March 2015 - Freeradius-Users - lists.freeradius.org

Odd behavior?
by J Kephart 18 Mar '15

18 Mar '15

We're seeing a very odd occurrence on one of our radius servers. To my knowledge, it has only happened once (this morning), but it's the first time it's happened, and we're not entirely sure where to look to find the cause. We're running on a CentOS 6.6 system, with FR v2.1.12, which is the package that is distributed by CentOS/RH. Each day, the logrotate routing rotates the radius.log (and compresses it), and then restarts FR. This morning, however, the radius log showed that the process restarted, but that it did absolutely nothing for the next two hours and 13 minutes. Fri Mar 13 03:27:01 2015 : Info: HUP - loading modules Fri Mar 13 03:27:01 2015 : Info: Module: Reloaded module "attr_filter.access_reject" Fri Mar 13 03:27:01 2015 : Info: Module: Reloaded module "attr_filter.accounting_response" Fri Mar 13 03:27:01 2015 : Info: Module: Reloaded module "files" Fri Mar 13 03:27:01 2015 : Info: Module: Reloaded module "radutmp" Fri Mar 13 03:27:01 2015 : Info: Module: Reloaded module "suffix" Fri Mar 13 03:27:01 2015 : Info: Module: Reloaded module "mschap" Fri Mar 13 03:27:01 2015 : Info: Module: Reloaded module "pap" Fri Mar 13 03:27:01 2015 : Info: Loaded virtual server <default> Fri Mar 13 03:27:01 2015 : Info: Loaded virtual server inner-tunnel Fri Mar 13 05:40:53 2015 : Info: rlm_sql (sql): Driver rlm_sql_mysql (module rlm_sql_mysql) loaded and linked Fri Mar 13 05:40:53 2015 : Info: rlm_sql (sql): Attempting to connect to radius@xxxxxxxxxxxxxxxxx:3306/radius Fri Mar 13 05:40:53 2015 : Info: rlm_sql (sql): Attempting to connect rlm_sql_mysql #0 Fri Mar 13 05:40:53 2015 : Info: rlm_sql_mysql: Starting connect to MySQL server for #0 Fri Mar 13 05:40:53 2015 : Info: rlm_sql (sql): Connected new DB handle, #0 Fri Mar 13 05:40:53 2015 : Info: rlm_sql (sql): Attempting to connect rlm_sql_mysql #1 Fri Mar 13 05:40:53 2015 : Info: rlm_sql_mysql: Starting connect to MySQL server for #1 Fri Mar 13 05:40:53 2015 : Info: rlm_sql (sql): Connected new DB handle, #1 Fri Mar 13 05:40:53 2015 : Info: rlm_sql (sql): Attempting to connect rlm_sql_mysql #2 Fri Mar 13 05:40:53 2015 : Info: rlm_sql_mysql: Starting connect to MySQL server for #2 ... Following these entries, normal authentication/accounting messages resumed, as they had been doing just prior. Has anyone ever run across this? Any thoughts on how we might track it down? Thanks, Jim

2 3

How to configure dynamic vlan for cisco aironet 1100 series
by Sautron Nick 18 Mar '15

18 Mar '15

Hello, I would to know, how to configure dynamic vlan for cisco aironet 1100 series without web interface please. Best regards

3 3

Freeradius Access-Reject to Access-Accept
by vanish 18 Mar '15

18 Mar '15

Hi, freeradius team! I newbye in FR and need your help with next scheme. I have: - L2TP NAS (cisco ASR1013) + freeradius2 + sql DBase I must realize next algorithm: - User connect to L2TP bras - Bras get from user login and chap password - Bras send to FR access-request: +++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++ rad_recv: Access-Request packet from host 10.10.10.10. port 1645, id=228, length=133 Framed-Protocol = PPP User-Name = "user1" CHAP-Password = 0x018ca6f7913b5901e187a80e3f41c419c54465v565 Connect-Info = "100000000" NAS-Port-Type = Virtual ... +++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++ - FR in sql module into "authorize" section select special-data from DBase by user-login. ... From here i need to realize next logic (as i see): 1. If user password is wrong - Freeradius must send to cisco access-accept and next reply: Cisco-Account-Info = "ARedirect_WRNG_PSSWRD" (This is Cisco SSG Service for redirect user to web-portal) 2. If user password is OK, but Tariff_Plan not set - Freeradius must send to cisco access-accept and next reply: Cisco-Account-Info = "ARedirect_NO_PAY" 3. If user password is OK, and Tariff_Plan is OK - Freeradius must send to cisco access-accept and next reply: Cisco-Account-Info = "AInternet_xxxIN_xxxOUT" In first and second steps - i must change access-reject to access-accept with some reply message. For example - if FR got from DBase: - "1" - wrong password (1 paragraph) - "2" - wrong tariff (2 paragraph) - "cleartext password" - allright (3 paragraph) can i in "authorize" section in module "sql" check return code from DB and by this code change access-reject to access-accept with reply valid service to cisco? Help me please.

1 0

Unknown client
by Tevfik Ceydeliler 18 Mar '15

18 Mar '15

Hi, Altough I have this configuration in client .conf: ################################## client 172.30.47.241 { secret = 877909 shortname = VodafonePinarsuAPNYeni1 nastype = other } client 172.30.47.242 { secret = 877909 shortname = VodafonePinarsuAPNYeni2 nastype = other } #################################### Why I get this error? ################################################################################################# Tue Mar 17 14:31:55 2015 : Error: Ignoring request to authentication address * port 1812 from unknown client 172.30.47.242 port 58312 Tue Mar 17 14:32:01 2015 : Error: Ignoring request to authentication address * port 1812 from unknown client 172.30.47.241 port 6040 ################################################################################################# And I am sure that secret is correct. Any idea? --

2 3

Attribute number 89 (vendor) not defined
by Clement Ogedengbe 17 Mar '15

17 Mar '15

I am seeing the following in the log. Any idea please? radiator: WARNING: Attribute number 89 (vendor 1) from x.x.x.x:50735 is not defined in your dictionary Clement

3 5

FreeRadius - 802.1X - Activce Directory
by Ronja 17 Mar '15

17 Mar '15

Hello, I try to a FreeRadiusserver on Centos 6.6. I have use that guide for my project. http://wiki.freeradius.org/guide/FreeRADIUS-Active-Directory-Integration-HOW TO . Now I want to create certificates with CA.all : "CA.all is located in the scripts subdirectory of FREERADIUS' source directory. In case of doubt try the command. find / -name CA.all When executing CA.all, we produce the 9 following certificates " But I can not find CA.all :( I use the command find * | grep CA.all but there is nothing. Can you help me? with kind regards, Host3

3 2

Cache One Time Password OTP
by Gardner, Mark 16 Mar '15

16 Mar '15

Has anyone had success in getting free radius to cache a HOTP so it works like a TOTP. The problem I have is a ThinLinc authentication were our LDAP is configured for a HOTP, and ThinLink requires the OTP to be used twice in quick succession across the distributed architecture (once to master once to client) Looks like someone had some relative success IN Feb 2013 http://lists.freeradius.org/pipermail/freeradius-users/2013-February/065163… But I'm not following whats going on. Mark Gardner Www.gtopia.org/blog

3 7

Re: Freeradius-Users Digest, Vol 119, Issue 57
by Rui Ribeiro 15 Mar '15

15 Mar '15

Hi Jim, FR 2.1.12 is too old, and has know bugs, including mschap hanging up after a HUP. Monitor the service at layer 7, and restart it automatically while you do not upgrade. Regards Message: 2 > Date: Fri, 13 Mar 2015 11:24:05 -0400 > From: J Kephart <jkephart(a)safetynetaccess.com> > To: FreeRadius users mailing list > <freeradius-users(a)lists.freeradius.org> > Subject: Odd behavior? > Message-ID: <55030115.3010706(a)safetynetaccess.com> > Content-Type: text/plain; charset=utf-8 > > We're seeing a very odd occurrence on one of our radius servers. To my > knowledge, it has only happened once (this morning), but it's the first > time it's happened, and we're not entirely sure where to look to find > the cause. > > We're running on a CentOS 6.6 system, with FR v2.1.12, which is the > package that is distributed by CentOS/RH. Each day, the logrotate > routing rotates the radius.log (and compresses it), and then restarts > FR. This morning, however, the radius log showed that the process > restarted, but that it did absolutely nothing for the next two hours and > 13 minutes. > > Fri Mar 13 03:27:01 2015 : Info: HUP - loading modules > Fri Mar 13 03:27:01 2015 : Info: Module: Reloaded module > "attr_filter.access_reject" > Fri Mar 13 03:27:01 2015 : Info: Module: Reloaded module > "attr_filter.accounting_response" > Fri Mar 13 03:27:01 2015 : Info: Module: Reloaded module "files" > Fri Mar 13 03:27:01 2015 : Info: Module: Reloaded module "radutmp" > Fri Mar 13 03:27:01 2015 : Info: Module: Reloaded module "suffix" > Fri Mar 13 03:27:01 2015 : Info: Module: Reloaded module "mschap" > Fri Mar 13 03:27:01 2015 : Info: Module: Reloaded module "pap" > Fri Mar 13 03:27:01 2015 : Info: Loaded virtual server <default> > Fri Mar 13 03:27:01 2015 : Info: Loaded virtual server inner-tunnel > Fri Mar 13 05:40:53 2015 : Info: rlm_sql (sql): Driver rlm_sql_mysql > (module rlm_sql_mysql) loaded and linked > Fri Mar 13 05:40:53 2015 : Info: rlm_sql (sql): Attempting to connect to > radius@xxxxxxxxxxxxxxxxx:3306/radius > Fri Mar 13 05:40:53 2015 : Info: rlm_sql (sql): Attempting to connect > rlm_sql_mysql #0 > Fri Mar 13 05:40:53 2015 : Info: rlm_sql_mysql: Starting connect to > MySQL server for #0 > Fri Mar 13 05:40:53 2015 : Info: rlm_sql (sql): Connected new DB handle, #0 > Fri Mar 13 05:40:53 2015 : Info: rlm_sql (sql): Attempting to connect > rlm_sql_mysql #1 > Fri Mar 13 05:40:53 2015 : Info: rlm_sql_mysql: Starting connect to > MySQL server for #1 > Fri Mar 13 05:40:53 2015 : Info: rlm_sql (sql): Connected new DB handle, #1 > Fri Mar 13 05:40:53 2015 : Info: rlm_sql (sql): Attempting to connect > rlm_sql_mysql #2 > Fri Mar 13 05:40:53 2015 : Info: rlm_sql_mysql: Starting connect to > MySQL server for #2 > ... > > Following these entries, normal authentication/accounting messages > resumed, as they had been doing just prior. > > Has anyone ever run across this? Any thoughts on how we might track it > down? > > Thanks, > > Jim > > -- Regards, -- Rui Ribeiro Senior Sysadm ISCTE-IUL https://www.linkedin.com/pub/rui-ribeiro/16/ab8/434

1 0

Re: Expansion of \t and \n in message with linelong module
by paul.moser＠bt.com 13 Mar '15

13 Mar '15

(apologies if I've broken the threading - I shouldn't have subscribed using digest mode, now corrected) On Tue, Dec 23, 2014 at 11:05:23AM -0500, Alan DeKok wrote: > The reason is that attributes can have embedded \n in them, either as binary or a as a string "\n". Using those attributes in the "linelog" module would then cause spurious new lines, and break your assumptions about what the log files mean. Very good point. Because the set of attributes we happen to use in the log entry don't include end user inputted data and the source of those packets we are safe from unexpected expansion for now, but our future intended use and as a general use case this is certainly what's known as a bad idea. Time to rethink. >Not with 3.0.6. We can take a look at correcting it for the next release. We’ve made other fixes in 3.0 which made it easier to separate the "literal" strings passed in from the config files, and the “end user” strings taken from a RADIUS packet. We can have the linelog module convert \n -> CR for literal strings you enter, but not do that expansion for strings taken from RADIUS packets. Certainly that would help, but I should probably the end result we are trying to achieve in case linelog was completely the wrong approach. It sound like we are doing much the same as Matthew Newton, in addition to performing some normal authentication/authorization/accounting we also send information from those to another radius server as accounting packet - in some cases this is for additional auditing, sometimes as it enables other functionality - using the linelog module we could write out a file in the standard detail format but with just the attributes we wanted (and the type as accounting even if it had originally been an access request), and use a detail listener to pick that up and send them on. Is there some other way to do this that I've missed? I suspect the reason in our case that accounting packets are always used is just because historically it was more convenient to do so. Given we own the systems that the packets get sent onto it's possible that we may be able to change those systems to handle access request or response packets as well as accounting, and modify the source systems to use a detail writer/read and Proxy-to-realm setup rather linelog Paul ------------------------------ Message: 2 Date: Tue, 23 Dec 2014 11:05:23 -0500 From: Alan DeKok <aland(a)deployingradius.com> To: FreeRadius users mailing list <freeradius-users(a)lists.freeradius.org> Subject: Re: Expansion of \t and \n in message with linelong module and correct_escapes = true with v3.0.6 Message-ID: <E5F57FCB-CC38-4386-B922-3F36D37A3F88(a)deployingradius.com> Content-Type: text/plain; charset=windows-1252 On Dec 23, 2014, at 10:38 AM, paul.moser(a)bt.com wrote: > I have a 3.0.3 FR instance to which some additional logging has been added using the linelog module. The log messages that are written are multi-line and tab indented with \n and \t used in the format option in the linelog modules configuration file. That?s not really the intended use of the ?linelog? module. It logs lines of text.. not multiple lines. > I have also tried migrating another, older (v2.x) FR instance to v3.0.6. I started with a vanilla 3.0.6 configuration and successfully slowly modified that to give the same behaviour as the v2.x version. However when I finally attempted to add the additional logging that had been added to the 3.0.3 instance the log statements appearing in the log file are not multi-line or tab indented, neither the newline \n nor the tab \t have been expanded, \n and \t appear in the log file where I'd expected newlines and tabs to appear. > > I note in the changelog that for v3.0.5 correct_escapes was introduced and in a vanilla 3.0.6 configuration this is set to true It?s correct, and it creates many other simplifications of the source tree. > Taking my 3.0.3 configuration as is and running it against a 3.0.6 server it behaves just as it does with a 3.0.3 server - expanding \t and \n . However if I modify the configuration to set correct_escapes to true then literal \t and \n appear in the log file rather than tabs and newlines. Yes. That?s really the correct behaviour. The reason is that attributes can have embedded \n in them, either as binary or a as a string ?\n?. Using those attributes in the ?linelog? module would then cause spurious new lines, and break your assumptions about what the log files mean. > With 3.0.6, with correct_escapes=true, is it possible to use backslash escape sequences, or some equivalent to format linelog log messages? Not with 3.0.6. We can take a look at correcting it for the next release. We?ve made other fixes in 3.0 which made it easier to separate the ?literal? strings passed in from the config files, and the ?end user? strings taken from a RADIUS packet. We can have the linelog module convert \n -> CR for literal strings you enter, but not do that expansion for strings taken from RADIUS packets. > It maybe that the expansion of \n and \t in 3.0.3 was just undocumented behaviour that we stumbled upon and utilised rather than expected behaviour, the fact that the module is called line (singular) log may indicated we should not expect it to write multi-line log statements. Both. > I realise that I could just set correct_escapes=false in my 3.0.6 instances, I have briefly tried this however much of the default configuration now appears to assume the correct escapes and I'd have to unwind all those changes. I suspect if I did this I'd just be storing up trouble for myself some point in the future. I?d recommend keeping the new behaviour. It?s *much* more intuitive. Alan DeKok. ------------------------------ Message: 3 Date: Tue, 23 Dec 2014 23:27:27 +0000 From: Matthew Newton <mcn4(a)leicester.ac.uk> To: FreeRadius users mailing list <freeradius-users(a)lists.freeradius.org> Subject: Re: Expansion of \t and \n in message with linelong module and correct_escapes = true with v3.0.6 Message-ID: <20141223232727.GA19006(a)rootmail.cc.le.ac.uk> Content-Type: text/plain; charset=utf-8 On Tue, Dec 23, 2014 at 11:05:23AM -0500, Alan DeKok wrote: > That?s not really the intended use of the ?linelog? module. > It logs lines of text.. not multiple lines. Of course, "intended" and "what's useful" are two different things. We're also (ab-)using linelog to write out detail log format. These are then picked up by the detail reader and fed (as accounting packets) across to a central RADIUS server for common logging. It means we can set exactly which attributes to forward. Because of the way the logging and detail reader works it is also reliable if the central server goes away for some reason. I guess the alternative would be to have an "include" option for the detail module, countering the "suppress" option. But that's only for our use case. > Not with 3.0.6. We can take a look at correcting it for the > next release. We?ve made other fixes in 3.0 which made it > easier to separate the ?literal? strings passed in from the > config files, and the ?end user? strings taken from a RADIUS > packet. We can have the linelog module convert \n -> CR for > literal strings you enter, but not do that expansion for > strings taken from RADIUS packets. That would seem the more sensible option - expand \n, \t etc in the string first, then expand %{..}. But I get that string expansion is pretty tricky in the ordering it needs to be done to get a sane output for all cases. Cheers Matthew -- Matthew Newton, Ph.D. <mcn4(a)le.ac.uk> Systems Specialist, Infrastructure Services, I.T. Services, University of Leicester, Leicester LE1 7RH, United Kingdom For IT help contact helpdesk extn. 2253, <ithelp(a)le.ac.uk> ------------------------------ Message: 4 Date: Tue, 23 Dec 2014 23:48:11 +0000 From: Alan Buxey <A.L.M.Buxey(a)lboro.ac.uk> To: FreeRadius users mailing list <freeradius-users(a)lists.freeradius.org>, Matthew Newton <mcn4(a)leicester.ac.uk> Subject: Re: Expansion of \t and \n in message with linelong module and correct_escapes = true with v3.0.6 Message-ID: <ABEC402F-CA0B-418A-A14F-C7F97692988B(a)lboro.ac.uk> Content-Type: text/plain; charset="utf-8" buffered_sql with extra attr_filter rule? alan -- Sent from my Android device with K-9 Mail. Please excuse my brevity.

3 5

Help with eduroam proxying config
by Mohamed Lrhazi 12 Mar '15

12 Mar '15

Hello, With this config, I want to say: anyuser(a)anything.edu should go to eduroam, but I get a warning that it wont be the case.. What's the correct config: Thanks a lot, Mohamed. proxy.conf: home_server eduroam1 { type = auth ipaddr = tlrs1.eduroam.us port = 1645 secret = eduroam_radius_secret } home_server eduroam2 { type = auth ipaddr = tlrs2.eduroam.us port = 1645 secret = eduroam_radius_secret } home_server_pool eduroam { type = fail-over home_server = eduroam1 home_server = eduroam2 } realm LOCAL { } realm NULL { } realm georgetown.edu { } realm gu.edu { } realm "~(.*\\.)+edu$" { nostrip auth_pool = eduroam } realm DEFAULT{ nostrip } radius/radacct/172.17.0.187/auth-detail-20150311 (0) auth_log : EXPAND %t (0) auth_log : --> Wed Mar 11 14:32:10 2015 (0) [auth_log] = ok (0) [chap] = noop (0) [mschap] = noop (0) [digest] = noop (0) suffix : Looking up realm "foo.edu" for User-Name = "ml623(a)foo.edu" (0) suffix : Found realm "~(.*\.)+edu$" (0) suffix : Adding Realm = "foo.edu" (0) suffix : Proxying request from user ml623(a)foo.edu to realm ~(.*\.)+edu$ (0) suffix : Preparing to proxy authentication request to realm "~(.*\.)+edu$" (0) [suffix] = updated (0) if ("%{Realm}" != 'NULL' && "%{Realm}" != 'LOCAL' && "%{Realm}" !~ /\\.edu$/) (0) EXPAND %{Realm} (0) --> foo.edu (0) EXPAND %{Realm} (0) --> foo.edu (0) EXPAND %{Realm} (0) --> foo.edu (0) if ("%{Realm}" != 'NULL' && "%{Realm}" != 'LOCAL' && "%{Realm}" !~ /\\.edu$/) -> FALSE (0) eap : EAP packet type response id 0 length 18 (0) eap : EAP-Identity reply, returning 'ok' so we can short-circuit the rest of authorize (0) [eap] = ok (0) } # authorize = ok (0) WARNING: You set Proxy-To-Realm = DEFAULT, but it is a LOCAL realm! Cancelling proxy request. (0) Found Auth-Type = EAP

3 4