June 2015 - Freeradius-Users - lists.freeradius.org

duplicate acctuniqueid problem
by d tbsky 12 Jun '15

12 Jun '15

Hi: I am testing 802.1x accounting under fr 3.0.8. steps below: 1. use my notebook to login AP. accounting begin. 2. poweroff/poweron the AP. AP send "Accounting on". and previous accounting log closed with "NAS-Reboot".that's good. 3. use my notebook to login AP. fr can not create a new accounting entry, it seems "Acct-Session-Id" will be reused and cause "acctuniqueid" duplicate. error message like below: (11) sql: rlm_sql_mysql: ERROR 1062 (Duplicate entry 'e8db0ea9accf3a44b835ff8a0e5b62c0' for key 'acctuniqueid'): 23000 (11) sql: SQL query returned: need alt query (11) sql: Trying next query... (11) sql: EXPAND UPDATE radacct SET acctstarttime = FROM_UNIXTIME(%{integer:Event-Timestamp})................... then fr will try to update an existing entry instead of log a new entry. is the behavior expected? how can I setup to prevent it? thanks a lot for help! Regards, tbskyd

3 16

freeradius 2.2 / radsecproxy integration
by Alex Sharaz 12 Jun '15

12 Jun '15

Hi, Can anyone point me at a working config showing FR 2.2.x / radsecproxy integration. Thx A

2 3

Writing custom policies
by Randeep 12 Jun '15

12 Jun '15

Hi, I have installled FreeRADIUS Version 2.1.12. I want to give a particular user maximum usage of 30GB in a month. I have enabled the counter.conf. And the NAS is sending the interim updates to the radacct. But where I can give this condition? to compare and respond with a disconnect message? I have to give this in policy.conf? Or in pre-auth session? The thing is in the default radiusd.conf, I'm not able to see this authorize,authentiate, accounting, pre-auth etc. Is this some version specific? Regards, Randeep

1 0

We have plans to 3.0.9?
by Jorge Pereira 11 Jun '15

11 Jun '15

Alan, I would like to know if have plans and date to 3.0.9. -- Jorge Pereira

2 1

ippool configuration
by Randeep 11 Jun '15

11 Jun '15

Hi, I've installed a freeradius server. Now I am trying to configure the ip pool. I have done the following. In /etc/raddb/radiusd.conf I have uncommented $INCLUDE sqlippool.conf In /etc/raddb/sqlippool.conf I have uncommented $INCLUDE sql/mysql/ippool.conf in /etc/raddb/sql/mysql/ippool.conf I haven't made any changes. in /etc/raddb/modules/ippool, I have set the range, netmask etc. But I couldn't understand what exactly is session-db = ${db_dir}/db.ippool and no ip is allocating for the client. I tested it with the debug mode. Couldnt find any logs related to this though. is it possible to see the ip address given to the request in the radtest command line client? Also, This ip pool is for the local ips right? Where we can configure the public IP to private IP mapping? This has to be done on the NAS side? Please help -- Randeep Mob: +919447831699[kerala] Mob: +919880050349[B'lore]

1 0

Authentication methods
by Randeep 11 Jun '15

11 Jun '15

Hi, We are implementing a solution with FreeRadius+Mysql+Mikrotik. We need two types of authentication methods. 1. PPPoE 2. Via HTTP. For eg: When a user connects from the laptop, the browser should redirect to a website on which we can enter username & password and authenticate. It would be better if we can do this with an api so that we can use the same api to login to the network from the devices which doesn't support PPPoE. is this possible with FreeRadius. Which protocols I need to enable for this? I need to specify this in radgroupreply? with Framed-Protocol? But two protocol is possible at the same time? Please advice. -- Randeep Mob: +919880050349[B'lore] http://twitter.com/Randeeppr http://in.linkedin.com/in/randeeppr

2 4

doubts about the functions in the unlang
by Jorge Pereira 11 Jun '15

11 Jun '15

Hi, someone know if have some way to do something like. int-require.by { if (!$1) { update { reply:Reply-Message:= "The $1 is required" } reject } else { noop } } and calling like int-require.by "Acct-Session-Id" -- Jorge Pereira

6 13

eap instantiation errors
by Paul Manyika 11 Jun '15

11 Jun '15

Hi I am trying co configure free radius on a freebsd10 server When i try to run "radiusd -X" I get radiusd: FreeRADIUS Version 2.2.7, for host i386-portbld-freebsd10.0, built on Jun 10 2015 at 12:35:41 Copyright (C) 1999-2015 The FreeRADIUS server project and contributors. There is NO warranty; not even for MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. You may redistribute copies of FreeRADIUS under the terms of the GNU General Public License. For more information about these matters, see the file named COPYRIGHT. Starting - reading configuration files ... including configuration file /usr/local/etc/raddb/radiusd.conf including configuration file /usr/local/etc/raddb/proxy.conf including configuration file /usr/local/etc/raddb/clients.conf including files in directory /usr/local/etc/raddb/modules/ including configuration file /usr/local/etc/raddb/modules/wimax including configuration file /usr/local/etc/raddb/modules/always including configuration file /usr/local/etc/raddb/modules/attr_filter including configuration file /usr/local/etc/raddb/modules/attr_rewrite including configuration file /usr/local/etc/raddb/modules/cache including configuration file /usr/local/etc/raddb/modules/chap including configuration file /usr/local/etc/raddb/modules/checkval including configuration file /usr/local/etc/raddb/modules/counter including configuration file /usr/local/etc/raddb/modules/cui including configuration file /usr/local/etc/raddb/modules/detail including configuration file /usr/local/etc/raddb/modules/detail.example.com including configuration file /usr/local/etc/raddb/modules/detail.log including configuration file /usr/local/etc/raddb/modules/dhcp_sqlippool including configuration file /usr/local/etc/raddb/sql/mysql/ippool-dhcp.conf including configuration file /usr/local/etc/raddb/modules/digest including configuration file /usr/local/etc/raddb/modules/dynamic_clients including configuration file /usr/local/etc/raddb/modules/echo including configuration file /usr/local/etc/raddb/modules/etc_group including configuration file /usr/local/etc/raddb/modules/exec including configuration file /usr/local/etc/raddb/modules/expiration including configuration file /usr/local/etc/raddb/modules/expr including configuration file /usr/local/etc/raddb/modules/files including configuration file /usr/local/etc/raddb/modules/inner-eap including configuration file /usr/local/etc/raddb/modules/ippool including configuration file /usr/local/etc/raddb/modules/krb5 including configuration file /usr/local/etc/raddb/modules/ldap including configuration file /usr/local/etc/raddb/modules/linelog including configuration file /usr/local/etc/raddb/modules/otp including configuration file /usr/local/etc/raddb/modules/logintime including configuration file /usr/local/etc/raddb/modules/mac2ip including configuration file /usr/local/etc/raddb/modules/mac2vlan including configuration file /usr/local/etc/raddb/modules/mschap including configuration file /usr/local/etc/raddb/modules/ntlm_auth including configuration file /usr/local/etc/raddb/modules/opendirectory including configuration file /usr/local/etc/raddb/modules/pam including configuration file /usr/local/etc/raddb/modules/pap including configuration file /usr/local/etc/raddb/modules/passwd including configuration file /usr/local/etc/raddb/modules/perl including configuration file /usr/local/etc/raddb/modules/policy including configuration file /usr/local/etc/raddb/modules/preprocess including configuration file /usr/local/etc/raddb/modules/radrelay including configuration file /usr/local/etc/raddb/modules/radutmp including configuration file /usr/local/etc/raddb/modules/realm including configuration file /usr/local/etc/raddb/modules/redis including configuration file /usr/local/etc/raddb/modules/rediswho including configuration file /usr/local/etc/raddb/modules/replicate including configuration file /usr/local/etc/raddb/modules/smbpasswd including configuration file /usr/local/etc/raddb/modules/smsotp including configuration file /usr/local/etc/raddb/modules/soh including configuration file /usr/local/etc/raddb/modules/sql_log including configuration file /usr/local/etc/raddb/modules/sqlcounter_expire_on_login including configuration file /usr/local/etc/raddb/modules/sradutmp including configuration file /usr/local/etc/raddb/modules/unix including configuration file /usr/local/etc/raddb/modules/acct_unique including configuration file /usr/local/etc/raddb/eap.conf including configuration file /usr/local/etc/raddb/sql.conf including configuration file /usr/local/etc/raddb/sql/mysql/dialup.conf including configuration file /usr/local/etc/raddb/policy.conf including files in directory /usr/local/etc/raddb/sites-enabled/ including configuration file /usr/local/etc/raddb/sites-enabled/control-socket including configuration file /usr/local/etc/raddb/sites-enabled/default including configuration file /usr/local/etc/raddb/sites-enabled/inner-tunnel main { user = "freeradius" group = "freeradius" allow_core_dumps = no } including dictionary file /usr/local/etc/raddb/dictionary main { name = "radiusd" prefix = "/usr/local" localstatedir = "/var" sbindir = "/usr/local/sbin" logdir = "/var/log" run_dir = "/var/run/radiusd" libdir = "/usr/local/lib/freeradius-2.2.7" radacctdir = "/var/log/radacct" hostname_lookups = no max_request_time = 30 cleanup_delay = 5 max_requests = 1024 pidfile = "/var/run/radiusd/radiusd.pid" checkrad = "/usr/local/sbin/checkrad" debug_level = 0 proxy_requests = yes log { stripped_names = no auth = no auth_badpass = yes auth_goodpass = no } security { max_attributes = 200 reject_delay = 1 status_server = yes allow_vulnerable_openssl = no } } radiusd: #### Loading Realms and Home Servers #### proxy server { retry_delay = 5 retry_count = 3 default_fallback = no dead_time = 120 wake_all_if_all_dead = no } home_server localhost { ipaddr = 127.0.0.1 port = 1812 type = "auth" secret = "testing123" response_window = 20 max_outstanding = 65536 require_message_authenticator = yes zombie_period = 40 status_check = "status-server" ping_interval = 30 check_interval = 30 num_answers_to_alive = 3 num_pings_to_alive = 3 revive_interval = 120 status_check_timeout = 4 coa { irt = 2 mrt = 16 mrc = 5 mrd = 30 } } home_server_pool my_auth_failover { type = fail-over home_server = localhost } realm example.com { auth_pool = my_auth_failover } realm LOCAL { } radiusd: #### Loading Clients #### client localhost { ipaddr = 127.0.0.1 require_message_authenticator = no secret = "testing123" nastype = "other" } radiusd: #### Instantiating modules #### instantiate { Module: Linked to module rlm_exec Module: Instantiating module "exec" from file /usr/local/etc/raddb/modules/exec exec { wait = no input_pairs = "request" shell_escape = yes timeout = 10 } Module: Linked to module rlm_expr Module: Instantiating module "expr" from file /usr/local/etc/raddb/modules/expr Module: Linked to module rlm_expiration Module: Instantiating module "expiration" from file /usr/local/etc/raddb/modules/expiration expiration { reply-message = "Password Has Expired " } Module: Linked to module rlm_logintime Module: Instantiating module "logintime" from file /usr/local/etc/raddb/modules/logintime logintime { reply-message = "You are calling outside your allowed timespan " minimum-timeout = 60 } } radiusd: #### Loading Virtual Servers #### server { # from file ?Ø¿âââ?( Ø¿âA modules { Module: Creating Auth-Type = digest Module: Checking authenticate {...} for more modules to load Module: Linked to module rlm_pap Module: Instantiating module "pap" from file /usr/local/etc/raddb/modules/pap pap { encryption_scheme = "auto" auto_header = no } Module: Linked to module rlm_chap Module: Instantiating module "chap" from file /usr/local/etc/raddb/modules/chap Module: Linked to module rlm_mschap Module: Instantiating module "mschap" from file /usr/local/etc/raddb/modules/mschap mschap { use_mppe = yes require_encryption = no require_strong = no with_ntdomain_hack = no allow_retry = yes } Module: Linked to module rlm_digest Module: Instantiating module "digest" from file /usr/local/etc/raddb/modules/digest Module: Linked to module rlm_pam Module: Instantiating module "pam" from file /usr/local/etc/raddb/modules/pam pam { pam_auth = "radiusd" } Module: Linked to module rlm_unix Module: Instantiating module "unix" from file /usr/local/etc/raddb/modules/unix unix { radwtmp = "/var/log/radwtmp" } Module: Linked to module rlm_eap Module: Instantiating module "eap" from file /usr/local/etc/raddb/eap.conf eap { default_eap_type = "ttls" timer_expire = 60 ignore_unknown_eap_types = no cisco_accounting_username_bug = no max_sessions = 1024 } Module: Linked to sub-module rlm_eap_md5 Module: Instantiating eap-md5 Module: Linked to sub-module rlm_eap_leap Module: Instantiating eap-leap Module: Linked to sub-module rlm_eap_gtc Module: Instantiating eap-gtc gtc { challenge = "Password: " auth_type = "PAP" } Module: Linked to sub-module rlm_eap_tls Module: Instantiating eap-tls tls { rsa_key_exchange = no dh_key_exchange = yes rsa_key_length = 512 dh_key_length = 512 verify_depth = 0 CA_path = "/usr/local/etc/raddb/certs" pem_file_type = yes private_key_file = "/usr/local/etc/raddb/certs/server.pem" certificate_file = "/usr/local/etc/raddb/certs/server.pem" CA_file = "/usr/local/etc/raddb/certs/ca.pem" private_key_password = "whatever" dh_file = "/usr/local/etc/raddb/certs/dh" random_file = "/usr/local/etc/raddb/certs/random" fragment_size = 1024 include_length = yes check_crl = no cipher_list = "DEFAULT" ecdh_curve = "prime256v1" cache { enable = no lifetime = 24 max_entries = 255 } verify { } } rlm_eap: No such sub-type for default EAP type ttls /usr/local/etc/raddb/eap.conf[17]: Instantiation failed for module "eap" /usr/local/etc/raddb/sites-enabled/default[312]: Failed to find "eap" in the "modules" section. /usr/local/etc/raddb/sites-enabled/default[254]: Errors parsing authenticate section. Can someone pliz show me what i did wrong? __________________________________________________________________ Find a local lawyer and free legal information at FindLaw.com.

2 1

rewrite attribute in freeradius 3
by Aleksander Vines 11 Jun '15

11 Jun '15

Hi list, I'm trying to set up Freeradius (3.0.4 - as its whats included in the centos repo) for Eduroam. It should act as a proxy to an internal server. Essentially, what I'm stuck at now is to rewrite the incoming User-Name attribute to remove the @domain postfix. In earlier versions I could use something like this: attr_rewrite rewrite_realm { attribute = User-Name searchin = packet searchfor = "^(.*)(a)adsl\.realm1$" replacewith = "%{1}" ignore_case = no new_attribute = no max_matches = 10 append = no } However, it seems its not supported in Freeradius 3:

2 2

EAP-TTLS with PAP and Mac Authentication is not working together
by Sunil Kulkarni -X (sunikulk - PERSISTENT SYSTEMS INC at Cisco) 10 Jun '15

10 Jun '15

Hello All, I am using FreeRadius 3.0.8 version. I am able configure EAP-TTLS with PAP on FreeRadius. I have to handle following scenarios when request coming from one of the client IP. I have followed http://wiki.freeradius.org/guide/Mac-Auth to achieve this. 1. MAC Authentication 2. EAP-TTLS with PAP Following are my files: Client.conf client <client_ip_address> { ipaddr = <client_ip_address> secret = <secret_key> shortname = <client_ip_address> virtual_server = client-listener } Client-lister server client- listener { authorize { if (EAP-Message) { eap } else { preprocess files if (ok) { update control { Auth-Type := Accept } } else { # reject update control { Auth-Type := Reject } } } } } When I removed virtual_server = client-listener from client.conf file, EAP-TTLS with PAP will work correctly. However, when I am testing with virtual_server = client-listener, FreeRadius is not able to identify EAP auth type. Below are few lines from log file: ............ ............ (0) NAS-Port-Type = Wireless-802.11 (0) EAP-Message = 0x0201001a016f73752d64303a61363a33373a62373a33363a6539 (0) Message-Authenticator = 0x917afa7c89cd3ab4ec557774b058f177 (0) # Executing section authorize from file /usr/local/etc/raddb/sites-enabled/client- listener (0) authorize { (0) if (EAP-Message) { (0) if (EAP-Message) -> TRUE (0) if (EAP-Message) { (0) eap: Peer sent code Response (2) ID 1 length 26 (0) eap: EAP-Identity reply, returning 'ok' so we can short-circuit the rest of authorize (0) [eap] = ok (0) } # if (EAP-Message) = ok (0) ... skipping else for request 0: Preceding "if" was taken (0) } # authorize = ok (0) Found Auth-Type = EAP (0) Auth-Type sub-section not found. Ignoring. (0) Failed to authenticate the user (0) Using Post-Auth-Type Reject (0) Post-Auth-Type sub-section not found. Ignoring. (0) Delaying response for 1.000000 seconds ....... ....... Am I missing any configuration? --- Thanks, Sunil Kulkarni

2 1