June 2015 - Freeradius-Users - lists.freeradius.org

rlm_passwd
by Peter Balsianok 17 Jun '15

17 Jun '15

Hi, I want to use rlm_passwd this way: passwd msisdn2ip { filename = ${modconfdir}/${.:instance}/msisdn2ip.dat format = "*Calling-Station-Id:=Framed-IP-Address" delimiter = "," } Exmaple of msisdn2ip: 421905000000,10.10.10.1 I want to use msisdn2ip ( instance of rlm_passwd) in the post-proxy section, therefore I have added MOD_POST_PROXY into the source core of rlm_passwd .... .methods = { [MOD_AUTHORIZE] = mod_passwd_map, [MOD_ACCOUNTING] = mod_passwd_map, [MOD_POST_AUTH] = mod_passwd_map, [MOD_POST_PROXY] = mod_passwd_map #ifdef WITH_COA [MOD_RECV_COA] = mod_passwd_map, [MOD_SEND_COA] = mod_passwd_map #endif }, ... After compilation everything works fine. Maybe i haven't realised something. Is it correct approach? Thx.

2 1

Re: Trouble setting up vmps with 3.0.8 (3 series)
by Manny 17 Jun '15

17 Jun '15

Sorry Alan, I did not intend to be impolite or offend. I included the config files just in case anyone noticed anything 'odd'. and will refrain. i've redone everything, and have finally gotten vmps responses. to test, i have used the check_vmps package from nagios and it appears to work at least from what I am seeing in the freeradius respones. Has anybody noticed any odd behavior with freeradius when a mac address have letters in it? It is like freeradius does not parse these macs correctly to assign it to the correct vlan. Example: mac2vlan file: 00:01:02:03:04:05,VLAN1 03:04:05:06:07:08,VLAN2 03:04:05:06:07:18,VLAN3 03:04:05:06:A7:18,VLAN4 03:04:05:06:B7:18,VLAN4 03:04:05:06:A8:18,VLAN4 03:04:05:06:A9:18,VLAN5 unix# ./check_vmps -s 192.168.2.25 -m 00:01:02:03:04:05 VMPS OK - Vlan: VLAN1, MAC Address: 000102030405, Status: ALLOW unix# unix# ./check_vmps -s 192.168.2.25 -m 03:04:05:06:07:08 VMPS OK - Vlan: VLAN2, MAC Address: 030405060708, Status: ALLOW unix# unix# ./check_vmps -s 192.168.2.25 -m 03:04:05:06:07:18 VMPS OK - Vlan: VLAN3, MAC Address: 030405060718, Status: ALLOW unix# unix# ./check_vmps -s 192.168.2.25 -m 03:04:05:06:A7:18 VMPS OK - Vlan: please_use_real_vlan_here, MAC Address: 03040506a718, Status: ALLOW unix# unix# ./check_vmps -s 192.168.2.25 -m 03:04:05:06:A9:18 VMPS OK - Vlan: please_use_real_vlan_here, MAC Address: 03040506a918, Status: ALLOW unix# unix# ./check_vmps -s 192.168.2.25 -m 03:04:05:06:A8:18 VMPS OK - Vlan: please_use_real_vlan_here, MAC Address: 03040506a818, Status: ALLOW unix# unix# ./check_vmps -s 192.168.2.25 -m 03:04:05:06:07:18 VMPS OK - Vlan: VLAN3, MAC Address: 030405060718, Status: ALLOW unix# unix# ./check_vmps -s 192.168.2.25 -m 00:01:02:03:04:05 VMPS OK - Vlan: VLAN1, MAC Address: 000102030405, Status: ALLOW unix# debug information: Ready to process requests VMPS-Packet-Type = VMPS-Join-Request VMPS-Error-Code = VMPS-No-Error VMPS-Sequence-Number = 4660 VMPS-Client-IP-Address = 127.0.0.1 VMPS-Port-Name = 'Fa0/1' VMPS-VLAN-Name = '' VMPS-Domain-Name = '' VMPS-Unknown = 0x00 VMPS-MAC = 03:04:05:06:07:18 (2) Received Access-Request Id 4660 from 192.168.2.5:50874 to 192.168.2.25:1589 length 60 (2) VMPS-Packet-Type = VMPS-Join-Request (2) VMPS-Error-Code = VMPS-No-Error (2) VMPS-Sequence-Number = 4660 (2) VMPS-Client-IP-Address = 127.0.0.1 (2) VMPS-Port-Name = 'Fa0/1' (2) VMPS-VLAN-Name = '' (2) VMPS-Domain-Name = '' (2) VMPS-Unknown = 0x00 (2) VMPS-MAC = 03:04:05:06:07:18 Doing VMPS (2) vmps { (2) if (!&VMPS-Mac) { (2) if (!&VMPS-Mac) -> FALSE (2) mac2vlan: Added VMPS-VLAN-Name: 'VLAN3' to reply_items (2) [mac2vlan] = ok (2) update reply { (2) &VMPS-Packet-Type = VMPS-Join-Response (2) &VMPS-Cookie = &VMPS-MAC -> 03:04:05:06:07:18 (2) &VMPS-VLAN-Name = "please_use_real_vlan_here" (2) } # update reply = noop (2) if (&VMPS-Packet-Type == VMPS-Reconfirm-Request){ (2) if (&VMPS-Packet-Type == VMPS-Reconfirm-Request) -> FALSE (2) } # vmps = ok Done VMPS (2) vmps { (2) if (!&VMPS-Mac) { (2) if (!&VMPS-Mac) -> FALSE (2) mac2vlan: Added VMPS-VLAN-Name: 'VLAN3' to reply_items (2) [mac2vlan] = ok (2) update reply { (2) &VMPS-Packet-Type = VMPS-Join-Response (2) &VMPS-Cookie = &VMPS-MAC -> 03:04:05:06:07:18 (2) &VMPS-VLAN-Name = "please_use_real_vlan_here" (2) } # update reply = noop (2) if (&VMPS-Packet-Type == VMPS-Reconfirm-Request){ (2) if (&VMPS-Packet-Type == VMPS-Reconfirm-Request) -> FALSE (2) } # vmps = ok (2) Sent Access-Accept Id 4660 from 192.168.2.25:1589 to 192.168.2.5:50874 length 0 VMPS-VLAN-Name = 'VLAN3' VMPS-Cookie = 03:04:05:06:07:18 (2) Finished request Waking up in 4.9 seconds. (2) <done>: Cleaning up request packet ID 4660 with timestamp +40 Ready to process requests VMPS-Packet-Type = VMPS-Join-Request VMPS-Error-Code = VMPS-No-Error VMPS-Sequence-Number = 4660 VMPS-Client-IP-Address = 127.0.0.1 VMPS-Port-Name = 'Fa0/1' VMPS-VLAN-Name = '' VMPS-Domain-Name = '' VMPS-Unknown = 0x00 VMPS-MAC = 00:01:02:03:04:05 (3) Received Access-Request Id 4660 from 192.168.2.5:50875 to 192.168.2.25:1589 length 60 (3) VMPS-Packet-Type = VMPS-Join-Request (3) VMPS-Error-Code = VMPS-No-Error (3) VMPS-Sequence-Number = 4660 (3) VMPS-Client-IP-Address = 127.0.0.1 (3) VMPS-Port-Name = 'Fa0/1' (3) VMPS-VLAN-Name = '' (3) VMPS-Domain-Name = '' (3) VMPS-Unknown = 0x00 (3) VMPS-MAC = 00:01:02:03:04:05 Doing VMPS (3) vmps { (3) if (!&VMPS-Mac) { (3) if (!&VMPS-Mac) -> FALSE (3) mac2vlan: Added VMPS-VLAN-Name: 'VLAN1' to reply_items (3) [mac2vlan] = ok (3) update reply { (3) &VMPS-Packet-Type = VMPS-Join-Response (3) &VMPS-Cookie = &VMPS-MAC -> 00:01:02:03:04:05 (3) &VMPS-VLAN-Name = "please_use_real_vlan_here" (3) } # update reply = noop (3) if (&VMPS-Packet-Type == VMPS-Reconfirm-Request){ (3) if (&VMPS-Packet-Type == VMPS-Reconfirm-Request) -> FALSE (3) } # vmps = ok Done VMPS (3) vmps { (3) if (!&VMPS-Mac) { (3) if (!&VMPS-Mac) -> FALSE (3) mac2vlan: Added VMPS-VLAN-Name: 'VLAN1' to reply_items (3) [mac2vlan] = ok (3) update reply { (3) &VMPS-Packet-Type = VMPS-Join-Response (3) &VMPS-Cookie = &VMPS-MAC -> 00:01:02:03:04:05 (3) &VMPS-VLAN-Name = "please_use_real_vlan_here" (3) } # update reply = noop (3) if (&VMPS-Packet-Type == VMPS-Reconfirm-Request){ (3) if (&VMPS-Packet-Type == VMPS-Reconfirm-Request) -> FALSE (3) } # vmps = ok (3) Sent Access-Accept Id 4660 from 192.168.2.25:1589 to 192.168.2.5:50875 length 0 VMPS-VLAN-Name = 'VLAN1' VMPS-Cookie = 00:01:02:03:04:05 (3) Finished request Waking up in 4.9 seconds. (3) <done>: Cleaning up request packet ID 4660 with timestamp +221 Ready to process requests thanks again, -- Manuel

2 2

Re: update reply: "Juniper-Primary-Dns"
by Amir Tal 17 Jun '15

17 Jun '15

Thanks for the replies. Replacing Juniper-* attributes with ERX-* did resolve the issue. Amir. [IMG]<http://www.ccc.co.il> Amir Tal [IMG] System Administrator +972 39201471 [IMG] Cloud Systems Support +972 39201442 [IMG]

1 0

MAC Auth Question
by J Kephart 16 Jun '15

16 Jun '15

Good day! We use FR to handle AAA services at a number of client sites, though we've not done anything "fancy" with it as yet. However, we've recently started using MAC authentication, but one thing we don't want to have happen is for a user to sign up for service in one location and then move to another and be able to use the network without signing in (both sites would be configured for MAC auth). To that end, we're thinking we might do something like the following: 1. Combine the NAS-Identifier with the User-Name (e.g., "1234-samjones"). 2. Do an sql lookup in radgroupreply (all users are assigned to groups based on NAS-ID and username) to determine if the group exists. 3. If it does, permit MAC auth to succeed; otherwise, reject. My first question is, does this seem a good way to prevent users from automatic roaming between sites, given that our clients are different? Does the method seem sound? Can we generate our own variable names within the raddb files for later use in the sql lookup? And, most importantly, where and in what file would be the best place to do this? Also, for accounting purposes, we'd like to prepend the same nas-id to the username. Any recommendations on how best to approach that? We're stepping off the edge of the world here, well outside our comfort zone, so we want to be sure we do this correctly. I appreciate any and all pointers, especially to docs that might describe how to do this. Cheers, Jim

2 2

Trouble setting up vmps with 3.0.8 (3 series)
by Manny 16 Jun '15

16 Jun '15

Hello gents, I love the the spirit of the freeradius software and am really hoping to use it for some testing in my home environment. Alas, I am having some definate trouble setting it up. When I use the magical google, all examples are for 2.0 and the documentation for setting up vmps with the 3 series appears a bit... lacking at least for my taste. What I have done so far. radiusd.conf [root@vmps01 raddb]# grep -v '^$' radiusd.conf|grep -v '#' prefix = /usr/local/freeradius exec_prefix = ${prefix} sysconfdir = ${prefix}/etc localstatedir = ${prefix}/var sbindir = ${exec_prefix}/sbin logdir = ${localstatedir}/log/radius raddbdir = ${sysconfdir}/raddb radacctdir = ${logdir}/radacct name = radiusd confdir = ${raddbdir} modconfdir = ${confdir}/mods-config certdir = ${confdir}/certs cadir = ${confdir}/certs run_dir = ${localstatedir}/run/${name} db_dir = ${raddbdir} libdir = ${exec_prefix}/lib pidfile = ${run_dir}/${name}.pid correct_escapes = true max_request_time = 30 cleanup_delay = 5 max_requests = 1024 hostname_lookups = no log { destination = files colourise = yes file = ${logdir}/radius.log syslog_facility = daemon stripped_names = no auth = no auth_badpass = no auth_goodpass = no msg_denied = "You are already logged in - access denied" } checkrad = ${sbindir}/checkrad security { allow_core_dumps = no max_attributes = 200 reject_delay = 1 status_server = yes allow_vulnerable_openssl = yes } proxy_requests = yes $INCLUDE proxy.conf $INCLUDE clients.conf thread pool { start_servers = 5 max_servers = 32 min_spare_servers = 3 max_spare_servers = 10 max_requests_per_server = 0 auto_limit_acct = no } modules { $INCLUDE mods-enabled/ } instantiate { } policy { $INCLUDE policy.d/ } $INCLUDE sites-enabled/ [root@vmps01 raddb]# [root@vmps01 raddb]# grep -v '^$' mods-enabled/mac2vlan|grep -v '#' passwd mac2vlan { filename = ${modconfdir}/${.:name}/${.:instance} format = "*VMPS-Mac:=VMPS-VLAN-Name" delimiter = "," } [root@vmps01 raddb]# [root@vmps01 raddb]# grep -v '^$' mods-config/passwd/mac2vlan|grep -v '#' 00:1C:B3:09:85:15,Server 00:1C:B3:09:85:16,VLAN1 00:1C:B3:09:85:17,VLAN2 [root@vmps01 raddb]# [root@vmps01 raddb]# grep -v '^$' clients.conf|grep -v '#' client localhost { ipaddr = 127.0.0.1 proto = * secret = testing123 require_message_authenticator = no limit { max_connections = 16 lifetime = 0 idle_timeout = 30 } } client localhost_ipv6 { ipv6addr = ::1 secret = testing123 } client lex { ipaddr = 192.168.1.0/24 secret = testing123456 } [root@vmps01 raddb]# My switches are on 192.168.1.10 & 192.168.1.11 Neither config on the switches accepts a secret (as defined in the clients.conf file) but I tried running the config without it, and the service would not start. Default installation enabled a bunch of other modules, but really I only want vmps (mac2vlan), but documentation doesn't really detail what I can remove to have vmps only service. Please help, thank you in advance, -- Manny

2 1

update reply: "Juniper-Primary-Dns"
by Amir Tal 16 Jun '15

16 Jun '15

Hi, Trying to implement setting custom values for DNS servers based on some condition. Following attributes are needed in radius reply: Juniper-Primary-Dns Juniper-Secondary-Dns Following snip was added to '/etc/raddb/sites-enabled/default' : ... if ( User-Name =~ /test2/i ) { if ( NAS-Port-Id =~ /147.235.4./i ) { update reply { Juniper-Primary-Dns := "109.226.x.x" Juniper-Secondary-Dns := "109.226.x.x" } } } ... When testing this, values are added to reply, this was confirmed by enabling "reply_log" in freeradius. Example: Tue Jun 16 18:54:07 2015 Packet-Type = Access-Accept Juniper-Primary-Dns = 109.226.x.x Juniper-Secondary-Dns = 109.226.x.x Framed-Protocol = PPP Framed-Compression = Van-Jacobson-TCP-IP ERX-Egress-Statistics := enable ERX-Ingress-Statistics := enable ERX-Egress-Policy-Name := "100MB" ERX-Ingress-Policy-Name := "4mb" Framed-MTU = 1512 Framed-Pool := "fast" But, this is not passed to the client, NAS still overrides this with default values. User authentication uses LDAP to store user profiles, if we add these two attributes to the user via his LDAP profile, then the change is accepted. Condition was tested on "authorize" and on "post-auth" sections, same result in both cases. Assistance would be appreciated, thanks. Amir. [IMG]<http://www.ccc.co.il> Amir Tal [IMG] System Administrator +972 39201471 [IMG] Cloud Systems Support +972 39201442 [IMG]

3 2

Radsec with freeradius 3.0.8
by Ashish Sinha 16 Jun '15

16 Jun '15

Hi Anyone know about client which can be used to test radsec(radius over tcp with TLS) I tried radtest but it doesn't support TLS and eapol_test supports TLS but doesn't support radius over TCP Thanks Ashish

3 3

Freeradius 3.0.0.8 and mysql
by rints harry 16 Jun '15

16 Jun '15

Hi anyone, I begin on freeradius , i configure freeradius with mysql ... all authentication are ok with myql , I dont use files. However , table radacct ... are empty , Online user in Daloradius returns nothing. Need help please > Thx

4 12

Re: Doubts about the rlm_replicate
by Jorge Pereira 15 Jun '15

15 Jun '15

Hi, My idea is to add support for "post-proxy" in the rlm_replicate. So I believe it can be sure that the first packet "Acct-Start" received ACK and then I can send the "replicated" packet that became in the "Acct-Interim-Updated" will be sent ok. Aland and Arran, what do you think about my idea? -- Jorge Pereira On Fri, Jun 12, 2015 at 5:47 PM, Jorge Pereira <jpereiran(a)gmail.com> wrote: > Hi, > > I have a situation that I get a packet "Acct-Start" and then is > necessary to duplicate and transform in a "Acct-Interim-Update". > but, I should send the second packet "Acct-Interim-Update" after I get the > "Accounting-Response" from the first sending "Acct-Start". > have someone idea about the solution? > > My first thought was to add in rlm_replicate the capability to process a > "preaccounting" and add some "flag" in the first packet saving > in redis cache... but is a madness. I prefer to hear other suggestions! > > p.s: my radius is a proxy between two others. > -- > Jorge Pereira >

2 4

Error in `radiusd': free(): invalid next size (normal)
by ICHIBA Sara 15 Jun '15

15 Jun '15

Hey there, I'm getting this error while trying to do radiusd -X: *** Error in `radiusd': free(): invalid next size (normal): 0x00007f2754001d10 *** ======= Backtrace: ========= /lib64/libc.so.6(+0x7d1fd)[0x7f27622d71fd] /lib64/libstdc++.so.6(_ZNSt18basic_stringstreamIcSt11char_traitsIcESaIcEED1Ev+0xdc)[0x7f275bb41f9c] /usr/local/lib64/libcassandra.so.2(_ZNK4cass7Address9to_stringEb+0x223)[0x7f275c0e7383] /usr/local/lib64/libcassandra.so.2(_ZN4cass10ConnectionC1EP9uv_loop_sRKNS_6ConfigEPNS_7MetricsERKNS_7AddressERKSsiPNS0_8ListenerE+0x1b1)[0x7f275c0f6ba3] /usr/local/lib64/libcassandra.so.2(_ZN4cass17ControlConnection9reconnectEb+0x19e)[0x7f275c10041a] /usr/local/lib64/libcassandra.so.2(_ZN4cass17ControlConnection7connectEPNS_7SessionE+0xc9)[0x7f275c1001b9] /usr/local/lib64/libcassandra.so.2(_ZN4cass7Session16internal_connectEv+0x8f)[0x7f275c14a075] /usr/local/lib64/libcassandra.so.2(_ZN4cass7Session10on_resolveEPNS_8ResolverE+0xf3)[0x7f275c14a957] /usr/local/lib64/libcassandra.so.2(_ZN4cass8Resolver10on_resolveEP16uv_getaddrinfo_siP8addrinfo+0x8c)[0x7f275c14d3a1] /usr/local/lib/libuv.so.1(+0x7998)[0x7f275bdb5998] /usr/local/lib/libuv.so.1(+0x953d)[0x7f275bdb753d] /usr/local/lib/libuv.so.1(+0x95de)[0x7f275bdb75de] /usr/local/lib/libuv.so.1(+0x15fdc)[0x7f275bdc3fdc] /usr/local/lib/libuv.so.1(uv_run+0xe7)[0x7f275bdb7de7] /usr/local/lib64/libcassandra.so.2(_ZN4cass10LoopThread15on_run_internalEPv+0x44)[0x7f275c14b9bc] /usr/local/lib/libuv.so.1(+0x13207)[0x7f275bdc1207] /lib64/libpthread.so.0(+0x7df5)[0x7f2762859df5] /lib64/libc.so.6(clone+0x6d)[0x7f27623501ad]

4 7