September 2014 - Freeradius-Users - lists.freeradius.org

Re: Module Statistics in freeradius
by Alan DeKok 26 Sep '14

26 Sep '14

Himanshu Pandey wrote: > But as we discussed, the server does NOT keep track of statistics for > each module return codes. Yes... I've said that repeatedly. Perhaps you could repeat it some more, to be sure that I understand how the server works? > The very first thing that I did was finding out the basic module > structure in freeradius, if I am not wrong this is the basic module > structure used: Yes. > Now I added an unsigned long array in this structure in which module > return code act as an index. Please see the snippet below: That's not a good idea. For one, the module return codes are already in a typedef. Just use that one. There's no reason to create a new one. And "unsigned long" isn't used anywhere else in the server. Just use "uint64_t". > Please advice me that how should I update this my unsigned long > rtcode[RLM_RETCODE_COUNT] array with each module return code. Use C code to increment the array entry. See modcall.c, call_modsingle(). Alan DeKok.

1 0

proxy.conf: unknown server
by Alex Gregory 26 Sep '14

26 Sep '14

I am trying to proxy radius requests to an upstream OTP radius server which I have no control of. To support that I have the following proxy.conf: proxy server { default_fallback = no } home_server inwebo1 { type = auth ipaddr = 94.143.115.73 port = 1812 secret = supersecretsecret status_check = status-server } home_server inwebo2 { type = auth ipaddr = 94.143.115.75 port = 1812 secret = supersecretsecret status_check = status-server } home_server_pool inwebo { type = fail-over home_server = inwebo1 home_server = inwebo2 } realm DEFAULT { pool = inwebo nostrip } Yet when I try to start the server I get: /usr/local/etc/raddb/proxy.conf[23]: Unknown home_server "inwebo1”. Can someone tell me if this is configuration or bug related? I noticed that there have been changes lately to this part of the code. This is on FreeRadius 3.0.4 on Ubuntu. Thanks, Alex

4 8

Reply-Message in postauth_query
by Hasanen AL-Bana 26 Sep '14

26 Sep '14

Hello, I am using freeradius 2.2.5 with MySQL. my postauth_query looks like the following : postauth_query = "INSERT INTO radpostauth \ (username, password, reply, authdate,service,mac,nasip,nasid) \ VALUES ( \ '%{User-Name}', \ '%{%{User-Password}:-%{Chap-Password}}', \ '%{reply:Packet-Type}', '%S', \ '%{Called-Station-Id}', \ '%{Calling-Station-Id}' ,\ '%{NAS-IP-Address}' ,\ '%{NAS-Identifier}')" in the reply field , I always get either Access-Reject or Access-Accept from reply:Packet-Type. What other options I have for reply: other than Packet-Type ? Is it possible to reach the Reply-Message from within postauth_query ? Thank you.

2 2

Re: Module Statistics in freeradius
by Himanshu Pandey 26 Sep '14

26 Sep '14

Dear Alan, I have gone through different statistics provided by radius server. But as we discussed, the server does NOT keep track of statistics for each module return codes. My aim is to achieve this. I want the statistics of each module return code. That is for e.g.,  Module X how many times returned OK or fail or reject etc. Now with this aim in mind I thought to modify the freeradius code: The very first thing that I did was finding out the basic module structure in freeradius, if I am not wrong this is the basic module structure used: typedef struct module_t {         uint64_t         magic;                          //!< Used to validate module struct.         char const     *name;                          //!< The name of the module (without rlm_ prefix).         int                 type;                           //!< One or more of the RLM_TYPE_* constants.         size_t            inst_size;                      //!< Size of the instance data         CONF_PARSER const     *config;         //!< Configuration information         instantiate_t    instantiate;                    //!< Function to use for instantiation.         detach_t         detach;                         //!< Function to use to free module instance.         packetmethod   methods[RLM_COMPONENT_COUNT];   //!< Pointers to the various section functions,                                                                                                     // ordering !< determines which function is mapped                                                                &! nbsp;                                //to!< which section.                             } module_t; Now I added an unsigned long array in this structure in which module return code act as an index. Please see the snippet below: typedef enum module_statistics {         RLM_MODULE_REJECT = 0, //!< 0 methods index for reject return code.         RLM_MODULE_FAIL,     //!< 1 methods index for fail return code.         RLM_MODULE_OK,     //!< 2 methods index for OK return code.         RLM_MODULE_HANDLED,     //!< 3 methods index for handled return code.         RLM_MODULE_INVALID,     //!< 4 methods index for invalid return code.         RLM_MODULE_USERLOCK,//!< 5 methods index for userlock return code.         RLM_MODULE_NOTFOUND, //!< 6 methods index for notfound return code.         RLM_MODULE_NOOP,//!< 7 methods index for noop return code.         RLM_MODULE_UPDATED, //!< 8 methods index for updated return code.                 RLM_RETCODE_COUNT     //!< 9 how many module return codes there are. } module_statistics; typedef struct module_t {         uint64_t                magic;                          //!< Used to validate module struct.         char const              *name;                          //!< The name of the module (without rlm_ prefix).         int                     type;                           //!< One or more of the RLM_TYPE_* constants.         size_t                  inst_size;                      //!< Size of the instance data         CONF_PARSER const       *config;                        //!< Configuration information         instantiate_t           instantiate;                    //!< Function to use for instantiation.         detach_t                detach;                         //!< Function to use to free module instance.         packetmethod         methods[RLM_COMPONENT_COUNT];   //!< Pointers to the various section functions,                                                                  //ordering                                                                 //!< determines which function is mapped to                                                                //!< which section.        unsigned long rtcode[RLM_RETCODE_COUNT];   //Used for module return codes                  } module_t;   Is this approach OK? Please suggest me. Please advice me that how should I update this my unsigned long rtcode[RLM_RETCODE_COUNT] array with each module return code. Regards, Sonu  From: Alan DeKok <aland(a)deployingradius.com> Sent: Thu, 25 Sep 2014 21:47:49 To: FreeRadius users mailing list <freeradius-users(a)lists.freeradius.org> Subject: Re: Module Statistics in freeradius Himanshu Pandey wrote: > I am a bit confused right now.  You keep changing what you're asking for.  The server already keeps track of total packet counts for Access-Request, Access-Accept, etc.  The server does NOT keep track of statistics for module return codes.  The server already keeps track of total packet counts for clients, listeners, and home servers.  The server does NOT keep track of statistics (anything) per module. > You mean to say that if suppose I want > the number of authorize request that were OK,UPDATED,FAILED,HANDLED or > REJECTED to be printed then I can use the radmin. Since the server DOES > keep track of statistics per listener.  And prints them out. > > Is it correct?  No.  If you run the "help" command from radmin, you will see what it's keepings statistics for.  If you run the appropriate statistics command, you will see which statistics it keeps.  It's that easy.  You should try it, rather than asking confusion questions on the list.  All of the answers are ALREADY in front of you.  Alan DeKok. - List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html

1 0

Authentication Before Authorization
by Russell Mike 26 Sep '14

26 Sep '14

Hi Alan D Can we do authentication before authorization in v3.0 ? Thanks

2 5

Refresh interval for end users devices
by Rando Nakarmi 26 Sep '14

26 Sep '14

Hi, I have a two devices, one phone and a windows 7 machine. I can connect to my my both devices with wireless and get authenticated with freeradius. (this is great) But I am noticing that every time devices refresh it actually re-authenticate which I can see int the radius logs. For example, my phone got connected - authenticated, then i locked the phone, after a while I open the phone, when it re-scan the network it actually sends the authentication request- gets re-authenticated. Is there a way, it only authenticates once, if you are in same wireless access point ? I meant, when device re-scans the network and if you are with the same Wireless access point not to send the auth request to the server over and and over ? Thanks, R

3 3

How to make EAP-TTLS work with ldap ?
by anindya.mukherjee＠wipro.com 26 Sep '14

26 Sep '14

Hello I am a new user of Freeradius and my goal is to set up a freeradius server for wifi access control, which can look up users from an openldap database. I have set the default eap type as ttls with additional ldap configurations, as well as added the radius schema to openldap and have created necessary attributes for the user entries. I am using eapol_test to test the server and so far have managed to do basic PAP authentication and EAP-TTLS(MD5) against local user file. My problem is, the inner tunnel eap only works with ldap password hashes when the inner eap is set as MSCHAPV2, otherwise MD5 throws the error "rlm_eap_md5: Cleartext-Password is required for EAP-MD5 authentication". So to make TTLS-EAP work with ldap, I have to use MSCHAPV2, and to make MSCHAPV2 work, I have to keep sambaNTPassword attribute in the ldap database. And every time an user changes their password, both sambaNTPassword and userPassword attributes have to be changed. Is there a way to make inner tunnel work with ldap userPassword attribute ? I'm sorry if I sound stupid, but I really need to know what I'm doing wrong. Thanks in Advance Anindya Mukherjee The information contained in this electronic message and any attachments to this message are intended for the exclusive use of the addressee(s) and may contain proprietary, confidential or privileged information. If you are not the intended recipient, you should not disseminate, distribute or copy this e-mail. Please notify the sender immediately and destroy all copies of this message and any attachments. WARNING: Computer viruses can be transmitted via email. The recipient should check this email and any attachments for the presence of viruses. The company accepts no liability for any damage caused by any virus transmitted by this email. www.wipro.com

2 2

pairs xlat
by Arran Cudbard-Bell 25 Sep '14

25 Sep '14

Don't know how many people will find this useful, but I just added a pairs xlat. It'll serialize one or more value pairs into a string. The format is the same as pairs in the debug output, with strings being enclosed in single quotes and separated by commas. (0) update { (0) control:Cleartext-Password := 'hello' (0) request:Tmp-String-0 := 'This is a string' (0) request:Tmp-String-0 += 'This is another one' (0) request:Tmp-Octets-0 := 0x000504030201 (0) request:Tmp-Integer-0 := 7331 (0) request:Tunnel-Private-Group-Id:5 = '127.0.0.1' (0) reply:Filter-Id = 'filter' (0) } # update = noop (0) EXPAND %{pairs:request:} (0) --> User-Name = 'bob', User-Password = 'hello', Tmp-String-0 = 'This is a string', Tmp-String-0 = 'This is another one', Tmp-Octets-0 = 0x000504030201, Tmp-Integer-0 = 7331, Tunnel-Private-Group-Id:5 = '127.0.0.1' You can use any qualifiers or selectors you'd use in a condition or the RHS of an update pair. For example outer.request:Tmp-String-0[*] will get you all instances of the Tmp-String-0 attribute in the outer request. This is useful for use in the linelog module, where you can easily construct messages containing AVPs. That's then intended for use with log aggregators such as Splunk, which should automatically parse the message into a list of attributes and values. -Arran Arran Cudbard-Bell <a.cudbardb(a)freeradius.org> FreeRADIUS development team FD31 3077 42EC 7FCD 32FE 5EE2 56CF 27F9 30A8 CAA2

1 0

Re: Module Statistics in freeradius
by Alan DeKok 25 Sep '14

25 Sep '14

Himanshu Pandey wrote: > I am a bit confused right now. You keep changing what you're asking for. The server already keeps track of total packet counts for Access-Request, Access-Accept, etc. The server does NOT keep track of statistics for module return codes. The server already keeps track of total packet counts for clients, listeners, and home servers. The server does NOT keep track of statistics (anything) per module. > You mean to say that if suppose I want > the number of authorize request that were OK,UPDATED,FAILED,HANDLED or > REJECTED to be printed then I can use the radmin. Since the server DOES > keep track of statistics per listener. And prints them out. > > Is it correct? No. If you run the "help" command from radmin, you will see what it's keepings statistics for. If you run the appropriate statistics command, you will see which statistics it keeps. It's that easy. You should try it, rather than asking confusion questions on the list. All of the answers are ALREADY in front of you. Alan DeKok.

1 0

Re: Module Statistics in freeradius
by Himanshu Pandey 25 Sep '14

25 Sep '14

Hi Alan, I am a bit confused right now. You mean to say that if suppose I want the number of authorize request that were OK,UPDATED,FAILED,HANDLED or REJECTED to be printed then I can use the radmin. Since the server DOES keep track of statistics per listener.  And prints them out. Is it correct? Regards, Sonu From: Alan DeKok <aland(a)deployingradius.com> Sent: Thu, 25 Sep 2014 19:53:03 To: FreeRadius users mailing list <freeradius-users(a)lists.freeradius.org> Subject: Re: Module Statistics in freeradius Himanshu Pandey wrote: > Suppose for auth requests I want the statistics of authorize module. So > in listen.c I have seen a function call ret_code=process_authorize();. > So whatever is the ret_code of this module according to that a server > replies to NAS.  That's not what you originally said.  The server DOES keep track of statistics per listener.  And prints them out.  See the radmin "help" command. > If you find this OK, the same thing I will follow for Accounting and > Authentication requests as well.  There's no need.  Alan DeKok. - List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html

1 0