January 2016 - Freeradius-Users - lists.freeradius.org

does freeradius support key-wrap
by Michael Martinez 17 Jan '16

17 Jan '16

Hi, Is Freeradius key-wrap compliant? I don't see any recent dialogue on this. I only see some discussion from 2009, in which Alan DeKok states that Freeradius does not yet support the IETF key-wrap document. Implying that perhaps it would be added at some point. But I don't see anything currently in the literature to say whether newer versions do, or do not. -Mike -- ---

2 1

freeradius 3.0.4 can't contact LDAP server
by Blangille Denis 17 Jan '16

17 Jan '16

hello I'm using freeradius 3.0.4 on CentOS 7 with a LDAP server, ApacheDS M20. I have configure radius.conf, clients.conf and ldap file module. The debug command radiusd -XC returns the configuration is good. But it returns : rlm_ldap: Falling back to build time libldapversion info. Query for LDAP_OPT_API_INFO returned -1. rlm_ldap: libldap vendor: OpenLDAP version: 20439. and the server can't contact LDAP server at the starting. I'm test with a ldapsearch command with the same information and i have no error. A solution is possible to make a contact between the servers ? Thanks. Denis Blangille

2 1

Does Freeradius support RFC 3576 (dynamic authorization)?
by Michael Martinez 16 Jan '16

16 Jan '16

Hi, do recent (>= 2.1.12) versions have support for RFC 3576? The website makes some vague statement about being "compatible" with it, but doesn't actually say whether it will *do* dynamic authorization. -Mike -- ---

3 2

Multilogin accounting Problem
by Arash Shams 16 Jan '16

16 Jan '16

Hello for example i have a daily service with 4gb bandwidth . i logged in 3 devices with same username (simultaneous-use) now i have 12 gb service means each device gets 4 gb instead of all of them have 4 gb together how can i solve this problem ? FreeRADIUS Version 3.1.0 with mysql and mikrotik as nas . thank you

2 1

Disabling log entries for rejected users
by Michał B 15 Jan '16

15 Jan '16

Hi guys, I use freeradius for authenticating DHCP/PPPoE clients connected to Mikrotik routers. Freeradius uses users files, not SQL database. If I disable some user in my management software, the "Accept" entry in proper "users" file is not generated. The access request for such user is logged: Jan 13 09:22:13 radsrv freeradius[2152]: Login incorrect (rlm_chap: Clear text password not available): [blockeduser/<CHAP-Password>] (from client mikrotik-main port 0 cli 194.182.13.200) After adding rejects for blocked users, for example: blockeduser Auth-Type := Reject The message still appears in the log file: Jan 13 09:26:14 radsrv freeradius[2152]: Login incorrect: [blockeduser/<CHAP-Password>] (from client mikrotik-main port 0 cli 194.182.13.200) How can I disable log etries for blocked/rejected users? Regards!

5 8

Accounting with external script
by mclaut＠mclaut.com 15 Jan '16

15 Jan '16

Hi ! Sorry, but I can not find the answer to the question - what the external (for example php script) should return to the radius server at accounting? What attributes? I'm use - FreeRADIUS Version 2.2.6, for host x86_64-redhat-linux-gnu, built on Sep 22 2015 at 15:27:25 In Radius log: Fri Jan 15 20:59:12 2016 : Info: Ready to process requests. rad_recv: Accounting-Request packet from host 1.1.4.4 port 62311, id=8, length=32 Acct-Status-Type = Start Acct-Session-Id = "8768" Fri Jan 15 20:59:54 2016 : Info: # Executing section preacct from file /etc/raddb/sites-enabled/mclaut_default_exec Fri Jan 15 20:59:54 2016 : Info: +group preacct { Fri Jan 15 20:59:54 2016 : Info: ++[preprocess] = ok Fri Jan 15 20:59:54 2016 : Info: [bill_acc] expand: %{hex:Attribute} -> Fri Jan 15 20:59:54 2016 : Info: [bill_acc] expand: %{Acct-Session-Id} -> 8768 Fri Jan 15 20:59:54 2016 : Info: [bill_acc] expand: %{Acct-Authentic} -> Fri Jan 15 20:59:54 2016 : Info: [bill_acc] expand: %{Acct-Status-Type} -> Start Fri Jan 15 20:59:54 2016 : Info: [bill_acc] expand: %{NAS-IP-Address} -> 1.1.4.4 Fri Jan 15 20:59:54 2016 : Info: [bill_acc] expand: %{User-Name} -> Fri Jan 15 20:59:54 2016 : Info: [bill_acc] expand: %{NAS-Port} -> Fri Jan 15 20:59:54 2016 : Info: [bill_acc] expand: %{Framed-Protocol} -> Fri Jan 15 20:59:54 2016 : Info: [bill_acc] expand: %{Framed-IP-Address} -> Fri Jan 15 20:59:54 2016 : Info: [bill_acc] expand: %S -> 2016-01-15 20:59:54 Fri Jan 15 20:59:54 2016 : Debug: Exec output: Fri Jan 15 20:59:54 2016 : Info: [bill_acc] Exec: program returned: 0 Fri Jan 15 20:59:54 2016 : Info: ++[bill_acc] = ok Fri Jan 15 20:59:54 2016 : Info: +} # group preacct = ok Fri Jan 15 20:59:54 2016 : Info: WARNING: Empty accounting section. Using default return values. Fri Jan 15 20:59:54 2016 : Info: Finished request 5. Fri Jan 15 20:59:54 2016 : Info: Cleaning up request 5 ID 8 with timestamp +125 Fri Jan 15 20:59:54 2016 : Debug: Going to the next request Fri Jan 15 20:59:54 2016 : Info: Ready to process requests. I do not understand - WARNING: Empty accounting section. Using default return values. But, answer from script: Fri Jan 15 20:59:54 2016 : Debug: Exec output: Fri Jan 15 20:59:54 2016 : Info: [bill_acc] Exec: program returned: 0 Fri Jan 15 20:59:54 2016 : Info: ++[bill_acc] = ok Fri Jan 15 20:59:54 2016 : Info: +} # group preacct = ok And NAS don't recieve any answers from Radius Server.... Tell me please, what am I doing wrong? Thank you in advance

2 1

MAC expiry
by Max .M 15 Jan '16

15 Jan '16

Hi all, I currently have MAC authentication with Freeradius and MAC stored into Mysql db. It works well :) Is it possible to enable MAC auth expiry ? E.G : A user can authenticate using MAC auth for 1 week but must auth again at day 8. Thanks !

2 4

Elasticsearch config update for detail files
by Matthew Newton 15 Jan '16

15 Jan '16

Hi, I've just done a pull request to update the elasticsearch config for FreeRADIUS. There are much more complete examples for the whole stack now, which should make it quite easy for anyone else to feed RADIUS detail files into elasticsearch for querying. As an overview - - The elasticsearch mapping (i.e. database field formats) has been updated so that common numeric fields such as Acct-Input-Octets are stored as "long" instead of "string". - All other fields are automatically set to "string". The mapping should automatically cope with any RADIUS attributes thrown at it, though some manual tweaking may be required to add additional number types (if they are used as numbers, rather than just identifiers). - The logstash configuration will automatically pull out MAC addresses, IP addresses, SSIDs etc from common attributes such as Calling-Station-Id or Framed-IP-Address and store them as sub-fields. Therefore the stored data includes e.g. Called-Station-Id.ssid to directly get the wireless SSID value. - It also merges Acct-Input/Output-Octets and Acct-Input-Gigawords to become the 64-bit value Acct-Input-Octets.long, removing the need to join these elsewhere and making e.g. plots of data transferred by user much easier. - There is an example log-courier configuration file, which is better than using the mulitline filter in logstash (using this disables threaded filters, which can slow processing down with lots of logs). In addition, example dashboards for both Kibana 3 and Kibana 4 and instructions on importing them. Putting all these together should make it really easy for anyone to feed their RADIUS detail files into elasticsearch for querying, analyzing and reporting. Happy to hear from anyone who tries using this - successful or otherwise. We've found it incredibly useful for all sorts of logs. Thanks, Matthew -- Matthew Newton, Ph.D. <mcn4(a)le.ac.uk> Systems Specialist, Infrastructure Services, I.T. Services, University of Leicester, Leicester LE1 7RH, United Kingdom For IT help contact helpdesk extn. 2253, <ithelp(a)le.ac.uk>

2 1

eap_ttls not setting 'FreeRADIUS-Proxied-To'
by David Lord 14 Jan '16

14 Jan '16

Hi all, I’m porting our config from v2.2.9 to v3.0.11. The problem I’m experiencing is that the eap_peap submodule does set FreeRADIUS-Proxied-To, but eap_ttls does not. In v2, both submodules did. Unfortunately I’m currently relying on this attribute for tunnelling in one server. Time is limited so I’m sticking with the previous architecture, which looks like this (trimmed down): authorize { split_user_realm choose_eduroam_proxy # reject invalid realm, set Proxy-To-Realm to national federation or do nothing so it goes internally eap_eduroam if (“%{%{FreeRADIUS-Proxied-To}:-}” == 127.0.0.1) { # inner tunnel: ensure user exists in LDAP and is permitted access user_search # includes ldap_central and sets auth-type if appropriate } } authenticate { Auth-Type PAP { pap } Auth-Type MS-CHAP { mschap } Auth-Type ldap_central { ldap_central } eap_eduroam } The result is that PEAP and various non-tunnelled EAPs authenticate correctly, but TTLS never enters the if-block and so no Auth-Type is ever set. Has this behaviour been intentionally changed? There’s no mention of it in https://github.com/FreeRADIUS/freeradius-server/blob/v3.0.x/doc/ChangeLog. If my need isn’t utterly terrible, would it be possible to re-add FreeRADIUS-Proxied-To to eap_ttls? Cheers, David Lord

7 20

Questions about RadPerf-u14.04
by Jim 13 Jan '16

13 Jan '16

I'm using RadPerf-u14.04 on Ubuntu 14.04 machine. Why is it that I cannot use -n together with -p? Does the "Packets/s" means Requests/seconds? If so, why is it that when I set -n to 50, the packet/sec is always less than 5, it only goes higher after using -p. Thanks, Jim Well Balatero, Cleversoft, Inc.

1 0