April 2015 - Freeradius-Users - lists.freeradius.org

Auto Authenticate
by Darren Ward (darrward) 10 Apr '15

10 Apr '15

Hey Guys I'm looking to do some automatic authentication so I can trigger the Authen status on some WiFi MAC-TAL services... I was wondering if I did something like: authenticate { if (User-Name =~ /^192.168.200.+/) { Whether it would be possible to send a access-accept back and how to configure? In this scenario the WiFi Gateway sends a Authen request to the RADIUS server with the DHCP assigned IP address as the user-name I just want to automatically say authenticated and return a couple of quote attributes for any client matching the subnet Darren

3 2

Freeradius + CoA + Mikrotik
by Leandro Melo - Netsul Telecom 10 Apr '15

10 Apr '15

Dear, Used as a form of client authentication in PPPoE, already use hotspot, but we are finalizing the hotspot migration to pppoe, so need to use the CoA feature to apply changes in the connections of my clients without disconnecting them from the equipment, and must do this using Freeradius + CoA. in places I could find something commenting on this situation, I was informed that PPPoE is not supported for this type of integration (CoA) and would like to confirm with you this news. Change the queues of active connections through the Radius using the CoA, you can not? I thank you and I'm waiting. Att,

2 1

sql - best practices
by Marcin 09 Apr '15

09 Apr '15

Hi, finally I've decided to use sql instead of flat files. there is in config "delete_stale_sessions = yes" from where radius know that is stale sessions? some other programs do I have to run? There is in documentation that to keep online sessions users in one table and history seesions in other table. How to achieve it from freeradius? -- Pozdrawiam Marcin / nicraM

7 16

freeradius disconnect user using accounting
by Leandro Melo - Netsul Telecom 08 Apr '15

08 Apr '15

dear, use FreeRADIUS Version 2.1.12 and mikrotik as hub, set up the interim update for 10 seconds (for testing) so that the radius can drop the connection when the time is reached. set up the / etc / raddb / sites-avaliable / default to accounting { detail unix radutmp sqlippool sql1 exec if ("% {Acct-Session-Time}"> 30) { reject } attr_filter.accounting_response } but the log returned by radius if he enters, but drops the connection, what command to derrumar the connection and return a "reply-message" to the hub? follows the log: ... [sql1] expand: UPDATE radacct SET FramedIPAddress = NULLIF('%{Framed-IP-Address}', '')::inet, AcctSessionTime = '%{Acct-Session-Time}', AcctInputOctets = (('%{%{Acct-Input-Gigawords}:-0}'::bigint << 32) + '%{%{Acct-Input-Octets}:-0}'::bigint), AcctOutputOctets = (('%{%{Acct-Output-Gigawords}:-0}'::bigint << 32) + '%{%{Acct-Output-Octets}:-0}'::bigint) WHERE AcctSessionId = '%{Acct-Session-Id}' AND UserName = '%{SQL-User-Name}' AND NASIPAddress= '%{NAS-IP-Address}' AND AcctStopTime IS NULL -> UPDATE radacct SET FramedIPAddress = NULLIF('192.168.95.101', '')::inet, AcctSessionTime = '1101', AcctInputOctets = (('0'::bigint << 32) + '211907'::bigint), AcctOutputOctets = (('0'::bigint << 32) + '407325'::bigint) WHERE AcctSessionId = '81c00012' AND UserName = 'teste1' AND NASIPAddress= '192.168.1.41' AND AcctStopTime IS NULL rlm_sql (sql1): Reserving sql socket id: 0 rlm_sql_postgresql: Status: PGRES_COMMAND_OK rlm_sql_postgresql: query affected rows = 1 rlm_sql (sql1): Released sql socket id: 0 ++[sql1] returns ok ++[exec] returns noop ++? if ("%{Acct-Session-Time}" > 30) expand: %{Acct-Session-Time} -> 1101 ? Evaluating ("%{Acct-Session-Time}" > 30) -> TRUE ++? if ("%{Acct-Session-Time}" > 30) -> TRUE ++- entering if ("%{Acct-Session-Time}" > 30) {...} +++- if ("%{Acct-Session-Time}" > 30) returns noop ++- group accounting returns noop [attr_filter.accounting_response] expand: %{User-Name} -> teste1 attr_filter: Matched entry DEFAULT at line 12 ++[attr_filter.accounting_response] returns updated Sending Accounting-Response of id 232 to 10.0.2.2 port 37115 Finished request 21. ... Att,

4 7

Custom Reject Replies in case customer doesn't have available balance
by Muhammad Usman 08 Apr '15

08 Apr '15

Hi, I want to send custom reply messages in case of Access reject, I have gone through the below link and updated the default file, by using sql{ notfound = 1 reject = 2 } if(notfound){ update reply { Reply-Message := "Login Failed. Please check your Username and Password" } ok = reject } if(reject){ update reply { Reply-Message := "Login Failed. Please check your Username and Password" } ok = reject } However, I didn't understand how these notfound and reject values are received and how can I add an extra here. My requirement is that in case if user doesn't have available resources in their account, FR should send reply-message informing customer to recharge account. Currently I am using SQL to authenticate user and SQL query only authenticates user if they have resources available in their account. *Case 1:* User: Usman Volume: 100MB Request: User-name = usman *FR Response: Access Accept* *Case 2:* User: Usman Volume: 100MB Request: User-name = random *FR Response: Access Reject * *Reply-Message: "you have entered incorrect credentials"* *Case 3:* User: Usman Volume: 0MB Request: User-name = usman *FR Response: Access Reject * *Reply-Message: "you donot have resources available"* http://grasehotspot.org/documentation/freeradius/meaningful-reply-message-f…

2 2

Conflicting Packet
by battossai 08 Apr '15

08 Apr '15

Hi All, I've seen a lot from the archive that this error : *Wed Apr 8 10:39:43 2015 : Error: Discarding duplicate request from client ZIGY port 52824 - ID: 197 due to unfinished request 1182* *Wed Apr 8 10:39:43 2015 : Error: Discarding conflicting packet from client ZIGY port 40402 - ID: 199 due to recent request 1184.* *Wed Apr 8 10:39:43 2015 : Error: Discarding conflicting packet from client ZIGY port 48586 - ID: 201 due to recent request 1186.* *Wed Apr 8 10:41:43 2015 : Error: Received conflicting packet from client ZIGY port 49888 - ID: 239 due to unfinished request 1226. Giving up on old request.* was cause by an slow database or slow machine. Can i have a clue how to trace it out, because i don't know which table shoud be lood regagrading ID or request number. Is it posibble what should i do about slow database, how we measure it. Thank you. Regards, Franky Yu

3 2

MAC Auth Bypass and LDAP
by Brendan Kearney 07 Apr '15

07 Apr '15

i have RADIUS authN and authZ using kerberos and ldap working in my environment. from here i want to add MAC Auth Bypass and finally full .1x when i get a CA up and running. i plan to have MAC Auth Bypass as an interim solution, and will leave it in place when full .1x is running as a fallback method. i would like to get dynamic vlan assignment configured too. with that said, i am not sure of a few things. i am running v3.0.3 on Fedora 20. i have found the wiki article for MAC Auth, but that is for v2.x and a lot has changed from v2 to v3. because i am looking to leverage ldap lookups for MAC Auth Bypass, the info in the wiki does not seem applicable. where do i start looking for info around MAC Auth Bypass and ldap? the ldap module does not have anything that i am able to see as appropriate. i would like to avoid using the files module, as the mac address info, etc is in my ldap already. once i get MAB working, i want to begin assigning the VLAN based on MAC class or address. is the MAC the right data point to make that determination? i see the desire to have full .1x use dynamic VLAN assignment, too, so i want to make sure the decisions are not counter to each other. i am ultimately looking to have full .1x, with MAC Auth Bypass as a fallback, and in either case (or both, if that could/should be) have the VLAN assigned based on the outcome of the auth (or auth bypass). my logic would be: if the device passes .1x, the device is assigned to VLAN_X. if the device fails .1x, the device is assigned to VLAN_Z. if the device cannot do .1x, and passes MAC Auth Bypass (i.e. the MAC is known and is in ldap), the device is assigned to VLAN_Y. if the device cannot do .1x and fails MAC Auth Bypass, the device is assigned to VLAN_Z. since full .1x is not going to be turned up right now, the last two pieces of the logic are what i am looking to pursue at this point. any pointers on where to start would be appreciated.

3 4

Re: 1. Cant read radius.log (Adam Schappell)
by Rui Ribeiro 06 Apr '15

06 Apr '15

Hi all, Adding the user freerad to www-data group won't probably help. Adding the user www-data to freerad group, which is probably what you wanted to suggest is also a terrible ideia from the security point of view. You would better play with the permissions of the directory, or add the user www-data to the adm group (also not the best of the ideas). Pick your devil. A better solution would probably be configure syslog to log also to another less secure directory and configure daloradius accordingly. Regards > Message: 1 > Date: Mon, 6 Apr 2015 00:34:14 +0530 > From: Vijay S <vijay.hcr(a)gmail.com> > To: FreeRadius users mailing list > <freeradius-users(a)lists.freeradius.org> > Subject: Re: 1. Cant read radius.log (Adam Schappell) > Message-ID: > < > CAPTJ3-dCKGJcCu5EDB-DrRDUJ3CCBXiMJMa59Xvwg1tvkj2LXw(a)mail.gmail.com> > Content-Type: text/plain; charset=UTF-8 > > Hi > Following command will help you add users in other group so that web server > service owner user can read radius logs. > > Usermod -a -G www-data freerad > > Above should work on debian based distro. Else you can find the user owner > of both web server and radius services and replace them in above command. > On Apr 4, 2015 6:11 PM, "Rui Ribeiro" <ruyrybeyro(a)gmail.com> wrote: > > > Hi Adam, > > > > You have already been told Daloradius may not be the most appropriate or > up > > to date interface to use. > > > > Permissions may not be fine, and they are not certainly fine in my debian > > for 3rd party tools to access that file. PHP/CGI processes are run under > > the www-data user in Debian, not freerad. > > > > Regards > > > > > > > > > Message: 1 > > > Date: Fri, 3 Apr 2015 12:25:04 -0400 > > > From: Adam Schappell <aschappell(a)clearedgeit.com> > > > To: FreeRadius users mailing list > > > <freeradius-users(a)lists.freeradius.org> > > > Subject: Cant read radius.log > > > Message-ID: > > > < > > > CAHoRX4Kj9u29QAUeL3_dxUmO_P6JVgunA+ybWcZd8KGUZrq_kQ(a)mail.gmail.com> > > > Content-Type: text/plain; charset=UTF-8 > > > > > > Hello, > > > > > > In dalo radius I get the error: error reading log file: > > > > > > looked for log file in '/var/log/freeradius/radius.log, > > > /usr/local/var/log/radius/radius.log, /var/log/radius/radius.log' but > > > couldn't find it. > > > if you know where your freeradius log file is located, set it's > location > > in > > > /daloradius/rep-logs-radius.php > > > > > > I go through the file system and can find it at > > /var/log/radius/radius.log. > > > Weird thing is that if I just keep pressing tab it wont pick it up. I > > have > > > to stop at the radius/ and type ll and it will come up. Permissions > seem > > > fine. Cant really figure out why. And in the > > > /daloradius/rep-logs-radius.php, there is no where to set a path. > > > > > > Thanks. > > > > > > > > > > > > > > > > -- > > Regards, > > > > -- > > Rui Ribeiro > > Senior Sysadm > > ISCTE-IUL > > https://www.linkedin.com/pub/rui-ribeiro/16/ab8/434 > > - > > List info/subscribe/unsubscribe? See > > http://www.freeradius.org/list/users.html > > -- Regards, -- Rui Ribeiro Senior Sysadm ISCTE-IUL https://www.linkedin.com/pub/rui-ribeiro/16/ab8/434

1 0

1. Cant read radius.log (Adam Schappell)
by Rui Ribeiro 06 Apr '15

06 Apr '15

Hi Adam, You have already been told Daloradius may not be the most appropriate or up to date interface to use. Permissions may not be fine, and they are not certainly fine in my debian for 3rd party tools to access that file. PHP/CGI processes are run under the www-data user in Debian, not freerad. Regards > Message: 1 > Date: Fri, 3 Apr 2015 12:25:04 -0400 > From: Adam Schappell <aschappell(a)clearedgeit.com> > To: FreeRadius users mailing list > <freeradius-users(a)lists.freeradius.org> > Subject: Cant read radius.log > Message-ID: > < > CAHoRX4Kj9u29QAUeL3_dxUmO_P6JVgunA+ybWcZd8KGUZrq_kQ(a)mail.gmail.com> > Content-Type: text/plain; charset=UTF-8 > > Hello, > > In dalo radius I get the error: error reading log file: > > looked for log file in '/var/log/freeradius/radius.log, > /usr/local/var/log/radius/radius.log, /var/log/radius/radius.log' but > couldn't find it. > if you know where your freeradius log file is located, set it's location in > /daloradius/rep-logs-radius.php > > I go through the file system and can find it at /var/log/radius/radius.log. > Weird thing is that if I just keep pressing tab it wont pick it up. I have > to stop at the radius/ and type ll and it will come up. Permissions seem > fine. Cant really figure out why. And in the > /daloradius/rep-logs-radius.php, there is no where to set a path. > > Thanks. > > > > -- Regards, -- Rui Ribeiro Senior Sysadm ISCTE-IUL https://www.linkedin.com/pub/rui-ribeiro/16/ab8/434

4 4

Cant read radius.log
by Adam Schappell 03 Apr '15

03 Apr '15

Hello, In dalo radius I get the error: error reading log file: looked for log file in '/var/log/freeradius/radius.log, /usr/local/var/log/radius/radius.log, /var/log/radius/radius.log' but couldn't find it. if you know where your freeradius log file is located, set it's location in /daloradius/rep-logs-radius.php I go through the file system and can find it at /var/log/radius/radius.log. Weird thing is that if I just keep pressing tab it wont pick it up. I have to stop at the radius/ and type ll and it will come up. Permissions seem fine. Cant really figure out why. And in the /daloradius/rep-logs-radius.php, there is no where to set a path. Thanks.

1 0