October 2018 - Freeradius-Users - lists.freeradius.org

Installing freeRADIUS 3.0.17 on centos
by Raghu nathan 30 Oct '18

30 Oct '18

*Hello Team,* I tried installing freeradius using ubuntu 18.04 and we get 3.0.17 version, when we tried using centos 7 we are ending up with 3.0.13. I tried using source code but end up with lot other issues. Could you please suggest how should I install newer version using centos 7? Or what is the best OS (based on performance) to use freeRADIUS. Regards, Raghu.

2 1

Release of the IP after the Acct-Stop (ippool)
by Lars Hillebrand 29 Oct '18

29 Oct '18

Hello everyone, I have a question regarding the release of IP addresses with the module ippool. We are about to replace our old Feeradius 2.2.8 with a new 3.0.16 installation. This worked very well, but there is still a problem with the release of the IP pools after the Acct-Stop. The corresponding "Acct-Status-Type = Stop" packets arrive correctly at the radius, but the evaluation is exited after the first "ippool area" within which no IP is found. (unabridged debug log in appendix —> debug_1) (6079) Mon Oct 29 14:40:20 2018: Debug: User-Name = "user1" (6079) Mon Oct 29 14:40:20 2018: Debug: NAS-Port = 202153984 (6079) Mon Oct 29 14:40:20 2018: Debug: Service-Type = Framed-User (6079) Mon Oct 29 14:40:20 2018: Debug: Framed-Protocol = PPP (6079) Mon Oct 29 14:40:20 2018: Debug: Framed-IP-Address = 10.99.157.108 (6079) Mon Oct 29 14:40:20 2018: Debug: Called-Station-Id = "193.25.18.219" (6079) Mon Oct 29 14:40:20 2018: Debug: Calling-Station-Id = "109.90.177.240" (6079) Mon Oct 29 14:40:20 2018: Debug: Acct-Status-Type = Stop (6079) Mon Oct 29 14:40:20 2018: Debug: Acct-Delay-Time = 0 (6079) Mon Oct 29 14:40:20 2018: Debug: Acct-Input-Octets = 5152 (6079) Mon Oct 29 14:40:20 2018: Debug: Acct-Output-Octets = 11550 (6079) Mon Oct 29 14:40:20 2018: Debug: Acct-Session-Id = "6DC02E18" (6079) Mon Oct 29 14:40:20 2018: Debug: Acct-Authentic = RADIUS (6079) Mon Oct 29 14:40:20 2018: Debug: Acct-Session-Time = 19 (6079) Mon Oct 29 14:40:20 2018: Debug: Acct-Input-Packets = 79 (6079) Mon Oct 29 14:40:20 2018: Debug: Acct-Output-Packets = 15 (6079) Mon Oct 29 14:40:20 2018: Debug: Acct-Terminate-Cause = User-Request (6079) Mon Oct 29 14:40:20 2018: Debug: NAS-Port-Type = Virtual ... (6079) Mon Oct 29 14:40:20 2018: Debug: accounting { (6079) Mon Oct 29 14:40:20 2018: Debug: detail: EXPAND /var/log/freeradius/radacct/%{%{Packet-Src-IP-Address}:-%{Packet-Src-IPv6-Address}}/detail-%Y%m%d (6079) Mon Oct 29 14:40:20 2018: Debug: detail: --> /var/log/freeradius/radacct/193.25.18.219/detail-20181029 (6079) Mon Oct 29 14:40:20 2018: Debug: detail: /var/log/freeradius/radacct/%{%{Packet-Src-IP-Address}:-%{Packet-Src-IPv6-Address}}/detail-%Y%m%d expands to /var/log/freeradius/radacct/193.25.18.219/detail-20181029 (6079) Mon Oct 29 14:40:20 2018: Debug: detail: EXPAND %t (6079) Mon Oct 29 14:40:20 2018: Debug: detail: --> Mon Oct 29 14:40:20 2018 (6079) Mon Oct 29 14:40:20 2018: Debug: [detail] = ok (6079) Mon Oct 29 14:40:20 2018: Debug: [unix] = ok (6079) Mon Oct 29 14:40:20 2018: Debug: FB1-B: EXPAND %{NAS-IP-Address} %{NAS-Port} (6079) Mon Oct 29 14:40:20 2018: Debug: FB1-B: --> 193.25.18.219 202153984 (6079) Mon Oct 29 14:40:20 2018: Debug: FB1-B: MD5 on 'key' directive maps to: 8c9ebba43c49461c579616773eb1d008 (6079) Mon Oct 29 14:40:20 2018: Debug: FB1-B: Searching for an entry for key: '193.25.18.219 202153984' (6079) Mon Oct 29 14:40:20 2018: Debug: FB1-B: Entry not found (6079) Mon Oct 29 14:40:20 2018: Debug: [FB1-B] = notfound (6079) Mon Oct 29 14:40:20 2018: Debug: } # accounting = notfound (6079) Mon Oct 29 14:40:20 2018: Debug: Not sending reply to client. (6079) Mon Oct 29 14:40:20 2018: Debug: Finished request (6079) Mon Oct 29 14:40:21 2018: Debug: Cleaning up request packet ID 132 with timestamp +76 If we adjust the order of the ippools in the site-availiable configuration so that the used area is in first place, it will be evaluated correctly at the Acct-Stop and the IP address will be released but the evaluation will jump out again after the first pool without an entry. (unabridged debug log in appendix —> debug_2) (2931) Mon Oct 29 14:45:52 2018: Debug: Received Accounting-Request Id 149 from 193.25.18.219:38622 to 10.100.16.162:2011 length 213 (2931) Mon Oct 29 14:45:52 2018: Debug: User-Name = "user1" (2931) Mon Oct 29 14:45:52 2018: Debug: NAS-Port = 202162176 (2931) Mon Oct 29 14:45:52 2018: Debug: Service-Type = Framed-User (2931) Mon Oct 29 14:45:52 2018: Debug: Framed-Protocol = PPP (2931) Mon Oct 29 14:45:52 2018: Debug: Framed-IP-Address = 10.99.156.54 (2931) Mon Oct 29 14:45:52 2018: Debug: Called-Station-Id = "193.25.18.219" (2931) Mon Oct 29 14:45:52 2018: Debug: Framed-IP-Address = 10.99.156.54 (2931) Mon Oct 29 14:45:52 2018: Debug: Called-Station-Id = "193.25.18.219" (2931) Mon Oct 29 14:45:52 2018: Debug: Calling-Station-Id = "109.90.177.240" (2931) Mon Oct 29 14:45:52 2018: Debug: Acct-Status-Type = Stop (2931) Mon Oct 29 14:45:52 2018: Debug: Acct-Delay-Time = 0 (2931) Mon Oct 29 14:45:52 2018: Debug: Acct-Input-Octets = 2747 (2931) Mon Oct 29 14:45:52 2018: Debug: Acct-Output-Octets = 2789 (2931) Mon Oct 29 14:45:52 2018: Debug: Acct-Session-Id = "6DC02E1B" (2931) Mon Oct 29 14:45:52 2018: Debug: Acct-Authentic = RADIUS (2931) Mon Oct 29 14:45:52 2018: Debug: Acct-Session-Time = 6 (2931) Mon Oct 29 14:45:52 2018: Debug: Acct-Input-Packets = 43 (2931) Mon Oct 29 14:45:52 2018: Debug: Acct-Output-Packets = 6 (2931) Mon Oct 29 14:45:52 2018: Debug: Acct-Terminate-Cause = User-Request (2931) Mon Oct 29 14:45:52 2018: Debug: NAS-Port-Type = Virtual ... (2931) Mon Oct 29 14:45:52 2018: Debug: accounting { (2931) Mon Oct 29 14:45:52 2018: Debug: detail: EXPAND /var/log/freeradius/radacct/%{%{Packet-Src-IP-Address}:-%{Packet-Src-IPv6-Address}}/detail-%Y%m%d (2931) Mon Oct 29 14:45:52 2018: Debug: detail: --> /var/log/freeradius/radacct/193.25.18.219/detail-20181029 (2931) Mon Oct 29 14:45:52 2018: Debug: detail: /var/log/freeradius/radacct/%{%{Packet-Src-IP-Address}:-%{Packet-Src-IPv6-Address}}/detail-%Y%m%d expands to /var/log/freeradius/radacct/193.25.18.219/detail-20181029 (2931) Mon Oct 29 14:45:52 2018: Debug: detail: EXPAND %t (2931) Mon Oct 29 14:45:52 2018: Debug: detail: --> Mon Oct 29 14:45:52 2018 (2931) Mon Oct 29 14:45:52 2018: Debug: [detail] = ok (2931) Mon Oct 29 14:45:52 2018: Debug: [unix] = ok (2931) Mon Oct 29 14:45:52 2018: Debug: DVZ-S: EXPAND %{NAS-IP-Address} %{NAS-Port} (2931) Mon Oct 29 14:45:52 2018: Debug: DVZ-S: --> 193.25.18.219 202162176 (2931) Mon Oct 29 14:45:52 2018: Debug: DVZ-S: MD5 on 'key' directive maps to: e1441074cac9707ffe85004a796a5062 (2931) Mon Oct 29 14:45:52 2018: Debug: DVZ-S: Searching for an entry for key: '193.25.18.219 202162176' (2931) Mon Oct 29 14:45:52 2018: Debug: DVZ-S: Deallocated entry for ip: 10.99.156.54 (2931) Mon Oct 29 14:45:52 2018: Debug: DVZ-S: Allocated count now: 0 (2931) Mon Oct 29 14:45:52 2018: Debug: [DVZ-S] = ok (2931) Mon Oct 29 14:45:52 2018: Debug: Gaeste: EXPAND %{NAS-IP-Address} %{NAS-Port} (2931) Mon Oct 29 14:45:52 2018: Debug: Gaeste: --> 193.25.18.219 202162176 (2931) Mon Oct 29 14:45:52 2018: Debug: Gaeste: MD5 on 'key' directive maps to: e1441074cac9707ffe85004a796a5062 (2931) Mon Oct 29 14:45:52 2018: Debug: Gaeste: Searching for an entry for key: '193.25.18.219 202162176' (2931) Mon Oct 29 14:45:52 2018: Debug: Gaeste: Entry not found (2931) Mon Oct 29 14:45:52 2018: Debug: [Gaeste] = notfound (2931) Mon Oct 29 14:45:52 2018: Debug: } # accounting = notfound (2931) Mon Oct 29 14:45:52 2018: Debug: Not sending reply to client. (2931) Mon Oct 29 14:45:52 2018: Debug: Finished request (2931) Mon Oct 29 14:45:52 2018: Debug: Cleaning up request packet ID 149 with timestamp +42 Does anyone know a similar behavior and has a tip for us? The unabridged debug logs and the corresponding sites-available configuration (vpn) can be found in the appendix. Many thanks in advance! Yours sincerely Lars Hillebrand __ Fachhochschule Dortmund University of Applied Sciences and Arts Dipl.-Ing. (FH) Lars Hillebrand Dez. VI, IT-Basisdienste Sonnenstraße 100 - 44139 Dortmund Raum SON D 008 Tel 0231 9112-253 Fax 0231 9112-338 lars.hillebrand(a)fh-dortmund.de www.fh-dortmund.de

2 3

Remove double quotes from variable
by Raghu nathan 29 Oct '18

29 Oct '18

We are calling %{Module-Failure-Message} in linelog and trying to create JSON logs. But we are getting sometime error with double quotes, which is creating issue on JSON spec. For example, In linelog messages we have below entry Access-Reject = "{\"Datetime\":\"%t\",\ \"Packet-Type\":\"%{reply:Packet-Type}\",\ \"User-Name\":\"%{User-Name}\",\ \"Module-Failure-Message\":\"%{Module-Failure-Message}\"\ }" We are getting the logs as {"Datetime":"Fri Oct 26 09:07:17 2018","Packet-Type":"Access-Reject","User-Name":"CONSUMER4.TATA","Module-Failure-Message":"pap: Cleartext password "WRONG-PASSWORD" does not match "known good" password"} In the Module-Failure-Message output we are receiving the message with double quotes which is not as per JSON standard. Please let me know how I can solve the issue without doing any coding. Regards, Raghu.

3 3

Connect static ip with freeradius (ip -> address)
by One Zero Art 27 Oct '18

27 Oct '18

Hi, I'm new to freeradius and Mikrotik. I need some help to connect Mikrotik static ip users to freeradius. I have set static IP users on Mikrotik by going ip -> address then add IP address there also I setup same IP address on pc. I am trying to set radius for these users but I am not sure which service to check. Is it DHCP or login or IPsec. Can you please help me. Did I miss something? Thank you

2 3

Linelog not creating file in /var/log
by Raghu nathan 26 Oct '18

26 Oct '18

We are using v3.0.13 - We have enabled the linelog but its not creating any log file under /var/log. - We kept no change in linelog module. Is there anything we need to enable to make it work? ******* # Loading module "linelog" from file /etc/raddb/mods-enabled/linelog linelog { filename = "/var/log/radius/linelog" escape_filenames = no syslog_facility = "auth" syslog_severity = "info" permissions = 384 group = "radiusd" format = "This is a log message for %{User-Name}" reference = "messages.%{%{reply:Packet-Type}:-default}" } ******* Regards, Raghu.

2 2

help
by Diwakar Bhardwaj 25 Oct '18

25 Oct '18

I'm just trying to use Redis DB with radius server by default it uses MySQL server for authentication and authorization. I tried by changing the default config (used redis instead of sql) but it didn't work, it complains like "*redis" modules aren't allowed in 'authorization' sections -- they have no such method*". I am just wanted to know What are the config changes are required for that? I haven't found any such documentation that explains it. Can anyone please help with this?

2 1

Error: Unresponsive child for request
by CALMELS, Thierry (SOGETI REGIONS SAS) 25 Oct '18

25 Oct '18

Hello freeradius support team, We have currently a new infrastucture using freeRadius 3 (freeradius-3.0.13-8.) on RHEL7.5. The infrastructure implements in front a layer “PROXY RADIUS” (not based on proxy.conf usage) allowing to forward requests either to a service RADIUS A or a service RADIUS B depending on the type of OTP. Service A handles/valids OTP A Service B handles/valids OTP B The infrastructure works as expected. However when a service disruption occurs on service B, the PROXY RADIUS is no longer able to forward the requests to service A. The PROXY is in a state stuck with the below error messages. Thu Oct 25 08:14:11 2018 : Error: Unresponsive child for request 5735, in component authenticate module perl Thu Oct 25 08:14:13 2018 : WARNING: (5735) WARNING: Module rlm_perl became unblocked :::::: Thu Oct 25 09:41:25 2018 : Error: Unresponsive child for request 5791, in component authenticate module perl Thu Oct 25 09:41:53 2018 : WARNING: (5783) WARNING: Module rlm_perl became unblocked How can we manage this kind of errors? Is there some parameters to release connections. I'm assuming the error indicates some sort of timeout in communication between rlm_perl and service B. Assuming this is a timeout-related error, what is an acceptable processing time? Thanks, Thierry - List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html The information in this e-mail is confidential. The contents may not be disclosed or used by anyone other than the addressee. Access to this e-mail by anyone else is unauthorised. If you are not the intended recipient, please notify Airbus immediately and delete this e-mail. Airbus cannot accept any responsibility for the accuracy or completeness of this e-mail as it has been sent over public networks. If you have any concerns over the content of this message or its Accuracy or Integrity, please contact Airbus immediately. All outgoing e-mails from Airbus are checked using regularly updated virus scanning software but you should take whatever measures you deem to be appropriate to ensure that this message and any attachments are virus free.

2 1

dhcp server and logging
by BASSAGET Cédric 25 Oct '18

25 Oct '18

Hello. I don't understand what is missing in my config to make freeradius (3.0.12) logging what is doing about DHCP queries / replies. I'm using module dhcp_sqlippool, which set things like : sqlippool_log_exists = "DHCP: Existing IP: %{reply:Framed-IP-Address} (did %{Called-Station-Id} cli %{Calling-Station-Id} port %{NAS-Port} user %{User-Name})" sqlippool_log_success = "DHCP: Allocated IP: %{reply:Framed-IP-Address} from %{control:Pool-Name} (did %{Called-Station-Id} cli %{Calling-Station-Id} port %{NAS-Port} user %{User-Name})" sqlippool_log_clear = "DHCP: Released IP %{Framed-IP-Address} (did %{Called-Station-Id} cli %{Calling-Station-Id} user %{User-Name})" sqlippool_log_failed = "DHCP: IP Allocation FAILED from %{control:Pool-Name} (did %{Called-Station-Id} cli %{Calling-Station-Id} port %{NAS-Port} user %{User-Name})" sqlippool_log_nopool = "DHCP: No Pool-Name defined (did %{Called-Station-Id} cli %{Calling-Station-Id} port %{NAS-Port} user %{User-Name})" But nothing is logged. And I can not find the good doc to learn how linelog works.I found this thread : http://freeradius.1045715.n5.nabble.com/DHCP-in-FreeRadius-3-and-logging-td… But It did not help me. I'm missing something... Can somebody help me / point me in the right direction ? Regards.

3 4

Accounting-Request Re write Rule
by Maile Halatuituia 25 Oct '18

25 Oct '18

Hi I need to rewrite this attribute Cisco-AVPair = "acct-input-octets-ipv6=xxx" upon receiving it in the accounting request from my BRAS to my Radius Server so I can further process. I received this Cisco-AVPair = "acct-input-octets-ipv6=xxx" I have done this on the Radius Server /etc/freeradius/sites-available/default if( &Cisco-AVPair[*]=~/\(acct-input-octets-ipv6\)=\(\d+)/ ) { update request { &acct-input-octets-ipv6 := "%{2}" } } But I have this on my debug if ( &Cisco-AVPair[*]=~/\(acct-input-octets-ipv6\)=\(\d+)/ ) { (0) if ( &Cisco-AVPair[*]=~/\(acct-input-octets-ipv6\)=\(\d+)/ ) -> FALSE Not sure if I can read it correctly but seem the rule does not matched .. Appreciate anyone comments if didn't do it correctly Confidentiality Notice: This email (including any attachment) is intended for internal use only. Any unauthorized use, dissemination or copying of the content is prohibited. If you are not the intended recipient and have received this e-mail in error, please notify the sender by email and delete this email and any attachment.

2 2

Optimize the authentication time
by Tom Yard 24 Oct '18

24 Oct '18

Hi people, we have a Freeradius with AD authentication and SQL authorization. I could notice that several Windows 10 clients spend severalk seconds in authorization and authentication. Is there any way to optimize the time of authentication/authorization? Thanking in advance, Tommy

2 1