July 2016 - Freeradius-Users - lists.freeradius.org

freeradius service
by Janis Heller 24 Jul '16

24 Jul '16

I’m running a freshly freeradius server (built from source) version 3.0.12 on a ubuntu server. Is there a way to control radius server as a service, like for example ’service radiusd stop’? All the best; Janis

9 39

Slow request response for auth/acct
by Marco Marino 22 Jul '16

22 Jul '16

Actually I'm using freeradius 2.1.10 and mysql 5.5.38 with 50K users and 40K accounting rows (they are purged each month). When I try an authentication request, it seems too slow: time echo "User-Name = user1,Password = xxxx" | radclient -x a.b.c.d:1812 auth testing123 Sending Access-Request of id 122 to 50.0.1.4 port 1812 User-Name = "3337822263" Password = "o24nu" rad_recv: Access-Accept packet from host a.b.c.d port 1812, id=122, length=26 Idle-Timeout = 600 real 0m0.870s user 0m0.012s sys 0m0.007s I have only 3 clients and in radius.log I see a lot of Fri Jul 15 10:01:19 2016 : Error: Discarding duplicate request from client owdata4 port 50368 - ID: 209 due to unfinished request 309 My clients are connected on the same lan of the freeradius server and I added indexes on table in mysql. Is there a way to speeding up my freeradius installation? Please let me know if I have to add more details. Thank you

4 7

Log File permissions
by Marc Beaumont 22 Jul '16

22 Jul '16

Despite setting permissions = 0770 in for the various log files in the mods-available files, the log files are still created with 644. Is this a known issue as it is really causing us issues with log analysis? I've had to do a hack to change perms on the files but I would rather not. Marc Beaumont Network Admin / Linux Specialist Comms365 Limited ______________________________________________________________________ Scanned by MailDefender Plus, powered by Symantec Email Security.cloud ______________________________________________________________________

2 3

radsniff with CSV output
by Adamczak Krzysztof 21 Jul '16

21 Jul '16

Hi guys, How to run radsniff in order to get csv output from stats? Currently I'm looking at source code (there is no info in help file or man). We have to turn on stats (e.g. -W 5) but when I add -E it just prints help. I'm sure I'm missing something as I'm not very comfortable with C - could you help? I tried: radsniff -x -E -W 5 thanks, Chris

3 5

dhcp and cache question
by Anton 21 Jul '16

21 Jul '16

Good day. I would like to cache queries in my dhcp configuration of freeradius and especially to cache sql queries. I have the next dhcp configuration section: dhcp DHCP-Discover { update reply { DHCP-Message-Type = DHCP-Offer } update reply { &DHCP-Domain-Name-Server[1] = 192.168.1.254 &DHCP-Domain-Name-Server[2] = 192.168.0.254 &DHCP-Subnet-Mask = 255.255.255.0 &DHCP-Renewal-Time = 86300 &DHCP-Rebinding-Time = 86330 &DHCP-IP-Address-Lease-Time = 86400 &DHCP-DHCP-Server-Identifier = 192.168.24.14 &DHCP-Relay-Circuit-Id := "%{request:DHCP-Relay-Circuit-Id}" &DHCP-Relay-Remote-Id := "%{request:DHCP-Relay-Remote-Id}" } mac2ip if ("%{request:DHCP-Relay-Circuit-Id}" =~ /0x....(....)..../i) { update control { &Pool-Name := "vlan-%{expr:0x%{1}}" } } dhcp_sqlippool if ("%{reply:DHCP-Your-IP-Address}" =~ /([0-9]{1,3}.[0-9]{1,3}.[0-9]{1,3}).[0-9]{1,3}/i) { update reply { &DHCP-Router-Address = "%{1}.1" } } if ("%{reply:DHCP-Your-IP-Address}" =~ /(10.[0-9]{1,3}.[0-9]{1,3}).[0-9]{1,3}/i) { update reply { &DHCP-Renewal-Time := 580 &DHCP-Rebinding-Time := 590 &DHCP-IP-Address-Lease-Time := 600 } } linelog ok } dhcp DHCP-Request section has the same configuration. Here is the static database(pool) mac2ip and dynamyc sql database(pool) sqlippool. ma2ip is checked first if we have match in mac2ip then we use it, else we use dynamic ip-address from sqlpool. It works. mac2ip works fast but sqlippool uses mysql and get some CPU load -- there are some crazy devices in the network which ask dhcp all the time and fast (misconfigured or brocken routers?). Mysql eats the CPU :-). How can I use rlm_cache module in this configuration to speed up and reduce CPU load ? I cannot understand how to use rlm_cache. Please explain me with examples on my configuration. -- Anton, инженер отдела управления сетью связи, ООО "ИКА" (Томика) 634050 г. Томск пр. Ленина 55, оф. 101 Тел: 701-855

2 3

freeradius and winbind stop to work
by Victor Hugo dos Santos 21 Jul '16

21 Jul '16

Hello, I have a problem with a freeradius + samba and ntlm authetication. the configuration work very well and without problems for a random period of time, but after 2, 4, 7 days, the freeradius stop to work and only work again if I restart the service (/etc/init.d/freeradius restart). in the same machine, I have a samba file server (connected to a domain) and winbindd service... both still working without problems. I have this packages installed ====================== dpkg -l | egrep '(winb|samba|freeradius)' ii freeradius 2.1.12+dfsg-1.2ubuntu8.1 amd64 high-performance and highly configurable RADIUS server ii freeradius-common 2.1.12+dfsg-1.2ubuntu8.1 all FreeRADIUS common files ii freeradius-utils 2.1.12+dfsg-1.2ubuntu8.1 amd64 FreeRADIUS client utilities ii libfreeradius2 2.1.12+dfsg-1.2ubuntu8.1 amd64 FreeRADIUS shared library ii libnss-winbind:amd64 2:4.3.9+dfsg-0ubuntu0.14.04.3 amd64 Samba nameservice integration plugins ii libwbclient0:amd64 2:4.3.9+dfsg-0ubuntu0.14.04.3 amd64 Samba winbind client library ii python-samba 2:4.3.9+dfsg-0ubuntu0.14.04.3 amd64 Python bindings for Samba ii samba 2:4.3.9+dfsg-0ubuntu0.14.04.3 amd64 SMB/CIFS file, print, and login server for Unix ii samba-common 2:4.3.9+dfsg-0ubuntu0.14.04.3 all common files used by both the Samba server and client ii samba-common-bin 2:4.3.9+dfsg-0ubuntu0.14.04.3 amd64 Samba common files used by both the server and the client ii samba-dsdb-modules 2:4.3.9+dfsg-0ubuntu0.14.04.3 amd64 Samba Directory Services Database ii samba-libs:amd64 2:4.3.9+dfsg-0ubuntu0.14.04.3 amd64 Samba core libraries ii samba-vfs-modules 2:4.3.9+dfsg-0ubuntu0.14.04.3 amd64 Samba Virtual FileSystem plugins ii winbind 2:4.3.9+dfsg-0ubuntu0.14.04.3 amd64 service to resolve user and group information from Windows NT servers ====================== on ====================== # cat /etc/lsb-release DISTRIB_ID=Ubuntu DISTRIB_RELEASE=14.04 DISTRIB_CODENAME=trusty DISTRIB_DESCRIPTION="Ubuntu 14.04.4 LTS" ====================== and in log file I found this (why the logs dont have the time for default ??) =================================== # Executing group from file /etc/freeradius/sites-enabled/inner-tunnel +- entering group authenticate {...} [eap] Request found, released from the list [eap] EAP/mschapv2 [eap] processing type mschapv2 [mschapv2] # Executing group from file /etc/freeradius/sites-enabled/inner-tunnel [mschapv2] +- entering group MS-CHAP {...} [mschap] No Cleartext-Password configured. Cannot create LM-Password. [mschap] No Cleartext-Password configured. Cannot create NT-Password. [mschap] Creating challenge hash with username: operador [mschap] Told to do MS-CHAPv2 for operador with NT-Password [mschap] FAILED: No NT/LM-Password. Cannot perform authentication. [mschap] FAILED: MS-CHAP2-Response is incorrect ++[mschap] returns reject [eap] Freeing handler ++[eap] returns reject Failed to authenticate the user. [peap] Tunneled authentication was rejected. [peap] FAILURE ++[eap] returns handled Finished request 788. Going to the next request Thread 4 waiting to be assigned a request Waking up in 0.9 seconds. Thread 5 got semaphore Thread 5 handling request 789, (158 handled so far) [<thread>] # Executing section authorize from file /etc/freeradius/sites-enabled/default [<thread>] +- entering group authorize {...} [<thread>] ++- entering policy filter_hostname {...} [<thread>] +++? if (User-Name =~ /^host/) [<thread>] ? Evaluating (User-Name =~ /^host/) -> FALSE [<thread>] +++? if (User-Name =~ /^host/) -> FALSE [<thread>] ++- policy filter_hostname returns notfound ++[preprocess] returns ok ++[chap] returns noop ++[mschap] returns noop ++[digest] returns noop [suffix] No '@' in User-Name = "operador", looking up realm NULL [suffix] No such realm "NULL" ++[suffix] returns noop [eap] EAP packet type response id 10 length 43 [eap] Continuing tunnel setup. ++[eap] returns ok Found Auth-Type = EAP # Executing group from file /etc/freeradius/sites-enabled/default +- entering group authenticate {...} [eap] Request found, released from the list [eap] EAP/peap [eap] processing type peap [peap] processing EAP-TLS [peap] eaptls_verify returned 7 [peap] Done initial handshake [peap] eaptls_process returned 7 [peap] EAPTLS_OK [peap] Session established. Decoding tunneled attributes. [peap] Peap state send tlv failure [peap] Received EAP-TLV response. [peap] The users session was previously rejected: returning reject (again.) [peap] *** This means you need to read the PREVIOUS messages in the debug output [peap] *** to find out the reason why the user was rejected. [peap] *** Look for "reject" or "fail". Those earlier messages will tell you. [peap] *** what went wrong, and how to fix the problem. [eap] Handler failed in EAP/peap [eap] Failed in EAP select ++[eap] returns invalid Failed to authenticate the user. Using Post-Auth-Type Reject # Executing group from file /etc/freeradius/sites-enabled/default +- entering group REJECT {...} [attr_filter.access_reject] expand: %{User-Name} -> operador attr_filter: Matched entry DEFAULT at line 11 ++[attr_filter.access_reject] returns updated Delaying reject of request 789 for 1 seconds Going to the next request Thread 5 waiting to be assigned a request Waking up in 0.9 seconds. Waiting to send Access-Reject to client red-gasco port 36995 - ID: 19 Sending delayed reject for request 789 Waking up in 3.9 seconds. =================================== any help or idea ? thanks and attentive -- -- Victor Hugo dos Santos http://www.vhsantos.net Linux Counter #224399

2 1

Accounting additional attributes
by Uwe Freier 21 Jul '16

21 Jul '16

Hello again, for any reason the attributes ADSL-Agent-Circuit-Id und ADSL-Agent-Remote-Id shall be accounted. My NAS sends them with each packet to the radius but there are no columns for them in the table radacct. So in my infinite naivity I simply would add this columns to table radacct and modify the SQL query "accounting_start_query" from /sql/mysql/dialup.conf so that these values are written each time an accounting starts (sure they must be only accounted once per session). Is this a legitime way or is it dangerous to modify the structure of the table radacct for any reason and there is a better way to account additional attributes? Many thanks in advance! Uwe Freier

2 1

Version 3.0.11 Compile Errors
by Wussler, Doug 21 Jul '16

21 Jul '16

I have downloaded the 3.0.11 tarball from freeradius.org and confirmed that I have all "BuildRequires" libraries. My platform is RHEL 7.2. "config.log" looks good but when I run "make" these options result in the following errors: "--with-dhcp=no" CC src/modules/proto_dhcp/dhcpclient.c /usr/lib/gcc/x86_64-redhat-linux/4.8.5/../../../../lib64/crt1.o: In function `_start': (.text+0x20): undefined reference to `main' collect2: error: ld returned 1 exit status make: *** [build/bin/local/dhcpclient] Error 1 "--with-tcp=no" CC src/main/client.c src/main/client.c: In function `client_afrom_cs': src/main/client.c:964:6: error: `hs_proto' undeclared (first use in this function) if (hs_proto) { ^ src/main/client.c:964:6: note: each undeclared identifier is reported only once for each function it appears in make: *** [build/objs/src/main/client.lo] Error 1 "--with-ascend-binary=no" CC src/lib/value.c src/lib/value.c: In function `value_data_from_str': src/lib/value.c:654:4: error: label `do_octets' used but not defined goto do_octets; ^ make: *** [build/objs/src/lib/value.lo] Error 1 I would prefer to eliminate unneeded options from the binary. The "--with-vmps=no" option works just fine. Have I done something wrong? Is there anything I can edit to resolve these problems? Doug Wussler Florida State University

4 4

Start up FreeRADIUS without all ldap servers present
by Jonathan Gazeley 21 Jul '16

21 Jul '16

I've configured my FreeRADIUS to use a virtual module 'uobldap' which is a redundant-load-balance set of 3 individual ldap servers. This works reasonably well, with one exception: if you try and start radiusd when one or more of the ldap servers is unavailable, the daemon hangs continuously retrying the connector. Is there a way to make FreeRADIUS start up with a degraded set of ldap connectors? Thanks, Jonathan -- Jonathan Gazeley Senior Systems Administrator IT Services University of Bristol

3 3

more limit for user
by تعلم البرمجة 20 Jul '16

20 Jul '16

hello and alsalamo alikom i have array in db array ( 0 { start-Timestamp = 05:30 end-Timestamp = 07:30 Mikrotik-Rate-Limit = 256k/512k } 1 { start-Timestamp = 07:30 end-Timestamp = 09:30 Mikrotik-Rate-Limit = 512k/1024k } ) I want Change Mikrotik-Rate-Limit When Equal any thing of this Values By COA If Freeradius Dosent support Array How I can Do This ? Best Regards

3 3