November 2014 - Freeradius-Users - lists.freeradius.org

Version 3.0.4 sql groups handling issue
by Philippe MARASSE 28 Nov '14

28 Nov '14

Hello, I'm upgrading from FR 3.0.0 to 3.0.4, during the tests, I've ran into an issue : - My NAS are sorted into 2 different huntgroups - My users are members of 2 SQL groups - Each SQL group is attached to one huntgroup Under v3.0.4 group processing stops when the first group get processed whether huntgroup matches or not. I think I've found the culprit line 621 in rlm_sql.c, the continue instruction skips lines 659 & 660 : pairdelete(&request->packet->vps, PW_SQL_GROUP, 0, TAG_ANY); entry = entry->next; As far as Fall-Through's default value has changed from 1 in v3.0.0 to FALL_THROUGH_DEFAULT (0), my second group never get processed. Another test : I've added Fall-Through = Yes into my radreply table : bang, infinite loop on the first group ! From my log : rlm_sql (sql): Executing query: 'SELECT id, groupname, attribute, Value, op FROM radgroupcheck WHERE groupname = 'pcs-sites' ORDER BY id' (1) sql : EXPAND SELECT id, groupname, attribute, Value, op FROM radgroupcheck WHERE groupname = '%{Sql-Group}' ORDER BY id (1) sql : --> SELECT id, groupname, attribute, Value, op FROM radgroupcheck WHERE groupname = 'pcs-sites' ORDER BY id rlm_sql (sql): Executing query: 'SELECT id, groupname, attribute, Value, op FROM radgroupcheck WHERE groupname = 'pcs-sites' ORDER BY id' (1) sql : EXPAND SELECT id, groupname, attribute, Value, op FROM radgroupcheck WHERE groupname = '%{Sql-Group}' ORDER BY id (1) sql : --> SELECT id, groupname, attribute, Value, op FROM radgroupcheck WHERE groupname = 'pcs-sites' ORDER BY id rlm_sql (sql): Executing query: 'SELECT id, groupname, attribute, Value, op FROM radgroupcheck WHERE groupname = 'pcs-sites' ORDER BY id' (1) sql : EXPAND SELECT id, groupname, attribute, Value, op FROM radgroupcheck WHERE groupname = '%{Sql-Group}' ORDER BY id (1) sql : --> SELECT id, groupname, attribute, Value, op FROM radgroupcheck WHERE groupname = 'pcs-sites' ORDER BY id rlm_sql (sql): Executing query: 'SELECT id, groupname, attribute, Value, op FROM radgroupcheck WHERE groupname = 'pcs-sites' ORDER BY id' (1) sql : EXPAND SELECT id, groupname, attribute, Value, op FROM radgroupcheck WHERE groupname = '%{Sql-Group}' ORDER BY id (1) sql : --> SELECT id, groupname, attribute, Value, op FROM radgroupcheck WHERE groupname = 'pcs-sites' ORDER BY id rlm_sql (sql): Executing query: 'SELECT id, groupname, attribute, Value, op FROM radgroupcheck WHERE groupname = 'pcs-sites' ORDER BY id' (1) sql : EXPAND SELECT id, groupname, attribute, Value, op FROM radgroupcheck WHERE groupname = '%{Sql-Group}' ORDER BY id (1) sql : --> SELECT id, groupname, attribute, Value, op FROM radgroupcheck WHERE groupname = 'pcs-sites' ORDER BY id I can post the entire log if needed. BTW, I've got a look on github, branch 3.0.x, rlm_sql.c seems to have the same issue (continue on line 720, skipped lines 769 & 770). Regards. -- Philippe MARASSE Responsable pôle Infrastructures - DSIO Centre Hospitalier Henri Laborit CS 10587 - 370 avenue Jacques Coeur 86021 Poitiers Cedex Tel : 05.49.44.57.19

3 9

re:NAP
by Zulzig 27 Nov '14

27 Nov '14

Hello, sorry Alan, I give you the informations that you want. i created one table in my radius database. if the reply on radpostauth is like Access-Accept. the table store the username and the authdate. I added a trigger which it run each time, when a username tries to log on. the trigger makes a diff between the authdate.rapostauth and the authdate.newtable of the user. if the date is up to 20 days, the trigger add/modify the groupname.radusergroup of the user. at he result the radgroupreply should be different. but in my case, it's different, the add/update works very well, but this are the last parameters before the modification of the radusergroup table which are sent radgroupreply table, | id | groupname | attribute | op | value | | 1 | safe | Tunnel-type | = | 13 | | 2 |safe | Tunnel-Medium-Type | = | 6 | | 3 | safe | Tunnel-Private-Group-ID | = | 7 | | 5 | no-safe | Tunnel-type | = | 13 | | 6 | no-safe | Tunnel-Medium-Type | = | 6 | | 7 | no-safe | Tunnel-Private-Group-ID | = | 8 before radusergroup; username :toto | groupname: safe | priority: 1 last Access-Accept > 20 days radusergroup; username :toto | groupname: no-safe | priority: 1 radgroupreply safe instead of no-safe. i hope that i answer at yours last questions

1 0

Authenticate WPA enterprise from custom service
by Adnan Miljkovic 27 Nov '14

27 Nov '14

Hello, I am trying to authenticate wifi users by using WPA enterprise. So far I have a script in the module folder: exec checkuser { wait = yes input_pairs = request output_pairs = reply program = "/etc/raddb/check-user.php -log -debug '%{User-Name}' '%{User-Password}' '%{NAS-IP-Address}' '%{Called-Station-Id}' '%{Calling-Station-Id}' '%{Chap-Password}'" shell_escape = yes } Where I pass the username and password. The script does the rest. It works properly. In my site-enables/default in the authorize section as the last check I have this: update control { Auth-Type := CheckUser } When I test it by using: # radtest adnan myPassword localhost 0 testing123 I clearly get in my log: Found Auth-Type = CheckUser # Executing group from file /etc/raddb/sites-enabled/default +- entering group CheckUser {...} [checkuser] expand: '%{User-Name}' -> 'adnan' [checkuser] expand: '%{User-Password}' -> 'myPassword ' [checkuser] expand: '%{NAS-IP-Address}' -> '172.20.4.1' [checkuser] expand: '%{Called-Station-Id}' -> '' [checkuser] expand: '%{Calling-Station-Id}' -> '' [checkuser] expand: '%{Chap-Password}' -> '' And the value for password is shown in the %{User-Password} variable. So it is passed to my PHP script for further checks. But when I try to login from my Android device I do not get the password, it is empty. I am using the following settings on my Android device, MSCHAPV2, and adding the identity (my username) and password. Is it possible to get the password in plain text from the remote device? I am missing some concept here, is there another way of authentication for WPA enterprise? All help is much appreciated. Regards, Adnan

2 1

Freeradius mysql ippool duplicate IP's
by Wesley 26 Nov '14

26 Nov '14

Hi there, We are using FreeRADIUS Version 2.1.12 on CentOS 6 The problem we are getting is that we are getting duplicate IP address issues on our network when assigning IP's via the mysql ippool setup. Have looked through many forums & help boards but still no joy Please advise what information you require for you to assist me. Regards

4 13

Version 3.0.4 and Interim-Update
by Heiko O 26 Nov '14

26 Nov '14

Hi all, i'm trying out freeradius 3.0.4 and have problems with Interim-Accounts. I get (8) # Executing section accounting from file /etc/raddb/sites-enabled/default (8) accounting { (8) detail : EXPAND /var/log/radius/radacct/%{%{Packet-Src-IP-Address}:-%{Packet-Src-IPv6-Address}}/detail-%Y%m%d (8) detail : --> /var/log/radius/radacct/172.16.252.9/detail-20141126 (8) detail : /var/log/radius/radacct/%{%{Packet-Src-IP-Address}:-%{Packet-Src-IPv6-Address}}/detail-%Y%m%d expands to /var/log/radius/radacct/172.16.252.9/detail-20141126 (8) detail : EXPAND %t (8) detail : --> Wed Nov 26 12:56:50 2014 (8) [detail] = ok (8) sql : EXPAND %{tolower:type.%{%{Acct-Status-Type}:-none}.query} (8) sql : --> type.interim-update.query No such configuration item .type.interim-update.query (8) [sql] = fail (8) } # accounting = fail (8) Not sending reply (8) Finished request My question is: how and where can i find / activate or place this interim-update.query? I read the README, that the config could be patched - but i'd like to migrate as suggested. So, how do i configure Interim-Updates properly? Thanks, Heiko

2 1

How to enable/disable log 'Error: Ignoring request to authentication address...'
by Christian Springer 25 Nov '14

25 Nov '14

Hello, I'm receiving radius requests from a client not in the clients.conf, but the log message is not appearing. Is there a way to enable/disable that message ? It seems I've disabled the log output somehow... Thank you, regards Chris

3 2

rlm_cache updates for v3.0.x
by Arran Cudbard-Bell 25 Nov '14

25 Nov '14

The rlm_cache module will act as described in the notes in raddb/cache in v3.0.x. The main change between 3.0.5 rlm_cache and 3.0.6 rlm_cache are that it will return different rcodes for different cache states. In <= v3.0.5 ------------ The module returns "ok" if it found a cache entry. The module returns "updated" if it added a new cache entry. The module returns "noop" if it did nothing. In >= v3.0.6 ------------ The module returns "ok" if it found or created a cache entry. The module returns "updated" if it merged a cached entry. The module returns "noop" if it did nothing. The module returns "fail" on error. The full list of return code for the various runtime options are documented here: https://github.com/FreeRADIUS/freeradius-server/blob/v3.0.x/raddb/mods-avai… The second change is that the cache module will now default to *not* merging the cached attributes back into the current request when creating a cache entry. You can still force the server to do this by setting control:Cache-Merge := yes. The original reason for merging the Cache-Entry into the current request was so that the results of xlat expansions performed by the cache module would be available. Almost no one used the rlm_cache module to cache the results of xlat expansions however, and the behaviour had some odd side effects when working with attribute references, so it seems more sensible to leave it disabled by default. If anyone has any objections to the above behaviour changes, feel free to post them to the list. We also decided that the multivalued conditions were pretty useful and should be pulled into v3.0.x as well. The test coverage of the condition parser/evaluator is good, we don't expect any issues with it. Testing of current v3.0.x branch would be appreciated. -Arran Arran Cudbard-Bell <a.cudbardb(a)freeradius.org> FreeRADIUS development team FD31 3077 42EC 7FCD 32FE 5EE2 56CF 27F9 30A8 CAA2

2 2

Question about SQL fail open in post-auth and keyed-balance use in load balancing configuration
by John Douglass 24 Nov '14

24 Nov '14

Question 1: I thought I once read how to add this "fail open" in regards to using an SQL module. I have a table that gets updated after an auth, but if the DB is slow or there is a network issue, I want it to go on. It's not vital to auth the user, just using it as a "location update" of sorts. Is this the correct configuration for this behavior? post-auth { redundant { sql_location handled } } Question 2: I am experimenting with load balancing. I read the comments about keyed-balance: # keyed-balance - the home server is chosen by hashing (FNV) the contents of the Load-Balance-Key attribute from the control items. The request is then sent to home server # chosen by taking: # server = (hash % num_servers_in_pool). # # If there is no Load-Balance-Key in the control items, the load balancing method is identical to "load-balance". # # For most non-EAP authentication methods, The User-Name attribute provides a good key. An "unlang" policy can be used to copy the User-Name to the Load-Balance-Key # attribute. This method may not work for EAP sessions, as the User-Name outside of the TLS tunnel is often static, e.g. "anonymous@realm". If the username is a bad choice, I figured that the Calling-Station-Id (which in my case is the client MAC) would be a way to consistently have the same Load-Balance-Key. I am adding this to my server {} section: pre-proxy { update control { Load-Balance-Key := "%{Calling-Station-Id}" } updated } But I am only seeing use of one of the defined proxy servers as defined in my "home_server_pool {}" section when I force auth's to this server. Would not expect every MAC address to hash to the same radius back end given the variation of MAC addresses: home_server = vm1 home_server = vm2 Is the above pre-proxy{} segment doing what I think it should do? Update the Load-Balance-Key to the control before it hits the proxy segment? Just want some confirmation that I am on the right track or I am going about this wrong (or if what I'm trying is not a good idea/possible). Thanks! - John Douglass, Sr. Systems IT/Architect, Georgia Institute of Technology

2 1

Segmentaton fault in 3.0.5
by nicolas.clo＠ricoh-industrie.fr 24 Nov '14

24 Nov '14

Hi list, Since 3.0.5 ( FreeRADIUS Version 3.0.5 (git #8bc2d13), for host i486-pc-linux-gnu,) Program received signal SIGSEGV, Segmentation fault. 0xb7a45287 in eappeap_process () from /usr/lib/freeradius/rlm_eap_peap.so (gdb) bt #0 0xb7a45287 in eappeap_process () from /usr/lib/freeradius/rlm_eap_peap.so #1 0xb7a433f9 in ?? () from /usr/lib/freeradius/rlm_eap_peap.so #2 0xb7a57ea6 in ?? () from /usr/lib/freeradius/rlm_eap.so #3 0xb7a58268 in eap_method_select () from /usr/lib/freeradius/rlm_eap.so #4 0xb7a57100 in ?? () from /usr/lib/freeradius/rlm_eap.so #5 0x0806af04 in ?? () #6 0x0806a2c0 in ?? () #7 0x0806a534 in ?? () #8 0x0806b55a in modcall () #9 0x08066467 in indexed_modcall () #10 0x080672eb in process_authenticate () #11 0x08055d3d in rad_authenticate () #12 0x08079eb7 in ?? () #13 0x0807597d in ?? () #14 0x08077d87 in request_receive () #15 0x08060bfd in ?? () #16 0x080743af in ?? () #17 0xb7fa6799 in fr_event_loop () from /usr/lib/freeradius/libfreeradius-radius.so #18 0x0807add3 in radius_event_process () #19 0x08054859 in main () Nicolas CLO

3 4

RADIUS Server Authorization and Accounting - MY SQL Configuration - Please Help
by anusha mule 24 Nov '14

24 Nov '14

Hi, We have the following understanding RADIUS Authentication and Accounting flow :- 1. When the Access-request from the NAS, Server will search in the radcheck table to check the attributes for the user. 2. If check attributes are found and its matches to the user, then the server will pull the reply items (Attributes like Bandwidth, Volume, Timeout, etc) from the radreply table for this user and add it in the Access-Accept packet. 3. On receiving Access-Accept packet, session will get established for the user and Accounting-Start message will get transmitted to the Server. 4. The server will update the radacct table with Accounting start message. 5. When the station get disconnected, Session should get deleted and Accounting-Stop message should sent to the Server including user statistics (like Session-time, input-octets, output-octets, etc)in it. 6. Server will update the radacct table with all the attributed present in the STOP message. With let us consider the following simple scenario :- RADIUS Server having User details as User Name = Joe Password = Joe123 Timeout = 30000 Secs Step 1: During the initial connect - User should be authenticated and Access-Accept should contains the attribute value as 30000 Secs, mentioning the max duration that the user session is allowed. Once the session is established, RADIUS Accounting Start message is send to RADIUS server. Next let us say, User has been disconnected after 20000 Secs. Again, the RADIUS Accounting Stop message with the consumed duration of 20000 Secs shall be send to the RADIUS Server. Step 2: Now, when the same user tries to authenticate, he should be authenticated and the Access-Accept provide the Timeout attribute as 10000 Secs ( i.e. 30000 Secs – 20000 Secs) Here, let us assume the user used the full session duration and get time out. Again, the RADIUS Accounting Stop message with the consumed duration of 10000 Secs shall be send to the RADIUS Server. Step 3: Now, when the same user tries to authenticate, he should be rejected. How can the above be achieved using radius server configurations. Kindly help us in this. Thanks in advance. Thank you & Regards, Anusha M

4 8