April 2018 - Freeradius-Users - lists.freeradius.org

No conf files installed on fresh freeradius install on Ubuntu 16.04
by John Burns 17 Apr '18

17 Apr '18

I've just tried to install freeradius on Ubuntu 16.04.4 LTS and no conf files are installed. I performed an apt-get update and apt-get upgrade before the install. :/# find /etc/freeradius/ /etc/freeradius/ /etc/freeradius/certs /etc/freeradius/sites-enabled /etc/freeradius/sites-available /etc/freeradius/modules /etc/freeradius/sql /etc/freeradius/sql/mysql :/# I've tried two different Ubuntu 16.04.4 LTS servers and both have the same problem. I've tried removing, force reinstalling, and having no luck. Debug output: :/# freeradius -CXx Tue Apr 17 12:12:47 2018 : Info: freeradius: FreeRADIUS Version 2.2.8, for host x86_64-pc-linux-gnu, built on Jul 26 2017 at 15:27:21 Tue Apr 17 12:12:47 2018 : Debug: Server was built with: Tue Apr 17 12:12:47 2018 : Debug: accounting Tue Apr 17 12:12:47 2018 : Debug: authentication Tue Apr 17 12:12:47 2018 : Debug: WITH_DHCP Tue Apr 17 12:12:47 2018 : Debug: WITH_VMPS Tue Apr 17 12:12:47 2018 : Debug: Server core libs: Tue Apr 17 12:12:47 2018 : Debug: ssl: OpenSSL 1.0.2g 1 Mar 2016 Tue Apr 17 12:12:47 2018 : Info: Copyright (C) 1999-2015 The FreeRADIUS server project and contributors. Tue Apr 17 12:12:47 2018 : Info: There is NO warranty; not even for MERCHANTABILITY or FITNESS FOR A Tue Apr 17 12:12:47 2018 : Info: PARTICULAR PURPOSE. Tue Apr 17 12:12:47 2018 : Info: You may redistribute copies of FreeRADIUS under the terms of the Tue Apr 17 12:12:47 2018 : Info: GNU General Public License. Tue Apr 17 12:12:47 2018 : Info: For more information about these matters, see the file named COPYRIGHT. Tue Apr 17 12:12:47 2018 : Info: Starting - reading configuration files ... Tue Apr 17 12:12:47 2018 : Debug: including configuration file /etc/freeradius/radiusd.conf Tue Apr 17 12:12:47 2018 : Error: Unable to open file "/etc/freeradius/radiusd.conf": No such file or directory Tue Apr 17 12:12:47 2018 : Error: Errors reading or parsing /etc/freeradius/radiusd.conf :/# Any ideas? Thanks John

3 3

EAP-AKA set-up failure on 4.0 dev. stream
by yukou katori 16 Apr '18

16 Apr '18

I'm setting up EAP-AKA on 4.0 dev. stream, because I have to set up EAP-AKA. I got the following error. Radiusd -X /// snip /// Loaded module "rlm_eap_aka" aka { /usr/local/etc/raddb/mods-enabled/eap[1190]: Configuration item "network_id" must have a value /usr/local/etc/raddb/mods-enabled/eap[1190]: Failed evaluating configuration for module "rlm_eap_aka" /usr/local/etc/raddb/mods-enabled/eap[15]: Failed evaluating configuration for module "rlm_eap" /usr/local/etc/raddb/mods-enabled# vi eap 1187 ## EAP-AKA 1188 # 1189 # 1190 aka { 1191 1192 } 1193 } /usr/local/src/freeradius-server-4.0.x/src/modules/rlm_eap/types/rlm_eap_aka# find . -type f | xargs grep network_id ./eap_aka.h: char const *network_id; //!< Network ID as described by RFC 5448. ./rlm_eap_aka.c: { FR_CONF_OFFSET("network_id", FR_TYPE_STRING | FR_TYPE_REQUIRED, rlm_eap_aka_t, network_id ) }, ./rlm_eap_aka.c: eap_aka_session->keys.network = (uint8_t *) talloc_bstrndup(eap_aka_session, inst->network_id, ./rlm_eap_aka.c: talloc_array_length(inst->network_id) - 1); It seems ""network_id" must have a value", what should I do for this error? I know it's dev. stream, but any comment would be really appreciated to set it up. Regards,

2 2

multiple columns in rlm_sql
by petr.linke＠seznam.cz 16 Apr '18

16 Apr '18

Hi, I have question, is it possible in virtual server config do something like this? update control { &value1,&value2, ... ,&valueN="%{sql:SELECT value1,value2, ... ,valueN from some_table where ...}" } I know, that is no problem to do more sql queries like: update control { &value1="%{sql:SELECT value1,from some_table where ...}" &value2="%{sql:SELECT value2,from some_table where ...}" ... &valueN="%{sql:SELECT valueN,from some_table where ...}" } but it is too expensive for performance, much better is to do with one sql select. I looked into rlm_sql.c, and the line #462 - "for (i = 0; i < fields; i++) names[i] = field_info[i].name;" looks as multiple column separation. I tried find some info in the freerarius WiKi and in the documentation, but without success. Thank you for any idea, Petr Linke

4 6

Freeradius 3.0.12 not processing LDAP control/check items
by Jan Baumann 13 Apr '18

13 Apr '18

Good evening, I have a well running freeradius 3.0.12 (Debian 9 package) with mysql und openldap backends. Usernames are of course unique and exist either only in ldap or mysql. Everything works for ldap and mysql users, except one thing: If I add a check-item into mysql radcheck table it works as expected. If I add the same item into openldap, it is not taken care of and access is always permitted if the item matches the request or not. But... if I add a reply-item to openldap is is delivered as part of the radius access accept message. debug output: (0) ldap: User object found at DN „uid=jbaumann,ou=people,dc=cyberways,dc=net" (0) ldap: Processing user attributes (0) ldap: control:Cleartext-Password := '12345' (0) ldap: Attribute "radiusExpiration" not found in LDAP object (0) ldap: control:NAS-Identifier := 'myWifiSSID' (0) ldap: Attribute "radiusSimultaneousUse" not found in LDAP object (0) ldap: Attribute "radiusReplyMessage" not found in LDAP object (0) ldap: Attribute "radiusTunnelType" not found in LDAP object (0) ldap: Attribute "radiusTunnelMediumType" not found in LDAP object (0) ldap: reply:Tunnel-Private-Group-ID := '1336' (0) ldap: Attribute "radiusControlAttribute" not found in LDAP object (0) ldap: Attribute "radiusRequestAttribute" not found in LDAP object (0) ldap: Attribute "radiusReplyAttribute" not found in LDAP object rlm_ldap (ldap): Released connection (1) Radius pulls the NAS-Identifier control item from ldap correctly, but does not reject the request if it does not match. For the cleartext password it works. I don’t see any hints of processing NAS-Identifier in the debug output at all, regardless which operator (=, := or +=) I try. It also pulls the Tunnel-Private-Group-ID reply item from ldap and successfully puts it into the reply message. So my ldap users can successfully log in with PEAP, but into any wifi SSID. Mysql users are correctly rejected if the NAS-Identifier does not match. config of ldap module: compare_check_items = yes update { control:Cleartext-Password := 'userPassword' control:Expiration := 'radiusExpiration' control:NAS-Identifier := 'radiusNASIdentifier' control:Simultaneous-Use := 'radiusSimultaneousUse' reply:Reply-Message := 'radiusReplyMessage' reply:Tunnel-Type := 'radiusTunnelType' reply:Tunnel-Medium-Type := 'radiusTunnelMediumType' reply:Tunnel-Private-Group-ID := 'radiusTunnelPrivategroupId' # Where only a list is specified as the RADIUS attribute, # the value of the LDAP attribute is parsed as a valuepair # in the same format as the 'valuepair_attribute' (above). control: += 'radiusControlAttribute' request: += 'radiusRequestAttribute' reply: += 'radiusReplyAttribute' } I am trying to fix this for the entire past week, so may I please ask the experts here. How are ldap check items meant to be configured and work in freeradius 3? Special thanks! Jan

2 2

Radacct
by Yahn do Amaral Almeida Pinheiro 13 Apr '18

13 Apr '18

Good afternoon. Does exist some limitation in the freeradius with the NAS management? When we utilize 4 or minus NAS, the radacct register the information correctly (registers on average 4600 customers). But when I use more of 4 NAS, the RADIUS doesn't register the other users. It was to register on average, 15 thousand usuarios.

2 2

Mapping between sqlippool and radius attributes
by Thore Krüss 13 Apr '18

13 Apr '18

Good evening, after reading the configuration files, the wiki entry as well as trying to dig in the code I haven't been able to figure out how the columns from the sqlippool module are mapped back to radius attributes. The default table scheme creates a column "framedipaddress" which appears to become the "Framed-IP-Address" attribute through magic. Is there a way to extend this with a "Framed-IPv6-Prefix"? Is adding a column with that name sufficient? I've seen it being done using xlat extensions and sql in the post-auth section but this seems to be a horrible approach and I'd love to avoid that. Best regards Thore

2 3

Grouping of sub attributes in seperate VSAs
by Бенджамин Томпсон 13 Apr '18

13 Apr '18

Hi We have a device which sends individual traffic counters for several different services. The dicitionary is as follows: VENDOR VasExperts 43823 BEGIN-VENDOR VasExperts ... ATTRIBUTE VasExperts-Acct-Traffic-Class-Name 16 string ATTRIBUTE VasExperts-Acct-Traffic-Class-Input-Octets 17 integer64 ATTRIBUTE VasExperts-Acct-Traffic-Class-Output-Octets 18 integer64 ATTRIBUTE VasExperts-Acct-Traffic-Class-Input-Packets 19 integer64 ATTRIBUTE VasExperts-Acct-Traffic-Class-Output-Packets 20 integer64 ... In the accounting packet these attribtues are grouped into individual VSAs as follows: AVP: l=51 t=Vendor-Specific(26) v=VAS Experts(43823) AVP Type: 26 AVP Length: 51 VSA: l=5 t=VasExperts-Acct-Traffic-Class-Name(16): cs0 VSA: l=10 t=VasExperts-Acct-Traffic-Class-Input-Octets(17): 0000000000000000 VSA: l=10 t=VasExperts-Acct-Traffic-Class-Output-Octets(18): 00000000002128bc VSA: l=10 t=VasExperts-Acct-Traffic-Class-Input-Packets(19): 0000000000000000 VSA: l=10 t=VasExperts-Acct-Traffic-Class-Output-Packets(20): 00000000000007a4 AVP: l=51 t=Vendor-Specific(26) v=VAS Experts(43823) AVP Type: 26 AVP Length: 51 VSA: l=5 t=VasExperts-Acct-Traffic-Class-Name(16): cs1 VSA: l=10 t=VasExperts-Acct-Traffic-Class-Input-Octets(17): 0000000000000000 VSA: l=10 t=VasExperts-Acct-Traffic-Class-Output-Octets(18): 0000000000000000 VSA: l=10 t=VasExperts-Acct-Traffic-Class-Input-Packets(19): 0000000000000000 VSA: l=10 t=VasExperts-Acct-Traffic-Class-Output-Packets(20): 0000000000000000 Here the fact that the five attributes are gouped together in a single VSA means that they all contain data which pertains to the same service. When FreeRADIUS processes the packet the attribtues are as I understand it added to one long list and I can access them individually by their index. However, as I understand it the ordering of RADIUS attributes is not something which is normally guaranteed and I would like to ask is whether there is any way in unlang or by other means to figure out which which sub attribtues came from the same parent attribute.

3 4

Perl vs. python vs. Lua?
by Dom Latter 12 Apr '18

12 Apr '18

Hi, we have been using the exec module with version 2 to run an external PHP script that (for example) assigns a VLAN depending on the user's location [1] - this is done post-auth. We have migrated to freeradius version 3. I note from http://networkradius.com/doc/3.0.10/raddb/mods-available/exec.html that "The exec module may look like it works for one or two tests, but in a live situation it can cause the server to become unresponsive under load. The perl module is recommended for general-purpose computing." Now if I had read that four years ago I'd not have gone down the exec route... anyway. So it seems to me we need to rewrite the exec module using one of the scripting modules. So I am wondering how the python module compares to the perl module. I found and read a great post from Herwin Weststrate <herwin(a)quarantainenet.nl> from November 2016 that explains some of the differences. I'd rather use python than perl, all else being equal. Lua is an outlier of an option. Any thoughts? Apologies if any of the above is unclear. [] which we get from the access-point identifier string.

3 17

Use LDAP with MySQL
by Charly 12 Apr '18

12 Apr '18

Hello, Do you known how to use LDAP as users database and MySQL for store Cisco-AVPair attributes ? When i only use MySQL it's working : radtest -x test password 127.0.0.1 0 TEST Sent Access-Request Id 75 from 0.0.0.0:32889 to 127.0.0.1:1812 length 81 User-Name = "test" User-Password = "password" NAS-IP-Address = 10.20.20.2 NAS-Port = 0 Message-Authenticator = 0x00 Cleartext-Password = "password" Received Access-Accept Id 75 from 127.0.0.1:1812 to 0.0.0.0:0 length 58 Cisco-AVPair = "ip:inacl#5=permit icmp any any" But i really don't know how to use both Thank for your help Charly

2 4

FreeRadius Server crashed when creating a large number of ipsec gateway tunnels.
by Li Guanqun 12 Apr '18

12 Apr '18

Hi expert, I am trying to create about 260 ipsec gateway tunnels in my femto test environment with FreeRadius(ver.2.2.0) installed. I prerared 1k users on both Femto and FreeRadius server(as "ipsec.db" and "users" file). However, freeRadius Server crashed during creating the 78th tunnel, and only 73 tunnels were created successfully. Can anyone give me some advice on the reason of this symptom ? Is there any limitation for the number of users ? I attached a PPT file to describe in detail, with topology, HW info and logs. If further info is needed, don`t hesitate to let me know. Any advice will be appreciated. Thank you ! Regards, Li

3 7