February 2017 - Freeradius-Users - lists.freeradius.org

Active Directory and Calling-Station-Id
by Ethariel 13 Jun '17

13 Jun '17

Hello, I'm running Freeradius : freeradius: FreeRADIUS Version 2.2.8, for host x86_64-pc-linux-gnu, built on Apr 5 2016 at 13:40:43 I've configurated Active Directory integration, and it's working fine for authentication. Local users in users file are also ok. In the local users file I can specify a calling station id like : customer Cleartext-Password := "password",Calling-Station-Id == "AA-AA-AA-AA-AA-AA" How can I use a local file (or sql table) to link a user authenticated in Active Directory with one or several calling-station-id ? If possible I'd really prefer not to use the ActiveDirectory to store the Mac addresses. The goal is to limit each login to a few devices (I know it's possible to mask mac address, this is not the point here). I've tried to insert in the users file : customer2 Calling-Station-Id := "BB-BB-BB-BB-BB-BB" but with correct password customer2 is always authenticated using the BB-....-BB mac adress or not. Thks a lot for any help, Ethariel

2 4

linelog best practice
by cedric delaunay 17 May '17

17 May '17

Hello all, I'm trying to log accounting and requests into our elasticsearch/graylog logserver. I use home made linelog modules to rewrite logs into json format. modules are called in authorize, accounting, post-auth, Post-Auth-Type REJECT, preproxy and post-proxy sections here is an exemple of my module : linelog linelog_postauth { format = "%t linelog_postauth \%Packet-Type non reconnu for %{User-Name} (%{Packet-Type})" filename = ${logdir}/linelog_json permissions = 0600 reference = "messages.%{%{reply:Packet-Type}:-format}" messages { Access-Reject = "{\"Datetime\":\"%t\",\"Module_Name\":\"linelog_postauth\",\"Packet-Type\":\"%{reply:Packet-Type}\",\"User-Name\":\"%{User-Name}\",\"Realm\":\"%{Realm}\",\"NAS-IP-Address\":\"%{NAS-IP-Address}\",\"NAS-Port\":\"%{NAS-Port}\",\"Service-Type\":\"%{Service-Type}\",\"Framed-MTU\":\"%{Framed-MTU}\",\"State\":\"%{State}\",\"Class\":\"%{Class}\",\"Vendor-Specific\":\"%{Vendor-Specific}\",\"Session-Timeout\":\"%{Session-Timeout}\",\"Idle-Timeout\":\"%{Idle-Timeout}\",\"Termination-Action\":\"%{Termination-Action}\",\"Called-Station-Id\":\"%{Called-Station-Id}\",\"Calling-Station-Id\":\"%{Calling-Station-Id}\",\"NAS-Identifier\":\"%{NAS-Identifier}\",\"Proxy-State\":\"%{Proxy-State}\",\"Login-LAT-Service\":\"%{Login-LAT-Service}\",\"Login-LAT-Node\":\"%{Login-LAT-Node}\",\"Login-LAT-Group\":\"%{Login-LAT-Group}\",\"Framed-AppleTalk-Link\":\"%{Framed-AppleTalk-Link}\",\"Framed-AppleTalk-Network\":\"%{Framed-AppleTalk-Network}\",\"Framed-AppleTalk-Zone\":\"%{Framed-AppleTalk-Zone}\",\"CHAP-Challenge\":\"%{CHAP-Challenge}\",\"NAS-Port-Type\":\"%{NAS-Port-Type}\",\"Port-Limit\":\"%{Port-Limit}\",\"Login-LAT-Port\":\"%{Login-LAT-Port}\"}" Access-Challenge = "{\"Datetime\":\"%t\",\"Module_Name\":\"linelog_postauth\",\"Packet-Type\":\"%{reply:Packet-Type}\",\"User-Name\":\"%{User-Name}\",\"Realm\":\"%{Realm}\",\"NAS-IP-Address\":\"%{NAS-IP-Address}\",\"NAS-Port\":\"%{NAS-Port}\",\"Service-Type\":\"%{Service-Type}\",\"Framed-Protocol\":\"%{Framed-Protocol}\",\"Framed-IP-Address\":\"%{Framed-IP-Address}\",\"Framed-IP-Netmask\":\"%{Framed-IP-Netmask}\",\"Framed-Routing\":\"%{Framed-Routing}\",\"Filter-Id\":\"%{Filter-Id}\",\"Framed-MTU\":\"%{Framed-MTU}\",\"Framed-Compression\":\"%{Framed-Compression}\",\"Login-IP-Host\":\"%{Login-IP-Host}\",\"Login-Service\":\"%{Login-Service}\",\"Login-TCP-Port\":\"%{Login-TCP-Port}\",\"Reply-Message\":\"%{Reply-Message}\",\"Callback-Number\":\"%{Callback-Number}\",\"Callback-Id\":\"%{Callback-Id}\",\"Framed-Route\":\"%{Framed-Route}\",\"Framed-IPX-Network\":\"%{Framed-IPX-Network}\",\"State\":\"%{State}\",\"Class\":\"%{Class}\",\"Vendor-Specific\":\"%{Vendor-Specific}\",\"Session-Timeout\":\"%{Session-Timeout}\",\"Idle-Timeout\":\"%{Idle-Timeout}\",\"Termination-Action\":\"%{Termination-Action}\",\"Called-Station-Id\":\"%{Called-Station-Id}\",\"Calling-Station-Id\":\"%{Calling-Station-Id}\",\"NAS-Identifier\":\"%{NAS-Identifier}\",\"Proxy-State\":\"%{Proxy-State}\",\"Login-LAT-Service\":\"%{Login-LAT-Service}\",\"Login-LAT-Node\":\"%{Login-LAT-Node}\",\"Login-LAT-Group\":\"%{Login-LAT-Group}\",\"Framed-AppleTalk-Link\":\"%{Framed-AppleTalk-Link}\",\"Framed-AppleTalk-Network\":\"%{Framed-AppleTalk-Network}\",\"Framed-AppleTalk-Zone\":\"%{Framed-AppleTalk-Zone}\",\"CHAP-Challenge\":\"%{CHAP-Challenge}\",\"NAS-Port-Type\":\"%{NAS-Port-Type}\",\"Port-Limit\":\"%{Port-Limit}\",\"Login-LAT-Port\":\"%{Login-LAT-Port}\"}" Access-Accept = "{\"Datetime\":\"%t\",\"Module_Name\":\"linelog_postauth\",\"Packet-Type\":\"%{reply:Packet-Type}\",\"User-Name\":\"%{User-Name}\",\"Realm\":\"%{Realm}\",\"NAS-IP-Address\":\"%{NAS-IP-Address}\",\"NAS-Port\":\"%{NAS-Port}\",\"Service-Type\":\"%{Service-Type}\",\"Framed-MTU\":\"%{Framed-MTU}\",\"Login-IP-Host\":\"%{Login-IP-Host}\",\"Login-Service\":\"%{Login-Service}\",\"Login-TCP-Port\":\"%{Login-TCP-Port}\",\"Reply-Message\":\"%{Reply-Message}\",\"Callback-Number\":\"%{Callback-Number}\",\"Callback-Id\":\"%{Callback-Id}\",\"Framed-Route\":\"%{Framed-Route}\",\"Framed-IPX-Network\":\"%{Framed-IPX-Network}\",\"State\":\"%{State}\",\"Class\":\"%{Class}\",\"Vendor-Specific\":\"%{Vendor-Specific}\",\"Session-Timeout\":\"%{Session-Timeout}\",\"Idle-Timeout\":\"%{Idle-Timeout}\",\"Termination-Action\":\"%{Termination-Action}\",\"Called-Station-Id\":\"%{Called-Station-Id}\",\"Calling-Station-Id\":\"%{Calling-Station-Id}\",\"NAS-Identifier\":\"%{NAS-Identifier}\",\"Proxy-State\":\"%{Proxy-State}\",\"Login-LAT-Service\":\"%{Login-LAT-Service}\",\"Login-LAT-Node\":\"%{Login-LAT-Node}\",\"Login-LAT-Group\":\"%{Login-LAT-Group}\",\"Framed-AppleTalk-Link\":\"%{Framed-AppleTalk-Link}\",\"Framed-AppleTalk-Network\":\"%{Framed-AppleTalk-Network}\",\"Framed-AppleTalk-Zone\":\"%{Framed-AppleTalk-Zone}\",\"CHAP-Challenge\":\"%{CHAP-Challenge}\",\"NAS-Port-Type\":\"%{NAS-Port-Type}\",\"Port-Limit\":\"%{Port-Limit}\",\"Login-LAT-Port\":\"%{Login-LAT-Port}\",\"VLAN\":\"%{Tunnel-Private-Group-ID:0}\"}" } } the goal is to keep info about login attempts and failure and why. when we run radius in debug mode we can see failure reason as next example : ..... (17) authenticate { (17) eap : Expiring EAP session with state 0x2ee654852ee14efb (17) eap : Finished EAP session with state 0x2ee654852ee14efb (17) eap : Previous EAP request found for state 0x2ee654852ee14efb, released from the list (17) eap : Peer sent method MSCHAPv2 (26) (17) eap : EAP MSCHAPv2 (26) (17) eap : Calling eap_mschapv2 to process EAP data (17) eap_mschapv2 : # Executing group from file /etc/raddb//sites-enabled/eduroam-inner-tunnel (17) eap_mschapv2 : Auth-Type MS-CHAP { (17) mschap : Found LM-Password (17) WARNING: mschap : No Cleartext-Password configured. Cannot create LM-Password (17) mschap : Found NT-Password (17) WARNING: mschap : No Cleartext-Password configured. Cannot create NT-Password (17) mschap : Creating challenge hash with username: cdelauna(a)univ-rennes1.fr (17) mschap : Client is using MS-CHAPv2 (17) ERROR: mschap : MS-CHAP2-Response is incorrect (17) [mschap] = reject (17) } # Auth-Type MS-CHAP = reject (17) eap : Freeing handler (17) [eap] = reject (17) } # authenticate = reject ..... I can't find reject reason (mscahp result, ...) in access-reject variables. I had a look into mailist's archives without success ;( Do anybody can help me to find the best way doing this ? Thanks a lot -- Cédric Delaunay Direction des Systèmes d'Informations Equipe Réseau & Telephonie 263, Avenue du Général Leclerc Tel: 02 23 23 71 59 CS 74205 - 35042 Rennes Cedex Pour toute demande utiliser l'aide et assistance via l'ENT à l'adresse http://ent.univ-rennes1.fr

7 19

Help for buy a real Cert (not self-signed)
by Spider s 04 May '17

04 May '17

Hello, I have got a few questions about radius and buy an original Certificate. Firsts thank you for the help here, but I can’t find an option for search on all post, is this possible ?? only find this: For example only can find post from this mount http://lists.freeradius.org/pipermail/freeradius-users/2017-January/thread.… Is for don’t disturb with my questions is are answered, sorry. And now my questions, first I have got running my freeradius installation 3.10 on ubuntu) with AD Auth, but with limitations, because I need install my self-signed cert on all device for connect to wifi. I don’t want this (I don’t want install the certs), and I need buy a real cert for a real CA, I know ,but I never buy one for this. (I never buy a certfor radius, web or similar) I need buy a real cert, where I can buy ?? recommendations webs?? And witch type ?? I see a lot of certs, and I don’t know the certification specification.( a lot of prices and options) Please a direct links if possible to correct cert. I never buy an original cert and I don’t know process. When I receive the certificates is like certs on the folder?? Need change data??? How can use this certs on my radius install?? Are 3, 5, 20 files ???? where i can find info about this ?? (On docs i reffer) Need a domain for this ?? can i use the cert from a Web (typical ssl cert that is used for web?? I see a lot of info on internet for use self-signed cert, but I can’t find info on documentations or on my Ubuntu install when use real certs. (Is very possible I don’t find) Thank you for your time when you read me, and sorry if a newbie questions. Thank you in advanced, i dont want confuse with this and spend money with this.

6 15

freeradius with sqlite3 solving database lock issue
by Antonio Silva 10 Apr '17

10 Apr '17

Hi, What are the best options to configure sqlite3 sql with freeradius? i'm having some lock errors followed by "ERROR: Hit reconnection limit" I tried to set the pool to only 1 server, since its a file db, but them i got the error "max connections2 when connecting two users at the same time. Right now i use: .... thread pool { start_servers = 5 max_servers = 25 min_spare_servers = 3 max_spare_servers = 10 max_requests_per_server = 1024 auto_limit_acct = yes } sql { driver = "rlm_sql_sqlite" sqlite { filename = "radius.db" busy_timeout = 200 } dialect = "sqlite" delete_stale_sessions = yes pool { start = ${thread[pool].start_servers} min = ${thread[pool].min_spare_servers} max = ${thread[pool].max_servers} spare = ${thread[pool].max_spare_servers} uses = 0 retry_delay = 30 lifetime = 0 idle_timeout = 60 } ... The errors are: Feb 12 17:41:08 PC radiusd[18187]: (2038) Login OK: [402(a)cm.com/<CHAP-Password>] (from client nas01 port 17 cli 30-10-E4-66-1A-CF) Feb 12 17:41:58 PC radiusd[18187]: (2042) ERROR: Error fetching row Feb 12 17:41:58 PC radiusd[18187]: (2042) ERROR: rlm_sql_sqlite: database is locked Feb 12 17:41:58 PC radiusd[18187]: (2042) ERROR: SQL query failed: server error Feb 12 17:41:58 PC radiusd[18187]: (2041) Login OK: [402(a)cm.com/<CHAP-Password>] (from client nas01 port 14 cli F4-37-B7-E0-66-DF) Feb 12 17:41:59 PC radiusd[18187]: (2042) sql: ERROR: Error fetching row Feb 12 17:41:59 PC radiusd[18187]: (2042) sql: ERROR: rlm_sql_sqlite: database is locked ... Feb 12 17:56:39 PC radiusd[18187]: (2125) sql: ERROR: Hit reconnection limit You can check the entire log in http://pastebin.com/fXuZVU93 Thanks, -- Saludos / Regards / Cumprimentos, António silva

2 9

rlm_perl returning attributes
by Ryan De Kock 30 Mar '17

30 Mar '17

Hi. I'm trying to return an attribute using the rlm_rest module. Authentication works fine but when a response is sent, an Access-Reject is generated. I'm hoping someone can point me in the right direction. *Working auth *(with no attributes in the response) (8) Cleaning up request packet ID 178 with timestamp +606 Ready to process requests (9) Received Access-Request Id 17 from 127.0.0.1:45433 to 127.0.0.1:1812 length 77 (9) User-Name = "585c208457bf8c3820c9e431(a)test.com" (9) User-Password = "password" (9) # Executing section authorize from file /usr/local/etc/raddb/sites-enabled/default (9) authorize { rlm_rest (rest): Reserved connection (16) (9) rest: Expanding URI components (9) rest: EXPAND http://127.0.0.1:1337 (9) rest: --> http://127.0.0.1:1337 (9) rest: EXPAND /Radius/auth?username=%{User-Name}&password=%{User-Password} (9) rest: --> /Radius/auth?username=585c208457bf8c3820c9e431%40test.com &password=password (9) rest: Sending HTTP GET to " http://127.0.0.1:1337/Radius/auth?username=585c208457bf8c3820c9e431%40test.… " (9) rest: Processing response header (9) rest: Status : 201 (Created) (9) rest: Type : json (application/json) rlm_rest (rest): Released connection (16) rlm_rest (rest): Need 1 more connections to reach 10 spares rlm_rest (rest): Opening additional connection (17), 1 of 30 pending slots used rlm_rest (rest): Connecting to "http://127.0.0.1:1337" (9) [rest] = ok (9) if (ok || updated) { (9) if (ok || updated) -> TRUE (9) if (ok || updated) { (9) update control { (9) Auth-Type := Rest (9) } # update control = noop (9) } # if (ok || updated) = noop (9) policy filter_username { (9) if (&User-Name) { (9) if (&User-Name) -> TRUE (9) if (&User-Name) { (9) if (&User-Name =~ / /) { (9) if (&User-Name =~ / /) -> FALSE (9) if (&User-Name =~ /@[^@]*@/ ) { (9) if (&User-Name =~ /@[^@]*@/ ) -> FALSE (9) if (&User-Name =~ /\.\./ ) { (9) if (&User-Name =~ /\.\./ ) -> FALSE (9) if ((&User-Name =~ /@/) && (&User-Name !~ /(a)(.+)\.(.+)$/)) { (9) if ((&User-Name =~ /@/) && (&User-Name !~ /(a)(.+)\.(.+)$/)) -> FALSE (9) if (&User-Name =~ /\.$/) { (9) if (&User-Name =~ /\.$/) -> FALSE (9) if (&User-Name =~ /(a)\./) { (9) if (&User-Name =~ /(a)\./) -> FALSE (9) } # if (&User-Name) = ok (9) } # policy filter_username = ok (9) [preprocess] = ok (9) [chap] = noop (9) [mschap] = noop (9) [digest] = noop (9) suffix: Checking for suffix after "@" (9) suffix: Looking up realm "test.com" for User-Name = " 585c208457bf8c3820c9e431(a)test.com" (9) suffix: No such realm "test.com" (9) [suffix] = noop (9) eap: No EAP-Message, not doing EAP (9) [eap] = noop (9) [files] = noop (9) [expiration] = noop (9) [logintime] = noop (9) pap: WARNING: No "known good" password found for the user. Not setting Auth-Type (9) pap: WARNING: Authentication will fail unless a "known good" password is available (9) [pap] = noop (9) } # authorize = ok (9) Found Auth-Type = Rest (9) # Executing group from file /usr/local/etc/raddb/sites-enabled/default (9) Auth-Type Rest { rlm_rest (rest): Reserved connection (15) (9) rest: Expanding URI components (9) rest: EXPAND http://127.0.0.1:1337 (9) rest: --> http://127.0.0.1:1337 (9) rest: EXPAND /Radius/auth?username=%{User-Name}&password=%{User-Password} (9) rest: --> /Radius/auth?username=585c208457bf8c3820c9e431%40test.com &password=password (9) rest: Sending HTTP GET to " http://127.0.0.1:1337/Radius/auth?username=585c208457bf8c3820c9e431%40test.… " (9) rest: Processing response header (9) rest: Status : 201 (Created) (9) rest: Type : json (application/json) rlm_rest (rest): Released connection (15) (9) [rest] = ok (9) } # Auth-Type Rest = ok (9) # Executing section post-auth from file /usr/local/etc/raddb/sites-enabled/default (9) post-auth { (9) update { (9) No attributes updated (9) } # update = noop (9) [exec] = noop (9) policy remove_reply_message_if_eap { (9) if (&reply:EAP-Message && &reply:Reply-Message) { (9) if (&reply:EAP-Message && &reply:Reply-Message) -> FALSE (9) else { (9) [noop] = noop (9) } # else = noop (9) } # policy remove_reply_message_if_eap = noop (9) } # post-auth = noop (9) Sent Access-Accept Id 17 from 127.0.0.1:1812 to 127.0.0.1:45433 length 0 (9) Finished request Waking up in 4.9 seconds. *exactly the same auth*, except I try return some values (8) Received Access-Request Id 178 from 127.0.0.1:41930 to 127.0.0.1:1812 length 77 (8) User-Name = "585c208457bf8c3820c9e431(a)test.com" (8) User-Password = "password" (8) # Executing section authorize from file /usr/local/etc/raddb/sites-enabled/default (8) authorize { rlm_rest (rest): Closing connection (13): Hit idle_timeout, was idle for 239 seconds rlm_rest (rest): You probably need to lower "min" rlm_rest (rest): Closing connection (14): Hit idle_timeout, was idle for 239 seconds rlm_rest (rest): You probably need to lower "min" rlm_rest (rest): Closing connection (12): Hit idle_timeout, was idle for 239 seconds rlm_rest (rest): You probably need to lower "min" rlm_rest (rest): 0 of 0 connections in use. You may need to increase "spare" rlm_rest (rest): Opening additional connection (15), 1 of 32 pending slots used rlm_rest (rest): Connecting to "http://127.0.0.1:1337" rlm_rest (rest): Reserved connection (15) (8) rest: Expanding URI components (8) rest: EXPAND http://127.0.0.1:1337 (8) rest: --> http://127.0.0.1:1337 (8) rest: EXPAND /Radius/auth?username=%{User-Name}&password=%{User-Password} (8) rest: --> /Radius/auth?username=585c208457bf8c3820c9e431%40test.com &password=password (8) rest: Sending HTTP GET to " http://127.0.0.1:1337/Radius/auth?username=585c208457bf8c3820c9e431%40test.… " (8) rest: Processing response header (8) rest: Status : 201 (Created) (8) rest: Type : json (application/json) (8) rest: Parsing attribute "Mikrotik-Address-List" (8) rest: EXPAND myList (8) rest: --> myList (8) rest: Mikrotik-Address-List := "myList" rlm_rest (rest): Released connection (15) rlm_rest (rest): Need 2 more connections to reach 10 spares rlm_rest (rest): Opening additional connection (16), 1 of 31 pending slots used rlm_rest (rest): Connecting to "http://127.0.0.1:1337" (8) [rest] = updated (8) if (ok || updated) { (8) if (ok || updated) -> TRUE (8) if (ok || updated) { (8) update control { (8) Auth-Type := Rest (8) } # update control = noop (8) } # if (ok || updated) = noop (8) policy filter_username { (8) if (&User-Name) { (8) if (&User-Name) -> TRUE (8) if (&User-Name) { (8) if (&User-Name =~ / /) { (8) if (&User-Name =~ / /) -> FALSE (8) if (&User-Name =~ /@[^@]*@/ ) { (8) if (&User-Name =~ /@[^@]*@/ ) -> FALSE (8) if (&User-Name =~ /\.\./ ) { (8) if (&User-Name =~ /\.\./ ) -> FALSE (8) if ((&User-Name =~ /@/) && (&User-Name !~ /(a)(.+)\.(.+)$/)) { (8) if ((&User-Name =~ /@/) && (&User-Name !~ /(a)(.+)\.(.+)$/)) -> FALSE (8) if (&User-Name =~ /\.$/) { (8) if (&User-Name =~ /\.$/) -> FALSE (8) if (&User-Name =~ /(a)\./) { (8) if (&User-Name =~ /(a)\./) -> FALSE (8) } # if (&User-Name) = updated (8) } # policy filter_username = updated (8) [preprocess] = ok (8) [chap] = noop (8) [mschap] = noop (8) [digest] = noop (8) suffix: Checking for suffix after "@" (8) suffix: Looking up realm "test.com" for User-Name = " 585c208457bf8c3820c9e431(a)test.com" (8) suffix: No such realm "test.com" (8) [suffix] = noop (8) eap: No EAP-Message, not doing EAP (8) [eap] = noop (8) [files] = noop (8) [expiration] = noop (8) [logintime] = noop (8) pap: WARNING: No "known good" password found for the user. Not setting Auth-Type (8) pap: WARNING: Authentication will fail unless a "known good" password is available (8) [pap] = noop (8) } # authorize = updated (8) Found Auth-Type = Rest (8) # Executing group from file /usr/local/etc/raddb/sites-enabled/default (8) Auth-Type Rest { rlm_rest (rest): Reserved connection (15) (8) rest: Expanding URI components (8) rest: EXPAND http://127.0.0.1:1337 (8) rest: --> http://127.0.0.1:1337 (8) rest: EXPAND /Radius/auth?username=%{User-Name}&password=%{User-Password} (8) rest: --> /Radius/auth?username=585c208457bf8c3820c9e431%40test.com &password=password (8) rest: Sending HTTP GET to " http://127.0.0.1:1337/Radius/auth?username=585c208457bf8c3820c9e431%40test.… " (8) rest: Processing response header (8) rest: Status : 201 (Created) (8) rest: Type : json (application/json) (8) rest: Parsing attribute "Mikrotik-Address-List" (8) rest: EXPAND myList (8) rest: --> myList (8) rest: Mikrotik-Address-List := "myList" rlm_rest (rest): Released connection (15) (8) [rest] = updated (8) } # Auth-Type Rest = updated (8) Failed to authenticate the user (8) Using Post-Auth-Type Reject (8) # Executing group from file /usr/local/etc/raddb/sites-enabled/default (8) Post-Auth-Type REJECT { (8) attr_filter.access_reject: EXPAND %{User-Name} (8) attr_filter.access_reject: --> 585c208457bf8c3820c9e431(a)test.com (8) attr_filter.access_reject: Matched entry DEFAULT at line 11 (8) [attr_filter.access_reject] = updated (8) [eap] = noop (8) policy remove_reply_message_if_eap { (8) if (&reply:EAP-Message && &reply:Reply-Message) { (8) if (&reply:EAP-Message && &reply:Reply-Message) -> FALSE (8) else { (8) [noop] = noop (8) } # else = noop (8) } # policy remove_reply_message_if_eap = noop (8) } # Post-Auth-Type REJECT = updated (8) Delaying response for 1.000000 seconds Waking up in 0.2 seconds. Waking up in 0.7 seconds. (8) Sending delayed response (8) Sent Access-Reject Id 178 from 127.0.0.1:1812 to 127.0.0.1:41930 length 20 Waking up in 3.9 seconds. It seems that because rest updated the user that it now fails for some reason (8) [rest] = updated (8) } # Auth-Type Rest = updated (8) Failed to authenticate the user What do I need to change to allow this process to go through? I would appreciate any light shedding.

2 3

3.0.4: binary LDAP attributes
by Nikolai Kondrashov 24 Mar '17

24 Mar '17

Hi everyone, Our (Red Hat) QA was testing the effect of this entry in 3.0.4 ChangeLog: * Modify pairparsevalue to deal with embedded NULLs better, and use the binary versions of attribute values in rlm_ldap. They have noticed that binary LDAP values get truncated on embedded zero characters (\0) in RADIUS replies, in radiusReplyMessage in particular. I.e. for radiusReplyMessage:: cmVwbHkgd2l0aCBhAGI= The response output by radtest was Reply-Message = 'reply with a' The network capture also showed that RADIUS reply packets contained truncated values. Is this intended, or was there a fix for this? In related discoveries, it seems that backslashes get removed from LDAP attribute values in RADIUS replies, so radiusReplyMessage: reply with a\0b becomes Reply-Message = 'reply with a0b' in radtest output. Is this intended? Thank you. Nick

4 12

user-group for rejected users
by Fabricio Viana 21 Mar '17

21 Mar '17

Hello! Let´s suppose the following situations: 1) User exists but the password is wrong 2) User does not exist In both cases the answer is REJECT. It happens that certain hardware is making endless attempts that eventually saturating the server. - It is possible to cause the server, instead of rejecting the users, accept the login but responds ACCEPT with "framed-pool = pool-block" ? or/and - Is there any way to put REJECT users in a given group by default? Thanks! Fabricio

3 3

Group membership by SSID
by Ethariel 07 Mar '17

07 Mar '17

Hello to all again, FreeRADIUS Version 2.2.8, for host x86_64-pc-linux-gnu, built on Apr 5 2016 at 13:40:43 I've got two SSID (Name_Lan and Name_Perso). Freeradius authentication using Active Directory (working fine, with and without require-membership-of) I wish to have a variable in modules/mschap linked to SSID. --require-membership-of=DOMAIN/Group1 for Name_Lan --require-membership-of=DOMAIN/Group2 for Name_Perso I don't find how to replace Group1 and Group2 with a variable (which variable ?). As I understand the unlang doc I cannot create new variables. I've also try to duplicate mschap module in mschap_perso and mschap_lan, then modify sites-available/default (and inner-tunnel) to add a test in authenticate section with : rewrite.called-station-id if (Called-Station-Id == "Name_Lan") { mschap_lan } but the is a syntax conf error when starting freeradius. TL;DR : how to test user group in AD based on SSID ? Thks a lot for any help/hint

3 7

Re: Accounting on 2 tables
by Ahmed Munir 02 Mar '17

02 Mar '17

Thanks. BTW, is there a way to distinguish instances in Radius server for accounting i.e. for asterisk use instance1 and opensips use instance2? Currently using NAS table for radius client setup. id nasname shortname type ports secret server community description 1 10.0.0.0/8 Company other 5060 hatuiks \N \N RADIUS Client 2 10.3.120.100 TestSIP04 other 5060 hatuiks04 \N \N RADIUS Client Please advise and share any supported document related to above case as I'm newbie in Freeradius. Date: Fri, 24 Feb 2017 09:54:53 -0500 > From: Alan DeKok <aland(a)deployingradius.com> > To: FreeRadius users mailing list > <freeradius-users(a)lists.freeradius.org> > Subject: Re: Accounting on 2 tables > Message-ID: <3653CA7E-31CF-4044-98AD-68E8DC0205CF(a)deployingradius.com> > Content-Type: text/plain; charset=us-ascii > > On Feb 24, 2017, at 9:44 AM, Ahmed Munir <ahmedmunir007(a)gmail.com> wrote: > > > > I would like to know is it possible to setup more than 1 tables for > > accounting? As by default radacct table is used. > > Yes. > > You will need to set up two instances of the SQL module, and then edit > the queries as necessary. > > > The reason I'm asking as need to setup accounting on different tables for > > Asterisk and OpenSIPs. > > > > Please advise and share the supported document. > > I would suggest taking the time to look at the wiki. This is documented > (see rlm_sql in the wiki). All it takes is for you to look. > > Alan DeKok. > -- Regards, Ahmed Munir Chohan

2 1

MD5 Auth Failure With Local User
by Martin, Jeremy 26 Feb '17

26 Feb '17

Hello, I am currently freeradius as a potential server and in doing so I am attempting to authenticate some devices using 802.1x that only support md5. From what I can tell this should be one of the most simplest tasks using freereadius but have as of yet have been successful in doing so. The setup could not be much simpler, there is a user in the users file and a client in the client configuration file. The request hits the server but is being rejected and from the debug output I am unable to determine why. I have reviewed most of the postings on the list serve and read just about all of the documents on the wiki and other sites and everything, unless I am missing something, is configured as documented. I am including the debug output and my users, if someone could please point me in the right direction I would be greatly appreciative. The version is 2.2.8 is a fresh and clean install from a debian 16.xx version that I just installed for this test, the only files modified are the users and clients files as the rest of the configuration files seem to indicate that eap with md5 is enabled and configured. Jeremy A009ED03287E Cleartext-Password := "1123481321" Service-Type = Framed-User, Framed-Protocol = PPP, Service-Type = Framed-User, Tunnel-Medium-Type = 6, Tunnel-Type = VLAN, Tunnel-Private-Group-ID = "U:140" Debug output freeradius: FreeRADIUS Version 2.2.8, for host x86_64-pc-linux-gnu, built on Apr 5 2016 at 13:40:43 Copyright (C) 1999-2015 The FreeRADIUS server project and contributors. There is NO warranty; not even for MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. You may redistribute copies of FreeRADIUS under the terms of the GNU General Public License. For more information about these matters, see the file named COPYRIGHT. Starting - reading configuration files ... including configuration file /etc/freeradius/radiusd.conf including configuration file /etc/freeradius/proxy.conf including configuration file /etc/freeradius/clients.conf including files in directory /etc/freeradius/modules/ including configuration file /etc/freeradius/modules/detail including configuration file /etc/freeradius/modules/files including configuration file /etc/freeradius/modules/wimax including configuration file /etc/freeradius/modules/checkval including configuration file /etc/freeradius/modules/attr_rewrite including configuration file /etc/freeradius/modules/logintime including configuration file /etc/freeradius/modules/detail.example.com including configuration file /etc/freeradius/modules/ippool including configuration file /etc/freeradius/modules/ldap including configuration file /etc/freeradius/modules/counter including configuration file /etc/freeradius/modules/radrelay including configuration file /etc/freeradius/modules/acct_unique including configuration file /etc/freeradius/modules/expiration including configuration file /etc/freeradius/modules/dhcp_sqlippool including configuration file /etc/freeradius/modules/realm including configuration file /etc/freeradius/modules/unix including configuration file /etc/freeradius/modules/perl including configuration file /etc/freeradius/modules/smsotp including configuration file /etc/freeradius/modules/echo including configuration file /etc/freeradius/modules/expr including configuration file /etc/freeradius/modules/pap including configuration file /etc/freeradius/modules/smbpasswd including configuration file /etc/freeradius/modules/detail.log including configuration file /etc/freeradius/modules/etc_group including configuration file /etc/freeradius/modules/ntlm_auth including configuration file /etc/freeradius/modules/inner-eap including configuration file /etc/freeradius/modules/exec including configuration file /etc/freeradius/modules/mac2vlan including configuration file /etc/freeradius/modules/rediswho including configuration file /etc/freeradius/modules/replicate including configuration file /etc/freeradius/modules/attr_filter including configuration file /etc/freeradius/modules/sqlcounter_expire_on_login including configuration file /etc/freeradius/modules/cache including configuration file /etc/freeradius/modules/opendirectory including configuration file /etc/freeradius/modules/mschap including configuration file /etc/freeradius/modules/linelog including configuration file /etc/freeradius/modules/chap including configuration file /etc/freeradius/modules/digest including configuration file /etc/freeradius/modules/passwd including configuration file /etc/freeradius/modules/sql_log including configuration file /etc/freeradius/modules/krb5 including configuration file /etc/freeradius/modules/sradutmp including configuration file /etc/freeradius/modules/preprocess including configuration file /etc/freeradius/modules/mac2ip including configuration file /etc/freeradius/modules/pam including configuration file /etc/freeradius/modules/policy including configuration file /etc/freeradius/modules/soh including configuration file /etc/freeradius/modules/always including configuration file /etc/freeradius/modules/otp including configuration file /etc/freeradius/modules/cui including configuration file /etc/freeradius/modules/dynamic_clients including configuration file /etc/freeradius/modules/redis including configuration file /etc/freeradius/modules/radutmp including configuration file /etc/freeradius/eap.conf including configuration file /etc/freeradius/policy.conf including files in directory /etc/freeradius/sites-enabled/ including configuration file /etc/freeradius/sites-enabled/inner-tunnel including configuration file /etc/freeradius/sites-enabled/default main { user = "freerad" group = "freerad" allow_core_dumps = no } including dictionary file /etc/freeradius/dictionary main { name = "freeradius" prefix = "/usr" localstatedir = "/var" sbindir = "/usr/sbin" logdir = "/var/log/freeradius" run_dir = "/var/run/freeradius" libdir = "/usr/lib/freeradius" radacctdir = "/var/log/freeradius/radacct" hostname_lookups = no max_request_time = 30 cleanup_delay = 5 max_requests = 1024 pidfile = "/var/run/freeradius/freeradius.pid" checkrad = "/usr/sbin/checkrad" debug_level = 0 proxy_requests = yes log { stripped_names = no auth = no auth_badpass = no auth_goodpass = no } security { max_attributes = 200 reject_delay = 1 status_server = yes allow_vulnerable_openssl = no } } radiusd: #### Loading Realms and Home Servers #### proxy server { retry_delay = 5 retry_count = 3 default_fallback = no dead_time = 120 wake_all_if_all_dead = no } home_server localhost { ipaddr = 127.0.0.1 port = 1812 type = "auth" secret = "testing123" response_window = 20 max_outstanding = 65536 require_message_authenticator = yes zombie_period = 40 status_check = "status-server" ping_interval = 30 check_interval = 30 num_answers_to_alive = 3 num_pings_to_alive = 3 revive_interval = 120 status_check_timeout = 4 coa { irt = 2 mrt = 16 mrc = 5 mrd = 30 } } home_server_pool my_auth_failover { type = fail-over home_server = localhost } realm example.com { auth_pool = my_auth_failover } realm LOCAL { } radiusd: #### Loading Clients #### client localhost { ipaddr = 127.0.0.1 require_message_authenticator = no secret = "testing123" nastype = "other" } client 10.40.10.215 { require_message_authenticator = no secret = "supersecret" } radiusd: #### Instantiating modules #### instantiate { Module: Linked to module rlm_exec Module: Instantiating module "exec" from file /etc/freeradius/modules/exec exec { wait = no input_pairs = "request" shell_escape = yes timeout = 10 } Module: Linked to module rlm_expr Module: Instantiating module "expr" from file /etc/freeradius/modules/expr Module: Linked to module rlm_expiration Module: Instantiating module "expiration" from file /etc/freeradius/modules/expiration expiration { reply-message = "Password Has Expired " } Module: Linked to module rlm_logintime Module: Instantiating module "logintime" from file /etc/freeradius/modules/logintime logintime { reply-message = "You are calling outside your allowed timespan " minimum-timeout = 60 } } radiusd: #### Loading Virtual Servers #### server { # from file /etc/freeradius/radiusd.conf modules { Module: Creating Auth-Type = digest Module: Checking authenticate {...} for more modules to load Module: Linked to module rlm_pap Module: Instantiating module "pap" from file /etc/freeradius/modules/pap pap { encryption_scheme = "auto" auto_header = no } Module: Linked to module rlm_chap Module: Instantiating module "chap" from file /etc/freeradius/modules/chap Module: Linked to module rlm_mschap Module: Instantiating module "mschap" from file /etc/freeradius/modules/mschap mschap { use_mppe = yes require_encryption = no require_strong = no with_ntdomain_hack = no allow_retry = yes } Module: Linked to module rlm_digest Module: Instantiating module "digest" from file /etc/freeradius/modules/digest Module: Linked to module rlm_unix Module: Instantiating module "unix" from file /etc/freeradius/modules/unix unix { radwtmp = "/var/log/freeradius/radwtmp" } Module: Linked to module rlm_eap Module: Instantiating module "eap" from file /etc/freeradius/eap.conf eap { default_eap_type = "md5" timer_expire = 60 ignore_unknown_eap_types = no cisco_accounting_username_bug = no max_sessions = 1024 } Module: Linked to sub-module rlm_eap_md5 Module: Instantiating eap-md5 Module: Linked to sub-module rlm_eap_leap Module: Instantiating eap-leap Module: Linked to sub-module rlm_eap_gtc Module: Instantiating eap-gtc gtc { challenge = "Password: " auth_type = "PAP" } Module: Linked to sub-module rlm_eap_tls Module: Instantiating eap-tls tls { rsa_key_exchange = no dh_key_exchange = yes rsa_key_length = 512 dh_key_length = 512 verify_depth = 0 CA_path = "/etc/freeradius/certs" pem_file_type = yes private_key_file = "/etc/freeradius/certs/server.key" certificate_file = "/etc/freeradius/certs/server.pem" CA_file = "/etc/freeradius/certs/ca.pem" private_key_password = "whatever" dh_file = "/etc/freeradius/certs/dh" random_file = "/dev/urandom" fragment_size = 1024 include_length = yes check_crl = no check_all_crl = no cipher_list = "DEFAULT" make_cert_command = "/etc/freeradius/certs/bootstrap" ecdh_curve = "prime256v1" cache { enable = no lifetime = 24 max_entries = 255 } verify { } ocsp { enable = no override_cert_url = yes url = "http://127.0.0.1/ocsp/" use_nonce = yes timeout = 0 softfail = no } } Module: Linked to sub-module rlm_eap_ttls Module: Instantiating eap-ttls ttls { default_eap_type = "md5" copy_request_to_tunnel = no use_tunneled_reply = no virtual_server = "inner-tunnel" include_length = yes } Module: Linked to sub-module rlm_eap_peap Module: Instantiating eap-peap peap { default_eap_type = "mschapv2" copy_request_to_tunnel = no use_tunneled_reply = no proxy_tunneled_request_as_eap = yes virtual_server = "inner-tunnel" soh = no } Module: Linked to sub-module rlm_eap_mschapv2 Module: Instantiating eap-mschapv2 mschapv2 { with_ntdomain_hack = no send_error = no } Module: Checking authorize {...} for more modules to load Module: Linked to module rlm_preprocess Module: Instantiating module "preprocess" from file /etc/freeradius/modules/preprocess preprocess { huntgroups = "/etc/freeradius/huntgroups" hints = "/etc/freeradius/hints" with_ascend_hack = no ascend_channels_per_line = 23 with_ntdomain_hack = no with_specialix_jetstream_hack = no with_cisco_vsa_hack = no with_alvarion_vsa_hack = no } reading pairlist file /etc/freeradius/huntgroups reading pairlist file /etc/freeradius/hints Module: Linked to module rlm_realm Module: Instantiating module "suffix" from file /etc/freeradius/modules/realm realm suffix { format = "suffix" delimiter = "@" ignore_default = no ignore_null = no } Module: Linked to module rlm_files Module: Instantiating module "files" from file /etc/freeradius/modules/files files { usersfile = "/etc/freeradius/users" acctusersfile = "/etc/freeradius/acct_users" preproxy_usersfile = "/etc/freeradius/preproxy_users" compat = "no" } reading pairlist file /etc/freeradius/users reading pairlist file /etc/freeradius/acct_users reading pairlist file /etc/freeradius/preproxy_users Module: Checking preacct {...} for more modules to load Module: Linked to module rlm_acct_unique Module: Instantiating module "acct_unique" from file /etc/freeradius/modules/acct_unique acct_unique { key = "User-Name, Acct-Session-Id, NAS-IP-Address, NAS-Identifier, NAS-Port" } Module: Checking accounting {...} for more modules to load Module: Linked to module rlm_detail Module: Instantiating module "detail" from file /etc/freeradius/modules/detail detail { detailfile = "/var/log/freeradius/radacct/%{%{Packet-Src-IP-Address}:-%{Packet-Src-IPv6-Address}}/detail-%Y%m%d" header = "%t" detailperm = 384 dirperm = 493 locking = no log_packet_header = no escape_filenames = no } Module: Linked to module rlm_attr_filter Module: Instantiating module "attr_filter.accounting_response" from file /etc/freeradius/modules/attr_filter attr_filter attr_filter.accounting_response { attrsfile = "/etc/freeradius/attrs.accounting_response" key = "%{User-Name}" relaxed = no } reading pairlist file /etc/freeradius/attrs.accounting_response Module: Checking session {...} for more modules to load Module: Linked to module rlm_radutmp Module: Instantiating module "radutmp" from file /etc/freeradius/modules/radutmp radutmp { filename = "/var/log/freeradius/radutmp" username = "%{User-Name}" case_sensitive = yes check_with_nas = yes perm = 384 callerid = yes } Module: Checking post-proxy {...} for more modules to load Module: Checking post-auth {...} for more modules to load Module: Instantiating module "attr_filter.access_reject" from file /etc/freeradius/modules/attr_filter attr_filter attr_filter.access_reject { attrsfile = "/etc/freeradius/attrs.access_reject" key = "%{User-Name}" relaxed = no } reading pairlist file /etc/freeradius/attrs.access_reject } # modules } # server server inner-tunnel { # from file /etc/freeradius/sites-enabled/inner-tunnel modules { Module: Checking authenticate {...} for more modules to load Module: Checking authorize {...} for more modules to load Module: Checking session {...} for more modules to load Module: Checking post-proxy {...} for more modules to load Module: Checking post-auth {...} for more modules to load } # modules } # server radiusd: #### Opening IP addresses and Ports #### listen { type = "auth" ipaddr = * port = 0 } listen { type = "acct" ipaddr = * port = 0 } listen { type = "auth" ipaddr = 127.0.0.1 port = 18120 } ... adding new socket proxy address * port 45349 Listening on authentication address * port 1812 Listening on accounting address * port 1813 Listening on authentication address 127.0.0.1 port 18120 as server inner-tunnel Listening on proxy address * port 1814 Ready to process requests. rad_recv: Access-Request packet from host 10.40.10.215 port 1362, id=119, length=140 User-Name = "A009ED03287E" Service-Type = Framed-User Framed-MTU = 1500 NAS-IP-Address = 10.40.10.215 NAS-Port-Type = Ethernet NAS-Port = 21 NAS-Port-Id = "1/1/21" NAS-Identifier = "MH-SW-CLW1" Calling-Station-Id = "A0-09-ED-03-28-7E" EAP-Message = 0x0201001101413030394544303332383745 Message-Authenticator = 0x525aed178402b6b2751f095ee64ab3ae # Executing section authorize from file /etc/freeradius/sites-enabled/default +group authorize { ++[preprocess] = ok ++[chap] = noop ++[mschap] = noop ++[digest] = noop [suffix] No '@' in User-Name = "A009ED03287E", looking up realm NULL [suffix] No such realm "NULL" ++[suffix] = noop [eap] EAP packet type response id 1 length 17 [eap] No EAP Start, assuming it's an on-going EAP conversation ++[eap] = updated [files] users: Matched entry A009ED03287E at line 1 ++[files] = ok ++[expiration] = noop ++[logintime] = noop [pap] WARNING: Auth-Type already set. Not setting to PAP ++[pap] = noop +} # group authorize = updated Found Auth-Type = EAP # Executing group from file /etc/freeradius/sites-enabled/default +group authenticate { [eap] EAP Identity [eap] processing type md5 rlm_eap_md5: Issuing Challenge ++[eap] = handled +} # group authenticate = handled Sending Access-Challenge of id 119 to 10.40.10.215 port 1362 Service-Type = Framed-User Framed-Protocol = PPP Tunnel-Medium-Type:0 = IEEE-802 Tunnel-Type:0 = VLAN Tunnel-Private-Group-Id:0 = "U:140" EAP-Message = 0x01020016041015bc1390ad75a179fb619b942c7243e1 Message-Authenticator = 0x00000000000000000000000000000000 State = 0x83b7aef283b5aacb6f9cfdec6ddd3f8e Finished request 0. Going to the next request Waking up in 4.9 seconds. rad_recv: Access-Request packet from host 10.40.10.215 port 1362, id=120, length=163 User-Name = "A009ED03287E" Service-Type = Framed-User Framed-MTU = 1500 NAS-IP-Address = 10.40.10.215 NAS-Port-Type = Ethernet NAS-Port = 21 NAS-Port-Id = "1/1/21" NAS-Identifier = "MH-SW-CLW1" Calling-Station-Id = "A0-09-ED-03-28-7E" State = 0x83b7aef283b5aacb6f9cfdec6ddd3f8e EAP-Message = 0x02020016041027406b254adbbe1a933b9f0a3eb249f4 Message-Authenticator = 0xe787e7ed108939823a95e2b5d8e3db55 # Executing section authorize from file /etc/freeradius/sites-enabled/default +group authorize { ++[preprocess] = ok ++[chap] = noop ++[mschap] = noop ++[digest] = noop [suffix] No '@' in User-Name = "A009ED03287E", looking up realm NULL [suffix] No such realm "NULL" ++[suffix] = noop [eap] EAP packet type response id 2 length 22 [eap] No EAP Start, assuming it's an on-going EAP conversation ++[eap] = updated [files] users: Matched entry A009ED03287E at line 1 ++[files] = ok ++[expiration] = noop ++[logintime] = noop [pap] WARNING: Auth-Type already set. Not setting to PAP ++[pap] = noop +} # group authorize = updated Found Auth-Type = EAP # Executing group from file /etc/freeradius/sites-enabled/default +group authenticate { [eap] Request found, released from the list [eap] EAP/md5 [eap] processing type md5 [eap] Freeing handler ++[eap] = reject +} # group authenticate = reject Failed to authenticate the user. Using Post-Auth-Type Reject # Executing group from file /etc/freeradius/sites-enabled/default +group REJECT { [eap] Reply already contained an EAP-Message, not inserting EAP-Failure ++[eap] = noop [attr_filter.access_reject] expand: %{User-Name} -> A009ED03287E attr_filter: Matched entry DEFAULT at line 11 ++[attr_filter.access_reject] = updated +} # group REJECT = updated Delaying reject of request 1 for 1 seconds Going to the next request Waking up in 0.9 seconds. Sending delayed reject for request 1 Sending Access-Reject of id 120 to 10.40.10.215 port 1362 EAP-Message = 0x04020004 Message-Authenticator = 0x00000000000000000000000000000000 Waking up in 3.9 seconds. Cleaning up request 0 ID 119 with timestamp +16 Waking up in 1.0 seconds. Cleaning up request 1 ID 120 with timestamp +16 Ready to process requests.

2 1