April 2015 - Freeradius-Users - lists.freeradius.org

How to find if the LDAP server is not rechable
by Adarsha S 21 Apr '15

21 Apr '15

Hi, I've a setup with freeradius-server-2.2.3 and Windows AD 2008 [LDAP server]for authentication. I need to implement fall back feature where if Windows AD server is not reachable , I need to authenticate using local database. The problem I'm facing is : When LDAP server is reachable and giving wrong password result is RLM_MODULE_REJECT. LDAP server not reachable the result is RLM_MODULE_FAIL. But for both the case reply code will be PW_AUTHENTICATION_REJECT. So please guide me in how to differentiate LDAP server not reachability from error due to wrong credentials. Thanks, Adarsha

3 4

Re: config section in rlm_perl module
by Peter Balsianok 21 Apr '15

21 Apr '15

On Tue, Apr 21, 2015 at 1:04 PM, Arran Cudbard-Bell < a.cudbardb(a)freeradius.org> wrote: > > > On 21 Apr 2015, at 11:11, Peter Balsianok <balsianok.peter(a)gmail.com> > wrote: > > > > Hi, > > > > You are not right. %RAD_PERLCONF is available also during > 'Instantiation'. > > Yeah, but that's still calling a perl subroutine, just without a request > pointer. > > > The question is: Would it be available also during compilation phase > (like > > radiusd::radlog) > > For that to work you'd need to get it into the perl environment as a > global, before parsing the perl file. It'd also have to be made constant to > prevent people from doing stupid things. > > I'll take a look at it and see if it's doable. > Config section (example) config { path = value } in freeradius will be created before parsing: use constant RAD_PERLCONF => { path => value }; then you can use it RAD_PERLCONF->{path} Of course, if it`s possible. > > I just... feel so dirty after looking at perl... or the embedding API... > or the documentation for the embedding API. It's like digging in to a big > bowl of chocolate pudding, to discover it's actually dog shit. > > You are right.

1 0

Problem with regular expression in huntgroups
by Angel L. Mateo 21 Apr '15

21 Apr '15

Hello, I'm migrating my current freeradius2 configuration to freeradius3. In my current FR2 configuration I have rules to check for huntgroups like: test_huntgroup NAS-IP-Address =~ ^10\.57\.1\.[0-9]+$ This same rule is not working in my FR3 configuration. Running FR in debug mode shows: .... (0) NAS-IP-Address = 10.57.1.50 (0) NAS-Identifier = 'RADIUS-PRUEBAS' (0) # Executing section authorize from file /etc/freeradius/sites-enabled/eduroam (0) authorize { (0) preprocess: EXPAND /10\.57\.1\.[0-9]+$/ (0) preprocess: --> /10\.57\.1\.[0-9]+$/ (0) preprocess: EXPAND ^10\.57\.8\.[0-9]+$ (0) preprocess: --> ^10\.57\.8\.[0-9]+$ (0) preprocess: EXPAND ^10\.57\.14\.[0-9]+$ (0) preprocess: --> ^10\.57\.14\.[0-9]+$ ... (0) [preprocess] = ok ... but no huntgroup is assigned. I have tried putting the RE inside // with the same result. Any help? Thank you. -- Angel L. Mateo Martínez Sección de Telemática Área de Tecnologías de la Información y las Comunicaciones Aplicadas (ATICA) http://www.um.es/atica Tfo: 868887590 Fax: 868888337

3 5

Log control attributes
by Peter Balsianok 21 Apr '15

21 Apr '15

Hi, Is there any way how to log all control attributes via detail or linelog in the freeradius ? Thx.

3 4

Re: Freeradius-Users Digest, Vol 120, Issue 78
by Rui Ribeiro 21 Apr '15

21 Apr '15

Olá, I won't mind answering small questions in our mother tongue. Forward them to my email. If need be, we will talk by voice. Email is so much less disruptive. Regards On 20 April 2015 at 19:28, <freeradius-users-request(a)lists.freeradius.org> wrote: > > > Message: 1 > Date: Mon, 20 Apr 2015 18:22:36 +0430 > From: "ademaiasantos(a)gmail.com" <ademaiasantos(a)gmail.com> > To: FreeRadius users mailing list > <freeradius-users(a)lists.freeradius.org> > Subject: Re: need a small help urgently > Message-ID: <553504A4.20000(a)gmail.com> > Content-Type: text/plain; charset=utf-8; format=flowed > > perfect suggestion, > you have skype i have just some small question > or please add mine: skype: morteza.22603 > > Thanks, waiting for you. > > > -- Regards, -- Rui Ribeiro Senior Sysadm ISCTE-IUL https://www.linkedin.com/pub/rui-ribeiro/16/ab8/434

1 0

SQL module question...
by Stefan Paetow 20 Apr '15

20 Apr '15

So, I know that there've been several changes to how the sql module loads. On one site, there is only one query, in a sql xlat, and the question is now about an error that the site is getting: (14) sql: EXPAND .query (14) sql: --> .query No such configuration item .query Granted, all table entries and the '$INCLUDE' for query.conf were commented out on the basis that only the sql xlat would be used, but why would the xlat still be looking for the 'post-auth.query' entry in the sql module (or the query.conf for that matter)? We've gotten around it by defining a 'post-auth { query = "select * from ..." }' line in the sql module to make it happy, but it seems to me that if you use a sql xlat, and there is no other call to 'sql' or '-sql' in the post-auth section, it shouldn't be looking for the post-auth.query string... Thoughts? Stefan Paetow Moonshot Industry & Research Liaison Coordinator t: +44 (0)1235 822 125 gpg: 0x3FCE5142 xmpp: stefanp(a)jabber.dev.ja.net skype: stefan.paetow.janet Lumen House, Library Avenue, Harwell Oxford, Didcot, OX11 0SG jisc.ac.uk Jisc is a registered charity (number 1149740) and a company limited by guarantee which is registered in England under Company No. 5747339, VAT No. GB 197 0632 86. Jisc’s registered office is: One Castlepark, Tower Hill, Bristol, BS2 0JA. T 0203 697 5800. Jisc Collections and Janet Ltd. is a wholly owned Jisc subsidiary and a company limited by guarantee which is registered in England under Company No. number 2881024, VAT No. GB 197 0632 86. The registered office is: Lumen House, Library Avenue, Harwell, Didcot, Oxfordshire, OX11 0SG. T 01235 822200.

2 2

sql authorize with password and mac
by Marcin 20 Apr '15

20 Apr '15

Hi, I've that config for query: #v+ authorize_check_query = "SELECT \ id, lower(name) as UserName , 'Cleartext-Password' as Attribute , passwd as Value, ':=' as op \ FROM nodes \ WHERE name = '%{User-Name}'\ UNION \ SELECT n.id, lower(name) as UserName, 'Calling-Station-Id' as Attribute, upper(mac) as Value, ':=' as op FROM \ nodes n, macs m \ WHERE lower(name) = '%{User-Name}' and access=1 AND n.id = m.nodeid \ UNION \ SELECT id, lower(name) as UserName , 'Simultaneous-Use' as Attribute, '1' as Value, ':=' as op \ FROM nodes \ WHERE name = '%{User-Name}'\ ;" #v- callint station id from database doesn't contain proper mac, but authorization is accepted #v+ (0) Received Access-Request Id 100 from 172.21.7.176:43226 to 172.21.7.175:1812 length 145 (0) Service-Type = Framed-User (0) Framed-Protocol = PPP (0) NAS-Port = 15728670 (0) NAS-Port-Type = Ethernet (0) User-Name = 'serwis' (0) Calling-Station-Id = '08:00:27:D6:04:2D' (0) Called-Station-Id = 'MtekPPPoE' (0) NAS-Port-Id = 'bridge1' (0) CHAP-Challenge = 0xc2d72642e5e288f7079288c64afa13bb (0) CHAP-Password = 0x0140f664ed644130bfdf53268c444c8382 (0) NAS-Identifier = 'TestowyMT' (0) NAS-IP-Address = 172.21.7.176 (0) # Executing section authorize from file /etc/freeradius/sites-enabled/default (0) authorize { (0) policy filter_username { (0) if (!&User-Name) { (0) if (!&User-Name) -> FALSE (0) if (&User-Name =~ / /) { (0) if (&User-Name =~ / /) -> FALSE (0) if (&User-Name =~ /@.*@/ ) { (0) if (&User-Name =~ /@.*@/ ) -> FALSE (0) if (&User-Name =~ /\.\./ ) { (0) if (&User-Name =~ /\.\./ ) -> FALSE (0) if ((&User-Name =~ /@/) && (&User-Name !~ /(a)(.+)\.(.+)$/)) { (0) if ((&User-Name =~ /@/) && (&User-Name !~ /(a)(.+)\.(.+)$/)) -> FALSE (0) if (&User-Name =~ /\.$/) { (0) if (&User-Name =~ /\.$/) -> FALSE (0) if (&User-Name =~ /(a)\./) { (0) if (&User-Name =~ /(a)\./) -> FALSE (0) } # policy filter_username = notfound (0) [preprocess] = ok (0) chap: &control:Auth-Type := CHAP (0) [chap] = ok (0) [mschap] = noop (0) [digest] = noop (0) suffix: Checking for suffix after "@" (0) suffix: No '@' in User-Name = "serwis", looking up realm NULL (0) suffix: No such realm "NULL" (0) [suffix] = noop (0) eap: No EAP-Message, not doing EAP (0) [eap] = noop (0) redundant (null) { (0) sqlms: EXPAND %{User-Name} (0) sqlms: --> serwis (0) sqlms: SQL-User-Name set to 'serwis' rlm_sql (sqlms): 0 of 0 connections in use. You may need to increase "spare" rlm_sql (sqlms): Opening additional connection (0), 1 of 10 pending slots used rlm_sql_postgresql: Connecting using parameters: dbname='lms' host='172.21.7.29' port=5432 user='user' password='pass' Connected to database 'lms' on '172.21.7.29' server version 90401, protocol version 3, backend PID 17929 rlm_sql (sqlms): Reserved connection (0) (0) sqlms: EXPAND SELECT id, lower(name) as UserName , 'Cleartext-Password' as Attribute , passwd as Value, ':=' as op FROM nodes WHERE name = '%{User-Name}' UNION SELECT n.id, lower(name) as UserName, 'Calling-Station-Id' as Attribute, upper(mac) as Value, ':=' as op FROM nodes n, macs m WHERE lower(name) = '%{User-Name}' and access=1 AND n.id = m.nodeid UNION SELECT id, lower(name) as UserName , 'Simultaneous-Use' as Attribute, '1' as Value, ':=' as op FROM nodes WHERE name = '%{User-Name}' ; (0) sqlms: --> SELECT id, lower(name) as UserName , 'Cleartext-Password' as Attribute , passwd as Value, ':=' as op FROM nodes WHERE name = 'serwis' UNION SELECT n.id, lower(name) as UserName, 'Calling-Station-Id' as Attribute, upper(mac) as Value, ':=' as op FROM nodes n, macs m WHERE lower(name) = 'serwis' and access=1 AND n.id = m.nodeid UNION SELECT id, lower(name) as UserName , 'Simultaneous-Use' as Attribute, '1' as Value, ':=' as op FROM nodes WHERE name = 'serwis' ; (0) sqlms: Executing select query: SELECT id, lower(name) as UserName , 'Cleartext-Password' as Attribute , passwd as Value, ':=' as op FROM nodes WHERE name = 'serwis' UNION SELECT n.id, lower(name) as UserName, 'Calling-Station-Id' as Attribute, upper(mac) as Value, ':=' as op FROM nodes n, macs m WHERE lower(name) = 'serwis' and access=1 AND n.id = m.nodeid UNION SELECT id, lower(name) as UserName , 'Simultaneous-Use' as Attribute, '1' as Value, ':=' as op FROM nodes WHERE name = 'serwis' ; rlm_sql_postgresql: Status: PGRES_TUPLES_OK rlm_sql_postgresql: query affected rows = 3 , fields = 5 (0) sqlms: User found in radcheck table (0) sqlms: Conditional check items matched, merging assignment check items (0) sqlms: Cleartext-Password := 'serwis*' (0) sqlms: Simultaneous-Use := 1 (0) sqlms: Calling-Station-Id := '00:02:2D:8B:67:C3' (0) sqlms: EXPAND SELECT id, lower(name) as UserName , 'Framed-IP-Address' as Attribute, inet_ntoa(ipaddr) as Value, '=' as op FROM nodes WHERE name = '%{User-Name}' UNION SELECT id, lower(name) as UserName , 'Acct-Interim-Interval' as Attribute , '300' as Value, '=' as op FROM nodes WHERE name='%{User-Name}'; (0) sqlms: --> SELECT id, lower(name) as UserName , 'Framed-IP-Address' as Attribute, inet_ntoa(ipaddr) as Value, '=' as op FROM nodes WHERE name = 'serwis' UNION SELECT id, lower(name) as UserName , 'Acct-Interim-Interval' as Attribute , '300' as Value, '=' as op FROM nodes WHERE name='serwis'; (0) sqlms: Executing select query: SELECT id, lower(name) as UserName , 'Framed-IP-Address' as Attribute, inet_ntoa(ipaddr) as Value, '=' as op FROM nodes WHERE name = 'serwis' UNION SELECT id, lower(name) as UserName , 'Acct-Interim-Interval' as Attribute , '300' as Value, '=' as op FROM nodes WHERE name='serwis'; rlm_sql_postgresql: Status: PGRES_TUPLES_OK rlm_sql_postgresql: query affected rows = 2 , fields = 5 (0) sqlms: User found in radreply table, merging reply items (0) sqlms: Acct-Interim-Interval = 300 (0) sqlms: Framed-IP-Address = 192.168.168.254 rlm_sql (sqlms): Released connection (0) rlm_sql (sqlms): 0 of 1 connections in use. Need more spares rlm_sql (sqlms): Opening additional connection (1), 1 of 9 pending slots used rlm_sql_postgresql: Connecting using parameters: dbname='lms' host='172.21.7.29' port=5432 user='user' password='pass' Connected to database 'lms' on '172.21.7.29' server version 90401, protocol version 3, backend PID 17930 (0) [sqlms] = ok (0) } # redundant (null) = ok (0) [expiration] = noop (0) [logintime] = noop (0) pap: WARNING: Auth-Type already set. Not setting to PAP (0) [pap] = noop (0) } # authorize = ok (0) Found Auth-Type = CHAP (0) # Executing group from file /etc/freeradius/sites-enabled/default (0) Auth-Type CHAP { (0) chap: Comparing with "known good" Cleartext-Password (0) chap: CHAP user "serwis" authenticated successfully (0) [chap] = ok (0) } # Auth-Type CHAP = ok (0) # Executing section session from file /etc/freeradius/sites-enabled/default (0) session { (0) radutmp: EXPAND /var/log/freeradius/radutmp (0) radutmp: --> /var/log/freeradius/radutmp (0) radutmp: EXPAND %{User-Name} (0) radutmp: --> serwis (0) [radutmp] = ok (0) } # session = ok (0) # Executing section post-auth from file /etc/freeradius/sites-enabled/default (0) post-auth { (0) update { (0) No attributes updated (0) } # update = noop (0) [exec] = noop (0) policy remove_reply_message_if_eap { (0) if (&reply:EAP-Message && &reply:Reply-Message) { (0) if (&reply:EAP-Message && &reply:Reply-Message) -> FALSE (0) else { (0) [noop] = noop (0) } # else = noop (0) } # policy remove_reply_message_if_eap = noop (0) } # post-auth = noop (0) Sent Access-Accept Id 100 from 172.21.7.175:1812 to 172.21.7.176:43226 length 0 (0) Acct-Interim-Interval = 300 (0) Framed-IP-Address = 192.168.168.254 (0) Finished request Waking up in 4.9 seconds. #v- Why authorization is ok when calling station is different from database? -- Pozdrawiam Marcin / nicraM

2 2

need a small help urgently
by ademaiasantos＠gmail.com 20 Apr '15

20 Apr '15

Hello i use this radius: http://pkgs.fedoraproject.org/repo/pkgs/pam_radius/pam_radius-1.3.17.tar.gz… unfortunately i have below issue: i connected two server at this file: nano /pam_radius-1.3.17/pam_radius_auth.conf but when i did it, radius just will connect to second server when first server be failed, otherwise second server in radius will not work. i need it use from two servers in the same time. Please help me. Thanks.

3 8

need a small help urgently
by ademaiasantos＠gmail.com 20 Apr '15

20 Apr '15

Hello i use this radius: http://pkgs.fedoraproject.org/repo/pkgs/pam_radius/pam_radius-1.3.17.tar.gz… unfortunately i have below issue: i connected two server at this file: nano /pam_radius-1.3.17/pam_radius_auth.conf but when i did it, radius just will connect to second server when first server be failed, otherwise second server in radius will not work. i need it use from two servers in the same time. Please help me. Thanks.

1 0

IP Allocation FAILED
by battossai 20 Apr '15

20 Apr '15

Hi, What should i do if some user get disconnected but don't get their ip again. I've set up allocation 1 ip to that user, but when get disconnected did not get the correct ip, in fact the user get another ip. It seems that the ip still active on radippool table, i have set up lease time for 300 second. Is there any clue how to fixed up this ? I give log from this issue. Thanky you in advanced. Mikrotik as NAS Log : Apr 19 15:19:17 DR2.SMG <pppoe-pxxx(a)gmedia.co.id>: terminating... - disconnected Apr 19 15:19:17 DR2.SMG pxxx(a)gmedia.co.id logged out, 141693 245159396 1882849781 2858800 2537848 Apr 19 15:19:17 DR2.SMG <pppoe-pxxx(a)gmedia.co.id>: disconnected Apr 19 15:20:23 DR2.SMG pxxx(a)gmedia.co.id logged in, 0.0.0.0 Apr 19 15:20:23 DR2.SMG <pppoe-pxxx(a)gmedia.co.id>: could not determine remote address, using 10.112.218.170 Radius Log : Sun Apr 19 15:19:17 2015 : Info: Released IP 103.247.123.79 (did PPPoE.Service.Vlan344 cli 00:0C:42:E6:62:F1 user pxxx(a)gmedia.co.id) Sun Apr 19 15:19:19 2015 : Auth: Login OK: [pxxx(a)gmedia.co.id/<via Auth-Type = MSCHAP>] (from client ZIGY port 15948795 cli 00:0C:42:E6:62:F1) Sun Apr 19 15:19:32 2015 : Auth: Login OK: [pxxx(a)gmedia.co.id/<via Auth-Type = MSCHAP>] (from client ZIGY port 15948800 cli 00:0C:42:E6:62:F1) Sun Apr 19 15:19:45 2015 : Auth: Login OK: [pxxx(a)gmedia.co.id/<via Auth-Type = MSCHAP>] (from client ZIGY port 15948805 cli 00:0C:42:E6:62:F1) Sun Apr 19 15:19:58 2015 : Auth: Login OK: [pxxx(a)gmedia.co.id/<via Auth-Type = MSCHAP>] (from client ZIGY port 15948810 cli 00:0C:42:E6:62:F1) Sun Apr 19 15:20:11 2015 : Auth: Invalid user: [pxxx(a)gmedia.co.id/<via Auth-Type = MSCHAP>] (from client ZIGY port 15948815 cli 00:0C:42:E6:62:F1) Sun Apr 19 15:20:13 2015 : Info: IP Allocation FAILED from 108 (did PPPoE.Service.Vlan344 cli 00:0C:42:E6:62:F1 port 15948800 user pxxx(a)gmedia.co.id) Sun Apr 19 15:20:14 2015 : Info: IP Allocation FAILED from 108 (did PPPoE.Service.Vlan344 cli 00:0C:42:E6:62:F1 port 15948805 user pxxx(a)gmedia.co.id) Sun Apr 19 15:20:14 2015 : Info: IP Allocation FAILED from 108 (did PPPoE.Service.Vlan344 cli 00:0C:42:E6:62:F1 port 15948810 user pxxx(a)gmedia.co.id) Sun Apr 19 15:20:23 2015 : Auth: Login OK: [pxxx(a)gmedia.co.id/<via Auth-Type = MSCHAP>] (from client ZIGY port 15948820 cli 00:0C:42:E6:62:F1) Sun Apr 19 15:20:23 2015 : Info: IP Allocation FAILED from 108 (did PPPoE.Service.Vlan344 cli 00:0C:42:E6:62:F1 port 15948820 user pxxx(a)gmedia.co.id) Regards, Franky Yu

2 1