August 2017 - Freeradius-Users - lists.freeradius.org

django-freeradius
by Fiorella De Luca 01 Sep '17

01 Sep '17

Hi everyone, I am Fiorella De Luca and I am a participant of the Google Summer Code. During this three months, I have worked on an OpenWISP project regarding the creation of a freeradius web interface.This app, django-freeradius, is a web interface built in django that can be used to manipulate the data of a freeradius 3 database. The project offers a REST API which can (and should) be used with freeradius 3 rest module. It's not yet ready for production but we are close to completing the first phase. In these links you can find the main information about the project: - GSOC project summary: https://delucafiorella2602.blog/2017/08/28/google-summer-of-code-2017-djang… - Repository of the project: https://github.com/openwisp/django-freeradius - Documentation of the project: http://django-freeradius.readthedocs.io/en/latest/ If you are interested in trying it I would be glad to know your precious opinions and suggestions. Thank you! Fiorella De Luca

2 1

new table and query
by Johansson, Daniel (GIS) 31 Aug '17

31 Aug '17

Hi I use FreeRADIUS Version 2.2.6 I want to make a custom table and query for freeradius. sql is enabled in sites-enabled/default for 'post-auth {sql}' and postauth_query is populating radpostauth However my 'macuseradd_query ' is not run can anyone tell me why? I have inserted a new table to my mysql for radius 'authorizedmacs'. mysql> show tables; +------------------+ | Tables_in_radius | +------------------+ | authorizedmacs | | radacct | | radcheck | | radgroupcheck | | radgroupreply | | radpostauth | | radreply | | radusergroup | +------------------+ mysql> describe authorizedmacs; +------------+----------------------+------+-----+-------------------+-----------------------------+ | Field | Type | Null | Key | Default | Extra | +------------+----------------------+------+-----+-------------------+-----------------------------+ | id | smallint(5) unsigned | NO | PRI | NULL | auto_increment | | macaddress | varchar(12) | NO | MUL | NULL | | | created | timestamp | NO | | CURRENT_TIMESTAMP | on update CURRENT_TIMESTAMP | +------------+----------------------+------+-----+-------------------+-----------------------------+ I also added a entry in sql.conf macauth_table = "authorizedmacs" Then I created query in dailup.conf 'macuseradd_query ' ####################################################################### # Authentication Logging Queries ####################################################################### # postauth_query - Insert some info after authentication ####################################################################### postauth_query = "INSERT INTO ${postauth_table} \ (username, pass, reply, authdate) \ VALUES ( \ '%{User-Name}', \ '%{%{User-Password}:-%{Chap-Password}}', \ '%{reply:Packet-Type}', '%S')" macuseradd_query = "INSERT INTO ${macauth_table} \ (macaddress) \ VALUES ( \ '%{Calling-Station-Id}')" It would be much appreciated if anyone can tell me why macuseradd_query isn’t run as postauth_query is. BR /Daniel

5 11

Update on v4
by Alan DeKok 30 Aug '17

30 Aug '17

Version 4 has been under heavy development for the past year. The goal is to enable new features and new capabilities. Well, we're making progress. :) As background, in v4 proxying has been replaced by a "radius" module. The "radius" module sends RADIUS packets and waits (asynchronously) for a response. You can create one "radius" module for each home_server. e.g. radius home_server_1 { ... ip, port, secret, etc. } This also means that proxy.conf goes away (sorry), and that home_server_pools get replaced with "unlang": Home server pool *type = load-balance` gets replaced with 'unlang' load-balance { home_server_1 home_server_2 home_server_3 } Even better, you can now add proxying *anywhere*: if (User-Name == "bob") { home_server_1 } else if (User-Name == "doug") { home_server_2 } Or you can proxy multiple times: if (User-Name == "bob") { home_server_1 home_server_2 } Or catch proxy failures: home_server_1 if (fail) { linelog } Or (even more magically), proxy to multiple destinations at the same time: parallel { home_server_1 home_server_2 home_server_3 } i.e. it sends packets t home_server_1, then 2, then 3. It waits until it receives responses (or timeouts) from all of them. It then continues with processing the request. We're still not recommending average people install v4. There are some caveats which means it's best suited for people who know those caveats. But, the long wait has been worth it, I think. Things which used to be impossible in previous versions of the server are now *trivial* to do. The next step is to finalize the functionality which creates child requests. e.g. originate-coa, but more standardized. Once that's done, you should be able to do something like: if (... bandwidth exceeded...) { create child Disconnect-Request send to NAS } Which mimics the "originate-coa" functionality, but in 3 unlang statements. You can also take an Access-Request, and create one (or more) Accounting-Requests which are sent to home servers. The "radius" module also supports a "fire and forget" method, so that you can send packets to home servers, and continue without waiting for a response. We hope to release an alpha of version 4 this fall. Alan DeKok.

2 3

Freeradius and Winbindd Issue
by Kinglok Fong 30 Aug '17

30 Aug '17

Hi all, I am using freeradius 3.0.15. Samba version is 4.6.7. I compile both software on a Debian 9 machine. With nmbd and winbindd running flawlessly at the background, the domain user identification is working with using tools like wbinfo and id. However, when try to configure it with freeradius, it cannot authenticate. First of all, this configuration file: /usr/local/freeradius/etc/raddb/mods-enabled/mschap =============== winbind_username = “%{schap:User-Name}” winbind_domain = “SAMBADOM” #ntlm_auth = blahblahblah ============== Authentication was test using radtest =============== /usr/local/freeradius/bin/radtest -t mschap a_user thepassword 127.0.0.1 0 testing123 Sent Access-Request Id 191 from 0.0.0.0:39893 to 127.0.0.1:1812 length 129 User-Name = "a_user" MS-CHAP-Password = "thepassword" NAS-IP-Address = 192.168.107.7 NAS-Port = 0 Message-Authenticator = 0x00 Cleartext-Password = "thepassword" MS-CHAP-Challenge = 0xde5c70d1225f3f6c MS-CHAP-Response = 0x0001000000000000000000000000000000000000000000000000e1a8009205e77b1fbbf020022ba3e20b70df576b57c71971 Sent Access-Request Id 191 from 0.0.0.0:39893 to 127.0.0.1:1812 length 129 User-Name = "a_user" MS-CHAP-Password = "thepassword" NAS-IP-Address = 192.168.107.7 NAS-Port = 0 Message-Authenticator = 0x00 Cleartext-Password = "thepassword" MS-CHAP-Challenge = 0xde5c70d1225f3f6c MS-CHAP-Response = 0x0001000000000000000000000000000000000000000000000000e1a8009205e77b1fbbf020022ba3e20b70df576b57c71971 Sent Access-Request Id 191 from 0.0.0.0:39893 to 127.0.0.1:1812 length 129 User-Name = "a_user" MS-CHAP-Password = "thepassword" NAS-IP-Address = 192.168.107.7 NAS-Port = 0 Message-Authenticator = 0x00 Cleartext-Password = "thepassword" MS-CHAP-Challenge = 0xde5c70d1225f3f6c MS-CHAP-Response = 0x0001000000000000000000000000000000000000000000000000e1a8009205e77b1fbbf020022ba3e20b70df576b57c71971 (0) No reply from server for ID 191 socket 3 =================== log.winbindd (in log level 10) =================== [2017/08/29 15:03:44.139816, 10, pid=25544, effective(0, 0), real(0, 0), class=winbind] ../source3/winbindd/winbindd.c:761(process_request) process_request: request fn INTERFACE_VERSION [2017/08/29 15:03:44.141735, 3, pid=25544, effective(0, 0), real(0, 0), class=winbind] ../source3/winbindd/winbindd_misc.c:395(winbindd_interface_version) [25579]: request interface version (version = 28) [2017/08/29 15:03:44.143656, 10, pid=25544, effective(0, 0), real(0, 0), class=winbind] ../source3/winbindd/winbindd.c:864(winbind_client_response_written) winbind_client_response_written[25579:INTERFACE_VERSION]: delivered response to client [2017/08/29 15:03:44.145639, 10, pid=25544, effective(0, 0), real(0, 0), class=winbind] ../source3/winbindd/winbindd.c:761(process_request) process_request: request fn WINBINDD_PRIV_PIPE_DIR [2017/08/29 15:03:44.147727, 3, pid=25544, effective(0, 0), real(0, 0), class=winbind] ../source3/winbindd/winbindd_misc.c:428(winbindd_priv_pipe_dir) [25579]: request location of privileged pipe [2017/08/29 15:03:44.150965, 10, pid=25544, effective(0, 0), real(0, 0), class=winbind] ../source3/winbindd/winbindd.c:864(winbind_client_response_written) winbind_client_response_written[25579:WINBINDD_PRIV_PIPE_DIR]: delivered response to client [2017/08/29 15:03:44.153161, 6, pid=25544, effective(0, 0), real(0, 0), class=winbind] ../source3/winbindd/winbindd.c:919(new_connection) accepted socket 27 [2017/08/29 15:03:44.155338, 6, pid=25544, effective(0, 0), real(0, 0), class=winbind] ../source3/winbindd/winbindd.c:968(winbind_client_request_read) closing socket 25, client exited [2017/08/29 15:03:44.157538, 10, pid=25544, effective(0, 0), real(0, 0), class=winbind] ../source3/winbindd/winbindd.c:734(process_request) process_request: Handling async request 25579:GETGROUPS [2017/08/29 15:03:44.159669, 3, pid=25544, effective(0, 0), real(0, 0), class=winbind] ../source3/winbindd/winbindd_getgroups.c:60(winbindd_getgroups_send) getgroups freerad [2017/08/29 15:03:44.162646, 1, pid=25544, effective(0, 0), real(0, 0)] ../librpc/ndr/ndr.c:468(ndr_print_function_debug) wbint_LookupName: struct wbint_LookupName in: struct wbint_LookupName domain : * domain : 'SAMBADOM' name : * name : 'FREERAD' flags : 0x00000008 (8) [2017/08/29 15:03:44.171620, 1, pid=25544, effective(0, 0), real(0, 0)] ../librpc/ndr/ndr.c:468(ndr_print_function_debug) wbint_LookupName: struct wbint_LookupName out: struct wbint_LookupName type : * type : SID_NAME_USE_NONE (0) sid : * sid : S-0-0 result : NT_STATUS_NONE_MAPPED [2017/08/29 15:03:44.180970, 5, pid=25544, effective(0, 0), real(0, 0), class=winbind] ../source3/winbindd/winbindd_getgroups.c:235(winbindd_getgroups_recv) Could not convert sid S-0-0: NT_STATUS_NONE_MAPPED [2017/08/29 15:03:44.183154, 10, pid=25544, effective(0, 0), real(0, 0), class=winbind] ../source3/winbindd/winbindd.c:796(wb_request_done) wb_request_done[25579:GETGROUPS]: NT_STATUS_NONE_MAPPED [2017/08/29 15:03:44.192083, 10, pid=25544, effective(0, 0), real(0, 0), class=winbind] ../source3/winbindd/winbindd.c:864(winbind_client_response_written) winbind_client_response_written[25579:GETGROUPS]: delivered response to client ============== When I switch back using ntlm_auth instead, it is working flawlessly. Hope someone would help. Thanks for attending. Kinglok, Fong

4 10

django-freeradius
by Fiorella De Luca 29 Aug '17

29 Aug '17

Hi everyone, I am Fiorella De Luca and I am a participant of the Google Summer Code. During this three months, I have worked on an OpenWISP project regarding the creation of a freeradius web interface.This app, django-freeradius, is a web interface built in django that can be used to manipulate the data of a freeradius 3 database. The project offers a REST API which can (and should) be used with freeradius 3 rest module. It's not yet ready for production but we are close to completing the first phase. In these links you can find the main information about the project: GSOC project summary: https://delucafiorella2602.blog/2017/08/28/google-summer-of-code-2017-djang… .Repository of the project: https://github.com/openwisp/django-freeradius .Documentation of the project: http://django-freeradius.readthedocs.io/en/latest/ . If you are interested in trying it I would be glad to know your precious opinions and suggestions. Thank you! Fiorella De Luca

1 0

RE: How to log Access-Accept reply attributes/values in radpostauth sql
by James Wood 27 Aug '17

27 Aug '17

Thanks for the replies. I can use %{pairs:reply:} and it provides: "Acct-Interim-Interval =3D 120=2C Session-Timeout =3D 86400" But this doesn't look nice in the DB as it gets inserted exactly like that. Is there a way to unescape the quoted printable text to that =3D is actually = for example? I tried %{unescape:%{pairs:reply:}} but I didn't change it. Thanks James

3 2

How to log Access-Accept reply attributes/values in radpostauth sql
by James Wood 26 Aug '17

26 Aug '17

Hi All FR 3.0.13. Everything working perfectly, including SQL (mysql) for auth/acct logging. When a user authenticates, I would like to log any Access-Accept reply attributes we've set to sql (radpostauth). For example, my typical Access-Accept looks like this: Access-Accept (2), id: 0x2f, Authenticator: 123 Session-Timeout Attribute (27), length: 6, Value: 86400 Idle-Timeout Attribute (28), length: 6, Value: 600 Acct-Interim-Interval Attribute (85), length: 6, Value: 300 Therefore, I would like to log anything that was sent back to the NAS to the DB, in this instance: "Session-Timeout=86400,Idle-Timeout=600,Acct-Interim-Interval=300" or some other format as long as the data is readable... Is that possible? I tried using something like the below in the queries file: post-auth { query = "\ INSERT INTO ${..postauth_table} \ (username, pass, reply, authdate, callingstationid, calledstationid, attributes) \ VALUES ( \ '%{SQL-User-Name}', \ '%{%{User-Password}:-%{Chap-Password}}', \ '%{reply:Packet-Type}', \ '%S', \ '%{Calling-Station-Id}', \ '%{Called-Station-Id}', \ '%{reply:[*]}')" But doesn't appar I can use %{reply[*]} in that way. Thanks James

4 4

vlan assignment
by Zenon Matuszyk 25 Aug '17

25 Aug '17

Hello, I have a problem with vlan assignment on the group. If user is in group wi-fi should get ip with vlan 200 if it is in another group should get ip with vlan 216. I attach file witch freeradius -X. Users and group are in SAMBA4. If i login to wifi i get allways ip on vlan 216. I use login(a)mydomain.pl to connect wifi. I try add in users but this is ignored root@LDAP1 /etc/freeradius # cat users DEFAULT LDAP-Group != "wi-fi", Auth-Type:=Reject Reply-Message="You are not allowed to connnect" DEFAULT Realm == Null Auth-Type := Reject DEFAULT Realm == NULL, Client-IP-Address == 14x.xxx.x.40 Auth-Type := Reject DEFAULT Realm == NULL, Client-IP-Address == 14x.xxx.x.66 Auth-Type := Reject DEFAULT LDAP-Group == "wi-fi" Reply-Message="XXXX HIT: wi-fi", Tunnel-Private-Group-Id := 200, Tunnel-Type = VLAN, Tunnel-Medium-Type = IEEE-802, Please help -- Z poważaniem / Yours sincerely Zenon Matuszyk mobile: 00 48 797 004 938 e-mail: zenon.matuszyk(a)networkers.pl www: http://www.networkers.pl

2 3

Error: Discarding duplicate request from client
by Ceferli Asef 25 Aug '17

25 Aug '17

Hi Colleagues, I encountered such a problem. What are you think, What is the reason this error?: Error: Discarding duplicate request from client BRAS № port № - ID: № due to unfinished request № in component authorize module sql. Please help me to solve this problem. Best regards, Asaf Jafarli | System Administrator Aztelekom LLC Address: 187, Tbilisi str., AZ1122, Baku, Azerbaijan Mobile : +994517487671 <http://aztelekom.net/cabinet/assets/images/logos/logo.png>

2 1

About service down when the number of sessions exceeded
by Seiichirou Hiraoka 25 Aug '17

25 Aug '17

Hello. I use the following version with RHEL 7. # rpm -qa | grep freeradius freeradius-3.0.4-6.el7.x86_64 freeradius-utils-3.0.4-6.el7.x86_64 freeradius-mysql-3.0.4-6.el7.x86_64 We set max_sessions to the default 1024, and when there are many users, radiusd forcibly shut down after outputting the following message. - /var/log/radius/radius.log Tue Jun 13 15:06:01 2017 : Error: rlm_eap (EAP): Too many open sessions. Try increasing "max_sessions" in the EAP moduleconfiguration Increasing the value of max_sessions now works without problems. Here, I have a question. I think that an error message is output in the following part of the source code, Change not to accept requests, not forced shutdown Is there a way? freeradius-server-3.0.4/src/modules/rlm_eap/mem.c ----- ... Done: / * * We do not need this any more. * / If (status> 0) handler-> request = NULL; PTHREAD_MUTEX_UNLOCK (& (inst -> session_mutex)); If (status <= 0) { Pairfree (& state); If (status <0) { Static time_t last_logged = 0; If (last_logged <handler-> timestamp) { Last_logged = handler-> timestamp; ERROR ("rlm_eap (% s): Too many open sessions. Try increasing \" max_sessions \ "" "In the EAP module configuration", inst-> xlat_name); } } Else { ERROR ("rlm_eap (% s): Failed to store handler", inst-> xlat_name); } Return 0; } ----- Thank you.

2 2