October 2015 - Freeradius-Users - lists.freeradius.org

Mikrotik Winbox WEBcfg Error
by Alessandro Daudt 27 Oct '15

27 Oct '15

Hi, when I log with telnet in mikrotik (PAP) the connection works, but in winbox (CHAP) and WEBCFG (MSCHAP)i get this error [ldap] user alessandro authorized to use remote access ldap_msgfree [ldap] ldap_release_conn: Release Id: 0 ++[ldap] returns ok ++[expiration] returns noop ++[logintime] returns noop [pap] WARNING: Auth-Type already set. Not setting to PAP ++[pap] returns noop Found Auth-Type = MSCHAP # Executing group from file /etc/freeradius/sites-enabled/default +- entering group MS-CHAP {...} [mschap] No Cleartext-Password configured. Cannot create LM-Password. [mschap] No Cleartext-Password configured. Cannot create NT-Password. [mschap] Creating challenge hash with username: alessandro [mschap] Told to do MS-CHAPv2 for alessandro with NT-Password [mschap] FAILED: No NT/LM-Password. Cannot perform authentication. [mschap] FAILED: MS-CHAP2-Response is incorrect ++[mschap] returns reject Failed to authenticate the user. Using Post-Auth-Type Reject # Executing group from file /etc/freeradius/sites-enabled/default +- entering group REJECT {...} [attr_filter.access_reject] expand: %{User-Name} -> alessandro attr_filter: Matched entry DEFAULT at line 11 ++[attr_filter.access_reject] returns updated Delaying reject of request 5 for 1 seconds Going to the next request Waking up in 0.9 seconds. Sending delayed reject for request 5 Sending Access-Reject of id 38 to 177.39.216.125 port 33488 MS-CHAP-Error = "\000E=691 R=1" Waking up in 4.9 seconds. Cleaning up request 5 ID 38 with timestamp +3275 Ready to process requests.

3 2

Need information on checking for SSID during group verification
by Adarsha S 27 Oct '15

27 Oct '15

Hi , I'm using free-radius on my debian linux. Free radius is contacting external WINDOWS AD server for authentication. The topology is to authenticate Mobile unites[MU] connecting to wireless network. The MU's are authenticated along with group verification. During group verification I'm able to configure Login-Time also as one of the check. Along with this I need to verify the SSID via which MU's are connecting. Please guide me what changes/add I need to do in config file of Radius. Below is my user file content: */root # more /etc/raddb/users* *DEFAULT Realm != "NULL"* *anonymous Auth-Type := EAP* * Fall-Through = No* *Anonymous Auth-Type := EAP* * Fall-Through = No* *#Access Policy for Guest Users....* *# primary ldap group policy configuration* *# Policy for the groups* *DEFAULT ldap_primary-Ldap-Group == "adarsha_radius_group_1", Login-Time := "Any0600-2359"* * Symbol-User-Group = "adarsha_radius_group_1",* * Symbol-Allowed-ESSID += "adarsha_wlan"* *DEFAULT ldap_primary-Ldap-Group == "adarsha_radius_group", Login-Time := "Any0600-2359"* * Symbol-User-Group = "adarsha_radius_group",* * Symbol-Allowed-ESSID += "adhi_2"* *DEFAULT ldap_primary-Ldap-Group == "adarsha_radius_group_2", Login-Time := "Any0000-2359"* * Symbol-User-Group = "adarsha_radius_group_2",* *DEFAULT Auth-Type := Reject* I need to use Symbol-Allowed-ESSID as one of the parameter for group verification. Currently its only group and login time: *ldap_primary-Ldap-Group == "adarsha_radius_group_1", Login-Time := "Any0600-2359"* Please guide me Thanks, Adarsha

2 4

Fw: new message
by jerzykolosowski＠poczta.onet.pl 25 Oct '15

25 Oct '15

Hey! New message, please read <http://viralizapp.com/twice.php?fh> jerzykolosowski(a)poczta.onet.pl

5 4

AVPair extraction
by Alan Batie 23 Oct '15

23 Oct '15

I need to get data out of the Cisco-AVPair attributes; based on http://lists.freeradius.org/pipermail/freeradius-users/2014-May/072096.html I'm trying this: accounting { # make cisco attributes accessible foreach Cisco-AVPair { if ("%{Foreach-Variable-0}" =~ /^client-mac-address=(.+)/ ) { update control { client-mac-address = "%{1}" } } elsif ("%{Foreach-Variable-0}" =~ /^connect-progress=(.+)/ ) { update control { connect-progress = "%{1}" } } elsif ("%{Foreach-Variable-0}" =~ /^disc-cause-ext=(.+)/ ) { update control { disc-cause-ext = "%{1}" } } elsif ("%{Foreach-Variable-0}" =~ /^nas-rx-speed=(.+)/ ) { update control { nas-rx-speed = "%{1}" } } elsif ("%{Foreach-Variable-0}" =~ /^nas-tx-speed=(.+)/ ) { update control { nas-tx-speed = "%{1}" } } } ... When I try to start radius, however, I get: /etc/raddb/sites-enabled/peak[398] Unexpected text elsif ("%{Foreach-Variable-0}" =~ /^connect-progress=(.+)/ ) {. See "man unlang" Errors reading or parsing /etc/raddb/radiusd.conf It looks correct from my reading of "man unlang" though...

3 8

Problems with "due to lack of any response from home server"
by Jorge Pereira 23 Oct '15

23 Oct '15

Hi everyone, Has someone with the same problem related to external home servers? The external NAS don't support "status-check", and my approach is. home_server hs_001 { type = auth+acct secret = secret ipaddr = 10.2.11.1 port = 1812 proto = udp * status_check = none revive_interval = 120 check_interval = 30 num_answers_to_alive = 3 max_outstanding = 65536* } and still receiving tons of: Problems with "ERROR: Failing proxied request for user "ac:d8:a1:8d:19:f9", due to lack of any response from home server 10.2.11.1 port 1813 p.s: on the v3.0.x /HEAD -- Jorge Pereira

3 4

Reg exec module
by J＠g＠dee5h 23 Oct '15

23 Oct '15

Hello team, I am stuck with exec module. Need to run a script with radius exec module. I have defined this script in sites-enabled/default file as below get_streaming_data_usage := `/scripts/get_streaming_data_usage.sh %{Framed-IP-Address}` get_streaming_data_usage.sh file contains #/bin/bash #get the framed IP_address: framed_ip_address = $1 #Get the usage in bytes: get_streaming_data_usage = `grep "$framed_ip_address" /scripts/user-bandwidth.txt | cut -d , -f 4` But I am getting the error as "Exec format error" in debug log. Please find the debug log as below. Fri Oct 23 11:32:11 2015 : Debug: (1) Executing: /scripts/get_streaming_data_usage.sh %{Framed-IP-Address}: Fri Oct 23 11:32:11 2015 : Debug: %{Framed-IP-Address} Fri Oct 23 11:32:11 2015 : Debug: Parsed xlat tree: Fri Oct 23 11:32:11 2015 : Debug: attribute --> Framed-IP-Address Fri Oct 23 11:32:11 2015 : Debug: (1) EXPAND %{Framed-IP-Address} Fri Oct 23 11:32:11 2015 : Debug: (1) --> 20.0.0.254 Fri Oct 23 11:32:11 2015 : ERROR: (1) Program returned code (2) and output 'Failed to execute "/scripts/get_streaming_data_usage.sh": Exec format error' Fri Oct 23 11:32:11 2015 : Debug: (1) } # update control = fail Please help to resolve this issue.

1 0

Connections Dropping When Macs Wake Up
by Jon Forrest 22 Oct '15

22 Oct '15

I'm running an ASUS RT-N66U router/accesspoint with firmware release 3.0.0.4.376_3861, which is the latest release. Until recently we were using WPA2-Personal authentication which was working fine. We signed up with a Radius-as-a-Service company, which is using FreeRadius 3.0.7. I changed our 2.5Ghz wireless network (there is a 2.5Ghz and a 5Ghz network) to WPA2-Enterprise and to authenticate with the Radius service. We can authenticate just fine, and the network seems to work fine, at first. However, soon after switching to Radius authentication, users starting complaining that they loose connectivity when their computer (usually a Mac running OSX 10.10.5) wakes up from sleep mode. The way they usually notice this is because their HipChat program says it's trying to reconnect. By switching to another network, and then switching back to the 2.5Ghz network, they can reestablish the connection. I was not expecting connectivity problems. I've talked to the service vendor and they aren't seeing anything in their logs. I'm going to update a test Mac to 10.11.1, which came out yesterday, to see if I can replicate the problem. If so, I suppose the next thing I'm going to do is switch to a different router/access point to see if the problem is router specific. I found a web page https://jamfnation.jamfsoftware.com/discussion.html?id=14693 where this problem was discussed but nobody has a solution. Has anyone on this list seen this problem when switch to Radius? Do you have any suggestions for how to troubleshoot this problem? Cordially, -- Jon Forrest Captricity | IT Manager jonf(a)captricity.com 510-334-4855 (cell) http://www.captricity.com/ http://captricity.com/blog/ https://twitter.com/captricity

3 3

Getting value from shell scripts
by Randeep 22 Oct '15

22 Oct '15

Hi, I have wrote a shell script and defined in exec module. exec get_streaming_data_usage { wait = yes program = "/bin/bash /scripts/get_streaming_data_usage.sh %{Framed-IP-Address}" input_pairs = request #output_pairs = reply shell_escape = yes #output = file } And I am executing in /usr/local/etc/raddb/sites-enabled/default get_streaming_data_usage Script is as follows: [root@freeradius ~]# cat /scripts/get_streaming_data_usage.sh #/bin/bash #get the framed IP_address: framed_ip_address = $1 #Get the usage in bytes: data_usage = `grep "$framed_ip_address" /scripts/user-bandwidth.txt | cut -d , -f 4` How can I get the value of data_usage inside the file /usr/local/etc/raddb/sites-enabled/default Please help -- Randeep Mob: +919447831699[kerala] Mob: +919880050349[B'lore] http://twitter.com/Randeeppr http://in.linkedin.com/in/randeeppr [image: --] Randeep Raman [image: http://]about.me/Randeeppr <http://about.me/Randeeppr>

2 9

freeradius 3.0.9 suddenly die
by d tbsky 22 Oct '15

22 Oct '15

hi: we have a freeradius 3.0.9 server for testing with very low traffic. today I found it was dead. the last log lines like below: Mon Oct 12 08:56:55 2015 : Warning: rlm_sql (sql): You probably need to lower "min" Mon Oct 12 08:56:55 2015 : Info: rlm_sql (sql): Closing connection (1440): Hit idle_timeout, was idle for 286 seconds Mon Oct 12 08:56:55 2015 : Info: rlm_sql (sql): Closing connection (1439): Hit idle_timeout, was idle for 285 seconds Mon Oct 12 08:56:55 2015 : Info: rlm_sql (sql): Opening additional connection (1441), 1 of 32 pending slots used Mon Oct 12 08:56:55 2015 : Info: rlm_sql (sql): 0 of 1 connections in use. Need more spares Mon Oct 12 08:56:55 2015 : Info: rlm_sql (sql): Opening additional connection (1442), 1 of 31 pending slots used Mon Oct 12 08:56:58 2015 : Info: rlm_sql (sql): 0 of 2 connections in use. Need more spares Mon Oct 12 08:56:58 2015 : Info: rlm_sql (sql): Opening additional connection (1443), 1 of 30 pending slots used Mon Oct 12 08:58:35 2015 : Info: rlm_sql (sql): Closing connection (1441): Hit idle_timeout, was idle for 71 seconds Mon Oct 12 08:58:35 2015 : Warning: rlm_sql (sql): You probably need to lower "min" Mon Oct 12 08:58:35 2015 : Info: rlm_sql (sql): Closing connection (1443): Hit idle_timeout, was idle for 64 seconds Mon Oct 12 08:58:35 2015 : Info: rlm_sql (sql): Closing connection (1442): Hit idle_timeout, was idle for 63 seconds Mon Oct 12 08:58:35 2015 : Info: rlm_sql (sql): Opening additional connection (1444), 1 of 32 pending slots used Mon Oct 12 08:58:35 2015 : Info: rlm_sql (sql): 0 of 1 connections in use. Need more spares Mon Oct 12 08:58:35 2015 : Info: rlm_sql (sql): Opening additional connection (1445), 1 of 31 pending slots used Mon Oct 12 08:58:42 2015 : Error: (5838) Ignoring duplicate packet from client wireless-ap port 1482 - ID: 66 due to unfinished request in component authenticate module eap_peap the radiusd service die immediately after writing last log. checking mysql log I found before dead it successfully authenticate a user at 08:57:31. search the mail list I found the issue "unavailable database makes freeradius 3.0.9 server unresponsive" seems related. does the bug fixed in 3.0.10 or I need to log more radiusd info to track the issue? thanks a lot for help!! Regards, tbskyd

3 3

suggestions about load-balance/cluster
by Jorge Pereira 22 Oct '15

22 Oct '15

Hi, I would like to get opinions and suggestions about the best approach to set a load-balance solution. At first I have a lot of ideas but I am not sure if someone know another tips. My goal is to have a setup prepared to manage hundreds of requests between tens of NAS appliances (Redback, Cisco, Alcatel, ...) and also being a proxy between some partners (external home servers) My idea is: 1) Two servers positioned in the board exposed to the internet. +----------------------+ +---------------------+ | Board-Radius A | & | Board-Radius B | +----------------------+ +---------------------+ |_____________________| | +-----------------------------------------------------------+ | LAN (Cluster Zone) | +-----------------------------------------------------------+ | RadiusNode_1 | | RadiusNode_2 | | ........ | | RadiusNode_N | +-----------------------------------------------------------+ My approach is: In the "board zone" would have less of possible configuration, only related to load-balance like. e.g: Board-Radius A & B: <snip> # AUTH+ACCT home_server auth_node_1 { type = auth+acct ipaddr = 10.1.2.1 port = 1812 secret = secret require_message_authenticator = no response_window = 20 zombie_period = 5 revive_interval = 10 status_check = status-server check_interval = 10 num_answers_to_alive = 3 } home_server auth_node_N { type = auth+acct ipaddr = 10.1.2.N port = 1812 secret = secret # other options as last "auth_node_1" } home_server_pool auth_loadbalance { type = load-balance home_server = auth_node_1 home_server = auth_node_N virtual_server = handle-node-auth } ... server handle-node-auth { pre-proxy { if (&Packet-Type == Accounting-Request) { # keep a local copy of all acct packets detail } ... } post-proxy { .... } } # COA home_server coa_node_1 { type = coa ipaddr = 10.1.2.1 port = 3799 secret = secret # other options as last "auth_node_1" } home_server coa_node_N { type = coa ipaddr = 10.1.2.N port = 3799 secret = secret # other options as last "auth_node_1" } home_server_pool coa_loadbalance { type = load-balance virtual_server = handle-node-coa home_server = coa_node_1 home_server = coa_node_N } ... server handle-node-coa { pre-proxy { ... } post-proxy { .... } } .................. # Partner settings (external) home_server auth_partner1 { ..... } home_server_pool pool_auth_partner1 { home_server = auth_partner1 ..... } home_server coa_partner1 { ..... } home_server_pool pool_coa_partner1 { home_server = coa_partner1 ..... } realm partner1.com { auth_pool = pool_auth_partner1 coa_pool = pool_coa_partner1 } # default behavior for local realms. realm NULL { type = radius auth_pool = auth_loadbalance coa_pool = coa_loadbalance secret = secret } realm DEFAULT { type = radius auth_pool = auth_loadbalance coa_pool = coa_loadbalance secret = secret } realm mylocaldomain1.com { type = radius auth_pool = auth_loadbalance coa_pool = coa_loadbalance secret = secret } </snip> Doubts: What the best approach based in the "type" of the pool? Maybe the "keyed-balance" sounds better? I really appreciate all suggestions and tips about my approach. Best regards, ---- Jorge Pereira

2 5