May 2015 - Freeradius-Users - lists.freeradius.org

acct-session-start attribute ?
by Jeremy Ravel 10 Jun '15

10 Jun '15

Hi guys, I am beginner in FR. I want to be able to delay the activation of the login. For example i can create an user monday, but i just want allow him to connect only from friday to logon on my network. I tried to use the attribute acct-session-start on the user, but when i use it one user, the user can never log. I get this from the log: Thu May 28 16:18:16 2015 : Info: Ready to process requests. rad_recv: Access-Request packet from host 127.0.0.1 port 39465, id=155, length=277 ChilliSpot-Version = "1.3.0" User-Name = "day2" User-Password = "day2" Service-Type = Login-User Acct-Session-Id = "5567077800000003" Framed-IP-Address = 10.10.4.200 NAS-Port-Type = Wireless-802.11 NAS-Port = 3 NAS-Port-Id = "00000003" Calling-Station-Id = "00-1B-77-16-34-1A" Called-Station-Id = "00-50-56-B2-BF-8D" NAS-IP-Address = 10.10.4.254 NAS-Identifier = "vlan4" WISPr-Location-ID = "isocc=,cc=,ac=,network=Coova,Vlan4_ssid" WISPr-Location-Name = "Vlan_4" WISPr-Logoff-URL = " http://10.10.4.254:3990/logoff " Message-Authenticator = 0xee48deacd07a8f3d13df74480fa48198 Thu May 28 16:19:09 2015 : Info: # Executing section authorize from file /etc/freeradius/sites-enabled/default Thu May 28 16:19:09 2015 : Info: +- entering group authorize {...} Thu May 28 16:19:09 2015 : Info: ++? if (!NAS-IP-Address) Thu May 28 16:19:09 2015 : Info: ? Evaluating !(NAS-IP-Address) -> FALSE Thu May 28 16:19:09 2015 : Info: ++? if (!NAS-IP-Address) -> FALSE Thu May 28 16:19:09 2015 : Info: ++[preprocess] returns ok Thu May 28 16:19:09 2015 : Info: ++[chap] returns noop Thu May 28 16:19:09 2015 : Info: ++[mschap] returns noop Thu May 28 16:19:09 2015 : Info: ++[digest] returns noop Thu May 28 16:19:09 2015 : Info: [suffix] No '@' in User-Name = "day2", looking up realm NULL Thu May 28 16:19:09 2015 : Info: [suffix] No such realm "NULL" Thu May 28 16:19:09 2015 : Info: ++[suffix] returns noop Thu May 28 16:19:09 2015 : Info: [eap] No EAP-Message, not doing EAP Thu May 28 16:19:09 2015 : Info: ++[eap] returns noop Thu May 28 16:19:09 2015 : Info: [sql] expand: %{User-Name} -> day2 Thu May 28 16:19:09 2015 : Info: [sql] sql_set_user escaped user --> 'day2' Thu May 28 16:19:09 2015 : Debug: rlm_sql (sql): Reserving sql socket id: 3 Thu May 28 16:19:09 2015 : Info: [sql] expand: SELECT id, username, attribute, value, op FROM radcheck WHERE username = '%{SQL-User-Name}' ORDER BY id -> SELECT id, username, attribute, value, op FROM radcheck WHERE username = 'day2' ORDER BY id Thu May 28 16:19:09 2015 : Info: [sql] expand: SELECT groupname FROM usergroup WHERE username = '%{SQL-User-Name}' ORDER BY priority -> SELECT groupname FROM usergroup WHERE username = 'day2' ORDER BY priority Thu May 28 16:19:09 2015 : Info: [sql] expand: SELECT id, groupname, attribute, Value, op FROM radgroupcheck WHERE groupname = '%{Sql-Group}' ORDER BY id -> SELECT id, groupname, attribute, Value, op FROM radgroupcheck WHERE groupname = 'vlan_4' ORDER BY id Thu May 28 16:19:09 2015 : Debug: rlm_sql (sql): Released sql socket id: 3 Thu May 28 16:19:09 2015 : Info: [sql] User day2 not found Thu May 28 16:19:09 2015 : Info: ++[sql] returns notfound Thu May 28 16:19:09 2015 : Debug: rlm_sqlcounter: Entering module authorize code Thu May 28 16:19:09 2015 : Debug: rlm_sqlcounter: Could not find Check item value pair Thu May 28 16:19:09 2015 : Info: ++[chillispot_max_bytes] returns noop Thu May 28 16:19:09 2015 : Debug: rlm_sqlcounter: Entering module authorize code Thu May 28 16:19:09 2015 : Debug: rlm_sqlcounter: Could not find Check item value pair Thu May 28 16:19:09 2015 : Info: ++[noresetcounter] returns noop Thu May 28 16:19:09 2015 : Debug: rlm_sqlcounter: Entering module authorize code Thu May 28 16:19:09 2015 : Debug: rlm_sqlcounter: Could not find Check item value pair Thu May 28 16:19:09 2015 : Info: ++[dailycounter] returns noop Thu May 28 16:19:09 2015 : Info: ++[expiration] returns noop Thu May 28 16:19:09 2015 : Info: ++[logintime] returns noop Thu May 28 16:19:09 2015 : Info: [pap] WARNING! No "known good" password found for the user. Authentication may fail because of this. Thu May 28 16:19:09 2015 : Info: ++[pap] returns noop Thu May 28 16:19:09 2015 : Info: ERROR: No authenticate method (Auth-Type) found for the request: Rejecting the user Thu May 28 16:19:09 2015 : Info: Failed to authenticate the user. Thu May 28 16:19:09 2015 : Info: Using Post-Auth-Type Reject Thu May 28 16:19:09 2015 : Info: # Executing group from file /etc/freeradius/sites-enabled/default Thu May 28 16:19:09 2015 : Info: +- entering group REJECT {...} Thu May 28 16:19:09 2015 : Info: [sql] expand: %{User-Name} -> day2 Thu May 28 16:19:09 2015 : Info: [sql] sql_set_user escaped user --> 'day2' Thu May 28 16:19:09 2015 : Info: [sql] expand: %{User-Password} -> day2 Thu May 28 16:19:09 2015 : Info: [sql] expand: INSERT INTO radpostauth (user, pass, reply, date) VALUES ( '%{User-Name}', '%{%{User-Password}:-%{Chap-Password}}', '%{reply acket-Type}', '%S') -> INSERT INTO radpostauth (user, pass, reply, date) VALUES ( 'day2', 'day2', 'Access-Reject', ' 2015-05-28 16 :19:09') Thu May 28 16:19:09 2015 : Debug: rlm_sql (sql) in sql_postauth: query is INSERT INTO radpostauth (user, pass, reply, date) VALUES ( 'day2', 'day2', 'Access-Reject', ' 2015-05-28 16 :19:09') Thu May 28 16:19:09 2015 : Debug: rlm_sql (sql): Reserving sql socket id: 2 Thu May 28 16:19:09 2015 : Debug: rlm_sql (sql): Released sql socket id: 2 Thu May 28 16:19:09 2015 : Info: ++[sql] returns ok Thu May 28 16:19:09 2015 : Info: [attr_filter.access_reject] expand: %{User-Name} -> day2 Thu May 28 16:19:09 2015 : Debug: attr_filter: Matched entry DEFAULT at line 11 But if i dont give him, the attribute he can logon. If somone has any clue ? Thanks

2 15

implementing network authentication
by Randeep 10 Jun '15

10 Jun '15

Hi Guys, This is Randeep from Bangalore, India. I work in a small company. We are planning to provide ISP services shortly. The plan is as follows. We will have a mpls nation wide vpn network and in each city we will have a city POP where the local cable operators can connect to our network. From the local cable operators we will reach the customers. So we are planning to use FreeRadius for the network authentication. We will have our centralized Radius server in Bangalore and in each city POP we will have a NAS(Network Access Server), most probably a Mikrotik router. The customers will as for authentication to the NAS and nas will forward the request to the radius and radius will validate it. Our plan for customer creation is as follows. >From our website, we will be able to create new customers. From the website we will be creating the broadband plans(includes the bandwidth available to the customer like 10mbps and the data limit etc). The issues are: I couldn't find any apis for the freeradius to create the plans or create the users or specify the plan details. How can I do this? We will be using mysql along with FreeRadius. What I understood from the google is the radius will send the VSA to the NAS for limiting the user access. But from where the FreeRadius will get these values? Can we write this to the mysql tables? And I learned that the NAS will update the Radius about the usage periodically. But to which table in FreeRadius this will be written? And will the freeRadius will compare the total data the user consumed and his limit when the radius validate the next request from the user? Is there any rules we need to write for this? We would like to use PPPoE for auth. We have to run the PPPoE on Mikrotik? also the ip pools we have to allot there? And we would like to do two kind of logins. 1. A browser page redirection when the user tries to start using interent. Which asks for password and username. 2. PPPoE dialer for android Can you guys please clear these or suggest if any other better scenario for implementing this kind of solution? Best Regards, Randeep

2 3

[Attrs Regex]
by Thomas Fagart 08 Jun '15

08 Jun '15

Hello, We were sucessfuly using regexp on keys in attr_filter module with FR 2.1.6 FreeBSD 8.0 Something like that in attrs file : "~\^$.+$\\.telco$" Framed-IP-Address =* ANY, Framed-IP-Netmask =* ANY, Framed-MTU =* ANY, Service-Type =* ANY, Framed-Protocol =* ANY, ERX-Virtual-Router-Name := "test", Tunnel-Type:0 =* ANY, Tunnel-Preference:0 =* ANY, Tunnel-Medium-Type:0 =* ANY, Tunnel-Client-Endpoint:0 =* ANY, Tunnel-Server-Endpoint:0 =* ANY, Tunnel-Assignment-Id:0 =* ANY, Tunnel-Client-Auth-Id:0 =* ANY, Tunnel-Server-Auth-Id:0 =* ANY, Class =* ANY After upgrading to FR 2.2.6 Freebsd 10.0, I've got the feeling that this regular expression on realm attribute does not work anymore. I've also noticed that the same regular expression still work in proxy.conf. Tue May 12 02:07:30 2015 : Debug: [suffix] Looking up realm "toto.telco" for User-Name = "test(a)toto.telco" Tue May 12 02:07:30 2015 : Debug: [suffix] Found realm "~^(.+)\.telco$" Tue May 12 02:07:30 2015 : Debug: [suffix] Adding Realm = "toto.telco" Tue May 12 02:07:30 2015 : Debug: [suffix] Proxying request from user test to realm ~^(.+)\.telco$ Tue May 12 02:07:30 2015 : Debug: [suffix] Preparing to proxy authentication request to realm "~^(.+)\.telco$" ... Tue May 12 02:07:30 2015 : Debug: +group post-proxy { Tue May 12 02:07:30 2015 : Debug: [attr_filter.post-proxy] expand: %{Realm} -> toto.telco Tue May 12 02:07:30 2015 : Debug: ++[attr_filter.post-proxy] = noop Tue May 12 02:07:30 2015 : Debug: +} # group post-proxy = noop After spending some time on the mailing list and the doc, I've got different ideas to solve that : 1. The new FR might not have been compile properly with pcre lib (as this was a package) (radiusd -Xv does not tell me wether this is the case or not) 2. The way regex work have change and I should fine the proper one 3. FR 3.x.x has been rewriten and should work better 4. Do not use rlm_attrs_filter and do something else (unlang ?) Could you advise ? Many thanks Thomas

5 9

permit access on date/hour intervals and policy.conf problem
by Franz Angeli 04 Jun '15

04 Jun '15

Hi, I need to be able to specify an interval of date and time for accessing through a captive portal connected to freeradius; for example testuser can use network from 2015-05-01 17:00:00 to 2015-05-01 18:00:00 i create 3 custom attributes: ATTRIBUTE System-Date 3002 integer ATTRIBUTE Start_Time 3000 integer ATTRIBUTE Stop_Time 3001 integer System-Date to store system data Start_Time to assign a start auth period for user Stop_Time to assign the end of auithentication permission. I use UNIX time for every attribute for provisioning purpose i use Freeradius + MySQL and in my radcheck table i have for example: testuser | Cleartext-Password | := | testuser testuser | Start_Time | := | 1430499600 testuser | Stop_Time | := | 1430503200 to check account validity i add on policy.conf : check_validity { update control { System-Date := "%l" } if (Start_Time > control:System-Date) { update reply { Reply-Message := "account not yet active" } reject } if (Stop_Time < control:System-Date) { update reply { Reply-Message := "account no longer active" } reject } } freeradius start without error, System-Date take the correct value for Date but Start_Time and Stop_Time in this way seems to work with a file not mysql...(yes my default site has check_validity in authorize section) I don't know how use a query to assign database stored value for Start_Time and Stop_TIme, is it possbile? I need some examples... Thanks in advance Franz Angeli

2 12

Fallback method of authentication
by Rafael Domingues Quitério 03 Jun '15

03 Jun '15

Hi everybody; I have installed FreeRADIUS Version 3.0.7 from source and it's doing machine authentication on a Windows domain. The radius server is a samba member. The place doesn't have a DC, so, the radius authentication is done to a remote DC. If the WAN link to the DC site fails, machine authentication on the Freradius server will fail. Because of that , I'm considering having a fallback method for authentication (files) when the link goes down. Is that possible to implement via the configuration files? Could somebody give me hints to achieve that. Thanks very much for the help. Rafael

2 3

error in the queries.conf file
by Pawel Bien 02 Jun '15

02 Jun '15

I found an error in the file raddb/mods-config/sql/main/mysql/queries.conf (fr 3.0.7) There is missing value for connectinfo_stop field in the SQL INSERT statement (after '%{Connect-Info}' in the line 380). This cause an error: rlm_sql_mysql: MySQL error 'Column count doesn't match value count at row 1' accounting { (...) type { (...) stop { (...) # # The update condition matched no existing sessions. Use # the values provided in the update to create a new session. # query = "\ INSERT INTO ${....acct_table2} \ (${...column_list}) \ VALUES \ ('%{Acct-Session-Id}', \ '%{Acct-Unique-Session-Id}', \ '%{SQL-User-Name}', \ '%{Realm}', \ '%{NAS-IP-Address}', \ '%{NAS-Port}', \ '%{NAS-Port-Type}', \ FROM_UNIXTIME(%{integer:Event-Timestamp} - \ %{%{Acct-Session-Time}:-0}), \ FROM_UNIXTIME(%{integer:Event-Timestamp}), \ FROM_UNIXTIME(%{integer:Event-Timestamp}), \ '%{Acct-Session-Time}', \ '%{Acct-Authentic}', '', \ '%{Connect-Info}', \ <-missing value after this '%{%{Acct-Input-Gigawords}:-0}' << 32 | \ '%{%{Acct-Input-Octets}:-0}', \ '%{%{Acct-Output-Gigawords}:-0}' << 32 | \ '%{%{Acct-Output-Octets}:-0}', \ '%{Called-Station-Id}', \ '%{Calling-Station-Id}', \ '%{Acct-Terminate-Cause}', \ '%{Service-Type}', \ '%{Framed-Protocol}', \ '%{Framed-IP-Address}')" } } } Just add next line with '', \ after '%{Connect-Info}', \ The similar error is duplicated in queries.conf template for the other database types (mssql, oracle, sqlite) except postgresql. Cheers, Pawel Bien

3 3

Question regarding Git config management
by Sebastian Hagedorn 01 Jun '15

01 Jun '15

Hi, we would like to use the Git config management as outlined here: <http://wiki.freeradius.org/guide/Git-config-management> For our new Freeradius environment we will have a separate development server, one staging server and four production servers, but right now it's not in production yet. It took me a while, but I got things working in general. However, I'm pretty sure I found a bug in the post-receive hook: <https://github.com/alandekok/freeradius-server/blob/master/scripts/git/post…> At least on a RHEL 6 system with Bash as /bin/sh, the syntax in line 109 causes an error: "if ! conf_check then" I has to be either "if ! conf_check; then" or "if ! conf_check then" But now I have found an issue that's potentially harder to work around. When I create an intentional syntax error, the post-receive hook works great: # git push radius4 Counting objects: 11, done. Delta compression using up to 2 threads. Compressing objects: 100% (7/7), done. Writing objects: 100% (7/7), 687 bytes, done. Total 7 (delta 5), reused 0 (delta 0) remote: HEAD is now at 90caabb Syntaxfehler remote: Checking new configuration... Copyright (C) 1999-2015 The FreeRADIUS server project and contributors remote: There is NO warranty; not even for MERCHANTABILITY or FITNESS FOR A remote: PARTICULAR PURPOSE remote: You may redistribute copies of FreeRADIUS under the terms of the remote: GNU General Public License remote: For more information about these matters, see the file named COPYRIGHT remote: Starting - reading configuration files ... remote: /etc/raddb/sites-enabled/rrzk-webprojekte[107]: Syntax error: Expected comma after '1818': { remote: Errors reading or parsing /etc/raddb/radiusd.conf remote: failed remote: WARNING: FreeRADIUS found errors in the configuration, remote: please fix the errors and push the corrected configuration. remote: Attempting to roll config back to tag: "stable"... HEAD is now at 29e1232 Absichtlicher Fehler remote: ok To ssh://radiusd@radius4/etc/raddb 29e1232..90caabb master -> master When I create an error that's only detected at runtime, however, it does not seem to work. I changed the configuration so that two virtual servers were listening on the same port. The "radmin -e hup" command did not throw an error. Consequently the commit was tagged as "stable". When I tried to manually restart Freeradius on the remote server, it didn't start anymore (as expected). At that point I wasn't even able to push a fix, because radmin doesn't work when the server isn't running, and so the post-receive hook reverted back to the "stable" version! I had to fix the error manually on the remote server to get things working again. I'm not sure what can be done about that, if anything, but at the very least I would like to have a better understanding of what class of error gets past a "radmin -e hup". Normally we would always test configuration changes locally on the staging server, so that errors like the one above shouldn't ever get pushed to a production system. But as you know, eventually everything that can go wrong will go wrong ... Thanks Sebastian -- .:.Sebastian Hagedorn - Weyertal 121 (Gebäude 133), Zimmer 2.02.:. .:.Regionales Rechenzentrum (RRZK).:. .:.Universität zu Köln / Cologne University - ✆ +49-221-470-89578.:.

3 16

Different behaviour of 2.2.0 and 2.2.6 in handling Post-auth-type reject
by Wiesław Bieniek 31 May '15

31 May '15

Hello, I've used default server configured as follows: post-auth { # my module decides to allow or reject request rtdps2 Post-Auth-Type REJECT { attr_filter.access_reject } } When I run this on 2.2.0 I got debug: Thu Nov 27 14:28:44 2014 : Info: ++[rtdps2] returns reject Thu Nov 27 14:28:44 2014 : Info: Using Post-Auth-Type REJECT Thu Nov 27 14:28:44 2014 : Info: # Executing group from file ../etc/raddb/sites-enabled/default Thu Nov 27 14:28:44 2014 : Info: +- entering group REJECT {...} Thu Nov 27 14:28:44 2014 : Info: [attr_filter.access_reject] expand: %{User-Name} -> testing Thu Nov 27 14:28:44 2014 : Debug: attr_filter: Matched entry DEFAULT at line 11 Thu Nov 27 14:28:44 2014 : Info: ++[attr_filter.access_reject] returns updated Sending Access-Reject of id 80 to 192.168.1.4 port 33304 Cisco-AVPair := "h323-return-code=8" Which is correct, but when I run it in 2.2.6 I got: Thu Nov 27 14:19:35 2014 : Info: ++[rtdps2] = reject Thu Nov 27 14:19:35 2014 : Info: +} # group post-auth = reject Sending Access-Reject of id 186 to 192.168.1.4 port 49975 Service-Type = 0 Framed-Protocol = 0 Cisco-AVPair := "h323-return-code=8" Thu Nov 27 14:19:35 2014 : Info: Finished request 0. Which is wrong, because attributes was not filtered out. Am I missing something ? Is this a bug ? What to do to make version 2.2.6 to work the same way 2.2.0 does ? Regards- *Wiesław Bieniek* <http://www.comarch.pl>

3 14

Building on CentOS 7; rlm_sql_mysql segmentation fault
by firing neurons 30 May '15

30 May '15

Hi! After testing CoA on the latest HEAD, I wanted to test and use 3.0.8. CentOS 7 repo has 3.0.4 binaries. I used maraidb libs and includes to build mysql driver. I get a segmentation fault when loading. This happened with the latest HEAD. I am yet to build 3.0.8 . debug(bold text present in debug): rlm_sql (sql): Driver rlm_sql_mysql (module rlm_sql_mysql) loaded and linked Creating attribute SQL-Group # Loaded module rlm_sqlcounter # Loading module "dailycounter" from file /usr/local/etc/raddb/mods-enabled/sqlcounter sqlcounter dailycounter { sql_module_instance = "sql" key = "User-Name" query = "SELECT SUM(acctsessiontime - GREATEST((%%b - UNIX_TIMESTAMP(acctstarttime)), 0)) FROM radacct WHERE username = '%{User-Name}' AND UNIX_TIMESTAMP(acctstarttime) + acctsessiontime > '%%b'" reset = "daily" counter_name = "Daily-Session-Time" check_name = "Max-Daily-Session" reply_name = "Session-Timeout" } Segmentation fault (core dumped) FR

2 1

SOLVED segmentation fault on coa ACK (Freeradius-Users Digest, Vol 121, Issue 92)
by firing neurons 30 May '15

30 May '15

I tried the latest from git with commit dd6fc66744096dfa22db9025227332fbcead5ec8. It is working!Thank you! I should have tried the latest version first. FreeRADIUS is awesome! I will try the 3.0.8 stable. Is there a schedule for stable releases? > radiusd: FreeRADIUS Version 3.0.4, for host x86_64-redhat-linux-gnu, > built on Mar 5 2015 at 23:41:36 Please check if this still happens with v3.0.x HEAD, there have been many bug fixes related to CoA since version 3.0.4 was released. -Arran Arran Cudbard-Bell <a.cudbardb(a)freeradius.org> FreeRADIUS development team FD31 3077 42EC 7FCD 32FE 5EE2 56CF 27F9 30A8 CAA2

2 1