/etc/raddb/mods-enabled/always including configuration file /usr/local/etc/raddb/mods-enabled/pap including configuration file /usr/local/etc/raddb/mods-enabled/detail.log including configuration file /usr/local/etc/raddb/mods-enabled/chap including configuration file /usr/local/etc/raddb/mods-enabled/expr including configuration file /usr/local/etc/raddb/mods-enabled/ntlm_auth including configuration file /usr/local/etc/raddb/mods-enabled/sradutmp including configuration file /usr/local/etc/raddb/mods-enabled/radutmp including configuration file /usr/local/etc/raddb/mods-enabled/unix including configuration file /usr/local/etc/raddb/mods-enabled/soh including configuration file /usr/local/etc/raddb/mods-enabled/logintime including configuration file /usr/local/etc/raddb/mods-enabled/dynamic_clients including configuration file /usr/local/etc/raddb/mods-enabled/files including configuration file /usr/local/etc/raddb/mods-enabled/unpack including configuration file /usr/local/etc/raddb/mods-enabled/replicate including configuration file /usr/local/etc/raddb/mods-enabled/ldap including configuration file /usr/local/etc/raddb/mods-enabled/attr_filter including configuration file /usr/local/etc/raddb/mods-enabled/linelog including configuration file /usr/local/etc/raddb/mods-enabled/cache_eap including configuration file /usr/local/etc/raddb/mods-enabled/detail including configuration file /usr/local/etc/raddb/mods-enabled/ldap-dev including configuration file /usr/local/etc/raddb/mods-enabled/exec including configuration file /usr/local/etc/raddb/mods-enabled/expiration including configuration file /usr/local/etc/raddb/mods-enabled/preprocess including configuration file /usr/local/etc/raddb/mods-enabled/eap-dev including files in directory /usr/local/etc/raddb/policy.d/ including configuration file /usr/local/etc/raddb/policy.d/dhcp including configuration file /usr/local/etc/raddb/policy.d/eap including configuration file /usr/local/etc/raddb/policy.d/cui including configuration file /usr/local/etc/raddb/policy.d/debug including configuration file /usr/local/etc/raddb/policy.d/filter including configuration file /usr/local/etc/raddb/policy.d/operator-name including configuration file /usr/local/etc/raddb/policy.d/accounting including configuration file /usr/local/etc/raddb/policy.d/control including configuration file /usr/local/etc/raddb/policy.d/canonicalization including files in directory /usr/local/etc/raddb/sites-enabled/ including configuration file /usr/local/etc/raddb/sites-enabled/default-dev including configuration file /usr/local/etc/raddb/sites-enabled/inner-tunnel-dev including configuration file /usr/local/etc/raddb/sites-enabled/inner-tunnel including configuration file /usr/local/etc/raddb/sites-enabled/default main { security { allow_core_dumps = no } } main { name = "radiusd" prefix = "/usr/local" localstatedir = "/usr/local/var" sbindir = "/usr/local/sbin" logdir = "/usr/local/var/log/radius" run_dir = "/usr/local/var/run/radiusd" libdir = "/usr/local/lib" radacctdir = "/usr/local/var/log/radius/radacct" hostname_lookups = no max_request_time = 30 cleanup_delay = 5 max_requests = 1024 pidfile = "/usr/local/var/run/radiusd/radiusd.pid" checkrad = "/usr/local/sbin/checkrad" debug_level = 0 proxy_requests = yes log { stripped_names = no auth = no auth_badpass = no auth_goodpass = no colourise = yes msg_denied = "You are already logged in - access denied" } security { max_attributes = 200 reject_delay = 1 status_server = yes allow_vulnerable_openssl = "yes" } } radiusd: #### Loading Realms and Home Servers #### proxy server { retry_delay = 5 retry_count = 3 default_fallback = no dead_time = 120 wake_all_if_all_dead = no } home_server inwebo1 { ipaddr = 94.143.115.73 port = 1812 type = "auth" secret = <<< secret >>> response_window = 30.000000 response_timeouts = 1 max_outstanding = 65536 zombie_period = 40 status_check = "status-server" ping_interval = 30 check_interval = 30 check_timeout = 4 num_answers_to_alive = 3 revive_interval = 300 coa { irt = 2 mrt = 16 mrc = 5 mrd = 30 } limit { max_connections = 16 max_requests = 0 lifetime = 0 idle_timeout = 0 } } home_server inwebo2 { ipaddr = 94.143.115.75 port = 1812 type = "auth" secret = <<< secret >>> response_window = 30.000000 response_timeouts = 1 max_outstanding = 65536 zombie_period = 40 status_check = "status-server" ping_interval = 30 check_interval = 30 check_timeout = 4 num_answers_to_alive = 3 revive_interval = 300 coa { irt = 2 mrt = 16 mrc = 5 mrd = 30 } limit { max_connections = 16 max_requests = 0 lifetime = 0 idle_timeout = 0 } } home_server_pool inwebo { type = fail-over home_server = inwebo1 home_server = inwebo2 } realm DEFAULT { auth_pool = inwebo nostrip } radiusd: #### Loading Clients #### client allhosts { ipaddr = * require_message_authenticator = no secret = <<< secret >>> nas_type = "other" proto = "*" limit { max_connections = 16 lifetime = 0 idle_timeout = 30 } } client localhost { ipaddr = 127.0.0.1 require_message_authenticator = no secret = <<< secret >>> nas_type = "other" proto = "*" limit { max_connections = 16 lifetime = 0 idle_timeout = 30 } } client localhost_ipv6 { ipv6addr = ::1 require_message_authenticator = no secret = <<< secret >>> limit { max_connections = 16 lifetime = 0 idle_timeout = 30 } } radiusd: #### Instantiating modules #### instantiate { } modules { # Loaded module rlm_mschap # Instantiating module "mschap" from file /usr/local/etc/raddb/mods-enabled/mschap mschap { use_mppe = yes require_encryption = no require_strong = no with_ntdomain_hack = yes passchange { } allow_retry = yes } # Loaded module rlm_passwd # Instantiating module "etc_passwd" from file /usr/local/etc/raddb/mods-enabled/passwd passwd etc_passwd { filename = "/etc/passwd" format = "*User-Name:Crypt-Password:" delimiter = ":" ignore_nislike = no ignore_empty = yes allow_multiple_keys = no hash_size = 100 } rlm_passwd: nfields: 3 keyfield 0(User-Name) listable: no # Loaded module rlm_digest # Instantiating module "digest" from file /usr/local/etc/raddb/mods-enabled/digest # Loaded module rlm_dhcp # Instantiating module "dhcp" from file /usr/local/etc/raddb/mods-enabled/dhcp # Loaded module rlm_eap # Instantiating module "eap" from file /usr/local/etc/raddb/mods-enabled/eap eap { default_eap_type = "ttls" timer_expire = 60 ignore_unknown_eap_types = no mod_accounting_username_bug = no max_sessions = 1024 } # Linked to sub-module rlm_eap_md5 # Linked to sub-module rlm_eap_leap # Linked to sub-module rlm_eap_gtc gtc { challenge = "Password: " auth_type = "PAP" } # Linked to sub-module rlm_eap_tls tls { tls = "tls-common" } tls-config tls-common { rsa_key_exchange = no dh_key_exchange = yes rsa_key_length = 512 dh_key_length = 512 verify_depth = 0 ca_path = "/usr/local/etc/raddb/certs" pem_file_type = yes private_key_file = "/usr/local/etc/raddb/certs/server.pem" certificate_file = "/usr/local/etc/raddb/certs/server.pem" ca_file = "/usr/local/etc/raddb/certs/ca.pem" private_key_password = <<< secret >>> dh_file = "/usr/local/etc/raddb/certs/dh" fragment_size = 1024 include_length = yes check_crl = no cipher_list = "DEFAULT" ecdh_curve = "prime256v1" cache { enable = yes lifetime = 24 max_entries = 255 } verify { } ocsp { enable = no override_cert_url = yes url = "http://127.0.0.1/ocsp/" use_nonce = yes timeout = 0 softfail = yes } } # Linked to sub-module rlm_eap_ttls ttls { tls = "tls-common" default_eap_type = "md5" copy_request_to_tunnel = no use_tunneled_reply = no virtual_server = "inner-tunnel" include_length = yes require_client_cert = no } Using cached TLS configuration from previous invocation # Linked to sub-module rlm_eap_peap peap { tls = "tls-common" default_method = "mschapv2" copy_request_to_tunnel = no use_tunneled_reply = no proxy_tunneled_request_as_eap = yes virtual_server = "inner-tunnel" soh = no require_client_cert = no } Using cached TLS configuration from previous invocation # Linked to sub-module rlm_eap_mschapv2 mschapv2 { with_ntdomain_hack = no send_error = no } # Loaded module rlm_realm # Instantiating module "IPASS" from file /usr/local/etc/raddb/mods-enabled/realm realm IPASS { format = "prefix" delimiter = "/" ignore_default = no ignore_null = no } # Instantiating module "suffix" from file /usr/local/etc/raddb/mods-enabled/realm realm suffix { format = "suffix" delimiter = "@" ignore_default = no ignore_null = no } # Instantiating module "realmpercent" from file /usr/local/etc/raddb/mods-enabled/realm realm realmpercent { format = "suffix" delimiter = "%" ignore_default = no ignore_null = no } # Instantiating module "ntdomain" from file /usr/local/etc/raddb/mods-enabled/realm realm ntdomain { format = "prefix" delimiter = "\" ignore_default = no ignore_null = no } # Loaded module rlm_exec # Instantiating module "echo" from file /usr/local/etc/raddb/mods-enabled/echo exec echo { wait = yes program = "/bin/echo %{User-Name}" input_pairs = "request" output_pairs = "reply" shell_escape = yes } # Loaded module rlm_utf8 # Instantiating module "utf8" from file /usr/local/etc/raddb/mods-enabled/utf8 # Loaded module rlm_always # Instantiating module "reject" from file /usr/local/etc/raddb/mods-enabled/always always reject { rcode = "reject" simulcount = 0 mpp = no } # Instantiating module "fail" from file /usr/local/etc/raddb/mods-enabled/always always fail { rcode = "fail" simulcount = 0 mpp = no } # Instantiating module "ok" from file /usr/local/etc/raddb/mods-enabled/always always ok { rcode = "ok" simulcount = 0 mpp = no } # Instantiating module "handled" from file /usr/local/etc/raddb/mods-enabled/always always handled { rcode = "handled" simulcount = 0 mpp = no } # Instantiating module "invalid" from file /usr/local/etc/raddb/mods-enabled/always always invalid { rcode = "invalid" simulcount = 0 mpp = no } # Instantiating module "userlock" from file /usr/local/etc/raddb/mods-enabled/always always userlock { rcode = "userlock" simulcount = 0 mpp = no } # Instantiating module "notfound" from file /usr/local/etc/raddb/mods-enabled/always always notfound { rcode = "notfound" simulcount = 0 mpp = no } # Instantiating module "noop" from file /usr/local/etc/raddb/mods-enabled/always always noop { rcode = "noop" simulcount = 0 mpp = no } # Instantiating module "updated" from file /usr/local/etc/raddb/mods-enabled/always always updated { rcode = "updated" simulcount = 0 mpp = no } # Loaded module rlm_pap # Instantiating module "pap" from file /usr/local/etc/raddb/mods-enabled/pap pap { normalise = yes } # Loaded module rlm_detail # Instantiating module "auth_log" from file /usr/local/etc/raddb/mods-enabled/detail.log detail auth_log { filename = "/usr/local/var/log/radius/radacct/%{%{Packet-Src-IP-Address}:-%{Packet-Src-IPv6-Address}}/auth-detail-%Y%m%d" header = "%t" permissions = 384 locking = no log_packet_header = no } rlm_detail (auth_log): 'User-Password' suppressed, will not appear in detail output # Instantiating module "reply_log" from file /usr/local/etc/raddb/mods-enabled/detail.log detail reply_log { filename = "/usr/local/var/log/radius/radacct/%{%{Packet-Src-IP-Address}:-%{Packet-Src-IPv6-Address}}/reply-detail-%Y%m%d" header = "%t" permissions = 384 locking = no log_packet_header = no } # Instantiating module "pre_proxy_log" from file /usr/local/etc/raddb/mods-enabled/detail.log detail pre_proxy_log { filename = "/usr/local/var/log/radius/radacct/%{%{Packet-Src-IP-Address}:-%{Packet-Src-IPv6-Address}}/pre-proxy-detail-%Y%m%d" header = "%t" permissions = 384 locking = no log_packet_header = no } # Instantiating module "post_proxy_log" from file /usr/local/etc/raddb/mods-enabled/detail.log detail post_proxy_log { filename = "/usr/local/var/log/radius/radacct/%{%{Packet-Src-IP-Address}:-%{Packet-Src-IPv6-Address}}/post-proxy-detail-%Y%m%d" header = "%t" permissions = 384 locking = no log_packet_header = no } # Loaded module rlm_chap # Instantiating module "chap" from file /usr/local/etc/raddb/mods-enabled/chap # Loaded module rlm_expr # Instantiating module "expr" from file /usr/local/etc/raddb/mods-enabled/expr expr { safe_characters = "@abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ0123456789.-_: /" } # Instantiating module "ntlm_auth" from file /usr/local/etc/raddb/mods-enabled/ntlm_auth exec ntlm_auth { wait = yes program = "/path/to/ntlm_auth --request-nt-key --domain=MYDOMAIN --username=%{mschap:User-Name} --password=%{User-Password}" shell_escape = yes } # Loaded module rlm_radutmp # Instantiating module "sradutmp" from file /usr/local/etc/raddb/mods-enabled/sradutmp radutmp sradutmp { filename = "/usr/local/var/log/radius/sradutmp" username = "%{User-Name}" case_sensitive = yes check_with_nas = yes permissions = 420 caller_id = no } # Instantiating module "radutmp" from file /usr/local/etc/raddb/mods-enabled/radutmp radutmp { filename = "/usr/local/var/log/radius/radutmp" username = "%{User-Name}" case_sensitive = yes check_with_nas = yes permissions = 384 caller_id = yes } # Loaded module rlm_unix # Instantiating module "unix" from file /usr/local/etc/raddb/mods-enabled/unix unix { radwtmp = "/usr/local/var/log/radius/radwtmp" } # Loaded module rlm_soh # Instantiating module "soh" from file /usr/local/etc/raddb/mods-enabled/soh soh { dhcp = yes } # Loaded module rlm_logintime # Instantiating module "logintime" from file /usr/local/etc/raddb/mods-enabled/logintime logintime { minimum_timeout = 60 } # Loaded module rlm_dynamic_clients # Instantiating module "dynamic_clients" from file /usr/local/etc/raddb/mods-enabled/dynamic_clients # Loaded module rlm_files # Instantiating module "files" from file /usr/local/etc/raddb/mods-enabled/files files { filename = "/usr/local/etc/raddb/mods-config/files/authorize" usersfile = "/usr/local/etc/raddb/mods-config/files/authorize" acctusersfile = "/usr/local/etc/raddb/mods-config/files/accounting" preproxy_usersfile = "/usr/local/etc/raddb/mods-config/files/pre-proxy" compat = "cistron" } reading pairlist file /usr/local/etc/raddb/mods-config/files/authorize [/usr/local/etc/raddb/mods-config/files/authorize]:181 Cistron compatibility checks for entry DEFAULT ... [/usr/local/etc/raddb/mods-config/files/authorize]:188 Cistron compatibility checks for entry DEFAULT ... [/usr/local/etc/raddb/mods-config/files/authorize]:195 Cistron compatibility checks for entry DEFAULT ... reading pairlist file /usr/local/etc/raddb/mods-config/files/authorize [/usr/local/etc/raddb/mods-config/files/authorize]:181 Cistron compatibility checks for entry DEFAULT ... [/usr/local/etc/raddb/mods-config/files/authorize]:188 Cistron compatibility checks for entry DEFAULT ... [/usr/local/etc/raddb/mods-config/files/authorize]:195 Cistron compatibility checks for entry DEFAULT ... reading pairlist file /usr/local/etc/raddb/mods-config/files/accounting reading pairlist file /usr/local/etc/raddb/mods-config/files/pre-proxy # Loaded module rlm_unpack # Instantiating module "unpack" from file /usr/local/etc/raddb/mods-enabled/unpack # Loaded module rlm_replicate # Instantiating module "replicate" from file /usr/local/etc/raddb/mods-enabled/replicate # Loaded module rlm_ldap # Instantiating module "ldap" from file /usr/local/etc/raddb/mods-enabled/ldap ldap { server = "ldap.team.company.com" port = 389 password = <<< secret >>> identity = "cn=admin,dc=team,dc=company,dc=com" user { filter = "(uid=%{%{Stripped-User-Name}:-%{User-Name}})" scope = "sub" base_dn = "ou=corp,ou=Users,dc=team,dc=company,dc=com" access_positive = yes } group { filter = "(objectClass=posixGroup)" scope = "sub" base_dn = "ou=corp,ou=Users,dc=team,dc=company,dc=com" name_attribute = "cn" membership_attribute = "memberOf" cacheable_name = no cacheable_dn = no } client { filter = "(objectClass=frClient)" scope = "sub" base_dn = "ou=corp,ou=Users,dc=team,dc=company,dc=com" attribute { identifier = "radiusClientIdentifier" shortname = "cn" secret = "radiusClientSecret" } } profile { filter = "(&)" } options { ldap_debug = 40 chase_referrals = yes rebind = yes net_timeout = 1 res_timeout = 20 srv_timelimit = 20 idle = 60 probes = 3 interval = 3 } tls { start_tls = no } } rlm_ldap: Falling back to build time libldap version info. Query for LDAP_OPT_API_INFO returned: -1 rlm_ldap: libldap vendor: OpenLDAP version: 20431 accounting { reference = "%{tolower:type.%{Acct-Status-Type}}" } post-auth { reference = "." } rlm_ldap (ldap): Initialising connection pool pool { start = 5 min = 4 max = 32 spare = 3 uses = 0 lifetime = 0 cleanup_interval = 30 idle_timeout = 60 retry_delay = 1 spread = no } rlm_ldap (ldap): Opening additional connection (0) rlm_ldap (ldap): Connecting to ldap.team.company.com:389 rlm_ldap (ldap): Waiting for bind result... rlm_ldap (ldap): Bind successful rlm_ldap (ldap): Opening additional connection (1) rlm_ldap (ldap): Connecting to ldap.team.company.com:389 rlm_ldap (ldap): Waiting for bind result... rlm_ldap (ldap): Bind successful rlm_ldap (ldap): Opening additional connection (2) rlm_ldap (ldap): Connecting to ldap.team.company.com:389 rlm_ldap (ldap): Waiting for bind result... rlm_ldap (ldap): Bind successful rlm_ldap (ldap): Opening additional connection (3) rlm_ldap (ldap): Connecting to ldap.team.company.com:389 rlm_ldap (ldap): Waiting for bind result... rlm_ldap (ldap): Bind successful rlm_ldap (ldap): Opening additional connection (4) rlm_ldap (ldap): Connecting to ldap.team.company.com:389 rlm_ldap (ldap): Waiting for bind result... rlm_ldap (ldap): Bind successful # Loaded module rlm_attr_filter # Instantiating module "attr_filter.post-proxy" from file /usr/local/etc/raddb/mods-enabled/attr_filter attr_filter attr_filter.post-proxy { filename = "/usr/local/etc/raddb/mods-config/attr_filter/post-proxy" key = "%{Realm}" relaxed = no } reading pairlist file /usr/local/etc/raddb/mods-config/attr_filter/post-proxy # Instantiating module "attr_filter.pre-proxy" from file /usr/local/etc/raddb/mods-enabled/attr_filter attr_filter attr_filter.pre-proxy { filename = "/usr/local/etc/raddb/mods-config/attr_filter/pre-proxy" key = "%{Realm}" relaxed = no } reading pairlist file /usr/local/etc/raddb/mods-config/attr_filter/pre-proxy # Instantiating module "attr_filter.access_reject" from file /usr/local/etc/raddb/mods-enabled/attr_filter attr_filter attr_filter.access_reject { filename = "/usr/local/etc/raddb/mods-config/attr_filter/access_reject" key = "%{User-Name}" relaxed = no } reading pairlist file /usr/local/etc/raddb/mods-config/attr_filter/access_reject # Instantiating module "attr_filter.access_challenge" from file /usr/local/etc/raddb/mods-enabled/attr_filter attr_filter attr_filter.access_challenge { filename = "/usr/local/etc/raddb/mods-config/attr_filter/access_challenge" key = "%{User-Name}" relaxed = no } reading pairlist file /usr/local/etc/raddb/mods-config/attr_filter/access_challenge # Instantiating module "attr_filter.accounting_response" from file /usr/local/etc/raddb/mods-enabled/attr_filter attr_filter attr_filter.accounting_response { filename = "/usr/local/etc/raddb/mods-config/attr_filter/accounting_response" key = "%{User-Name}" relaxed = no } reading pairlist file /usr/local/etc/raddb/mods-config/attr_filter/accounting_response # Loaded module rlm_linelog # Instantiating module "linelog" from file /usr/local/etc/raddb/mods-enabled/linelog linelog { filename = "/usr/local/var/log/radius/linelog" permissions = 384 format = "This is a log message for %{User-Name}" reference = "messages.%{%{Packet-Type}:-default}" } # Instantiating module "log_accounting" from file /usr/local/etc/raddb/mods-enabled/linelog linelog log_accounting { filename = "/usr/local/var/log/radius/linelog-accounting" permissions = 384 format = "" reference = "Accounting-Request.%{%{Acct-Status-Type}:-unknown}" } # Loaded module rlm_cache # Instantiating module "cache_eap" from file /usr/local/etc/raddb/mods-enabled/cache_eap cache cache_eap { key = "%{%{control:State}:-%{%{reply:State}:-%{State}}}" ttl = 15 max_entries = 16384 epoch = 0 add_stats = no } # Instantiating module "detail" from file /usr/local/etc/raddb/mods-enabled/detail detail { filename = "/usr/local/var/log/radius/radacct/%{%{Packet-Src-IP-Address}:-%{Packet-Src-IPv6-Address}}/detail-%Y%m%d" header = "%t" permissions = 384 locking = no log_packet_header = no } # Instantiating module "ldap-dev" from file /usr/local/etc/raddb/mods-enabled/ldap-dev ldap ldap-dev { server = "ldap.team.company.com" port = 389 password = <<< secret >>> identity = "cn=admin,dc=team,dc=company,dc=com" user { filter = "(uid=%{%{Stripped-User-Name}:-%{User-Name}})" scope = "sub" base_dn = "ou=dev,ou=Users,dc=team,dc=company,dc=com" access_positive = yes } group { filter = "(objectClass=posixGroup)" scope = "sub" base_dn = "ou=dev,ou=Users,dc=team,dc=company,dc=com" name_attribute = "cn" membership_attribute = "memberOf" cacheable_name = no cacheable_dn = no } client { filter = "(objectClass=frClient)" scope = "sub" base_dn = "ou=dev,ou=Users,dc=team,dc=company,dc=com" attribute { identifier = "radiusClientIdentifier" shortname = "cn" secret = "radiusClientSecret" } } profile { filter = "(&)" } options { ldap_debug = 40 chase_referrals = yes rebind = yes net_timeout = 1 res_timeout = 20 srv_timelimit = 20 idle = 60 probes = 3 interval = 3 } tls { start_tls = no } } accounting { reference = "%{tolower:type.%{Acct-Status-Type}}" } post-auth { reference = "." } rlm_ldap (ldap-dev): Initialising connection pool pool { start = 5 min = 4 max = 32 spare = 3 uses = 0 lifetime = 0 cleanup_interval = 30 idle_timeout = 60 retry_delay = 1 spread = no } rlm_ldap (ldap-dev): Opening additional connection (0) rlm_ldap (ldap-dev): Connecting to ldap.team.company.com:389 rlm_ldap (ldap-dev): Waiting for bind result... rlm_ldap (ldap-dev): Bind successful rlm_ldap (ldap-dev): Opening additional connection (1) rlm_ldap (ldap-dev): Connecting to ldap.team.company.com:389 rlm_ldap (ldap-dev): Waiting for bind result... rlm_ldap (ldap-dev): Bind successful rlm_ldap (ldap-dev): Opening additional connection (2) rlm_ldap (ldap-dev): Connecting to ldap.team.company.com:389 rlm_ldap (ldap-dev): Waiting for bind result... rlm_ldap (ldap-dev): Bind successful rlm_ldap (ldap-dev): Opening additional connection (3) rlm_ldap (ldap-dev): Connecting to ldap.team.company.com:389 rlm_ldap (ldap-dev): Waiting for bind result... rlm_ldap (ldap-dev): Bind successful rlm_ldap (ldap-dev): Opening additional connection (4) rlm_ldap (ldap-dev): Connecting to ldap.team.company.com:389 rlm_ldap (ldap-dev): Waiting for bind result... rlm_ldap (ldap-dev): Bind successful # Instantiating module "exec" from file /usr/local/etc/raddb/mods-enabled/exec exec { wait = no input_pairs = "request" shell_escape = yes timeout = 10 } # Loaded module rlm_expiration # Instantiating module "expiration" from file /usr/local/etc/raddb/mods-enabled/expiration # Loaded module rlm_preprocess # Instantiating module "preprocess" from file /usr/local/etc/raddb/mods-enabled/preprocess preprocess { huntgroups = "/usr/local/etc/raddb/mods-config/preprocess/huntgroups" hints = "/usr/local/etc/raddb/mods-config/preprocess/hints" with_ascend_hack = no ascend_channels_per_line = 23 with_ntdomain_hack = no with_specialix_jetstream_hack = no with_cisco_vsa_hack = no with_alvarion_vsa_hack = no } reading pairlist file /usr/local/etc/raddb/mods-config/preprocess/huntgroups reading pairlist file /usr/local/etc/raddb/mods-config/preprocess/hints } # modules radiusd: #### Loading Virtual Servers #### server { # from file /usr/local/etc/raddb/radiusd.conf } # server server default-dev { # from file /usr/local/etc/raddb/sites-enabled/default-dev # Creating Auth-Type = digest # Loading authenticate {...} # Loading authorize {...} Ignoring "sql" (see raddb/mods-available/README.rst) # Loading preacct {...} # Loading accounting {...} # Loading post-proxy {...} # Loading post-auth {...} } # server default-dev server inner-tunnel-dev { # from file /usr/local/etc/raddb/sites-enabled/inner-tunnel-dev # Loading authenticate {...} # Loading authorize {...} # Loading session {...} # Loading post-proxy {...} # Loading post-auth {...} } # server inner-tunnel-dev server inner-tunnel { # from file /usr/local/etc/raddb/sites-enabled/inner-tunnel # Loading authenticate {...} # Loading authorize {...} # Loading session {...} # Loading post-proxy {...} # Loading post-auth {...} } # server inner-tunnel server default { # from file /usr/local/etc/raddb/sites-enabled/default # Loading authenticate {...} # Loading authorize {...} # Loading preacct {...} # Loading accounting {...} # Loading post-proxy {...} # Loading post-auth {...} } # server default radiusd: #### Opening IP addresses and Ports #### listen { type = "auth" ipaddr = * port = 1814 limit { max_connections = 16 lifetime = 0 idle_timeout = 30 } } listen { type = "acct" ipaddr = * port = 1815 limit { max_connections = 16 lifetime = 0 idle_timeout = 30 } } listen { type = "auth" ipv6addr = :: port = 18144 limit { max_connections = 16 lifetime = 0 idle_timeout = 30 } } listen { type = "acct" ipv6addr = :: port = 18155 limit { max_connections = 16 lifetime = 0 idle_timeout = 30 } } listen { type = "auth" ipaddr = 127.0.0.1 port = 18121 } listen { type = "auth" ipaddr = 127.0.0.1 port = 18120 } listen { type = "auth" ipaddr = * port = 0 limit { max_connections = 16 lifetime = 0 idle_timeout = 30 } } listen { type = "acct" ipaddr = * port = 0 limit { max_connections = 16 lifetime = 0 idle_timeout = 30 } } listen { type = "auth" ipv6addr = :: port = 0 limit { max_connections = 16 lifetime = 0 idle_timeout = 30 } } listen { type = "acct" ipv6addr = :: port = 0 limit { max_connections = 16 lifetime = 0 idle_timeout = 30 } } Listening on auth address * port 1814 as server default-dev Listening on acct address * port 1815 as server default-dev Listening on auth address :: port 18144 as server default-dev Listening on acct address :: port 18155 as server default-dev Listening on auth address 127.0.0.1 port 18121 as server inner-tunnel-dev Listening on auth address 127.0.0.1 port 18120 as server inner-tunnel Listening on auth address * port 1812 as server default Listening on acct address * port 1813 as server default Listening on auth address :: port 1812 as server default Listening on acct address :: port 1813 as server default Opening new proxy socket 'proxy address * port 0' Listening on proxy address * port 32995 Ready to process requests Received Access-Request Id 28 from x.x.x.x:32771 to 10.11.1.102:1814 length 159 User-Name = 'mahendra' NAS-IP-Address = 10.9.20.252 NAS-Port = 0 Called-Station-Id = '12-18-1A-33-1E-9A:company Test' Calling-Station-Id = '28-CF-E9-1C-09-0D' Framed-MTU = 1400 NAS-Port-Type = Wireless-802.11 Connect-Info = 'CONNECT 0Mbps 802.11' EAP-Message = 0x0200000d016d6168656e647261 Message-Authenticator = 0x50c836905077d620bb79e86fdc4d92e3 (0) Received Access-Request packet from host x.x.x.x port 32771, id=28, length=159 (0) User-Name = 'mahendra' (0) NAS-IP-Address = 10.9.20.252 (0) NAS-Port = 0 (0) Called-Station-Id = '12-18-1A-33-1E-9A:company Test' (0) Calling-Station-Id = '28-CF-E9-1C-09-0D' (0) Framed-MTU = 1400 (0) NAS-Port-Type = Wireless-802.11 (0) Connect-Info = 'CONNECT 0Mbps 802.11' (0) EAP-Message = 0x0200000d016d6168656e647261 (0) Message-Authenticator = 0x50c836905077d620bb79e86fdc4d92e3 (0) # Executing section authorize from file /usr/local/etc/raddb/sites-enabled/default-dev (0) authorize { (0) filter_username filter_username { (0) if (!&User-Name) (0) if (!&User-Name) -> FALSE (0) if (&User-Name =~ / /) (0) if (&User-Name =~ / /) -> FALSE (0) if (&User-Name =~ /@.*@/ ) (0) if (&User-Name =~ /@.*@/ ) -> FALSE (0) if (&User-Name =~ /\\.\\./ ) (0) if (&User-Name =~ /\\.\\./ ) -> FALSE (0) if ((&User-Name =~ /@/) && (&User-Name !~ /(a)(.+)\\.(.+)$/)) (0) if ((&User-Name =~ /@/) && (&User-Name !~ /(a)(.+)\\.(.+)$/)) -> FALSE (0) if (&User-Name =~ /\\.$/) (0) if (&User-Name =~ /\\.$/) -> FALSE (0) if (&User-Name =~ /(a)\\./) (0) if (&User-Name =~ /(a)\\./) -> FALSE (0) } # filter_username filter_username = notfound (0) [preprocess] = ok (0) [chap] = noop (0) [mschap] = noop (0) [digest] = noop (0) suffix : Checking for suffix after "@" (0) suffix : No '@' in User-Name = "mahendra", looking up realm NULL (0) suffix : Found realm "DEFAULT" (0) suffix : Adding Realm = "DEFAULT" (0) suffix : Proxying request from user mahendra to realm DEFAULT (0) suffix : Preparing to proxy authentication request to realm "DEFAULT" (0) [suffix] = updated (0) eap : Request is supposed to be proxied to Realm DEFAULT. Not doing EAP. (0) [eap] = noop (0) [files] = noop rlm_ldap (ldap-dev): Reserved connection (4) (0) ldap-dev : EXPAND (uid=%{%{Stripped-User-Name}:-%{User-Name}}) (0) ldap-dev : --> (uid=mahendra) (0) ldap-dev : EXPAND ou=dev,ou=Users,dc=team,dc=company,dc=com (0) ldap-dev : --> ou=dev,ou=Users,dc=team,dc=company,dc=com (0) ldap-dev : Performing search in 'ou=dev,ou=Users,dc=team,dc=company,dc=com' with filter '(uid=mahendra)', scope 'sub' (0) ldap-dev : Waiting for search result... (0) ldap-dev : User object found at DN "cn=Mahendra Maheshwara,ou=dev,ou=Users,dc=team,dc=company,dc=com" (0) ldap-dev : Processing user attributes (0) ldap-dev : control:Password-With-Header += '{MD5}0QiT3SRZWW1UWo3OZ14QOA==' rlm_ldap (ldap-dev): Released connection (4) rlm_ldap (ldap-dev): Closing connection (0), from 1 unused connections (0) [ldap-dev] = ok (0) if (notfound) (0) if (notfound) -> FALSE (0) [expiration] = noop (0) [logintime] = noop (0) [pap] = noop (0) } # authorize = updated Opening new proxy socket 'proxy address * port 0' Listening on proxy address * port 45890 (0) Proxying request to home server 94.143.115.73 port 1812 timeout 30.000000 (0) Sending Access-Request packet to host 94.143.115.73 port 1812, id=160, length=0 (0) User-Name = 'mahendra' (0) NAS-IP-Address = 10.9.20.252 (0) NAS-Port = 0 (0) Called-Station-Id = '12-18-1A-33-1E-9A:company Test' (0) Calling-Station-Id = '28-CF-E9-1C-09-0D' (0) Framed-MTU = 1400 (0) NAS-Port-Type = Wireless-802.11 (0) Connect-Info = 'CONNECT 0Mbps 802.11' (0) EAP-Message = 0x0200000d016d6168656e647261 (0) Message-Authenticator = 0x50c836905077d620bb79e86fdc4d92e3 (0) Event-Timestamp = 'Oct 22 2014 18:03:22 UTC' (0) Realm = 'DEFAULT' (0) EAP-Type = Identity (0) Proxy-State = 0x3238 Sending Access-Request Id 160 from 0.0.0.0:45890 to 94.143.115.73:1812 User-Name = 'mahendra' NAS-IP-Address = 10.9.20.252 NAS-Port = 0 Called-Station-Id = '12-18-1A-33-1E-9A:company Test' Calling-Station-Id = '28-CF-E9-1C-09-0D' Framed-MTU = 1400 NAS-Port-Type = Wireless-802.11 Connect-Info = 'CONNECT 0Mbps 802.11' EAP-Message = 0x0200000d016d6168656e647261 Message-Authenticator = 0x50c836905077d620bb79e86fdc4d92e3 Event-Timestamp = 'Oct 22 2014 18:03:22 UTC' Proxy-State = 0x3238 Waking up in 0.3 seconds. Waking up in 0.1 seconds. (0) Expecting proxy response no later than 29.499700 seconds from now Waking up in 29.4 seconds. Received Access-Reject Id 160 from 94.143.115.73:1812 to 10.11.1.102:45890 length 24 Proxy-State = 0x3238 (0) Received Access-Reject packet from host 94.143.115.73 port 1812, id=160, length=24 (0) Proxy-State = 0x3238 (0) # Executing section post-proxy from file /usr/local/etc/raddb/sites-enabled/default-dev (0) post-proxy { (0) eap : No pre-existing handler found (0) [eap] = noop (0) } # post-proxy = noop (0) Using Post-Auth-Type Reject (0) # Executing group from file /usr/local/etc/raddb/sites-enabled/default-dev (0) Post-Auth-Type REJECT { (0) attr_filter.access_reject : EXPAND %{User-Name} (0) attr_filter.access_reject : --> mahendra (0) attr_filter.access_reject : Matched entry DEFAULT at line 11 (0) [attr_filter.access_reject] = updated (0) eap : Request was previously rejected, inserting EAP-Failure (0) [eap] = updated (0) remove_reply_message_if_eap remove_reply_message_if_eap { (0) if (&reply:EAP-Message && &reply:Reply-Message) (0) if (&reply:EAP-Message && &reply:Reply-Message) -> FALSE (0) else else { (0) [noop] = noop (0) } # else else = noop (0) } # remove_reply_message_if_eap remove_reply_message_if_eap = noop (0) } # Post-Auth-Type REJECT = updated (0) Delaying response for 1 seconds Waking up in 0.3 seconds. Waking up in 0.6 seconds. Received Access-Request Id 28 from x.x.x.x:32771 to 10.11.1.102:1814 length 159 (0) Discarding duplicate request from client allhosts port 32771 - ID: 28 due to delayed response Waking up in 0.1 seconds. (0) Sending delayed response (0) Sending Access-Reject packet to host x.x.x.x port 32771, id=28, length=0 (0) EAP-Message = 0x04000004 (0) Message-Authenticator = 0x00000000000000000000000000000000 Sending Access-Reject Id 28 from 10.11.1.102:1814 to x.x.x.x:32771 EAP-Message = 0x04000004 Message-Authenticator = 0x00000000000000000000000000000000 Waking up in 3.9 seconds. (0) Cleaning up request packet ID 28 with timestamp +31 Ready to process requests

2 1

Fixing \\\\ escapes \\\\\\\\\\
by Alan DeKok 22 Oct '14

22 Oct '14

I finally sat down and went through the source to fix \\ the \\\\ escaping \\\\\\\\ problem. \\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\ The main issue is backwards compatibility. The good news is that the server continues to work as before, with no changes required to your configuration. The *better* news is that if you edit radiusd.conf, and set: correct_escapes = true it will now require only one backslash, instead of many. e.g. if (User-Name =~ /foo\.bar/) { ... } Will match User-Name = "foo.bar", as expected. This is a minor change which should get rid of severe annoyance in the server. If you *don't* set "correct_escapes", you will need to use the old method of: if (User-Name =~ /foo\\.bar/) { ... } Which is annoying. Please test the v3.0.x branch in git. There *are* regression tests for the new behavior, and they've been carefully checked. Alan DeKok.

5 4

Framed-IPv6-Prefix and Delegated-IPv6-Prefix + SQL
by Martin Brault 22 Oct '14

22 Oct '14

Hello, I have been searching how to add Framed and Delegated IPv6 accounting data into SQL and have come across this relatively old info: http://freeradius.1045715.n5.nabble.com/IPv6-Accounting-td4432174.html I am using RedHat/CentOS EL7 with the packaged freeradius-3.0.1 I have started modding queries.conf and have made some good progress: specific changes, I added columns in the SQL radacct table (and I altered the table to add the columns in question): column_list = "\ acctsessionid, acctuniqueid, username, \ realm, nasipaddress, nasportid, \ nasporttype, acctstarttime, acctupdatetime, \ acctstoptime, acctsessiontime, acctauthentic, \ connectinfo_start, connectinfo_stop, acctinputoctets, \ acctoutputoctets, calledstationid, callingstationid, \ acctterminatecause, servicetype, framedprotocol, \ framedipaddress, framedipv6address, framedipv6pool,\ framedipv6prefix, delegatedipv6prefix" and in the start { query, I added: '%{Framed-IPv6-Address}', '%{Framed-IPv6-Pool}', '%{Framed-IPv6-Prefix}', '%{Delegated-IPv6-Prefix}' )" When I look at the detail file, I see the info I am wishing to insert into the database, note the mask of /64 and /56 Tue Oct 21 17:30:04 2014 Acct-Session-Id = '0098EF19' Tunnel-Type:0 = L2TP Tunnel-Medium-Type:0 = IPv4 Tunnel-Server-Endpoint:0 = '192.168.204.210' Tunnel-Client-Endpoint:0 = '192.168.204.231' Tunnel-Assignment-Id:0 = 'foo' Tunnel-Client-Auth-Id:0 = 'foo' Tunnel-Server-Auth-Id:0 = 'pppoe' Acct-Tunnel-Connection = '26314987' Delegated-IPv6-Prefix = 2001:db8:a000::/56 Framed-Protocol = PPP Framed-Interface-Id = 5c73:a540:688f:37e2 Framed-IPv6-Prefix = 2001:db8:a000:ff::/64 Framed-IP-Address = 192.168.138.1 User-Name = 'pppoeuser' Acct-Authentic = RADIUS X-Ascend-Connect-Progress = LAN-Session-Up [...snip...] strangely, when I check what was logged in the SQL table however, I get for some reason /38 netmask for both pieces of information (apologies for the formatting...): MariaDB [radius]> select * from radacct where radacctid = '1494'; | 1494 | 009E2FDE | 7a22c13be9bcca21aaab7d7494ed1826 | pppoeuser | | | 192.168.128.24 | 2546 | Virtual | 2014-10-21 17:30:41 | 2014-10-21 17:30:41 | NULL | 0 | 0 | RADIUS | 2000000000 | | 0 | 111 | | lag-72:450 | | Framed-User | PPP | 72.10.138.1 | | | 2001:db8:a000:ff:0:0:0:0/38 | 2001:db8:a000:0:0:0:0:0/38 | why would the detail file have the correct /64 and /56 netmasks, yet the INSERT (which seems to explode the data into proper ipv6addr format with padded zeroes) would have this strange /38 netmask added? I feel I am close, any help would be much appreciated. Thanks, M.

4 7

tunnel-private-group-id in access-accept
by Marc Boisis 22 Oct '14

22 Oct '14

Hello, The attribute « Tunnel-Private-Group-Id » is sent in an access challenge packet but never in the Access-Accept response, how can I have it in the access accept ? Thanks Sending Access-Challenge of id 50 to 10.9.0.1 port 38933 Tunnel-Private-Group-Id:0 = "1" Tunnel-Medium-Type:0 = IEEE-802 Tunnel-Type:0 = VLAN Class = 0x4f553d61646d696e3b EAP-Message = 0x010200061920 Message-Authenticator = 0x00000000000000000000000000000000 State = 0x066c0c42066e157cccd2b11a53caf40e Sending Access-Accept of id 61 to 10.9.0.1 port 38933 User-Name = "mdelavau\000" MS-MPPE-Recv-Key = 0xe9ac2590a2e51a4337dbabcf1a506eb3fce9d4823514315e383a85d526b4118c MS-MPPE-Send-Key = 0x99ecc593acf1721f395abf9d3e5b195edc16dd881842737d5cb3299fa77ca5ed EAP-Message = 0x030c0004 Message-Authenticator = 0x00000000000000000000000000000000

3 3

Re: CHAP authentication fails when radtest communicates with freeradius 3.0.4 server through radsecproxy 1.6.2
by anoop 22 Oct '14

22 Oct '14

> Hi, > In process of evaluating Radsec feature, We encountered the failure with CHAP authentication. Authentication was successful with PAP, MSCHAP and eap-md5. Version(3.0.4) of freeradius is same in Client and Server. Radsecproxy version is 1.6.2. > > The following is the radtest command used and the output. > $radtest -x -t chap root root1234 127.0.0.1:1812 1812 radsec > Sending Access-Request Id 80 from 0.0.0.0:35860 to 127.0.0.1:1812 > User-Name = 'root' > CHAP-Password = 0xdb78dddafe77d7bb8d5d554b24d26ba2bb > NAS-IP-Address = 127.0.1.1 > NAS-Port = 1812 > Message-Authenticator = 0x00 > Received Access-Reject Id 80 from 127.0.0.1:1812 to 127.0.0.1:35860 > length 33 > Reply-Message = 'Hello, root' > (0) -: Expected Access-Accept got Access-Reject > > > The following is the freeradius 3.0.4 server log. > > Wed Oct 22 19:47:17 2014 : Debug: (0) Reading from socket 14 > READ FROM SSL 138 > 00: 17 03 01 00 20 63 12 16 67 d9 d9 9b 72 10 c9 28 > 10: 29 28 f9 9d a3 91 76 34 76 50 c2 02 0d ed a3 de > 20: d0 b5 b6 05 41 17 03 01 00 60 ed 50 88 08 7f 9f > 30: ed 15 d8 ed b9 0a c7 ea f8 75 21 fe df a9 1c 56 > 40: 91 85 c8 e8 4c fd 7d e3 14 52 78 a2 3d f0 fe fa > 50: 57 a6 bc b7 87 4a 18 95 63 4f 6d 41 7e f4 dc f0 > 60: 10 f3 72 39 3b 58 8f 8c 0a 9f 0f 88 1a 5e 19 d4 > 70: 60 f6 c3 57 d7 a6 88 95 f0 5d f2 c6 de ee 93 0b > 80: d0 24 74 ae 2a 6c 8e 8c 79 96 > Wed Oct 22 19:47:17 2014 : Debug: (0) Application data status 7 > TUNNELED DATA > 75 > 00: 01 01 00 4b ad 6c 2d c3 12 71 3a 32 7a 8a ed ae > 10: 47 a7 34 4f 01 06 72 6f 6f 74 03 13 db 78 dd da > 20: fe 77 d7 bb 8d 5d 55 4b 24 d2 6b a2 bb 04 06 7f > 30: 00 01 01 05 06 00 00 07 14 50 12 07 3f 6b 50 ab > 40: d7 1b 3f d8 e9 b1 2b 4e eb 18 e4 > Wed Oct 22 19:47:17 2014 : Debug: (0) tls_recv: Access-Request packet > from host 192.168.14.56 port 2083, id=1, length=75 > Wed Oct 22 19:47:17 2014 : Debug: Waking up in 0.3 seconds. > Wed Oct 22 19:47:17 2014 : Debug: Thread 1 got semaphore > Wed Oct 22 19:47:17 2014 : Debug: Thread 1 handling request 8, (2 > handled so far) > User-Name = 'root' > CHAP-Password = 0xdb78dddafe77d7bb8d5d554b24d26ba2bb > NAS-IP-Address = 127.0.1.1 > NAS-Port = 1812 > Message-Authenticator = 0x073f6b50abd71b3fd8e9b12b4eeb18e4 > Wed Oct 22 19:47:17 2014 : Debug: (8) Received Access-Request packet > from host 192.168.14.56 port 2083, id=1, length=75 > Wed Oct 22 19:47:17 2014 : Debug: (8) User-Name = 'root' > Wed Oct 22 19:47:17 2014 : Debug: (8) CHAP-Password = > 0xdb78dddafe77d7bb8d5d554b24d26ba2bb > Wed Oct 22 19:47:17 2014 : Debug: (8) NAS-IP-Address = 127.0.1.1 > Wed Oct 22 19:47:17 2014 : Debug: (8) NAS-Port = 1812 > Wed Oct 22 19:47:17 2014 : Debug: (8) Message-Authenticator = > 0x073f6b50abd71b3fd8e9b12b4eeb18e4 > Wed Oct 22 19:47:17 2014 : Debug: (8) # Executing section authorize > from file /usr/local/etc/raddb/sites-enabled/default > Wed Oct 22 19:47:17 2014 : Debug: (8) authorize { > Wed Oct 22 19:47:17 2014 : Debug: (8) filter_username filter_username { > Wed Oct 22 19:47:17 2014 : Debug: (8) if (!&User-Name) > Wed Oct 22 19:47:17 2014 : Debug: (8) if (!&User-Name) -> FALSE > Wed Oct 22 19:47:17 2014 : Debug: (8) if (&User-Name =~ / /) > Wed Oct 22 19:47:17 2014 : Debug: (8) if (&User-Name =~ / /) -> FALSE > Wed Oct 22 19:47:17 2014 : Debug: (8) if (&User-Name =~ /@.*@/ ) > Wed Oct 22 19:47:17 2014 : Debug: (8) if (&User-Name =~ /@.*@/ ) > -> FALSE > Wed Oct 22 19:47:17 2014 : Debug: (8) if (&User-Name =~ /\\.\\./ ) > Wed Oct 22 19:47:17 2014 : Debug: (8) if (&User-Name =~ /\\.\\./ > ) -> FALSE > Wed Oct 22 19:47:17 2014 : Debug: (8) if ((&User-Name =~ /@/) && > (&User-Name !~ /(a)(.+)\\.(.+)$/)) > Wed Oct 22 19:47:17 2014 : Debug: (8) if ((&User-Name =~ /@/) && > (&User-Name !~ /(a)(.+)\\.(.+)$/)) -> FALSE > Wed Oct 22 19:47:17 2014 : Debug: (8) if (&User-Name =~ /\\.$/) > Wed Oct 22 19:47:17 2014 : Debug: (8) if (&User-Name =~ /\\.$/) > -> FALSE > Wed Oct 22 19:47:17 2014 : Debug: (8) if (&User-Name =~ /(a)\\./) > Wed Oct 22 19:47:17 2014 : Debug: (8) if (&User-Name =~ /(a)\\./) > -> FALSE > Wed Oct 22 19:47:17 2014 : Debug: (8) } # filter_username > filter_username = notfound > Wed Oct 22 19:47:17 2014 : Debug: (8) modsingle[authorize]: calling > preprocess (rlm_preprocess) for request 8 > Wed Oct 22 19:47:17 2014 : Debug: (8) modsingle[authorize]: returned > from preprocess (rlm_preprocess) for request 8 > Wed Oct 22 19:47:17 2014 : Debug: (8) [preprocess] = ok > Wed Oct 22 19:47:17 2014 : Debug: (8) modsingle[authorize]: calling > chap (rlm_chap) for request 8 > Wed Oct 22 19:47:17 2014 : Debug: (8) chap : Setting 'Auth-Type := CHAP' > Wed Oct 22 19:47:17 2014 : Debug: (8) modsingle[authorize]: returned > from chap (rlm_chap) for request 8 > Wed Oct 22 19:47:17 2014 : Debug: (8) [chap] = ok > Wed Oct 22 19:47:17 2014 : Debug: (8) modsingle[authorize]: calling > mschap (rlm_mschap) for request 8 > Wed Oct 22 19:47:17 2014 : Debug: (8) modsingle[authorize]: returned > from mschap (rlm_mschap) for request 8 > Wed Oct 22 19:47:17 2014 : Debug: (8) [mschap] = noop > Wed Oct 22 19:47:17 2014 : Debug: (8) modsingle[authorize]: calling > digest (rlm_digest) for request 8 > Wed Oct 22 19:47:17 2014 : Debug: (8) modsingle[authorize]: returned > from digest (rlm_digest) for request 8 > Wed Oct 22 19:47:17 2014 : Debug: (8) [digest] = noop > Wed Oct 22 19:47:17 2014 : Debug: (8) modsingle[authorize]: calling > suffix (rlm_realm) for request 8 > Wed Oct 22 19:47:17 2014 : Debug: (8) suffix : Checking for suffix > after "@" > Wed Oct 22 19:47:17 2014 : Debug: (8) suffix : No '@' in User-Name = > "root", looking up realm NULL > Wed Oct 22 19:47:17 2014 : Debug: (8) suffix : No such realm "NULL" > Wed Oct 22 19:47:17 2014 : Debug: (8) modsingle[authorize]: returned > from suffix (rlm_realm) for request 8 > Wed Oct 22 19:47:17 2014 : Debug: (8) [suffix] = noop > Wed Oct 22 19:47:17 2014 : Debug: (8) modsingle[authorize]: calling > eap (rlm_eap) for request 8 > Wed Oct 22 19:47:17 2014 : Debug: (8) eap : No EAP-Message, not doing EAP > Wed Oct 22 19:47:17 2014 : Debug: (8) modsingle[authorize]: returned > from eap (rlm_eap) for request 8 > Wed Oct 22 19:47:17 2014 : Debug: (8) [eap] = noop > Wed Oct 22 19:47:17 2014 : Debug: (8) modsingle[authorize]: calling > files (rlm_files) for request 8 > Wed Oct 22 19:47:17 2014 : Debug: (8) files : users: Matched entry > root at line 91 > Wed Oct 22 19:47:17 2014 : Debug: (8) files : ::: FROM 1 TO 0 MAX 1 > Wed Oct 22 19:47:17 2014 : Debug: (8) files : ::: Examining Reply-Message > Wed Oct 22 19:47:17 2014 : Debug: Hello, %{User-Name} > Wed Oct 22 19:47:17 2014 : Debug: Parsed xlat tree: > Wed Oct 22 19:47:17 2014 : Debug: literal --> Hello, > Wed Oct 22 19:47:17 2014 : Debug: attribute --> User-Name > Wed Oct 22 19:47:17 2014 : Debug: (8) files : EXPAND Hello, %{User-Name} > Wed Oct 22 19:47:17 2014 : Debug: (8) files : --> Hello, root > Wed Oct 22 19:47:17 2014 : Debug: (8) files : ::: APPENDING > Reply-Message FROM 0 TO 0 > Wed Oct 22 19:47:17 2014 : Debug: (8) files : ::: TO in 0 out 1 > Wed Oct 22 19:47:17 2014 : Debug: (8) files : ::: to[0] = Reply-Message > Wed Oct 22 19:47:17 2014 : Debug: (8) modsingle[authorize]: returned > from files (rlm_files) for request 8 > Wed Oct 22 19:47:17 2014 : Debug: (8) [files] = ok > Wed Oct 22 19:47:17 2014 : Debug: (8) modsingle[authorize]: calling > expiration (rlm_expiration) for request 8 > Wed Oct 22 19:47:17 2014 : Debug: (8) modsingle[authorize]: returned > from expiration (rlm_expiration) for request 8 > Wed Oct 22 19:47:17 2014 : Debug: (8) [expiration] = noop > Wed Oct 22 19:47:17 2014 : Debug: (8) modsingle[authorize]: calling > logintime (rlm_logintime) for request 8 > Wed Oct 22 19:47:17 2014 : Debug: (8) modsingle[authorize]: returned > from logintime (rlm_logintime) for request 8 > Wed Oct 22 19:47:17 2014 : Debug: (8) [logintime] = noop > Wed Oct 22 19:47:17 2014 : Debug: (8) modsingle[authorize]: calling > pap (rlm_pap) for request 8 > Wed Oct 22 19:47:17 2014 : WARNING: (8) pap : Auth-Type already set. > Not setting to PAP > Wed Oct 22 19:47:17 2014 : Debug: (8) modsingle[authorize]: returned > from pap (rlm_pap) for request 8 > Wed Oct 22 19:47:17 2014 : Debug: (8) [pap] = noop > Wed Oct 22 19:47:17 2014 : Debug: (8) } # authorize = ok > Wed Oct 22 19:47:17 2014 : Debug: (8) Found Auth-Type = CHAP > Wed Oct 22 19:47:17 2014 : Debug: (8) # Executing group from file > /usr/local/etc/raddb/sites-enabled/default > Wed Oct 22 19:47:17 2014 : Debug: (8) Auth-Type CHAP { > Wed Oct 22 19:47:17 2014 : Debug: (8) modsingle[authenticate]: calling > chap (rlm_chap) for request 8 > Wed Oct 22 19:47:17 2014 : Debug: (8) chap : Login attempt by "root" > with CHAP password > Wed Oct 22 19:47:17 2014 : Debug: (8) chap : Comparing with "known > good" Cleartext-Password "root1234" > Wed Oct 22 19:47:17 2014 : Debug: (8) chap : CHAP challenge : > ad6c2dc312713a327a8aedae47a7344f > Wed Oct 22 19:47:17 2014 : Debug: (8) chap : Client sent : > 78dddafe77d7bb8d5d554b24d26ba2bb > Wed Oct 22 19:47:17 2014 : Debug: (8) chap : We calculated : > 8b672ba8589f7d0658b3b3e8e2002b09 > Wed Oct 22 19:47:17 2014 : ERROR: (8) chap : Password is comparison > failed: password is incorrect > Wed Oct 22 19:47:17 2014 : Debug: (8) modsingle[authenticate]: > returned from chap (rlm_chap) for request 8 > Wed Oct 22 19:47:17 2014 : Debug: (8) [chap] = reject > Wed Oct 22 19:47:17 2014 : Debug: (8) } # Auth-Type CHAP = reject > Wed Oct 22 19:47:17 2014 : Debug: (8) Failed to authenticate the user > Wed Oct 22 19:47:17 2014 : Debug: (8) Using Post-Auth-Type Reject > Wed Oct 22 19:47:17 2014 : Debug: (8) # Executing group from file > /usr/local/etc/raddb/sites-enabled/default > Wed Oct 22 19:47:17 2014 : Debug: (8) Post-Auth-Type REJECT { > Wed Oct 22 19:47:17 2014 : Debug: (8) modsingle[post-auth]: calling > attr_filter.access_reject (rlm_attr_filter) for request 8 > Wed Oct 22 19:47:17 2014 : Debug: %{User-Name} > Wed Oct 22 19:47:17 2014 : Debug: Parsed xlat tree: > Wed Oct 22 19:47:17 2014 : Debug: attribute --> User-Name > Wed Oct 22 19:47:17 2014 : Debug: (8) attr_filter.access_reject : > EXPAND %{User-Name} > Wed Oct 22 19:47:17 2014 : Debug: (8) attr_filter.access_reject : > --> root > Wed Oct 22 19:47:17 2014 : Debug: (8) attr_filter.access_reject : > Matched entry DEFAULT at line 11 > Wed Oct 22 19:47:17 2014 : Debug: (8) attr_filter.access_reject : > Reply-Message = 'Hello, root' allowed by Reply-Message =* '' > Wed Oct 22 19:47:17 2014 : Debug: (8) attr_filter.access_reject : > Attribute "Reply-Message" allowed by 1 rules, disallowed by 0 rules > Wed Oct 22 19:47:17 2014 : Debug: (8) modsingle[post-auth]: returned > from attr_filter.access_reject (rlm_attr_filter) for request 8 > Wed Oct 22 19:47:17 2014 : Debug: (8) [attr_filter.access_reject] = > updated > Wed Oct 22 19:47:17 2014 : Debug: (8) modsingle[post-auth]: calling > eap (rlm_eap) for request 8 > Wed Oct 22 19:47:17 2014 : Debug: (8) eap : Request didn't contain an > EAP-Message, not inserting EAP-Failure > Wed Oct 22 19:47:17 2014 : Debug: (8) modsingle[post-auth]: returned > from eap (rlm_eap) for request 8 > Wed Oct 22 19:47:17 2014 : Debug: (8) [eap] = noop > Wed Oct 22 19:47:17 2014 : Debug: (8) remove_reply_message_if_eap > remove_reply_message_if_eap { > Wed Oct 22 19:47:17 2014 : Debug: (8) if (&reply:EAP-Message && > &reply:Reply-Message) > Wed Oct 22 19:47:17 2014 : Debug: (8) if (&reply:EAP-Message && > &reply:Reply-Message) -> FALSE > Wed Oct 22 19:47:17 2014 : Debug: (8) else else { > Wed Oct 22 19:47:17 2014 : Debug: (8) modsingle[post-auth]: calling > noop (rlm_always) for request 8 > Wed Oct 22 19:47:17 2014 : Debug: (8) modsingle[post-auth]: returned > from noop (rlm_always) for request 8 > Wed Oct 22 19:47:17 2014 : Debug: (8) [noop] = noop > Wed Oct 22 19:47:17 2014 : Debug: (8) } # else else = noop > Wed Oct 22 19:47:17 2014 : Debug: (8) } # > remove_reply_message_if_eap remove_reply_message_if_eap = noop > Wed Oct 22 19:47:17 2014 : Debug: (8) } # Post-Auth-Type REJECT = updated > Wed Oct 22 19:47:17 2014 : Debug: (8) Delaying response for 1 seconds > Wed Oct 22 19:47:17 2014 : Debug: Thread 1 waiting to be assigned a > request > Wed Oct 22 19:47:18 2014 : Debug: Waking up in 0.6 seconds. > Wed Oct 22 19:47:18 2014 : Debug: (8) Sending delayed response > Wed Oct 22 19:47:18 2014 : Debug: (8) Sending Access-Reject packet to > host 192.168.14.56 port 2083, id=1, length=0 > Wed Oct 22 19:47:18 2014 : Debug: (8) Reply-Message = 'Hello, root' > Sending Access-Reject Id 1 from 0.0.0.0:2083 to 192.168.14.56:2083 > Reply-Message = 'Hello, root' > TUNNELED DATA < 33 > 00: 03 01 00 21 76 36 57 24 bd 97 0d 4a 15 a5 f2 4d > 10: 13 5f 61 fd 12 0d 48 65 6c 6c 6f 2c 20 72 6f 6f > 20: 74 > WRITE TO SSL 69 > 00: 17 03 01 00 40 bb e3 13 b9 34 ff 57 aa 32 38 19 > 10: ad da 7c aa 29 76 bf 04 ff 5a b1 64 00 5d 3c ff > 20: 2c a1 4f 5f 76 31 63 04 d3 93 f9 a1 41 b8 1f 23 > 30: c9 c6 7e 59 da 1a 46 ff a7 e0 eb 7d f1 a2 0a 56 > 40: f3 d4 c4 dd de > Wed Oct 22 19:47:18 2014 : Debug: (8) Writing to socket 14 > Wed Oct 22 19:47:18 2014 : Debug: Waking up in 3.9 seconds. > Wed Oct 22 19:47:23 2014 : Debug: (8) Cleaning up request packet ID 1 > with timestamp +397 > Wed Oct 22 19:47:23 2014 : Debug: Waking up in 5.4 seconds. > Wed Oct 22 19:47:28 2014 : Debug: Waking up in 18.9 seconds. > > > > Thanks and Regards, > Anoop

2 1

Daily counter and options to extend
by Matej Žerovnik 22 Oct '14

22 Oct '14

Hello! I'm trying to achieve something, but not sure for to do it... What I want is to have a fixed daily limit for all users set to 1h. That is no problem, since I set Max-Daily-Session for all users via group check. But sometimes I would like to extend that limit to 2 or more hours for certain users. I could set Max-Daily-Session for that certain user, but that setting would not get reset at the end of the way. I would have to run a cronjob to purge settings in sql... Is there a nicer/proper way of achieving that? Matej -- --- Matej Zerovnik

2 3

PAM: change user's passwords in the Freeradius server
by Roberto Carna 22 Oct '14

22 Oct '14

Dear, I have a Freeradius/Mysql server that authenticates SSH logins from Debian machines. In the Freeradius I add the user and password basically, and in each Debian machine I have installed the libpam-radius-auth package in order to execute SSH and SUDO, all authenticating against the Freeradius server. But now I want the Debian machines' users to change their passwords with the "passwd" command in the MySQL database from Freeradius, but after editing the file /etc/pam.d/passwd as follow: password sufficient pam_radius_auth.so debug @include common-password the users can't change their passwords at all in the Freeradius server. As I said, the SSH login and SUDO command work perfectly authenticating against Freeradius, this is my /etc/pam.d/sudo file: auth required pam_radius_auth.so debug account required pam_radius_auth.so debug password required pam_radius_auth.so debug How can I edit the /etc/pam.d/passwd file in order to let users to change Freeradius passwords??? Thanks a lot, Roberto

3 6

Quick way of finding out which EAP outer was used?
by Stefan Paetow 21 Oct '14

21 Oct '14

Hi, I have a quick question again: I know the EAP type is passed along in the EAP message in the outer request and FR figures it out (obviously). Now I want to do some bits depending on whether PEAP was used or whether EAP-TTLS was used... What would arguably be the quickest way be to discover either was used? For TLS that's easier, but TTLS/PEAP? Is there a virtual attribute for it or do I need to pick apart the packet? :-) Any hints where to start would be very much appreciated :-) Thanks in advance Stefan Paetow Moonshot Industry & Research Liaison Coordinator t: +44 (0)1235 822 125 gpg: 0x3FCE5142 xmpp: stefanp(a)jabber.dev.ja.net skype: stefan.paetow.janet Janet, the UK’s research and education network. Janet(UK) is a trading name of Jisc Collections and Janet Limited, a not-for-profit company which is registered in England under No. 2881024 and whose Registered Office is at Lumen House, Library Avenue, Harwell Oxford, Didcot, Oxfordshire. OX11 0SG. VAT No. 614944238

3 3