February 2014 - Freeradius-Users - lists.freeradius.org

FR3.0.1Problems with raddebug and radmin.
by Palmer J.D.F. 27 Feb '14

27 Feb '14

Hello, I'm having some issues with raddebug and radmin not matching conditions. If I run raddebug with no condition, and run a test auth an output is generated; however if I set a condition I get no output. I've not been able to get radmin to write anything to my debug file. I've tried a few different formats for my conditions, all to no avail. -u user(a)domain.com -u 'user(a)domain.com' -u "user(a)domain.com" debug condition '(User-Name == -u user(a)domain.com)' debug condition '(User-Name == -u 'user(a)domain.com')' debug condition '(User-Name == -u "user(a)domain.com")' Only raddebug with no condition produces anything, which at least proves that it is connecting to the radiusd socket. I also note that if I set a condition within radmin, then do 'show debug condition' there is no condition active. Whereas if I repeat this exercise on FR2.2.0 it returns my condition as expected. Can anyone confirm that they are seeing the same behaviour? FR 3.0.0 had an issues where radmin and raddebug would crash radiusd on exit, however that appears to be fixed in FR3.0.1 Many thanks, Jezz. Jezz Palmer Information Services and Systems Swansea University Singleton Park Swansea SA2 8PP

3 4

DHCP with Oracle and sqlippool
by Бен Томпсон 27 Feb '14

27 Feb '14

Hello everyone I am trying to set up FreeRADIUS as a DHCP server for use with an IP pool in an Oracle DB. I built the latest version from git, and added some basic config to test the DHCP pool functionality. However, the server does not process any requests and gives the following error: Received DHCP-Discover of id cf875833 from 10.180.1.1:67 to 10.160.0.254:67 Threads: total/active/spare threads = 0/0/0 Something is blocking the server. There are 0 packets in the queue, waiting to be processed. Ignoring the new request. (0) Cleaning up request packet ID 3481753651 with timestamp +302 I would be very grateful if someone could advise what the problem is. The full debug log is as follows: radiusd: FreeRADIUS Version 3.1.0 (git #10ffd5b), for host x86_64-unknown-linux-gnu, built on Feb 21 2014 at 13:50:22 Copyright (C) 1999-2014 The FreeRADIUS server project and contributors There is NO warranty; not even for MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE You may redistribute copies of FreeRADIUS under the terms of the GNU General Public License For more information about these matters, see the file named COPYRIGHT Starting - reading configuration files ... including dictionary file /usr/local/share/freeradius/dictionary including dictionary file /usr/local/etc/raddb/dictionary including configuration file /usr/local/etc/raddb/radiusd.conf including configuration file /usr/local/etc/raddb/clients.conf including files in directory /usr/local/etc/raddb/mods-enabled/ including configuration file /usr/local/etc/raddb/mods-enabled/expr including configuration file /usr/local/etc/raddb/mods-enabled/ntlm_auth including configuration file /usr/local/etc/raddb/mods-enabled/logintime including configuration file /usr/local/etc/raddb/mods-enabled/expiration including configuration file /usr/local/etc/raddb/mods-enabled/realm including configuration file /usr/local/etc/raddb/mods-enabled/detail.log including configuration file /usr/local/etc/raddb/mods-enabled/pap including configuration file /usr/local/etc/raddb/mods-enabled/digest including configuration file /usr/local/etc/raddb/mods-enabled/attr_filter including configuration file /usr/local/etc/raddb/mods-enabled/chap including configuration file /usr/local/etc/raddb/mods-enabled/eap including configuration file /usr/local/etc/raddb/mods-enabled/utf8 including configuration file /usr/local/etc/raddb/mods-enabled/replicate including configuration file /usr/local/etc/raddb/mods-enabled/detail including configuration file /usr/local/etc/raddb/mods-enabled/always including configuration file /usr/local/etc/raddb/mods-enabled/echo including configuration file /usr/local/etc/raddb/mods-enabled/cache_eap including configuration file /usr/local/etc/raddb/mods-enabled/linelog including configuration file /usr/local/etc/raddb/mods-enabled/files including configuration file /usr/local/etc/raddb/mods-enabled/dhcp including configuration file /usr/local/etc/raddb/mods-enabled/dynamic_clients including configuration file /usr/local/etc/raddb/mods-enabled/mschap including configuration file /usr/local/etc/raddb/mods-enabled/radutmp including configuration file /usr/local/etc/raddb/mods-enabled/unix including configuration file /usr/local/etc/raddb/mods-enabled/sql including configuration file /usr/local/etc/raddb/mods-config/sql/main/oracle/queries.conf including configuration file /usr/local/etc/raddb/mods-enabled/passwd including configuration file /usr/local/etc/raddb/mods-enabled/sradutmp including configuration file /usr/local/etc/raddb/mods-enabled/exec including configuration file /usr/local/etc/raddb/mods-enabled/soh including configuration file /usr/local/etc/raddb/mods-enabled/dhcp_sqlippool including configuration file /usr/local/etc/raddb/mods-config/sql/ippool-dhcp/oracle/queries.conf including configuration file /usr/local/etc/raddb/mods-enabled/preprocess including configuration file /usr/local/etc/raddb/mods-enabled/sqlippool including configuration file /usr/local/etc/raddb/mods-config/sql/ippool/mysql/queries.conf including files in directory /usr/local/etc/raddb/policy.d/ including configuration file /usr/local/etc/raddb/policy.d/canonicalization including configuration file /usr/local/etc/raddb/policy.d/control including configuration file /usr/local/etc/raddb/policy.d/filter including configuration file /usr/local/etc/raddb/policy.d/eap including configuration file /usr/local/etc/raddb/policy.d/dhcp including configuration file /usr/local/etc/raddb/policy.d/operator-name including configuration file /usr/local/etc/raddb/policy.d/cui including configuration file /usr/local/etc/raddb/policy.d/accounting including files in directory /usr/local/etc/raddb/sites-enabled/ including configuration file /usr/local/etc/raddb/sites-enabled/dhcp_pool main { security { allow_core_dumps = no } } main { name = "radiusd" prefix = "/usr/local" localstatedir = "/usr/local/var" sbindir = "/usr/local/sbin" logdir = "/usr/local/var/log/radius" run_dir = "/usr/local/var/run/radiusd" libdir = "/usr/local/lib" radacctdir = "/usr/local/var/log/radius/radacct" hostname_lookups = no max_request_time = 30 cleanup_delay = 5 max_requests = 1024 pidfile = "/usr/local/var/run/radiusd/radiusd.pid" checkrad = "/usr/local/sbin/checkrad" debug_level = 0 proxy_requests = no log { stripped_names = no auth = no auth_badpass = no auth_goodpass = no colourise = yes } security { max_attributes = 200 reject_delay = 1 status_server = yes } } radiusd: #### Loading Realms and Home Servers #### radiusd: #### Loading Clients #### client localhost { ipaddr = 127.0.0.1 require_message_authenticator = no secret = <<< secret >>> nas_type = "other" proto = "*" limit { max_connections = 16 lifetime = 0 idle_timeout = 30 } } radiusd: #### Instantiating modules #### instantiate { } modules { # Loaded module rlm_expr # Instantiating module "expr" from file /usr/local/etc/raddb/mods-enabled/expr expr { safe_characters = "@abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ0123456789.-_: /" } # Loaded module rlm_exec # Instantiating module "ntlm_auth" from file /usr/local/etc/raddb/mods-enabled/ntlm_auth exec ntlm_auth { wait = yes program = "/path/to/ntlm_auth --request-nt-key --domain=MYDOMAIN --username=%{mschap:User-Name} --password=%{User-Password}" shell_escape = yes } # Loaded module rlm_logintime # Instantiating module "logintime" from file /usr/local/etc/raddb/mods-enabled/logintime logintime { minimum_timeout = 60 } # Loaded module rlm_expiration # Instantiating module "expiration" from file /usr/local/etc/raddb/mods-enabled/expiration # Loaded module rlm_realm # Instantiating module "IPASS" from file /usr/local/etc/raddb/mods-enabled/realm realm IPASS { format = "prefix" delimiter = "/" ignore_default = no ignore_null = no } # Instantiating module "suffix" from file /usr/local/etc/raddb/mods-enabled/realm realm suffix { format = "suffix" delimiter = "@" ignore_default = no ignore_null = no } # Instantiating module "realmpercent" from file /usr/local/etc/raddb/mods-enabled/realm realm realmpercent { format = "suffix" delimiter = "%" ignore_default = no ignore_null = no } # Instantiating module "ntdomain" from file /usr/local/etc/raddb/mods-enabled/realm realm ntdomain { format = "prefix" delimiter = "\" ignore_default = no ignore_null = no } # Loaded module rlm_detail # Instantiating module "auth_log" from file /usr/local/etc/raddb/mods-enabled/detail.log detail auth_log { filename = "/usr/local/var/log/radius/radacct/%{%{Packet-Src-IP-Address}:-%{Packet-Src-IPv6-Address}}/auth-detail-%Y%m%d" header = "%t" permissions = 384 dir_permissions = 493 locking = no log_packet_header = no } rlm_detail (auth_log): 'User-Password' suppressed, will not appear in detail output # Instantiating module "reply_log" from file /usr/local/etc/raddb/mods-enabled/detail.log detail reply_log { filename = "/usr/local/var/log/radius/radacct/%{%{Packet-Src-IP-Address}:-%{Packet-Src-IPv6-Address}}/reply-detail-%Y%m%d" header = "%t" permissions = 384 dir_permissions = 493 locking = no log_packet_header = no } # Instantiating module "pre_proxy_log" from file /usr/local/etc/raddb/mods-enabled/detail.log detail pre_proxy_log { filename = "/usr/local/var/log/radius/radacct/%{%{Packet-Src-IP-Address}:-%{Packet-Src-IPv6-Address}}/pre-proxy-detail-%Y%m%d" header = "%t" permissions = 384 dir_permissions = 493 locking = no log_packet_header = no } # Instantiating module "post_proxy_log" from file /usr/local/etc/raddb/mods-enabled/detail.log detail post_proxy_log { filename = "/usr/local/var/log/radius/radacct/%{%{Packet-Src-IP-Address}:-%{Packet-Src-IPv6-Address}}/post-proxy-detail-%Y%m%d" header = "%t" permissions = 384 dir_permissions = 493 locking = no log_packet_header = no } # Loaded module rlm_pap # Instantiating module "pap" from file /usr/local/etc/raddb/mods-enabled/pap pap { auto_header = no normalise = yes } # Loaded module rlm_digest # Instantiating module "digest" from file /usr/local/etc/raddb/mods-enabled/digest # Loaded module rlm_attr_filter # Instantiating module "attr_filter.post-proxy" from file /usr/local/etc/raddb/mods-enabled/attr_filter attr_filter attr_filter.post-proxy { filename = "/usr/local/etc/raddb/mods-config/attr_filter/post-proxy" key = "%{Realm}" relaxed = no } reading pairlist file /usr/local/etc/raddb/mods-config/attr_filter/post-proxy # Instantiating module "attr_filter.pre-proxy" from file /usr/local/etc/raddb/mods-enabled/attr_filter attr_filter attr_filter.pre-proxy { filename = "/usr/local/etc/raddb/mods-config/attr_filter/pre-proxy" key = "%{Realm}" relaxed = no } reading pairlist file /usr/local/etc/raddb/mods-config/attr_filter/pre-proxy # Instantiating module "attr_filter.access_reject" from file /usr/local/etc/raddb/mods-enabled/attr_filter attr_filter attr_filter.access_reject { filename = "/usr/local/etc/raddb/mods-config/attr_filter/access_reject" key = "%{User-Name}" relaxed = no } reading pairlist file /usr/local/etc/raddb/mods-config/attr_filter/access_reject # Instantiating module "attr_filter.access_challenge" from file /usr/local/etc/raddb/mods-enabled/attr_filter attr_filter attr_filter.access_challenge { filename = "/usr/local/etc/raddb/mods-config/attr_filter/access_challenge" key = "%{User-Name}" relaxed = no } reading pairlist file /usr/local/etc/raddb/mods-config/attr_filter/access_challenge # Instantiating module "attr_filter.accounting_response" from file /usr/local/etc/raddb/mods-enabled/attr_filter attr_filter attr_filter.accounting_response { filename = "/usr/local/etc/raddb/mods-config/attr_filter/accounting_response" key = "%{User-Name}" relaxed = no } reading pairlist file /usr/local/etc/raddb/mods-config/attr_filter/accounting_response # Loaded module rlm_chap # Instantiating module "chap" from file /usr/local/etc/raddb/mods-enabled/chap # Loaded module rlm_eap # Instantiating module "eap" from file /usr/local/etc/raddb/mods-enabled/eap eap { default_eap_type = "md5" timer_expire = 60 ignore_unknown_eap_types = no mod_accounting_username_bug = no max_sessions = 4096 } # Linked to sub-module rlm_eap_md5 # Linked to sub-module rlm_eap_leap # Linked to sub-module rlm_eap_gtc gtc { challenge = "Password: " auth_type = "PAP" } # Linked to sub-module rlm_eap_tls tls { tls = "tls-common" } tls-config tls-common { rsa_key_exchange = no dh_key_exchange = yes rsa_key_length = 512 dh_key_length = 512 verify_depth = 0 ca_path = "/usr/local/etc/raddb/certs" pem_file_type = yes private_key_file = "/usr/local/etc/raddb/certs/server.pem" certificate_file = "/usr/local/etc/raddb/certs/server.pem" ca_file = "/usr/local/etc/raddb/certs/ca.pem" private_key_password = <<< secret >>> dh_file = "/usr/local/etc/raddb/certs/dh" fragment_size = 1024 include_length = yes check_crl = no cipher_list = "DEFAULT" ecdh_curve = "prime256v1" cache { enable = yes lifetime = 24 max_entries = 255 } verify { } ocsp { enable = no override_cert_url = yes url = "http://127.0.0.1/ocsp/" use_nonce = yes timeout = 0 softfail = yes } } # Linked to sub-module rlm_eap_ttls ttls { tls = "tls-common" default_eap_type = "md5" copy_request_to_tunnel = no use_tunneled_reply = no virtual_server = "inner-tunnel" include_length = yes require_client_cert = no } Using cached TLS configuration from previous invocation # Linked to sub-module rlm_eap_peap peap { tls = "tls-common" default_method = "mschapv2" copy_request_to_tunnel = no use_tunneled_reply = no proxy_tunneled_request_as_eap = yes virtual_server = "inner-tunnel" soh = no require_client_cert = no } Using cached TLS configuration from previous invocation # Linked to sub-module rlm_eap_mschapv2 mschapv2 { with_ntdomain_hack = no send_error = no } # Loaded module rlm_utf8 # Instantiating module "utf8" from file /usr/local/etc/raddb/mods-enabled/utf8 # Loaded module rlm_replicate # Instantiating module "replicate" from file /usr/local/etc/raddb/mods-enabled/replicate # Instantiating module "detail" from file /usr/local/etc/raddb/mods-enabled/detail detail { filename = "/usr/local/var/log/radius/radacct/%{%{Packet-Src-IP-Address}:-%{Packet-Src-IPv6-Address}}/detail-%Y%m%d" header = "%t" permissions = 384 dir_permissions = 493 locking = no log_packet_header = no } # Loaded module rlm_always # Instantiating module "reject" from file /usr/local/etc/raddb/mods-enabled/always always reject { rcode = "reject" simulcount = 0 mpp = no } # Instantiating module "fail" from file /usr/local/etc/raddb/mods-enabled/always always fail { rcode = "fail" simulcount = 0 mpp = no } # Instantiating module "ok" from file /usr/local/etc/raddb/mods-enabled/always always ok { rcode = "ok" simulcount = 0 mpp = no } # Instantiating module "handled" from file /usr/local/etc/raddb/mods-enabled/always always handled { rcode = "handled" simulcount = 0 mpp = no } # Instantiating module "invalid" from file /usr/local/etc/raddb/mods-enabled/always always invalid { rcode = "invalid" simulcount = 0 mpp = no } # Instantiating module "userlock" from file /usr/local/etc/raddb/mods-enabled/always always userlock { rcode = "userlock" simulcount = 0 mpp = no } # Instantiating module "notfound" from file /usr/local/etc/raddb/mods-enabled/always always notfound { rcode = "notfound" simulcount = 0 mpp = no } # Instantiating module "noop" from file /usr/local/etc/raddb/mods-enabled/always always noop { rcode = "noop" simulcount = 0 mpp = no } # Instantiating module "updated" from file /usr/local/etc/raddb/mods-enabled/always always updated { rcode = "updated" simulcount = 0 mpp = no } # Instantiating module "echo" from file /usr/local/etc/raddb/mods-enabled/echo exec echo { wait = yes program = "/bin/echo %{User-Name}" input_pairs = "request" output_pairs = "reply" shell_escape = yes } # Loaded module rlm_cache # Instantiating module "cache_eap" from file /usr/local/etc/raddb/mods-enabled/cache_eap cache cache_eap { key = "%{%{control:State}:-%{%{reply:State}:-%{State}}}" ttl = 15 max_entries = 16384 epoch = 0 add_stats = no } # Loaded module rlm_linelog # Instantiating module "linelog" from file /usr/local/etc/raddb/mods-enabled/linelog linelog { filename = "/usr/local/var/log/radius/linelog" permissions = 384 format = "This is a log message for %{User-Name}" reference = "%{%{Packet-Type}:-format}" } # Instantiating module "linelog-dhcp" from file /usr/local/etc/raddb/mods-enabled/linelog linelog linelog-dhcp { filename = "/usr/local/var/log/radius/linelog-dhcp.log" permissions = 384 format = "" reference = "%{%{reply:DHCP-Message-Type}:-%{request:DHCP-Message-Type}}" } # Loaded module rlm_files # Instantiating module "files" from file /usr/local/etc/raddb/mods-enabled/files files { filename = "/usr/local/etc/raddb/mods-config/files/authorize" usersfile = "/usr/local/etc/raddb/mods-config/files/authorize" acctusersfile = "/usr/local/etc/raddb/mods-config/files/accounting" preproxy_usersfile = "/usr/local/etc/raddb/mods-config/files/pre-proxy" compat = "no" } reading pairlist file /usr/local/etc/raddb/mods-config/files/authorize reading pairlist file /usr/local/etc/raddb/mods-config/files/authorize reading pairlist file /usr/local/etc/raddb/mods-config/files/accounting reading pairlist file /usr/local/etc/raddb/mods-config/files/pre-proxy # Loaded module rlm_dhcp # Instantiating module "dhcp" from file /usr/local/etc/raddb/mods-enabled/dhcp # Loaded module rlm_dynamic_clients # Instantiating module "dynamic_clients" from file /usr/local/etc/raddb/mods-enabled/dynamic_clients # Loaded module rlm_mschap # Instantiating module "mschap" from file /usr/local/etc/raddb/mods-enabled/mschap mschap { use_mppe = yes require_encryption = no require_strong = no with_ntdomain_hack = yes passchange { } allow_retry = yes } # Loaded module rlm_radutmp # Instantiating module "radutmp" from file /usr/local/etc/raddb/mods-enabled/radutmp radutmp { filename = "/usr/local/var/log/radius/radutmp" username = "%{User-Name}" case_sensitive = yes check_with_nas = yes permissions = 384 caller_id = yes } # Loaded module rlm_unix # Instantiating module "unix" from file /usr/local/etc/raddb/mods-enabled/unix unix { radwtmp = "/usr/local/var/log/radius/radwtmp" } # Loaded module rlm_sql # Instantiating module "sql" from file /usr/local/etc/raddb/mods-enabled/sql sql { driver = "rlm_sql_oracle" server = "localhost" port = "" login = "foo" password = <<< secret >>> radius_db = "(DESCRIPTION=(ADDRESS=(PROTOCOL=TCP)(HOST=foo)(PORT=1521))(CONNECT_DATA=(SID=bar)))" read_groups = yes read_clients = no delete_stale_sessions = yes sql_user_name = "%{User-Name}" default_user_profile = "" client_query = "SELECT id, nasname, shortname, type, secret, server FROM nas" authorize_check_query = "SELECT id,UserName,Attribute,Value,op FROM radcheck WHERE Username = '%{SQL-User-Name}' ORDER BY id" authorize_reply_query = "SELECT id,UserName,Attribute,Value,op FROM radreply WHERE Username = '%{SQL-User-Name}' ORDER BY id" authorize_group_check_query = "SELECT radgroupcheck.id,radgroupcheck.GroupName,radgroupcheck.Attribute,radgroupcheck.Value,radgroupcheck.op FROM radgroupcheck,radusergroup WHERE radusergroup.Username = '%{SQL-User-Name}' AND radusergroup.GroupName = radgroupcheck.GroupName ORDER BY radgroupcheck.id" authorize_group_reply_query = "SELECT radgroupreply.id,radgroupreply.GroupName,radgroupreply.Attribute,radgroupreply.Value,radgroupreply.op FROM radgroupreply,radusergroup WHERE radusergroup.Username = '%{SQL-User-Name}' AND radusergroup.GroupName = radgroupreply.GroupName ORDER BY radgroupreply.id" group_membership_query = "SELECT GroupName FROM radusergroup WHERE UserName='%{SQL-User-Name}'" simul_count_query = "" simul_verify_query = "SELECT RadAcctId, AcctSessionId, UserName, NASIPAddress, NASPortId, FramedIPAddress, CallingStationId, FramedProtocol FROM radacct WHERE UserName='%{SQL-User-Name}' AND AcctStopTime IS NULL" safe_characters = "@abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ0123456789.-_: /" } accounting { reference = "%{tolower:type.%{Acct-Status-Type}.query}" } post-auth { reference = ".query" } rlm_sql (sql): Driver rlm_sql_oracle (module rlm_sql_oracle) loaded and linked rlm_sql (sql): Attempting to connect to database "(DESCRIPTION=(ADDRESS=(PROTOCOL=TCP)(HOST=foo)(PORT1521))(CONNECT_DATA=(SID=bar)))" rlm_sql (sql): Initialising connection pool pool { start = 5 min = 4 max = 32 spare = 3 uses = 0 lifetime = 0 cleanup_delay = 5 idle_timeout = 60 spread = no } rlm_sql (sql): Opening additional connection (0) rlm_sql (sql): Opening additional connection (1) rlm_sql (sql): Opening additional connection (2) rlm_sql (sql): Opening additional connection (3) rlm_sql (sql): Opening additional connection (4) # Loaded module rlm_passwd # Instantiating module "etc_passwd" from file /usr/local/etc/raddb/mods-enabled/passwd passwd etc_passwd { filename = "/etc/passwd" format = "*User-Name:Crypt-Password:" delimiter = ":" ignore_nislike = no ignore_empty = yes allow_multiple_keys = no hash_size = 100 } rlm_passwd: nfields: 3 keyfield 0(User-Name) listable: no # Instantiating module "sradutmp" from file /usr/local/etc/raddb/mods-enabled/sradutmp radutmp sradutmp { filename = "/usr/local/var/log/radius/sradutmp" username = "%{User-Name}" case_sensitive = yes check_with_nas = yes permissions = 420 caller_id = no } # Instantiating module "exec" from file /usr/local/etc/raddb/mods-enabled/exec exec { wait = no input_pairs = "request" shell_escape = yes timeout = 10 } # Loaded module rlm_soh # Instantiating module "soh" from file /usr/local/etc/raddb/mods-enabled/soh soh { dhcp = yes } # Loaded module rlm_sqlippool # Instantiating module "dhcp_sqlippool" from file /usr/local/etc/raddb/mods-enabled/dhcp_sqlippool sqlippool dhcp_sqlippool { sql_module_instance = "sql" lease_duration = 7200 pool_name = "" default_pool = "main_pool" allocate_begin = "COMMIT" allocate_clear = " UPDATE radippool SET EXPIRY_TIME = CURRENT_TIMESTAMP - INTERVAL '1' SECOND(1) WHERE POOL_KEY = '%{Calling-Station-Id}'" allocate_find = " WITH POOLS AS ( SELECT * FROM radippool WHERE EXPIRY_TIME < CURRENT_TIMESTAMP AND POOL_NAME = '%{control:Pool-Name}') SELECT FRAMEDIPADDRESS FROM ( SELECT FRAMEDIPADDRESS FROM POOLS WHERE POOL_KEY = '%{Calling-Station-Id}' OR (NOT EXISTS ( SELECT 1 FROM POOLS WHERE POOL_KEY = '%{Calling-Station-Id}'))) WHERE ROWNUM = 1 FOR UPDATE" allocate_update = " UPDATE radippool SET NASIPADDRESS = '%{NAS-IP-Address}', POOL_KEY = '%{Calling-Station-Id}', CALLINGSTATIONID = '%{Mac-Addr}', USERNAME = '%{SQL-User-Name}', EXPIRY_TIME = CURRENT_TIMESTAMP + INTERVAL '7200' SECOND(1) WHERE FRAMEDIPADDRESS = '%I'" allocate_commit = "COMMIT" pool_check = "" start_begin = "COMMIT" start_update = " UPDATE radippool SET EXPIRY_TIME = CURRENT_TIMESTAMP + INTERVAL '7200' SECOND(1) WHERE NASIPADDRESS = '%{NAS-IP-Address}' AND POOL_NAME = '%{control:Pool-Name}' AND POOL_KEY = '%{Calling-Station-Id}' AND FRAMEDIPADDRESS = '%{Framed-IP-Address}'" start_commit = "COMMIT" alive_begin = "COMMIT" alive_update = " UPDATE radippool SET EXPIRY_TIME = CURRENT_TIMESTAMP + INTERVAL '7200' SECOND(1) WHERE POOL_KEY = '%{Calling-Station-Id}' AND POOL_NAME = '%{control:Pool-Name}' AND FRAMEDIPADDRESS = '%{Framed-IP-Address}'" alive_commit = "COMMIT" stop_begin = "COMMIT" stop_clear = " UPDATE radippool SET EXPIRY_TIME = CURRENT_TIMESTAMP - INTERVAL '1' SECOND(1) WHERE POOL_KEY = '%{Calling-Station-Id}'" stop_commit = "COMMIT" on_begin = "COMMIT" on_clear = " UPDATE radippool SET EXPIRY_TIME = CURRENT_TIMESTAMP - INTERVAL '1' SECOND(1) WHERE NASIPADDRESS = '%{Nas-IP-Address}'" on_commit = "COMMIT" off_begin = "COMMIT" off_clear = " UPDATE radippool SET EXPIRY_TIME = CURRENT_TIMESTAMP - INTERVAL '1' SECOND(1) WHERE NASIPADDRESS = '%{Nas-IP-Address}'" off_commit = "COMMIT" messages { } } # Loaded module rlm_preprocess # Instantiating module "preprocess" from file /usr/local/etc/raddb/mods-enabled/preprocess preprocess { huntgroups = "/usr/local/etc/raddb/mods-config/preprocess/huntgroups" hints = "/usr/local/etc/raddb/mods-config/preprocess/hints" with_ascend_hack = no ascend_channels_per_line = 23 with_ntdomain_hack = no with_specialix_jetstream_hack = no with_cisco_vsa_hack = no with_alvarion_vsa_hack = no } reading pairlist file /usr/local/etc/raddb/mods-config/preprocess/huntgroups reading pairlist file /usr/local/etc/raddb/mods-config/preprocess/hints # Instantiating module "sqlippool" from file /usr/local/etc/raddb/mods-enabled/sqlippool sqlippool { sql_module_instance = "sql" lease_duration = 3600 pool_name = "" default_pool = "main_pool" allocate_begin = "START TRANSACTION" allocate_clear = "UPDATE radippool SET nasipaddress = '', pool_key = 0, callingstationid = '', username = '', expiry_time = NULL WHERE expiry_time <= NOW() - INTERVAL 1 SECOND AND nasipaddress = '%{Nas-IP-Address}'" allocate_find = "SELECT framedipaddress FROM radippool WHERE pool_name = '%{control:Pool-Name}' AND (expiry_time < NOW() OR expiry_time IS NULL) ORDER BY (username <> '%{User-Name}'), (callingstationid <> '%{Calling-Station-Id}'), expiry_time LIMIT 1 FOR UPDATE" allocate_update = "UPDATE radippool SET nasipaddress = '%{NAS-IP-Address}', pool_key = '%{NAS-Port}', callingstationid = '%{Calling-Station-Id}', username = '%{User-Name}', expiry_time = NOW() + INTERVAL 3600 SECOND WHERE framedipaddress = '%I' AND expiry_time IS NULL" allocate_commit = "COMMIT" pool_check = "SELECT id FROM radippool WHERE pool_name='%{control:Pool-Name}' LIMIT 1" start_begin = "START TRANSACTION" start_update = "UPDATE radippool SET expiry_time = NOW() + INTERVAL 3600 SECOND WHERE nasipaddress = '%{NAS-IP-Address}' AND pool_key = '%{NAS-Port}' AND username = '%{User-Name}' AND callingstationid = '%{Calling-Station-Id}' AND framedipaddress = '%{Framed-IP-Address}'" start_commit = "COMMIT" alive_begin = "START TRANSACTION" alive_update = "UPDATE radippool SET expiry_time = NOW() + INTERVAL 3600 SECOND WHERE nasipaddress = '%{Nas-IP-Address}' AND pool_key = '%{NAS-Port}' AND username = '%{User-Name}' AND callingstationid = '%{Calling-Station-Id}' AND framedipaddress = '%{Framed-IP-Address}'" alive_commit = "COMMIT" stop_begin = "START TRANSACTION" stop_clear = "UPDATE radippool SET nasipaddress = '', pool_key = 0, callingstationid = '', username = '', expiry_time = NULL WHERE nasipaddress = '%{Nas-IP-Address}' AND pool_key = '%{NAS-Port}' AND username = '%{User-Name}' AND callingstationid = '%{Calling-Station-Id}' AND framedipaddress = '%{Framed-IP-Address}'" stop_commit = "COMMIT" on_begin = "START TRANSACTION" on_clear = "UPDATE radippool SET nasipaddress = '', pool_key = 0, callingstationid = '', username = '', expiry_time = NULL WHERE nasipaddress = '%{Nas-IP-Address}'" on_commit = "COMMIT" off_begin = "START TRANSACTION" off_clear = "UPDATE radippool SET nasipaddress = '', pool_key = 0, callingstationid = '', username = '', expiry_time = NULL WHERE nasipaddress = '%{Nas-IP-Address}'" off_commit = "COMMIT" messages { exists = "Existing IP: %{reply:Framed-IP-Address} (did %{Called-Station-Id} cli %{Calling-Station-Id} port %{NAS-Port} user %{User-Name})" success = "Allocated IP: %{reply:Framed-IP-Address} from %{control:Pool-Name} (did %{Called-Station-Id} cli %{Calling-Station-Id} port %{NAS-Port} user %{User-Name})" clear = "Released IP %{Framed-IP-Address} (did %{Called-Station-Id} cli %{Calling-Station-Id} user %{User-Name})" failed = "IP Allocation FAILED from %{control:Pool-Name} (did %{Called-Station-Id} cli %{Calling-Station-Id} port %{NAS-Port} user %{User-Name})" nopool = "No Pool-Name defined (did %{Called-Station-Id} cli %{Calling-Station-Id} port %{NAS-Port} user %{User-Name})" } } } # modules radiusd: #### Loading Virtual Servers #### server { # from file /usr/local/etc/raddb/radiusd.conf } # server server dhcp { # from file /usr/local/etc/raddb/sites-enabled/dhcp_pool # Loading dictionary.dhcp # Loading dhcp DHCP-Discover {...} # Loading dhcp DHCP-Request {...} # Loading dhcp DHCP-Release {...} # Loading dhcp DHCP-Inform {...} # Loading dhcp DHCP-Decline {...} # Loading dhcp {...} } # server dhcp radiusd: #### Opening IP addresses and Ports #### listen { type = "dhcp" ipaddr = 0.0.0.0 port = 67 } Listening on dhcp interface eth1 address * port 67 as server dhcp Ready to process requests Received DHCP-Discover of id cf875833 from 10.180.1.1:67 to 10.160.0.254:67 Threads: total/active/spare threads = 0/0/0 Something is blocking the server. There are 0 packets in the queue, waiting to be processed. Ignoring the new request. (0) Cleaning up request packet ID 3481753651 with timestamp +302

3 8

Control reject delay per-request?
by Phil Mayers 26 Feb '14

26 Feb '14

We have a radius virtual server that takes macauth requests. We know for sure it won't receive user traffic and/or dictionary attacks. But it's in the same process as another, which might. Can we set a control: item or similar to set the reject delay to some requests and not others? I'd rather not break it out into a separate process for this sole reason. Version is 2.2.3

2 1

Max-Daily-Session for current station only
by Lorenzo Milesi 26 Feb '14

26 Feb '14

Hi. I'd like to create a counter which is exactly like the Max-Daily-Session, but should count only the time consumed on the current Called-Station-Id only. This because using HuntGroups I'd like to allow the user to connect 1h from station A and 2h from station B. Having a look at the rlm_sqlcounter shipped with FR2 I find there are only three possible parameters to be used in the query, and this doesn't include the NAS. Any help on how to implement this counter? Thanks -- Lorenzo Milesi - lorenzo.milesi(a)yetopen.it YetOpen S.r.l. - http://www.yetopen.it/

2 4

Freeradius 2.1 - Accouting packets mirring
by Antonio Modesto Amaral Sousa 26 Feb '14

26 Feb '14

Hello everyone, I'll apologize in advance for asking something that have been already asked in this list, but the answers for those previous questions couldn't help me a lot. I work at an ISP and we have an instance of Freeradius 2.1 that is responsible for accounting, authentication and IP address redistribution. We are testing a new equipment from Allot (Netenforcer) that can do traffic analysis and traffic shaping, in order for this equipment to work correctly and recognize our subscribers traffic, it needs to receive a copy of our radius accounting requests and responses, as I said before, I've found some information about 'copy-acct-to-home-server' file and radrelay, the problem is that in the comments in this file it says something about 'detail' file and stuff, I don't know nothing about it, I just know that my server is configured to store the accounting information into a mysql table, I just need it to send a identical copy of this packets to the appliance. What's the easiest way to do this without messing up with my current configuration? Thanks a lot. --

4 4

freeradius-3.0.1 ldap authenticate
by d zz 26 Feb '14

26 Feb '14

Is there a simple doc about configure ldap authenticate with freeraidus-3.0.1 ? I am confused about it. I've questioned the developer on Github https://github.com/FreeRADIUS/freeradius-server/issues/531, but it did not solve my problem. In "mods-available/ldap" # Note: set_auth_type was removed in v3.x.x # Equivalent functionality can be achieved by adding the following # stanza to the authorize {} section of your virtual server. # # ldap # if ((ok || updated) && User-Password) { # update { # control:Auth-Type := ldap # } # } So I add the stanza to virtual server, "radiusd -X" says Unknown value 'ldap' for attribute 'Auth-Type' I then add VALUE Auth-Type LDAP 1026 to "/usr/local/share/freeradius/dictionary.freeradius.internal", but "radiusd -X" says (0) Found Auth-Type = LDAP (0) WARNING: Unknown value specified for Auth-Type. Cannot perform requested action. (0) Failed to authenticate the user. Any body can tell me a clear progress about configure ldap authenticate? Thanks very much.

7 14

How to avoid logging cleartext passwords upon unix authentication failures
by Gianni Costanzi 25 Feb '14

25 Feb '14

Hi, we're using Freeradius Version 2.2.0 to authenticate users against unix unsers/passwords stored on the freeradius server. We noticed that when a user authentication fails, the following line appears with the cleartext password within it: Tue Feb 25 11:36:49 2014 : Auth: [unix] invalid password "wrongPassword" Is it possible to tell the unix module not to log passwords? We already disabled authentication requests' logging in the main radiusd.conf file, but there seem not to be an option to disable authentication failures' logging for the unix module, am I wrong? Thank you for any help, Gianni Costanzi

3 3

log *** instead of actual User-Password in postauth_query
by Michael Weissenbacher 24 Feb '14

24 Feb '14

Dear List! I am wondering if there is a way to convert a password to a number of asterisk symbols (*) matching the length of the actual password using unlang. For obvious reasons i do not want to log the cleartext password in radpostauth. But i don't want to completely omit the field either. Changing the postauth_query in dialup.conf is pretty straightforward, but i could not figure out how to replace the password with the exact same number of * symbols. The best i could come up with so far is: %{%{#User-Password}:-0} Which outputs the length of the password as a number. Is there a straightforward way to achieve what i want? tia, Michael

2 2

EAP-PEAP drops attributes
by freerad＠spambin.de 23 Feb '14

23 Feb '14

Hi, I've set up a Cisco WLC carrying several SSIDs authenticating against freeradius using EAP-PEAP. I would like to make it so that specific users can only connect to some SSIDs. Requests contain the attribute "Airespace-Wlan-Id" which contains the numeric index of the SSID the request is associated to. I have therefore set up my users file like this: test1 Auth-Type == EAP, Airespace-Wlan-Id == 2, NAS-IP-Address == 192.168.225.110, Cleartext-Password := "test1" This, however, doesn't seem to work as freeradius seems to drop the Airespace-Wlan-Id attribute while processing the request. As can be seen in the debug trace (debug_fail.txt), the user is being matched at first ([files] users: Matched entry test1 at line 173) but isn't found later on. When I remove that one check from the users file leaving test1 Auth-Type == EAP, NAS-IP-Address == 192.168.225.110, Cleartext-Password := "test1" the request is being accepted (see debug_ok.txt). The reject is clearly coming from freeradius being unable to match the request against the users file therefore being unable to get to the cleartext password, but only when I'm checking the Airespace-Wlan-Id attribute. However, as can be seen, the attribute is present in the request and the user is matched at first, even for the failed attempt. This is freeradius 2.1.8 on Ubuntu 10.04, I'm not using inner-tunnel for EAP. I'm clearly missing something here, could somebody point me in the right direction? Thanks and regards, Bodo Bodo Bellut bodo(a)bellut.net | USE PGP! +-----------+ Stangefolstr. 17 Fax/Mobile: just ask | (key via server |\ O---m /| 44141 Dortmund Fon: +49-700-77-BELLUT | or on request) |/---------\| PGP: 768/FA18A639 AE 5A 47 40 5A A0 D6 15 8E 54 44 AA 8D DD 6E BD+-----------+

3 5

Reply-Message
by nicolas.clo＠ricoh-industrie.fr 21 Feb '14

21 Feb '14

Hi List, Actually, I catch MS-CHAP-Error by regex and I update Reply-Message with specific messages . I log this via sql ( module sql enable in inner-tunnel - Post-Auth-Type REJECT section) The problem is that I have two lines of logs errors, one with the good reply message and one with nothing because the module sql is present in inner-tunnel (Post-Auth-Type REJECT) and default server (Post-Auth-Type REJECT ) I would like to know is there a way to copy Reply-Message in inner-tunnel to Reply-Message in default virtual server in disable the module sql in inner-tunnel (Post-Auth-Type REJECT section ). My test show me that Reply-Message is cleaning when Freeradius pass from one to other virtual server. Thanks . Nicolas.

4 12