June 2016 - Freeradius-Users - lists.freeradius.org

Multiple Database
by Oscar Jofre 05 Jun '16

05 Jun '16

Hi, At the moment Im using freeradius 3.0.10 to identify hotspot users from over 400 mikrotiks. Its working fins but because all the routers are behind NAT IPS providers some of them uses the same local IP (nasipaddress). Im trying to change this creating VPN tunnels from mikrotik to radius server and assign unique IP to each hotspot mikrotik. I will identify this VPN clients throw radius as well. I dont want to use the same database from hotspot users and VPN-routers so I will create a new database and change configuration to setup freeradius to use 2 database. I will change on /mods-available/sql.conf to use sql hotspotdb {..} and sql vpndb {..} and pointing each one to a different database. For the moment I only want to use vpndb to authentificate not accounting So on sites-available/default I should change sql to hotspotdb and vpndb. Here are my questions. 1) Ive seen on sites-available/default authorize section sql, here is where I have to change to hotspotdb vpndb ? 2) On the other sections a have to change from sql à to hotspotdb .. anywhere else ? 3) This is most important how works authorization: When trying to authorize always check both databases ? Or if the first database return ok then doesnt query the second one. The best option will be with ULANG that Im not really familiarized with how I can know if a auth query comes to query a hotspot user or a VPN user .. maybe with nasipaddress or framedipaddress So what I should write on authorize section: If {% nasipaddress ?? } then - hotspotdb Else vpndb End if Thanks a lot !

2 1

make use of external DHCP server or ip address provisioning
by Rene Stoutjesdijk 05 Jun '16

05 Jun '16

Hello, i do have a question (my first on this list) or described situation below is possible, and if yes can somebody provide me tips how to do the freeradius part. I do have a freeradius daemon up and running with only authentication and accounting. I would like to change the setup that also ip address are provided (via the AVP Framed-IP-Address) towards the client. This seems to be possible, but i would like to get the ip address from an external DHCP server. So basically what i would like to achieve is: if authentication request comes in: - let the radius daemon do a request for an ip address from an external dhcp server with the following characteristics - the client mac address should contain the IMSI/MSISDN from the subscriber (request is coming from a GGSN (mobile network)) so doesn't contain a valid client mac address - the username AVP should be used as (i think option 61) within DHCP so it can also be used with the DHCP/DNS integration for name resolving (DDNS) - if the ip address is provided towards the free radius daemon, take this ip address and provide it back within the framed-ip-addres AVP towards the radius client (GGSN) I do have maybe an alternative and that's provide the ip address from the free radius daemon and execute a nsupdate update script to update the DNS, but i think the above described situation is better. thx in advance for your response.

2 2

ntlm_auth and UPN suffix for user-name
by Shawn Wilson 04 Jun '16

04 Jun '16

Hi, I'm trying to configure freeradius 2.x to authenticate users against 3 different domains in an active directory forest. Currently, I have the the proxy.conf file configure for each realm like so: realm domain.name { auth_pool = my_auth_failover } realm sub1.domain.name { auth_pool = my_auth_failover } realm sub2.domain.name { auth_pool = my_auth_failover } Then I can pass the domain to the ntlm_auth command by using the "-domain=%{realm}" parameter. Everything works fine as long User-Name is in the format <username>@<my.domain.name>. HOWEVER, the big problem I'm encountering is that we need users to authenticate via alternate UPN suffixes. It turns out Ntlm_auth will not authenticate against these suffixes, only the actual domain names. Soooo, my question is: How can I change the UPN suffixes to their corresponding domain names? I tried using preprocess and the hints file configured like this: DEFAULT User-Name =~ "^([^@]+)@upnsuffix1.name" User-Name := %{1}(a)domain.name<mailto:%25%7b1%7d@domain.name> But that seemed to break EAP because it detected that the user-name changed. Any help would be greatly appreciated, Shawn

2 1

Adding CUI support while NAS is not supporting it
by Anuruddha Premalal 04 Jun '16

04 Jun '16

Hi All, I have a setup as shown in the below figure (CUIissue.jpg) At step 3. the proxy AAA add the CUI to the radius access packet.and step 4 forward it unmodified to the NAS. NAS is supposed to send the CUI with the radius accounting requests, however the NAS is not supporting that and dropping the cui value. I read about the cui support in freeradius however it seems to be used in generating a new one and adding to the packet. In this case I need to add the CUI receiving from the proxy AAA to the accounting packets coming from the NAS. I could record the received CUI at step 3 and add that value to the accounting packet at pre-proxy stage 5>6, however the challenge is to find a correlation between the packets. Has anyone came across such a use-case and were there any solutions available? Appreciate your comments. Thanks and Regards, -- *Anuruddha Premalala (MIEEE)Mobile : +94717213122E-mail : anuruddhapremalal(a)gmail.com <anuruddhapremalal(a)gmail.com>web : www.anuruddha.org <http://www.anuruddha.org>Sri Lanka.*

2 1

Cisco-NAS-Port or Quintum-NAS-Port ignored
by Nelson Naranjo - PLOTCOM 04 Jun '16

04 Jun '16

Hi I've been googling a lot about this problem but I can't find any answer: I have Freeradius Version 2.1.10 (from Daloradius) only for accounting from a Cisco and Quintum NAS. I need to storage at MySQL the attribute NAS-Port.I do not need authentication. Freeradius receive an string like Quintum-NAS-port= "2 2/1/20" (or Cisco-NAS-Port) but it says "NAS-Port not seen" How can I do for Server recognize the vendor prefix.? I simulate from NTRadPing by sending string with "NAS-Port = xxx" and it's recognized fine but sending "Cisco-NAS-Port" it's not recognized. (Not seen) Of course I have installed dictionaries Cisco and Quintum all from default release of Daloradius. Thank you Nelson -- Nelson Naranjo ____________ PLOTCOM Colombia

3 2

Unstable freeRADIUS (authorization) work
by Манцуров Дмитрий Вячеславович 03 Jun '16

03 Jun '16

I have freeRADIUS version 2.2.5 installed on Debian GNU/Linux 8.4 (Jessie). freeRADIUS use with telephone station. Now testing with two users. Their User-Names 682808 and 686038. When I run freeRADIUS as daemon, it works about one hour (sometimes less). Then I get for one of users: "Auth: [preprocess] No huntgroup access..." (log below). And another user can continue to work When I run FreeRADIUS in debug mode (freeradius -X), it can work for three days, I did not check longer. Detailed log, when user was authorize: Fri Jun 3 14:57:46 2016 : Info: expand: %{debug:3} -> 0 Fri Jun 3 14:57:46 2016 : Info: +++} # update control = noop Fri Jun 3 14:57:46 2016 : Info: ++} # if ("%{User-Name}" == "682808") = noop Fri Jun 3 14:57:46 2016 : Info: modsingle[authorize]: calling preprocess (rlm_preprocess) for request 1434 Fri Jun 3 14:57:46 2016 : Info: modsingle[authorize]: returned from preprocess (rlm_preprocess) for request 1434 Fri Jun 3 14:57:46 2016 : Info: ++[preprocess] = ok Fri Jun 3 14:57:46 2016 : Info: modsingle[authorize]: calling auth_log (rlm_detail) for request 1434 Fri Jun 3 14:57:46 2016 : Info: [auth_log] expand: %{Packet-Src-IP-Address} -> 10.10.10.200 Fri Jun 3 14:57:46 2016 : Info: [auth_log] expand: /var/log/freeradius/radacct/%{%{Packet-Src-IP-Address}:-%{Packet-Src-IPv6-Address}}/auth-detail-%Y%m%d -> /var/log/freeradius/radacc$ Fri Jun 3 14:57:46 2016 : Info: [auth_log] /var/log/freeradius/radacct/%{%{Packet-Src-IP-Address}:-%{Packet-Src-IPv6-Address}}/auth-detail-%Y%m%d expands to /var/log/freeradius/radacct/10$ Fri Jun 3 14:57:46 2016 : Info: [auth_log] expand: %t -> Fri Jun 3 14:57:46 2016 Fri Jun 3 14:57:46 2016 : Info: modsingle[authorize]: returned from auth_log (rlm_detail) for request 1434 Fri Jun 3 14:57:46 2016 : Info: ++[auth_log] = ok Fri Jun 3 14:57:46 2016 : Info: modsingle[authorize]: calling files (rlm_files) for request 1434 Fri Jun 3 14:57:46 2016 : Info: [files] users: Matched entry DEFAULT at line 62 Fri Jun 3 14:57:46 2016 : Info: [files] users: Matched entry DEFAULT at line 65 Fri Jun 3 14:57:46 2016 : Info: modsingle[authorize]: returned from files (rlm_files) for request 1434 Fri Jun 3 14:57:46 2016 : Info: ++[files] = ok Fri Jun 3 14:57:46 2016 : Info: modsingle[authorize]: calling monthlycounter (rlm_counter) for request 1434 Fri Jun 3 14:57:46 2016 : Info: modsingle[authorize]: returned from monthlycounter (rlm_counter) for request 1434 Fri Jun 3 14:57:46 2016 : Info: ++[monthlycounter] = ok Fri Jun 3 14:57:46 2016 : Info: modsingle[authorize]: calling expiration (rlm_expiration) for request 1434 Fri Jun 3 14:57:46 2016 : Info: modsingle[authorize]: returned from expiration (rlm_expiration) for request 1434 Fri Jun 3 14:57:46 2016 : Info: ++[expiration] = noop Fri Jun 3 14:57:46 2016 : Info: modsingle[authorize]: calling logintime (rlm_logintime) for request 1434 Fri Jun 3 14:57:46 2016 : Info: modsingle[authorize]: returned from logintime (rlm_logintime) for request 1434 Fri Jun 3 14:57:46 2016 : Info: ++[logintime] = noop Fri Jun 3 14:57:46 2016 : Info: +} # group authorize = ok Fri Jun 3 14:57:46 2016 : Info: Found Auth-Type = Accept Fri Jun 3 14:57:46 2016 : Info: Auth-Type = Accept, accepting the user Fri Jun 3 14:57:46 2016 : Auth: Login OK: [682808/<via Auth-Type = Accept>] (from client localhost port 0 cli 682808) Fri Jun 3 14:57:46 2016 : Info: WARNING: Empty post-auth section. Using default return values. Fri Jun 3 14:57:46 2016 : Info: Sending Access-Accept packet to host 10.10.10.200 port 49777, id=15, length=0 Fri Jun 3 14:57:46 2016 : Info: Auth-Type := Reject Fri Jun 3 14:57:46 2016 : Info: h323-credit-time = "h323-credit-time=900" Fri Jun 3 14:57:46 2016 : Info: Session-Timeout = 5977 Fri Jun 3 14:57:46 2016 : Info: Finished request 1434. Fri Jun 3 14:57:48 2016 : Info: Cleaning up request 1434 ID 15 with timestamp +2483 Not authorize: Fri Jun 3 15:18:27 2016 : Info: expand: %{debug:3} -> 0 Fri Jun 3 15:18:27 2016 : Info: +++} # update control = noop Fri Jun 3 15:18:27 2016 : Info: ++} # if ("%{User-Name}" == "682808") = noop Fri Jun 3 15:18:27 2016 : Info: modsingle[authorize]: calling preprocess (rlm_preprocess) for request 2273 Fri Jun 3 15:18:27 2016 : Auth: [preprocess] No huntgroup access: [682808] (from client localhost port 0 cli 682808) Fri Jun 3 15:18:27 2016 : Info: modsingle[authorize]: returned from preprocess (rlm_preprocess) for request 2273 Fri Jun 3 15:18:27 2016 : Info: ++[preprocess] = reject Fri Jun 3 15:18:27 2016 : Info: +} # group authorize = reject Fri Jun 3 15:18:27 2016 : Auth: Invalid user: [682808/<no User-Password attribute>] (from client localhost port 0 cli 682808) Fri Jun 3 15:18:27 2016 : Info: Using Post-Auth-Type REJECT Fri Jun 3 15:18:27 2016 : Info: WARNING: Unknown value specified for Post-Auth-Type. Cannot perform requested action. Fri Jun 3 15:18:27 2016 : Info: Delaying reject of request 2273 for 1 seconds Fri Jun 3 15:18:28 2016 : Info: Sending delayed reject for request 2273 Fri Jun 3 15:18:28 2016 : Info: Sending Access-Reject packet to host 10.10.10.200 port 46827, id=42, length=0 Fri Jun 3 15:18:30 2016 : Info: Cleaning up request 2273 ID 42 with timestamp +3724 I would be grateful for any ideas.

2 1

Classic double radius, how to configure accounting
by Fabrizio Fiore Donati 02 Jun '16

02 Jun '16

Hi, i need to configure a classic setup, with some cisco router that do AAA versus two radius server. The radius database is on a mysql cluster. How i must configure the two radius for accounting ? They can have a simple configuration or i need to do something other ? Each router have two radius configured. Thanks

2 3

Multiple access-request + access-accept packets in one conversation.
by Vlad Kratsberg 02 Jun '16

02 Jun '16

Hi Freeradius Users, I will appreciate some help here. We are running FR3.0.11 + ldap + 802.1x peap + gtc. When client tries to get on the network for the first time, everything is good. Server issues cert, client accepts, vlan id is attached to access-accept packet, and client gets an ip. The whole exchange is fast and only consists of 8 request packets. http://pastebin.com/P35eNW4C However , when client tries to re-authenticate -- communication between client and a server grows to 100 + request packets while server responds with multiple access-accept packets and none of them contain Tunnel-Id ( not cached ?) http://pastebin.com/y1HGF4PP When i disable cache subsection of eap module, and client tries to re-authenticate, i also get a very long conversation (100+ requests ) involving multiple access-request and access-accept messages, however access-accept messages return with Tunnel-id attribute. Can someone point me in the right direction as to why communication is so long and involves multiple access-accept packets when client tries to re-authenticate and what needs to be done with cache so it works properly and caches Tunnel-Id. Thanks

2 7

radacct.pl
by Alex Moen 01 Jun '16

01 Jun '16

Until just last month, we were using FreeRADIUS circa 2007? 2008? IDK for sure, because that server has been put out to pasture. Anyway, in the good old days, we were able to parse the accounting logs using a perl script named radacct.pl. We use this to determine dialup usage overage (yes, we still have some users that want to use dialup, even though it's as expensive as a DSL connection. Don't ask me... I just work here.) However, with our NEW and IMPROVED FreeRADIUS 3.0.4, and with the new versions of Perl, radacct.pl no longer works. I guess I can't blame it, the last time it was updated was, like, 1998. So, what is the modern way to parse the logs and get the usage information? Thanks!! -- Alex Moen NSTII North Dakota Telephone Company 701-662-6481

2 1

Thought 3.0.12 was coming out on the 31st
by Alex Sharaz 01 Jun '16

01 Jun '16

A

2 2