June 2017 - Freeradius-Users - lists.freeradius.org

add attribute when proxying
by denis 29 Jun '17

29 Jun '17

Hello, I have setup made according to robust proxy accounting guide. Now I need freeradius to add Tmp-String-1 attribute to each Access-Request sent to proxy. I tried using policy conf and ulang in robust-proxy-accounting config, but request sent to proxy is still unmodified One of log examples (just for curiosity i'm trying update both - proxy-request and request: (0) server home.mycompany.com { (0) # Executing section pre-proxy from file /etc/freeradius/sites-enabled/robust-proxy-accounting (0) pre-proxy { (0) policy add-attribute { (0) update request { (0) Tmp-String-1 := 1111111 (0) } # update request = noop (0) update proxy-request { (0) Tmp-String-1 := 1111111 (0) } # update proxy-request = noop (0) } # policy add-attribute = noop (0) policy debug_proxy_request { (0) if ("%{debug_attr:proxy-request:}" == '') { (0) Attributes matching "proxy-request:" (0) &proxy-request:User-Name = username (0) &proxy-request:User-Password = password (0) &proxy-request:NAS-Identifier = nasid (0) &proxy-request:Framed-Protocol = PPP (0) &proxy-request:Service-Type = Framed-User (0) &proxy-request:Event-Timestamp = Jun 29 2017 13:51:01 UTC (0) &proxy-request:NAS-IP-Address = 185.7.90.32 (0) &proxy-request:Message-Authenticator := 0x00 (0) &proxy-request:Proxy-State = 0x313636 (0) &proxy-request:Tmp-String-1 := 1111111 (0) EXPAND %{debug_attr:proxy-request:} (0) --> (0) if ("%{debug_attr:proxy-request:}" == '') -> TRUE (0) if ("%{debug_attr:proxy-request:}" == '') { (0) [noop] = noop (0) } # if ("%{debug_attr:proxy-request:}" == '') = noop (0) } # policy debug_proxy_request = noop (0) } # pre-proxy = noop (0) } (0) Proxying request to home server 138.7.90.9 port 1812 timeout 30.000000 (0) Sent Access-Request Id 19 from 0.0.0.0:30848 to 138.7.90.9:1812 length 101 (0) User-Name = "username" (0) User-Password = "password" (0) NAS-Identifier = "nasid" (0) Framed-Protocol = PPP (0) Service-Type = Framed-User (0) Event-Timestamp = "Jun 29 2017 13:51:01 UTC" (0) NAS-IP-Address = 185.7.90.32 (0) Message-Authenticator := 0x00 (0) Proxy-State = 0x313636 Waking up in 0.3 seconds. As you see proxied request is unchaged, while debug output above states attribute was added. For example if in same way I modify existing attribute - this will work fine, i.e Framed-Protocol will be sent to proxy with value I set. update proxy-request { Framed-Protocol := 11111 } But I need new attr added, and now I'm completely out of ideas how to achieve this. Already read lots of mailing archives, unlang doc and etc - still do not understand how attribute can be added. So if someone has any idea - please point me to correct doc/direction. freeradius 3.0.12 -- Denis

2 3

How to avoid EAP-TLS login on commercial CA's?
by Ramon Escriba 29 Jun '17

29 Jun '17

Hello FreeRadius masters, We're planning to use EAP-TTLS with a commercial certificate on freeradius-3.0.4. We do not want any "client certificate" signed by this commercial big CA to log in. Of course, I saw the warning: /etc/raddb/mod-enabled/eap # Note that you should NOT use a globally known CA here! # e.g. using a Verisign cert as a "known CA" means that # ANYONE who has a certificate signed by them can # authenticate via EAP-TLS! This is likely not what you want. But, there's any simple way to forbid globally any CA 'valid client certificate', a part of not using the commercial CA?? Regards.

4 5

Freeradius as a loadbalancer - logging dropped accounting requests
by Aleš Rygl 29 Jun '17

29 Jun '17

Hello, I am running several instances of Freeradius 3.0.13 on a single machine and one of them acts as a load balancer distributing just accounting request among four home servers listening on loopback on different ports: thread pool { start_servers = 64 max_servers = 1500 min_spare_servers = 50 max_spare_servers = 80 max_requests_per_server = 0 auto_limit_acct = no } realm NULL { acct_pool = DRACO_acct_pool nostrip } realm DEFAULT { acct_pool = DRACO_acct_pool nostrip } home_server_pool DRACO_acct_pool { type = keyed-balance home_server = rzt-gc-01 home_server = rzt-gc-02 home_server = rzt-gc-03 home_server = rzt-gc-04 } home_server rzt-gc-01 { type = acct ipaddr = 127.0.0.1 port = 2814 secret = testing123 response_window = 20 zombie_period = 40 revive_interval = 120 status_check = status-server check_interval = 10 check_timeout = 4 num_answers_to_alive = 3 coa { irt = 2 mrt = 16 mrc = 5 mrd = 30 } limit { max_connections = 16 max_requests = 0 lifetime = 0 idle_timeout = 0 } } ... and so on. The load is quite heavy - about 3.5k req/s. Balancing works fine, the key is Calling-Station-ID (MSISDN). What I can see is that there are some dropped packets in the stats: # echo "stats client acct" | radmin -d /etc/freeradius_lb/ radmin> stats client acct requests 39511449 responses 39508797 dup 0 invalid 0 malformed 0 bad_authenticator 0 dropped 1584 unknown_types 0 last_packet 1498477859 elapsed.1us 0 elapsed.10us 0 elapsed.100us 33765867 elapsed.1ms 5742921 elapsed.10ms 9 elapsed.100ms 0 elapsed.1s 0 elapsed.10s 0 radmin> The homeservers have no performance issues: # echo "stats client acct" | radmin -d /etc/freeradius_04/ radmin> stats client acct requests 159032334 responses 159030646 dup 21 invalid 0 malformed 0 bad_authenticator 0 dropped 21 unknown_types 0 last_packet 1498478023 elapsed.1us 0 elapsed.10us 0 elapsed.100us 158795858 elapsed.1ms 234786 elapsed.10ms 2 elapsed.100ms 0 elapsed.1s 0 elapsed.10s 0 radmin> Is there a way how to indetify the reason why are some req. dropped? I.e. logging such requestest? LB there is no lack of CPU or memory on the server, no drops in the UDP stack.. Thanks Ales

2 7

Delegated-IPv6-Prefix & sqlippool
by maxime.gerges＠ariane.network 29 Jun '17

29 Jun '17

Hello folks, I am currently checking for the possibility of using the sqlippool module to assign dynamically delegated IPv6 Prefixes. I found out that there is an option in the module to activate the IPv6 support and start assigning IPv6 address as well as traditional IPv4, but this option is only handling the creation of reply attribute 'Framed-IPv6-Prefix'. From the module's code on github, I also confirm that sqlippool doesn't seem to be ready to handle Delegated-IPv6-Prefix attribute. Does anybody know if this option might be interesting to be integrated in the code ? Is there any plan to add such option ? For information we are currently assigning Delegated IPv6 prefixes to customer thanks to an entry per customer in the radreply table and are copying the job of the sqlippool in an algorithm outside of the radius server. We do have a pool of available prefixes in an external database - when a customer subscribes we are picking up a prefix and populate it in the radreply - when the customer unsubscribe we are deleting the radreply entry and make the prefix available again in our external database. Many thanks for your replies. Maxime.

3 4

FR3.x - EAP proxy - EAP-TLS to MS NPS trouble
by Kylián Martin 29 Jun '17

29 Jun '17

Hi to everybody, I use freeradius for mac authentication bypass and as proxy for EAP. Specifically, an EAP-TLS that is routed to one of the MS NPS servers. I run the production environment on debian8 and FreeRadius 2.2.5, where everything works as it should. There is a problem I can not solve on the FreeRadius 3.0.12 (deb9) test server. After forwarding the access-request to the AD server, the request is not processed on the MS NPS server (w2012r2): Reason Code: 3 Reason: The RADIUS Request message that the Network Policy Server received from the network access server was malformed. NPS discards this request and does not respond. When I look at access-request with wireshark, I do not see any problem. (Message-authenticator is different from that sent by the client and which sends FreeRadius to NPS and Proxy-State added.) The same configuration with FR2.2.5 is parsed on NPS and is responded. Is there something I've overlooked when migrating to FR3? Is anyone running a similar configuration? I am doing something wrong? Thank you for any help Log: (2) Received Access-Request Id 27 from 192.168.59.80:1645 to 172.31.12.100:1812 length 340 (2) User-Name = "host/NB106484.example-edu.cz" (2) Service-Type = Framed-User (2) Framed-MTU = 1500 (2) Called-Station-Id = "28-34-A2-F0-7F-83" (2) Calling-Station-Id = "28-92-4A-25-56-CC" (2) EAP-Message = 0x020200710d800000006716030100620100005e03015953650a19b07c0ab643096685c9141950ad6c79abf54fa72736f856abd72b9900001cc014c013003900330035002fc00ac00900380032000a00130005000401000019000a0006000400170018000b0002010000170000ff01000100 (2) Message-Authenticator = 0xbfcf629e3a34b88c37d824ec7358e314 (2) NAS-Port-Type = Ethernet (2) NAS-Port = 50003 (2) NAS-Port-Id = "FastEthernet0/3" (2) State = 0x540106e70000013700011700fe800000000000002114a20fdc26eb140000000448ff01e5 (2) NAS-IP-Address = 192.168.59.80 (2) NAS-Identifier = "d4-cat2960-sw-132-2.net.sitmp.cz" (2) session-state: No cached attributes (2) # Executing section authorize from file /etc/freeradius/3.0/sites-enabled/default (2) authorize { rlm_sql (sql): Reserved connection (0) rlm_sql (sql): Released connection (0) (2) [sql] = notfound (2) if (!EAP-Message) { (2) if (!EAP-Message) -> FALSE (2) else { (2) if ("%{User-Name}" =~ /\.example-edu\.cz$/) { (2) EXPAND %{User-Name} (2) --> host/NB106484.example-edu.cz (2) if ("%{User-Name}" =~ /\.example-edu\.cz$/) -> TRUE (2) if ("%{User-Name}" =~ /\.example-edu\.cz$/) { (2) update control { (2) Proxy-To-Realm := 'EXAMPLE-EDU' (2) } # update control = noop (2) } # if ("%{User-Name}" =~ /\.example-edu\.cz$/) = noop (2) ... skipping elsif: Preceding "if" was taken (2) ... skipping elsif: Preceding "if" was taken (2) ... skipping else: Preceding "if" was taken (2) eap: Request is supposed to be proxied to Realm EXAMPLE-EDU. Not doing EAP. (2) [eap] = noop (2) } # else = noop (2) } # authorize = noop (2) Starting proxy to home server 172.31.12.14 port 1812 (2) Proxying request to home server 172.31.12.14 port 1812 timeout 20.000000 (2) Sent Access-Request Id 243 from 0.0.0.0:59582 to 172.31.12.14:1812 length 342 (2) User-Name = "host/NB106484.example-edu.cz" (2) Service-Type = Framed-User (2) Framed-MTU = 1500 (2) Called-Station-Id = "28-34-A2-F0-7F-83" (2) Calling-Station-Id = "28-92-4A-25-56-CC" (2) EAP-Message = 0x020200710d800000006716030100620100005e03015953650a19b07c0ab643096685c9141950ad6c79abf54fa72736f856abd72b9900001cc014c013003900330035002fc00ac00900380032000a00130005000401000019000a0006000400170018000b0002010000170000ff01000100 (2) Message-Authenticator = 0xbfcf629e3a34b88c37d824ec7358e314 (2) NAS-Port-Type = Ethernet (2) NAS-Port = 50003 (2) NAS-Port-Id = "FastEthernet0/3" (2) State = 0x540106e70000013700011700fe800000000000002114a20fdc26eb140000000448ff01e5 (2) NAS-IP-Address = 192.168.59.80 (2) NAS-Identifier = "d4-cat2960-sw-132-2.net.example.cz" (2) Proxy-State = 0x3237 Waking up in 0.3 seconds. (2) Expecting proxy response no later than 19.671053 seconds from now NPS receives (and discards for unknown reason): RADIUS Protocol Code: Access-Request (1) Packet identifier: 0xf3 (243) Length: 342 Authenticator: 0e4c4171a7c216d63ea6c394e98175bd Attribute Value Pairs AVP: l=28 t=User-Name(1): host/NB106484.plzen-edu.cz AVP: l=6 t=Service-Type(6): Framed(2) AVP: l=6 t=Framed-MTU(12): 1500 AVP: l=19 t=Called-Station-Id(30): 28-34-A2-F0-7F-83 AVP: l=19 t=Calling-Station-Id(31): 28-92-4A-25-56-CC AVP: l=115 t=EAP-Message(79) Last Segment[1] AVP Type: 79 AVP Length: 115 EAP fragment: 020200710d800000006716030100620100005e0301595365... Extensible Authentication Protocol AVP: l=18 t=Message-Authenticator(80): b2b9f1cf1e3ab216e63a949451ba2c69 AVP: l=6 t=NAS-Port-Type(61): Ethernet(15) AVP: l=6 t=NAS-Port(5): 50003 AVP: l=17 t=NAS-Port-Id(87): FastEthernet0/3 AVP: l=38 t=State(24): 540106e70000013700011700fe800000000000002114a20f... AVP: l=6 t=NAS-IP-Address(4): 192.168.59.80 AVP: l=34 t=NAS-Identifier(32): d4-cat2960-sw-132-2.net.sitmp.cz AVP: l=4 t=Proxy-State(33): 3237

3 4

Re: FreeRADIUS 3.0.12 VMPS and logging twice?
by Václav Ovsík 28 Jun '17

28 Jun '17

On Wed, Jun 28, 2017 at 03:49:52PM -0400, Alan DeKok wrote: > On Jun 28, 2017, at 3:27 PM, Václav Ovsík <vaclav.ovsik(a)i.cz> wrote: > > > > Forgot you to attach the patch? > > Hmm.. the mailing list strips it. I've attached it here. ...including the patch hier for completeness -----<snip>----- diff --git a/src/modules/proto_vmps/vmps.c b/src/modules/proto_vmps/vmps.c index f1df128..1fc0a19 100644 --- a/src/modules/proto_vmps/vmps.c +++ b/src/modules/proto_vmps/vmps.c @@ -37,6 +37,7 @@ static int vmps_process(REQUEST *request) process_post_auth(0, request); DEBUG2("Done VMPS"); + request->packet->code = 0; /* hack for VMPS */ request->reply->code = PW_CODE_ACCESS_ACCEPT; return 0; -----<snip>----- I rebuilt Debian package including your patch and it looks ok now! FreeRADIUS Version 3.0.12 Copyright (C) 1999-2016 The FreeRADIUS server project and contributors There is NO warranty; not even for MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE You may redistribute copies of FreeRADIUS under the terms of the GNU General Public License For more information about these matters, see the file named COPYRIGHT Starting - reading configuration files ... including dictionary file /usr/share/freeradius/dictionary including dictionary file /usr/share/freeradius/dictionary.dhcp including dictionary file /usr/share/freeradius/dictionary.vqp including dictionary file /etc/freeradius/3.0/dictionary including configuration file /etc/freeradius/3.0/radiusd.conf including configuration file /etc/freeradius/3.0/clients.conf including files in directory /etc/freeradius/3.0/mods-enabled/ including configuration file /etc/freeradius/3.0/mods-enabled/mac2vlan including configuration file /etc/freeradius/3.0/mods-enabled/linelog_vmps including files in directory /etc/freeradius/3.0/policy.d/ including configuration file /etc/freeradius/3.0/policy.d/control including configuration file /etc/freeradius/3.0/policy.d/canonicalization including configuration file /etc/freeradius/3.0/policy.d/eap including configuration file /etc/freeradius/3.0/policy.d/cui including configuration file /etc/freeradius/3.0/policy.d/dhcp including configuration file /etc/freeradius/3.0/policy.d/filter including configuration file /etc/freeradius/3.0/policy.d/accounting including configuration file /etc/freeradius/3.0/policy.d/abfab-tr including configuration file /etc/freeradius/3.0/policy.d/moonshot-targeted-ids including configuration file /etc/freeradius/3.0/policy.d/debug including configuration file /etc/freeradius/3.0/policy.d/operator-name including files in directory /etc/freeradius/3.0/sites-enabled/ including configuration file /etc/freeradius/3.0/sites-enabled/vmps main { security { user = "freerad" group = "freerad" allow_core_dumps = no } name = "freeradius" prefix = "/usr" localstatedir = "/var" logdir = "/var/log/freeradius" run_dir = "/var/run/freeradius" } main { name = "freeradius" prefix = "/usr" localstatedir = "/var" sbindir = "/usr/sbin" logdir = "/var/log/freeradius" run_dir = "/var/run/freeradius" libdir = "/usr/lib/freeradius" radacctdir = "/var/log/freeradius/radacct" hostname_lookups = no max_request_time = 30 cleanup_delay = 5 max_requests = 16384 pidfile = "/var/run/freeradius/freeradius.pid" checkrad = "/usr/sbin/checkrad" debug_level = 0 proxy_requests = no log { stripped_names = no auth = no auth_badpass = no auth_goodpass = no colourise = yes msg_denied = "You are already logged in - access denied" } resources { } security { max_attributes = 200 reject_delay = 1.000000 status_server = yes } } radiusd: #### Loading Realms and Home Servers #### radiusd: #### Loading Clients #### client localhost { ipaddr = 127.0.0.1 require_message_authenticator = no secret = <<< secret >>> nas_type = "other" proto = "*" limit { max_connections = 16 lifetime = 0 idle_timeout = 30 } } client localhost_ipv6 { ipv6addr = ::1 require_message_authenticator = no secret = <<< secret >>> limit { max_connections = 16 lifetime = 0 idle_timeout = 30 } } Debugger not attached radiusd: #### Instantiating modules #### modules { # Loaded module rlm_passwd # Loading module "mac2vlan" from file /etc/freeradius/3.0/mods-enabled/mac2vlan passwd mac2vlan { filename = "/etc/freeradius/3.0/mods-config/passwd/mac2vlan" format = "*VMPS-Mac:=VMPS-VLAN-Name" delimiter = "," ignore_nislike = yes ignore_empty = yes allow_multiple_keys = no hash_size = 100 } # Loaded module rlm_linelog # Loading module "linelog_vmps" from file /etc/freeradius/3.0/mods-enabled/linelog_vmps linelog linelog_vmps { filename = "/var/log/freeradius/vmps.log" escape_filenames = no syslog_severity = "info" permissions = 384 format = "%S %{VMPS-Client-IP-Address} %{VMPS-Port-Name} %{VMPS-Packet-Type} %{VMPS-Mac} -> %{reply:VMPS-VLAN-Name}" } instantiate { } # Instantiating module "mac2vlan" from file /etc/freeradius/3.0/mods-enabled/mac2vlan rlm_passwd: nfields: 2 keyfield 0(VMPS-Mac) listable: no # Instantiating module "linelog_vmps" from file /etc/freeradius/3.0/mods-enabled/linelog_vmps } # modules radiusd: #### Loading Virtual Servers #### server { # from file /etc/freeradius/3.0/radiusd.conf } # server server vmps { # from file /etc/freeradius/3.0/sites-enabled/vmps # Loading vmps {...} } # server vmps radiusd: #### Opening IP addresses and Ports #### listen { type = "vmps" ipaddr = 10.2.28.97 port = 1589 client cisco-switches { ipaddr = 192.168.0.0 netmask = 16 require_message_authenticator = no secret = <<< secret >>> limit { max_connections = 16 lifetime = 0 idle_timeout = 30 } } client cisco-switches2 { ipaddr = 10.0.0.0 netmask = 11 require_message_authenticator = no secret = <<< secret >>> limit { max_connections = 16 lifetime = 0 idle_timeout = 30 } } client monit { ipaddr = 192.168.30.80 netmask = 28 require_message_authenticator = no secret = <<< secret >>> limit { max_connections = 16 lifetime = 0 idle_timeout = 30 } } client monit2 { ipaddr = 10.0.156.80 netmask = 29 require_message_authenticator = no secret = <<< secret >>> limit { max_connections = 16 lifetime = 0 idle_timeout = 30 } } } Listening on vmps address 10.2.28.97 port 1589 bound to server vmps Ready to process requests VMPS-Packet-Type = VMPS-Join-Request VMPS-Error-Code = VMPS-No-Error VMPS-Sequence-Number = 4660 VMPS-Client-IP-Address = 127.0.0.1 VMPS-Port-Name = "Fa0/1" VMPS-VLAN-Name = "" VMPS-Domain-Name = "" VMPS-Unknown = 0x00 VMPS-MAC = d4:be:d9:68:15:58 (0) Received Access-Request Id 4660 from 192.168.30.82:49212 to 10.2.28.97:1589 length 60 (0) VMPS-Packet-Type = VMPS-Join-Request (0) VMPS-Error-Code = VMPS-No-Error (0) VMPS-Sequence-Number = 4660 (0) VMPS-Client-IP-Address = 127.0.0.1 (0) VMPS-Port-Name = "Fa0/1" (0) VMPS-VLAN-Name = "" (0) VMPS-Domain-Name = "" (0) VMPS-Unknown = 0x00 (0) VMPS-MAC = d4:be:d9:68:15:58 Doing VMPS (0) vmps { (0) if (!&VMPS-Mac) { (0) if (!&VMPS-Mac) -> FALSE (0) mac2vlan: Added VMPS-VLAN-Name: 'TPS' to reply_items (0) [mac2vlan] = ok (0) update reply { (0) &VMPS-Packet-Type = VMPS-Join-Response (0) &VMPS-Cookie = &VMPS-Mac -> d4:be:d9:68:15:58 (0) &VMPS-VLAN-Name = "Guest" (0) } # update reply = noop (0) if (&VMPS-Packet-Type == VMPS-Reconfirm-Request){ (0) if (&VMPS-Packet-Type == VMPS-Reconfirm-Request) -> FALSE (0) linelog_vmps: EXPAND %S %{VMPS-Client-IP-Address} %{VMPS-Port-Name} %{VMPS-Packet-Type} %{VMPS-Mac} -> %{reply:VMPS-VLAN-Name} (0) linelog_vmps: --> 2017-06-28 23:39:04 127.0.0.1 Fa0/1 VMPS-Join-Request d4:be:d9:68:15:58 -> TPS (0) linelog_vmps: EXPAND /var/log/freeradius/vmps.log (0) linelog_vmps: --> /var/log/freeradius/vmps.log (0) [linelog_vmps] = ok (0) } # vmps = ok Done VMPS (0) Sent Access-Accept Id 4660 from 10.2.28.97:1589 to 192.168.30.82:49212 length 0 VMPS-VLAN-Name = "TPS" VMPS-Cookie = d4:be:d9:68:15:58 (0) Finished request (0) Cleaning up request packet ID 4660 with timestamp +2 Ready to process requests Great! Many thanks for solving the problem! Regards -- Zito

1 0

Execute external script triggered by accounting request
by Leandro 28 Jun '17

28 Jun '17

Hi guys , I need to take device ip from accounting request packet, use this ip to run external script to grab some device parameters via ping and snmp. Im working on two methods , both have cons and advantages. 1st Method: "perl module." So far I have the module working with a testing script but when I want to exec net::ping module it yelds that root privileges are needed. I tried "usermod -G root radiusd" to provide radiusd root privileges but have not success. Other consequence of this method could be to get a very large delay considering that every devices takes 5~7 secs to process and send the response back, so I think that it would be good also to run this external script in background. 2nd Method " Tail the raddacct file" I can use a perl tail process to grab the "Framed_ip_address" from the accounting log file and execute the snmp and ping queries from outside the radius process Principal advantage could be that Im not adding extra delay to the radius accounting process. I wanted to know if is possible to change the accounting logging behaviour in the following way: Write always to /var/log/messages file (currently it writes to detail-YYYYMMDD file). Select the fields and write them horizontally instead of writting them in column format. Any idea would be wellcome. Regards Leandro.

2 1

shared secret
by Andrew Meyer 28 Jun '17

28 Jun '17

I have my clients setup with the same shared secret for testing. I have this setup w/ FreeIPA. However I am testing FreeRADIUS in debug mode and i'm running radtest against and not getting anything. I'm not sure why. I have verified that I am typing in the secret correctly. (10) Cleaning up request packet ID 88 with timestamp +475Ready to process requestsReceived Access-Request Id 88 from 127.0.0.1:60005 to 127.0.0.1:1812 length 76(11) Received Access-Request packet from host 127.0.0.1 port 60005, id=88, length=76(11) Dropping packet without response because of error: Received packet from 127.0.0.1 with invalid Message-Authenticator! (Shared secret is incorrect.)

2 2

Migration how to
by Olivier 28 Jun '17

28 Jun '17

Hello, I am migrating my configuration from FreeRadius 2 to 3 and I am struggling to go ahead. I am not really sure what is in the working configuration, nor why it is there. Does it exist some how to to help doing the migration? Best regards, Olivier --

3 2

FreeRADIUS 3.0.12 VMPS and logging twice?
by Václav Ovsík 28 Jun '17

28 Jun '17

Hi, we are using FreeRADIUS VMPS server for a long time on Debian GNU/Linux. It works perfectly and my tiny modification to dist vmps site definition is line log. With FreeRADIUS 2.2.5 it worked fine. I did upgrade of first VMPS yesterday (Debian Stretch) and did a small mods to vmps for FreeRADIUS version 3.0.12. What I didn't know to do with is that vmps processing doubled or two-phase or something (every request is logged twice). Request sent from monitoring site using check_vmps nagios plugin with success: VMPS OK - Vlan: TPS, MAC Address: d4bed9681558, Status: ALLOW response is correct one packet (checked using tcpdump). The output of freeradius -X: FreeRADIUS Version 3.0.12 Copyright (C) 1999-2016 The FreeRADIUS server project and contributors There is NO warranty; not even for MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE You may redistribute copies of FreeRADIUS under the terms of the GNU General Public License For more information about these matters, see the file named COPYRIGHT Starting - reading configuration files ... including dictionary file /usr/share/freeradius/dictionary including dictionary file /usr/share/freeradius/dictionary.dhcp including dictionary file /usr/share/freeradius/dictionary.vqp including dictionary file /etc/freeradius/3.0/dictionary including configuration file /etc/freeradius/3.0/radiusd.conf including configuration file /etc/freeradius/3.0/clients.conf including files in directory /etc/freeradius/3.0/mods-enabled/ including configuration file /etc/freeradius/3.0/mods-enabled/mac2vlan including configuration file /etc/freeradius/3.0/mods-enabled/linelog_vmps including files in directory /etc/freeradius/3.0/policy.d/ including configuration file /etc/freeradius/3.0/policy.d/control including configuration file /etc/freeradius/3.0/policy.d/canonicalization including configuration file /etc/freeradius/3.0/policy.d/eap including configuration file /etc/freeradius/3.0/policy.d/cui including configuration file /etc/freeradius/3.0/policy.d/dhcp including configuration file /etc/freeradius/3.0/policy.d/filter including configuration file /etc/freeradius/3.0/policy.d/accounting including configuration file /etc/freeradius/3.0/policy.d/abfab-tr including configuration file /etc/freeradius/3.0/policy.d/moonshot-targeted-ids including configuration file /etc/freeradius/3.0/policy.d/debug including configuration file /etc/freeradius/3.0/policy.d/operator-name including files in directory /etc/freeradius/3.0/sites-enabled/ including configuration file /etc/freeradius/3.0/sites-enabled/vmps main { security { user = "freerad" group = "freerad" allow_core_dumps = no } name = "freeradius" prefix = "/usr" localstatedir = "/var" logdir = "/var/log/freeradius" run_dir = "/var/run/freeradius" } main { name = "freeradius" prefix = "/usr" localstatedir = "/var" sbindir = "/usr/sbin" logdir = "/var/log/freeradius" run_dir = "/var/run/freeradius" libdir = "/usr/lib/freeradius" radacctdir = "/var/log/freeradius/radacct" hostname_lookups = no max_request_time = 30 cleanup_delay = 5 max_requests = 16384 pidfile = "/var/run/freeradius/freeradius.pid" checkrad = "/usr/sbin/checkrad" debug_level = 0 proxy_requests = no log { stripped_names = no auth = no auth_badpass = no auth_goodpass = no colourise = yes msg_denied = "You are already logged in - access denied" } resources { } security { max_attributes = 200 reject_delay = 1.000000 status_server = yes } } radiusd: #### Loading Realms and Home Servers #### radiusd: #### Loading Clients #### client localhost { ipaddr = 127.0.0.1 require_message_authenticator = no secret = <<< secret >>> nas_type = "other" proto = "*" limit { max_connections = 16 lifetime = 0 idle_timeout = 30 } } client localhost_ipv6 { ipv6addr = ::1 require_message_authenticator = no secret = <<< secret >>> limit { max_connections = 16 lifetime = 0 idle_timeout = 30 } } Debugger not attached radiusd: #### Instantiating modules #### modules { # Loaded module rlm_passwd # Loading module "mac2vlan" from file /etc/freeradius/3.0/mods-enabled/mac2vlan passwd mac2vlan { filename = "/etc/freeradius/3.0/mods-config/passwd/mac2vlan" format = "*VMPS-Mac:=VMPS-VLAN-Name" delimiter = "," ignore_nislike = yes ignore_empty = yes allow_multiple_keys = no hash_size = 100 } # Loaded module rlm_linelog # Loading module "linelog_vmps" from file /etc/freeradius/3.0/mods-enabled/linelog_vmps linelog linelog_vmps { filename = "/var/log/freeradius/vmps.log" escape_filenames = no syslog_severity = "info" permissions = 384 format = "%S %{VMPS-Client-IP-Address} %{VMPS-Port-Name} %{VMPS-Packet-Type} %{VMPS-Mac} -> %{reply:VMPS-VLAN-Name}" } instantiate { } # Instantiating module "mac2vlan" from file /etc/freeradius/3.0/mods-enabled/mac2vlan rlm_passwd: nfields: 2 keyfield 0(VMPS-Mac) listable: no # Instantiating module "linelog_vmps" from file /etc/freeradius/3.0/mods-enabled/linelog_vmps } # modules radiusd: #### Loading Virtual Servers #### server { # from file /etc/freeradius/3.0/radiusd.conf } # server server vmps { # from file /etc/freeradius/3.0/sites-enabled/vmps # Loading vmps {...} } # server vmps radiusd: #### Opening IP addresses and Ports #### listen { type = "vmps" ipaddr = 10.2.28.97 port = 1589 client cisco-switches { ipaddr = 192.168.0.0 netmask = 16 require_message_authenticator = no secret = <<< secret >>> limit { max_connections = 16 lifetime = 0 idle_timeout = 30 } } client cisco-switches2 { ipaddr = 10.0.0.0 netmask = 11 require_message_authenticator = no secret = <<< secret >>> limit { max_connections = 16 lifetime = 0 idle_timeout = 30 } } client monit { ipaddr = 192.168.30.80 netmask = 28 require_message_authenticator = no secret = <<< secret >>> limit { max_connections = 16 lifetime = 0 idle_timeout = 30 } } client monit2 { ipaddr = 10.0.156.80 netmask = 29 require_message_authenticator = no secret = <<< secret >>> limit { max_connections = 16 lifetime = 0 idle_timeout = 30 } } } Listening on vmps address 10.2.28.97 port 1589 bound to server vmps Ready to process requests VMPS-Packet-Type = VMPS-Join-Request VMPS-Error-Code = VMPS-No-Error VMPS-Sequence-Number = 4660 VMPS-Client-IP-Address = 127.0.0.1 VMPS-Port-Name = "Fa0/1" VMPS-VLAN-Name = "" VMPS-Domain-Name = "" VMPS-Unknown = 0x00 VMPS-MAC = d4:be:d9:68:15:58 (0) Received Access-Request Id 4660 from 192.168.30.82:41160 to 10.2.28.97:1589 length 60 (0) VMPS-Packet-Type = VMPS-Join-Request (0) VMPS-Error-Code = VMPS-No-Error (0) VMPS-Sequence-Number = 4660 (0) VMPS-Client-IP-Address = 127.0.0.1 (0) VMPS-Port-Name = "Fa0/1" (0) VMPS-VLAN-Name = "" (0) VMPS-Domain-Name = "" (0) VMPS-Unknown = 0x00 (0) VMPS-MAC = d4:be:d9:68:15:58 Doing VMPS (0) vmps { (0) if (!&VMPS-Mac) { (0) if (!&VMPS-Mac) -> FALSE (0) mac2vlan: Added VMPS-VLAN-Name: 'TPS' to reply_items (0) [mac2vlan] = ok (0) update reply { (0) &VMPS-Packet-Type = VMPS-Join-Response (0) &VMPS-Cookie = &VMPS-Mac -> d4:be:d9:68:15:58 (0) &VMPS-VLAN-Name = "Guest" (0) } # update reply = noop (0) if (&VMPS-Packet-Type == VMPS-Reconfirm-Request){ (0) if (&VMPS-Packet-Type == VMPS-Reconfirm-Request) -> FALSE (0) linelog_vmps: EXPAND %S %{VMPS-Client-IP-Address} %{VMPS-Port-Name} %{VMPS-Packet-Type} %{VMPS-Mac} -> %{reply:VMPS-VLAN-Name} (0) linelog_vmps: --> 2017-06-28 17:21:53 127.0.0.1 Fa0/1 VMPS-Join-Request d4:be:d9:68:15:58 -> TPS (0) linelog_vmps: EXPAND /var/log/freeradius/vmps.log (0) linelog_vmps: --> /var/log/freeradius/vmps.log (0) [linelog_vmps] = ok (0) } # vmps = ok Done VMPS (0) vmps { (0) if (!&VMPS-Mac) { (0) if (!&VMPS-Mac) -> FALSE (0) mac2vlan: Added VMPS-VLAN-Name: 'TPS' to reply_items (0) [mac2vlan] = ok (0) update reply { (0) &VMPS-Packet-Type = VMPS-Join-Response (0) &VMPS-Cookie = &VMPS-Mac -> d4:be:d9:68:15:58 (0) &VMPS-VLAN-Name = "Guest" (0) } # update reply = noop (0) if (&VMPS-Packet-Type == VMPS-Reconfirm-Request){ (0) if (&VMPS-Packet-Type == VMPS-Reconfirm-Request) -> FALSE (0) linelog_vmps: EXPAND %S %{VMPS-Client-IP-Address} %{VMPS-Port-Name} %{VMPS-Packet-Type} %{VMPS-Mac} -> %{reply:VMPS-VLAN-Name} (0) linelog_vmps: --> 2017-06-28 17:21:53 127.0.0.1 Fa0/1 VMPS-Join-Request d4:be:d9:68:15:58 -> TPS (0) linelog_vmps: EXPAND /var/log/freeradius/vmps.log (0) linelog_vmps: --> /var/log/freeradius/vmps.log (0) [linelog_vmps] = ok (0) } # vmps = ok (0) Sent Access-Accept Id 4660 from 10.2.28.97:1589 to 192.168.30.82:41160 length 0 VMPS-VLAN-Name = "TPS" VMPS-Cookie = d4:be:d9:68:15:58 (0) Finished request (0) Cleaning up request packet ID 4660 with timestamp +3 Ready to process requests To distributed Debian configuration I did only * disabled proxy_requests in radiusd.conf * added to site-enabled vmps, removed default and inner-tunnel * removed all mods from mods-enabled and enable linelog-vmps and mac2vlan Any idea why there is second pass after 'Done VMPS'? Regards -- Zito

2 1