July 2014 - Freeradius-Users - lists.freeradius.org

SSL Certificate Question
by Charles Plater 09 Jul '14

09 Jul '14

Many moons ago, i set up a FreeRadius server as part of our 802.1x / WPA project. At that time, I asked this list about using a commercially signed SSL certificate as opposed to a self signed certificate. I’m not sure I understood all of the reasons, but I was advised by another member of this list to use a self signed certificate. Fast forward 6 years to today, and our management is convinced that problems we are seeing w/ clients having problems connecting are related to the self signed SSL certificate. Could someone please describe to me the reasoning behind using a self signed certificate with on with FreeRadius? What kinds of problems / vulnerabilities will we be exposed to if we use a commercially signed (DigiCert) SSL certificate? Many thanks in advance. -- Charles Plater Lead Application Technical Analyst Internet Services +1-313-577-4620 ab3189(a)wayne.edu

4 5

SSL Certificate Question (Charles Plater) was Re: Freeradius-Users Digest, Vol 111, Issue 19
by Rui Ribeiro 08 Jul '14

08 Jul '14

Hi Charles, The experience we have here is iOS devices, and apparently, the iPhone more than the iPad are very picky with certificates. Recent OSX versions seem to very a little more picky too. We used to have a lot of strange errors before we fixed our certtificates. Your certificate on the RADIUS side has to be carefully built to include any extra certificates if you are using an intermediate root certificate. I also maybe stating the obvious, however if you are using self signed certificates it is a must to install the root certificate in the client devices. I advise, for Windows and iOS devices, to build profiles. Regards, Rui Ribeiro https://www.linkedin.com/pub/rui-ribeiro/16/ab8/434 > > Message: 1 > Date: Tue, 8 Jul 2014 15:32:27 -0400 > From: Charles Plater <ab3189(a)wayne.edu> > To: freeradius-users(a)lists.freeradius.org > Subject: SSL Certificate Question > Message-ID: <6271539D-6C15-4B9A-A71F-F4A72F1B3EAB(a)wayne.edu> > Content-Type: text/plain; charset=windows-1252 > > Many moons ago, i set up a FreeRadius server as part of our 802.1x / WPA > project. At that time, I asked this list about using a commercially signed > SSL certificate as opposed to a self signed certificate. I?m not sure I > understood all of the reasons, but I was advised by another member of this > list to use a self signed certificate. Fast forward 6 years to today, and > our management is convinced that problems we are seeing w/ clients having > problems connecting are related to the self signed SSL certificate. Could > someone please describe to me the reasoning behind using a self signed > certificate with on with FreeRadius? What kinds of problems / > vulnerabilities will we be exposed to if we use a commercially signed > (DigiCert) SSL certificate? > > Many thanks in advance. > > -- > Charles Plater > Lead Application Technical Analyst > Internet Services > +1-313-577-4620 > ab3189(a)wayne.edu > >

1 0

Document for postgresql is broken.
by Lifan Su 08 Jul '14

08 Jul '14

Hi, I'm trying to use freeradius with postgresql. I found the document ( http://wiki.freeradius.org/guide/SQL-HOWTO#Configuring_FreeRadius_to_use_SQL ) requires file postgresql.sql, but it is missing from the tarball. So what is the correct way to setup now? Regards Lifan Su

2 1

rlm_sql: Failed to create the pair: Unknown attribute "DragonWave-Privilege-Level" requires a hex string, not "DragonWave-Super-User"
by Tony DeMatteis 08 Jul '14

08 Jul '14

Greetings, I am setting up/migrating to a new Radius server. My current server is using flat files (users/clients). Not a huge deployment, but now have designs to scale larger. I've run into a problem with one reply attribute I can't seem to identify the problem. I've searched the documentation (and Googled), and while probably in from of my eyes, I can't seem to find the cause/solution. The same reply attributes work fine in my current/production server, but fail (and only when trying to include the "DragonWave-Privilege-Level" reply attribute). Now one note, in my production server in my user stanza I use the "=" operator for each of the reply attributes. However, in my new server, when using the "=" as the operator in the reply attribute I was receiving only one attribute upon authentication. I then thought I understood from the documentation that I needed to use "+=" in my reply attributes. After making that change, all the group attributes were returned. One difference may be that I am specifying the "group" attributes under each "user" (current/production) vs in a "group" which is referenced (new server)? I am in no way well versed in all the nuances of radius (but working that direction), so if I'm overlooking the obvious I would greatly appreciate a nudge in the right direction. Thank you very much, tony #************************* # #// CURRENT SERVER # #************************* # # System information # admin@radius:/home/admin# uname -a Linux radius 3.5.0-45-generic #68~precise1-Ubuntu SMP Wed Dec 4 16:18:46 UTC 2013 x86_64 x86_64 x86_64 GNU/Linux admin@radius:/home/admin# cat /etc/issue Ubuntu 12.04.4 LTS \n \l admin@radius:/home/admin# freeradius -v freeradius: FreeRADIUS Version 2.1.10, for host x86_64-pc-linux-gnu, built on Feb 24 2014 at 15:16:50 Copyright (C) 1999-2010 The FreeRADIUS server project and contributors. There is NO warranty; not even for MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. You may redistribute copies of FreeRADIUS under the terms of the GNU General Public License. For more information about these matters, see the file named COPYRIGHT. # # /etc/freeradius/users # "testuser" ClearText-Password := "tester" Reply-Message = "Hello, %{User-Name}", Mikrotik-Group = "full", DragonWave-Privilege-Level = "DragonWave-Super-User", APC-Service-Type = 1, APC-Outlets = "1,2,3,4,5,6,7,8" # # radtest and result # admin@radius:/home/admin# radtest testuser tester localhost 10 testing123 0 10.10.0.120 Sending Access-Request of id 25 to 127.0.0.1 port 1812 User-Name = "testuser" User-Password = "tester" NAS-IP-Address = 10.10.0.120 NAS-Port = 10 Framed-Protocol = PPP rad_recv: Access-Accept packet from host 127.0.0.1 port 1812, id=25, length=70 Reply-Message = "Hello, testuser" Mikrotik-Group = "full" DragonWave-Privilege-Level = DragonWave-Super-User APC-Service-Type = Admin APC-Outlets = "1,2,3,4,5,6,7,8" #************************* # #// NEW SERVER # #************************* admin@radius1:/home/admin# uname -a Linux radius1.mydomain.net 2.6.32-431.20.3.el6.i686 #1 SMP Thu Jun 19 19:51:30 UTC 2014 i686 i686 i386 GNU/Linux admin@radius1:/home/admin# cat /etc/issue CentOS release 6.5 (Final) Kernel \r on an \m admin@radius1:/home/admin# radiusd -v radiusd: FreeRADIUS Version 2.1.12, for host i386-redhat-linux-gnu, built on Oct 3 2012 at 01:20:08 Copyright (C) 1999-2011 The FreeRADIUS server project and contributors. There is NO warranty; not even for MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. You may redistribute copies of FreeRADIUS under the terms of the GNU General Public License. For more information about these matters, see the file named COPYRIGHT. #************************* # #// radtest # #************************* admin@radius1:/home/admin# radtest testuser tester 216.x.x.x 10 testing123 0 10.10.0.120 Sending Access-Request of id 119 to 216.x.x.x port 1812 User-Name = "testuser" User-Password = "tester" NAS-IP-Address = 10.10.0.120 NAS-Port = 10 Message-Authenticator = 0x00000000000000000000000000000000 rad_recv: Access-Reject packet from host 216.x.x.x port 1812, id=119, length=20 #************************* # #// Partial debug output # #************************* Ready to process requests. rad_recv: Access-Request packet from host 216.x.x.x port 50707, id=119, length=75 User-Name = "testuser" User-Password = "tester" NAS-IP-Address = 10.10.0.120 NAS-Port = 10 Message-Authenticator = 0x17fec73c577cb5fd95d9dd3656c3a8db # Executing section authorize from file /etc/raddb/sites-enabled/default +- entering group authorize {...} ++- entering policy filter_username {...} +++? if (User-Name =~ /^ /) ? Evaluating (User-Name =~ /^ /) -> FALSE +++? if (User-Name =~ /^ /) -> FALSE +++? if (User-Name =~ / $$/) ? Evaluating (User-Name =~ / $$/) -> FALSE +++? if (User-Name =~ / $$/) -> FALSE +++? if (User-Name != "%{tolower:%{User-Name}}") expand: %{User-Name} -> testuser expand: %{tolower:%{User-Name}} -> testuser ? Evaluating (User-Name != "%{tolower:%{User-Name}}") -> FALSE +++? if (User-Name != "%{tolower:%{User-Name}}") -> FALSE ++- policy filter_username returns notfound ++[preprocess] returns ok ++[chap] returns noop ++[mschap] returns noop ++[digest] returns noop [suffix] No '@' in User-Name = "testuser", looking up realm NULL [suffix] No such realm "NULL" ++[suffix] returns noop [eap] No EAP-Message, not doing EAP ++[eap] returns noop [sql] expand: %{User-Name} -> testuser [sql] sql_set_user escaped user --> 'testuser' rlm_sql (sql): Reserving sql socket id: 3 [sql] expand: SELECT id, username, attribute, value, op FROM radcheck WHERE username = '%{SQL-User-Name}' ORDER BY id -> SELECT id, username, attribute, value, op FROM radcheck WHERE username = 'testuser' ORDER BY id [sql] User found in radcheck table [sql] expand: SELECT id, username, attribute, value, op FROM radreply WHERE username = '%{SQL-User-Name}' ORDER BY id -> SELECT id, username, attribute, value, op FROM radreply WHERE username = 'testuser' ORDER BY id [sql] expand: SELECT groupname FROM radusergroup WHERE username = '%{SQL-User-Name}' ORDER BY priority -> SELECT groupname FROM radusergroup WHERE username = 'testuser' ORDER BY priority [sql] expand: SELECT id, groupname, attribute, Value, op FROM radgroupcheck WHERE groupname = '%{Sql-Group}' ORDER BY id -> SELECT id, groupname, attribute, Value, op FROM radgroupcheck WHERE groupname = 'NOC-Admin' ORDER BY id [sql] User found in group NOC-Admin [sql] expand: SELECT id, groupname, attribute, value, op FROM radgroupreply WHERE groupname = '%{Sql-Group}' ORDER BY id -> SELECT id, groupname, attribute, value, op FROM radgroupreply WHERE groupname = 'NOC-Admin' ORDER BY id rlm_sql: Failed to create the pair: Unknown attribute "DragonWave-Privilege-Level" requires a hex string, not "DragonWave-Super-User" rlm_sql (sql): Error getting data from database [sql] Error retrieving reply pairs for group NOC-Admin [sql] Error processing groups; rejecting user rlm_sql (sql): Released sql socket id: 3 ++[sql] returns fail Using Post-Auth-Type Reject # Executing group from file /etc/raddb/sites-enabled/default +- entering group REJECT {...} [attr_filter.access_reject] expand: %{User-Name} -> testuser attr_filter: Matched entry DEFAULT at line 11 ++[attr_filter.access_reject] returns updated Delaying reject of request 0 for 1 seconds Going to the next request Waking up in 0.9 seconds. Sending delayed reject for request 0 Sending Access-Reject of id 119 to 216.x.x.x port 50707 Waking up in 4.9 seconds. Cleaning up request 0 ID 119 with timestamp +54 Ready to process requests. #************************* # #// Manual query based on radiusd -X debug output # #************************* mysql> SELECT id, groupname, attribute, value, op FROM radgroupreply WHERE groupname = 'NOC-Admin' ORDER BY id; +----+---------------------+----------------------------+-----------------------+----+ | id | groupname | attribute | value | op | +----+---------------------+----------------------------+-----------------------+----+ | 1 | NOC-Admin | Mikrotik-Group | full | += | | 7 | NOC-Admin | APC-Service-Type | 1 | += | | 8 | NOC-Admin | APC-Outlets | "1,2,3,4,5,6,7,8" | += | | 10 | NOC-Admin | DragonWave-Privilege-Level | DragonWave-Super-User | += | +----+---------------------+----------------------------+-----------------------+----+ 5 rows in set (0.00 sec) mysql> # /usr/share/freeradius/dictionary.dragonwave #************************* # #// Dragonwave Dictionary Definition # #************************* # -*- text -*- # http://www.dragonwaveinc.com # # $Id$ # VENDOR DragonWave 7262 BEGIN-VENDOR DragonWave # Used to determine the user login privilege level. ATTRIBUTE DragonWave-Privilege-Level 1 integer # Read-only access. VALUE DragonWave-Privilege-Level DragonWave-Admin-User 1 # Limited read-write access. VALUE DragonWave-Privilege-Level DragonWave-NOC-User 2 # Unlimited read-write access. VALUE DragonWave-Privilege-Level DragonWave-Super-User 3 END-VENDOR DragonWave

2 4

3.0.x: check regex against multiple instances of attribute
by Stefan Winter 08 Jul '14

08 Jul '14

Hello, currently setting up 3.0 with one of our eduroam participants here in Luxembourg. They have an AD backend, and auth via ntlm_auth works fine. Now, they also want to extract group membership attributes and assign users to VLANs as appropriate. The users can be members of multiple groups and there is an LDAP attribute "memberOf" which spits out all applicable groups in sequence. I've used the ldap modules in authorize to do that, and add the groups with +=. This seems to work (debug snippet below). Now I'd like to use unlang to check "if one of the values of those attributes matches regex foo, add the user to VLANx. I used to think there was a special comparison operator for exactly that purpose, but I can't for the life of me find it in documentation. What I've tried is if ( control:Member-Check =~ /regex/ ) but that apparently checks only the first occurence of the control item; I.e. it returns true if the regex is contained in the first instance, but not if it is contained only in a non-first instance. I guess I'm missing something fairly obvious? A typical debug is this: Mon Jul 7 11:21:14 2014 : Debug: (7) ldap : Waiting for search result... Mon Jul 7 11:21:14 2014 : Debug: (7) ldap : User object found at DN "CN=My User,OU=Test,OU=Users,DC=mydomain,DC=com" Mon Jul 7 11:21:14 2014 : Debug: (7) ldap : Processing user attributes Mon Jul 7 11:21:14 2014 : Debug: (7) ldap : control:Member-Check += ''CN=Group1,OU=SecurityGroupsManagedCentrally,OU=Groups,DC=mydomain,DC=com'' Mon Jul 7 11:21:14 2014 : Debug: (7) ldap : control:Member-Check += ''CN=Group2,OU=SecurityGroups,OU=Groups,DC=mydomain,DC=com'' Mon Jul 7 11:21:14 2014 : Debug: (7) ldap : control:Member-Check += ''CN=Group3,OU=SecurityGroups,OU=Groups,DC=mydomain,DC=com'' Mon Jul 7 11:21:14 2014 : Debug: (7) ldap : control:Member-Check += ''CN=Group4,OU=SecurityGroups,OU=Groups,DC=mydomain,DC=com'' Mon Jul 7 11:21:14 2014 : Debug: (7) ldap : control:Member-Check += ''CN=Group5,OU=SecurityGroups,OU=Groups,DC=mydomain,DC=com'' Mon Jul 7 11:21:14 2014 : Debug: (7) ldap : control:Member-Check += ''CN=VLAN-Students,OU=Network,OU=Groups,DC=mydomain,DC=com'' Mon Jul 7 11:21:14 2014 : Debug: (7) ldap : control:Member-Check += ''CN=Group6,OU=SecurityGroups,OU=Groups,DC=mydomain,DC=com'' Mon Jul 7 11:21:14 2014 : Debug: (7) ldap : control:Member-Check += ''CN=Group7,OU=SecurityGroups,OU=Groups,DC=mydomain,DC=com'' Mon Jul 7 11:21:14 2014 : Debug: rlm_ldap (ldap): Released connection (4) Mon Jul 7 11:21:14 2014 : Debug: (7) modsingle[authorize]: returned from ldap (rlm_ldap) for request 7 Mon Jul 7 11:21:14 2014 : Debug: (7) [ldap] = ok Mon Jul 7 11:21:14 2014 : Debug: (7) if ( control:Member-Check =~ /Student/ ) Mon Jul 7 11:21:14 2014 : Debug: (7) if ( control:Member-Check =~ /Student/ ) -> FALSE Mon Jul 7 11:21:14 2014 : Debug: (7) modsingle[authorize]: calling pap (rlm_pap) for request 7 Mon Jul 7 11:21:14 2014 : Debug: (7) modsingle[authorize]: returned from pap (rlm_pap) for request 7 Mon Jul 7 11:21:14 2014 : Debug: (7) [pap] = noop Mon Jul 7 11:21:14 2014 : Debug: (7) } # authorize = updated The regex "Student" should match the sixth instance of the control items, but doesn't. If someone could lend me a hint ... Stefan -- Stefan WINTER Ingenieur de Recherche Fondation RESTENA - Réseau Téléinformatique de l'Education Nationale et de la Recherche 6, rue Richard Coudenhove-Kalergi L-1359 Luxembourg Tel: +352 424409 1 Fax: +352 422473 PGP key updated to 4096 Bit RSA - I will encrypt all mails if the recipient's key is known to me http://pgp.mit.edu:11371/pks/lookup?op=get&search=0xC0DE6A358A39DC66

7 10

RE: Subject: rlm_sql: Failed to create the pair: Unknown attribute
by Mike Poole 07 Jul '14

07 Jul '14

Tony, I'm replying at the top instead of inline. Our FreeRADIUS SQL returns this for : 44418AS id 1-1-1 AS groupname Mikrotik-Rate-Limit AS attribute 1000k/2001k 2000k/4000k 750k/1500k 1800/1800 7 AS value ≔ AS op I think your problem is with the op (operator). It should be "≔" and I believe it should be at the end. We use custom tables and stored procedures to do this. For the "group" query all I return is a groupname, such as the package ID '1-1-1' SELECT packageId as "groupname"; (I believe this is where you are having the trouble. Let me know if it helps or if I can do anything else Message: 2 Date: Mon, 07 Jul 2014 08:03:03 -0700 From: Tony DeMatteis <tonyd(a)commspeed.net<mailto:tonyd@commspeed.net>> To: freeradius-users(a)lists.freeradius.org<mailto:freeradius-users@lists.freeradius.org> Subject: rlm_sql: Failed to create the pair: Unknown attribute "DragonWave-Privilege-Level" requires a hex string, not "DragonWave-Super-User" Message-ID: <53BAB6A7.2040309(a)commspeed.net<mailto:53BAB6A7.2040309@commspeed.net>> Content-Type: text/plain; charset="iso-8859-1"; Format="flowed" Greetings, I am setting up/migrating to a new Radius server. My current server is using flat files (users/clients). Not a huge deployment, but now have designs to scale larger. I've run into a problem with one reply attribute I can't seem to identify the problem. I've searched the documentation (and Googled), and while probably in from of my eyes, I can't seem to find the cause/solution. The same reply attributes work fine in my current/production server, but fail (and only when trying to include the "DragonWave-Privilege-Level" reply attribute). Now one note, in my production server in my user stanza I use the "=" operator for each of the reply attributes. However, in my new server, when using the "=" as the operator in the reply attribute I was receiving only one attribute upon authentication. I then thought I understood from the documentation that I needed to use "+=" in my reply attributes. After making that change, all the group attributes were returned. One difference may be that I am specifying the "group" attributes under each "user" (current/production) vs in a "group" which is referenced (new server)? I am in no way well versed in all the nuances of radius (but working that direction), so if I'm overlooking the obvious I would greatly appreciate a nudge in the right direction. Thank you very much, tony #************************* # #// CURRENT SERVER # #************************* # # System information # admin@radius:/home/admin# uname -a Linux radius 3.5.0-45-generic #68~precise1-Ubuntu SMP Wed Dec 4 16:18:46 UTC 2013 x86_64 x86_64 x86_64 GNU/Linux admin@radius:/home/admin# cat /etc/issue Ubuntu 12.04.4 LTS \n \l admin@radius:/home/admin# freeradius -v freeradius: FreeRADIUS Version 2.1.10, for host x86_64-pc-linux-gnu, built on Feb 24 2014 at 15:16:50 Copyright (C) 1999-2010 The FreeRADIUS server project and contributors. There is NO warranty; not even for MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. You may redistribute copies of FreeRADIUS under the terms of the GNU General Public License. For more information about these matters, see the file named COPYRIGHT. # # /etc/freeradius/users # "testuser" ClearText-Password := "tester" Reply-Message = "Hello, %{User-Name}", Mikrotik-Group = "full", DragonWave-Privilege-Level = "DragonWave-Super-User", APC-Service-Type = 1, APC-Outlets = "1,2,3,4,5,6,7,8" # # radtest and result # admin@radius:/home/admin# radtest testuser tester localhost 10 testing123 0 10.10.0.120 Sending Access-Request of id 25 to 127.0.0.1 port 1812 User-Name = "testuser" User-Password = "tester" NAS-IP-Address = 10.10.0.120 NAS-Port = 10 Framed-Protocol = PPP rad_recv: Access-Accept packet from host 127.0.0.1 port 1812, id=25, length=70 Reply-Message = "Hello, testuser" Mikrotik-Group = "full" DragonWave-Privilege-Level = DragonWave-Super-User APC-Service-Type = Admin APC-Outlets = "1,2,3,4,5,6,7,8" #************************* # #// NEW SERVER # #************************* admin@radius1:/home/admin# uname -a Linux radius1.mydomain.net 2.6.32-431.20.3.el6.i686 #1 SMP Thu Jun 19 19:51:30 UTC 2014 i686 i686 i386 GNU/Linux admin@radius1:/home/admin# cat /etc/issue CentOS release 6.5 (Final) Kernel \r on an \m admin@radius1:/home/admin# radiusd -v radiusd: FreeRADIUS Version 2.1.12, for host i386-redhat-linux-gnu, built on Oct 3 2012 at 01:20:08 Copyright (C) 1999-2011 The FreeRADIUS server project and contributors. There is NO warranty; not even for MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. You may redistribute copies of FreeRADIUS under the terms of the GNU General Public License. For more information about these matters, see the file named COPYRIGHT. #************************* # #// radtest # #************************* admin@radius1:/home/admin# radtest testuser tester 216.x.x.x 10 testing123 0 10.10.0.120 Sending Access-Request of id 119 to 216.x.x.x port 1812 User-Name = "testuser" User-Password = "tester" NAS-IP-Address = 10.10.0.120 NAS-Port = 10 Message-Authenticator = 0x00000000000000000000000000000000 rad_recv: Access-Reject packet from host 216.x.x.x port 1812, id=119, length=20 #************************* # #// Partial debug output # #************************* Ready to process requests. rad_recv: Access-Request packet from host 216.x.x.x port 50707, id=119, length=75 User-Name = "testuser" User-Password = "tester" NAS-IP-Address = 10.10.0.120 NAS-Port = 10 Message-Authenticator = 0x17fec73c577cb5fd95d9dd3656c3a8db # Executing section authorize from file /etc/raddb/sites-enabled/default +- entering group authorize {...} ++- entering policy filter_username {...} +++? if (User-Name =~ /^ /) ? Evaluating (User-Name =~ /^ /) -> FALSE +++? if (User-Name =~ /^ /) -> FALSE +++? if (User-Name =~ / $$/) ? Evaluating (User-Name =~ / $$/) -> FALSE +++? if (User-Name =~ / $$/) -> FALSE +++? if (User-Name != "%{tolower:%{User-Name}}") expand: %{User-Name} -> testuser expand: %{tolower:%{User-Name}} -> testuser ? Evaluating (User-Name != "%{tolower:%{User-Name}}") -> FALSE +++? if (User-Name != "%{tolower:%{User-Name}}") -> FALSE ++- policy filter_username returns notfound ++[preprocess] returns ok ++[chap] returns noop ++[mschap] returns noop ++[digest] returns noop [suffix] No '@' in User-Name = "testuser", looking up realm NULL [suffix] No such realm "NULL" ++[suffix] returns noop [eap] No EAP-Message, not doing EAP ++[eap] returns noop [sql] expand: %{User-Name} -> testuser [sql] sql_set_user escaped user --> 'testuser' rlm_sql (sql): Reserving sql socket id: 3 [sql] expand: SELECT id, username, attribute, value, op FROM radcheck WHERE username = '%{SQL-User-Name}' ORDER BY id -> SELECT id, username, attribute, value, op FROM radcheck WHERE username = 'testuser' ORDER BY id [sql] User found in radcheck table [sql] expand: SELECT id, username, attribute, value, op FROM radreply WHERE username = '%{SQL-User-Name}' ORDER BY id -> SELECT id, username, attribute, value, op FROM radreply WHERE username = 'testuser' ORDER BY id [sql] expand: SELECT groupname FROM radusergroup WHERE username = '%{SQL-User-Name}' ORDER BY priority -> SELECT groupname FROM radusergroup WHERE username = 'testuser' ORDER BY priority [sql] expand: SELECT id, groupname, attribute, Value, op FROM radgroupcheck WHERE groupname = '%{Sql-Group}' ORDER BY id -> SELECT id, groupname, attribute, Value, op FROM radgroupcheck WHERE groupname = 'NOC-Admin' ORDER BY id [sql] User found in group NOC-Admin [sql] expand: SELECT id, groupname, attribute, value, op FROM radgroupreply WHERE groupname = '%{Sql-Group}' ORDER BY id -> SELECT id, groupname, attribute, value, op FROM radgroupreply WHERE groupname = 'NOC-Admin' ORDER BY id rlm_sql: Failed to create the pair: Unknown attribute "DragonWave-Privilege-Level" requires a hex string, not "DragonWave-Super-User" rlm_sql (sql): Error getting data from database [sql] Error retrieving reply pairs for group NOC-Admin [sql] Error processing groups; rejecting user rlm_sql (sql): Released sql socket id: 3 ++[sql] returns fail Using Post-Auth-Type Reject # Executing group from file /etc/raddb/sites-enabled/default +- entering group REJECT {...} [attr_filter.access_reject] expand: %{User-Name} -> testuser attr_filter: Matched entry DEFAULT at line 11 ++[attr_filter.access_reject] returns updated Delaying reject of request 0 for 1 seconds Going to the next request Waking up in 0.9 seconds. Sending delayed reject for request 0 Sending Access-Reject of id 119 to 216.x.x.x port 50707 Waking up in 4.9 seconds. Cleaning up request 0 ID 119 with timestamp +54 Ready to process requests. #************************* # #// Manual query based on radiusd -X debug output # #************************* mysql> SELECT id, groupname, attribute, value, op FROM radgroupreply WHERE groupname = 'NOC-Admin' ORDER BY id; +----+---------------------+----------------------------+-----------------------+----+ | id | groupname | attribute | value | op | +----+---------------------+----------------------------+-----------------------+----+ | 1 | NOC-Admin | Mikrotik-Group | full | += | | 7 | NOC-Admin | APC-Service-Type | 1 | += | | 8 | NOC-Admin | APC-Outlets | "1,2,3,4,5,6,7,8" | += | | 10 | NOC-Admin | DragonWave-Privilege-Level | DragonWave-Super-User | += | +----+---------------------+----------------------------+-----------------------+----+ 5 rows in set (0.00 sec) mysql> # /usr/share/freeradius/dictionary.dragonwave #************************* # #// Dragonwave Dictionary Definition # #************************* # -*- text -*- # http://www.dragonwaveinc.com # # $Id$ # VENDOR DragonWave 7262 BEGIN-VENDOR DragonWave # Used to determine the user login privilege level. ATTRIBUTE DragonWave-Privilege-Level 1 integer # Read-only access. VALUE DragonWave-Privilege-Level DragonWave-Admin-User 1 # Limited read-write access. VALUE DragonWave-Privilege-Level DragonWave-NOC-User 2 # Unlimited read-write access. VALUE DragonWave-Privilege-Level DragonWave-Super-User 3 END-VENDOR DragonWave -------------- next part -------------- An HTML attachment was scrubbed... URL: <http://lists.freeradius.org/pipermail/freeradius-users/attachments/20140707…> ------------------------------ - List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html End of Freeradius-Users Digest, Vol 111, Issue 13 *************************************************

2 2

Priority of user attribute
by Mehdi Ravanbakhsh 07 Jul '14

07 Jul '14

Hi All Do we have any whey to change Priority of User Attribute over Group Attribute (in SQL) ? Best Regards

1 0

intermittent auth issue (proxy: request is no longer in proxy hash)
by Chris Knipe 04 Jul '14

04 Jul '14

Hi All, I've manage to pull the below request (-Xxx) from a debug log. Very intermittently, and randomly, my FR would receive a auth-accept from an proxy server. The accept packet received from the proxy server includes a Configuration-Token attribute, which I then interpret and do stuff with in the post_proxy section, using rlm_perl. For some reason, the response received does not make it through post_proxy. From what I can gather in the logs, FR complains: Thu Jul 3 11:55:49 2014 : Debug: (216) proxy: request is no longer in proxy hash Thu Jul 3 11:55:49 2014 : Debug: (216) Found Auth-Type = Accept Thu Jul 3 11:55:49 2014 : Debug: (216) Auth-Type = Accept, accepting the user Thu Jul 3 11:55:49 2014 : Auth: (216) Login OK: [user(a)proxy.realm/oozuL8poop] (from client CLIENT port 0 cli c.d.99.6) And then of course, never passes the request off through rlm_perl. Can anyone shed some light on this in terms of how to fix this? It is imperative that that proxied response passes through rlm_perl - in my specific case, I am not concerned about how long the authentication process takes, but it is critically important that it passes through rlm_perl so that various aspects of the session can be setup... Full Debug Log: Received Access-Request Id 85 from e.f.240.36:22947 to e.f.136.224:1812 length 119 Called-Station-Id = 'a.b.8.42' Calling-Station-Id = 'c.d.99.6' NAS-IP-Address = e.f.240.36 NAS-Port-Type = Virtual NAS-Port-Id = '16980' Service-Type = Authenticate-Only User-Name = 'user(a)proxy.realm' User-Password = 'oozuL8poop' Thu Jul 3 11:55:48 2014 : Debug: (216) # Executing section authorize from file /etc/freeradius/radiusd.conf Thu Jul 3 11:55:48 2014 : Debug: (216) authorize { Thu Jul 3 11:55:48 2014 : Debug: (216) filter_username filter_username { Thu Jul 3 11:55:48 2014 : Debug: (216) if (User-Name =~ / /) Thu Jul 3 11:55:48 2014 : Debug: Thu Jul 3 11:55:48 2014 : Debug: Parsed xlat tree: Thu Jul 3 11:55:48 2014 : Debug: literal --> Thu Jul 3 11:55:48 2014 : Debug: (216) EXPAND Thu Jul 3 11:55:48 2014 : Debug: (216) --> Thu Jul 3 11:55:48 2014 : Debug: (216) if (User-Name =~ / /) -> FALSE Thu Jul 3 11:55:48 2014 : Debug: (216) if (User-Name =~ /@.*@/ ) Thu Jul 3 11:55:48 2014 : Debug: @.*@ Thu Jul 3 11:55:48 2014 : Debug: Parsed xlat tree: Thu Jul 3 11:55:48 2014 : Debug: literal --> @.*@ Thu Jul 3 11:55:48 2014 : Debug: (216) EXPAND @.*@ Thu Jul 3 11:55:48 2014 : Debug: (216) --> @.*@ Thu Jul 3 11:55:48 2014 : Debug: (216) if (User-Name =~ /@.*@/ ) -> FALSE Thu Jul 3 11:55:48 2014 : Debug: (216) if (User-Name =~ /\\.\\./ ) Thu Jul 3 11:55:48 2014 : Debug: \.\. Thu Jul 3 11:55:48 2014 : Debug: Parsed xlat tree: Thu Jul 3 11:55:48 2014 : Debug: literal --> \\\. Thu Jul 3 11:55:48 2014 : Debug: (216) EXPAND \.\. Thu Jul 3 11:55:48 2014 : Debug: (216) --> \\\. Thu Jul 3 11:55:48 2014 : Debug: (216) if (User-Name =~ /\\.\\./ ) -> FALSE Thu Jul 3 11:55:48 2014 : Debug: (216) if (User-Name =~ /\\.$/) Thu Jul 3 11:55:48 2014 : Debug: \.$ Thu Jul 3 11:55:48 2014 : Debug: Parsed xlat tree: Thu Jul 3 11:55:48 2014 : Debug: literal --> \$$ Thu Jul 3 11:55:48 2014 : Debug: (216) EXPAND \.$ Thu Jul 3 11:55:48 2014 : Debug: (216) --> \$$ Thu Jul 3 11:55:48 2014 : Debug: (216) if (User-Name =~ /\\.$/) -> FALSE Thu Jul 3 11:55:48 2014 : Debug: (216) if (User-Name =~ /(a)\\./) Thu Jul 3 11:55:48 2014 : Debug: @\. Thu Jul 3 11:55:48 2014 : Debug: Parsed xlat tree: Thu Jul 3 11:55:48 2014 : Debug: literal --> @\. Thu Jul 3 11:55:48 2014 : Debug: (216) EXPAND @\. Thu Jul 3 11:55:48 2014 : Debug: (216) --> @\. Thu Jul 3 11:55:48 2014 : Debug: (216) if (User-Name =~ /(a)\\./) -> FALSE Thu Jul 3 11:55:48 2014 : Debug: (216) } # filter_username filter_username = notfound Thu Jul 3 11:55:48 2014 : Debug: (216) modsingle[authorize]: calling preprocess (rlm_preprocess) for request 216 Thu Jul 3 11:55:48 2014 : Debug: (216) modsingle[authorize]: returned from preprocess (rlm_preprocess) for request 216 Thu Jul 3 11:55:48 2014 : Debug: (216) [preprocess] = ok Thu Jul 3 11:55:48 2014 : Debug: (216) modsingle[authorize]: calling auth_log (rlm_detail) for request 216 Thu Jul 3 11:55:48 2014 : Debug: /var/log/freeradius/%Y/%Y-%m/%Y-%m-%d-auth_log Thu Jul 3 11:55:48 2014 : Debug: Parsed xlat tree: Thu Jul 3 11:55:48 2014 : Debug: literal --> /var/log/freeradius/ Thu Jul 3 11:55:48 2014 : Debug: percent --> Y Thu Jul 3 11:55:48 2014 : Debug: literal --> / Thu Jul 3 11:55:48 2014 : Debug: percent --> Y Thu Jul 3 11:55:48 2014 : Debug: literal --> - Thu Jul 3 11:55:48 2014 : Debug: percent --> m Thu Jul 3 11:55:48 2014 : Debug: literal --> / Thu Jul 3 11:55:48 2014 : Debug: percent --> Y Thu Jul 3 11:55:48 2014 : Debug: literal --> - Thu Jul 3 11:55:48 2014 : Debug: percent --> m Thu Jul 3 11:55:48 2014 : Debug: literal --> - Thu Jul 3 11:55:48 2014 : Debug: percent --> d Thu Jul 3 11:55:48 2014 : Debug: literal --> -auth_log Thu Jul 3 11:55:48 2014 : Debug: (216) auth_log : EXPAND /var/log/freeradius/%Y/%Y-%m/%Y-%m-%d-auth_log Thu Jul 3 11:55:48 2014 : Debug: (216) auth_log : --> /var/log/freeradius/2014/2014-07/2014-07-03-auth_log Thu Jul 3 11:55:48 2014 : Debug: (216) auth_log : /var/log/freeradius/%Y/%Y-%m/%Y-%m-%d-auth_log expands to /var/log/freeradius/2014/2014-07/2014-07-03-auth_log Thu Jul 3 11:55:48 2014 : Debug: %t Thu Jul 3 11:55:48 2014 : Debug: Parsed xlat tree: Thu Jul 3 11:55:48 2014 : Debug: percent --> t Thu Jul 3 11:55:48 2014 : Debug: (216) auth_log : EXPAND %t Thu Jul 3 11:55:48 2014 : Debug: (216) auth_log : --> Thu Jul 3 11:55:48 2014 Thu Jul 3 11:55:48 2014 : Debug: (216) modsingle[authorize]: returned from auth_log (rlm_detail) for request 216 Thu Jul 3 11:55:48 2014 : Debug: (216) [auth_log] = ok Thu Jul 3 11:55:48 2014 : Debug: (216) modsingle[authorize]: calling suffix (rlm_realm) for request 216 Thu Jul 3 11:55:48 2014 : Debug: (216) suffix : Looking up realm "proxy.realm" for User-Name = "user(a)proxy.realm" Thu Jul 3 11:55:48 2014 : Debug: (216) suffix : Found realm "proxy.realm" Thu Jul 3 11:55:48 2014 : Debug: (216) suffix : Adding Realm = "proxy.realm" Thu Jul 3 11:55:48 2014 : Debug: (216) suffix : Proxying request from user user(a)proxy.realm to realm proxy.realm Thu Jul 3 11:55:48 2014 : Debug: (216) suffix : Preparing to proxy authentication request to realm "proxy.realm" Thu Jul 3 11:55:48 2014 : Debug: (216) modsingle[authorize]: returned from suffix (rlm_realm) for request 216 Thu Jul 3 11:55:48 2014 : Debug: (216) [suffix] = updated Thu Jul 3 11:55:48 2014 : Debug: (216) modsingle[authorize]: calling files (rlm_files) for request 216 Thu Jul 3 11:55:48 2014 : Debug: (216) modsingle[authorize]: returned from files (rlm_files) for request 216 Thu Jul 3 11:55:48 2014 : Debug: (216) [files] = noop Thu Jul 3 11:55:48 2014 : Debug: (216) modsingle[authorize]: calling perl (rlm_perl) for request 216 Thu Jul 3 11:55:48 2014 : Debug: (216) perl : <-- Proxy-To-Realm = proxy.realm Thu Jul 3 11:55:48 2014 : Debug: (216) perl : <-- Called-Station-Id = a.b.8.42 Thu Jul 3 11:55:48 2014 : Debug: (216) perl : <-- Calling-Station-Id = c.d.99.6 Thu Jul 3 11:55:48 2014 : Debug: (216) perl : <-- NAS-IP-Address = e.f.240.36 Thu Jul 3 11:55:48 2014 : Debug: (216) perl : <-- NAS-Port-Type = Virtual Thu Jul 3 11:55:48 2014 : Debug: (216) perl : <-- NAS-Port-Id = 16980 Thu Jul 3 11:55:48 2014 : Debug: (216) perl : <-- Service-Type = Authenticate-Only Thu Jul 3 11:55:48 2014 : Debug: (216) perl : <-- User-Name = user(a)proxy.realm Thu Jul 3 11:55:48 2014 : Debug: (216) perl : <-- User-Password = oozuL8poop Thu Jul 3 11:55:48 2014 : Debug: (216) perl : <-- Realm = proxy.realm Thu Jul 3 11:55:48 2014 : Debug: (216) perl : <-- Proxy-To-Realm = proxy.realm Thu Jul 3 11:55:48 2014 : Debug: (216) perl : --> NAS-Port-Type = Virtual Thu Jul 3 11:55:48 2014 : Debug: (216) perl : --> Service-Type = Authenticate-Only Thu Jul 3 11:55:48 2014 : Debug: (216) perl : --> Calling-Station-Id = c.d.99.6 Thu Jul 3 11:55:48 2014 : Debug: (216) perl : --> Called-Station-Id = a.b.8.42 Thu Jul 3 11:55:48 2014 : Debug: (216) perl : --> User-Name = user(a)proxy.realm Thu Jul 3 11:55:48 2014 : Debug: (216) perl : --> User-Password = oozuL8poop Thu Jul 3 11:55:48 2014 : Debug: (216) perl : --> Realm = proxy.realm Thu Jul 3 11:55:48 2014 : Debug: (216) perl : --> NAS-IP-Address = e.f.240.36 Thu Jul 3 11:55:48 2014 : Debug: (216) perl : --> NAS-Port-Id = 16980 Thu Jul 3 11:55:48 2014 : Debug: (216) perl : --> Proxy-To-Realm = proxy.realm Thu Jul 3 11:55:48 2014 : Debug: (216) modsingle[authorize]: returned from perl (rlm_perl) for request 216 Thu Jul 3 11:55:48 2014 : Debug: (216) [perl] = noop Thu Jul 3 11:55:48 2014 : Debug: (216) modsingle[authorize]: calling logintime (rlm_logintime) for request 216 Thu Jul 3 11:55:48 2014 : Debug: (216) modsingle[authorize]: returned from logintime (rlm_logintime) for request 216 Thu Jul 3 11:55:48 2014 : Debug: (216) [logintime] = noop Thu Jul 3 11:55:48 2014 : Debug: (216) modsingle[authorize]: calling pap (rlm_pap) for request 216 Thu Jul 3 11:55:48 2014 : Debug: (216) modsingle[authorize]: returned from pap (rlm_pap) for request 216 Thu Jul 3 11:55:48 2014 : Debug: (216) [pap] = noop Thu Jul 3 11:55:48 2014 : Debug: (216) modsingle[authorize]: calling chap (rlm_chap) for request 216 Thu Jul 3 11:55:48 2014 : Debug: (216) modsingle[authorize]: returned from chap (rlm_chap) for request 216 Thu Jul 3 11:55:48 2014 : Debug: (216) [chap] = noop Thu Jul 3 11:55:48 2014 : Debug: (216) } # authorize = updated Thu Jul 3 11:55:48 2014 : Debug: (216) # Executing section pre-proxy from file /etc/freeradius/radiusd.conf Thu Jul 3 11:55:48 2014 : Debug: (216) pre-proxy { Thu Jul 3 11:55:48 2014 : Debug: (216) modsingle[pre-proxy]: calling pre_proxy_log (rlm_detail) for request 216 Thu Jul 3 11:55:48 2014 : Debug: /var/log/freeradius/%Y/%Y-%m/%Y-%m-%d-pre_proxy_log Thu Jul 3 11:55:48 2014 : Debug: Parsed xlat tree: Thu Jul 3 11:55:48 2014 : Debug: literal --> /var/log/freeradius/ Thu Jul 3 11:55:48 2014 : Debug: percent --> Y Thu Jul 3 11:55:48 2014 : Debug: literal --> / Thu Jul 3 11:55:48 2014 : Debug: percent --> Y Thu Jul 3 11:55:48 2014 : Debug: literal --> - Thu Jul 3 11:55:48 2014 : Debug: percent --> m Thu Jul 3 11:55:48 2014 : Debug: literal --> / Thu Jul 3 11:55:48 2014 : Debug: percent --> Y Thu Jul 3 11:55:48 2014 : Debug: literal --> - Thu Jul 3 11:55:48 2014 : Debug: percent --> m Thu Jul 3 11:55:48 2014 : Debug: literal --> - Thu Jul 3 11:55:48 2014 : Debug: percent --> d Thu Jul 3 11:55:48 2014 : Debug: literal --> -pre_proxy_log Thu Jul 3 11:55:48 2014 : Debug: (216) pre_proxy_log : EXPAND /var/log/freeradius/%Y/%Y-%m/%Y-%m-%d-pre_proxy_log Thu Jul 3 11:55:48 2014 : Debug: (216) pre_proxy_log : --> /var/log/freeradius/2014/2014-07/2014-07-03-pre_proxy_log Thu Jul 3 11:55:48 2014 : Debug: (216) pre_proxy_log : /var/log/freeradius/%Y/%Y-%m/%Y-%m-%d-pre_proxy_log expands to /var/log/freeradius/2014/2014-07/2014-07-03-pre_proxy_log Thu Jul 3 11:55:48 2014 : Debug: %t Thu Jul 3 11:55:48 2014 : Debug: Parsed xlat tree: Thu Jul 3 11:55:48 2014 : Debug: percent --> t Thu Jul 3 11:55:48 2014 : Debug: (216) pre_proxy_log : EXPAND %t Thu Jul 3 11:55:48 2014 : Debug: (216) pre_proxy_log : --> Thu Jul 3 11:55:48 2014 Thu Jul 3 11:55:48 2014 : Debug: (216) modsingle[pre-proxy]: returned from pre_proxy_log (rlm_detail) for request 216 Thu Jul 3 11:55:48 2014 : Debug: (216) [pre_proxy_log] = ok Thu Jul 3 11:55:48 2014 : Debug: (216) modsingle[pre-proxy]: calling attr_filter.pre-proxy (rlm_attr_filter) for request 216 Thu Jul 3 11:55:48 2014 : Debug: %{Realm} Thu Jul 3 11:55:48 2014 : Debug: Parsed xlat tree: Thu Jul 3 11:55:48 2014 : Debug: attribute --> Realm Thu Jul 3 11:55:48 2014 : Debug: { Thu Jul 3 11:55:48 2014 : Debug: ref 2 Thu Jul 3 11:55:48 2014 : Debug: list 1 Thu Jul 3 11:55:48 2014 : Debug: tag -128 Thu Jul 3 11:55:48 2014 : Debug: } Thu Jul 3 11:55:48 2014 : Debug: (216) attr_filter.pre-proxy : EXPAND %{Realm} Thu Jul 3 11:55:48 2014 : Debug: (216) attr_filter.pre-proxy : --> proxy.realm Thu Jul 3 11:55:48 2014 : Debug: (216) attr_filter.pre-proxy : Matched entry DEFAULT at line 1 Thu Jul 3 11:55:48 2014 : Debug: (216) attr_filter.pre-proxy : NAS-Port-Type = Virtual allowed by NAS-Port-Type == Virtual Thu Jul 3 11:55:48 2014 : Debug: (216) attr_filter.pre-proxy : Attribute "NAS-Port-Type" allowed by 1 rules, disallowed by 0 rules Thu Jul 3 11:55:48 2014 : Debug: (216) attr_filter.pre-proxy : Service-Type = Authenticate-Only allowed by Service-Type == Authenticate-Only Thu Jul 3 11:55:48 2014 : Debug: (216) attr_filter.pre-proxy : Attribute "Service-Type" allowed by 1 rules, disallowed by 0 rules Thu Jul 3 11:55:48 2014 : Debug: (216) attr_filter.pre-proxy : Calling-Station-Id = 'c.d.99.6' allowed by Calling-Station-Id =* '' Thu Jul 3 11:55:48 2014 : Debug: (216) attr_filter.pre-proxy : Attribute "Calling-Station-Id" allowed by 1 rules, disallowed by 0 rules Thu Jul 3 11:55:48 2014 : Debug: (216) attr_filter.pre-proxy : Called-Station-Id = 'a.b.8.42' allowed by Called-Station-Id == 'a.b.8.42' Thu Jul 3 11:55:48 2014 : Debug: (216) attr_filter.pre-proxy : Attribute "Called-Station-Id" allowed by 1 rules, disallowed by 0 rules Thu Jul 3 11:55:48 2014 : Debug: (216) attr_filter.pre-proxy : User-Name = 'user(a)proxy.realm' allowed by User-Name =* '' Thu Jul 3 11:55:48 2014 : Debug: (216) attr_filter.pre-proxy : Attribute "User-Name" allowed by 1 rules, disallowed by 0 rules Thu Jul 3 11:55:48 2014 : Debug: (216) attr_filter.pre-proxy : User-Password = 'oozuL8poop' allowed by User-Password =* '' Thu Jul 3 11:55:48 2014 : Debug: (216) attr_filter.pre-proxy : Attribute "User-Password" allowed by 1 rules, disallowed by 0 rules Thu Jul 3 11:55:48 2014 : Debug: (216) attr_filter.pre-proxy : Attribute "Realm" allowed by 0 rules, disallowed by 0 rules Thu Jul 3 11:55:48 2014 : Debug: (216) attr_filter.pre-proxy : Attribute "NAS-IP-Address" allowed by 0 rules, disallowed by 0 rules Thu Jul 3 11:55:48 2014 : Debug: (216) attr_filter.pre-proxy : Attribute "NAS-Port-Id" allowed by 0 rules, disallowed by 0 rules Thu Jul 3 11:55:48 2014 : Debug: (216) attr_filter.pre-proxy : Attribute "Message-Authenticator" allowed by 0 rules, disallowed by 0 rules Thu Jul 3 11:55:48 2014 : Debug: (216) attr_filter.pre-proxy : Proxy-State = 0x3835 allowed by Proxy-State =* 0x Thu Jul 3 11:55:48 2014 : Debug: (216) attr_filter.pre-proxy : Attribute "Proxy-State" allowed by 1 rules, disallowed by 0 rules Thu Jul 3 11:55:48 2014 : Debug: (216) modsingle[pre-proxy]: returned from attr_filter.pre-proxy (rlm_attr_filter) for request 216 Thu Jul 3 11:55:48 2014 : Debug: (216) [attr_filter.pre-proxy] = updated Thu Jul 3 11:55:48 2014 : Debug: (216) } # pre-proxy = updated Thu Jul 3 11:55:48 2014 : Debug: (216) proxy: Trying to allocate ID (0/2) Thu Jul 3 11:55:48 2014 : Debug: (216) proxy: request is now in proxy hash Thu Jul 3 11:55:48 2014 : Debug: (216) proxy: allocating destination 127.0.0.1 port 18130 - Id 28 Thu Jul 3 11:55:48 2014 : Debug: (216) Proxying request to home server 127.0.0.1 port 18130 Sending Access-Request Id 28 from 0.0.0.0:5245 to 127.0.0.1:18130 Acct-Authentic := RADIUS Acct-Delay-Time := 0 NAS-IP-Address := 85.12.8.44 NAS-Port-Type = Virtual Service-Type = Authenticate-Only Calling-Station-Id = 'c.d.99.6' Called-Station-Id = 'a.b.8.42' User-Name = 'user(a)proxy.realm' User-Password = 'oozuL8poop' Proxy-State = 0x3835 Received Access-Accept Id 28 from 127.0.0.1:18130 to 127.0.0.1:5245 length 106 Configuration-Token = 'OK:100:15:V:26843545600' Reply-Message = 'Welcome to the ...' Service-Type = Authenticate-Only Proxy-State = 0x3835 Default-TTL = 19 Thu Jul 3 11:55:49 2014 : Debug: (216) proxy: request is no longer in proxy hash Thu Jul 3 11:55:49 2014 : Debug: (216) Found Auth-Type = Accept Thu Jul 3 11:55:49 2014 : Debug: (216) Auth-Type = Accept, accepting the user Thu Jul 3 11:55:49 2014 : Auth: (216) Login OK: [user(a)proxy.realm/oozuL8poop] (from client CLIENT port 0 cli c.d.99.6) Thu Jul 3 11:55:49 2014 : Debug: (216) # Executing section post-auth from file /etc/freeradius/radiusd.conf Thu Jul 3 11:55:49 2014 : Debug: (216) post-auth { Thu Jul 3 11:55:49 2014 : Debug: (216) modsingle[post-auth]: calling reply_log (rlm_detail) for request 216 Thu Jul 3 11:55:49 2014 : Debug: /var/log/freeradius/%Y/%Y-%m/%Y-%m-%d-reply_log Thu Jul 3 11:55:49 2014 : Debug: Parsed xlat tree: Thu Jul 3 11:55:49 2014 : Debug: literal --> /var/log/freeradius/ Thu Jul 3 11:55:49 2014 : Debug: percent --> Y Thu Jul 3 11:55:49 2014 : Debug: literal --> / Thu Jul 3 11:55:49 2014 : Debug: percent --> Y Thu Jul 3 11:55:49 2014 : Debug: literal --> - Thu Jul 3 11:55:49 2014 : Debug: percent --> m Thu Jul 3 11:55:49 2014 : Debug: literal --> / Thu Jul 3 11:55:49 2014 : Debug: percent --> Y Thu Jul 3 11:55:49 2014 : Debug: literal --> - Thu Jul 3 11:55:49 2014 : Debug: percent --> m Thu Jul 3 11:55:49 2014 : Debug: literal --> - Thu Jul 3 11:55:49 2014 : Debug: percent --> d Thu Jul 3 11:55:49 2014 : Debug: literal --> -reply_log Thu Jul 3 11:55:49 2014 : Debug: (216) reply_log : EXPAND /var/log/freeradius/%Y/%Y-%m/%Y-%m-%d-reply_log Thu Jul 3 11:55:49 2014 : Debug: (216) reply_log : --> /var/log/freeradius/2014/2014-07/2014-07-03-reply_log Thu Jul 3 11:55:49 2014 : Debug: (216) reply_log : /var/log/freeradius/%Y/%Y-%m/%Y-%m-%d-reply_log expands to /var/log/freeradius/2014/2014-07/2014-07-03-reply_log Thu Jul 3 11:55:49 2014 : Debug: %t Thu Jul 3 11:55:49 2014 : Debug: Parsed xlat tree: Thu Jul 3 11:55:49 2014 : Debug: percent --> t Thu Jul 3 11:55:49 2014 : Debug: (216) reply_log : EXPAND %t Thu Jul 3 11:55:49 2014 : Debug: (216) reply_log : --> Thu Jul 3 11:55:48 2014 Thu Jul 3 11:55:49 2014 : Debug: (216) modsingle[post-auth]: returned from reply_log (rlm_detail) for request 216 Thu Jul 3 11:55:49 2014 : Debug: (216) [reply_log] = ok Thu Jul 3 11:55:49 2014 : Debug: (216) } # post-auth = ok Sending Access-Accept Id 85 from e.f.136.224:1812 to e.f.240.36:22947 -- Regards, Chris Knipe

5 13

radutmp file not created
by Khapare Joshi 03 Jul '14

03 Jul '14

hi I am not able to do radwho since radutmp is not created, In Radius -X it tells me radutmp module is loaded and file should be /var/log/radius/radutmp Freeradius version is : freeradius-2.2.3-6.el6.x86_64 Module: Linked to module rlm_radutmp Module: Instantiating module "radutmp" from file /etc/raddb/modules/radutmp radutmp { filename = "/var/log/radius/radutmp" username = "%{User-Name}" case_sensitive = yes check_with_nas = yes perm = 384 callerid = yes } And, In /var/log/radius/radacct/192.168.1.1/auth-detail-20140430, NAS seem to sending request packet to the server Wed Apr 30 10:58:41 2014 Packet-Type = Access-Request EAP-Message = 0x020900061a03 FreeRADIUS-Proxied-To = 127.0.0.1 User-Name = "testuser(a)ba.com" State = 0x882dba688924a0df1b204ef3b696b63f Calling-Station-Id = "00215c5b8ef3" Called-Station-Id = "dca5f44de9c0:eduroam-tmp" NAS-Port = 1 Cisco-AVPair = "audit-session-id=82d0a5f700000e5a535fb9e9" NAS-IP-Address = 192.168.1.1 NAS-Identifier = "mywireless1" Airespace-Wlan-Id = 310 Service-Type = Framed-User Framed-MTU = 1300 NAS-Port-Type = Wireless-802.11 In /etc/raddb/sites-enabled/default accounting section radutmp is uncommented And, still radutmp file is not created in /var/log/radius directory. When I run the freeradius in debug mode (radiusd -X) and test authenticate user I get following: Listening on proxy address * port 1814 Ready to process requests. rad_recv: Access-Request packet from host 127.0.0.1 port 54636, id=127, length=139 User-Name = "testuser(a)ba.com" NAS-IP-Address = 192.168.1.1 NAS-Port = 0 Message-Authenticator = 0xee4209c0650849c1f6d60a5f94bf5a9b MS-CHAP-Challenge = 0x3feecd0086804485 MS-CHAP-Response = 0x000100000000000000000000000000000000000000000000000077ac654ce5135ab5f8690098e68c7e403bfcc24bb714d293 # Executing section authorize from file /etc/raddb/sites-enabled/default +group authorize { ++[preprocess] = ok ++[chap] = noop [mschap] Found MS-CHAP attributes. Setting 'Auth-Type = mschap' ++[mschap] = ok ++[digest] = noop [suffix] Looking up realm "ba.com" for User-Name = "testuser(a)ba.com" [suffix] Found realm "ba.com" [suffix] Adding Stripped-User-Name = "testuser" [suffix] Adding Realm = "ba.com" [suffix] Authentication realm is LOCAL. ++[suffix] = ok [eap] No EAP-Message, not doing EAP ++[eap] = noop [files] users: Matched entry DEFAULT at line 3 ++[files] = ok [ldap] performing user authorization for testuser [ldap] expand: %{Stripped-User-Name} -> testuser [ldap] expand: (uid=%{%{Stripped-User-Name}:-%{User-Name}}) -> (uid=testuser) [ldap] expand: ou=People,dc=BA,dc=com -> ou=People,dc=BA,dc=com [ldap] ldap_get_conn: Checking Id: 0 [ldap] ldap_get_conn: Got Id: 0 [ldap] attempting LDAP reconnection [ldap] (re)connect to ldap.ba.com:389, authentication 0 [ldap] bind as / to ldap.ba.com:389 [ldap] waiting for bind result ... [ldap] Bind was successful [ldap] performing search in ou=People,dc=BA,dc=com, with filter (uid=testuser) [ldap] looking for check items in directory... [ldap] looking for reply items in directory... WARNING: No "known good" password was found in LDAP. Are you sure that the user is configured correctly? [ldap] ldap_release_conn: Release Id: 0 ++[ldap] = ok ++[expiration] = noop ++[logintime] = noop [pap] WARNING! No "known good" password found for the user. Authentication may fail because of this. ++[pap] = noop +} # group authorize = ok Found Auth-Type = MSCHAP # Executing group from file /etc/raddb/sites-enabled/default +group MS-CHAP { [mschap] Client is using MS-CHAPv1 with NT-Password [mschap] expand: %{Stripped-User-Name} -> testuser [mschap] expand: --username=%{%{Stripped-User-Name}:-%{%{User-Name}:-None}} -> --username=testuser [mschap] mschap1: 3f [mschap] expand: %{mschap:Challenge} -> 3feecd0086804485 [mschap] expand: --challenge=%{%{mschap:Challenge}:-00} -> --challenge=3feecd0086804485 [mschap] expand: %{mschap:NT-Response} -> 77ac654ce5135ab5f8690098e68c7e403bfcc24bb714d293 [mschap] expand: --nt-response=%{%{mschap:NT-Response}:-00} -> --nt-response=77ac654ce5135ab5f8690098e68c7e403bfcc24bb714d293 Exec output: NT_KEY: 04066C8C6B0E8CFCABBB0AB6760971F7 Exec plaintext: NT_KEY: 04066C8C6B0E8CFCABBB0AB6760971F7 [mschap] Exec: program returned: 0 [mschap] adding MS-CHAPv1 MPPE keys ++[mschap] = ok +} # group MS-CHAP = ok # Executing section session from file /etc/raddb/sites-enabled/default +group session { [radutmp] expand: /var/log/radius/radutmp -> /var/log/radius/radutmp ++[radutmp] = ok So, even though it says radutmp = ok the file /var/log/radius/radutmp is not created. I must be doing something wrong or my configuration is not correct for radutmp. I appericiate some inputs. Thanks K

3 7

rlm_exec: "multi line" attributes
by Adam Bishop 03 Jul '14

03 Jul '14

Good Morning, I’ve been playing with rlm_exec a little, and have noticed that it doesn’t seem to handle multi line attributes nicely. In my case, there are multiple SAML-AAA-Assertions in a single response, however only the last line (</saml:Assertion>) is stuffed into an environment variable. Could this behaviour be changed (concatenation with '\n' as a separator perhaps?)? I had a quick look, but it isn’t immediately obvious to me what is causing the issue (also radius_start_program also touches mingw specific code :/). Regards, Adam Bishop gpg: 0x6609D460 Janet, the UK's research and education network. Janet(UK) is a trading name of Jisc Collections and Janet Limited, a not-for-profit company which is registered in England under No. 2881024 and whose Registered Office is at Lumen House, Library Avenue, Harwell Oxford, Didcot, Oxfordshire. OX11 0SG. VAT No. 614944238

3 6