October 2015 - Freeradius-Users - lists.freeradius.org

vendor-specific problem in 3.0.4 vs. 2.1.12
by Rob McKennon 08 Oct '15

08 Oct '15

Hi, I'm trying to get super-micro's IPMI to work with freeradius. Their latest docs say to use freeradius 2.1.12, and it does work. Using this in the users file: "radius_admin" Cleartext-Password := "123456" Vendor-Specific = "H=4, I=4" I get the following results: Found Auth-Type = PAP # Executing group from file /usr/local/etc/raddb/sites-enabled/default +- entering group PAP {...} [pap] login attempt with password "123456" [pap] Using clear text password "123456" [pap] User authenticated successfully ++[pap] returns ok # Executing section post-auth from file /usr/local/etc/raddb/sites-enabled/default +- entering group post-auth {...} ++[exec] returns noop Sending Access-Accept of id 0 to 10.50.30.51 port 43540 Vendor-Specific = 0x483d342c20493d34 Finished request 0. But when I try using freeradius 3.0.4 with the same radius-admin user, I get this result: (0) Sending Access-Accept packet to host 10.50.30.51 port 38957, id=0, length=0 (0) Vendor-Specific = UNKNOWN-TYPE Sending Access-Accept Id 0 from 10.10.30.32:1812 <http://10.10.30.32:1812> to 10.50.30.51:38957 <http://10.50.30.51:38957> Vendor-Specific = UNKNOWN-TYPE (0) ERROR: Failed sending reply: ERROR: Unknown attribute type 21 (0) Finished request So, I'm not sure how version 3 differs from version 2.1.12 in handling of the Vendor-specific attributes, but is there a way to make this work in version 3 / something I need to tweak? Rob

2 2

"WARNING: !! EAP session for state ... did not finish!", And Other Warnings
by Jim Seymour 07 Oct '15

07 Oct '15

Hi All, FreeRADIUS v2.2.9 So I successfully upgraded to 2.2.9, via the Launchpad. (Thanks, Fajar!) Now the test MS-Win7 Pro laptop complains that it can't connect, but does, anyway. Windows. Go figure. Running the service with -X, I see: WARNING: !! EAP session for state ... did not finish! Now the Wiki claims this is because of certificate problems. But if that's so: Why have I never experienced this with the exact same clients with FreeRADIUS 1.1.1 and certs generated the exact same way? Found this: http://lists.freeradius.org/pipermail/freeradius-users/2011-October/056497.… But no clue what "the cause was an MTU issue." The only mention on the Wiki page is a cryptic "Consider to decreasing the tunnel MTU" with no clue as to how that might be accomplished. Searching on the question results in "You don't." Saw a suggestion from Alan DeKok to set the fragment size in eap.conf. Uncommented "fragment_size = 1024". Didn't change anything. I'm also seeing... Twice: [pap] WARNING! No "known good" password found for the user. Authentication may fail because of this . Once: WARNING: Empty post-auth section. Using default return values. Wasn't able to find anything helpful for those, either. Thanks, Jim -- Note: My mail server employs *very* aggressive anti-spam filtering. If you reply to this email and your email is rejected, please accept my apologies and let me know via my web form at <http://jimsun.LinxNet.com/contact/scform.php>.

6 19

radius CoA client for PPTP box
by Brock Eastman 07 Oct '15

07 Oct '15

I am currently trying to implement radius CoA on a NAS client using freeradius to handle the listening of inbound packets. I need to add a feature to change the shaping policy on the fly from our radius system to each existing NAS. Freeradius appears to employ a nice framework to accomplish this such as PPTP/PPPOE servers for an ISP environment. I originally started out with a PHP socket program that listened on port 3799 - it worked but has compatibility issues with older php4 systems that I must still support. I am not trying to proxy anything, just straight listen for packets, send the attributes to a secondary program and change rate shaping or disconnect users on the fly. I have no problems sending requests from my radius server to the NAS hosting the radius CoA listener on port 3799. RADIUS AUTH/ACCT SERVER - > SEND REQUEST ON PORT 3799 Radclient call - echo "User-Name = test, Framed-IP-Address=198.204.209.33, NAS-Port=382" | radclient -x 198.204.208.XX:3799 coa mypass What I need is in the recv-coa section to allow me to send a remote command using exec. So far nothing has worked for me. I've dug around in the documentation all day without anything working. I'm validating the php script runs by touching a filesystem command and running the daemon in debug mode from the command line to see the output. But the php is never called. ----------------snippet from radiusd.conf server coa { # When a packet is received, it is processed through the # recv-coa section. This applies to *both* CoA-Request and # Disconnect-Request packets. recv-coa { # CoA && Disconnect packets can be proxied in the same # way as authentication or accounting packets. # Just set Proxy-To-Realm, or Home-Server-Pool, and the # packets will be proxied. # Insert your own policies here. update control { Auth-Type:=`/usr/bin/php /usr/local/bin/radius_coa.php %{User-Name}` } ok } } ----------------------- Here is the output I have .. successfully getting data into freeradius NAS from central radius... radiusd -X ... adding new socket proxy address * port 53450 Listening on coa address * port 3799 Listening on accounting address * port 1813 Listening on command file /var/run/radiusd/radiusd.sock Listening on authentication address 127.0.0.1 port 18120 as server inner-tunnel Listening on proxy address * port 1151 Ready to process requests. rad_recv: CoA-Request packet from host 198.204.208.XX port 39238, id=55, length=38 User-Name = "test" Framed-IP-Address = 198.204.209.33 NAS-Port = 382 WARNING: Empty recv-coa section. Using default return values. WARNING: Empty send-coa section. Using default return values. Sending CoA-ACK of id 55 to 198.204.208.XX port 39238 Finished request 0. Going to the next request Cleaning up request 0 ID 55 with timestamp +23 Ready to process requests. ------------------------------------------------------ I am sure this is something simple to fix. Thanks Brock Eastman VP Engineering DigitalPath, Inc

2 3

Version 3.0.10 has been released
by Alan DeKok 07 Oct '15

07 Oct '15

It was delayed (again) for one last issue. The result is a nice clean release, with a whole lot of new tests and features. The full change log is available at: http://freeradius.org/press/index.html#3.0.10 We'd like to thank Matthew Newton, Herwin Weststrate, Christopher Hoskin, Alan Buxey, and and Jorge Pereira for a ton of cleanups and fixes, especially for Debian builds. Input from the community helps "round out" the functionality of FreeRADIUS. Alan DeKok.

5 6

Minor 3.10 debian packaging bug
by Fajar A. Nugraha 06 Oct '15

06 Oct '15

Tested on ubuntu trusty, /etc/init.d/freeradius looks for pid file on /var/run/freeradius/freeradius.pid, yet by default the server writes /var/run/radiusd/radius.pid. This cause the init script to always thinks freeradius is not running, making "service freeradius status" return the wrong information, and "service freeradius restart" fails. Editing radiusd.conf from name = radiusd to name = freeradius fixed this issue. -- Fajar

3 5

Old-style Acct-Unique-Session-Id hashing
by Lotkov Svyatoslav 06 Oct '15

06 Oct '15

Hello everybody. I wrote a policy fo FR 3.x that hashes Acct-Unique-Session-ID like in FR 2.x This helps me migrate from 2.x to 3.x Is there any reason to commit this code to 3.x branches ? The code is: (in raddb/policy.d/acct_unique_fr2) # # Old rlm_acct_unique style hashing # This code does the same thing, as in FR 2.x # Written by Svyatoslav Lotkov, 2015 # acct_unique2 { # # The default settings in modules/acct_unique looks like: # # acct_unique { # key = "User-Name, Acct-Session-Id, NAS-IP-Address, NAS-Port" # } # # We have to list values for the key in reverse order plus add the 0x00 in the end of string. Then calculate md5 # # update request { &Tmp-Octets-0 := "NAS-Port = %{NAS-Port},NAS-IP-Address = %{NAS-IP-Address},Acct-Session-Id = \"%{Acct-Session-ID}\",User-Name = \"%{User-Name}\"" &Tmp-String-0 := "%{&Tmp-Octets-0}00" &Tmp-Octets-1 := "%{string:&Tmp-String-0}" &Tmp-String-1 := "%{md5:&Tmp-Octets-1}" } if ( &Tmp-String-1 =~ /(.{1,16})/i ) { update request { &Acct-Unique-Session-Id := "%{1}" } } }

2 1

send an "coa" packet from "authorize {}" section
by Jorge Pereira 05 Oct '15

05 Oct '15

Hi, I need to send a COA to another NAS during the section "authorize { }", below my current approach. 1) I receive the "Access-Request" Sun Oct 4 18:19:33 2015 : Debug: (0) Received Access-Request Id 227 from 10.1.2.128:42305 to 192.168.56.90:1812 length 46 Sun Oct 4 18:19:33 2015 : Debug: (0) User-Name = "ca:de:ca:fe:00:01" Sun Oct 4 18:19:33 2015 : Debug: (0) Acct-Session-Id = "12345" Sun Oct 4 18:19:33 2015 : Debug: (0) session-state: No State attribute Sun Oct 4 18:19:33 2015 : Debug: (0) # Executing section authorize from file /etc/freeradius/sites-enabled/mcare-nas-portal Sun Oct 4 18:19:33 2015 : Debug: (0) authorize { 2) Build a "coa" packet and build to the home-server. *Sun Oct 4 18:19:33 2015 : Debug: (0) update coa {* *Sun Oct 4 18:19:33 2015 : Debug: (0) &Packet-Type := CoA-Request* *Sun Oct 4 18:19:33 2015 : Debug: (0) &Acct-Session-Id := "12345"* *Sun Oct 4 18:19:33 2015 : Debug: (0) &Home-Server-Pool := coa_pool_wifilabs* *Sun Oct 4 18:19:33 2015 : Debug: (0) } # update coa = noop* Sun Oct 4 18:19:33 2015 : Debug: (0) modsingle[authorize]: calling handled (rlm_always) for request 0 Sun Oct 4 18:19:33 2015 : Debug: (0) modsingle[authorize]: returned from handled (rlm_always) for request 0 Sun Oct 4 18:19:33 2015 : Debug: (0) [handled] = handled Sun Oct 4 18:19:33 2015 : Debug: (0) } # authorize = handled 3) From this point, I can't figure out about the best way to wait and only responds after coa feedback. Sun Oct 4 18:19:33 2015 : Debug: (0) There was no response configured: rejecting request Sun Oct 4 18:19:33 2015 : Debug: (0) Using Post-Auth-Type Reject Sun Oct 4 18:19:33 2015 : Debug: (0) Post-Auth-Type sub-section not found. Ignoring. 4) Below the behavior of home-server (mcare-nas-radius-wifilabs)... was sent with success! Sun Oct 4 18:19:33 2015 : Debug: (0) # Executing group from file /etc/freeradius/sites-enabled/mcare-nas-portal Sun Oct 4 18:19:33 2015 : Debug: (0) server mcare-nas-radius-wifilabs { Sun Oct 4 18:19:33 2015 : Debug: (0) Empty pre-proxy section in virtual server "mcare-nas-radius-wifilabs". Using default return values. Sun Oct 4 18:19:33 2015 : Debug: (0) } Sun Oct 4 18:19:33 2015 : Debug: (0) proxy: Trying to allocate ID (0/2) Sun Oct 4 18:19:33 2015 : Debug: (0) proxy: request is now in proxy hash Sun Oct 4 18:19:33 2015 : Debug: (0) proxy: allocating destination 10.11.10.22 port 1812 - Id 25 Sun Oct 4 18:19:33 2015 : Debug: (0) session-state: Nothing to cache *Sun Oct 4 18:19:33 2015 : Debug: (0) Sent CoA-Request Id 25 from 0.0.0.0:57493 <http://0.0.0.0:57493> to 10.11.10.22:1812 <http://10.11.10.22:1812> length 27* Sun Oct 4 18:19:33 2015 : Debug: (0) Acct-Session-Id := "12345" Sun Oct 4 18:19:33 2015 : Debug: (0) Delaying response for 1.000000 seconds Sun Oct 4 18:19:33 2015 : Debug: Waking up in 0.3 seconds. Sun Oct 4 18:19:33 2015 : Proxy: (0) Marking home server 10.11.10.22 port 1812 alive Sun Oct 4 18:19:33 2015 : Debug: (0) Clearing existing &reply: attributes *Sun Oct 4 18:19:33 2015 : Debug: (0) Received CoA-ACK Id 25 from 10.11.10.221812 to 192.168.56.90:57493 <http://192.168.56.90:57493> length 75* Sun Oct 4 18:19:33 2015 : Debug: (0) Reply-Message = "AAA->NOKIA() listen::type=coa,port::1812 pack-type=(CoA-Request)" 5) I would like to get the received response from home-server and threat to reponse Access-Accept (if CoA-ACK) or Access-Reject (if CoA-NAK) Sun Oct 4 18:19:33 2015 : Debug: (0) server mcare-nas-radius-wifilabs { Sun Oct 4 18:19:33 2015 : Debug: (0) # Executing section post-proxy from file /etc/freeradius/sites-enabled/mcare-nas-radius-wifilabs Sun Oct 4 18:19:33 2015 : Debug: (0) post-proxy { Sun Oct 4 18:19:33 2015 : Debug: (0) update control { Sun Oct 4 18:19:33 2015 : Debug: (0) &Auth-Type := Accept Sun Oct 4 18:19:33 2015 : Debug: (0) &Response-Packet-Type := Access-Accept Sun Oct 4 18:19:33 2015 : Debug: (0) &Packet-Type := Access-Accept Sun Oct 4 18:19:33 2015 : Debug: (0) } # update control = noop Sun Oct 4 18:19:33 2015 : Debug: (0) update request { Sun Oct 4 18:19:33 2015 : Debug: (0) &Auth-Type := Accept Sun Oct 4 18:19:33 2015 : Debug: (0) &Response-Packet-Type := Access-Accept Sun Oct 4 18:19:33 2015 : Debug: (0) &Packet-Type := Access-Accept Sun Oct 4 18:19:33 2015 : Debug: (0) } # update request = noop Sun Oct 4 18:19:33 2015 : Debug: (0) update proxy-reply { Sun Oct 4 18:19:33 2015 : Debug: (0) &Auth-Type := Accept Sun Oct 4 18:19:33 2015 : Debug: (0) &Response-Packet-Type := Access-Accept Sun Oct 4 18:19:33 2015 : Debug: (0) &Packet-Type := Access-Accept Sun Oct 4 18:19:33 2015 : Debug: (0) } # update proxy-reply = noop Sun Oct 4 18:19:33 2015 : Debug: (0) modsingle[post-proxy]: calling updated (rlm_always) for request 0 Sun Oct 4 18:19:33 2015 : Debug: (0) [handled] = handled Sun Oct 4 18:19:33 2015 : Debug: (0) } # post-proxy = handled Sun Oct 4 18:19:33 2015 : Debug: (0) } Sun Oct 4 18:19:33 2015 : Debug: (0) Cleaning up request packet ID 227 with timestamp +286 Sun Oct 4 18:19:33 2015 : Debug: Waking up in 0.1 seconds. Sun Oct 4 18:19:33 2015 : Debug: Waking up in 0.6 seconds. I have tried all lists "request", "proxy-reply" and "control".... but, don't work! Sun Oct 4 18:19:34 2015 : Debug: (0) Sending delayed response Sun Oct 4 18:19:34 2015 : Debug: (0) Sent Access-Reject Id 227 from 192.168.56.90:1812 to 10.1.2.128:42305 length 20 Sun Oct 4 18:19:34 2015 : Debug: Waking up in 3.9 seconds. Any suggestions are welcome! -- Jorge Pereira

3 5

MSCHAPv2 Error message
by Arran Cudbard-Bell 05 Oct '15

05 Oct '15

Do any supplicants other than wpa_supplicant display the M= component to the users? -Arran Arran Cudbard-Bell <a.cudbardb(a)freeradius.org> FreeRADIUS development team FD31 3077 42EC 7FCD 32FE 5EE2 56CF 27F9 30A8 CAA2

2 1

Logging of DHCP queries/responses
by Hernán Freschi 04 Oct '15

04 Oct '15

Is there a way to log DHCP queries? I would like to keep a log of timestamp, MAC address and assigned IP address for every request. Something like: post-auth { sql } but for the DHCP module. Thanks

2 2

Freeradius 3.0.9 COA Disconnect Configuration
by Joaquin Alzola 04 Oct '15

04 Oct '15

Hi Guys, I have configured COA and have no problem on receiving and sending the COA package: Command: linux-8cwx:/usr/local/etc/raddb # cat coa-test.txt | radclient -x 192.168.56.101:3799 disconnect 'testing123' Sent Disconnect-Request Id 248 from 0.0.0.0:38327 to 192.168.56.101:3799 length 48 Acct-Session-Id = "00000580" User-Name = "root" NAS-IP-Address = 127.0.0.1 NAS-Port = 511 Received Disconnect-ACK Id 248 from 192.168.56.101:3799 to 0.0.0.0:0 length 20 Log: (13) Received Disconnect-Request Id 248 from 192.168.56.101:38327 to 192.168.56.101:3799 length 48 (13) Acct-Session-Id = "00000580" (13) User-Name = "root" (13) NAS-IP-Address = 127.0.0.1 (13) NAS-Port = 511 (13) # Executing section recv-coa from file /usr/local/etc/raddb/sites-enabled/coa (13) recv-coa { (13) [suffix] = noop (13) [ok] = ok (13) } # recv-coa = ok (13) # Executing section send-coa from file /usr/local/etc/raddb/sites-enabled/coa (13) send-coa { (13) [ok] = ok (13) } # send-coa = ok (13) Sent Disconnect-ACK Id 248 from 192.168.56.101:3799 to 192.168.56.101:38327 length 0 (13) Finished request (13) <done>: Cleaning up request packet ID 248 with timestamp +628 Ready to process requests Should I expect to see the root user with Session-ID 580 get disconnected? And to to trigger this disconnect automatically? BR Joaquin This email is confidential and may be subject to privilege. If you are not the intended recipient, please do not copy or disclose its content but contact the sender immediately upon receipt.

2 3