September 2015 - Freeradius-Users - lists.freeradius.org

Please check v3.0.x head
by Alan DeKok 30 Sep '15

30 Sep '15

We're getting ready for the release of 3.0.10. Please do a last double-check to be sure it's OK. We've added a LOT of tests since 3.0.9. The tests make sure that future code changes will be caught by the test cases before they're seen in production. :) The list of changed or added tests follows: src/tests/eapsim-03/radiusd-example.txt src/tests/keywords/count-error src/tests/keywords/else-error src/tests/keywords/foreach-break-4 src/tests/keywords/radiusd.conf src/tests/keywords/switch-escape src/tests/keywords/switch-virtual src/tests/keywords/update-delete src/tests/keywords/virtual src/tests/keywords/virtual-load-balance src/tests/keywords/virtual_policy src/tests/keywords/with_dots src/tests/map/base src/tests/map/base.out src/tests/map/count-error src/tests/map/count-list-error src/tests/map/map_tests.mk src/tests/map/map_unit.c src/tests/map/map_unit.mk src/tests/modules/ldap/groups_rfc2307bis.unlang src/tests/peap-client-mschapv2.conf src/tests/unit/rfc.txt src/tests/unit/tunnel.txt src/tests/unit/vendor.txt src/tests/unit/xlat.txt Alan DeKok.

7 20

RE: Backtrace of ldap related crash
by Franks Andy (IT Technical Architecture Manager) 30 Sep '15

30 Sep '15

Just noticed I rather rudely didn't say thanks. Thanks! Andy -----Original Message----- From: Freeradius-Users [mailto:freeradius-users-bounces+andy.franks=sath.nhs.uk@lists.freeradius.org] On Behalf Of Arran Cudbard-Bell Sent: 22 September 2015 19:42 To: FreeRadius users mailing list Subject: Re: Backtrace of ldap related crash > On 22 Sep 2015, at 15:35, Matthew Newton <mcn4(a)LEICESTER.AC.UK> wrote: > > On Tue, Sep 22, 2015 at 01:59:17PM +0000, Franks Andy (IT Technical Architecture Manager) wrote: >> Drat, I fixed AD (memory leak) and now it's not likely to happen >> again until the next time, which could be a while away. > > Have you still got the coredump? Should be able to fire up gdb again > and get it from there. Pushed a fix. Missed return code check from rlm_ldap_map_profile. -Arran Arran Cudbard-Bell <a.cudbardb(a)freeradius.org> FreeRADIUS development team FD31 3077 42EC 7FCD 32FE 5EE2 56CF 27F9 30A8 CAA2

1 0

Alive sessions in radacct table
by Anisa Allahdadi 30 Sep '15

30 Sep '15

Hi all, My FreeRADIUS is up and running. However, in 'radacct' table, there are only 'acctstarttime' and 'acctstoptime' being recorded, how about 'alive'? In the real world situation we can record Alive sessions every 10-15 min. Could anybody tell me if it is possible in FreeRADIUS as well? Many thanks Anisa

7 28

buffered_sql problem
by Ricardo Larrañaga 29 Sep '15

29 Sep '15

Hello Guys: I was wondering if you could help me with an issue that i am having with my buffered_sql configuration. I am using freeradius 3.0.4, under centos 7, and with buffered sql configuration, and since 3 days ago, no accounting records are being imported into my database. detail and detail.work files are in the proper directory, but detail.work keeps growing and it does not look like it is offloading any data to the DB, Almost like buffered_sql would not be reading the detail.work file anymore. Now, i did run the server in debug mode, and i see the detail.work file being read. I do see one problem with the db insertion of some accounting records. It looks like it looks like some acct records are coming with a acctuniqueid that is already in the db, so those fail, but my question is, will the server keep trying to insert that record and not try any others in the detail.work file? My buffered_sql config is pretty standard: server buffered-sql { listen { type = detail filename = "/buffer_disk/detail" load_factor = 10 poll_interval = 1 retry_interval = 30 } preacct { preprocess acct_unique files } accounting { sql_radacct } The first packet in the detail.work file fails with a db error for having a duplicated acctuniqueid. Will the server continue processing other packets? Will that packet stay in the file? At this point i have a really big amount of packets in the file, and no accounting records on my db, so i am really looking forward to fix this issue. Thanks for any help you could provide. Regards

5 14

Excluding traffic from one ip in accounting
by Randeep 29 Sep '15

29 Sep '15

Hi All, We have a couple of streaming servers in our network. We would like to exclude the traffic from these servers to client from accounting. How we can do that? We tried to put a filter in accounting section when interim accounts is processed. But in interim accounts, only the data usage is receiving. It doesn't have any ip information in those. How can we achieve this. Please suggest. -- Randeep Mob: +919447831699[kerala] Mob: +919880050349[B'lore] http://twitter.com/Randeeppr http://in.linkedin.com/in/randeeppr [image: --] Randeep Raman [image: http://]about.me/Randeeppr <http://about.me/Randeeppr>

2 11

Accepting expired CA using EAP-TLS
by Alexandros Gougousoudis 29 Sep '15

29 Sep '15

Hi, I'am using FR 2.1.10 für EAP-TLS over Wifi. The problem is, that our CA has expired and I have to renew it (and it seems also all depending certs), but we're a little late with that. The Wifi-Clients can't connect anymore, because FR says that the CA has expired, which also means, I can't install them the new cert. Is there a dirty hack in EAP to make FR ignore this? TIA Alex

3 2

Freeradius with Kamailio integration
by Marian Pandoranum 28 Sep '15

28 Sep '15

Hello, I have a problem regarding the integration between Freeradius and Kamailio. In order to do that I followed this tutorial [1]http://www.kamailio.org/docs/openser-radius-1.0.x.html . Kamailio, radiusclient and freeradius are running on the same machine. My config files includes the following: /etc/raddb/radiusd.conf: ... modules { ... $INCLUDE sql.conf $INCLUDE ${confdir}/modules/ #here I have digest module } /etc/raddb/dictionary: ... $INCLUDE /etc/radiusclient-ng/dictionary.kamailio ... /etc/raddb/clients.conf .... client localhost {... ipaddr = 127.0.0.1,.....secret=mysecret......} In /etc/raddb/sql.conf I have set database to postgresql, server =localhost,...... /etc/raddb/sites-enabled/default : authorize{... sql digest..... } authenticate{... digest.... } accounting{.... sql..... } /etc/radiusclient-ng/radiusclient.conf: authserver and acctserver = localhost seqfile = /var/run/kamailio_radius.seq -----> should I have something set here !? /etc/radiusclient-ng/servers: localhost mysecret ---> Also, I've tried 127.0.0.1 mysecret ---> the result is the same /usr/share/radiusclient-ng/dictionary: $INCLUDE /etc/radiusclient-ng/dictionary.kamailio /etc/kamailio/dictionary.freeradius and /etc/radiusclient-ng/dictionary.kamailio are the same. I am using auth_radius module in kamailio.cfg but when I am running radiusd -X i can't see any requests from Kamailio. Also, I am using radclient command like in the above link...and everything it's OK. I am receiveing : code 2, length = 45 Reply-Message = "Hello, test with digest" Did I miss something in the configuration process ? Thank you for any help you can provide ! References 1. http://www.kamailio.org/docs/openser-radius-1.0.x.html

2 1

EAP authentication and DHCP
by Hernán Freschi 28 Sep '15

28 Sep '15

I would like to authenticate WiFi users with EAP and assign an IP address based on their username. I realize this is a two step process: first, the user must be authenticated with EAP. Once this is done, the user will request an IP address via DHCP. But there is no connection between the EAP username, and the client's MAC address which EAP uses. With EAP, the MAC address is the Calling-Station-ID for the Anonymous identity. The tunneled identity has no ID. Is it possible to use the post-auth section to log both username and MAC, so the DHCP module can look up the username from MAC address, and assign the address from the right pool? By default the post-auth module writes two records to the radpostauth table: one, from the anonymous identity with the Calling-Station-ID set to the MAC address, and another, for the tunneled identity, with an empty calling ID. Thanks, Hernan

3 8

Normalizing MAC address for database storage?
by Hernán Freschi 28 Sep '15

28 Sep '15

I'm trying to use EAP and DHCP together: EAP authenticates the client, the MAC address is stored to database along with username, and then the DHCP module looks up the MAC and uses it as a key to retrieve the username, which will be used to find the user group, which will be the ip pool for the address. Anyway, the problem I've found is that the device I'm using sends the Calling-Station-Id as uppercase separated with hyphen: AA-BB-CC-DD-EE-FF, while DHCP uses the lowercase-colon format: aa:bb:cc:dd:ee:ff. How can I normalize the formats before writing to database? I've found the "tolower" case function which solves half the problem. But I can't find a way to convert "-" into ":". I could do it on SQL but I'd rather do it on Freeradius before it's stored. Maybe even a more minimalistic format would be better for MAC address: all lowercase, no separators: aabbccddeeff. A simple regex could discard anything that's not 0123456789abcdef, and then convert to lowercase. Thanks, Hernan

5 4

rfc6929 radius ext - nested tlv format question
by Vereecke, Katrien (Katrien) 28 Sep '15

28 Sep '15

Hello, I have a question regarding the nesting of radius attributes according to rfc6929. I am using the freeradius-server version V3.0.x and I defined as test the following in my dictionary : ATTRIBUTE Test-Attr-50 241.50 tlv ATTRIBUTE Test-Attr-50_1 241.50.1 octets ATTRIBUTE Test-Attr-50_1_2 241.50.1.2 string And in the users file : Test-Attr-50_1 = 0x112233, Test-Attr-50_1_2 = "testString50", These attributes are sent in the access-accept: (156) Sent Access-Accept Id 247 from 138.203.10.191:1812 to 138.203.10.123:64395 length 0 (156) Test-Attr-50_1 = 0x112233 (156) Test-Attr-50_1_2 = "testString50" I expected that this would give problems because the attribute 241.50.1 is not defined as tlv in the dictionary, but the wireshark shows that the attribute includes both the octets for Test-Attr-50_1 and the nested attribute Test-Attr-50_1_2 . Is the above a valid configuration? When decoding this attribute, how can one distinguish whether 241.50.1 contains real data or again a nested attribute 241.50.1.2? f1 18 32 01 05 11 22 33 01 10 02 0e 74 65 73 74 53 74 72 69 6e 67 35 30 Thanks, Kind regards, Katrien.

2 3