July 2015 - Freeradius-Users - lists.freeradius.org

Dynamic proxies??
by Peter Lambrechtsen 16 Jul '15

16 Jul '15

I suspect the answer will be "patches welcome" but... Has anyone ever thought of having a similar module as dynamic clients where you can pull proxies for external realms from an external source using unlang such as sql or ldap?? I have an interesting use case where I am looking to replace an existing radius proxy server with FreeRadius that has a lot of downstream proxies. So far the the best option I have is to copy the proxies.conf across all the instances and HUP the config whenever a new realm is added or removed and wondered if there was a smarter way to do it. Cheers Peter

3 5

MySQL group authentication problem (v3.0.8)
by ankita therese 15 Jul '15

15 Jul '15

Hi, I'm having trouble getting FreeRADIUS to recognize the group of a user using sql. I'm running version 3.0.8, and as far as I can tell, everything runs smoothly up to the authorize_group_check_query. It executes, but after this, on debugging with radiusd -XX, authentication breaks off with Debug: (0) sql: ... falling-through to profile processing Debug: rlm_sql (sql): Released connection (4) The output of radiusd -X is as follows. Group attribute values are not verified or added to reply. I tried increasing minimum no of sql connections, but that just makes radius tell me i have too many idle connections and need to reduce min. (0) Received Access-Request Id 153 from 127.0.0.1:49747 to 127.0.1.1:1812 length 85 (0) User-Name = 'mynewuser' (0) User-Password = 'password' (0) NAS-IP-Address = 127.0.1.1 (0) NAS-Port = 0 (0) Message-Authenticator = 0x32010b83ba8a72dd523a231e353d1a1b (0) Framed-Protocol = PPP (0) # Executing section authorize from file /usr/local/etc/raddb/sites-enabled/default (0) authorize { (0) policy filter_username { (0) if (!&User-Name) { (0) if (!&User-Name) -> FALSE (0) if (&User-Name =~ / /) { (0) if (&User-Name =~ / /) -> FALSE (0) if (&User-Name =~ /@.*@/ ) { (0) if (&User-Name =~ /@.*@/ ) -> FALSE (0) if (&User-Name =~ /\.\./ ) { (0) if (&User-Name =~ /\.\./ ) -> FALSE (0) if ((&User-Name =~ /@/) && (&User-Name !~ /(a)(.+)\.(.+)$/)) { (0) if ((&User-Name =~ /@/) && (&User-Name !~ /(a)(.+)\.(.+)$/)) -> FALSE (0) if (&User-Name =~ /\.$/) { (0) if (&User-Name =~ /\.$/) -> FALSE (0) if (&User-Name =~ /(a)\./) { (0) if (&User-Name =~ /(a)\./) -> FALSE (0) } # policy filter_username = notfound (0) [preprocess] = ok (0) [chap] = noop (0) [mschap] = noop (0) [digest] = noop (0) suffix: Checking for suffix after "@" (0) suffix: No '@' in User-Name = "mynewuser", looking up realm NULL (0) suffix: No such realm "NULL" (0) [suffix] = noop (0) eap: No EAP-Message, not doing EAP (0) [eap] = noop (0) files: users: Matched entry DEFAULT at line 182 (0) [files] = ok (0) sql: EXPAND %{User-Name} (0) sql: --> mynewuser (0) sql: SQL-User-Name set to 'mynewuser' rlm_sql (sql): Reserved connection (4) (0) sql: EXPAND SELECT id, username, attribute, value, op FROM radcheck WHERE username = '%{SQL-User-Name}' ORDER BY id (0) sql: --> SELECT id, username, attribute, value, op FROM radcheck WHERE username = 'mynewuser' ORDER BY id (0) sql: Executing select query: SELECT id, username, attribute, value, op FROM radcheck WHERE username = 'mynewuser' ORDER BY id (0) sql: User found in radcheck table (0) sql: Conditional check items matched, merging assignment check items (0) sql: Cleartext-Password := 'password' (0) sql: EXPAND SELECT id, username, attribute, value, op FROM radreply WHERE username = '%{SQL-User-Name}' ORDER BY id (0) sql: --> SELECT id, username, attribute, value, op FROM radreply WHERE username = 'mynewuser' ORDER BY id (0) sql: Executing select query: SELECT id, username, attribute, value, op FROM radreply WHERE username = 'mynewuser' ORDER BY id (0) sql: User found in radreply table, merging reply items (0) sql: Reply-Message = 'OK' (0) sql: EXPAND SELECT groupname FROM radusergroup WHERE username = '%{SQL-User-Name}' ORDER BY priority (0) sql: --> SELECT groupname FROM radusergroup WHERE username = 'mynewuser' ORDER BY priority (0) sql: Executing select query: SELECT groupname FROM radusergroup WHERE username = 'mynewuser' ORDER BY priority (0) sql: User found in the group table (0) sql: EXPAND SELECT id, groupname, attribute, Value, op FROM radgroupcheck WHERE groupname = '%{Sql-Group}' ORDER BY id (0) sql: --> SELECT id, groupname, attribute, Value, op FROM radgroupcheck WHERE groupname = 'student' ORDER BY id (0) sql: Executing select query: SELECT id, groupname, attribute, Value, op FROM radgroupcheck WHERE groupname = 'student' ORDER BY id rlm_sql (sql): Released connection (4) (0) [sql] = ok (0) [expiration] = noop (0) [logintime] = noop (0) [pap] = updated (0) } # authorize = updated (0) Found Auth-Type = PAP (0) # Executing group from file /usr/local/etc/raddb/sites-enabled/default (0) Auth-Type PAP { (0) pap: Login attempt with password (0) pap: User authenticated successfully (0) [pap] = ok (0) } # Auth-Type PAP = ok (0) # Executing section post-auth from file /usr/local/etc/raddb/sites-enabled/default (0) post-auth { (0) update { (0) No attributes updated (0) } # update = noop (0) sql: EXPAND .query (0) sql: --> .query (0) sql: Using query template 'query' rlm_sql (sql): Reserved connection (4) (0) sql: EXPAND %{User-Name} (0) sql: --> mynewuser (0) sql: SQL-User-Name set to 'mynewuser' (0) sql: EXPAND INSERT INTO radpostauth (username, pass, reply, authdate) VALUES ( '%{SQL-User-Name}', '%{%{User-Password}:-%{Chap-Password}}', '%{reply:Packet-Type}', '%S') (0) sql: --> INSERT INTO radpostauth (username, pass, reply, authdate) VALUES ( 'mynewuser', 'password', 'Access-Accept', '2015-07-12 20:57:34') (0) sql: Executing query: INSERT INTO radpostauth (username, pass, reply, authdate) VALUES ( 'mynewuser', 'password', 'Access-Accept', '2015-07-12 20:57:34') (0) sql: SQL query returned: success (0) sql: 1 record(s) updated rlm_sql (sql): Released connection (4) (0) [sql] = ok (0) [exec] = noop (0) policy remove_reply_message_if_eap { (0) if (&reply:EAP-Message && &reply:Reply-Message) { (0) if (&reply:EAP-Message && &reply:Reply-Message) -> FALSE (0) else { (0) [noop] = noop (0) } # else = noop (0) } # policy remove_reply_message_if_eap = noop (0) } # post-auth = ok (0) Sent Access-Accept Id 153 from 127.0.1.1:1812 to 127.0.0.1:49747 length 0 (0) Framed-Protocol = PPP (0) Framed-Compression = Van-Jacobson-TCP-IP (0) Reply-Message = 'OK' (0) Finished request Thank you

1 0

sending requests to a virtual server when behind a proxy
by Louis Munro 15 Jul '15

15 Jul '15

Hello, I have a set of servers behind two FreeRADIUS servers configured to proxy and load balance to a pool of backend FR servers (2.26 both on the load balancers and backend). I would like to send some requests to a different virtual server on the backend to authenticate our VPN requests separately from the regular Wireless authentications. I can set the virtual server in the client definition (on the backend servers) and that seems to work well but when the requests are proxied through the load-balancers the client is the proxying server and so my virtual server config is not applied. I could alway send those requests to a virtual server listening on a different port on the backend, but I would like to avoid that if there is a way. That just adds more complexity and ports to manage in firewall and such. Am I missing something obvious? I don’t think this could be done using dynamic clients since I can’t inspect the NAS-IP-Address there. Any other way that someone can think of? Your help is much appreciated, -- Louis Munro lmunro(a)inverse.ca :: www.inverse.ca +1.514.447.4918 x125 :: +1 (866) 353-6153 x125 Inverse inc. :: Leaders behind SOGo (www.sogo.nu) and PacketFence (www.packetfence.org)

3 3

MySQL Authentication Problem (v3.0.3)
by Pyromancer 15 Jul '15

15 Jul '15

I am attempting to build a replacement radius server for a client who's primary v2.0.2 machine has gone down for good. There is a secondary so service continues for now. The old system had a very complex config which hands off lots of realms to LNSs and also does authentication for non-handed-off users via MySQL. Initially I attempted to replicate the original server on a newly installed machine, however FR 2.0.2 refused to compile with MySQL on the new box (Current SuSE, vendor MySQL). So I've installed the vendor FreeRadius (3.0.3 64bit). Initially I tried using the existing config copied from the secondary box, after commenting out all the depreciated attributes it ran and talked to MySQL however refused to authenticate a test user. Research led to the Wiki and mailing list, comments re changing the default config as little as possible (and potentially greater b0rkake the more this is ignored noted), So having backed up the original config I cleared it and am starting from scratch with the default one, and slowly adding in the features of the client's original system. This has the side benefit of removing a lot of redundant stuff from the files. However it's refusing to authenticate the MySQL users, giving a no known good password error, even though the cleartext password is present in the database and matches what radtest is submitting. The output from radiusd -X is below - the obvious problem is the "(0) WARNING: pap : No "known good" password found for the user. Not setting Auth-Type." line. But look above that and the user is found in the radcheck table - there are no group entries as this is a purely local auth-only user. This user was able to authenticate from radtest on the old server (and still is on the secondary), the databases are identical. I know there's another error further down regarding the accounting due to a missing table, but as that's after the auth section I'm assuming that won't be related to why a reject is being generated. I've tried running -X -x and -xx to get more detailed debug, but it doesn't reveal any more information on why the reject is being generated. The database entry looks like this: mysql> SELECT id, username, attribute, value, op FROM radcheck WHERE username = 'xktester' ORDER BY id; +------+------------+----------------------+------------------------------+----+ | id | username | attribute | value | op | +------+------------+----------------------+------------------------------+----+ | 3983 | xktester | Cleartext-Password | correct_horse_battery_staple | == | +------+------------+----------------------+------------------------------+----+ 1 row in set (0.00 sec) radiusd -X output: Received Access-Request Id 228 from 127.0.0.1:60330 to 127.0.0.1:21812 length 76 User-Name = 'xktester' User-Password = 'correct_horse_battery_staple' NAS-IP-Address = 192.168.142.85 NAS-Port = 10 Message-Authenticator = 0x48c52fb5b7f81584a37eccc1eb44a643 (0) # Executing section authorize from file /etc/raddb_ADSL//sites-enabled/default (0) authorize { (0) filter_username filter_username { (0) if (User-Name != "%{tolower:%{User-Name}}") (0) EXPAND %{tolower:%{User-Name}} (0) --> xktester (0) if (User-Name != "%{tolower:%{User-Name}}") -> FALSE (0) if (User-Name =~ / /) (0) if (User-Name =~ / /) -> FALSE (0) if (User-Name =~ /@.*@/ ) (0) if (User-Name =~ /@.*@/ ) -> FALSE (0) if (User-Name =~ /\\.\\./ ) (0) if (User-Name =~ /\\.\\./ ) -> FALSE (0) if ((User-Name =~ /@/) && (User-Name !~ /(a)(.+)\\.(.+)$/)) (0) if ((User-Name =~ /@/) && (User-Name !~ /(a)(.+)\\.(.+)$/)) -> FALSE (0) if (User-Name =~ /\\.$/) (0) if (User-Name =~ /\\.$/) -> FALSE (0) if (User-Name =~ /(a)\\./) (0) if (User-Name =~ /(a)\\./) -> FALSE (0) } # filter_username filter_username = notfound (0) [preprocess] = ok (0) [chap] = noop (0) [mschap] = noop (0) [digest] = noop (0) suffix : No '@' in User-Name = "xktester", looking up realm NULL (0) suffix : No such realm "NULL" (0) [suffix] = noop (0) eap : No EAP-Message, not doing EAP (0) [eap] = noop (0) [files] = noop (0) sql : EXPAND %{User-Name} (0) sql : --> xktester (0) sql : SQL-User-Name set to 'xktester' rlm_sql (sql): Reserved connection (4) (0) sql : EXPAND SELECT id, username, attribute, value, op FROM radcheck WHERE username = '%{SQL-User-Name}' ORDER BY id (0) sql : --> SELECT id, username, attribute, value, op FROM radcheck WHERE username = 'xktester' ORDER BY id rlm_sql (sql): Executing query: 'SELECT id, username, attribute, value, op FROM radcheck WHERE username = 'xktester' ORDER BY id' (0) sql : User found in radcheck table (0) sql : EXPAND # SELECT groupname # FROM radusergroup # WHERE username = BINARY '%{SQL-User-Name}' # ORDER BY priority (0) sql : --> # SELECT groupname # FROM radusergroup # WHERE username = BINARY 'xktester' # ORDER BY priority rlm_sql (sql): Executing query: '# SELECT groupname # FROM radusergroup # WHERE username = BINARY 'xktester' # ORDER BY priority' rlm_sql_mysql: MYSQL Error: No Fields rlm_sql_mysql: MYSQL error: (0) sql : User not found in any groups rlm_sql (sql): Released connection (4) (0) [sql] = noop (0) [expiration] = noop (0) [logintime] = noop (0) WARNING: pap : No "known good" password found for the user. Not setting Auth-Type. (0) WARNING: pap : Authentication will fail unless a "known good" password is available. (0) [pap] = noop (0) } # authorize = ok (0) ERROR: No Auth-Type found: rejecting the user via Post-Auth-Type = Reject (0) Failed to authenticate the user. (0) Using Post-Auth-Type Reject (0) # Executing group from file /etc/raddb_ADSL//sites-enabled/default (0) Post-Auth-Type REJECT { (0) sql : EXPAND .query (0) sql : --> .query (0) sql : Using query template 'query' rlm_sql (sql): Reserved connection (4) (0) sql : EXPAND %{User-Name} (0) sql : --> xktester (0) sql : SQL-User-Name set to 'xktester' (0) sql : EXPAND INSERT INTO radpostauth (username, pass, reply, authdate) VALUES ( '%{SQL-User-Name}', '%{%{User-Password}:-%{Chap-Password}}', '%{reply:Packet-Type}', '%S') (0) sql : --> INSERT INTO radpostauth (username, pass, reply, authdate) VALUES ( 'xktester', 'correct_horse_battery_staple', 'Access-Reject', '2015-07-15 20:38:03') rlm_sql (sql): Executing query: 'INSERT INTO radpostauth (username, pass, reply, authdate) VALUES ( 'xktester', 'correct_horse_battery_staple', 'Access-Reject', '2015-07-15 20:38:03')' rlm_sql_mysql: MYSQL check_error: 1146 received rlm_sql (sql): Table 'radius_ADSL.radpostauth' doesn't exist rlm_sql_mysql: MYSQL check_error: 1146 received rlm_sql_mysql: Cannot store result rlm_sql_mysql: MySQL error 'Table 'radius_ADSL.radpostauth' doesn't exist' (0) sql : No additional queries configured rlm_sql (sql): Released connection (4) (0) [sql] = noop (0) attr_filter.access_reject : EXPAND %{User-Name} (0) attr_filter.access_reject : --> xktester (0) attr_filter.access_reject : Matched entry DEFAULT at line 11 (0) [attr_filter.access_reject] = updated (0) eap : Request didn't contain an EAP-Message, not inserting EAP-Failure (0) [eap] = noop (0) remove_reply_message_if_eap remove_reply_message_if_eap { (0) if (reply:EAP-Message && reply:Reply-Message) (0) if (reply:EAP-Message && reply:Reply-Message) -> FALSE (0) else else { (0) [noop] = noop (0) } # else else = noop (0) } # remove_reply_message_if_eap remove_reply_message_if_eap = noop (0) } # Post-Auth-Type REJECT = updated (0) Delaying response for 1 seconds Waking up in 0.3 seconds. Waking up in 0.6 seconds. (0) Sending delayed response Sending Access-Reject Id 228 from 127.0.0.1:21812 to 127.0.0.1:60330 Waking up in 3.9 seconds. (0) Cleaning up request packet ID 228 with timestamp +10 Ready to process requests.

3 5

freeradius-3.0 problem with EAP-TTLS
by Till Dörges 15 Jul '15

15 Jul '15

[Not sure where to report this. So please advise, if there's a more suitable place.] Dear all, When upgrading our running freeradius-2.2 configuration for EAP-TTLS to freeradius-3.0 we followed the guide from http://freeradius.org/version3.html and almost everything was running in our test environment except one point already discussed similarly: http://lists.freeradius.org/pipermail/freeradius-users/2015-March/076365.ht… We had the same problem with our wpa_supplicant and Oddyssey clients: The very last ACK from the client was not well recognized by freeradius-3 with the same DEBUG message, also see (partly obfuscated radius.debug.txt): Login incorrect (eap_ttls: Invalid ACK received: 0) Encouraged from the thread follow-up http://lists.freeradius.org/pipermail/freeradius-users/2015-May/077614.html we checked the values returned to the method tls_ack_handler() in src/main/tls.c : In fact we found for the last ACK: ssn->info.content_type == 0 (instead of handshake == 22) ssn->info.handshake_type == handshake_finished (expected 20) ssn->dirty_out.used == 0 In order to make it work, we patched freeradius-3 like this (also see attachments tls.c.patch and tls.c.original): $ diff tls.c.patch tls.c.original 3130,3134d3129 < /* patch needed for many versions of TTLS clients, compare http://lists.freeradius.org/pipermail/freeradius-users/2015-May/077614.html */ < if ((ssn->info.handshake_type == handshake_finished) && (ssn->dirty_out.used == 0)) { < ssn->info.content_type = handshake; < } < HTH -- Till -- Dipl.-Inform. Till Dörges doerges(a)pre-sense.de Tel. +49 - 40 - 244 2407 - 14 Fax +49 - 40 - 244 2407 - 24 PRESENSE Technologies GmbH Sachsenstr. 5, D-20097 HH Geschäftsführer/Managing Directors AG Hamburg, HRB 107844 Till Dörges, Jürgen Sander USt-IdNr.: DE263765024

2 1

Is EAP-AKA supported in FreeRADIUS 3.0.9
by Paul Gunman 15 Jul '15

15 Jul '15

Hello, I would like to know if EAP-AKA is supported in FreeRADIUS 3.0.9. According to the wiki, it is: wiki.freeradius.org/protocol/EAP However, several person told me that it was supported 'as a beta version'. Could someone confirm this? Regards, Pascal

4 4

Acct-Unique-Session-Id
by ICHIBA Sara 15 Jul '15

15 Jul '15

hey there, I keep having an error coming from my database which claims that the account unique id can't be empty and when I check the logs I can't see its value anywhere. here is the list of AVP i can find AVP : Acct-Input-Octets, Valeur : 41516757 AVP : NAS-Port-Type, Valeur : Wireless-802.11 AVP : Acct-Session-Id, Valeur : 55A63A3C-143CF000 AVP : Proxy-State, Valeur : 74 AVP : Called-Station-Id, Valeur : D4-68-4D-14-3C-F8:CASSANDRA AVP : Ruckus-SCG-CBlade-IP, Valeur : 3232236075 AVP : Acct-Link-Count, Valeur : 1 AVP : Acct-Authentic, Valeur : RADIUS AVP : Acct-Status-Type, Valeur : Interim-Update AVP : Connect-Info, Valeur : CONNECT 802.11b/g/n AVP : Acct-Output-Packets, Valeur : 19275 AVP : NAS-IP-Address, Valeur : 192.168.2.7 AVP : Attr-26.25053.9, Valeur : AVP : Acct-Output-Octets, Valeur : 1107617 AVP : Ruckus-SSID, Valeur : CASSANDRA AVP : Ruckus-Sta-RSSI, Valeur : 26 AVP : Acct-Session-Time, Valeur : 660 AVP : Calling-Station-Id, Valeur : F4-09-D8-04-6F-24 AVP : User-Name, Valeur : test AVP : Event-Timestamp, Valeur : juil. 15 2015 12:58:26 CEST AVP : NAS-Identifier, Valeur : D4-68-4D-14-3C-F8 AVP : Acct-Multi-Session-Id, Valeur : d4684d143cf8f409d8046f2455a63a3c002b AVP : Framed-IP-Address, Valeur : 192.168.2.9 AVP : Acct-Input-Packets, Valeur : 28735 AVP : NAS-Port, Valeur : 1 Vérification de attributs du message d'ACCOUNTING: AVP : Acct-Status-Type, Valeur : Interim-Update AVP : Acct-Session-ID, Valeur : 55A63A3C-143CF000 AVP : Acct-Session-ID, Valeur : 660 AVP : User-Name, Valeur : test AVP : Framed-IP-Address, Valeur : 192.168.2.9 AVP : NAS-IP-Address, Valeur : 192.168.2.7 Attention: pas d'attribut NAS-Port-Id! AVP : NAS-Port-Type, Valeur : Wireless-802.11 AVP : Called-Station-Id, Valeur : D4-68-4D-14-3C-F8:CASSANDRA AVP : Calling-Station-Id, Valeur : F4-09-D8-04-6F-24 Attention: pas d'attribut Alc-Subsc-ID-Str! Attention: pas d'attribut Alc-Subsc-Prof-Str! Attention: pas d'attribut Alc-SLA-Prof-Str! Attention: pas d'attribut Alc-Client-Hardware-Addr! Attention: pas d'attribut ADSL-Agent-Circuit-Id! Attention: pas d'attribut ADSL-Agent-Remote-Id! AVP : Acct-Input-Octets, Valeur : 41516757 AVP : Acct-Output-Octets, Valeur : 1107617 Pas d'attribut avp_class ! VSA : Ruckus-SSID, Valeur : CASSANDRA Can you please tell me how can I make my freeradius server generate a Account unique session id. here is the query that fails. You can see that the acctuniqueid is empty Wed Jul 15 13:01:32 2015 : Debug: (23) sql: Executing query: BEGIN BATCH INSERT INTO radacct ( acctuniqueid, acctsessionid, username, realm, nasipaddress, nasportid, nasporttype, acctupdatetime, acctstoptime, acctauthentic, connectinfo_start, acctinputoctets, acctoutputoctets, calledstationid, callingstationid, servicetype, framedprotocol, groupname, connectinfo_stop, framedipaddress ) VALUES ( '', '55A63A3C-143CF000', 'test', '', '192.168.2.7', '1', 'Wireless-802.11', 1436958086000, null, 'RADIUS', 'CONNECT 802.11b/g/n', 53864193, 1437431, 'D4-68-4D-14-3C-F8:CASSANDRA', 'F4-09-D8-04-6F-24', '', '', '', 'CONNECT 802.11b/g/n', '192.168.2.9' ); UPDATE radacct SET acctstarttime = 1436957246000 WHERE acctuniqueid = '' APPLY BATCH; Wed Jul 15 13:01:32 2015 : ERROR: (23) sql: rlm_sql_cassandra: Key may not be empty Thank you for your response, cheers, Sara

2 1

rlm_files: Collided users not always sorted
by Dylan Jones 14 Jul '15

14 Jul '15

I believe I have found a bug in that when I have a lot of users with similar enough naming that results in hash collisions, the collided users in the linked list are not always properly sorted. This results in a noop from the rlm_files module and authentication failure. I have tested 2.1.7 and a 3.1 pull from git. Since I'm unable to paste such a large users file, hopefully this TCL snippet, which you can redirect to a file, will suffice to generate the users file. #! /usr/bin/env tclsh set users [list] set pw "thisisatest" for {set i 8} {$i < 16} {incr i} { for {set j 0} {$j < 32768} {incr j} { lappend users "[format %016d [expr {$j + 1}]](a)aaaaa${i}.com\tCleartext-Password := \"$pw\"" } } puts [join $users "\n"] In this file, there will be 6 users that cannot be authenticated and it always seems to happen in pairs. Mon Jul 13 12:17:40 2015 : Auth: (0) Login incorrect (No Auth-Type found: rejecting the user via Post-Auth-Type = Reject): [ 0000000000026311(a)aaaaa10.com/thisisatest] (from client name port 0) Mon Jul 13 12:17:49 2015 : Auth: (1) Login incorrect (No Auth-Type found: rejecting the user via Post-Auth-Type = Reject): [ 0000000000026311(a)aaaaa11.com/thisisatest] (from client name port 0) Mon Jul 13 12:17:53 2015 : Auth: (2) Login incorrect (No Auth-Type found: rejecting the user via Post-Auth-Type = Reject): [ 0000000000028649(a)aaaaa12.com/thisisatest] (from client name port 0) Mon Jul 13 12:17:57 2015 : Auth: (3) Login incorrect (No Auth-Type found: rejecting the user via Post-Auth-Type = Reject): [ 0000000000028649(a)aaaaa13.com/thisisatest] (from client name port 0) Mon Jul 13 12:18:00 2015 : Auth: (4) Login incorrect (No Auth-Type found: rejecting the user via Post-Auth-Type = Reject): [ 0000000000028471(a)aaaaa14.com/thisisatest] (from client name port 0) Mon Jul 13 12:18:05 2015 : Auth: (5) Login incorrect (No Auth-Type found: rejecting the user via Post-Auth-Type = Reject): [ 0000000000028471(a)aaaaa15.com/thisisatest] (from client name port 0) I have debugged this to the point where if I relax the 'if (cmp > 0) break;' in list_find to 'if (cmp > 0) continue;', forcing a further walk of the list, my users will be authenticated. At this point though, the reverse split-ordered list is a bit beyond me and I'm looking for some help. Any ideas? Is this enough for a defect? Thanks, Dylan

2 2

Copy-acct-to-home-server Issue
by Ricardo Larrañaga 14 Jul '15

14 Jul '15

Hello Guys, i was wondering if you could give me some pointers on how to troubleshoot an issue. I am running freeradius 3.0.4 on Centos 7, and i am using copy-acct-to-home-server in order to replicate the accounting database between the 3 servers. Right now, all my NAS are only pointing to one server (Lets call it server1). So server2 and server3 do not receive authentication requests, they just receive accounting packets from server1. Now, with some NAS i also see issues where i miss accounting stop packets, and i end up with stale sessions. I am working on solving that, but in the mean time i run a script on all three servers that queries all NAS for active sessions and marks the stale sessions as Terminated. My script logs the stale sessions, so i can compare them between servers. My problem is that the stale sessions between the servers are different. Usually, server 2 and 3 have more stale sessions than server 1. This would tell me that there are accounting packets not processed or missing between server 1 and server 2 and 3. First thing i did was looking at the networking side of things. All interfaces between the servers run clean, they are all connected to the same switch. So i am trying to troubleshoot what is happeing with these packets. The questions i have are: 1) My copy acct-to-home-server for each server configuration is as follows: - log all the incoming packets to a detail file. -copy-acct-to-home-server server reads the detail file and updates the proxy-to-realm control attribute so the packet gets proxied to the other server. Acct always returns ok. If i understand this correctly, in this configuration the packets are "Sent and forgotten". So if a packet fails to be received or processed by server2 or server3, it wont be retried. The fact that all the detail files are empty makes me think that this is the way the server is working right now. Any ideas on how could i implement a simple "retry 3 times" policy? My issue is that since i proxy the packet, and and always return ok on accounting, i am not sure where to put the "IF packet failed to ACK, return fail". From what i see, it cannot be done in the proxy section, unless i do something like: realm SERVER1 { } 2) I dont see anything in the logs that would indicate there is a problem with packets being sent to the other to servers. How can i catch these issues from the logs or debug perspective? the only thing i can think of is to turn debug on for all the packets with packet-source-destination equals "server 2" and server 3" in server one, and go from there, but any suggestions would be appreciated, as that would basically be my whole radius acct traffic. I am copying here the contents of copy-acct-to-home-server, for reference (They are identical for all servers): server copy-acct-to-SERVER2 { listen { type = detail filename = /buffer_disk/SERVER2/detail_SERVER2 load_factor = 10 } preacct { update control { Proxy-To-Realm := "SERVER2" } } accounting { ok } pre-proxy { } post-proxy { } } My proxy.conf section only contains a realm section from it server, in the old configuration fashion (I probably should change it to the new one): realm "SERVER1" { nostrip authhost = 192.168.1.1:1812 accthost = 192.168.1.1:1813 secret=itssecret } As always, thank you very much for your help!. Regards

2 7

Manual insert of credentials into radcheck row disappears after five mins ( MySQL )
by Sophie Loewenthal 14 Jul '15

14 Jul '15

Dear everybody, I was asked to manaully add a user into our Radius db for some thrird party monitoring. Sometimes when I insert the row it's there, but after 5 mins or less the row is removed, as shown below. Does some Radius process remove rows? * First attempt * mysql> INSERT INTO radcheck (id, username, attribute, op, value) VALUES (DEFAULT,'xmonitor1','User-Password',':=','xxxxxxx'); Query OK, 1 row affected (0.01 sec) mysql> select * from radcheck where username = 'xmonitor1'; Empty set (0.01 sec) (Disappeared immediately!) * Try again * mysql> INSERT INTO radcheck (id, username, attribute, op, value) VALUES (DEFAULT,'xmonitor1','User-Password',':=','xxxxxxx'); Query OK, 1 row affected (0.00 sec) mysql> select * from radcheck where username = 'xmonitor1'; +-------+-----------+---------------+----+---------+ | id | username | attribute | op | value | +-------+-----------+---------------+----+---------+ | 65745 | xmonitor1 | User-Password | := | xxxxxxx | +-------+-----------+---------------+----+---------+ 1 row in set (0.00 sec) ( Now it's there) ( Let's wait 5 mins and try this query again ) mysql> select * from radcheck where username = 'xmonitor1'; Empty set (0.00 sec) ( Opps. now it's gone ) ( Let's see if some other entry took this id ) mysql> select * from radcheck where id = '65745'; Empty set (0.00 sec) mysql> select * from radcheck where id = 65745; Empty set (0.00 sec) ( Nope ). Operating System: CentOS 6.2 RADIUS Server: freeradius-mysql-2.1.12-1.el6.x86_64 freeradius-utils-2.1.12-1.el6.x86_64 freeradius-2.1.12-1.el6.x86_64 MYSQL server: percona-xtrabackup-2.2.9-5067.el6.x86_64 Percona-Server-shared-56-5.6.21-rel69.0.el6.x86_64 Percona-Server-server-56-5.6.21-rel69.0.el6.x86_64 Percona-Server-shared-compat-5.5.30-rel30.2.508.rhel6.x86_64 percona-toolkit-2.2.3-1.noarch Percona-Server-client-56-5.6.21-rel69.0.el6.x86_64 I'd be very grateful if somebody could let me know how I could diagnose this, or perhaps tell me the right way to insert a username+password into Radius. Kind regards. Sophie

4 5