September 2014 - Freeradius-Users - lists.freeradius.org

FreeRadius 3 deb packages upgrade
by Rui Ribeiro 08 Sep '14

08 Sep '14

Hi, Been using FreeRadius 3 deb compiled packages for a while here. At first I installed them locally and had no problem; however when doing the upgrade from a repository, the upgrades always overwrite my eap file in /etc/freeradius/mods-enabled with the original file. In the modules directory I am doing links to the files I have not modified, and I have the full files when modifying them. Is this intended behaviour or should I leave only links in mods-enabled and do full modifications in mods-available? (will also test this situation in my next upgrade) -- Regards, -- Rui Ribeiro Senior Sysadm ISCTE-IUL https://www.linkedin.com/pub/rui-ribeiro/16/ab8/434

3 2

How-To for setting up ldap for Active Directory
by Lord Felix 08 Sep '14

08 Sep '14

Hi Everyone, I'm new to freeRadius and I've been reading some of the mailing list e-mails. I've got freeRadius with Cento 6 which is version 2.1.12 installed. So I've followed the instructions for getting freeRadius working ntlm_auth with Windows 2012 Active Directory, based on the link below: http://deployingradius.com/documents/configuration/active_directory.html Everything works great! The only issue is now I need Dynamic Vlan working and I also need to look up mac address via from a mssql database to validate the user to allow access to the network. After reading more about ntlm_auth, it will only respond to true or false and this method doesn't really help with want I want to accomplish. What I need to do is based on what group the user belongs to, they are assigned to that specific vlan. i.e. if you are a staff you go to VLAN 7 and if you are a student you go to vlan 9. Is there any How-To guide for setting up ldap for Active Directory just like the link above? I've tried to setup the ldap module and I'm running into issues. This is how my ldap config looks like: ldap { server = "xxx.xxx.xxx" basedn = "dc=xxx,dc=xxx,dc=xxx" filter = (&(sAMAccountname=%{Stripped-User-Name:-%{User-Name}})(objectClass=person)) groupmembership_attribute = "Administrators" ldap_connections_number = 5 timeout = 40 timelimit = 30 net_timeout = 10 tls { start_tls = no } dictionary_mapping = ${confdir}/ldap.attrmap edir_account_policy_check = no groupname_attribute = cn groupmembership_filter = "(|(&(objectClass=GroupOfNames)(member=%{control:Ldap-UserDn}))(&(objectClass=GroupOfUniqueNames)(uniquemember=%{control:Ldap-UserDn})))" groupmembership_attribute = memberOf chase_referrals = yes rebind = yes ldap_debug = 0x0028 keepalive { idle = 60 probes = 3 interval = 3 } } Here is my debug info, and I know it's not working, because I don't even see it trying to contact the radius server, which is why I'm asking if there is quick HowTo: rad_recv: Access-Request packet from host 127.0.0.1 port 33583, id=125, length=74 User-Name = "xxxxxxx" User-Password = "xxxxxxx" NAS-IP-Address = xx.xx.xxxx NAS-Port = 0 Message-Authenticator = 0x1c451a3ee1cd4caabec9e764c4006d2b # Executing section authorize from file /etc/raddb/sites-enabled/default +- entering group authorize {...} ++[preprocess] returns ok ++[chap] returns noop ++[mschap] returns noop ++[digest] returns noop [suffix] No '@' in User-Name = "xxxxxx", looking up realm NULL [suffix] No such realm "NULL" ++[suffix] returns noop [eap] No EAP-Message, not doing EAP ++[eap] returns noop ++[files] returns noop [sql] expand: %{User-Name} -> xxxx [sql] sql_set_user escaped user --> 'xxxxxx' rlm_sql (sql): Reserving sql socket id: 3 [sql] expand: SELECT id,UserName,Attribute,Value,op FROM radcheck WHERE Username = '%{SQL-User-Name}' ORDER BY id -> SELECT id,UserName,Attribute,Value,op FROM radcheck WHERE Username = 'username' ORDER BY id [sql] expand: SELECT groupname FROM radusergroup WHERE username = '%{SQL-User-Name}' ORDER BY priority -> SELECT groupname FROM radusergroup WHERE username = 'xxxxxx' ORDER BY priority rlm_sql (sql): Released sql socket id: 3 [sql] User username not found ++[sql] returns notfound ++[expiration] returns noop ++[logintime] returns noop [pap] WARNING! No "known good" password found for the user. Authentication may fail because of this. ++[pap] returns noop ERROR: No authenticate method (Auth-Type) found for the request: Rejecting the user Failed to authenticate the user. Using Post-Auth-Type Reject # Executing group from file /etc/raddb/sites-enabled/default +- entering group REJECT {...} [attr_filter.access_reject] expand: %{User-Name} -> xxxxx attr_filter: Matched entry DEFAULT at line 11 ++[attr_filter.access_reject] returns updated Delaying reject of request 1 for 1 seconds Going to the next request Waking up in 0.9 seconds. Sending delayed reject for request 1 Sending Access-Reject of id 125 to 127.0.0.1 port 33583 Waking up in 4.9 seconds. Cleaning up request 1 ID 125 with timestamp +2007 Ready to process requests. Someone also posted that they can get ntlm_auth working with groups and you need to chat the stuff around? It would be great if someone can provide a how on this to work with dynamic vlan. Any help would be greatly appreciated. Thanks

2 1

d.iskandarov
by d.iskandarov 08 Sep '14

08 Sep '14

http://houtwormbestrijding-houtwormbestrijding.nl/oikluvdq/kzdzfglodp.khldtf

1 0

send parameter to radclient
by Mehdi Ravanbakhsh 08 Sep '14

08 Sep '14

Hi All I need to send about 22 attribute parameter to radclient but it is not working in this way : echo "Service-Type=Framed-User,Framed-Protocol=PPP,NAS-Port=11115644,NAS-Port-Type=Ethernet,User-Name=test1,Calling-Station-Id=D8:5D:4C:BC:C7:6B,NAS-Port-Id=ADSL-PARSIAN(906),Acct-Session-Id=81a57fe5,Framed-IP-Address=2.184.215.124,Acct-Session-Time =777,Acct-Input-Octets=999999,Acct-Input-Gigawords=0,Acct-Output-Octets=999,Acct-Output-Gigawords=0,Acct-Status-Type=Interim-Update,NAS-IP-Address=127.0.0.1" | radclient -x 127.0.0.1:1813 acct ''test'' I get this error : radclient:: Expected end of line or comma radclient: Nothing to send. I need to send parameter in file or something like that I can not find any document or sample . Any one can help me ? Best regards.

3 2

Brand new beginner need help!
by Frank Wei 07 Sep '14

07 Sep '14

Hi, I'm brand new to FreeRadius and just installed server 2.2.5. I have followed the wiki instruction (basic Configuration section) to do the simple test. The only thing I added is to add testing Cleartext-Password := "password" in the /raddb/users Here is the debug information I had when I run radtest testing password localhost 0 testing123 rad_recv: Access-Request packet from host 127.0.0.1 port 32775, id=195, length=77 User-Name = "testing" User-Password = "password" NAS-IP-Address = 127.0.0.1 NAS-Port = 10 Message-Authenticator = 0x024f3a845461e5597651150741f365fd # Executing section authorize from file /usr/local/etc/raddb/sites-enabled/default +group authorize { ++[preprocess] = ok ++[chap] = noop ++[mschap] = noop ++[digest] = noop [suffix] No '@' in User-Name = "testing", looking up realm NULL [suffix] No such realm "NULL" ++[suffix] = noop [eap] No EAP-Message, not doing EAP ++[eap] = noop ++[files] = noop ++[expiration] = noop ++[logintime] = noop [pap] WARNING! No "known good" password found for the user. Authentication may fail because of this. ++[pap] = noop +} # group authorize = ok ERROR: No authenticate method (Auth-Type) found for the request: Rejecting the user Failed to authenticate the user. Using Post-Auth-Type REJECT # Executing group from file /usr/local/etc/raddb/sites-enabled/default +group REJECT { [attr_filter.access_reject] expand: %{User-Name} -> testing attr_filter: Matched entry DEFAULT at line 11 ++[attr_filter.access_reject] = updated +} # group REJECT = updated Delaying reject of request 2 for 1 seconds Going to the next request Waking up in 0.9 seconds. Sending delayed reject for request 2 Sending Access-Reject of id 195 to 127.0.0.1 port 32775 Waking up in 4.9 seconds. Cleaning up request 2 ID 195 with timestamp +530 Could anybody help to me to explain why it was rejected? (it looks like a no "known good" password issue but I don't know why) Great thanks, 4RF Limited The information in this email communication (inclusive of attachments) is confidential to 4RF Limited and the intended recipient(s). If you are not the intended recipient(s), please note that any use, disclosure, distribution or copying of this information or any part thereof is strictly prohibited and that the author accepts no liability for the consequences of any action taken on the basis of the information provided. If you have received this email in error, please notify the sender immediately by return email and then delete all instances of this email from your system. 4RF Limited will not accept responsibility for any consequences associated with the use of this email (including, but not limited to, damages sustained as a result of any viruses and/or any action or lack of action taken in reliance on it).

1 0

For peap with ms-chapv2 are the MPPE keys derived from ms-chap or TLS material?
by mark.leese＠stfc.ac.uk 06 Sep '14

06 Sep '14

Hi, This is hopefully a simple question and so apologises if I'm being stupid :-) When using PEAP with an inner method of MS-CHAPv2, are the encryption keys (MS-MPPE-Recv-Key and MS-MPPE-Send-Key) derived from the MS-CHAP material or the TLS tunnel information? I always thought it was from the TLS tunnel, just like RFC3079 says it is when using EAP-TLS, but I could not find a definitive answer for PEAP. Thanks in advance, Mark. -- Scanned by iCritical.

2 1

Fwd: Failed Authentication user on EAP-SIM,
by Iman Rahmat 05 Sep '14

05 Sep '14

Dear All hello , i was installed freeradius-server 2.2.5 on ubuntu 10.04 The configuration was i done is : - i was installed Eap-Sim server and rlm_sim_files.so was in /usr/lib/freeradius - i was input sim { } on eap.conf in last before } closing. - i was make simtriplets.dat in /etc/freeradius with this : 1510011642151135,634B1828FE9F4cd987EE44A54D25DD80,0638e55f,15c22dc20A8ae000 1510011642151135,DD00F2D8D6FB4095B2BD8A2AE11FB600,02ed2e94,536655a061778400 1510011642151135,A852B0E55BC741f5A8C5B6ABF1E81504,F77daa16,71e9bd629Cee3000 - i was input in users file with this : 1510011642151135(a)wlan.mnc001.mcc510.3gppnetwork.org EAP-Type := SIM EAP-Sim-Rand1 = 0x634B1828FE9F4cd987EE44A54D25DD80, EAP-Sim-SRES1 = 0x0638e55f, EAP-Sim-KC1 = 0x15c22dc20A8ae000, EAP-Sim-Rand2 = 0xDD00F2D8D6FB4095B2BD8A2AE11FB600, EAP-Sim-SRES2 = 0x02ed2e94, EAP-Sim-KC2 = 0x536655a061778400, EAP-Sim-Rand2 = 0xA852B0E55BC741f5A8C5B6ABF1E81504, EAP-Sim-SRES2 = 0xF77daa16, EAP-Sim-KC2 = 0x71e9bd629Cee3000 - i was make sim files on /etc/freeradius/modules, with this : sim_files { simtriplets = "/etc/freeradius/simtriplets.dat" } - i was input sim_files @ /etc/freeradius/sites-enabled/default on authorized { } directly befor eap { ok=return } - i was input my ipp address network on clients.conf thank you for advanced, i really apreciate and respect your help :-)/ freeradius -X freeradius: FreeRADIUS Version 2.2.5, for host i486-pc-linux-gnu, built on Sep 2 2014 at 01:14:34 Copyright (C) 1999-2013 The FreeRADIUS server project and contributors. There is NO warranty; not even for MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. You may redistribute copies of FreeRADIUS under the terms of the GNU General Public License. For more information about these matters, see the file named COPYRIGHT. Starting - reading configuration files ... including configuration file /etc/freeradius/radiusd.conf including configuration file /etc/freeradius/proxy.conf including configuration file /etc/freeradius/clients.conf including files in directory /etc/freeradius/modules/ including configuration file /etc/freeradius/modules/opendirectory including configuration file /etc/freeradius/modules/sim_files including configuration file /etc/freeradius/modules/inner-eap including configuration file /etc/freeradius/modules/rediswho including configuration file /etc/freeradius/modules/detail.example.com including configuration file /etc/freeradius/modules/exec including configuration file /etc/freeradius/modules/wimax including configuration file /etc/freeradius/modules/echo including configuration file /etc/freeradius/modules/cui including configuration file /etc/freeradius/modules/passwd including configuration file /etc/freeradius/modules/logintime including configuration file /etc/freeradius/modules/detail.log including configuration file /etc/freeradius/modules/dynamic_clients including configuration file /etc/freeradius/modules/replicate including configuration file /etc/freeradius/modules/linelog including configuration file /etc/freeradius/modules/acct_unique including configuration file /etc/freeradius/modules/cache including configuration file /etc/freeradius/modules/unix including configuration file /etc/freeradius/modules/attr_rewrite including configuration file /etc/freeradius/modules/otp including configuration file /etc/freeradius/modules/expr including configuration file /etc/freeradius/modules/sradutmp including configuration file /etc/freeradius/modules/digest including configuration file /etc/freeradius/modules/krb5 including configuration file /etc/freeradius/modules/preprocess including configuration file /etc/freeradius/modules/smsotp including configuration file /etc/freeradius/modules/sqlcounter_expire_on_login including configuration file /etc/freeradius/modules/mac2vlan including configuration file /etc/freeradius/modules/counter including configuration file /etc/freeradius/modules/dhcp_sqlippool including configuration file /etc/freeradius/modules/etc_group including configuration file /etc/freeradius/modules/radrelay including configuration file /etc/freeradius/modules/chap including configuration file /etc/freeradius/modules/ldap including configuration file /etc/freeradius/modules/expiration including configuration file /etc/freeradius/modules/detail including configuration file /etc/freeradius/modules/pam including configuration file /etc/freeradius/modules/sql_log including configuration file /etc/freeradius/modules/realm including configuration file /etc/freeradius/modules/ntlm_auth including configuration file /etc/freeradius/modules/checkval including configuration file /etc/freeradius/modules/ippool including configuration file /etc/freeradius/modules/redis including configuration file /etc/freeradius/modules/policy including configuration file /etc/freeradius/modules/attr_filter including configuration file /etc/freeradius/modules/mschap including configuration file /etc/freeradius/modules/radutmp including configuration file /etc/freeradius/modules/smbpasswd including configuration file /etc/freeradius/modules/pap including configuration file /etc/freeradius/modules/files including configuration file /etc/freeradius/modules/mac2ip including configuration file /etc/freeradius/modules/soh including configuration file /etc/freeradius/modules/always including configuration file /etc/freeradius/modules/perl including configuration file /etc/freeradius/eap.conf including configuration file /etc/freeradius/policy.conf including files in directory /etc/freeradius/sites-enabled/ including configuration file /etc/freeradius/sites-enabled/inner-tunnel including configuration file /etc/freeradius/sites-enabled/default main { user = "freerad" group = "freerad" allow_core_dumps = no } including dictionary file /etc/freeradius/dictionary main { name = "freeradius" prefix = "/usr" localstatedir = "/var" sbindir = "/usr/sbin" logdir = "/var/log/freeradius" run_dir = "/var/run/freeradius" libdir = "/usr/lib/freeradius" radacctdir = "/var/log/freeradius/radacct" hostname_lookups = no max_request_time = 30 cleanup_delay = 5 max_requests = 1024 pidfile = "/var/run/freeradius/freeradius.pid" checkrad = "/usr/sbin/checkrad" debug_level = 0 proxy_requests = yes log { stripped_names = no auth = no auth_badpass = no auth_goodpass = no } security { max_attributes = 200 reject_delay = 1 status_server = yes allow_vulnerable_openssl = no } } radiusd: #### Loading Realms and Home Servers #### proxy server { retry_delay = 5 retry_count = 3 default_fallback = no dead_time = 120 wake_all_if_all_dead = no } home_server localhost { ipaddr = 127.0.0.1 port = 1812 type = "auth" secret = "testing123" response_window = 20 max_outstanding = 65536 require_message_authenticator = yes zombie_period = 40 status_check = "status-server" ping_interval = 30 check_interval = 30 num_answers_to_alive = 3 num_pings_to_alive = 3 revive_interval = 120 status_check_timeout = 4 coa { irt = 2 mrt = 16 mrc = 5 mrd = 30 } } home_server_pool my_auth_failover { type = fail-over home_server = localhost } realm example.com { auth_pool = my_auth_failover } realm LOCAL { } radiusd: #### Loading Clients #### client localhost { ipaddr = 127.0.0.1 require_message_authenticator = no secret = "testing123" nastype = "other" } client 111.111.111.0/24 { require_message_authenticator = no secret = "imanajadeh" shortname = "unifi" } radiusd: #### Instantiating modules #### instantiate { Module: Linked to module rlm_exec Module: Instantiating module "exec" from file /etc/freeradius/modules/exec exec { wait = no input_pairs = "request" shell_escape = yes timeout = 10 } Module: Linked to module rlm_expr Module: Instantiating module "expr" from file /etc/freeradius/modules/expr Module: Linked to module rlm_expiration Module: Instantiating module "expiration" from file /etc/freeradius/modules/expiration expiration { reply-message = "Password Has Expired " } Module: Linked to module rlm_logintime Module: Instantiating module "logintime" from file /etc/freeradius/modules/logintime logintime { reply-message = "You are calling outside your allowed timespan " minimum-timeout = 60 } } radiusd: #### Loading Virtual Servers #### server { # from file ��?�?2� modules { Module: Creating Auth-Type = digest Module: Creating Post-Auth-Type = REJECT Module: Checking authenticate {...} for more modules to load Module: Linked to module rlm_pap Module: Instantiating module "pap" from file /etc/freeradius/modules/pap pap { encryption_scheme = "auto" auto_header = no } Module: Linked to module rlm_chap Module: Instantiating module "chap" from file /etc/freeradius/modules/chap Module: Linked to module rlm_mschap Module: Instantiating module "mschap" from file /etc/freeradius/modules/mschap mschap { use_mppe = yes require_encryption = no require_strong = no with_ntdomain_hack = no allow_retry = yes } Module: Linked to module rlm_digest Module: Instantiating module "digest" from file /etc/freeradius/modules/digest Module: Linked to module rlm_unix Module: Instantiating module "unix" from file /etc/freeradius/modules/unix unix { radwtmp = "/var/log/freeradius/radwtmp" } Module: Linked to module rlm_eap Module: Instantiating module "eap" from file /etc/freeradius/eap.conf eap { default_eap_type = "md5" timer_expire = 60 ignore_unknown_eap_types = no cisco_accounting_username_bug = no max_sessions = 1024 } Module: Linked to sub-module rlm_eap_md5 Module: Instantiating eap-md5 Module: Linked to sub-module rlm_eap_leap Module: Instantiating eap-leap Module: Linked to sub-module rlm_eap_gtc Module: Instantiating eap-gtc gtc { challenge = "Password: " auth_type = "PAP" } Module: Linked to sub-module rlm_eap_tls Module: Instantiating eap-tls tls { rsa_key_exchange = no dh_key_exchange = yes rsa_key_length = 512 dh_key_length = 512 verify_depth = 0 CA_path = "/etc/freeradius/certs" pem_file_type = yes private_key_file = "/etc/freeradius/certs/server.key" certificate_file = "/etc/freeradius/certs/server.pem" CA_file = "/etc/freeradius/certs/ca.pem" private_key_password = "whatever" dh_file = "/etc/freeradius/certs/dh" fragment_size = 1024 include_length = yes check_crl = no cipher_list = "DEFAULT" make_cert_command = "/etc/freeradius/certs/bootstrap" ecdh_curve = "prime256v1" cache { enable = no lifetime = 24 max_entries = 255 } verify { } ocsp { enable = no override_cert_url = yes url = "http://127.0.0.1/ocsp/" use_nonce = yes timeout = 0 softfail = no } } Module: Linked to sub-module rlm_eap_ttls Module: Instantiating eap-ttls ttls { default_eap_type = "md5" copy_request_to_tunnel = no use_tunneled_reply = no virtual_server = "inner-tunnel" include_length = yes } Module: Linked to sub-module rlm_eap_peap Module: Instantiating eap-peap peap { default_eap_type = "mschapv2" copy_request_to_tunnel = no use_tunneled_reply = no proxy_tunneled_request_as_eap = yes virtual_server = "inner-tunnel" soh = no } Module: Linked to sub-module rlm_eap_mschapv2 Module: Instantiating eap-mschapv2 mschapv2 { with_ntdomain_hack = no send_error = no } Module: Linked to sub-module rlm_eap_sim Module: Instantiating eap-sim Module: Checking authorize {...} for more modules to load Module: Linked to module rlm_preprocess Module: Instantiating module "preprocess" from file /etc/freeradius/modules/preprocess preprocess { huntgroups = "/etc/freeradius/huntgroups" hints = "/etc/freeradius/hints" with_ascend_hack = no ascend_channels_per_line = 23 with_ntdomain_hack = no with_specialix_jetstream_hack = no with_cisco_vsa_hack = no with_alvarion_vsa_hack = no } reading pairlist file /etc/freeradius/huntgroups reading pairlist file /etc/freeradius/hints Module: Linked to module rlm_realm Module: Instantiating module "suffix" from file /etc/freeradius/modules/realm realm suffix { format = "suffix" delimiter = "@" ignore_default = no ignore_null = no } Module: Linked to module rlm_sim_files Module: Instantiating module "sim_files" from file /etc/freeradius/modules/sim_files sim_files { simtriplets = "/etc/freeradius/simtriplets.dat" } Module: Linked to module rlm_files Module: Instantiating module "files" from file /etc/freeradius/modules/files files { usersfile = "/etc/freeradius/users" acctusersfile = "/etc/freeradius/acct_users" preproxy_usersfile = "/etc/freeradius/preproxy_users" compat = "no" } reading pairlist file /etc/freeradius/users [/etc/freeradius/users]:208 WARNING! Check item "EAP-Sim-Rand1" found in reply item list for user "1510011642151135(a)wlan.mnc001.mcc510.3gppnetwork.org". This attribute MUST go on the first line with the other check items [/etc/freeradius/users]:208 WARNING! Check item "EAP-Sim-SRES1" found in reply item list for user "1510011642151135(a)wlan.mnc001.mcc510.3gppnetwork.org". This attribute MUST go on the first line with the other check items [/etc/freeradius/users]:208 WARNING! Check item "EAP-Sim-KC1" found in reply item list for user "1510011642151135(a)wlan.mnc001.mcc510.3gppnetwork.org". This attribute MUST go on the first line with the other check items [/etc/freeradius/users]:208 WARNING! Check item "EAP-Sim-Rand2" found in reply item list for user "1510011642151135(a)wlan.mnc001.mcc510.3gppnetwork.org". This attribute MUST go on the first line with the other check items [/etc/freeradius/users]:208 WARNING! Check item "EAP-Sim-SRES2" found in reply item list for user "1510011642151135(a)wlan.mnc001.mcc510.3gppnetwork.org". This attribute MUST go on the first line with the other check items [/etc/freeradius/users]:208 WARNING! Check item "EAP-Sim-KC2" found in reply item list for user "1510011642151135(a)wlan.mnc001.mcc510.3gppnetwork.org". This attribute MUST go on the first line with the other check items [/etc/freeradius/users]:208 WARNING! Check item "EAP-Sim-Rand3" found in reply item list for user "1510011642151135(a)wlan.mnc001.mcc510.3gppnetwork.org". This attribute MUST go on the first line with the other check items [/etc/freeradius/users]:208 WARNING! Check item "EAP-Sim-SRES3" found in reply item list for user "1510011642151135(a)wlan.mnc001.mcc510.3gppnetwork.org". This attribute MUST go on the first line with the other check items [/etc/freeradius/users]:208 WARNING! Check item "EAP-Sim-KC3" found in reply item list for user "1510011642151135(a)wlan.mnc001.mcc510.3gppnetwork.org". This attribute MUST go on the first line with the other check items reading pairlist file /etc/freeradius/acct_users reading pairlist file /etc/freeradius/preproxy_users Module: Checking preacct {...} for more modules to load Module: Linked to module rlm_acct_unique Module: Instantiating module "acct_unique" from file /etc/freeradius/modules/acct_unique acct_unique { key = "User-Name, Acct-Session-Id, NAS-IP-Address, NAS-Identifier, NAS-Port" } Module: Checking accounting {...} for more modules to load Module: Linked to module rlm_detail Module: Instantiating module "detail" from file /etc/freeradius/modules/detail detail { detailfile = "/var/log/freeradius/radacct/%{%{Packet-Src-IP-Address}:-%{Packet-Src-IPv6-Address}}/detail-%Y%m%d" header = "%t" detailperm = 384 dirperm = 493 locking = no log_packet_header = no } Module: Linked to module rlm_attr_filter Module: Instantiating module "attr_filter.accounting_response" from file /etc/freeradius/modules/attr_filter attr_filter attr_filter.accounting_response { attrsfile = "/etc/freeradius/attrs.accounting_response" key = "%{User-Name}" relaxed = no } reading pairlist file /etc/freeradius/attrs.accounting_response Module: Checking session {...} for more modules to load Module: Linked to module rlm_radutmp Module: Instantiating module "radutmp" from file /etc/freeradius/modules/radutmp radutmp { filename = "/var/log/freeradius/radutmp" username = "%{User-Name}" case_sensitive = yes check_with_nas = yes perm = 384 callerid = yes } Module: Checking post-proxy {...} for more modules to load Module: Checking post-auth {...} for more modules to load Module: Instantiating module "attr_filter.access_reject" from file /etc/freeradius/modules/attr_filter attr_filter attr_filter.access_reject { attrsfile = "/etc/freeradius/attrs.access_reject" key = "%{User-Name}" relaxed = no } reading pairlist file /etc/freeradius/attrs.access_reject } # modules } # server server inner-tunnel { # from file /etc/freeradius/sites-enabled/inner-tunnel modules { Module: Checking authenticate {...} for more modules to load Module: Checking authorize {...} for more modules to load Module: Checking session {...} for more modules to load Module: Checking post-proxy {...} for more modules to load Module: Checking post-auth {...} for more modules to load } # modules } # server radiusd: #### Opening IP addresses and Ports #### listen { type = "auth" ipaddr = * port = 0 } listen { type = "acct" ipaddr = * port = 0 } listen { type = "auth" ipaddr = 127.0.0.1 port = 18120 } ... adding new socket proxy address * port 46286 Listening on authentication address * port 1812 Listening on accounting address * port 1813 Listening on authentication address 127.0.0.1 port 18120 as server inner-tunnel Listening on proxy address * port 1814 Ready to process requests. authentication failed with this debug log : rad_recv: Access-Request packet from host 111.111.111.219 port 56787, id=148, length=232 User-Name = "1510011642151135(a)wlan.mnc000.mcc510.3gppnetwork.org" NAS-IP-Address = 111.111.111.219 NAS-Identifier = "dc9fdb9c7513" NAS-Port = 0 Called-Station-Id = "26-9F-DB-9D-75-13:SuperWiFi-SIM_A" Calling-Station-Id = "D4-97-0B-47-3F-10" Framed-MTU = 1400 NAS-Port-Type = Wireless-802.11 Connect-Info = "CONNECT 0Mbps 802.11b" EAP-Message = 0x02a300060312 State = 0xb03003e9b0930724bdcb3e1f451eecdb Message-Authenticator = 0xcebc5c917498be5780531a7fd0daead0 # Executing section authorize from file /etc/freeradius/sites-enabled/default +group authorize { ++[preprocess] = ok ++[chap] = noop ++[mschap] = noop ++[digest] = noop [suffix] Looking up realm "wlan.mnc000.mcc510.3gppnetwork.org" for User-Name = "1510011642151135(a)wlan.mnc000.mcc510.3gppnetwork.org" [suffix] No such realm "wlan.mnc000.mcc510.3gppnetwork.org" ++[suffix] = noop rlm_sim_files: insufficient number of challenges for imsi 1510011642151135(a)wlan.mnc000.mcc510.3gppnetwork.org: 0 ++[sim_files] = notfound [eap] EAP packet type response id 163 length 6 [eap] No EAP Start, assuming it's an on-going EAP conversation ++[eap] = updated ++[files] = noop ++[expiration] = noop ++[logintime] = noop [pap] WARNING! No "known good" password found for the user. Authentication may fail because of this. ++[pap] = noop +} # group authorize = updated Found Auth-Type = EAP # Executing group from file /etc/freeradius/sites-enabled/default +group authenticate { [eap] Request found, released from the list [eap] EAP NAK [eap] EAP-NAK asked for EAP-Type/sim [eap] processing type sim can not initiate sim, no RAND1 attribute [eap] Default EAP type sim failed in initiate [eap] Failed in EAP select ++[eap] = invalid +} # group authenticate = invalid Failed to authenticate the user. Using Post-Auth-Type REJECT # Executing group from file /etc/freeradius/sites-enabled/default +group REJECT { [attr_filter.access_reject] expand: %{User-Name} -> 1510011642151135(a)wlan.mnc000.mcc510.3gppnetwork.org attr_filter: Matched entry DEFAULT at line 11 ++[attr_filter.access_reject] = updated +} # group REJECT = updated Delaying reject of request 33 for 1 seconds Going to the next request Waking up in 0.5 seconds. Cleaning up request 30 ID 145 with timestamp +1518 Waking up in 0.4 seconds. Sending delayed reject for request 33 Sending Access-Reject of id 148 to 111.111.111.219 port 56787 EAP-Message = 0x04a30004 Message-Authenticator = 0x00000000000000000000000000000000 Waking up in 0.5 seconds. Cleaning up request 31 ID 146 with timestamp +1518 Waking up in 3.4 seconds. Cleaning up request 32 ID 147 with timestamp +1523 Waking up in 1.0 seconds. Cleaning up request 33 ID 148 with timestamp +1523 Ready to process requests. thank you before

1 0

Re: Virtual server can't set reply attributes
by Paul 05 Sep '14

05 Sep '14

Alan wrote: > That's wrong. Why are you using Cisco-AVPair twice? It should be: > Cisco-AVPair > += > "ip:inacl=ACL_VIRT_SECURE_IN" I just badly pasted. The SQL table is fine. > OK... and what does the debug log look like for 2.2.5? Are you using the same SQL tables? Or different ones? The same tables. 2.2.5 output: rad_recv: Access-Request packet from host 193.151.53.4 port 1645, id=59, length=121 Framed-Protocol = PPP User-Name = "test1" CHAP-Password = 0x0123554ba1746f7fd30486bd0bd46c39de Calling-Station-Id = "0024.c435.f7e4" NAS-Port-Type = Ethernet NAS-Port = 33554632 NAS-Port-Id = "0/0/2/200" Connect-Info = "POL_Vlan200_500M" Service-Type = Framed-User NAS-IP-Address = 193.151.53.4 # Executing section authorize from file /usr/local/etc/raddb/sites-enabled/srv_default +group authorize { ++[preprocess] = ok [suffix] No '@' in User-Name = "test1", looking up realm NULL [suffix] Found realm "NULL" [suffix] Adding Stripped-User-Name = "test1" [suffix] Adding Realm = "NULL" [suffix] Proxying request from user test1 to realm NULL [suffix] Preparing to proxy authentication request to realm "NULL" ++[suffix] = updated +} # group authorize = updated WARNING: Empty pre-proxy section. Using default return values. >>> Sending proxied request internally to virtual server. server srv_null { # Executing section authorize from file /usr/local/etc/raddb/sites-enabled/srv_null +group authorize { ++[preprocess] = ok [chap] Setting 'Auth-Type := CHAP' ++[chap] = ok [files] users: Matched entry DEFAULT at line 172 ++[files] = ok [sql] expand: %{Stripped-User-Name} -> test1 [sql] expand: %{%{Stripped-User-Name}:-%{%{User-Name}:-DEFAULT}} -> test1 [sql] sql_set_user escaped user --> 'test1' rlm_sql (sql): Reserving sql socket id: 26 [sql] expand: SELECT id, username, attribute, value, op FROM radcheck WHERE username = BINARY '%{SQL-User-Name}' ORDER BY id -> SELECT id, username, attribute, value, op FROM radcheck WHERE username = BINARY 'test1' ORDER BY id [sql] User found in radcheck table [sql] expand: SELECT id, username, attribute, value, op FROM radreply WHERE username = BINARY '%{SQL-User-Name}' ORDER BY id -> SELECT id, username, attribute, value, op FROM radreply WHERE username = BINARY 'test1' ORDER BY id [sql] expand: SELECT groupname FROM radusergroup WHERE username = BINARY '%{SQL-User-Name}' ORDER BY priority -> SELECT groupname FROM radusergroup WHERE username = BINARY 'test1' ORDER BY priority rlm_sql (sql): Released sql socket id: 26 ++[sql] = ok ++[expiration] = noop ++[logintime] = noop +} # group authorize = ok Found Auth-Type = CHAP # Executing group from file /usr/local/etc/raddb/sites-enabled/srv_null +group CHAP { [chap] login attempt by "test1" with CHAP password [chap] Using clear text password "test121" for user test1 authentication. [chap] chap user test1 authenticated succesfully ++[chap] = ok +} # group CHAP = ok WARNING: Empty post-auth section. Using default return values. } # server srv_null Going to the next request <<< Received proxied response code 2 from internal virtual server. WARNING: Empty post-proxy section. Using default return values. Found Auth-Type = Accept Auth-Type = Accept, accepting the user WARNING: Empty post-auth section. Using default return values. # Executing section post-auth from file /usr/local/etc/raddb/sites-enabled/srv_default WARNING: Empty post-auth section. Using default return values. # Executing section post-auth from file /usr/local/etc/raddb/sites-enabled/srv_default Sending Access-Accept of id 59 to 193.151.53.4 port 1645 Framed-Protocol = PPP Cisco-AVPair += "ip:inacl=ACL_VIRT_SECURE_IN" Finished request 5. Going to the next request Waking up in 4.9 seconds. -- Regards, Paul

2 2

Forwarding accounting Data to another radius Server for HA
by Daren Hendricks 05 Sep '14

05 Sep '14

Hi Everyone, We have 2 radius servers (v2.2.1) a primary and secondary. Currently both use same mysql database that lives on the primary server. For HA sake we would like to have the following setup. The primary server will read/write to it's radius DB and that will be replicated using mysql replication to the secondary server. The secondary server will then read/write to the replicated db and forward/proxy it's accounting data to the primary server. Does this sound like a feasible solution? Also, what can we use to forward the accounting data to the primary server, would robust-proxy-accounting be something worth looking into? Regards

6 12

is git working?
by Rui Ribeiro 05 Sep '14

05 Sep '14

Hi, Trying to use git since yesterday. At work and at home, in different machines I am having this error: git clone git://git.freeradius.org/freeradius-server.git Cloning into 'freeradius-server'... fatal: unable to connect to git.freeradius.org: git.freeradius.org[0: 195.154.231.44]: errno=Connection timed out Is it everything ok? Regards, Rui

4 3