April 2014 - Freeradius-Users - lists.freeradius.org

Mikrotik Attribute problem
by Ryan De Kock 08 Apr '14

08 Apr '14

Hi. I was running freeradius v2.1.12 on Fedora and have changed over to CentOS now (also v2.1.12). All of a sudden I am having issues where my attribute Mikrotik-Total-Limit is no longer being sent to the Mikrotik with access-reply. This is the radius -X excerpt ... Found Auth-Type = PERL # Executing group from file /etc/raddb/sites-enabled/default +- entering group PERL {...} rlm_perl: Added pair NAS-Port-Type = Wireless-802.11 rlm_perl: Added pair WISPr-Logoff-URL = http://X.X.X.X/logout rlm_perl: Added pair Acct-Session-Id = 807008e4 rlm_perl: Added pair Service-Type = Login-User rlm_perl: Added pair Called-Station-Id = MYID rlm_perl: Added pair Calling-Station-Id = 94:CE:2C:87:8A:84 rlm_perl: Added pair User-Name = 94:CE:2C:87:8A:84 rlm_perl: Added pair NAS-Identifier = NASNAME rlm_perl: Added pair User-Password = password rlm_perl: Added pair Mikrotik-Host-IP = X.X.X.X rlm_perl: Added pair Framed-IP-Address = X.X.X.X rlm_perl: Added pair NAS-IP-Address = X.X.X.X rlm_perl: Added pair NAS-Port = 2154825956 rlm_perl: Added pair NAS-Port-Id = ether3 - Rooms rlm_perl: ERROR: Failed to create pair Mikrotik-Total-Limit = 209715200 rlm_perl: Added pair Cleartext-Password = password rlm_perl: Added pair databank = 209715200 rlm_perl: Added pair Auth-Type = PERL ++[perl] returns ok ... Because of that the user is no longer being limited by total data usage. It looks as if the dictionary file location has been changed BUT here is the working dictionary Working server: [root@localhost ~]# cat /usr/share/freeradius/dictionary.mikrotik # -*- text -*- # http://www.mikrotik.com # # http://www.mikrotik.com/documentation//manual_2.9/dictionary # # Do NOT follow their instructions and replace the dictionary # in /etc/raddb with the one that they supply. It is NOT necessary. # # On top of that, the sample dictionary file they provide # DOES NOT WORK. Do NOT use it. # # $Id$ # VENDOR Mikrotik 14988 BEGIN-VENDOR Mikrotik ATTRIBUTE Mikrotik-Recv-Limit 1 integer ATTRIBUTE Mikrotik-Xmit-Limit 2 integer # this attribute is unused ATTRIBUTE Mikrotik-Group 3 string ATTRIBUTE Mikrotik-Wireless-Forward 4 integer ATTRIBUTE Mikrotik-Wireless-Skip-Dot1x 5 integer ATTRIBUTE Mikrotik-Wireless-Enc-Algo 6 integer ATTRIBUTE Mikrotik-Wireless-Enc-Key 7 string ATTRIBUTE Mikrotik-Rate-Limit 8 string ATTRIBUTE Mikrotik-Realm 9 string ATTRIBUTE Mikrotik-Host-IP 10 ipaddr ATTRIBUTE Mikrotik-Mark-Id 11 string ATTRIBUTE Mikrotik-Advertise-URL 12 string ATTRIBUTE Mikrotik-Advertise-Interval 13 integer ATTRIBUTE Mikrotik-Recv-Limit-Gigawords 14 integer ATTRIBUTE Mikrotik-Xmit-Limit-Gigawords 15 integer ATTRIBUTE Mikrotik-Total-Limit 17 integer ATTRIBUTE Mikrotik-Total-Limit-Gigawords 18 integer # MikroTik Values VALUE Mikrotik-Wireless-Enc-Algo No-encryption 0 VALUE Mikrotik-Wireless-Enc-Algo 40-bit-WEP 1 VALUE Mikrotik-Wireless-Enc-Algo 104-bit-WEP 2 END-VENDOR Mikrotik Not working server: # cat /usr/local/share/freeradius/dictionary.mikrotik # MikroTik vendor specific dictionary # Copyright (C) MikroTikls, SIA # # You may freely redistribute and use this software or any part of it in source # and/or binary forms, with or without modification for any purposes without # limitations, provided that you respect the following statement: # # This software is provided 'AS IS' without a warranty of any kind, expressed or # implied, including, but not limited to, the implied warranty of # merchantability and fitness for a particular purpose. In no event shall # MikroTikls SIA be liable for direct or indirect, incidental, consequential or # other damages that may result from the use of this software, including, but # not limited to, loss of data, time and (or) profits. # # $Id: dictionary.mikrotik,v 1.7 2011/11/25 08:00:00 normis Exp $ # # MikroTik Attributes VENDOR Mikrotik 14988 BEGIN-VENDOR Mikrotik ATTRIBUTE Mikrotik-Recv-Limit 1 integer ATTRIBUTE Mikrotik-Xmit-Limit 2 integer ATTRIBUTE Mikrotik-Group 3 string ATTRIBUTE Mikrotik-Wireless-Forward 4 integer ATTRIBUTE Mikrotik-Wireless-Skip-Dot1x 5 integer ATTRIBUTE Mikrotik-Wireless-Enc-Algo 6 integer ATTRIBUTE Mikrotik-Wireless-Enc-Key 7 string ATTRIBUTE Mikrotik-Rate-Limit 8 string ATTRIBUTE Mikrotik-Realm 9 string ATTRIBUTE Mikrotik-Host-IP 10 ipaddr ATTRIBUTE Mikrotik-Mark-Id 11 string ATTRIBUTE Mikrotik-Advertise-URL 12 string ATTRIBUTE Mikrotik-Advertise-Interval 13 integer ATTRIBUTE Mikrotik-Recv-Limit-Gigawords 14 integer ATTRIBUTE Mikrotik-Xmit-Limit-Gigawords 15 integer ATTRIBUTE Mikrotik-Wireless-PSK 16 string ATTRIBUTE Mikrotik-Total-Limit 17 integer ATTRIBUTE Mikrotik-Total-Limit-Gigawords 18 integer ATTRIBUTE Mikrotik-Address-List 19 string ATTRIBUTE Mikrotik-Wireless-MPKey 20 string ATTRIBUTE Mikrotik-Wireless-Comment 21 string ATTRIBUTE Mikrotik-Delegated-IPv6-Pool 22 string # MikroTik Values VALUE Mikrotik-Wireless-Enc-Algo No-encryption 0 VALUE Mikrotik-Wireless-Enc-Algo 40-bit-WEP 1 VALUE Mikrotik-Wireless-Enc-Algo 104-bit-WEP 2 VALUE Mikrotik-Wireless-Enc-Algo AES-CCM 3 VALUE Mikrotik-Wireless-Enc-Algo TKIP 4 END-VENDOR Mikrotik What i have noticed is that if I add "ATTRIBUTE Mikrotik-Total-Limit 17 integer" to the /usr/local/etc/raddb/dictionary file then freeradius says that it sends the attribute however the Mikrotik complains that its incorrect. Have I missed something? I have checked that "/usr/local/share/freeradius/dictionary.mikrotik" is included in /usr/local/share/freeradius/dictionary. any advice would be great

3 6

Originate COA in Freeradius 3.0.x
by unbeliever012000 08 Apr '14

08 Apr '14

I have been using Freeradius for several years now, starting around the 1.0.0 release. Recently I have been playing with Freeradius 3.0.1 and 3.0.2. The changes which have been made have provided me many ways to clean up my code thanks to the use of talloc, and the connection pooling. While playing with originating COA, deploying the "update coa" sub section within my site's accounting section, I always get an error logged for every accounting request; WARNING: List 'coa' doesn't exist for this packet This looks like a duplicate of the situation reported Nov 2012; http://lists.freeradius.org/mailman/private/freeradius-users/2012-November/0 63633.html I did dig into the code and can see that when passing back the list you validate that not only does the list exist, but it also has the right type. Have I missed something which has to be done to set the type but was not documented in the sites-available/originate-coa ? Checking the code I see that setting Send-CoA-Request blocks the request no matter what value is set. This I checked as I see in the originate-coa file its documented that setting Send-CoA-Request to No is suppose to block requests and thought that maybe setting it to yes would be the fix to my issue, which obviously I was wrong about. The compile has been double checked and can confirm that coa is suppose to be compiled in. While proxy capabilities have been tested and can be confirmed, understand from the defines that COA is dependant on Proxy. Loading the sites-available/coa file also works, but obviously that's to consume COA's rather than originate as desired. Please advise as to if I have made a config error, or have found an issue which will be resolved in a later release. Thanks Geoff

3 2

Cisco 2960 and WLC Accounting Interim-Update
by Matthew Ceroni 07 Apr '14

07 Apr '14

I don't believe this is controlled by FreeRadius itself but I am kind of at a loss figuring out where it might be configured. I have Freeradius acting as an AAA server for a Cisco 2960 L2 switch as well as a Cisco Wireless LAN Controller. Working on setting up Accounting which for the most part works. However I am unable to determine what causes the Interim-Update Acct-Status-Type message to be sent. Checking the detail log (have that module turned on in accounting section) I have seen those messages present. In fact earlier in the day connected clients sent a few Interim-Update messages (one was 1 second apart, than 10 seconds apart, than 30 seconds apart). That happened early this morning. However ever since that I have not seen any Interim-Update accounting messages. I read through the 802.1x configuration guide for the 2960 and it just talks about the Interim-Update message being sent but doesn't list of a way to specify the interval (assuming that interval is specified on the switch side). Any help would be appreciated. Thanks

3 3

In auth request packet, Stripped-User-Name attribute value wrongly rewritten by radius server
by Adarsha S 07 Apr '14

07 Apr '14

Hi, I'm currently using free radius server versioned 2.1.12 [freeradius-server-2.1.12]. I'm having a setup where clients get authenticated by Windows AD 2003 server. It uses stripped-user-name attribute. I'm having free radius 2.1.12 as the radius server. The username are provided as DomainName\Username. Various combination of Domain name and user name worked but when ever the username starts with "t" or "n" the authentication failed. Network capture showed that the backslash delimiter between domain and username combined with specific letters are translated to special characters. \n = new line \r = return \t = tab Eg: During authentication, the usernames goes as "DOMAIN\timcopy. We are supposed to strip the domain name along with the "\" and populate the sAMAccount name with the username timcopy. But the username gets converted as "DOMAIN imcopy" which is then used as the sAMAccount name. I was getting the authentication problem when I used "timcopy" as the username and success when I used "kiran" as the username. On further looking into code could make out , On receiving the request packet at radius server side, rlm is adding the the new attribute stripped-user-name [attr number 1043] and updating the value as "DOMAIN imcopy" Here \timcopy got converted as "<tab space>imcopy" Please let me know the solution for this problem. Thanks, Adarsha

2 1

parameter "OR" on attribute "Calling-station-id" mysql
by Deivison Moraes 07 Apr '14

07 Apr '14

Hi, How I set two different macs on attribute calling station id in base mysql? I need insert 1 more mac with attribute Calling-Station-ID. mysql> SELECT * FROM radcheck WHERE UserName = 'deiveson'; +--------+----------+--------------------+----+-------------------+ | id | UserName | Attribute | op | Value | +--------+----------+--------------------+----+-------------------+ | 292359 | deiveson | user-password | == | 123 | | 292360 | deiveson | Calling-Station-ID | == | 78:44:76:0D:34:FB | +--------+----------+--------------------+----+-------------------+ I tested ":=" and "+=", but don't worked fine, with these options is accepting any mac. Anyone know how to make a "OR" for this situation? Tks Deivison Moraes

2 1

panic_action / ptrace: Operation not permitted
by Stefan Winter 07 Apr '14

07 Apr '14

Hi, I'm currently configuring the shiny new panic_action handler on my 3.0.2 system. The server runs as radiusd:radiusd. When I send it a kill -SEGV to try the panic_action, the resulting log file tells me: # cat gdb-radiusd-27780.log Reading symbols from /usr/local/freeradius/3.0.2/sbin/radiusd...done. Attaching to program: /usr/local/freeradius/3.0.2/sbin/radiusd, process 27780 ptrace: Operation not permitted. //27780: No such file or directory. /usr/local/freeradius/config/raddb/panic.gdb:1: Error in sourced command file: No frame selected. (gdb) quit The gdb session is started as radiusd (I guess; after all the running process dropped its root priv right after starting). So... I can't ptrace my own process? Why, thank you! I ran the panic_action command-line as root on a running process - and get the ptrace just fine. I read up on this on Google, and found that this would typically be a problem when using the "yama" security module, which I don't (there is no /proc/sys/kernel/yama subdir). This is a very recent system, openSUSE 13.1 with current patchlevel. The kernel is the shipped SuSE-flavoured "default" kernel. Before I dig into running a vanilla kernel to see if there's SUSE magic happening on their flavour - am I looking at the wrong place? Is this problem known and solved? Greetings, Stefan Winter -- Stefan WINTER Ingenieur de Recherche Fondation RESTENA - Réseau Téléinformatique de l'Education Nationale et de la Recherche 6, rue Richard Coudenhove-Kalergi L-1359 Luxembourg Tel: +352 424409 1 Fax: +352 422473 PGP key updated to 4096 Bit RSA - I will encrypt all mails if the recipient's key is known to me http://pgp.mit.edu:11371/pks/lookup?op=get&search=0xC0DE6A358A39DC66

2 5

RE: MPPE with PPTP - external module (P K)
by S y s C o / developer 07 Apr '14

07 Apr '14

Hi Alan, How can I do that multiOTP either supply the NT-Password to FreeRADIUS (the best option for me), or how to supply the derived attributes MS-MPPE-Recv-Key, MS-MPPE-Send-Key etc. directly. As multiOTP is doing two factor authentication, the NT-Password is not sensitive, as a new is created each time. I already fixed that with TeKRADIUS by supplying the clear one time password back to TekRADIUS. Regards, Andre > P K wrote: >> VPN works fine with CHAP & MSCHAP with multiotp. The trouble is >> encryption (PPTP with MPPE). When encryption is selected by the user, >> VPN fails. The problem is that radius will not send the required MPPE >> responses(MS-MPPE-Recv-Key, MS-MPPE-Send-Key etc.) to NAS. > Because the multiotp program isn't supplying them to FreeRADIUS. >> I note that mschap module has options like use_mppe, >> require_encryption etc.. How can I get radius to send those when I'm >> using multiotp module to perform chap/mschap so that PPTP with MPPE >> works? > Make the multiotp program supply them to FreeRADIUS. > The keys are derived from the NT-Password, and the MS-CHAP information. Since FreeRADIUS doesn't have the NT-Password, it can't derive the keys. > Alan DeKok.

3 5

Re: Freeradius-Users Digest, Vol 108, Issue 20
by Rui Ribeiro 05 Apr '14

05 Apr '14

Hi, First you´d better upgrade to 2.2.4; so many things have improved. We are serving around 2500 wifi customers, and the whole process of authentication takes less than 20 ms, and we do use a MySQL database. I advise to avoid external perl routines as possible, and have a look at unlang; are you sure you are also measuring correctly things? I used to use a couple of scripts that had their own setup, and though I had 200 ms when I was having 30ms in the past, until it dawned in me it was the time for the perl environment and script to load and setup the environment to work. Regards ------------------------------ > > Message: 4 > Date: Fri, 04 Apr 2014 16:46:11 +0700 > From: Eugene Grosbein <fr(a)grosbein.net> > To: freeradius-users(a)lists.freeradius.org > Subject: DHCP module and external DHCP relay > Message-ID: <533E7F63.5020109(a)grosbein.net> > Content-Type: text/plain; charset=us-ascii > > Hi! > > We use FreeRADIUS 2.2.0 as DHCP server with rlm_perl > to connect to external database to run stored procedure there > that returns IP/mask/DNS etc for option82-enabled requests. > > The database is pretty fast and serves hundreds of parallel requests > in 1 second or less. > > FreeRADIUS receives all DHCP requests from external high loaded DHCP relay > and threats them all as coming from single DHCP client. > > Our perl script does extensive logging through direct syslog connection > and I see that there is great delay between the moment of DHCP request > arrival > as shown by tcpdump and the moment when post_auth perl function is > invoked by FreeRADIUS. > > This delay is about 6 seconds and some DHCP clients do not wait for so > long. > > Is it possible to eliminate these delays? Here are lines from radiusd log: > > Request 14280134 has been waiting in the processing queue for 6 seconds. > Check that all databases are running properly! > Discarding duplicate request from client dhcp port 67 - ID: 1381353109 due > to unfinished request 14280311 > > Again, our database processes most request in less than 1 second and very > seldom in 2 seconds > but mentioned problem is persistent. > > Eugene Grosbein > > > ------------------------------ > > - > List info/subscribe/unsubscribe? See > http://www.freeradius.org/list/users.html > > End of Freeradius-Users Digest, Vol 108, Issue 20 > ************************************************* >

4 6

Re: Freeradius-Users Digest, Vol 108, Issue 24
by Rui Ribeiro 04 Apr '14

04 Apr '14

Hi, Probably you are using a Cisco that always fill it´s virtual port as 29 in every connection. I log everything to MySQL and see all the authentications there. So essentially it is a bug from Cisco, I think. If someone also manages to explain how to get radwho working properly I will be very interested. Regards > > Message: 7 > Date: Fri, 4 Apr 2014 14:06:55 -0700 > From: Matthew Ceroni <matthewceroni(a)gmail.com> > To: FreeRadius users mailing list > <freeradius-users(a)lists.freeradius.org> > Subject: radutmp and sradutmp modules > Message-ID: > < > CA+NsY5gjtmqnd3haj0nkzNroWQNG8+A3WmZ9GC_BcVRjy6rfSw(a)mail.gmail.com> > Content-Type: text/plain; charset="iso-8859-1" > > Hi: > > I am utilizing FreeRadius as an authentication server for a 802.1x > environment (wired and wireless). Everything is up and running great. > > I recently enabled Accounting and turned on the radutmp and sradutmp files. > I am probably missing something simple but running radwho only shows the > last person to login. So if I sign onto the wireless or wired network, > authenticate successfully to the radius server and type radwho is shows me > as logged in. If another users signs on the output of radwho just shows > them (always a single line of output). > > Is radwho meant to keep track of all currently signed in users? Or am I > missing something simple? > > Thanks >

2 1

RE: Querying freeRADIUS from Java
by Estefania figueroa buitrago 04 Apr '14

04 Apr '14

Hello guys, thank you very much for your suggestions. I'm really impressed by the amount and quickness. I ended up using TinyRadius and it worked like a charm. Just in case someone have the same question I drop here the code I am using: --------------------------------------------------- public class RadiusClient { //check http://wiki.freeradius.org/guide/SQL-HOWTO first public static void main (String[] args) throws RadiusException{ org.tinyradius.util.RadiusClient radiusClient = new org.tinyradius.util.RadiusClient("127.0.0.1", "testing123"); AccessRequest accessRequest = new AccessRequest("dialrouter", "dialup"); try{ RadiusPacket response = radiusClient.authenticate(accessRequest); if(response.getPacketType() == RadiusPacket.ACCESS_ACCEPT){ String outs = response.getAttributeValue("Framed-Protocol"); System.out.println(outs); System.out.println("Authenticated"); } else if(response.getPacketType() == RadiusPacket.ACCESS_REJECT){ System.out.println("No Authenticated"); } }catch(IOException e){ e.printStackTrace(); }catch(RadiusException e){ e.printStackTrace(); } } } --------------------------------------------------- To support vendor specific AVPs check this tutorial. It helped me a lot: http://raihanulislam.wordpress.com/2012/03/25/supporting-vendor-specific-av… Greetings, Estefanía > Message: 2 > Date: Thu, 3 Apr 2014 21:26:52 +0100 > From: <adrian.p.smith(a)bt.com> > To: <freeradius-users(a)lists.freeradius.org> > Subject: RE: Querying freeRADIUS from Java > Message-ID: > <555F5D0F9437EB4EB0E1828E3A271939375E599D8D(a)EMV65-UKRD.domain1.systemhost.net> > > Content-Type: text/plain; charset="iso-8859-1" > > We use http://tinyradius.sourceforge.net/ for simple a Java Radius client. > > From: freeradius-users-bounces+adrian.p.smith=bt.com(a)lists.freeradius.org [mailto:freeradius-users-bounces+adrian.p.smith=bt.com@lists.freeradius.org] On Behalf Of Estefania figueroa buitrago > Sent: 03 April 2014 20:30 > To: freeradius-users(a)lists.freeradius.org > Subject: Querying freeRADIUS from Java > > Hello guys, > > I just started to use freeRADIUS. The server is running and working with mySQL just like in this tutorial: > > http://wiki.freeradius.org/guide/SQL-HOWTO > > What I want to do is really simple. I want to be able to query the server from Java just like radtest does and get response information, for example: > > Framed-IP-Address = 2.3.4.1 > Framed-IP-Netmask = 255.255.255.255 > Framed-Routing = Broadcast-Listen > Framed-Route = "2.3.4.0 255.255.255.248" > Idle-Timeout = 900 > Service-Type = Framed-User > Framed-Protocol = PPP > > to be processed later also in Java. Is there a way to do this and keep it as simple as possible? I have an application server written in Java (Mobicents) and I only need to obtain authentication information from freeRADIUS to process it later. Sorry if my cuestion isn't pertinent, but I haven't find anything in the wiki. If there is no way to do this, I would be very grateful if you could show another way to do it. > > Greetings, > Estefan?a >

1 0