July 2017 - Freeradius-Users - lists.freeradius.org

Missing groupname in radacct table
by Antonio Silva 21 Jul '17

21 Jul '17

Hi all, I've set the account query to include the groupname in radacct table but it expand the %{SQL-Group} to empty... any idea what i'm doing wrong? You can check the full configuration used for accounting in https://pastebin.com/dnEQRwUf But in resume i do: INSERT INTO ${....acct_table1} \ (${...column_list}) \ VALUES \ ('%{Acct-Session-Id}', \ '%{Acct-Unique-Session-Id}', \ '%{SQL-User-Name}', \ '%{SQL-Group}', \ '%{Realm}', \ ... In the log when authentication is done is see the group been set... But it inserts the groupname empty... (0) sql: Executing select query: SELECT groupname FROM radusergroup WHERE username = 'MyUSER' ORDER BY priority (0) sql: User found in the group table (0) sql: EXPAND SELECT id, groupname, attribute, Value, op FROM radgroupcheck WHERE groupname = '%{SQL-Group}' ORDER BY id (0) sql: --> SELECT id, groupname, attribute, Value, op FROM radgroupcheck WHERE groupname = 'group2' ORDER BY id (0) sql: Executing select query: SELECT id, groupname, attribute, Value, op FROM radgroupcheck WHERE groupname = 'group2' ORDER BY id (0) sql: Group "group2": Conditional check items matched (0) sql: Group "group2": Merging assignment check items (0) sql: Simultaneous-Use := 100 (0) sql: EXPAND SELECT id, groupname, attribute, value, op FROM radgroupreply WHERE groupname = '%{SQL-Group}' ORDER BY id (0) sql: --> SELECT id, groupname, attribute, value, op FROM radgroupreply WHERE groupname = 'group2' ORDER BY id (0) sql: Executing select query: SELECT id, groupname, attribute, value, op FROM radgroupreply WHERE groupname = 'group2' ORDER BY id (0) sql: Group "group2": Merging reply items ... (1) sql: EXPAND INSERT INTO radacct (acctsessionid, acctuniqueid, username, groupname, realm, nasipaddress, nasportid, nasporttype, acctstarttime, acctupdatetime, acctstoptime, acctsessiontime, acctauthentic, connectinfo_start, connectinfo_stop, acctinputoctets, acctoutputoctets, calledstationid, callingstationid, acctterminatecause, servicetype, framedprotocol, framedipaddress) VALUES ('%{Acct-Session-Id}', '%{Acct-Unique-Session-Id}', '%{SQL-User-Name}', '%{SQL-Group}', '%{Realm}', '%{NAS-IP-Address}', '%{%{NAS-Port-ID}:-%{NAS-Port}}', '%{NAS-Port-Type}', FROM_UNIXTIME(%{integer:Event-Timestamp}), FROM_UNIXTIME(%{integer:Event-Timestamp}), NULL, '0', '%{Acct-Authentic}', '%{Connect-Info}', '', '0', '0', '%{Called-Station-Id}', '%{Calling-Station-Id}', '', '%{Service-Type}', '%{Framed-Protocol}', '%{Framed-IP-Address}') (1) sql: --> INSERT INTO radacct (acctsessionid, acctuniqueid, username, groupname, realm, nasipaddress, nasportid, nasporttype, acctstarttime, acctupdatetime, acctstoptime, acctsessiontime, acctauthentic, connectinfo_start, connectinfo_stop, acctinputoctets, acctoutputoctets, calledstationid, callingstationid, acctterminatecause, servicetype, framedprotocol, framedipaddress) VALUES ('5971E477290A00', '3a3680e379da33a7ad1c8436a1f049ed', 'MyUSER', '', '', '127.0.1.1', '0', 'Async', FROM_UNIXTIME(1500636279), FROM_UNIXTIME(1500636279), NULL, '0', 'RADIUS', '', '', '0', '0', 'L2TP:telework_sol1', '', '', 'Framed-User', 'PPP', '192.168.10.200') (1) sql: Executing query: INSERT INTO radacct (acctsessionid, acctuniqueid, username, groupname, realm, nasipaddress, nasportid, nasporttype, acctstarttime, acctupdatetime, acctstoptime, acctsessiontime, acctauthentic, connectinfo_start, connectinfo_stop, acctinputoctets, acctoutputoctets, calledstationid, callingstationid, acctterminatecause, servicetype, framedprotocol, framedipaddress) VALUES ('5971E477290A00', '3a3680e379da33a7ad1c8436a1f049ed', 'MyUSER', '', '', '127.0.1.1', '0', 'Async', FROM_UNIXTIME(1500636279), FROM_UNIXTIME(1500636279), NULL, '0', 'RADIUS', '', '', '0', '0', 'L2TP:telework_sol1', '', '', 'Framed-User', 'PPP', '192.168.10.200') -- Saludos / Regards / Cumprimentos, António silva

2 2

Rotating detail files.
by Alex Sharaz 21 Jul '17

21 Jul '17

FR 3.0.14 Ubuntu 16.04 I'm creating a detail file which is used by an agent to upload contents into our logstash. detail detail-filebeat{ filename = /var/spool/freeradius/detail-filebeat escape_filenames = no permissions = 0600 # group = ${security.group} header = "%t" locking = yes suppress { User-Password } detail-fileberat invoked in both default and inner-tunnel sites Logrotate configured as /var/spool/freeradius/detail-filebeat { rotate 1 postrotate /bin/kill -HUP `cat /var/run/freeradius/freeradius.pid` endscript } Problem is that although logrotate rotates the file, freeradius isn't writing to the newly created file. A FR restart sorts it out but I'd rather not restart the server every day. I'm using radmin on another server to reread files periodically, might I be able to persuade FR to write to the new file via radadmin ? Rgds Alex

2 2

MySQL DB and /n in Cisco-AVPair problem
by Andy Smith 20 Jul '17

20 Jul '17

Hi everyone, we are attempting to migrate a system from FreeRadius 1.x to 3.x and we have an issue with our Cisco network devices. Basically authentication fails. Stepping back a bit and doing some testing with NTRadPing everything looks ok, except for one small detail. With both the 1.x and 3.x systems we get "response: Access-Accept" and a load of details such as Service-Type, Tunnel-Password etc. However I see differences for non printing characters such as "/n". So for the Cisco-AVPair in the output in NTRadPing I see on 1.x: lcp:interface-config=ip unnumbered loopback 2003\n But on 3.x I see: lcp:interface-config=ip unnumbered loopback 2003\0x0a The output from 1.x is exactly how the data is entered and displays direct in MySQL. I've tried double escaping the "\" but it doesn't make any difference. I see that 0x0a is the ASCII encoding for \n, has something changed in FreeRadius WRT this? Or perhaps its an issue at the MySQL level? I also note the output for the Tunnel-Password displays differently between 1.x and 3.x. I'm testing this on FreeBSD 11.0 and FreeRadius 3.0.14 and MySQL 8.0 (although I've previously encountered this issue with 5.x), thanks, Andy.

3 8

Discarding conflicting packet due to recent request
by khouzam yaghi 20 Jul '17

20 Jul '17

i am receiving this error from time to time in the radius log Error: Discarding conflicting packet from client PPPOE1 port 33184 - ID: 1 due to recent request i searched online and found very old posts about this error, what does it mean? is it something related to the database slow? or broken NAS? my NAS is a Linux server running accel-ppp as a pppoe-server. is this something related to the NAS itself or to my configuration with freeradius? also what does this error means? Regards.

2 1

Arris CMTS attributes
by Kalil de A. Carvalho 20 Jul '17

20 Jul '17

Hello all. I'm trying configure a FreeRADIUS to centralize all my devices authentication, it is a simple configuration, I guess. But one of my vendors is Arris and my device is a CMTS, more specifically CMTS_V08.02.01.07. What I want to do is just pass the user level but I looked for this attributes and not found in any site. I tryed to search some examples but I did not have any sucesses. Does any one has this kind of configuration, more precisely, one example of the users file? Here my environment: S.O: CentOS 7 FreeRADIUS version: Version 3.0.4, for host x86_64-redhat-linux-gnu Best regards -- Atenciosamente, Kalil de A. Carvalho

2 3

use detail file to proxy Access-Request
by adrian.p.smith＠bt.com 20 Jul '17

20 Jul '17

For some testing we are doing it's desirable to send some existing Access-Request traffic to an additional remote server. For Accounting we routinely use a detail file with an associated listening server to achieve this. Looking at the source code, it appears that a detail file listener throws access requests away. Is there any other way to get this working please? Regards, Adrian

2 1

Version 3.0.15 and 2.2.10 have been released.
by Alan DeKok 19 Jul '17

19 Jul '17

Guido Vranken found some issues with OpenVPN, so I asked him to look at FreeRADIUS. The good news is we're releasing new versions of the server. The bad news is he found things: http://freeradius.org/security/fuzzer-2017.html The various vendors have already been notified, and should have patches ready. Alan DeKok.

7 15

Stuck on EAP-challenge remote client version 3.0.15
by Mathieu Devos 19 Jul '17

19 Jul '17

Hello, Finally managed to get the full installation running, and got a local user test to pass the system. This works very smoothly with user-identity and user-password. The commands that work are the following: radtest alice alice localhost 0 testing123 radtest -t eap-md5 alice alice localhost 0 testing123 However trying to run this from a remote client passes the authorize, however the autehnticate seems to get stuck in a challenge <> request loop. Pastebin of radiusd -X is available here: https://pastebin.com/ePFCQhtF First ones are me remotely trying (with the built in test on the client AP, and on my phone), last one is a straightforward radtest localhost. Note that this same setup was used on freeradius 2.x in a previous build and was confirmed to be working. BR, Mathieu

3 3

Informix error in "id" field ?
by vanish 19 Jul '17

19 Jul '17

Hi all! 1. I have freeradius v3.0.12, iodbc and informix database. 2. In informix i have tables - "accounts" with users logins and "acct_details" with passwords. 3. One user (login) can have 2 or more passwords in "acct_details" table. 4. Fields in tables: ...accounts... - fscontrol VARCHAR (64) NOT NULL, - this is username ...acct_details... - fiacct_dtl_id SERIAL, - fspassword VARCHAR(64)NOT NULL, 5. My radcheck_query: authorize_check_query = "\ SELECT p.fiacct_dtl_id id, '%{SQL-User-Name}' username, \ 'Cleartext-Password' attribute, trim(p.fspassword) value,':=' op \ FROM accounts a inner join acct_details p on a.fiaccount_id = \ p.fiaccount_id \ WHERE a.fscontrol = '%{SQL-User-Name}'" 6. In debug i see: Debug: (2) pppoe: Executing select query: SELECT p.fiacc_dtl_id id, '0015w' username, 'Cleartext-Password' attribute, trim(p.fspassword) value, ':=' op FROM accounts a inner join acct_details p on a.fiaccount_id = p.fiaccount_id WHERE a.fscontrol = '0015w' ERROR: (2) pppoe: Invalid op "??s???" for attribute ??s??? ERROR: (2) pppoe: Error parsing user data from database result ERROR: (2) pppoe: Error getting check attributes Debug: rlm_sql (pppoe): Released connection (3) Debug: (2) modsingle[authorize]: returned from pppoe (rlm_sql) Debug: (2) [pppoe] = fail Debug: (2) } # authorize = fail In informix cli i see next result for query: "id" ; username ; attribute ; value ; op "2567890"; 0015w ; Cleartext-Password ; password ; := 7. If replace "p.fiacct_dtl_id id" on "1 id" in query, then everything work fine. Where can be the problem?

2 1

Installation failure during make and general confusion
by Mathieu Devos 19 Jul '17

19 Jul '17

Hello, Recently started as a part time system admin at this work, and in an effort to upgrade our systems we're looking at installing a RADIUS server. We only have 1 office, with around 50 employees, who all have the same access rights (just plain Internet access). As such the idea is to set up a very straightforward authentication RADIUS server, no need for accounting yet. My eye spotted freeradius, and I've started working with it. Throughout the Internet I found a mixed bag of tutorials (quite confusing tbh) who mostly all suggest to run apt-get install freeradius and just work with that. Now I've tried that but ran into issues when moving towards TTLS (maybe another email will follow once I have set that up). I also found the git repo, and have cloned this (I'm on the v4 branch), however, the ./configure runs properly fine. I have attempted to run the ./configure as both normal user, and as root, both with the same output (they complete). However running the make is where issues arise. I'm not getting very far in this entire endeavor. CC src/protocols/dhcpv4/packet.c In file included from src/protocols/dhcpv4/packet.c:31:0: src/freeradius-devel/dhcpv4/dhcpv4.h:138:1: error: unknown type name ‘RADIUS_PACKET’ RADIUS_PACKET *fr_dhcpv4_udp_packet_recv(int sockfd); ^ src/freeradius-devel/dhcpv4/dhcpv4.h:139:31: error: unknown type name ‘RADIUS_PACKET’ int fr_dhcpv4_udp_packet_send(RADIUS_PACKET *packet); ^ src/freeradius-devel/dhcpv4/dhcpv4.h:146:1: error: unknown type name ‘RADIUS_PACKET’ RADIUS_PACKET *fr_dhcpv4_packet_ok(uint8_t const *data, ssize_t data_len, fr_ipaddr_t src_ipaddr, ^ src/freeradius-devel/dhcpv4/dhcpv4.h:169:30: error: unknown type name ‘RADIUS_PACKET’ int fr_dhcpv4_packet_decode(RADIUS_PACKET *packet); ^ src/freeradius-devel/dhcpv4/dhcpv4.h:171:30: error: unknown type name ‘RADIUS_PACKET’ int fr_dhcpv4_packet_encode(RADIUS_PACKET *packet); ^ In file included from src/protocols/dhcpv4/packet.c:31:0: src/freeradius-devel/dhcpv4/dhcpv4.h:180:70: error: unknown type name ‘RADIUS_PACKET’ int fr_dhcpv4_raw_packet_send(int sockfd, struct sockaddr_ll *p_ll, RADIUS_PACKET *packet); ^ src/freeradius-devel/dhcpv4/dhcpv4.h:182:1: error: unknown type name ‘RADIUS_PACKET’ RADIUS_PACKET *fr_dhcv4_raw_packet_recv(int sockfd, struct sockaddr_ll *p_ll, RADIUS_PACKET *request); ^ src/freeradius-devel/dhcpv4/dhcpv4.h:182:79: error: unknown type name ‘RADIUS_PACKET’ RADIUS_PACKET *fr_dhcv4_raw_packet_recv(int sockfd, struct sockaddr_ll *p_ll, RADIUS_PACKET *request); ^ src/protocols/dhcpv4/packet.c:101:29: error: unknown type name ‘RADIUS_PACKET’ int fr_dhcpv4_packet_decode(RADIUS_PACKET *packet) ^ src/protocols/dhcpv4/packet.c:295:29: error: unknown type name ‘RADIUS_PACKET’ int fr_dhcpv4_packet_encode(RADIUS_PACKET *packet) ^ scripts/boiler.mk:635: recipe for target '/home/vagrant/freeradius-server/build/objs/src/protocols/dhcpv4/packet.lo' failed make: *** [/home/vagrant/freeradius-server/build/objs/src/protocols/dhcpv4/packet.lo] Error 1 this is the output I'm getting from make. As such my questions are the following: 1) how to fix this issue? 2) should I just ignore the entire git repo and straightforward run apt-get install freeradius BR, Mathieu

4 4