September 2014 - Freeradius-Users - lists.freeradius.org

Re: freeradius sql groups not working
by James w 29 Sep '14

29 Sep '14

Here is the sql module being loaded: It shows the group queries so not sure why it doesn't process them # Loaded module rlm_sql # Instantiating module "sql" from file /etc/raddb/mods-enabled/sql sql { driver = "rlm_sql_mysql" server = "localhost" port = "3306" login = "radius" password = "123456" radius_db = "radius" read_groups = yes read_clients = yes delete_stale_sessions = yes sql_user_name = "%{User-Name}" default_user_profile = "" client_query = "SELECT id, nasname, shortname, type, secret, server FROM nas" authorize_check_query = "SELECT id, username, attribute, value, op FROM radcheck WHERE username = '%{SQL-User-Name}' ORDER BY id" authorize_reply_query = "SELECT id, username, attribute, value, op FROM radreply WHERE username = '%{SQL-User-Name}' ORDER BY id" authorize_group_check_query = "SELECT id, groupname, attribute, Value, op FROM radgroupcheck WHERE groupname = '%{Sql-Group}' ORDER BY id" authorize_group_reply_query = "SELECT id, groupname, attribute, value, op FROM radgroupreply WHERE groupname = '%{Sql-Group}' ORDER BY id" group_membership_query = "SELECT groupname FROM radusergroup WHERE username = '%{SQL-User-Name}' ORDER BY priority" simul_count_query = "" simul_verify_query = "SELECT radacctid, acctsessionid, username, nasipaddress, nasportid, framedipaddress, callingstationid, framedprotocol FROM radacct WHERE username = '%{SQL-User-Name}' AND acctstoptime IS NULL" safe_characters = "@abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ0123456789.-_: /" } accounting { reference = "%{tolower:type.%{Acct-Status-Type}.query}" } post-auth { reference = ".query" } mysql { tls { } }rlm_sql (sql): Driver rlm_sql_mysql (module rlm_sql_mysql) loaded and linkedrlm_sql (sql): Attempting to connect to database "radius"rlm_sql (sql): Initialising connection pool pool { start = 5 min = 4 max = 10 spare = 3 uses = 0 lifetime = 0 cleanup_delay = 5 idle_timeout = 60 spread = no }rlm_sql (sql): Opening additional connection (0)rlm_sql_mysql: Starting connect to MySQL serverrlm_sql (sql): Opening additional connection (1)rlm_sql_mysql: Starting connect to MySQL serverrlm_sql (sql): Opening additional connection (2)rlm_sql_mysql: Starting connect to MySQL serverrlm_sql (sql): Opening additional connection (3)rlm_sql_mysql: Starting connect to MySQL serverrlm_sql (sql): Opening additional connection (4)rlm_sql_mysql: Starting connect to MySQL serverrlm_sql (sql): Processing generate_sql_clientsrlm_sql (sql) in generate_sql_clients: query is SELECT id, nasname, shortname, type, secret, server FROM nasrlm_sql (sql): Reserved connection (4)rlm_sql (sql): Executing query: 'SELECT id, nasname, shortname, type, secret, server FROM nas'rlm_sql (sql): Released connection (4) } # modulesradiusd: #### Loading Virtual Servers ####server { # from file /etc/raddb/radiusd.conf} # serverserver default { # from file /etc/raddb/sites-enabled/default # Creating Auth-Type = digest # Loading authenticate {...} # Loading authorize {...} # Loading virtual module filter_usernameWARNING: Ignoring "ldap" (see raddb/mods-available/README.rst) # Loading preacct {...} # Loading virtual module acct_unique # Loading accounting {...} # Loading post-proxy {...} # Loading post-auth {...} # Loading virtual module remove_reply_message_if_eap # Loading virtual module remove_reply_message_if_eap} # server defaultserver inner-tunnel { # from file /etc/raddb/sites-enabled/inner-tunnel # Loading authenticate {...} # Loading authorize {...}WARNING: Ignoring "ldap" (see raddb/mods-available/README.rst) # Loading session {...} # Loading post-proxy {...} # Loading post-auth {...}} # server inner-tunnelradiusd: #### Opening IP addresses and Ports ####listen { type = "auth" ipaddr = * port = 0 limit { max_connections = 16 lifetime = 0 idle_timeout = 30 }}listen { type = "acct" ipaddr = * port = 0 limit { max_connections = 16 lifetime = 0 idle_timeout = 30 }}listen { type = "auth" ipaddr = 127.0.0.1 port = 18120}Listening on auth address * port 1812 as server defaultListening on acct address * port 1813 as server defaultListening on auth address 127.0.0.1 port 18120 as server inner-tunnelOpening new proxy address * port 1814Listening on proxy address * port 1814Ready to process requests. > From: freeradius-users-request(a)lists.freeradius.org > Subject: Freeradius-Users Digest, Vol 113, Issue 129 > To: freeradius-users(a)lists.freeradius.org > Date: Mon, 29 Sep 2014 09:29:30 +0200 > > Send Freeradius-Users mailing list submissions to > freeradius-users(a)lists.freeradius.org > > To subscribe or unsubscribe via the World Wide Web, visit > http://lists.freeradius.org/mailman/listinfo/freeradius-users > or, via email, send a message with subject or body 'help' to > freeradius-users-request(a)lists.freeradius.org > > You can reach the person managing the list at > freeradius-users-owner(a)lists.freeradius.org > > When replying, please edit your Subject line so it is more specific > than "Re: Contents of Freeradius-Users digest..." > > > Today's Topics: > > 1. RE: Beginner need help (unrecognized clients) (Frank Wei) > 2. Re: freeradius sql groups not working (James w) > > > ---------------------------------------------------------------------- > > Message: 1 > Date: Mon, 29 Sep 2014 05:09:58 +0000 > From: Frank Wei <Frank.Wei(a)4rf.com> > To: FreeRadius users mailing list > <freeradius-users(a)lists.freeradius.org> > Subject: RE: Beginner need help (unrecognized clients) > Message-ID: > <36A567FFA4FB734C89ABF498A70F83AE9615B3BA(a)4rf-nz-orion.local.4rf.com> > Content-Type: text/plain; charset="us-ascii" > > Dear friends, > > I have added clients > > client private-network-1 { > ipaddr = 192.168.0.244 > netmask = 24 > secret = testing123-1 > shortname = private-network-1 > } > > To the clients.conf. > > And run command "radius -X". From the debug message I can see the added client loaded. > > Then from my NAS (with IP 192.168.0.244) I sent a "authentication only" request to the server. The server showed me a message: > > Ignored,.....Unrecognized client "192.168.0.244" port "1222". > > What is wrong with my config? > > Regards, > Frank > > > -----Original Message----- > From: freeradius-users-bounces+frank.wei=4rf.com(a)lists.freeradius.org [mailto:freeradius-users-bounces+frank.wei=4rf.com@lists.freeradius.org] On Behalf Of A.L.M.Buxey(a)lboro.ac.uk > Sent: Thursday, 25 September 2014 6:49 p.m. > To: FreeRadius users mailing list > Subject: Re: Beginner need help > > Hi, > > > My understanding is that source IP address of the Access-Request packets must be the NAS IP address which is "NAS-IP-Address". Apparently this is different to the Attribute description. > > > > Could anybody explain? > > sure. > > the NAS-IP-Address is set by the NAS - so it SHOULD be its IP address in a nice world. okay > thats clear....however, the packet might be reaching your RADIUS server via some other > route - lets say, eg a NAT gateway, a RADIUS server (it has been proxied) or from some > central controller (thinking of some of the WiFi solutions out there) - in which case > the NAS-IP-Address is NOT the source IP address of the packet. > > > the NAS-IP-Address is also part of the RADIUS datagram - so you've already started to > analyse the packet contents really before you can - eg how did you ensure the packet > contents were correct, verify the message authenticator or ensured the content values > by using the shared secret? you didnt. > > the RADIUS datagram comes in. you see the source address of the packet. look up the client, > get its shared secret, work on the packet. > > alan > - > List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html > The information in this email communication (inclusive of attachments) is confidential to 4RF Limited and the intended recipient(s). If you are not the intended recipient(s), please note that any use, disclosure, distribution or copying of this information or any part thereof is strictly prohibited and that the author accepts no liability for the consequences of any action taken on the basis of the information provided. If you have received this email in error, please notify the sender immediately by return email and then delete all instances of this email from your system. 4RF Limited will not accept responsibility for any consequences associated with the use of this email (including, but not limited to, damages sustained as a result of any viruses and/or any action or lack of action taken in reliance on it). > > > ------------------------------ > > Message: 2 > Date: Mon, 29 Sep 2014 07:29:26 +0000 > From: James w <spyda46(a)hotmail.com> > To: "freeradius-users(a)lists.freeradius.org" > <freeradius-users(a)lists.freeradius.org> > Subject: Re: freeradius sql groups not working > Message-ID: <DUB123-W2A21F9FBF92014A289545B2BA0(a)phx.gbl> > Content-Type: text/plain; charset="iso-8859-1" > > Does anybody have any suggestions, could this be a bug ? Shall i try another version, its running on RHEL 7 Free radius version 3.0.1 > > > From: freeradius-users-request(a)lists.freeradius.org > > Subject: Freeradius-Users Digest, Vol 113, Issue 128 > > To: freeradius-users(a)lists.freeradius.org > > Date: Mon, 29 Sep 2014 04:06:31 +0200 > > > > Send Freeradius-Users mailing list submissions to > > freeradius-users(a)lists.freeradius.org > > > > To subscribe or unsubscribe via the World Wide Web, visit > > http://lists.freeradius.org/mailman/listinfo/freeradius-users > > or, via email, send a message with subject or body 'help' to > > freeradius-users-request(a)lists.freeradius.org > > > > You can reach the person managing the list at > > freeradius-users-owner(a)lists.freeradius.org > > > > When replying, please edit your Subject line so it is more specific > > than "Re: Contents of Freeradius-Users digest..." > > > > > > Today's Topics: > > > > 1. Re: How to send disconnect message to the NAS? (Alan DeKok) > > 2. Re: EAP and rlm_perl. Is it possible to build custom logic > > for VPN peers? (Oleksandr Yermolenko) > > 3. Re: EAP and rlm_perl. Is it possible to build custom logic > > for VPN peers? (Oleksandr Yermolenko) > > 4. version 2.2.5 repo (Rando Nakarmi) > > 5. Re: version 2.2.5 repo (Alan DeKok) > > 6. Re: EAP and rlm_perl. Is it possible to build custom logic > > for VPN peers? (Alan DeKok) > > 7. Re: Problem in Module Statistics in freeradius (Himanshu Pandey) > > > > > > ---------------------------------------------------------------------- > > > > Message: 1 > > Date: Sun, 28 Sep 2014 11:08:16 -0400 > > From: Alan DeKok <aland(a)deployingradius.com> > > To: FreeRadius users mailing list > > <freeradius-users(a)lists.freeradius.org> > > Subject: Re: How to send disconnect message to the NAS? > > Message-ID: <54282460.1090603(a)deployingradius.com> > > Content-Type: text/plain; charset=ISO-8859-1 > > > > Xin wrote: > > > Thanks a lot for your reply, I have understood I can use update control > > > section to control send or not. And one more question, what is the virtual > > > server in home_server_pool section. Just find the server > > > originate-coa.example.com section? > > > > The behavior is documented in that file. > > > > > If this is right, can you tell me the > > > usage of pre-proxy section? I have already understand the purpose of the > > > post-proxy is to handle the COA/DM response. > > > > Read the file. This is documented. > > > > Alan DeKok. > > > > > > ------------------------------ > > > > Message: 2 > > Date: Sun, 28 Sep 2014 18:52:59 +0300 > > From: Oleksandr Yermolenko <aae(a)sumix.com> > > To: Alan DeKok <aland(a)deployingradius.com> > > Subject: Re: EAP and rlm_perl. Is it possible to build custom logic > > for VPN peers? > > Message-ID: <54282EDB.20904(a)sumix.com> > > Content-Type: text/plain; charset=utf-8; format=flowed > > > > > > >> Is it possible to use any of EAP methods (I mean EAP-PEAP, EAP-TTLS or > > >> EAP-TLS ...) with rlm_perl. > > > What does that mean? > > can I use authenticate, authorize, accounting hooks (or post_auth)? > > I looked at example.pl. > > > > Just put "perl" in somewhere eap.conf file? > > > > > > > > You can run the perl module when the server receives a packet. It > > > doesn't matter whether the packet contains PAP, CHAP, MS-CHAP, or any > > > EAP type. > > > > > > What do you want to *do* in rlm_perl? Knowing that probably more > > > useful, and will get you a better answer. > > authenticate a lot of VPN clients (currently I can choose EAP method), > > keeping them in mysql or ldap. According their properties give a > > personal access to > > different local resources. Accounting: updating start/stop/alive > > messages. POD if it's possible > > for strongswan. > > > > > > Alan DeKok. > > > > > > > > ------------------------------ > > > > Message: 3 > > Date: Sun, 28 Sep 2014 18:52:59 +0300 > > From: Oleksandr Yermolenko <aae(a)sumix.com> > > To: Alan DeKok <aland(a)deployingradius.com> > > Subject: Re: EAP and rlm_perl. Is it possible to build custom logic > > for VPN peers? > > Message-ID: <54282EDB.20904(a)sumix.com> > > Content-Type: text/plain; charset=utf-8; format=flowed > > > > > > >> Is it possible to use any of EAP methods (I mean EAP-PEAP, EAP-TTLS or > > >> EAP-TLS ...) with rlm_perl. > > > What does that mean? > > can I use authenticate, authorize, accounting hooks (or post_auth)? > > I looked at example.pl. > > > > Just put "perl" in somewhere eap.conf file? > > > > > > > > You can run the perl module when the server receives a packet. It > > > doesn't matter whether the packet contains PAP, CHAP, MS-CHAP, or any > > > EAP type. > > > > > > What do you want to *do* in rlm_perl? Knowing that probably more > > > useful, and will get you a better answer. > > authenticate a lot of VPN clients (currently I can choose EAP method), > > keeping them in mysql or ldap. According their properties give a > > personal access to > > different local resources. Accounting: updating start/stop/alive > > messages. POD if it's possible > > for strongswan. > > > > > > Alan DeKok. > > > > > > > > ------------------------------ > > > > Message: 4 > > Date: Sun, 28 Sep 2014 19:14:18 +0000 > > From: Rando Nakarmi <randonakarmi(a)gmail.com> > > To: FreeRadius users mailing list > > <freeradius-users(a)lists.freeradius.org> > > Subject: version 2.2.5 repo > > Message-ID: > > <CAG+85v_XJ_v8cJGu-tMqi+eWNSsnME=7mZcv5yqAhB6d9K+_KA(a)mail.gmail.com> > > Content-Type: text/plain; charset="utf-8" > > > > HI, > > > > I see both in RHEL and epel , the freeradius version 2.1.12-4 is available > > but not the 2.2.5 which is the newest version on 2.x.x series. > > > > I am used to do yum, where can I get version 2.2.5 in yum repo for RHEL > > base linux. > > > > R > >

1 0

Re: Problem in Module Statistics in freeradius
by Himanshu Pandey 29 Sep '14

29 Sep '14

DONE. From: Alan DeKok <aland(a)deployingradius.com> Sent: Sun, 28 Sep 2014 19:25:18 To: FreeRadius users mailing list <freeradius-users(a)lists.freeradius.org> Subject: Re: Problem in Module Statistics in freeradius Himanshu Pandey wrote: > I added the following code in modcall.c under the function > modcall_recurse():  This list is for *using* FreeRADIUS.  It's not for learning how to program.  You're making beginners errors in the code.  Don't do that.  Alan DeKok. - List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html

1 0

EAP and rlm_perl. Is it possible to build custom logic for VPN peers?
by Oleksandr Yermolenko 28 Sep '14

28 Sep '14

Hello, Started a new project and trying to make solution, I can't find the answer on the following: Is it possible to use any of EAP methods (I mean EAP-PEAP, EAP-TTLS or EAP-TLS ...) with rlm_perl. Thanks a lot for your time and any advices. Alex. // <http://wiki.freeradius.org/modules/Rlm_perl>

2 3

How to send disconnect message to the NAS?
by Xin 28 Sep '14

28 Sep '14

Hi, I want to send disconnect message to the user who has exceeded the limited traffic. I have done the following steps: 1. Create a sqlCounter: sqlcounter monthlytrafficcounter { counter-name = Monthly-Traffic check-name = Max-Monthly-Traffic reply-name = Monthly-Traffic-Limit sqlmod-inst = sql key = User-Name reset = monthly query = "SELECT SUM(acctinputoctets + acctoutputoctets) FROM radacct WHERE U serName='%{%k}' AND UNIX_TIMESTAMP(AcctStartTime) > '%b'" } 2. add the monthlytrafficcounter to "sites-enabled/default" authorize section. 3. It worked when user login to NAS(NAS reject the user's request), but failed when the user connection connected. The Accounting request like following below: ================================================================ rad_recv: Accounting-Request packet from host NAS-IP port 48378, id=188 , length=175 Acct-Status-Type = Interim-Update Acct-Session-Id = "1411720910-19" NAS-Port-Type = Virtual Service-Type = Framed-User NAS-Port = 19 NAS-Port-Id = "radius" NAS-IP-Address = NAS-IP Called-Station-Id = "NAS-IP[4500]" Calling-Station-Id = "User-IP[5476]" User-Name = "kirito" Framed-IP-Address = 10.0.0.1 Acct-Output-Octets = 549938 Acct-Output-Packets = 602 Acct-Input-Octets = 77110 Acct-Input-Packets = 785 Acct-Session-Time = 122 NAS-Identifier = "strongSwan" # Executing section preacct from file /usr/local/etc/raddb/sites-enabled/default +group preacct { ++[preprocess] = ok [acct_unique] Hashing 'NAS-Port = 19,NAS-Identifier = "strongSwan",NAS-IP-Addres s = NAS-IP,Acct-Session-Id = "1411720910-19",User-Name = "kirito"' [acct_unique] Acct-Unique-Session-ID = "afe2593237df22fa". ++[acct_unique] = ok [suffix] No '@' in User-Name = "kirito", looking up realm NULL [suffix] No such realm "NULL" ++[suffix] = noop +} # group preacct = ok # Executing section accounting from file /usr/local/etc/raddb/sites-enabled/defa ult +group accounting { [detail] expand: %{Packet-Src-IP-Address} -> NAS-IP [detail] expand: /usr/local/var/log/radius/radacct/%{%{Packet-Src-IP-Addr ess}:-%{Packet-Src-IPv6-Address}}/detail-%Y%m%d -> /usr/local/var/log/radius/rad acct/NAS-IP/detail-20140926 [detail] /usr/local/var/log/radius/radacct/%{%{Packet-Src-IP-Address}:-%{Packet- Src-IPv6-Address}}/detail-%Y%m%d expands to /usr/local/var/log/radius/radacct/11 6.251.216.197/detail-20140926 [detail] expand: %t -> Fri Sep 26 21:19:07 2014 ++[detail] = ok [sql] expand: %{Stripped-User-Name} -> [sql] ... expanding second conditional [sql] expand: %{User-Name} -> kirito [sql] expand: %{%{User-Name}:-DEFAULT} -> kirito [sql] expand: %{%{Stripped-User-Name}:-%{%{User-Name}:-DEFAULT}} -> kirito [sql] sql_set_user escaped user --> 'kirito' [sql] expand: %{Acct-Input-Gigawords} -> [sql] ... expanding second conditional [sql] expand: %{Acct-Input-Octets} -> 77110 [sql] expand: %{Acct-Output-Gigawords} -> [sql] ... expanding second conditional [sql] expand: %{Acct-Output-Octets} -> 549938 [sql] expand: UPDATE radacct SET framedipadd ress = '%{Framed-IP-Address}', acctsessiontime = '%{Acct-Sessio n-Time}', acctinputoctets = '%{%{Acct-Input-Gigawords}:-0}' << 32 | '%{%{Acct-Input-Octets}:-0}', acctoutputoctets = '%{%{Acct-Output-Gigawords}:-0}' << 32 | '%{%{Acct-Output-Octets}:-0}' WHERE acctsessioni d = '%{Acct-Session-Id}' AND username = '%{SQL-User-Name}' AND nasipaddress = '%{NAS-IP-Address}' -> UPDATE radacct SET framedipaddress = '10.0.0.1', acctsessionti me = '122', acctinputoctets = '0' << 32 | '77110', acctoutputoctets = '0' << 32 | '549938' WHERE acctsessionid = '14117209 10-19' AND username = 'kirito' AND na rlm_sql (sql): Reserving sql socket id: 12 rlm_sql (sql): Released sql socket id: 12 ++[sql] = ok ++[exec] = noop [attr_filter.accounting_response] expand: %{User-Name} -> kirito attr_filter: Matched entry DEFAULT at line 12 ++[attr_filter.accounting_response] = updated +} # group accounting = updated Sending Accounting-Response of id 188 to NAS-IP port 48378 Finished request 6. Cleaning up request 6 ID 188 with timestamp +157 Going to the next request Ready to process requests. ================================================================= I think it may have a way to send the Disconnect Message to NAS when FreeRadius server get the Accounting-Request message. But I don't know how do I do. Appreciate for your response.

3 10

Problem in Module Statistics in freeradius
by Himanshu Pandey 28 Sep '14

28 Sep '14

Dear Alan, I added the following code in modcall.c under the function modcall_recurse(): rlm_rcode_t result; module_t module; int i; result = call_modsingle(c->method, sp, request); module.rtcode[result] = module.rtcode[result] + 1; /*Used printf to view the array elements*/ for (i = 0; i < RLM_MODULE_NUMCODES; i++) { printf("\nRTCODE[%d]=%ld\n",i,module.rtcode[i]); } In module_t structure I added my unsigned long array: uint64_t rtcode[RLM_MODULE_NUMCODES]; //Used for module return codes But I am getting junk values in array at times and I don't know where exactly shall I do memset(module.rtcode,0,sizeof(module.rtcode)); Please help to resolve this. Following debug log is generated when I run radiusd -X. Starting - reading configuration files ... including dictionary file /opt/freeradius/share/freeradius/dictionary including dictionary file /opt/freeradius/share/freeradius/dictionary.dhcp including dictionary file /opt/freeradius/share/freeradius/dictionary.vqp including dictionary file /opt/freeradius/etc/raddb/dictionary including configuration file /opt/freeradius/etc/raddb/radiusd.conf including configuration file /opt/freeradius/etc/raddb/proxy.conf including configuration file /opt/freeradius/etc/raddb/clients.conf including files in directory /opt/freeradius/etc/raddb/mods-enabled/ including configuration file /opt/freeradius/etc/raddb/mods-enabled/always including configuration file /opt/freeradius/etc/raddb/mods-enabled/logintime including configuration file /opt/freeradius/etc/raddb/mods-enabled/digest including configuration file /opt/freeradius/etc/raddb/mods-enabled/cache_eap including configuration file /opt/freeradius/etc/raddb/mods-enabled/exec including configuration file /opt/freeradius/etc/raddb/mods-enabled/dynamic_clients including configuration file /opt/freeradius/etc/raddb/mods-enabled/files including configuration file /opt/freeradius/etc/raddb/mods-enabled/passwd including configuration file /opt/freeradius/etc/raddb/mods-enabled/replicate including configuration file /opt/freeradius/etc/raddb/mods-enabled/pap including configuration file /opt/freeradius/etc/raddb/mods-enabled/realm including configuration file /opt/freeradius/etc/raddb/mods-enabled/attr_filter including configuration file /opt/freeradius/etc/raddb/mods-enabled/ntlm_auth including configuration file /opt/freeradius/etc/raddb/mods-enabled/detail including configuration file /opt/freeradius/etc/raddb/mods-enabled/dhcp including configuration file /opt/freeradius/etc/raddb/mods-enabled/utf8 including configuration file /opt/freeradius/etc/raddb/mods-enabled/chap including configuration file /opt/freeradius/etc/raddb/mods-enabled/unpack including configuration file /opt/freeradius/etc/raddb/mods-enabled/sradutmp including configuration file /opt/freeradius/etc/raddb/mods-enabled/mschap including configuration file /opt/freeradius/etc/raddb/mods-enabled/expiration including configuration file /opt/freeradius/etc/raddb/mods-enabled/eap including configuration file /opt/freeradius/etc/raddb/mods-enabled/unix including configuration file /opt/freeradius/etc/raddb/mods-enabled/expr including configuration file /opt/freeradius/etc/raddb/mods-enabled/radutmp including configuration file /opt/freeradius/etc/raddb/mods-enabled/soh including configuration file /opt/freeradius/etc/raddb/mods-enabled/linelog including configuration file /opt/freeradius/etc/raddb/mods-enabled/detail.log including configuration file /opt/freeradius/etc/raddb/mods-enabled/preprocess including configuration file /opt/freeradius/etc/raddb/mods-enabled/echo including files in directory /opt/freeradius/etc/raddb/policy.d/ including configuration file /opt/freeradius/etc/raddb/policy.d/operator-name including configuration file /opt/freeradius/etc/raddb/policy.d/canonicalization including configuration file /opt/freeradius/etc/raddb/policy.d/dhcp including configuration file /opt/freeradius/etc/raddb/policy.d/debug including configuration file /opt/freeradius/etc/raddb/policy.d/eap including configuration file /opt/freeradius/etc/raddb/policy.d/cui including configuration file

2 1

freeradius sql groups not working
by James w 28 Sep '14

28 Sep '14

Hi, I am having some trouble with freeradius and the SQL module. The issue i have is the radgroupcheck and radgroupreply tables never get read by freeradius. I cannot find a reason why the group tables aren't being used, they meet the requirements according the the wiki. Specifically my Pool-Name is not being pulled and assigned to the user from the groupcheck. If i set the pool name in radcheck and not radgroupcheck it works and the user is assigned an IP from the pool. In the sql.conf i have checked "read_groups = yes" is set The sqlippool and sql modules are enabled in the default sites setup hence it works when set in radcheck. This problem is because the groups are not being read. I would really like some help as to why my groups aren't working Here is my config and a debug out of radiusd -X MariaDB [radius]> select * from radcheck;+----+----------+--------------------+----+-------+| id | username | attribute | op | value |+----+----------+--------------------+----+-------+| 1 | user | Cleartext-Password | := | pass |+----+----------+--------------------+----+-------+4 rows in set (0.00 sec) MariaDB [radius]> select * from radusergroup;+----------+-----------+----------+| username | groupname | priority |+----------+-----------+----------+| user | vpngroup | 1 |+----------+-----------+----------+1 row in set (0.00 sec) MariaDB [radius]> select * from radgroupcheck;+----+-----------+--------------+----+-------+| id | groupname | attribute | op | value |+----+-----------+--------------+----+-------+| 3 | vpngroup | Pool-Name | := | pool1 |+----+-----------+--------------+----+-------+2 rows in set (0.01 sec) MariaDB [radius]> select * from radippool;+----+-----------+-----------------+--------------+-----------------+------------------+---------------------+----------+----------+| id | pool_name | framedipaddress | nasipaddress | calledstationid | callingstationid | expiry_time | username | pool_key |+----+-----------+-----------------+--------------+-----------------+------------------+---------------------+----------+----------+| 1 | pool1 | 172.16.15.1 | | | | NULL | | 0 || 2 | pool1 | 172.16.15.2 | | | | NULL | | || 3 | pool1 | 172.16.15.3 | | | | NULL | | |+----+-----------+-----------------+--------------+-----------------+------------------+---------------------+----------+----------+3 rows in set (0.00 sec) >From the above it meets the requirements set out in the wiki - http://wiki.freeradius.org/modules/Rlm_sql "The user IS found in radcheck, the check items DO match AND the read_groups directive is set to 'yes' " >From the debug out you can see it doesn't check the groups then moves on and says " (0) sqlippool : No Pool-Name defined." I have also checked the file /etc/raddb/mods-config/sql/main/mysql/queries.conf and i see the queries for the groupcheck its just not doing it Ready to process requests.rad_recv: Access-Request packet from host 192.168.1.109 port 55758, id=53, length=146 Service-Type = Framed-User Framed-Protocol = PPP User-Name = 'test' MS-CHAP-Challenge = 0x7098b7e479b88ea6ea646493435c771e MS-CHAP2-Response = 0x7a002c2ae80d2311583f5e38117753a3dc7a0000000000000000eef14310bcc325e0edb4908298df6014328fc042ddaf2360 Calling-Station-Id = '192.168.1.70' NAS-IP-Address = 127.0.0.1 NAS-Port = 0(0) # Executing section authorize from file /etc/raddb/sites-enabled/default(0) authorize {(0) filter_username filter_username {(0) ? if (User-Name != "%{tolower:%{User-Name}}") (0) expand: "%{tolower:%{User-Name}}" -> 'test'(0) ? if (User-Name != "%{tolower:%{User-Name}}") -> FALSE(0) ? if (User-Name =~ / /) (0) ? if (User-Name =~ / /) -> FALSE(0) ? if (User-Name =~ /@.*@/ ) (0) ? if (User-Name =~ /@.*@/ ) -> FALSE(0) ? if (User-Name =~ /\\.\\./ ) (0) ? if (User-Name =~ /\\.\\./ ) -> FALSE(0) ? if ((User-Name =~ /@/) && (User-Name !~ /(a)(.+)\\.(.+)$/)) (0) ? if ((User-Name =~ /@/) && (User-Name !~ /(a)(.+)\\.(.+)$/)) -> FALSE(0) ? if (User-Name =~ /\\.$/) (0) ? if (User-Name =~ /\\.$/) -> FALSE(0) ? if (User-Name =~ /(a)\\./) (0) ? if (User-Name =~ /(a)\\./) -> FALSE(0) } # filter_username filter_username = notfound(0) [preprocess] = ok(0) auth_log : expand: "/var/log/radius/radacct/%{%{Packet-Src-IP-Address}:-%{Packet-Src-IPv6-Address}}/auth-detail-%Y%m%d" -> '/var/log/radius/radacct/192.168.1.109/auth-detail-20140926'(0) auth_log : /var/log/radius/radacct/%{%{Packet-Src-IP-Address}:-%{Packet-Src-IPv6-Address}}/auth-detail-%Y%m%d expands to /var/log/radius/radacct/192.168.1.109/auth-detail-20140926(0) auth_log : expand: "%t" -> 'Fri Sep 26 06:51:18 2014'(0) [auth_log] = ok(0) [chap] = noop(0) mschap : Found MS-CHAP attributes. Setting 'Auth-Type = mschap'(0) [mschap] = ok(0) [digest] = noop(0) suffix : No '@' in User-Name = "test", looking up realm NULL(0) suffix : No such realm "NULL"(0) [suffix] = noop(0) eap : No EAP-Message, not doing EAP(0) [eap] = noop(0) files : users: Matched entry DEFAULT at line 181(0) [files] = ok(0) sql : expand: "%{User-Name}" -> 'test'(0) sql : SQL-User-Name set to 'test'rlm_sql (sql): Reserved connection (4)(0) sql : expand: "SELECT id, username, attribute, value, op FROM radcheck WHERE username = '%{SQL-User-Name}' ORDER BY id" -> 'SELECT id, username, attribute, value, op FROM radcheck WHERE username = 'test' ORDER BY id'rlm_sql (sql): Executing query: 'SELECT id, username, attribute, value, op FROM radcheck WHERE username = 'test' ORDER BY id'(0) sql : User found in radcheck table(0) sql : Check items matched(0) sql : expand: "SELECT id, username, attribute, value, op FROM radreply WHERE username = '%{SQL-User-Name}' ORDER BY id" -> 'SELECT id, username, attribute, value, op FROM radreply WHERE username = 'test' ORDER BY id'rlm_sql (sql): Executing query: 'SELECT id, username, attribute, value, op FROM radreply WHERE username = 'test' ORDER BY id'(0) sql : expand: "SELECT groupname FROM radusergroup WHERE username = '%{SQL-User-Name}' ORDER BY priority" -> 'SELECT groupname FROM radusergroup WHERE username = 'test' ORDER BY priority'rlm_sql (sql): Executing query: 'SELECT groupname FROM radusergroup WHERE username = 'test' ORDER BY priority'rlm_sql (sql): Released connection (4)rlm_sql (sql): Closing connection (0): Too many free connections (5 > 3)rlm_sql_mysql: Socket destructor called, closing socket(0) [sql] = ok(0) [expiration] = noop(0) [logintime] = noop(0) WARNING: pap : Auth-Type already set. Not setting to PAP(0) [pap] = noop(0) } # authorize = ok(0) Found Auth-Type = MSCHAP(0) # Executing group from file /etc/raddb/sites-enabled/default(0) Auth-Type MS-CHAP {(0) mschap : Found Cleartext-Password, hashing to create LM-Password(0) mschap : Found Cleartext-Password, hashing to create NT-Password(0) mschap : Creating challenge hash with username: test(0) mschap : Client is using MS-CHAPv2 for test, we need NT-Password(0) mschap : adding MS-CHAPv2 MPPE keys(0) [mschap] = ok(0) } # Auth-Type MS-CHAP = ok(0) Login OK: [test/<via Auth-Type = MSCHAP>] (from client 192.168.1.109 port 0 cli 192.168.1.70)(0) # Executing section post-auth from file /etc/raddb/sites-enabled/default(0) post-auth {(0) sql : expand: ".query" -> '.query'(0) sql : Using query template 'query'rlm_sql (sql): Reserved connection (4)(0) sql : expand: "%{User-Name}" -> 'test'(0) sql : SQL-User-Name set to 'test'(0) sql : expand: "INSERT INTO radpostauth (username, pass, reply, authdate) VALUES ( '%{SQL-User-Name}', '%{%{User-Password}:-%{Chap-Password}}', '%{reply:Packet-Type}', '%S')" -> 'INSERT INTO radpostauth (username, pass, reply, authdate) VALUES ( 'test', '', 'Access-Accept', '2014-09-26 06:51:18')'rlm_sql (sql): Executing query: 'INSERT INTO radpostauth (username, pass, reply, authdate) VALUES ( 'test', '', 'Access-Accept', '2014-09-26 06:51:18')'rlm_sql (sql): Released connection (4)(0) [sql] = ok(0) sqlippool : No Pool-Name defined.(0) sqlippool : expand: "No Pool-Name defined (did %{Called-Station-Id} cli %{Calling-Station-Id} port %{NAS-Port} user %{User-Name})" -> 'No Pool-Name defined (did cli 192.168.1.70 port 0 user test)'(0) [sqlippool] = noop(0) [exec] = noop(0) remove_reply_message_if_eap remove_reply_message_if_eap {(0) ? if (reply:EAP-Message && reply:Reply-Message) (0) ? if (reply:EAP-Message && reply:Reply-Message) -> FALSE(0) else else {(0) [noop] = noop(0) } # else else = noop(0) } # remove_reply_message_if_eap remove_reply_message_if_eap = noop(0) } # post-auth = okSending Access-Accept of id 53 from 192.168.1.67 port 1812 to 192.168.1.109 port 55758 Framed-Protocol = PPP Framed-Compression = Van-Jacobson-TCP-IP MS-CHAP2-Success = 0x7a533d30383134394335414641303837374636373833433934413034313938373737363341344231433632 MS-MPPE-Recv-Key = 0xa2232b07eab47e9464305946464fdd13 MS-MPPE-Send-Key = 0xf1ab397d79c4eb450b5dde7dad811f1d MS-MPPE-Encryption-Policy = Encryption-Required MS-MPPE-Encryption-Types = 4(0) Finished request 0.Waking up in 0.2 seconds.Waking up in 4.7 seconds.rad_recv: Accounting-Request packet from host 192.168.1.109 port 35133, id=54, length=110 Acct-Session-Id = '5425A63435B300' User-Name = 'test' Acct-Status-Type = Start Service-Type = Framed-User Framed-Protocol = PPP Calling-Station-Id = '192.168.1.70' Acct-Authentic = RADIUS NAS-Port-Type = Async Framed-IP-Address = 192.168.1.1 NAS-IP-Address = 127.0.0.1 NAS-Port = 0 Acct-Delay-Time = 0(1) # Executing section preacct from file /etc/raddb/sites-enabled/default(1) preacct {(1) [preprocess] = ok(1) acct_unique acct_unique {(1) ? if ("%{string:Class}" =~ /ai:([0-9a-f]{32})/i) (1) expand: "%{string:Class}" -> ''(1) ? if ("%{string:Class}" =~ /ai:([0-9a-f]{32})/i) -> FALSE(1) else else {(1) update request {(1) expand: "%{md5:%{User-Name},%{Acct-Session-ID},%{NAS-IP-Address},%{NAS-Identifier},%{NAS-Port-ID},%{NAS-Port}}" -> '84b95fb1219c04cd5fd1f53d294840aa'(1) Acct-Unique-Session-Id := "84b95fb1219c04cd5fd1f53d294840aa"(1) } # update request = noop(1) } # else else = noop(1) } # acct_unique acct_unique = noop(1) suffix : No '@' in User-Name = "test", looking up realm NULL(1) suffix : No such realm "NULL"(1) [suffix] = noop(1) [files] = noop(1) } # preacct = ok(1) # Executing section accounting from file /etc/raddb/sites-enabled/default(1) accounting {(1) detail : expand: "/var/log/radius/radacct/%{%{Packet-Src-IP-Address}:-%{Packet-Src-IPv6-Address}}/detail-%Y%m%d" -> '/var/log/radius/radacct/192.168.1.109/detail-20140926'(1) detail : /var/log/radius/radacct/%{%{Packet-Src-IP-Address}:-%{Packet-Src-IPv6-Address}}/detail-%Y%m%d expands to /var/log/radius/radacct/192.168.1.109/detail-20140926(1) detail : expand: "%t" -> 'Fri Sep 26 06:51:20 2014'(1) [detail] = ok(1) [unix] = okrlm_sql (sql): Reserved connection (4)(1) sqlippool : expand: "%{User-Name}" -> 'test'(1) sqlippool : SQL-User-Name set to 'test'(1) sqlippool : expand: "START TRANSACTION" -> 'START TRANSACTION'rlm_sql (sql): Executing query: 'START TRANSACTION'(1) sqlippool : expand: "UPDATE radippool SET expiry_time = NOW() + INTERVAL 3600 SECOND WHERE nasipaddress = '%{NAS-IP-Address}' AND pool_key = '%{NAS-Port}' AND username = '%{User-Name}' AND callingstationid = '%{Calling-Station-Id}' AND framedipaddress = '%{Framed-IP-Address}'" -> 'UPDATE radippool SET expiry_time = NOW() + INTERVAL 3600 SECOND WHERE nasipaddress = '127.0.0.1' AND pool_key = '0' AND username = 'test' AND callingstationid = '192.168.1.70' AND framedipaddress = '192.168.1.1''rlm_sql (sql): Executing query: 'UPDATE radippool SET expiry_time = NOW() + INTERVAL 3600 SECOND WHERE nasipaddress = '127.0.0.1' AND pool_key = '0' AND username = 'test' AND callingstationid = '192.168.1.70' AND framedipaddress = '192.168.1.1''(1) sqlippool : expand: "COMMIT" -> 'COMMIT'rlm_sql (sql): Executing query: 'COMMIT'rlm_sql (sql): Released connection (4)rlm_sql (sql): Closing connection (1): Too many free connections (4 > 3)rlm_sql_mysql: Socket destructor called, closing socket(1) [sqlippool] = ok(1) sql : expand: "%{tolower:type.%{Acct-Status-Type}.query}" -> 'type.start.query'(1) sql : Using query template 'query'rlm_sql (sql): Reserved connection (4)(1) sql : expand: "%{User-Name}" -> 'test'(1) sql : SQL-User-Name set to 'test'(1) sql : expand: "INSERT INTO radacct (acctsessionid, acctuniqueid, username, realm, nasipaddress, nasportid, nasporttype, acctstarttime, acctupdatetime, acctstoptime, acctsessiontime, acctauthentic, connectinfo_start, connectinfo_stop, acctinputoctets, acctoutputoctets, calledstationid, callingstationid, acctterminatecause, servicetype, framedprotocol, framedipaddress) VALUES ('%{Acct-Session-Id}', '%{Acct-Unique-Session-Id}', '%{SQL-User-Name}', '%{Realm}', '%{NAS-IP-Address}', '%{NAS-Port}', '%{NAS-Port-Type}', FROM_UNIXTIME(%{integer:Event-Timestamp}), FROM_UNIXTIME(%{integer:Event-Timestamp}), NULL, '0', '%{Acct-Authentic}', '%{Connect-Info}', '', '0', '0', '%{Called-Station-Id}', '%{Calling-Station-Id}', '', '%{Service-Type}', '%{Framed-Protocol}', '%{Framed-IP-Address}')" -> 'INSERT INTO radacct (acctsessionid, acctuniqueid, username, realm, nasipaddress, nasportid, nasporttype, acctstarttime, acctupdatetime, acctstoptime, acctsessiontime, acctauthentic, connectinfo_start, connectinfo_stop, acctinputoctets, acctoutputoctets, calledstationid, callingstationid, acctterminatecause, servicetype, framedprotocol, framedipaddress) VALUES ('5425A63435B300', '84b95fb1219c04cd5fd1f53d294840aa', 'test', '', '127.0.0.1', '0', 'Async', FROM_UNIXTIME(1411710680), FROM_UNIXTIME(1411710680), NULL, '0', 'RADIUS', '', '', '0', '0', '', '192.168.1.70', '', 'Framed-User', 'PPP', '192.168.1.1')'rlm_sql (sql): Executing query: 'INSERT INTO radacct (acctsessionid, acctuniqueid, username, realm, nasipaddress, nasportid, nasporttype,acctstarttime, acctupdatetime, acctstoptime, acctsessiontime, acctauthentic, connectinfo_start, connectinfo_stop, acctinputoctets, acctoutputoctets, calledstationid, callingstationid, acctterminatecause, servicetype, framedprotocol, framedipaddress) VALUES ('5425A63435B300', '84b95fb1219c04cd5fd1f53d294840aa', 'test', '', '127.0.0.1', '0', 'Async', FROM_UNIXTIME(1411710680), FROM_UNIXTIME(1411710680), NULL, '0', 'RADIUS', '', '', '0', '0', '', '192.168.1.70', '', 'Framed-User', 'PPP', '192.168.1.1')'rlm_sql (sql): Released connection (4)(1) [sql] = ok(1) [exec] = noop(1) attr_filter.accounting_response : expand: "%{User-Name}" -> 'test'(1) attr_filter.accounting_response : Matched entry DEFAULT at line 12(1) [attr_filter.accounting_response] = updated(1) } # accounting = updatedSending Accounting-Response of id 54 from 192.168.1.67 port 1813 to 192.168.1.109 port 35133(1) Finished request 1.Waking up in 0.2 seconds.(1) Cleaning up request packet ID 54 with timestamp +14Waking up in 2.7 seconds.(0) Cleaning up request packet ID 53 with timestamp +12Ready to process requests.rad_recv: Accounting-Request packet from host 192.168.1.109 port 59458, id=55, length=146 Acct-Session-Id = '5425A63435B300' User-Name = 'test' Acct-Status-Type = Stop Service-Type = Framed-User Framed-Protocol = PPP Acct-Authentic = RADIUS Acct-Session-Time = 4 Acct-Output-Octets = 0 Acct-Input-Octets = 2804 Acct-Output-Packets = 0 Acct-Input-Packets = 36 Calling-Station-Id = '192.168.1.70' NAS-Port-Type = Async Acct-Terminate-Cause = User-Request Framed-IP-Address = 192.168.1.1 NAS-IP-Address = 127.0.0.1 NAS-Port = 0 Acct-Delay-Time = 0(2) # Executing section preacct from file /etc/raddb/sites-enabled/default(2) preacct {(2) [preprocess] = ok(2) acct_unique acct_unique {(2) ? if ("%{string:Class}" =~ /ai:([0-9a-f]{32})/i) (2) expand: "%{string:Class}" -> ''(2) ? if ("%{string:Class}" =~ /ai:([0-9a-f]{32})/i) -> FALSE(2) else else {(2) update request {(2) expand: "%{md5:%{User-Name},%{Acct-Session-ID},%{NAS-IP-Address},%{NAS-Identifier},%{NAS-Port-ID},%{NAS-Port}}" -> '84b95fb1219c04cd5fd1f53d294840aa'(2) Acct-Unique-Session-Id := "84b95fb1219c04cd5fd1f53d294840aa"(2) } # update request = noop(2) } # else else = noop(2) } # acct_unique acct_unique = noop(2) suffix : No '@' in User-Name = "test", looking up realm NULL(2) suffix : No such realm "NULL"(2) [suffix] = noop(2) [files] = noop(2) } # preacct = ok(2) # Executing section accounting from file /etc/raddb/sites-enabled/default(2) accounting {(2) detail : expand: "/var/log/radius/radacct/%{%{Packet-Src-IP-Address}:-%{Packet-Src-IPv6-Address}}/detail-%Y%m%d" -> '/var/log/radius/radacct/192.168.1.109/detail-20140926'(2) detail : /var/log/radius/radacct/%{%{Packet-Src-IP-Address}:-%{Packet-Src-IPv6-Address}}/detail-%Y%m%d expands to /var/log/radius/radacct/192.168.1.109/detail-20140926(2) detail : expand: "%t" -> 'Fri Sep 26 06:51:23 2014'(2) [detail] = ok(2) [unix] = okrlm_sql (sql): Reserved connection (4)(2) sqlippool : expand: "%{User-Name}" -> 'test'(2) sqlippool : SQL-User-Name set to 'test'(2) sqlippool : expand: "START TRANSACTION" -> 'START TRANSACTION'rlm_sql (sql): Executing query: 'START TRANSACTION'(2) sqlippool : expand: "UPDATE radippool SET nasipaddress = '', pool_key = 0, callingstationid = '', username = '', expiry_time = NULL WHERE nasipaddress = '%{Nas-IP-Address}' AND pool_key = '%{NAS-Port}' AND username = '%{User-Name}' AND callingstationid = '%{Calling-Station-Id}' AND framedipaddress = '%{Framed-IP-Address}'" -> 'UPDATE radippool SET nasipaddress = '', pool_key = 0, callingstationid = '', username = '', expiry_time = NULL WHERE nasipaddress = '127.0.0.1' AND pool_key = '0' AND username = 'test' AND callingstationid = '192.168.1.70' AND framedipaddress = '192.168.1.1''rlm_sql (sql): Executing query: 'UPDATE radippool SET nasipaddress = '', pool_key = 0, callingstationid = '', username = '', expiry_time = NULL WHERE nasipaddress = '127.0.0.1' AND pool_key = '0' AND username = 'test' AND callingstationid = '192.168.1.70' AND framedipaddress = '192.168.1.1''(2) sqlippool : expand: "COMMIT" -> 'COMMIT'rlm_sql (sql): Executing query: 'COMMIT'(2) sqlippool : expand: "Released IP %{Framed-IP-Address} (did %{Called-Station-Id} cli %{Calling-Station-Id} user %{User-Name})" -> 'Released IP 192.168.1.1 (did cli 192.168.1.70 user test)'rlm_sql (sql): Released connection (4)(2) [sqlippool] = ok(2) sql : expand: "%{tolower:type.%{Acct-Status-Type}.query}" -> 'type.stop.query'(2) sql : Using query template 'query'rlm_sql (sql): Reserved connection (4)(2) sql : expand: "%{User-Name}" -> 'test'(2) sql : SQL-User-Name set to 'test'(2) sql : expand: "UPDATE radacct SET acctstoptime = FROM_UNIXTIME(%{integer:Event-Timestamp}), acctsessiontime = '%{Acct-Session-Time}', acctinputoctets = '%{%{Acct-Input-Gigawords}:-0}' << 32 | '%{%{Acct-Input-Octets}:-0}', acctoutputoctets = '%{%{Acct-Output-Gigawords}:-0}' << 32 | '%{%{Acct-Output-Octets}:-0}', acctterminatecause = '%{Acct-Terminate-Cause}', connectinfo_stop = '%{Connect-Info}' WHERE acctsessionid = '%{Acct-Session-Id}' AND username = '%{SQL-User-Name}' AND nasipaddress = '%{NAS-IP-Address}'" -> 'UPDATE radacct SET acctstoptime = FROM_UNIXTIME(1411710683), acctsessiontime = '4', acctinputoctets = '0' << 32 | '2804', acctoutputoctets = '0' << 32 | '0', acctterminatecause = 'User-Request', connectinfo_stop = '' WHERE acctsessionid = '5425A63435B300' AND username = 'test' AND nasipaddress = '127.0.0.1''rlm_sql (sql): Executing query: 'UPDATE radacct SET acctstoptime = FROM_UNIXTIME(1411710683), acctsessiontime = '4', acctinputoctets = '0' << 32 | '2804', acctoutputoctets = '0' << 32 | '0', acctterminatecause = 'User-Request', connectinfo_stop = '' WHERE acctsessionid = '5425A63435B300' AND username = 'test' AND nasipaddress = '127.0.0.1''rlm_sql (sql): Released connection (4)(2) [sql] = ok(2) [exec] = noop(2) attr_filter.accounting_response : expand: "%{User-Name}" -> 'test'(2) attr_filter.accounting_response : Matched entry DEFAULT at line 12(2) [attr_filter.accounting_response] = updated(2) } # accounting = updatedSending Accounting-Response of id 55 from 192.168.1.67 port 1813 to 192.168.1.109 port 59458(2) Finished request 2.Waking up in 0.3 seconds.(2) Cleaning up request packet ID 55 with timestamp +17Ready to process requests.

2 2

MSCHAP2 local Password change failure - "MS-CHAP-New-Cleartext-Password" char buffer not \0 terminated
by Isaac Boukris 27 Sep '14

27 Sep '14

Hello, I've encounter this issue while running some tests with the new MSCHAP2 password change feature. My setup consists of the following. # radiusd -v radiusd: FreeRADIUS Version 3.0.5 (git #b6c3143), for host i686-pc-linux-gnu, built on Sep 19 2014 at 01:28:18 /etc/raddb/users: anna Cleartext-Password := 'aaaa', SMB-Account-Ctrl-Text := '[Ue]' /etc/raddb/mods-enabled/mschap (under passchange): local_cpw = "%{exec:/bin/mys %{mschap:User-Name} %{MS-CHAP-New-Cleartext-Password}}" When I first enter the password I get the proper error of user expired, when I enter the new password radiusd crashes. This is what 'radiusd -X' shows before it exits: (2) mschap : MS-CHAPv2 password change request received (2) mschap : Password change payload valid (2) mschap : Doing MS-CHAPv2 password change locally CONSISTENCY CHECK FAILED src/lib/cursor.c[151]: VALUE_PAIR "MS-CHAP-New-Cleartext-Password" char buffer not \0 terminated SOFT ASSERT FAILED src/lib/debug.c[1008]: 0 CAUGHT SIGNAL: User defined signal 1 Backtrace of last 35 frames: /usr/local/lib/libfreeradius-radius.so(fr_fault+0x105)[0x82d281] ... When I add: RDEBUG("length is: %d - and new pass is %s", new_pass->length, new_pass->vp_strvalue); At: https://github.com/FreeRADIUS/freeradius-server/blob/master/src/modules/rlm… I get: (2) mschap : length is: 4 - and new pass is bbbb?????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????? So adding the following line at the same place makes it work ok (my script gets the new password and I get access-accept): x[new_pass->length] = '\0'; But I am not sure it is a proper solution as I am still reading about encoding stuff. If any additional information or tests are needed i'll be glad to supply. Thanks a lot for the great open software. Isaac Boukris

2 4

RE: Freeradius-Users Digest, Vol 113, Issue 122
by James w 27 Sep '14

27 Sep '14

Thanks, yes the debug is from another test I ran with the user test, when I copied by sql tables I edited them to simplify. Sent from my Windows Phone ________________________________ From: freeradius-users-request(a)lists.freeradius.org<mailto:freeradius-users-request@lists.freeradius.org> Sent: ‎27/‎09/‎2014 11:00 To: freeradius-users(a)lists.freeradius.org<mailto:freeradius-users@lists.freeradius.org> Subject: Freeradius-Users Digest, Vol 113, Issue 122 Send Freeradius-Users mailing list submissions to freeradius-users(a)lists.freeradius.org To subscribe or unsubscribe via the World Wide Web, visit http://lists.freeradius.org/mailman/listinfo/freeradius-users or, via email, send a message with subject or body 'help' to freeradius-users-request(a)lists.freeradius.org You can reach the person managing the list at freeradius-users-owner(a)lists.freeradius.org When replying, please edit your Subject line so it is more specific than "Re: Contents of Freeradius-Users digest..." Today's Topics: 1. Re: freeradius sql groups not working (Axel Luttgens) ---------------------------------------------------------------------- Message: 1 Date: Sat, 27 Sep 2014 10:51:25 +0200 From: Axel Luttgens <axel.luttgens(a)skynet.be> To: FreeRadius users mailing list <freeradius-users(a)lists.freeradius.org> Subject: Re: freeradius sql groups not working Message-ID: <EFDB9BD9-F0F4-467E-98EE-48741F9E10A5(a)skynet.be> Content-Type: text/plain; charset=iso-8859-1 Le 27 sept. 2014 ? 09:56, James w a ?crit : > Hi, > > I am having some trouble with freeradius and the SQL module. The issue i have is the radgroupcheck and radgroupreply tables never get read by freeradius. I cannot find a reason why the group tables aren't being used, they meet the requirements according the the wiki. > > [...] > > Here is my config and a debug out of radiusd -X > > [...] Hello James, Not sure, but your radusergroup table shows a single row with a username set to "user", and you're sending an Acces-Request with a User-Name having value "test"... Axel ------------------------------ - List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html End of Freeradius-Users Digest, Vol 113, Issue 122 **************************************************

2 1

Proxied Access-reject reply
by Juanjo Abenza 27 Sep '14

27 Sep '14

Hi, I'm using "freeradius-3.0.1-6.el7.x86_64" as proxy, between radius server and a mikrotik NAS for pppoe users, this is the scheme. NAS --> Proxy freeradius --> freeradius Server 10.200.0.34 10.100.1.100 10.100.1.101 My goal is to change the Access-Reject messaje recieved in the Proxy radius from the Radius server to send to the NAS an Access-Accept with some attributtes, like this more or less, i tried to put this just inside "Post-Auth-Type REJECT" in Post-Auth section without results if (reject) { ok # over-ride "reject" update control { Auth-Type := Accept Framed-Pool = 'BAN' } } i think i just miss to put before this update control the if condition before, but i dont know which one to use This is what i can see in debug mode: rad_recv: Accounting-Response packet from host 10.100.1.101 port 1813, id=225, length=25 Proxy-State = 0x323033 (0) # Executing section post-proxy from file /etc/raddb/sites-enabled/default (0) post-proxy { (0) eap : No pre-existing handler found (0) [eap] = noop (0) } # post-proxy = noop Sending Accounting-Response of id 203 from 10.100.1.100 port 1813 to 10.200.0.34 port 56239 (0) Finished request 0. Waking up in 0.3 seconds. rad_recv: Access-Request packet from host 10.200.0.34 port 60374, id=204, length=157 Service-Type = Framed-User Framed-Protocol = PPP NAS-Port = 8546310 NAS-Port-Type = Ethernet User-Name = 'USERNAME_XX' Calling-Station-Id = 'D4:CA:6D:47:A5:27' Called-Station-Id = 'pppoe-Excom' NAS-Port-Id = 'bridge-pppoe' User-Password = 'Password' NAS-Identifier = 'PABELLON_RT1' NAS-IP-Address = 10.200.0.34 (1) # Executing section authorize from file /etc/raddb/sites-enabled/default (1) authorize { (1) filter_username filter_username { (1) ? if (User-Name != "%{tolower:%{User-Name}}") (1) expand: "%{tolower:%{User-Name}}" -> 'username_xx' (1) ? if (User-Name != "%{tolower:%{User-Name}}") -> TRUE (1) if (User-Name != "%{tolower:%{User-Name}}") { (1) [reject] = reject (1) } # if (User-Name != "%{tolower:%{User-Name}}") = reject (1) } # filter_username filter_username = reject (1) } # authorize = reject (1) Using Post-Auth-Type Reject (1) # Executing group from file /etc/raddb/sites-enabled/default (1) Post-Auth-Type REJECT { (1) attr_filter.access_reject : expand: "%{User-Name}" -> 'USERNAME_XX' (1) attr_filter.access_reject : Matched entry DEFAULT at line 11 (1) [attr_filter.access_reject] = updated (1) eap : Request didn't contain an EAP-Message, not inserting EAP-Failure (1) [eap] = noop (1) remove_reply_message_if_eap remove_reply_message_if_eap { (1) ? if (reply:EAP-Message && reply:Reply-Message) (1) ? if (reply:EAP-Message && reply:Reply-Message) -> FALSE (1) else else { (1) [noop] = noop (1) } # else else = noop (1) } # remove_reply_message_if_eap remove_reply_message_if_eap = noop (1) } # Post-Auth-Type REJECT = updated (1) Finished request 1. (0) Cleaning up request packet ID 203 with timestamp +5 Waking up in 0.2 seconds. rad_recv: Access-Request packet from host 10.200.0.34 port 60374, id=204, length=157 (1) Discarding duplicate request from client Bejar port 60374 - ID: 204 due to unfinished request Waking up in 0.6 seconds. rad_recv: Access-Request packet from host 10.200.0.34 port 60374, id=204, length=157 (1) Discarding duplicate request from client Bejar port 60374 - ID: 204 due to delayed reject Waking up in 0.3 seconds. (1) Sending delayed reject Sending Access-Reject of id 204 from 10.100.1.100 port 1812 to 10.200.0.34 port 60374 Can anyone help me?? Best regards, JJ -- ------------------------------------ Juanjo Abenza Sánchez Operaciones Free Technologies Excom, S.L. http://www.excom.es Tel. 902 02 02 34 Ext. 202 Fax 902 87 66 41 ----------------------------------- AVISO LEGAL *Este mensaje es CONFIDENCIAL, siendo para uso exclusivo de su destinatario. Si usted no es el destinatario,* *por favor, reenvíe el mensaje inmediatamente a la dirección remitente y proceda a su borrado.* *Free Technologies Excom, s.l. **incluirá su dirección de correo electrónico, así como los datos de contacto que* *le facilite en un fichero automatizado, con el fin de gestionar el envío de comunicaciones profesionales y/o* *personales. Para ejercitar sus derechos de acceso, rectificación, cancelación y oposición, remita su solicitud a:* *Free Technologies Excom, s.l. - Avenida Valdeparra nº 27, edificio nº 1, planta 2, oficina 4 - 28108,* *Alcobendas (Madrid).* LEGAL NOTICE *This message is CONFIDENTIAL, being for exclusive use of the addressee. If you are not the addressee, please* *forward this message to sender inmediately and arrange for its deletion.* *Free Technologies Excom, s.l. **will include your address and contact details in an automated file, in order to* *manage the delivery of business and personal communications. To exercise your rights of access, rectification,* *cancellation and opposition, send your request to:* *Free Technologies Excom, s.l. - Avenida Valdeparra nº 27, edificio nº 1, planta 2, oficina 4 - 28108,* *Alcobendas (Madrid).*

2 3

Re: Module Statistics in freeradius
by Himanshu Pandey 27 Sep '14

27 Sep '14

Dear Alan, I have completed my coding to achieve my task. I tried my best not to disturb much of the server code. Here is my code snippet. I request you to suggest me If my  added code is correct or wrong. Also, suggest me if there is any other best way to achieve this or you think my added can be optimized more. /* Structure */ /**     Return codes indicating the result of the module call  *  *  *   *  All module functions must return one of the codes listed below (apart from  *    * RLM_MODULE_NUMCODES, which is used to check for validity).  *     */ typedef enum rlm_rcodes {         RLM_MODULE_REJECT = 0,  //!< Immediately reject the request.         RLM_MODULE_FAIL,             //!< Module failed, don't reply.         RLM_MODULE_OK,              //!< The module is OK, continue.         RLM_MODULE_HANDLED,    //!< The module handled the request, so stop.         RLM_MODULE_INVALID,       //!< The module considers the request invalid.         RLM_MODULE_USERLOCK,  //!< Reject the request (user is locked out).         RLM_MODULE_NOTFOUND,    //!< User not found.         RLM_MODULE_NOOP,           //!< Module succeeded without doing anything.         RLM_MODULE_UPDATED,     //!< OK (pairs modified).         RLM_MODULE_NUMCODES,  //!< How many valid return codes there are.         RLM_MODULE_UNKNOWN      //!< Error resolving rcode (should not be                                                       //!< returned by modules). } rlm_rcode_t; typedef struct module_t {         uint64_t                magic;               //!< Used to validate module struct.         char const              *name;             //!< The name of the module (without rlm_ prefix).         int                     type;                     //!< One or more of the RLM_TYPE_* constants.         size_t                  inst_size;            //!< Size of the instance data         CONF_PARSER const       *config;                        //!< Configuration information         instantiate_t           instantiate;                    //!< Function to use for instantiation.         detach_t                detach;                         //!< Function to use to free module instance.         packetmethod            methods[RLM_COMPONENT_COUNT];   //!< Pointers to the various section                                                                                                                  //functions, ordering                                                                 //!< determines which function is mapped                                                                                                         //to           &n! bsp;                                                                                                //!< which section                                                                                                                      &nbsp! ;                                                                                                                                                                    &nb! sp;           & nbsp;                       uint64_t                rtcode[RLM_MODULE_NUMCODES];    //Used for module return codes                  } module_t; Now in function: modcall_recurse() I added modcall_recurse() { rlm_rcode_t result; module_t const *module; result = call_modsingle(c->method, sp, request); module->rtcode[result] = module->rtcode[result] + 1; }  Also, in radius.c in function main I will use memset to initialize my rtcode array to zero. will add this statement: memset(module->rtcode,0,sizeof(module->rtcode)); Regards, Sonu From: Alan DeKok <aland(a)deployingradius.com> Sent: Fri, 26 Sep 2014 23:43:18 To: FreeRadius users mailing list <freeradius-users(a)lists.freeradius.org> Subject: Re: Module Statistics in freeradius Himanshu Pandey wrote: > But as we discussed, the server does NOT keep track of statistics for > each module return codes.  Yes... I've said that repeatedly.  Perhaps you could repeat it some more, to be sure that I understand how the server works? > The very first thing that I did was finding out the basic module > structure in freeradius, if I am not wrong this is the basic module > structure used:  Yes. > Now I added an unsigned long array in this structure in which module > return code act as an index. Please see the snippet below:  That's not a good idea.  For one, the module return codes are already in a typedef.  Just use that one.  There's no reason to create a new one.  And "unsigned long" isn't used anywhere else in the server.  Just use "uint64_t". > Please advice me that how should I update this my unsigned long > rtcode[RLM_RETCODE_COUNT] array with each module return code.  Use C code to increment the array entry.  See modcall.c, call_modsingle().  Alan DeKok. - List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html

1 0