April 2014 - Freeradius-Users - lists.freeradius.org

Duplicate release of IP ?
by adrian.sandu＠asandu.eu 19 Apr '14

19 Apr '14

Hello list, For some time now, I've been getting some complaints that some users are getting duplicate ips and not doing any traffic .. Allocated IP: x.x.x.42 from main (did cli 00:25:22 port 622 user szc) Released IP x.x.x.42 (did cli 00:25:22 user szc) Allocated IP: x.x.x.42 from main (did cli C8:3A:35 port 25 user vii) Released IP x.x.x.42 (did cli C8:3A:35 user vii) Allocated IP: x.x.x.42 from main (did cli 00:1B:B9 port 670 user cor) Released IP x.x.x.42 (did cli 00:1B:B9 user cor) Allocated IP: x.x.x.42 from main (did cli 64:70:02 port 8 user tur) Released IP x.x.x.42 (did cli 64:70:02 user tur) Released IP x.x.x.42 (did cli C8:3A:35 user vii) Allocated IP: x.x.x.42 from main (did cli 00:26:22 port 610 user fuv) Released IP x.x.x.42 (did cli 00:26:22 user fuv) Allocated IP: x.x.x.42 from main (did cli 00:19:CB port 88 user stl) Released IP x.x.x.42 (did cli 00:19:CB user stl) Allocated IP: x.x.x.42 from main (did cli 00:14:0B port 436 user per) Released IP x.x.x.42 (did cli 00:14:0B user per) Allocated IP: x.x.x.244 from main (did cli 07:50:32 port 315 user visan Released IP x.x.x.244 (did cli 07:50:32 user visan Allocated IP: x.x.x.244 from main (did cli 37:5B:5D port 175 user cristea Released IP x.x.x.244 (did cli 37:5B:5D user cristea Allocated IP: x.x.x.244 from main (did cli 4A:69:39 port 140 user dinita Released IP x.x.x.244 (did cli 4A:69:39 user dinita Allocated IP: x.x.x.244 from main (did cli DC:D9:2F port 503 user dragusin Released IP x.x.x.244 (did cli DC:D9:2F user dragusin Allocated IP: x.x.x.244 from main (did cli 52:E2:FA port 33 user pamblica Released IP x.x.x.244 (did cli 52:E2:FA user pamblica Allocated IP: x.x.x.244 from main (did cli 95:AB:62 port 431 user ocoleanu Released IP x.x.x.244 (did cli 95:AB:62 user ocoleanu Allocated IP: x.x.x.244 from main (did cli 00:00:00 port 686 user lungu Released IP x.x.x.244 (did cli 00:00:00 user lungu Released IP x.x.x.244 (did cli 00:00:00 user lungu Allocated IP: x.x.x.244 from main (did cli 17:AA:E8 port 643 user ene Released IP x.x.x.244 (did cli 17:AA:E8 user ene Released IP x.x.x.244 (did cli 00:00:00 user lungu Allocated IP: x.x.x.244 from main (did cli EB:AF:CF port 173 user simion Released IP x.x.x.244 (did cli EB:AF:CF user simion Allocated IP: x.x.x.244 from main (did cli 15:B2:E2 port 216 user coroiu Released IP x.x.x.244 (did cli 15:B2:E2 user coroiu Allocated IP: x.x.x.244 from main (did cli 2D:AD:65 port 281 user stefan Released IP x.x.x.244 (did cli 2D:AD:65 user stefan Allocated IP: x.x.x.244 from main (did cli 03:15:27 port 545 user spita Released IP x.x.x.244 (did cli 03:15:27 user spita Allocated IP: x.x.x.244 from main (did cli 2D:AD:65 port 281 user stefan Released IP x.x.x.244 (did cli 2D:AD:65 user stefan Allocated IP: x.x.x.244 from main (did cli 2F:58:05 port 376 user simion Released IP x.x.x.244 (did cli 2F:58:05 user simion I also made a lil' script to monitor what is in radacct/radippool .. what ifconfig says and what radwho says...I can provide the source if wanted .. 2014-04-15 11:46:02 - 708 distinct ( 708 total ) framedipaddress in SQL radippool 2014-04-15 11:46:02 - Total Connected in radius SQL radacct : 380 2014-04-15 11:46:02 - Distinct IPs in radius SQL radacct: 379 2014-04-15 11:46:02 - Users sharing IP: x.x.x.x.42 - 2 - vii tur 2014-04-15 11:46:02 - There are a total of 15 reserved (SQL radreply) IPs that are connected (SQL radacct) 2014-04-15 11:46:02 - There are a total of 15 distinct reserved (SQL radreply) IPs that are connected (SQL radacct) 2014-04-15 11:46:02 - There are a total of 45 reserved IPs in SQL radreply 2014-04-15 11:46:02 - There are a total of 45 distinct reserved IPs in SQL radreply 2014-04-15 11:46:02 - There are 363 total connected users in radippool. 2014-04-15 11:46:02 - There are 363 distinct connected users in radippool. 2014-04-15 11:46:02 - There are 363 total connected user IPs in radippool. 2014-04-15 11:46:02 - There are 363 distinct connected user IPs in radippool. 2014-04-15 11:46:02 - Total IPs in radwho CLI: 380 2014-04-15 11:46:02 - Distinct IPs in radwho CLI: 379 2014-04-15 11:46:02 - Total IPs in ifconfig CLI: 380 2014-04-15 11:46:02 - Distinct IPs in ifconfig CLI: 379 2014-04-15 11:46:02 - FAIL: Total connected 15 (reserved) + 363 (radippool) != 380 (radacct) - should be 378 2014-04-15 18:18:01 - 708 distinct ( 708 total ) framedipaddress in SQL radippool 2014-04-15 18:18:01 - Total Connected in radius SQL radacct : 404 2014-04-15 18:18:01 - Distinct IPs in radius SQL radacct: 403 2014-04-15 18:18:01 - Users sharing IP: x.x.x.244 - 2 - lungu ene 2014-04-15 18:18:01 - There are a total of 13 reserved (SQL radreply) IPs that are connected (SQL radacct) 2014-04-15 18:18:01 - There are a total of 13 distinct reserved (SQL radreply) IPs that are connected (SQL radacct) 2014-04-15 18:18:01 - There are a total of 45 reserved IPs in SQL radreply 2014-04-15 18:18:01 - There are a total of 45 distinct reserved IPs in SQL radreply 2014-04-15 18:18:01 - There are 390 total connected users in radippool. 2014-04-15 18:18:01 - There are 390 distinct connected users in radippool. 2014-04-15 18:18:01 - There are 390 total connected user IPs in radippool. 2014-04-15 18:18:01 - There are 390 distinct connected user IPs in radippool. 2014-04-15 18:18:01 - Total IPs in radwho CLI: 405 2014-04-15 18:18:01 - Distinct IPs in radwho CLI: 404 2014-04-15 18:18:01 - Total IPs in ifconfig CLI: 404 2014-04-15 18:18:01 - Distinct IPs in ifconfig CLI: 403 2014-04-15 18:18:01 - FAIL: Total connected 13 (reserved) + 390 (radippool) != 404 (radacct) - should be 403 The script is ran every 2 minutes and only has selects. The "sharing" ip part goes on for some time .. I can provide full logs.. I'm running gentoo [ebuild R ] net-dialup/ppp-2.4.6:0/2.4.6 USE="pam radius -activefilter -atm -dhcp -eap-tls -gtk -ipv6" 0 kB [ebuild R ] net-dialup/rp-pppoe-3.11-r1 USE="-X" 0 kB [ebuild R ] dev-db/mysql-5.5.32 USE="community perl ssl -cluster -debug -embedded -extraengine -jemalloc -latin1 -max-idx-128 -minimal -profiling (-selinux) -static -systemtap -tcmalloc {-test}" 0 kB [ebuild R ] net-dialup/freeradius-2.2.0 USE="mysql pam readline ssl -bindist -debug (-firebird) -iodbc -kerberos -ldap -odbc -oracle -pcap -postgres -python -sqlite (-ruby%)" 0 kB The machine seems idle .. 16:06:50 up 2 days, 3:48, 2 users, load average: 0.17, 0.27, 0.39 radius is running with -xx for the past few days so I can provide logs .. 828M /var/log/radius/radius.log I've tried looking through them but can't figure out why it would do that ..

3 7

Executing an external program
by Muhammad Usman 18 Apr '14

18 Apr '14

Hi, I am using Freeradius version 2.2.4, I want to execute an external Java program, whenever I receive an Accounting Stop packet, I have added the below code in the "Accounting" section of /etc/raddb/sites-enabled/default accounting { # # Create a 'detail'ed log of the packets. # Note that accounting requests which are proxied # are also logged in the detail file. detail # daily # Update the wtmp file # # If you don't use "radlast", you can delete this line. unix # # For Simultaneous-Use tracking. # # Due to packet losses in the network, the data here # may be incorrect. There is little we can do about it. radutmp # sradutmp # Return an address to the IP Pool when we see a stop record. # main_pool # # Log traffic to an SQL database. # # See "Accounting queries" in sql.conf sql # # If you receive stop packets with zero session length, # they will NOT be logged in the database. The SQL module # will print a message (only in debugging mode), and will # return "noop". # # You can ignore these packets by uncommenting the following # three lines. Otherwise, the server will not respond to the # accounting request, and the NAS will retransmit. # # if (noop) { # ok # } # # Instead of sending the query to the SQL server, # write it into a log file. # # sql_log # Cisco VoIP specific bulk accounting # pgsql-voip # For Exec-Program and Exec-Program-Wait exec # Filter attributes from the accounting response. attr_filter.accounting_response update reply { Tmp-String-0 = "%{exec:/usr/bin/java -jar "/var/AccountingProcessor.jar" arg1 arg2 >> /home/user/capture.log}" } # # See "Autz-Type Status-Server" for how this works. # # Acct-Type Status-Server { # # } } where arg1 and arg2 will be the radius accounting stop packet attributes. i will add the IF condition for checking stop packets later Currently I am receiving error in logs, error is mentioned below ++[exec] returns noop [attr_filter.accounting_response] expand: %{User-Name} -> muhd.usman(a)hotmail.com attr_filter: Matched entry DEFAULT at line 12 ++[attr_filter.accounting_response] returns updated ERROR: Badly formatted variable: %{exec:/usr/bin/java -jar ++[reply] returns updated Sending Accounting-Response of id 14 to 192.168.6.121 port 55006 Finished request 1. Thanks in advance

4 10

PacketFence + HP Switches + code hacking
by Nick Van Duyn 18 Apr '14

18 Apr '14

Hello All, So I am investigating a network upgrade + better NAC and I wanted to get some thoughts on the deployment. I am currently evaluating it in our lab and saw that PacketFence was pretty easy to set up. Currently have PF 4.1.0 integrated with a Samba4 AD server (No Windows :) ), so that part is done. Looking to get some thoughts on HP switches, looking at evaluating them with PacketFence. Since it doesn't look like they sell the ProCurve switches anymore I'll probably end up getting one (or multiple) of the following depending on how the lab evaluation goes: - HP 2530 - HP 2920 - HP 5120 So even though these are not explicitly listed on the supported list, is there a general consensus how much hacking is required to get support added, or is that is even possible? I'll probably end up sending a diff out so others can take advantage of my work. I'm planning on using 802.1X PEAP (wired), MAC based auth (either .1x or snmp traps), and SNMP so I can throw idiots on my network back into an isolation VLAN. I'm willing to looking into other vendors if someone how someone has suggestions; only reason I'm looking at HP is the price point is nice for the features provided. Thanks in advance! -- Thank You, Nick Van Duyn

3 5

SELINUX blocks radius but not when using radiusd -X (debug)
by Michael Monette 17 Apr '14

17 Apr '14

Hi, Could anyone explain why this is happening? I just spent like 3 hours trying to figure this out, and I feel like it just doesn't make much sense. On the RADIUS server, SELinux is ON. I start radius in Debug with "radiusd -X" and from my client I login with my RADIUS credentials(really..ldap creds) and it works. No problem. I stop radiusd in debug, and run a 'service radiusd start'. I try to login again and it fails! I then disable SELinux (setenforce 0) and try again and it works. Why does SElinux not block 'radiusd -X' but it seems to block radius when it's started as a service(service radiusd start). What is the difference? Mike Mike

4 3

radtest mac authentication
by Frederic Van Espen 17 Apr '14

17 Apr '14

Hi, I'm pretty new to freeradius so apologies if it is a silly question. I have a server set up to do mac authentication with an ldap backend on debian wheezy. I'm trying to use radtest to verify mac authentication, but I don't find a way to add the calling-station-id attribute to the request. I see that in previous versions of radtest, there was a -g option to pass it, but it is no longer there. How can I add it to the request with a recent version? Cheers, Frederic

2 1

help! seperate database for accounting
by Stacy Trippe 16 Apr '14

16 Apr '14

What is the best place to place directives to make separate calls to a separate database for accounting table updates. I want to use a database -- radius -- for strictly -- radcheck, reply, and radgroupcheck, group reply, and usergroup tables -- the radacct table I want to strictly be updated in a separate database: accounting. The reason for this is to keep database replication turned on for those check/reply tables, and not worry so much about replicating accounting tables between the database servers. I am running the following version of FreeRADIUS: radiusd: FreeRADIUS Version 2.2.4, for host i686-pc-linux-gnu, built on Apr 8 2014 at 18:21:52 At this point, I have SQL working for authorization and authentication purposes, and the databases are replicating between all 3 database servers. In radiusd.conf: $INCLUDE sql1.conf $INCLUDE sql2.conf $INCLUDE sqlacct1.conf $INCLUDE sqlacct2.conf In sites-enabled\default: authorize { ... redundant { sql1 sql2 } ... accounting { acct_unique detail unix radutmp sql sqlacct1 { fail = 1 notfound = return noop = 2 ok = return updated = 3 reject = return userlock = 4 invalid = 5 handled = 6 } Despite this, and despite the separate connection setting in sqlacct1.conf vs. sql1.conf -- radius still sending accounting data to radius:/radacct table for insertion. Sql1.conf: sql { ... # Database type # Current supported are: rlm_sql_mysql, rlm_sql_postgresql, # rlm_sql_iodbc, rlm_sql_oracle, rlm_sql_unixodbc, rlm_sql_freetds driver = "rlm_sql_mysql" # Connect info server = "127.0.0.1" login = "raduser" password = "XXXXXXXX" # Database table configuration radius_db = "radius" ... Sqlacct1.conf: Sql { ... # Database type # Current supported are: rlm_sql_mysql, rlm_sql_postgresql, # rlm_sql_iodbc, rlm_sql_oracle, rlm_sql_unixodbc, rlm_sql_freetds driver = "rlm_sql_mysql" # Connect info server = "127.0.0.1" login = "raduser" password = "XXXXXXXX" # Database table configuration radius_db = "accounting" ... Stacy

3 3

Authorized Macs File
by Matthew Ceroni 16 Apr '14

16 Apr '14

I followed the authorized_macs guide successfully and it has been working well for me. The issue is that I find myself constantly updating the file and restarting FreeRadius (this file is even maintained in SVN and pushed out via Puppet). Is there a way to query the data via LDAP? The systems in question are registered to our AD server and a custom attribute field contains the MAC address. If I could dynamically pull this data it would make life much easier. Thanks

2 1

Monitor current NAS list with dynamic clients
by Lorenzo Milesi 16 Apr '14

16 Apr '14

Hi I'm using FR with Dynamic Clients from SQL. Is it possible to know the current cache of NASes known to radius at a certain time? I'm having problems when I move NAS from one IP to another, I had a lifetime of 86400 but even if I move it after one week the new address is still not recognized, and radius packets ignored. thanks -- Lorenzo Milesi - lorenzo.milesi(a)yetopen.it YetOpen S.r.l. - http://www.yetopen.it/

5 9

Stale sessions and simultaneous use issue
by Fernando Pizarro 16 Apr '14

16 Apr '14

Hi all! I had configured MySQL to store sessions of the users and I have a lots of records with wrong acctsessiontime value because NAS are sent Accounting On/Off packets and the database is update with the actual timestamp. I change deletestalesessions = no in sql.conf but the database is update too. What is the function of this parameter? There are some attribute to avoid stale sessions? I remember Idle-Timeout attribute but if the NAS isn't live the server never kill that session right? Thanks for all. Kings regards. Fernando.

4 8

Hex to Cleartext
by Joseph Showalter 16 Apr '14

16 Apr '14

So, after working on our puzzling issue, we have found the root cause of chap failing instance: Our equipment vendor is putting this in the end device 4867467528286D35655B523F585C5359. But freeradius needs to see this value: HgFu((m5e[R?X\\SY. This value is the "Escaped" value of the above hex. In the radius db we have the hex value stored like this: 4867467528286D35655B523F585C5359. Are there any suggestions on how we could easily convert this to the 'Escaped' value either with SQL changes or writing a perl plugin or something else that we have missed? Here is how it can be converted in Postgres: # select encode(E'\\x4867467528286D35655B523F585C5359','escape'); encode ------------------- HgFu((m5e[R?X\\SY (1 row) Any suggestions? One idea I have is to change the SQL select statement FR uses, at least if we find one that works right... -- regards, Joseph

2 3