December 2016 - Freeradius-Users - lists.freeradius.org

RADSEC testing with FR 3.1
by Alex Sharaz 08 Dec '16

08 Dec '16

Now I did some radsec stuff in 2013 with radsecproxy but those brain cells have long gone, and I need to use FR for this So As advised given up on FR 4.0 Built 2 servers running FR 3.1 Copied TLS example into /etc/freeradius/sites-enabled at both end. Wrapped listen statement with server {...} to get it to run Defined sending client IPv6 address at end supposed to be connecting to Added home_server/pool/realm at sending end Built eapol_test so I could fire an eap_peap request at the other end. Run both serevers with radiusd -d /etc/freeradius -fxxxx -l /var/log/radius.log>/var/log/radius.log (yes its -fxxx because that's what it tells me to do if you want to use tls) run eapol_test -c /usr/local/etc/sharaz-peap.conf -a 127.0.0.1 -s testing123 receiving end gets Thu Dec 8 14:24:56 2016 : Info : Ready to process requests Thu Dec 8 14:25:00 2016 : Debug : ... new connection request on TCP socket Thu Dec 8 14:25:00 2016 : Debug : Listening on auth+acct from client (2a01:348:6:59d::2, 56193) -> (::, 2083, virtual-server=sharaz-tls) Thu Dec 8 14:25:00 2016 : Debug : tls - Closing TLS socket from client port 56193 Thu Dec 8 14:25:00 2016 : Debug : tls - Client has closed connection Thu Dec 8 14:25:00 2016 : Info : ... shutting down socket auth+acct from client (2a01:348:6:59d::2, 56193) -> (::, 2083, virtual-server=sharaz-tls) Sender seems to have Thu Dec 8 14:41:53 2016 : Debug : No matches Thu Dec 8 14:41:53 2016 : Info : (1) sql - Need 2 more connections to reach min connections (3) Thu Dec 8 14:41:53 2016 : Debug : Trying SSL to port 2083 Thu Dec 8 14:41:53 2016 : Debug : tls - Requiring Server certificate Thu Dec 8 14:41:53 2016 : Error : tls - System call (I/O) error (0) Thu Dec 8 14:41:53 2016 : Error : Failed starting SSL to new proxy socket 'proxy (::, 0) -> home_server (2a03:b0c0:1:a1::a9f:8001, 2083)' Thu Dec 8 14:41:53 2016 : Proxy : (1) Failed to insert request into the proxy list Thu Dec 8 14:41:53 2016 : Debug : Thread 5 waiting to be assigned a request So how do I enable enough debugging to figure out what's gone wrong at the System Call I/O error log message point ?

2 2

Re: Freeradius and check connection to DB
by vanish 08 Dec '16

08 Dec '16

Thanks for your answer. Install freeradius 3.0.12 and iODBC. Read docs at http://networkradius.com/doc/3.0.10 Can't understand - how work multiple sql instances in v3? In freeradius v2 it works clear for me: - Create in sql.conf: sql sql_instance1 { ... } sql sql_instance2 { ... } - Use: On virtual server1: authorize { sql_instance1 } accounting { sql_instance1 } On virtual server2: authorize { sql_instance2 } accounting { sql_instance2 } But in 3-d version i can't understand how it works. Where i can find more detail info about this in v3 with examples?

2 2

Authenticate by users file for RADIUS service operation check
by Seiichirou Hiraoka 08 Dec '16

08 Dec '16

Hello folks, I am using FreeRADIUS 3.0.4 on CentOS 7.2. In order to check the service operation of RADIUS, we are trying to authenticate with the users file, but proxy request is made. The setting is as follows. - /etc/raddb/proxy.conf realm "~^subdomain\.domain\.com$" { authhost = LOCAL accthost = LOCAL } home_server server1 { .... } home_server server2 { .... } home_server_pool server { type = fail-over home_server = server1 home_server = server2 } realm DEFAULT { pool = server nostrip } - /etc/raddb/users test(a)test.com Auth-Type := PAP , Cleartext-Password := "test" or test(a)test.com Auth-Type := Local , Cleartext-Password := "test" or test(a)test.com Cleartext-Password := "test" ... ----- When radtest command is executed with radiusd -X, the following result is obtained. # radtest test(a)test.com test localhost 0 testing123 Sending Access-Request Id 3 from 0.0.0.0:48661 to 127.0.0.1:1812 User-Name = 'test(a)test.com' User-Password = 'test' NAS-IP-Address = X.X.X.X NAS-Port = 0 Message-Authenticator = 0x00 Received Access-Reject Id 3 from 127.0.0.1:1812 to 127.0.0.1:48661 length 36 Reply-Message = 'Request Denied' (0) -: Expected Access-Accept got Access-Reject The following log is output to the console. (snip) (0) [auth_log] = ok (0) [chap] = noop (0) [mschap] = noop (0) [digest] = noop (0) suffix : Checking for suffix after "@" (0) suffix : Looking up realm "test.com" for User-Name = "test(a)test.com" (0) suffix : Found realm "DEFAULT" (0) suffix : Adding Realm = "DEFAULT" (0) suffix : Proxying request from user test(a)test.com to realm DEFAULT (0) suffix : Preparing to proxy authentication request to realm "DEFAULT" (0) [suffix] = updated (0) eap : No EAP-Message, not doing EAP (0) [eap] = noop (0) files : users: Matched entry test(a)test.com at line 1 (0) [files] = ok (0) [expiration] = noop (0) [logintime] = noop (0) [pap] = noop (0) } # authorize = updated Opening new proxy socket 'proxy address * port 0' Listening on proxy address * port 59404 (0) Proxying request to home server X.X.X.X port 1812 timeout 30.000000 (0) Sending Access-Request packet to host X.X.X.X port 1812, id=85, length=0 (snip) ----- My question is how to authenticate users file without proxying ? Best regards!

1 0

Framed-IP-Address not inserted in mysql
by Bernd 07 Dec '16

07 Dec '16

Hi, running FreeRADIUS Version 3.0.4 (built for host x86_64-redhat-linux-gnu, built on Mar 5 2015 at 23:41:36) from stock packages on a CentOS 7 machine. I have the problem that I see Framed-IP-Address entries in radacct log files: Wed Dec 7 15:11:57 2016 Acct-Session-Id = '0004xxxx' Framed-Protocol = PPP Framed-IP-Address = 10.2.3.4 User-Name = 'user(a)example.com' Acct-Session-Time = 111 Acct-Input-Octets = 3499 Acct-Output-Octets = 5252 Acct-Input-Packets = 45 Acct-Output-Packets = 57 Acct-Status-Type = Stop Service-Type = Framed-User Acct-Delay-Time = 0 NAS-IP-Address = 12.13.14.15 Event-Timestamp = 'Dec 7 2016 15:11:57 CET' Acct-Unique-Session-Id = '297cb70bcbc4a02b1d1xyz123' Timestamp = 1481119917 but they're *not* being inserted into the MySQL database (field is empty, tcpdump shows that clearly a '' is being transmitted to MySQL): INSERT INTO radacct (acctsessionid, acctuniqueid, username, realm, nasipaddress, nasportid, nasporttype, acctstarttime, acctupdatetime, acctstoptime, acctsessiontime, acctauthentic, connectinfo_start, connectinfo_stop, acctinputoctets, acctoutputoctets, calledstationid, callingstationid, acctterminatecause, servicetype, framedprotocol, framedipaddress) VALUES ('0004xxxx', '297cb70bcbc4a02b1d1xyz123', 'user(a)example.com', '', '12.13.14.15', '', '', FROM_UNIXTIME(1481119920), FROM_UNIXTIME(1481119920), NULL, '0', '', '', '', '0', '0', '', '', '', 'Framed-User', 'PPP', '') Help very much appreciated. Best, Bernd

2 1

RE: Set up /dev/null (no auth) proxy server on NULL realm
by Alan Buxey 07 Dec '16

07 Dec '16

I told you exactly what to do in my first reply (simple bit of unlang in the authorize section) alan

2 1

Set up /dev/null (no auth) proxy server on NULL realm
by Seiichirou Hiraoka 06 Dec '16

06 Dec '16

Hello folks, I use freeradius 3.0.4 on CentOS 7.2 (RPM) And I want to set up /dev/null (without auth) proxy server on NULL realm. Now, I set up my proxy.conf as follow. ----- realm NULL { authhost = 127.0.0.1:1645 accthost = 127.0.0.1:1646 secret = dummy } ----- No service exist in 127.0.0.1:1645, 1646. When user try to auth without realm (NULL realm), all authentication going to fail. I have some question. 1) Is my setting correct ? 2) Is there a way to set the timeout? (I want to set timeout to 0) 3) Any other advice? Best regards,

2 4

Calculating data usage between interim and stop packets.
by Anuruddha Premalal 05 Dec '16

05 Dec '16

Hi All, I'm trying to get users actual usage between accounting updates. With the folowing method, 1. Extended the python *preacct* method and filterout only interim updates and accounting stop packets. 2. Get the current usage recorded(inputoctets, outputoctets) from the mysql databse for the accounting sessionid group by date and take the latest value. 3. Take the difference between received input and output octets and the valus in the database *tx*= new_input_octets - old_input_octets *rx*= new_output_octets - old_output_octets 3. Send a paylod to a message queue pnly if *tx, rx* values are positive. I am trying to use this method to avoid periodic database polling to perform this operation. The issue is - at point 2 sometimes(intermittently) it returns an empty record set even the session has already been started (already received an accounting start). Is freeradius clearing the existing accouting record from the database as soon as it receives an accounting interim paccket - is there a way to insert my logic before that happens? Thanks & Best Regards, -- *Anuruddha Premalala (MIEEE)Mobile : +94717213122 <071%20721%203122>E-mail : anuruddhapremalal(a)gmail.com <anuruddhapremalal(a)gmail.com>web : www.anuruddha.org <http://www.anuruddha.org>*

2 2

issues with duplicate AcctUniqueId attribute values
by Alex Sharaz 05 Dec '16

05 Dec '16

While I track down why the above is happening .... 1). Can I enable debugging in just the buffered-sql virt server ? Its a pain running all of a server in debug mode 2). Is it possible to manually take a detail.work file and pipe it into buffered sql offline? 3). When buffered-sql sees rlm_sql_postgresql: Status: PGRES_FATAL_ERROR (4) sql: rlm_sql_postgresql: ERROR: duplicate key value violates unique constraint "radacct_acctuniqueid_key" (4) sql: rlm_sql_postgresql: DETAIL: Key (acctuniqueid)=(e5aa2781f1f3842a1b9e7590ce9d2ab6) already exists. (4) sql: SQL query returned: need alt query (4) sql: No additional queries configured rlm_sql (sql): Released connection (3) (4) [sql] = noop (4) } # accounting = noop (4) detail (/var/spool/freeradius/detail): No response to request. Will retry in 30 seconds it seems to block processing of subsequent statements. Any way of telling it to skip that update log an error and move onto the next one? A

2 2

FreeRadius Error
by Albert K 05 Dec '16

05 Dec '16

Hi, I have an installation with Samba 4.3.x (with winbindd) and FreeRadius 3.0.11. I want authentication with Windows AD and authorization with Windows AD LDAP. I am trying setup the PEAP mschap wifi and get the following error when /usr/local/bin/radtest radius tycbf@179963 localhost 0 testing123 Ready to process requests (1) Received Access-Request Id 160 from 127.0.0.1:22166 to 127.0.0.1:1812 length 76 (1) User-Name = "radius" (1) User-Password = "tycbf@179963" (1) NAS-IP-Address = 10.200.1.7 (1) NAS-Port = 0 (1) Message-Authenticator = 0xbd3d0852f4606cda7488d1198c4387bc (1) # Executing section authorize from file /usr/local/etc/raddb/sites-enabled/default (1) authorize { (1) policy filter_username { (1) if (&User-Name) { (1) if (&User-Name) -> TRUE (1) if (&User-Name) { (1) if (&User-Name =~ / /) { (1) if (&User-Name =~ / /) -> FALSE (1) if (&User-Name =~ /@[^@]*@/ ) { (1) if (&User-Name =~ /@[^@]*@/ ) -> FALSE (1) if (&User-Name =~ /\.\./ ) { (1) if (&User-Name =~ /\.\./ ) -> FALSE (1) if ((&User-Name =~ /@/) && (&User-Name !~ /(a)(.+)\.(.+)$/)) { (1) if ((&User-Name =~ /@/) && (&User-Name !~ /(a)(.+)\.(.+)$/)) -> FALSE (1) if (&User-Name =~ /\.$/) { (1) if (&User-Name =~ /\.$/) -> FALSE (1) if (&User-Name =~ /(a)\./) { (1) if (&User-Name =~ /(a)\./) -> FALSE (1) } # if (&User-Name) = notfound (1) } # policy filter_username = notfound (1) [preprocess] = ok (1) [chap] = noop (1) [mschap] = noop (1) [digest] = noop (1) suffix: Checking for suffix after "@" (1) suffix: No '@' in User-Name = "radius", looking up realm NULL (1) suffix: No such realm "NULL" (1) [suffix] = noop (1) eap: No EAP-Message, not doing EAP (1) [eap] = noop (1) [files] = noop rlm_ldap (ldap): Closing connection (1): Hit idle_timeout, was idle for 1543 seconds rlm_ldap (ldap): Closing connection (2): Hit idle_timeout, was idle for 1543 seconds rlm_ldap (ldap): Closing connection (3): Hit idle_timeout, was idle for 1543 seconds rlm_ldap (ldap): You probably need to lower "min" rlm_ldap (ldap): Closing connection (4): Hit idle_timeout, was idle for 1543 seconds rlm_ldap (ldap): You probably need to lower "min" rlm_ldap (ldap): Closing connection (5): Hit idle_timeout, was idle for 1537 seconds rlm_ldap (ldap): You probably need to lower "min" rlm_ldap (ldap): 0 of 0 connections in use. You may need to increase "spare" rlm_ldap (ldap): Opening additional connection (6), 1 of 32 pending slots used rlm_ldap (ldap): Connecting to ldap://10.100.100.10:389 rlm_ldap (ldap): Waiting for bind result... rlm_ldap (ldap): Bind successful rlm_ldap (ldap): Reserved connection (6) (1) ldap: EXPAND (samaccountname=%{%{Stripped-User-Name}:-%{User-Name}}) (1) ldap: --> (samaccountname=radius) (1) ldap: Performing search in "dc=sgcom,dc=co,dc=sg" with filter "(samaccountname=radius)", scope "sub" (1) ldap: Waiting for search result... rlm_ldap (ldap): Rebinding to URL ldap:// DomainDnsZones.sgcom.co.sg/DC=DomainDnsZones,DC=sgcom,DC=co,DC=sg rlm_ldap (ldap): Waiting for bind result... rlm_ldap (ldap): Rebinding to URL ldap:// ForestDnsZones.sgcom.co.sg/DC=ForestDnsZones,DC=sgcom,DC=co,DC=sg rlm_ldap (ldap): Waiting for bind result... rlm_ldap (ldap): Rebinding to URL ldap:// sgcom.co.sg/CN=Configuration,DC=sgcom,DC=co,DC=sg rlm_ldap (ldap): Waiting for bind result... rlm_ldap (ldap): Bind successful rlm_ldap (ldap): Bind successful rlm_ldap (ldap): Bind successful (1) ldap: User object found at DN "CN=radius,OU=LPK USERS,DC=sgcom,DC=co,DC=sg" (1) ldap: Processing user attributes (1) ldap: WARNING: No "known good" password added. Ensure the admin user has permission to read the password attribute (1) ldap: WARNING: PAP authentication will *NOT* work with Active Directory (if that is what you were trying to configure) rlm_ldap (ldap): Deleting connection (6) rlm_ldap (ldap): Need 3 more connections to reach 10 spares rlm_ldap (ldap): Opening additional connection (7), 1 of 32 pending slots used rlm_ldap (ldap): Connecting to ldap://10.100.100.10:389 rlm_ldap (ldap): Waiting for bind result... rlm_ldap (ldap): Bind successful (1) [ldap] = ok (1) [expiration] = noop (1) [logintime] = noop (1) } # authorize = ok (1) ERROR: No Auth-Type found: rejecting the user via Post-Auth-Type = Reject (1) Failed to authenticate the user (1) Using Post-Auth-Type Reject (1) # Executing group from file /usr/local/etc/raddb/sites-enabled/default (1) Post-Auth-Type REJECT { (1) attr_filter.access_reject: EXPAND %{User-Name} (1) attr_filter.access_reject: --> radius (1) attr_filter.access_reject: Matched entry DEFAULT at line 11 (1) [attr_filter.access_reject] = updated (1) [eap] = noop (1) policy remove_reply_message_if_eap { (1) if (&reply:EAP-Message && &reply:Reply-Message) { (1) if (&reply:EAP-Message && &reply:Reply-Message) -> FALSE (1) else { (1) [noop] = noop (1) } # else = noop (1) } # policy remove_reply_message_if_eap = noop (1) } # Post-Auth-Type REJECT = updated (1) Delaying response for 1.000000 seconds Waking up in 0.9 seconds. (1) Sending delayed response (1) Sent Access-Reject Id 160 from 127.0.0.1:1812 to 127.0.0.1:22166 length 20 Waking up in 3.9 seconds. (1) Cleaning up request packet ID 160 with timestamp +1543

2 1

Anyone got a working sites-available/tls file for FR 4.0- ?
by Alex Sharaz 03 Dec '16

03 Dec '16

Once I wrapped the supplied example in "server tls {....} " Get a "Failed to find clients radsec {..} message" even though the config is there. A

4 9