November 2015 - Freeradius-Users - lists.freeradius.org

RE: If block in authenticate statement
by Franks Andy (IT Technical Architecture Manager) 12 Nov '15

12 Nov '15

Hi, Sorry I didn't complete this email the other day.. I didn't realise you could set the EAP-Type to force the inner, that's great - thanks, it seems there are a good few better ways than an IF .. in the auth section. As for the authenticate bit, just for learning sake, and theory, should the below work? It seems daft putting if (ok) { ok } in there , but putting the explicit ok in anywhere else didn't seem to work, but this doesn't either. The mschap auth seems to be called from the Auth-Type inner-eap as a "sub-auth", and here I have a module catch for other failures, but not for ok : It's still doing a noop (I've edited the mschap script call out, which complete ok, just to keep the mail shorter): if (( control:SSID == "RSH_WiFi_2" ) || ( control:SSID == "Another_WiFi" )) { (12) eap_mschapv2: if (( control:SSID == "RSH_WiFi_2" ) || ( control:SSID == "Another_WiFi" )) -> TRUE (12) eap_mschapv2: if (( control:SSID == "RSH_WiFi_2" ) || ( control:SSID == "Another_WiFi" )) { .. .. mschap: Adding MS-CHAPv2 MPPE keys (12) [mschap] = ok (12) if ok { (12) if ok -> TRUE (12) if ok { (12) [ok] = ok (12) } # if ok = ok (12) ... skipping else for request 12: Preceding "if" was taken (12) } # if (( control:SSID == "RSH_WiFi_2" ) || ( control:SSID == "Another_WiFi" )) = ok (12) ... skipping else for request 12: Preceding "if" was taken (12) } # Auth-Type MS-CHAP = noop (12) inner-eap: Freeing handler (12) [inner-eap] = reject Auth-Type inner-eap { inner-eap { reject = 1 invalid = 1 } if (!ok) { ... Auth-Type MS-CHAP { # get ssid so we can check against mschapv2 allowed ssids get_ssid # allowed ssids. Commented out 06-11-2015 due to return status issues. if (( control:SSID == "RSH_WiFi_2" ) || ( control:SSID == "Another_WiFi" )) { mschap { reject = 1 invalid = 1 } if ok { ok } else { if (Module-Failure-Message) { # Could be that we've got a failure message or just debug information, depending on whether mschap i$ # seems sometimes that the failure goes straight to reject, sometimes via the outer tunnel which is $ # tunnel (above in mschap), and the outer anyway, so should be ok. update outer.control { Debug-RejectInformation := "%{Module-Failure-Message}" } } reject } } else { update control { Debug-RejectInformation := "PEAP - EAP - MSCHAPv2 not allowed!" } reject } } -----Original Message----- From: Freeradius-Users [mailto:freeradius-users-bounces+andy.franks=sath.nhs.uk@lists.freeradius.org] On Behalf Of Alan DeKok Sent: 09 November 2015 13:45 To: FreeRadius users mailing list Subject: Re: If block in authenticate statement On Nov 9, 2015, at 8:28 AM, Franks Andy (IT Technical Architecture Manager) <Andy.Franks(a)sath.nhs.uk> wrote: > I did try the OK bit at the end of the module, but it still returns noop, which is what confuses me. What was the exact configuration you tried? > Whether I did the ok bit in the correct place is debateable but I did try it in the logical places. Does the ok placement need to be after an "else" statement? It needs to be wherever you want to set the return code to be "ok". > Anyway, onto why - I don't want to flat reject people using that SSID, just people who use PEAP and use mschapv2 (instead of TLS) on certain SSIDs. In certain circumstances I might want them to be allowed if they bring me sweets at Christmas for example. Then configure that... authorize { ... eap ... if ((SSID == "no-peap") && (EAP-Type == PEAP)) { reject } ... } Or, you can do the same thing in the inner tunnel. But realistically, why ban certain configurations? Why not configure the client correctly? And then configure the server to use only one authentication method? > The problem is we (afaik) don't find out what the auth type is until the authorize stage where that module (eap in this case) sets it, and the inner auth type here is a few layers into the onion, that's why it sort of made sense to me to do it at "final" authenticate stage. I could probably also do it post-auth too I guess, pass it then check and reject.. That would work, too. Or, you could just set EAP-Type for particular users. server inner-tunnel { authorize { ... if (WiFi == "no-inner-mschap") { update control { EAP-Type := TLS # force outer PEAP, inner TLS } } ... eap ... } } > The custom debug message was an "overall" delivery message to the indicate why failure had occurred at any point in the chain. Module-Failure-Message only works on certain modules afaik (or did when I last asked) so failures in certain areas would yield blanks. I'd quite happily ditch that if all modules do it now! Most should... more do in v3.1.x. > I also think (from unreliable memory) that I had issues copying some of the attributes from inner to outer, some worked and some didn't - does the module-failure-message get automatically copied now from inner to outer layer? No. Alan DeKok. - List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html

1 0

RE: Attributes not being copied to inner tunnel
by Franks Andy (IT Technical Architecture Manager) 12 Nov '15

12 Nov '15

True on the dev code learning but we are using nice things like if (Attr[*] == ..), some nice changes in ldap for caching group and so on and I'm not sure if the codes has been merged into stable. Something to try though I guess! Thanks Andy -----Original Message----- From: Freeradius-Users [mailto:freeradius-users-bounces+andy.franks=sath.nhs.uk@lists.freeradius.org] On Behalf Of Matthew Newton Sent: 12 November 2015 12:28 To: FreeRadius users mailing list Subject: Re: Attributes not being copied to inner tunnel On Thu, Nov 12, 2015 at 10:29:50AM +0000, Franks Andy (IT Technical Architecture Manager) wrote: > FR 3.1 from git, although not updated for a little while.. You're probably best not learning on development code... > Sorry for the regular "help me!" posts, still learning! Does it work on latest stable (3.0.x) code? If so then may be a bug in 3.1. Though most of that code hasn't changed in 5 years. Matthew -- Matthew Newton, Ph.D. <mcn4(a)le.ac.uk> Systems Specialist, Infrastructure Services, I.T. Services, University of Leicester, Leicester LE1 7RH, United Kingdom For IT help contact helpdesk extn. 2253, <ithelp(a)le.ac.uk> - List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html

1 0

Using OpenWRT nas, identical shared secret, told "Shared secret is incorrect."
by Toyam Cox 11 Nov '15

11 Nov '15

Hey folks, Using FreeRadius on OpenBSD, version 2.2.7. I'm using a OpenWRT based nas client, identical shared secret, be it "testsecret" "secret1" "supersecure" or whatever, I'm told "Shared secret is incorrect." Below is my radiusd -X (Wow, my database password is in there. Glad I don't care about it) and the relevant configuration details on both the NAS table in Postgresql and the wireless configuration on the OpenWRT box. radiusd: FreeRADIUS Version 2.2.7, for host x86_64-unknown-openbsd5.8, built on Aug 8 2015 at 13:06:28 Copyright (C) 1999-2015 The FreeRADIUS server project and contributors. There is NO warranty; not even for MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. You may redistribute copies of FreeRADIUS under the terms of the GNU General Public License. For more information about these matters, see the file named COPYRIGHT. Starting - reading configuration files ... including configuration file /etc/raddb/radiusd.conf including configuration file /etc/raddb/clients.conf including files in directory /etc/raddb/modules/ including configuration file /etc/raddb/modules/acct_unique including configuration file /etc/raddb/modules/always including configuration file /etc/raddb/modules/attr_filter including configuration file /etc/raddb/modules/attr_rewrite including configuration file /etc/raddb/modules/cache including configuration file /etc/raddb/modules/chap including configuration file /etc/raddb/modules/checkval including configuration file /etc/raddb/modules/counter including configuration file /etc/raddb/modules/cui including configuration file /etc/raddb/modules/detail including configuration file /etc/raddb/modules/detail.example.com including configuration file /etc/raddb/modules/detail.log including configuration file /etc/raddb/modules/dhcp_sqlippool including configuration file /etc/raddb/modules/digest including configuration file /etc/raddb/modules/dynamic_clients including configuration file /etc/raddb/modules/echo including configuration file /etc/raddb/modules/etc_group including configuration file /etc/raddb/modules/exec including configuration file /etc/raddb/modules/expiration including configuration file /etc/raddb/modules/expr including configuration file /etc/raddb/modules/files including configuration file /etc/raddb/modules/inner-eap including configuration file /etc/raddb/modules/ippool including configuration file /etc/raddb/modules/linelog including configuration file /etc/raddb/modules/logintime including configuration file /etc/raddb/modules/mac2ip including configuration file /etc/raddb/modules/mac2vlan including configuration file /etc/raddb/modules/mschap including configuration file /etc/raddb/modules/ntlm_auth including configuration file /etc/raddb/modules/opendirectory including configuration file /etc/raddb/modules/otp including configuration file /etc/raddb/modules/pap including configuration file /etc/raddb/modules/passwd including configuration file /etc/raddb/modules/policy including configuration file /etc/raddb/modules/preprocess including configuration file /etc/raddb/modules/radrelay including configuration file /etc/raddb/modules/radutmp including configuration file /etc/raddb/modules/realm including configuration file /etc/raddb/modules/redis including configuration file /etc/raddb/modules/rediswho including configuration file /etc/raddb/modules/replicate including configuration file /etc/raddb/modules/smbpasswd including configuration file /etc/raddb/modules/smsotp including configuration file /etc/raddb/modules/soh including configuration file /etc/raddb/modules/sql_log including configuration file /etc/raddb/modules/sqlcounter_expire_on_login including configuration file /etc/raddb/modules/sradutmp including configuration file /etc/raddb/modules/unix including configuration file /etc/raddb/modules/wimax including configuration file /etc/raddb/eap.conf including configuration file /etc/raddb/sql.conf including configuration file /etc/raddb/sql/postgresql/dialup.conf including configuration file /etc/raddb/policy.conf including files in directory /etc/raddb/sites-enabled/ including configuration file /etc/raddb/sites-enabled/control-socket including configuration file /etc/raddb/sites-enabled/default including configuration file /etc/raddb/sites-enabled/inner-tunnel main { user = "_freeradius" group = "_freeradius" allow_core_dumps = no } including dictionary file /etc/raddb/dictionary main { name = "radiusd" prefix = "/usr/local" localstatedir = "/var" sbindir = "/usr/local/sbin" logdir = "/var/log/radius" run_dir = "/var/run/radiusd" libdir = "/usr/local/lib/freeradius" radacctdir = "/var/log/radius/radacct" hostname_lookups = no max_request_time = 30 cleanup_delay = 5 max_requests = 1024 pidfile = "/var/run/radiusd/radiusd.pid" checkrad = "/usr/local/sbin/checkrad" debug_level = 0 proxy_requests = no log { stripped_names = no auth = yes auth_badpass = yes auth_goodpass = no } security { max_attributes = 200 reject_delay = 1 status_server = yes allow_vulnerable_openssl = no } } radiusd: #### Loading Realms and Home Servers #### radiusd: #### Loading Clients #### client localhost { ipaddr = 127.0.0.1 require_message_authenticator = no secret = "testing123" nastype = "other" } radiusd: #### Instantiating modules #### instantiate { Module: Linked to module rlm_exec Module: Instantiating module "exec" from file /etc/raddb/modules/exec exec { wait = no input_pairs = "request" shell_escape = yes timeout = 10 } Module: Linked to module rlm_expr Module: Instantiating module "expr" from file /etc/raddb/modules/expr Module: Linked to module rlm_expiration Module: Instantiating module "expiration" from file /etc/raddb/modules/expiration expiration { reply-message = "Password Has Expired " } Module: Linked to module rlm_logintime Module: Instantiating module "logintime" from file /etc/raddb/modules/logintime logintime { reply-message = "You are calling outside your allowed timespan " minimum-timeout = 60 } } radiusd: #### Loading Virtual Servers #### server { # from file KQ@?D? modules { Module: Creating Auth-Type = digest Module: Checking authenticate {...} for more modules to load Module: Linked to module rlm_pap Module: Instantiating module "pap" from file /etc/raddb/modules/pap pap { encryption_scheme = "auto" auto_header = no } Module: Linked to module rlm_chap Module: Instantiating module "chap" from file /etc/raddb/modules/chap Module: Linked to module rlm_mschap Module: Instantiating module "mschap" from file /etc/raddb/modules/mschap mschap { use_mppe = yes require_encryption = no require_strong = no with_ntdomain_hack = no allow_retry = yes } Module: Linked to module rlm_digest Module: Instantiating module "digest" from file /etc/raddb/modules/digest Module: Linked to module rlm_unix Module: Instantiating module "unix" from file /etc/raddb/modules/unix unix { radwtmp = "/var/log/radius/radwtmp" } Module: Linked to module rlm_eap Module: Instantiating module "eap" from file /etc/raddb/eap.conf eap { default_eap_type = "md5" timer_expire = 60 ignore_unknown_eap_types = no cisco_accounting_username_bug = no max_sessions = 1024 } Module: Linked to sub-module rlm_eap_md5 Module: Instantiating eap-md5 Module: Linked to sub-module rlm_eap_leap Module: Instantiating eap-leap Module: Linked to sub-module rlm_eap_gtc Module: Instantiating eap-gtc gtc { challenge = "Password: " auth_type = "PAP" } Module: Linked to sub-module rlm_eap_tls Module: Instantiating eap-tls tls { rsa_key_exchange = no dh_key_exchange = yes rsa_key_length = 512 dh_key_length = 512 verify_depth = 0 CA_path = "/etc/raddb/certs" pem_file_type = yes private_key_file = "/etc/raddb/certs/server.pem" certificate_file = "/etc/raddb/certs/server.pem" CA_file = "/etc/raddb/certs/ca.pem" private_key_password = "whatever" dh_file = "/etc/raddb/certs/dh" fragment_size = 1024 include_length = yes check_crl = no cipher_list = "DEFAULT" make_cert_command = "/etc/raddb/certs/bootstrap" ecdh_curve = "prime256v1" cache { enable = no lifetime = 24 max_entries = 255 } verify { } ocsp { enable = no override_cert_url = yes url = "http://127.0.0.1/ocsp/" use_nonce = yes timeout = 0 softfail = no } } Module: Linked to sub-module rlm_eap_ttls Module: Instantiating eap-ttls ttls { default_eap_type = "md5" copy_request_to_tunnel = no use_tunneled_reply = no virtual_server = "inner-tunnel" include_length = yes } Module: Linked to sub-module rlm_eap_peap Module: Instantiating eap-peap peap { default_eap_type = "mschapv2" copy_request_to_tunnel = no use_tunneled_reply = no proxy_tunneled_request_as_eap = yes virtual_server = "inner-tunnel" soh = no } Module: Linked to sub-module rlm_eap_mschapv2 Module: Instantiating eap-mschapv2 mschapv2 { with_ntdomain_hack = no send_error = no } Module: Checking authorize {...} for more modules to load Module: Loading virtual module filter_username Module: Linked to module rlm_always Module: Instantiating module "reject" from file /etc/raddb/modules/always always reject { rcode = "reject" simulcount = 0 mpp = no } Module: Linked to module rlm_preprocess Module: Instantiating module "preprocess" from file /etc/raddb/modules/preprocess preprocess { huntgroups = "/etc/raddb/huntgroups" hints = "/etc/raddb/hints" with_ascend_hack = no ascend_channels_per_line = 23 with_ntdomain_hack = no with_specialix_jetstream_hack = no with_cisco_vsa_hack = no with_alvarion_vsa_hack = no } reading pairlist file /etc/raddb/huntgroups reading pairlist file /etc/raddb/hints Module: Linked to module rlm_detail Module: Instantiating module "auth_log" from file /etc/raddb/modules/detail.log detail auth_log { detailfile = "/var/log/radius/radacct/%{%{Packet-Src-IP-Address}:-%{Packet-Src-IPv6-Address}}/auth-detail-%Y%m%d" header = "%t" detailperm = 384 dirperm = 493 locking = no log_packet_header = no escape_filenames = no } Module: Linked to module rlm_realm Module: Instantiating module "suffix" from file /etc/raddb/modules/realm realm suffix { format = "suffix" delimiter = "@" ignore_default = no ignore_null = no } Module: Linked to module rlm_files Module: Instantiating module "files" from file /etc/raddb/modules/files files { usersfile = "/etc/raddb/users" acctusersfile = "/etc/raddb/acct_users" preproxy_usersfile = "/etc/raddb/preproxy_users" compat = "no" } reading pairlist file /etc/raddb/users reading pairlist file /etc/raddb/acct_users reading pairlist file /etc/raddb/preproxy_users Module: Linked to module rlm_sql Module: Instantiating module "sql" from file /etc/raddb/sql.conf sql { driver = "rlm_sql_postgresql" server = "localhost" port = "" login = "radius" password = "J89DtRVV0m7kOAXPmDQ10BEqCYYTiagwJ/1yyoIRMPlJMvfq8b68bZVBosAzvWZw/pDe4uOaTbVf" radius_db = "radius" read_groups = yes sqltrace = yes sqltracefile = "/var/log/radius/sqltrace.sql" readclients = yes deletestalesessions = yes num_sql_socks = 32 lifetime = 0 max_queries = 0 sql_user_name = "%{User-Name}" default_user_profile = "" nas_query = "SELECT id, nasname, shortname, type, secret, server FROM nas" authorize_check_query = "SELECT id, UserName, Attribute, Value, Op FROM radcheck WHERE Username = '%{SQL-User-Name}' ORDER BY id" authorize_reply_query = "SELECT id, UserName, Attribute, Value, Op FROM radreply WHERE Username = '%{SQL-User-Name}' ORDER BY id" authorize_group_check_query = "SELECT id, GroupName, Attribute, Value, op FROM radgroupcheck WHERE GroupName = '%{Sql-Group}' ORDER BY id" authorize_group_reply_query = "SELECT id, GroupName, Attribute, Value, op FROM radgroupreply WHERE GroupName = '%{Sql-Group}' ORDER BY id" accounting_onoff_query = "UPDATE radacct SET AcctStopTime = ('%S'::timestamp - '%{%{Acct-Delay-Time}:-0}'::interval), AcctSessionTime = (EXTRACT(EPOCH FROM ('%S'::timestamp with time zone - AcctStartTime::timestamp with time zone - '%{%{Acct-Delay-Time}:-0}'::interval)))::BIGINT, AcctTerminateCause = '%{Acct-Terminate-Cause}', AcctStopDelay = 0 WHERE AcctStopTime IS NULL AND NASIPAddress= '%{NAS-IP-Address}' AND AcctStartTime <= '%S'::timestamp" accounting_update_query = "UPDATE radacct SET FramedIPAddress = NULLIF('%{Framed-IP-Address}', '')::inet, AcctSessionTime = NULLIF('%{Acct-Session-Time}','')::BIGINT, AcctInputOctets = (('%{%{Acct-Input-Gigawords}:-0}'::bigint << 32) + '%{%{Acct-Input-Octets}:-0}'::bigint), AcctOutputOctets = (('%{%{Acct-Output-Gigawords}:-0}'::bigint << 32) + '%{%{Acct-Output-Octets}:-0}'::bigint) WHERE AcctSessionId = '%{Acct-Session-Id}' AND UserName = '%{SQL-User-Name}' AND NASIPAddress= '%{NAS-IP-Address}' AND AcctStopTime IS NULL" accounting_update_query_alt = "INSERT INTO radacct (AcctSessionId, AcctUniqueId, UserName, Realm, NASIPAddress, NASPortId, NASPortType, AcctStartTime, AcctSessionTime, AcctAuthentic, AcctInputOctets, AcctOutputOctets, CalledStationId, CallingStationId, ServiceType, FramedProtocol, FramedIPAddress, XAscendSessionSvrKey) VALUES('%{Acct-Session-Id}', '%{Acct-Unique-Session-Id}', '%{SQL-User-Name}', NULLIF('%{Realm}', ''), '%{NAS-IP-Address}', %{%{NAS-Port}:-NULL}, '%{NAS-Port-Type}', ('%S'::timestamp - '%{%{Acct-Delay-Time}:-0}'::interval - '%{%{Acct-Session-Time}:-0}'::interval), NULLIF('%{Acct-Session-Time}','')::BIGINT, '%{Acct-Authentic}', (('%{%{Acct-Input-Gigawords}:-0}'::bigint << 32) + '%{%{Acct-Input-Octets}:-0}'::bigint), (('%{%{Acct-Output-Gigawords}:-0}'::bigint << 32) + '%{%{Acct-Output-Octets}:-0}'::bigint), '%{Called-Station-Id}', '%{Calling-Station-Id}', '%{Service-Type}', '%{Framed-Protocol}', NULLIF('%{Framed-IP-Address}', '')::inet, '%{X-Ascend-Session-Svr-Key}')" accounting_start_query = "INSERT INTO radacct (AcctSessionId, AcctUniqueId, UserName, Realm, NASIPAddress, NASPortId, NASPortType, AcctStartTime, AcctAuthentic, ConnectInfo_start, CalledStationId, CallingStationId, ServiceType, FramedProtocol, FramedIPAddress, AcctStartDelay, XAscendSessionSvrKey) VALUES('%{Acct-Session-Id}', '%{Acct-Unique-Session-Id}', '%{SQL-User-Name}', NULLIF('%{Realm}', ''), '%{NAS-IP-Address}', %{%{NAS-Port}:-NULL}, '%{NAS-Port-Type}', ('%S'::timestamp - '%{%{Acct-Delay-Time}:-0}'::interval), '%{Acct-Authentic}', '%{Connect-Info}', '%{Called-Station-Id}', '%{Calling-Station-Id}', '%{Service-Type}', '%{Framed-Protocol}', NULLIF('%{Framed-IP-Address}', '')::inet, 0, '%{X-Ascend-Session-Svr-Key}')" accounting_start_query_alt = "UPDATE radacct SET AcctStartTime = ('%S'::timestamp - '%{%{Acct-Delay-Time}:-0}'::interval), AcctStartDelay = 0, ConnectInfo_start = '%{Connect-Info}' WHERE AcctSessionId = '%{Acct-Session-Id}' AND UserName = '%{SQL-User-Name}' AND NASIPAddress = '%{NAS-IP-Address}' AND AcctStopTime IS NULL" accounting_stop_query = "UPDATE radacct SET AcctStopTime = ('%S'::timestamp - '%{%{Acct-Delay-Time}:-0}'::interval), AcctSessionTime = CASE WHEN '%{Acct-Session-Time}' = '' THEN (EXTRACT(EPOCH FROM ('%S'::TIMESTAMP WITH TIME ZONE - AcctStartTime::TIMESTAMP WITH TIME ZONE - '%{%{Acct-Delay-Time}:-0}'::INTERVAL)))::BIGINT ELSE NULLIF('%{Acct-Session-Time}','')::BIGINT END, AcctInputOctets = (('%{%{Acct-Input-Gigawords}:-0}'::bigint << 32) + '%{%{Acct-Input-Octets}:-0}'::bigint), AcctOutputOctets = (('%{%{Acct-Output-Gigawords}:-0}'::bigint << 32) + '%{%{Acct-Output-Octets}:-0}'::bigint), AcctTerminateCause = '%{Acct-Terminate-Cause}', AcctStopDelay = 0, FramedIPAddress = NULLIF('%{Framed-IP-Address}', '')::inet, ConnectInfo_stop = '%{Connect-Info}' WHERE AcctSessionId = '%{Acct-Session-Id}' AND UserName = '%{SQL-User-Name}' AND NASIPAddress = '%{NAS-IP-Address}' AND AcctStopTime IS NULL" accounting_stop_query_alt = "INSERT INTO radacct (AcctSessionId, AcctUniqueId, UserName, Realm, NASIPAddress, NASPortId, NASPortType, AcctStartTime, AcctStopTime, AcctSessionTime, AcctAuthentic, ConnectInfo_stop, AcctInputOctets, AcctOutputOctets, CalledStationId, CallingStationId, AcctTerminateCause, ServiceType, FramedProtocol, FramedIPAddress, AcctStopDelay) values('%{Acct-Session-Id}', '%{Acct-Unique-Session-Id}', '%{SQL-User-Name}', NULLIF('%{Realm}', ''), '%{NAS-IP-Address}', %{%{NAS-Port}:-NULL}, '%{NAS-Port-Type}', ('%S'::timestamp - '%{%{Acct-Delay-Time}:-0}'::interval - '%{%{Acct-Session-Time}:-0}'::interval), ('%S'::timestamp - '%{%{Acct-Delay-Time}:-0}'::interval), NULLIF('%{Acct-Session-Time}', '')::bigint, '%{Acct-Authentic}', '%{Connect-Info}', (('%{%{Acct-Input-Gigawords}:-0}'::bigint << 32) + '%{%{Acct-Input-Octets}:-0}'::bigint), (('%{%{Acct-Output-Gigawords}:-0}'::bigint << 32) + '%{%{Acct-Output-Octets}:-0}'::bigint), '%{Called-Station-Id}', '%{Calling-Station-Id}', '%{Acct-Terminate-Cause}', '%{Service-Type}', '%{Framed-Protocol}', NULLIF('%{Framed-IP-Address}', '')::inet, 0)" group_membership_query = "SELECT GroupName FROM radusergroup WHERE UserName='%{SQL-User-Name}' ORDER BY priority" connect_failure_retry_delay = 60 simul_count_query = "" simul_verify_query = "" postauth_query = "INSERT INTO radpostauth (username, pass, reply, authdate) VALUES ('%{User-Name}', '%{%{User-Password}:-Chap-Password}', '%{reply:Packet-Type}', NOW())" safe-characters = "@abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ0123456789.-_: /" } rlm_sql (sql): Driver rlm_sql_postgresql (module rlm_sql_postgresql) loaded and linked rlm_sql (sql): Attempting to connect to radius@localhost:/radius rlm_sql (sql): starting 0 rlm_sql (sql): Attempting to connect rlm_sql_postgresql #0 rlm_sql (sql): Connected new DB handle, #0 rlm_sql (sql): starting 1 rlm_sql (sql): Attempting to connect rlm_sql_postgresql #1 rlm_sql (sql): Connected new DB handle, #1 rlm_sql (sql): starting 2 rlm_sql (sql): Attempting to connect rlm_sql_postgresql #2 rlm_sql (sql): Connected new DB handle, #2 rlm_sql (sql): starting 3 rlm_sql (sql): Attempting to connect rlm_sql_postgresql #3 rlm_sql (sql): Connected new DB handle, #3 rlm_sql (sql): starting 4 rlm_sql (sql): Attempting to connect rlm_sql_postgresql #4 rlm_sql (sql): Connected new DB handle, #4 rlm_sql (sql): starting 5 rlm_sql (sql): Attempting to connect rlm_sql_postgresql #5 rlm_sql (sql): Connected new DB handle, #5 rlm_sql (sql): starting 6 rlm_sql (sql): Attempting to connect rlm_sql_postgresql #6 rlm_sql (sql): Connected new DB handle, #6 rlm_sql (sql): starting 7 rlm_sql (sql): Attempting to connect rlm_sql_postgresql #7 rlm_sql (sql): Connected new DB handle, #7 rlm_sql (sql): starting 8 rlm_sql (sql): Attempting to connect rlm_sql_postgresql #8 rlm_sql (sql): Connected new DB handle, #8 rlm_sql (sql): starting 9 rlm_sql (sql): Attempting to connect rlm_sql_postgresql #9 rlm_sql (sql): Connected new DB handle, #9 rlm_sql (sql): starting 10 rlm_sql (sql): Attempting to connect rlm_sql_postgresql #10 rlm_sql (sql): Connected new DB handle, #10 rlm_sql (sql): starting 11 rlm_sql (sql): Attempting to connect rlm_sql_postgresql #11 rlm_sql (sql): Connected new DB handle, #11 rlm_sql (sql): starting 12 rlm_sql (sql): Attempting to connect rlm_sql_postgresql #12 rlm_sql (sql): Connected new DB handle, #12 rlm_sql (sql): starting 13 rlm_sql (sql): Attempting to connect rlm_sql_postgresql #13 rlm_sql (sql): Connected new DB handle, #13 rlm_sql (sql): starting 14 rlm_sql (sql): Attempting to connect rlm_sql_postgresql #14 rlm_sql (sql): Connected new DB handle, #14 rlm_sql (sql): starting 15 rlm_sql (sql): Attempting to connect rlm_sql_postgresql #15 rlm_sql (sql): Connected new DB handle, #15 rlm_sql (sql): starting 16 rlm_sql (sql): Attempting to connect rlm_sql_postgresql #16 rlm_sql (sql): Connected new DB handle, #16 rlm_sql (sql): starting 17 rlm_sql (sql): Attempting to connect rlm_sql_postgresql #17 rlm_sql (sql): Connected new DB handle, #17 rlm_sql (sql): starting 18 rlm_sql (sql): Attempting to connect rlm_sql_postgresql #18 rlm_sql (sql): Connected new DB handle, #18 rlm_sql (sql): starting 19 rlm_sql (sql): Attempting to connect rlm_sql_postgresql #19 rlm_sql (sql): Connected new DB handle, #19 rlm_sql (sql): starting 20 rlm_sql (sql): Attempting to connect rlm_sql_postgresql #20 rlm_sql (sql): Connected new DB handle, #20 rlm_sql (sql): starting 21 rlm_sql (sql): Attempting to connect rlm_sql_postgresql #21 rlm_sql (sql): Connected new DB handle, #21 rlm_sql (sql): starting 22 rlm_sql (sql): Attempting to connect rlm_sql_postgresql #22 rlm_sql (sql): Connected new DB handle, #22 rlm_sql (sql): starting 23 rlm_sql (sql): Attempting to connect rlm_sql_postgresql #23 rlm_sql (sql): Connected new DB handle, #23 rlm_sql (sql): starting 24 rlm_sql (sql): Attempting to connect rlm_sql_postgresql #24 rlm_sql (sql): Connected new DB handle, #24 rlm_sql (sql): starting 25 rlm_sql (sql): Attempting to connect rlm_sql_postgresql #25 rlm_sql (sql): Connected new DB handle, #25 rlm_sql (sql): starting 26 rlm_sql (sql): Attempting to connect rlm_sql_postgresql #26 rlm_sql (sql): Connected new DB handle, #26 rlm_sql (sql): starting 27 rlm_sql (sql): Attempting to connect rlm_sql_postgresql #27 rlm_sql_postgresql: Couldn't connect socket to PostgreSQL server radius@localhost:radius rlm_sql (sql): Failed to connect DB handle #27 rlm_sql (sql): starting 28 rlm_sql (sql): starting 29 rlm_sql (sql): starting 30 rlm_sql (sql): starting 31 rlm_sql (sql): Processing generate_sql_clients rlm_sql (sql) in generate_sql_clients: query is SELECT id, nasname, shortname, type, secret, server FROM nas rlm_sql (sql): Ignoring unconnected handle 31.. rlm_sql (sql): Ignoring unconnected handle 30.. rlm_sql (sql): Ignoring unconnected handle 29.. rlm_sql (sql): Ignoring unconnected handle 28.. rlm_sql (sql): Ignoring unconnected handle 27.. rlm_sql (sql): Reserving sql socket id: 26 rlm_sql (sql): got socket 26 after skipping 5 unconnected handles, tried to reconnect 0 though rlm_sql_postgresql: query: SELECT id, nasname, shortname, type, secret, server FROM nas rlm_sql_postgresql: Status: PGRES_TUPLES_OK rlm_sql_postgresql: query affected rows = 1 , fields = 6 rlm_sql (sql): Read entry nasname=10.0.0.10,shortname=frank,secret=secret_shared rlm_sql (sql): Adding client 10.0.0.10 (frank, server=<none>) to clients list rlm_sql (sql): Released sql socket id: 26 Module: Linked to module rlm_counter Module: Instantiating module "daily" from file /etc/raddb/modules/counter counter daily { filename = "/etc/raddb/db.daily" key = "User-Name" reset = "daily" count-attribute = "Acct-Session-Time" counter-name = "Daily-Session-Time" check-name = "Max-Daily-Session" reply-name = "Session-Timeout" allowed-servicetype = "Framed-User" cache-size = 5000 } rlm_counter: Counter attribute Daily-Session-Time is number 11273 rlm_counter: Current Time: 1447234857 [2015-11-11 04:40:57], Next reset 1447304400 [2015-11-12 00:00:00] Module: Checking preacct {...} for more modules to load Module: Linked to module rlm_acct_unique Module: Instantiating module "acct_unique" from file /etc/raddb/modules/acct_unique acct_unique { key = "User-Name, Acct-Session-Id, NAS-IP-Address, NAS-Identifier, NAS-Port" } Module: Checking accounting {...} for more modules to load Module: Instantiating module "detail" from file /etc/raddb/modules/detail detail { detailfile = "/var/log/radius/radacct/%{%{Packet-Src-IP-Address}:-%{Packet-Src-IPv6-Address}}/detail-%Y%m%d" header = "%t" detailperm = 384 dirperm = 493 locking = no log_packet_header = no escape_filenames = no } Module: Linked to module rlm_attr_filter Module: Instantiating module "attr_filter.accounting_response" from file /etc/raddb/modules/attr_filter attr_filter attr_filter.accounting_response { attrsfile = "/etc/raddb/attrs.accounting_response" key = "%{User-Name}" relaxed = no } reading pairlist file /etc/raddb/attrs.accounting_response Module: Checking session {...} for more modules to load Module: Linked to module rlm_radutmp Module: Instantiating module "radutmp" from file /etc/raddb/modules/radutmp radutmp { filename = "/var/log/radius/radutmp" username = "%{User-Name}" case_sensitive = yes check_with_nas = yes perm = 384 callerid = yes } Module: Checking post-proxy {...} for more modules to load Module: Checking post-auth {...} for more modules to load Module: Instantiating module "attr_filter.access_reject" from file /etc/raddb/modules/attr_filter attr_filter attr_filter.access_reject { attrsfile = "/etc/raddb/attrs.access_reject" key = "%{User-Name}" relaxed = no } reading pairlist file /etc/raddb/attrs.access_reject } # modules } # server server inner-tunnel { # from file /etc/raddb/sites-enabled/inner-tunnel modules { Module: Checking authenticate {...} for more modules to load Module: Checking authorize {...} for more modules to load Module: Checking session {...} for more modules to load Module: Checking post-proxy {...} for more modules to load Module: Checking post-auth {...} for more modules to load } # modules } # server radiusd: #### Opening IP addresses and Ports #### listen { type = "auth" ipaddr = * port = 0 } listen { type = "acct" ipaddr = * port = 0 } listen { type = "control" listen { socket = "/var/run/radiusd/radiusd.sock" } } listen { type = "auth" ipaddr = 127.0.0.1 port = 18120 } Listening on authentication address * port 1812 Listening on accounting address * port 1813 Listening on command file /var/run/radiusd/radiusd.sock Listening on authentication address 127.0.0.1 port 18120 as server inner-tunnel Ready to process requests. rad_recv: Access-Request packet from host 10.0.0.10 port 2071, id=0, length=127 Received packet from 10.0.0.10 with invalid Message-Authenticator! (Shared secret is incorrect.) Dropping packet without response. Going to the next request Waking up in 0.9 seconds. Cleaning up request 0 ID 0 with timestamp +20 Ready to process requests. Seeing NAS configuration: SELECT * FROM nas; id | nasname | shortname | type | ports | secret | server | community | description ----+-----------+-----------+-------+-------+---------------+--------+-----------+---------------------- 1 | 10.0.0.10 | frank | other | | secret_shared | | | Wifi on Frank (1 row) Wireless settings on the AP (OpenWRT device): root@frank:~# uci show wireless wireless.wl0=wifi-device wireless.wl0.type=broadcom wireless.wl0.channel=11 wireless.@wifi-iface[0]=wifi-iface wireless.(a)wifi-iface[0].device=wl0 wireless.(a)wifi-iface[0].network=lan wireless.(a)wifi-iface[0].mode=ap wireless.(a)wifi-iface[0].ssid=CleverSSID wireless.(a)wifi-iface[0].encryption=wpa2 wireless.(a)wifi-iface[0].server=10.0.0.5 wireless.(a)wifi-iface[0].key=secret_shared

5 12

Fw: new message
by jerzykolosowski＠poczta.onet.pl 11 Nov '15

11 Nov '15

Hey! New message, please read <http://theilovemesomemeexperience.com/should.php?au0> jerzykolosowski(a)poczta.onet.pl --- لقد تم التحقق من خلو هذا البريد الإلكتروني من الفيروسات بواسطة برنامج أفاست مضاد الفيروسات. https://www.avast.com/antivirus

1 0

Fw: new message
by Business Director 11 Nov '15

11 Nov '15

Hey! New message, please read <http://rxforhope.com/cut.php?54hqd> Business Director

1 0

Different IP Pool for different group user
by Yanrui Hu 10 Nov '15

10 Nov '15

Guys, Let me explain my problem briefly. I want different group user get different ip pool. Here is the settings: *===users* DEFAULT Pool-Name := "tc_pool" Fall-Through = Yes *===sites-enabled/default* post_auth...... if (SQL-Group == "restricted") { tc_pool } else { main_pool } *===modules/ippool* ippool main_pool { range-start = 172.16.10.1 range-stop = 172.16.10.254 netmask = 255.255.255.0 cache-size = 254 session-db = ${raddbdir}/db.ipmainpool ip-index = ${raddbdir}/db.ipmainindex override = no maximum-timeout = 0 } ippool tc_pool { range-start = 172.26.11.1 range-stop = 172.26.11.254 netmask = 255.255.255.0 cache-size = 254 session-db = ${raddbdir}/db.ipsecondary26pool ip-index = ${raddbdir}/db.ipsecondary26index override = no maximum-timeout = 0 } *Test result, if use a user in restricted group. There will be a Frame_IP_address in access_accept.* *But if a user not in this group, the radius log is:* ? Evaluating (SQL-Group == "restricted") -> FALSE ++? if (SQL-Group == "restricted") -> FALSE ++else else { +++[main_pool] = noop ++} # else else = noop ...... Sending Access-Accept of id 140 to 127.0.0.1 port 60577 MS-MPPE-Encryption-Policy = 0x00000001 MS-MPPE-Encryption-Types = 0x00000006 MS-MPPE-Send-Key = 0xb4c7f85ed7a94628e635e6b7d933c39a MS-MPPE-Recv-Key = 0x024db770d98a83bdf54a7512e8f4a4ad EAP-Message = 0x03020004 Message-Authenticator = 0x00000000000000000000000000000000 User-Name = "3dd5ac675d704831a89e2475f97f575f" Finished request 2. -- Best Regards, Yanrui Hu -- *This email may contain or reference confidential information and is intended only for the individual to whom it is addressed. Please refrain from distributing, disclosing or copying this email and the information contained within unless you are the intended recipient. If you received this email in error, please notify us at legal(a)appannie.com <legal(a)appannie.com>** immediately and remove it from your system.*

1 0

Segregate Accounting
by Guilherme Domingues 10 Nov '15

10 Nov '15

We're looking to segregate regular Wan traffic of your dsl users, to special services (e.g: CDN). As a solution we've been thinking to setup netflow/snmp to decrease final acct register of amount of traffic. But imo it is think an ugly idea. Anyone has any suggestion for that kind of design? Best regards, Guilherme Domingues LPI 201 LPI000161013 https://cs.lpi.org/caf/Xamman/certification/process_verify code verification: v8bwxqzja7 Linux ID #425752 --- "A mente que se abre a uma nova idéia jamais voltará ao seu tamanho original." Albert Einstein

1 0

FreeRADIUS on maintenance mode? Open authentication.
by Antonio Fernández Pérez 10 Nov '15

10 Nov '15

Hi everybody: I would like to know if there are some option to adjust in FreeRADIUS configuration to allow open authentication from all users. I have to make some maintenance tasks on MySQL and I don't want to interrupt the service. My objective is prevent alter all hotspot configurations (NASes) disabling RADIUS server. I hope your advices. Regards, Antonio.

2 2

rfc6929 : combination extended-type/long-extended-type and TLV data type
by Vereecke, Katrien (Katrien) 10 Nov '15

10 Nov '15

Hello, I am using freeradius server version V3.0.x. According to rfc6929 the combination of a extended or long-extended-type and tlv-data type is allowed. The rfc states that the TLV-length must have a value between 3 and 255, but is this correct in case of an extended or long extended type , should it then not be respectively 252 and 251 max? I was testing the TLV data type and long extended type, I defined in my dictionary the following: ATTRIBUTE Test-Attr-261-11 246.11 tlv ATTRIBUTE Test-Attr-261-11-1 246.11.1 octets And in my users file I included Test-Attr-261-11-1 = 0x00112233445566aabbccddeeff0011223344.......... => with a length more than 300 octets In the wireshark I see that the attribute is fragmented but the length-attr and the tlv-length are both set to ff and the second fragmented part does only contain the octets up till data length 255, not all octets specified in my users file. Is this correct? Wireshark output : f6 ff 0b 80 01 ff 00 11 22 33 44 55 ..... f6 08 0b 00 99 aa bb cc ... Thanks, Kind regards, Katrien.

2 3

freeradius 3.0.x HOW TO ULANG read/write all list keys/values
by Michal Tomaszewski 10 Nov '15

10 Nov '15

Hello, Could you advice how to write and read all reply list parameters to/from database? I would like to store reply parameters between sessions of the same user without generating them from scratch. As I understand writing all parameters to the database is possible using e.g. such command: &AllReplyString := "%{pairs:reply:[*]}" Then I can write AllReplyString to e.g. SQL database. But how can I read it back and fill all reply parameters into freeradius? I can retrieve AllReplyString from database. How to assign all parameters from such string to radius reply list? I imagine there shall be a kind of construction like Update reply { .... list := AllReplyString } but I couldn't find proper construction in ulang manual nor any converting function. Could you suggest the proper way of solving such issue? Regards, Mike ________________________________________ Uwaga: Treść niniejszej wiadomości może być poufna i objęta zakazem jej ujawniania. Jeśli czytelnik tej wiadomości nie jest jej zamierzonym adresatem, pracownikiem lub pośrednikiem upoważnionym do jej przekazania adresatowi, informujemy że wszelkie rozprowadzanie, rozpowszechnianie lub powielanie niniejszej wiadomości jest zabronione. Jeśli otrzymałeś tę wiadomość omyłkowo, proszę bezzwłocznie odesłać ją nadawcy, a samą wiadomość usunąć z komputera. Dziękujemy. ________________________________ Note: The information contained in this message may be privileged and confidential and protected from disclosure. If the reader of this message is not the intended recipient, or an employee or agent responsible for delivering this message to the intended recipient, you are hereby notified that any dissemination, distribution or copying of this communication is strictly prohibited.If you have received this communication in error, please notify the sender immediately by replying to the message and deleting it from your computer. Thank you. ________________________________

2 6