December 2019 - Freeradius-Users - lists.freeradius.org

FreeRadius LDAP group verification not working for me
by Condor 13 Dec '19

13 Dec '19

Hi all, i'm really brand new on freeradius. i'm using freeradius 3.0.4 with ldap, ldap autethication work for me fine with "o=organitation" but not with group = cn, maybe the ldap configuration is not the standart I'm following these thread: lists.freeradius.org/pipermail/freeradius-users/2016-December/085971.html For me: in /mods-available/ldap ldap { server = "x.x.x.x" base_dn = "o=organization,cn=telecom"} user { base_dn = "o=organization,cn=telecom" filter = "(uid=%{%{Stripped-User-Name}:-%{User-Name}})"} group { base_dn = "o=organization,cn=telecom" filter = '(cn=telecom)' name_attribute = cn membership_filter = "(|(member=%{control:Ldap-UserDn})(memberUid=%{%{Stripped-User-Name}:-%{User-Name}}))" membership_attribute = 'memberUid' } on radius -X : Received Access-Request Id 125 from y.y.y.y:42420 to x.x.x.x:1812 length 78 User-Name = 'usertest' User-Password = '*****' NAS-IP-Address = 127.0.1.1 NAS-Port = 0 Message-Authenticator = 0x075a82e674d1e57b22856618bd3adc87(2) Received Access-Request packet from host y.y.y.y port 42420, id=125, length=78(2) User-Name = 'usertest'(2) User-Password = '*****'(2) NAS-IP-Address = 127.0.1.1(2) NAS-Port = 0(2) Message-Authenticator = 0x075a82e674d1e57b22856618bd3adc87(2) # Executing section authorize from file /etc/raddb/sites-enabled/default(2) authorize {(2) eap : No EAP-Message, not doing EAP(2) [eap] = nooprlm_ldap (ldap): Reserved connection (4)(2) ldap : EXPAND (uid=%{%{Stripped-User-Name}:-%{User-Name}})(2) ldap : --> (uid=usertest)(2) ldap : EXPAND o=organitation,cn=telecom(2) ldap : --> o=organitation,cn=telecom(2) ldap : Performing search in 'o=organitation,cn=telecom' with filter '(uid=usertest)', scope 'sub'(2) ldap : Waiting for search result...(2) ERROR: ldap : Failed performing search: The specified DN wasn't found, check base_dn and identityrlm_ldap (ldap): Released connection (4)(2) [ldap] = fail(2) } # authorize = fail(2) Invalid user (ldap: Failed performing search: The specified DN wasn't found, check base_dn and identity): [usertest/******] (from client Renaju port 0)(2) Using Post-Auth-Type Reject(2) # Executing group from file /etc/raddb/sites-enabled/default(2) Post-Auth-Type REJECT {(2) attr_filter.access_reject : EXPAND %{User-Name}(2) attr_filter.access_reject : --> usertest(2) attr_filter.access_reject : Matched entry DEFAULT at line 11(2) [attr_filter.access_reject] = updated(2) } # Post-Auth-Type REJECT = updated(2) Delaying response for 1 seconds ------- # in the "default" server authorize { ... eap { ok = return updated = return } ldap group_authorization # In the "inner-tunnel" server: authorize { ... eap { ok = return } ldap group_authorization I create "policy.d/group_authorization" the file not exist # in policy.d/group_authorization: group_authorization { if (&Huntgroup-Name == "telecom") { if (&LDAP-Group[*] == "o=organization,cn=telecom") { ok } else { update reply { &Reply-Message := "Not authorized for telecom" } reject } } elsif (&Huntgroup-Name == "telecom") { reject }} Thanks!

2 1

Script
by Aurélio de Souza Ribeiro Neto 13 Dec '19

13 Dec '19

Hello All, I'm using freeradius 3.0.20 in ubuntu + MySQL, and I want to implement a solution to discconect users when I don't receive 2 Interim Update Packets for example. How can I do this? Someone can help? Aurélio

3 2

Regex match on a variable is not working if length is long
by Chinnapaiyan, Nagamani 12 Dec '19

12 Dec '19

Hi, I am using freeradius-4.0.x version. This one works, (6) if ( "%{control:Tmp-String-7}" =~ /vendor-options.*$number 43$$value (([0-9a-fA-F]{2}:)*[0-9a-fA-F]{2})/ ) { (6) EXPAND %{control:Tmp-String-7} (6) --> ((ClassName Policy)(name client-policy:1,6,00:A0:BC:6C:7E:64)(v4-reply-options [vendor-encapsulated-options])(vendor-options [((ClassName Option)(number 43)(value 01:03:00:A0:BC:14:44:01:00:02:01:03:11:05:00:44:00:44:07:00:43:00:43:01:01:02:01:03:06:07:01:BD:01:BD:01:01:02:01:07:00:87:00:88:01:01:02:01:06:C0:A8:64:00:18:07:00:16:00:17:01:01:02:01:03:11:06:C0:A8:64:00:18:07:00:A1:00:A1:19:01:01:21:01:01:26:38:68:74:74:70:3A:2F:2F:31:30:2E:34:33:2E:31:39:2E:31:38:3A:39:36:37:35:2F:6C:69:76:65:2F:43:50:45:4D:61:6E:61:67:65:72:2F:43:50:45:73:2F:67:65:6E:65:72:69:63:54:52:36:39:27:02:00:05:28:02:07:D0:36:01:FF:40:01:00)(option-definition-set-name ViasatUT))])) (6) update control { But this one is not, (15) if ( "%{control:Tmp-String-7}" =~ /vendor-options.*\(number 43$\(value (([0-9a-fA-F]{2}:)*[0-9a-fA-F]{2})/ ) { (15) EXPAND %{control:Tmp-String-7} (15) --> ((ClassName Policy)(name client-policy:1,6,00:A0:BC:6C:7D:3A)(v4-reply-options [vendor-encapsulated-options])(vendor-options [((ClassName Option)(number 43)(value 01:03:00:A0:BC:02:09:55:54:00:00:00:00:00:00:07:03:0E:55:54:32:00:00:00:00:00:03:07:03:0A:00:09:04:11:55:54:5F:33:2E:37:2E:33:2E:31:30:2E:39:2E:62:69:6E:05:04:0A:4F:FF:0F:14:44:01:00:02:01:03:11:05:00:44:00:44:07:00:43:00:43:01:01:02:01:03:06:07:01:BD:01:BD:01:01:02:01:07:00:87:00:88:01:01:02:01:06:C0:A8:64:00:18:07:00:16:00:17:01:01:02:01:03:11:06:C0:A8:64:00:18:07:00:A1:00:A1:19:01:01:26:42:68:74:74:70:3A:2F:2F:61:63:73:2E:64:65:76:2E:63:6D:74:2E:76:69:61:73:61:74:2E:69:6F:3A:39:36:37:35:2F:6C:69:76:65:2F:43:50:45:4D:61:6E:61:67:65:72:2F:43:50:45:73:2F:67:65:6E:65:72:69:63:54:52:36:39:27:02:00:05:28:02:07:D0:2A:0E:55:54:2E:35:2E:32:2E:32:2E:31:30:35:30:33:2B:04:0A:4F:FF:0F:2C:0E:55:54:2E:35:2E:32:2E:32:2E:31:30:33:39:33:33:0C:55:54:32:00:00:00:00:00:00:00:29:08:36:01:FF:3B:0E:55:54:32:00:00:00:00:00:03:07:03:0A:00:09:3C:12:55:54:32:5F:33:2E:37:2E:33:2E:31:30:2E:39:2E:62:69:6E:3D:04:0A:4F:FF:0F:3E:3C:68:74:74:70:3A:2F:2F:31:30:2E:37:39:2E:32:35:35:2E:31:36:2F:70:75:62:2F:76:77:61:5F:69:6D:61:67:65:73:2F:76:77:61:5F:55:54:2E:35:2E:32:2E:32:2E:31:30:35:30:33:2E:74:61:72:2E:67:7A:3F:3C:68:74:74:70:3A:2F:2F:31:30:2E:37:39:2E:32:35:35:2E:31:36:2F:70:75:62:2F:76:77:61:5F:69:6D:61:67:65:73:2F:76:77:61:5F:55:54:2E:35:2E:32:2E:32:2E:31:30:33:39:33:2E:74:61:72:2E:67:7A:40:01:00)(option-definition-set-name ViasatUT))])) (15) ERROR: regex failed: regex evaluation failed with code (-27): <INVALID> (15) ERROR: Condition evaluation failed because the value of an operand could not be determined (15) ... (15) } Both are same conditions with different values in them. Why second one is not working? Regards, Nagamani Chinnapaiyan

3 5

Does freeRADIUS 3 support PostgreSQL 11
by Min Wang 11 Dec '19

11 Dec '19

Does freeRADIUS 3 support PostgreSQL 11? Best regards, Min Wang Global Data Services New York Stock Exchange An Intercontinental Exchange Company (NYSE: ICE) 11 Wall St. | New York, NY 10005 Tel: +1 212.656.2441 | Mob: +1 201.936.9888 Min.Wang(a)theice.com<mailto:Min.Wang@theice.com> [ice] [Intercontinental Exchange - email.png]<https://icespace.cpex.com/servlet/JiveServlet/showImage/102-61239-14-18333/…> ________________________________ This message may contain confidential information and is intended for specific recipients unless explicitly noted otherwise. If you have reason to believe you are not an intended recipient of this message, please delete it and notify the sender. This message may not represent the opinion of Intercontinental Exchange, Inc. (ICE), its subsidiaries or affiliates, and does not constitute a contract or guarantee. Unencrypted electronic mail is not secure and the recipient of this message is expected to provide safeguards from viruses and pursue alternate means of communication where privacy or a binding message is desired.

3 9

Trying not to send outer identity in the Access-Accept message
by Torres López María Isabel 11 Dec '19

11 Dec '19

Dear Sir or Madam. Currently, we are running Freeradius 3.0.11. It works correctly with our wireless controler, but when we upgrade the firmware of our wireless controlles, the users are not able to stablish sesión anymore. The problem is that the freeradius is sending two User-Name values in the Access-Accept packet (the inner and the outer identity), and the Wireless controler detects two values and drops the packet. The authentication is correct, but the Wireless controller does not stablish the user sesión. Besides, as the Freeradius sends both identities, sometimes the accountings shows the outer identity, not the inner one. ¿Is there any way to send only the inner identity in the Access-Accept packet? (6) Login OK: [pruebas.wifi(a)uah.es] (from client WLAN-1 port 0 cli B49D0B8C389F via TLS tunnel) (6) } # server inner (6) Virtual server sending reply (6) User-Name = "pruebas.wifi(a)uah.es" (6) Class = 0x414c554d4e4f53 (6) Filter-Id = "ALUMNOS" (6) eap_ttls: Got tunneled Access-Accept (6) eap: Sending EAP Success (code 3) ID 8 length 4 (6) eap: Freeing handler (6) [eap] = ok (6) } # authenticate = ok (6) Login OK: [anonymous(a)uah.es] (from client WLAN-1 port 0 cli B49D0B8C389F) (6) Sent Access-Accept Id 56 from 192.168.153.175:1812 to 172.17.47.240:37462 length 0 (6) User-Name = "anonymous(a)uah.es" (6) User-Name = "pruebas.wifi(a)uah.es" (6) Class = 0x414c554d4e4f53 (6) Filter-Id = "ALUMNOS" (6) MS-MPPE-Recv-Key = 0x567a04806953128ea5aadb908f6728a6753794d66a6ec189964c4f2e54cfb15b (6) MS-MPPE-Send-Key = 0x068df56d4605c2a4b62e8f4eee3fdb12031bdebf9eaa4201d6d08b310246d6d4 (6) EAP-Message = 0x03080004 (6) Message-Authenticator = 0x00000000000000000000000000000000 (6) Finished request Best regards. Mª Isabel Torres López Comunicaciones - Servicios Informáticos Universidad de Alcalá Correo: Isabel.torres(a)uah.es<mailto:Isabel.torres@uah.es> Telefono: 918856458

2 1

NT Status file lock conflict - 0xc0000054
by Innes Hatton 11 Dec '19

11 Dec '19

Hi, Currently I have an issue with a radius servers, every day the user authentication appears to not work for our Eduroam WIFI, after restarting the server everything begins to work again. I am currently using SAMBA to connect FreeRADIUS to Active Directory. Please see the errors below, any advice would be appreciated [root@EKCRadius5 /usr/home/netsys]# su freeradius $ /usr/local/bin/ntlm_auth --request-nt-key --domain=EASTKENT --username=service.freeradius --password=xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx NT_STATUS_FILE_LOCK_CONFLICT: A requested read/write cannot be granted due to a conflicting file lock. (0xc0000054) Fri Dec 6 08:15:24 2019 : Error: No response to status check 909333 ID 41 for home server xxxxxxxxxxxxx port 1812 Fri Dec 6 08:15:24 2019 : Error: (909322) Ignoring duplicate packet from client 110-CAN-APS port 47516 - ID: 103 due to unfinished request in component authenticate module eap_peap Fri Dec 6 08:15:24 2019 : ERROR: (909214) mschap: ERROR: Failed to read from child output Thanks, Innes 'This email and any files transmitted with it are confidential and for the use of the individual or entity to whom they are addressed. If you are not the intended recipient be advised that you have received this email in error and that any use, dissemination, forwarding, printing or copying of this email is prohibited' - EKC Group

2 1

dhcpclient DHCP-Vendor display problem
by Chinnapaiyan, Nagamani 11 Dec '19

11 Dec '19

Hi, I am using freeradius 4.0.x version. The dhcpclient displays a truncated DHCP-Vendor option in reply packet. If I take a pcap it shows full DHCP-Vendor. Server side: (0) Sending DHCP-Offer XID e7ef0a2f from 10.43.18.62:6767 to 10.43.18.44:6767 via eth1 ... (0) DHCP-Vendor = 0x010300a0bc0209555400000000000007030e5554000000000000030703070016041155545f332e372e332e372e32322e62696e05040a4fff060c0200010e0100145e0100020103110500440044070043004301000201030606c0a86400180700500050010102010306070016001701010201060a000000080101020106ac1000000c0101020106c0a80000100101020106a9fe00001001010201067f00000008330c5554320000000000000029083b0e55543200000000000307030600003c115554325f332e372e332e362e302e62696e3d040a4fff06 ... Client side: # /usr/bin/dhcpclient -i eth1 -x -f /opt/viasat/dhcp_fr_citests/dhcpclient-modem_discover.txt 10.43.18.62:6767 Sending DHCP-Discover Id e7ef0a2f from 0.0.0.0:6767 to 10.43.18.62:6767 length 322 ... ... Received DHCP-Offer Id e7ef0a2f from 10.43.18.62:6767 to 0.0.0.0:6767 via eth1 length 553 ... DHCP-Vendor = 0x010300a0bc0209555400000000000007030e5554000000000000030703070016041155545f332e372e332e372e32322e62696e05040a4fff060c0200010e0100145e0100020103110500440044070043004301000201030606c0a86400180700500050010102010306070016001701010201060a000000 ... Regards, Nagamani Chinnapaiyan

2 1

Using freeradius just for device administrative access
by Coy Hile 10 Dec '19

10 Dec '19

Hi all, I'm finally getting around to setting up RADIUS in my lab so I can centralize authentication and authorization access to network devices. Assume for sanity's sake, NAS information and user information stored in a SQL database. Does anyone have any boilerplate for what can be thrown away wholesale from the default configs when *not* doing 802.1x or other end-user authentication/authorization. -- Coy Hile coy.hile(a)coyhile.com

2 1

Allow same user to authenticate with different passwords
by Taymour Gabr 10 Dec '19

10 Dec '19

Hi All, We are trying to allow users to authenticate with different passwords using an SQL database and freeradius version 3.0.17 (hotel scenario, where unrelated people can have the same family name). I've already seen these two links: http://freeradius.1045715.n5.nabble.com/Help-FreeRadius-Users-with-multiple… http://lists.freeradius.org/pipermail/freeradius-users/2009-February/035570… and I've had a look at the queries.conf file for mysql. I found the 'authorize_check_query', but that query just resolves to present all the fields for the username, and 'authorize_check_query' is not used elsewhere to use those results to retrieve the password... . So I am still at a loss of how I can change freeradius to accept a different type of radcheck table with multiple fields for the password per user, and where I would change the logic of how it accepts any of these passwords. Addiionally it should use Simultaneous-Use checks per username+password combination rather than per username. But that's of course something we can change within the sql server events and triggers. Thanks, Kind Regards, Taymour

3 4

get AP MAC Address
by juliana sales porto 06 Dec '19

06 Dec '19

Hello guys, I have a question. Is that possible I take the Mac Address from RB or AP mikrotik when the user is authenticating on hotspot system? Att, Juliana Porto

3 4

Microsoft ODBC bug
by Dom Latter 06 Dec '19

06 Dec '19

Hi all, I have been experimenting with Microsoft SQL Server as a replacement for our current mysql servers [1]. I installed Microsoft's own "ODBC Driver 17 for SQL Server" and have tested against both SQL Server running on the same Linux machine as Freeradius itself, and SQL Server running on a Windows machine. In both cases I found the same (what appears to be a) bug, which I will describe below for the benefit of the archives, even though it is (probably) not a problem with freeradius. Because people hitting this are very likely to be searching with terms including "freeradius". Also there is a chance that it is somehow specific to the interaction with freeradius. Because it is hard to imagine even Microsoft releasing something with such a glaring fault. I'll also give a work-around. I think I will now try iodbc instead - anybody here used it? Right, the bug. Here's my custom attribute: ATTRIBUTE My-Int 3004 integer Here's part of the post-auth section in the "outer" site: update control { My-Int := "%{sql:SELECT 9999 }" My-Int := "%{sql:SELECT 10000 }" My-Int := "%{sql:SELECT '10000' }" Here's debug output: EXPAND %{sql:SELECT 9999 } --> 9999 My-Int := 9999 Executing select query: SELECT 10000 rlm_sql_unixodbc: 22003 [Microsoft][ODBC Driver 17 for SQL Server]Numeric value out of range ERROR: Error fetching row ERROR: Unknown error ERROR: SQL query failed: <INVALID> EXPAND %{sql:SELECT 10000 } --> My-Int := 0 Executing select query: SELECT '10000' EXPAND %{sql:SELECT '10000' } --> 10000 My-Int := 10000 As you can see, if an integer is more than four digits long, the driver throws an error. But if you return the number as a string, it works fine. I'd love to see the source code for this... [1] Everything else is SQL Server and our current integration between the two databases is rather clunky; a homogeneous environment makes sense, whatever I personally think of Microsoft <grin>.

7 26

Redundant SQL connection. Starting radiusd and Respond with Access-Accept if all databases do not work #2
by Никита Борисенков 05 Dec '19

05 Dec '19

> The task is to allow or prohibit calls to subscribers. If the subscriber > has valid status, then we send Access-Accept. If the subscriber calls > the emergency service, then we send Access-Accept. In other cases, we > send Access-Reject. > > I configured two radius server, and two sql server. Replication > configured between sql servers. > > I write accounting and authentication to the database. > > I want that when one database is unavailable, data is written to another > database. But if both databases are not available, then we send > Access-Accept > > Some questions: > * Is there a way to not duplicate config for modules sql1 and sql2 > because they differ only in ip-address? > * Is there a way to start freeradius if one or all databases are down? > * What is the correct way to verify that sql1 and sql2 modules are fail > without checking "Calling-Station-Id-Is-Exists" for empty string? > * How can I simplify this configuration? > > > My config: > > sql sql1 { > driver = "rlm_sql_mysql" > dialect = "mysql" > > server = "localhost" > port = 3306 > login = "radius" > password = "test" > > query_timeout = 5 > > radius_db = "radius" > > read_clients = no > > # Table to keep radius client info > client_table = "nas" > > # If you want both stop and start records logged to the > # same SQL table, leave this as is. If you want them in > # different tables, put the start table in acct_table1 > # and stop table in acct_table2 > acct_table1 = "radacct" > acct_table2 = "radacct" > > # Allow for storing data after authentication > postauth_table = "radpostauth" > > # Tables containing 'check' items > authcheck_table = "radcheck" > groupcheck_table = "radgroupcheck" > > # Tables containing 'reply' items > authreply_table = "radreply" > groupreply_table = "radgroupreply" > > # Table to keep group info > usergroup_table = "radusergroup" > > pool { > start = ${thread[pool].start_servers} > min = ${thread[pool].min_spare_servers} > max = ${thread[pool].max_servers} > spare = ${thread[pool].max_spare_servers} > > uses = 0 > retry_delay = 30 > lifetime = 0 > idle_timeout = 60 > } > > # This entry should be used for additional instances (sql foo {}) > # of the SQL module. > group_attribute = "${.:instance}-SQL-Group" > > # This entry should be used for the default instance (sql {}) > # of the SQL module. > #group_attribute = "SQL-Group" > > # Read database-specific queries > # $INCLUDE ${modconfdir}/${.:name}/main/${dialect}/queries.conf > $INCLUDE ${modconfdir}/sql/main/${dialect}/queries.conf > } > > sql sql2 { > driver = "rlm_sql_mysql" > dialect = "mysql" > > server = "172.27.65.243" > port = 3306 > login = "radius" > password = "test" > > query_timeout = 5 > > radius_db = "radius" > > read_clients = no > > # Table to keep radius client info > client_table = "nas" > > # If you want both stop and start records logged to the > # same SQL table, leave this as is. If you want them in > # different tables, put the start table in acct_table1 > # and stop table in acct_table2 > acct_table1 = "radacct" > acct_table2 = "radacct" > > # Allow for storing data after authentication > postauth_table = "radpostauth" > > # Tables containing 'check' items > authcheck_table = "radcheck" > groupcheck_table = "radgroupcheck" > > # Tables containing 'reply' items > authreply_table = "radreply" > groupreply_table = "radgroupreply" > > # Table to keep group info > usergroup_table = "radusergroup" > > pool { > start = ${thread[pool].start_servers} > min = ${thread[pool].min_spare_servers} > max = ${thread[pool].max_servers} > spare = ${thread[pool].max_spare_servers} > > uses = 0 > retry_delay = 30 > lifetime = 0 > idle_timeout = 60 > } > > # This entry should be used for additional instances (sql foo {}) > # of the SQL module. > group_attribute = "${.:instance}-SQL-Group" > > # This entry should be used for the default instance (sql {}) > # of the SQL module. > #group_attribute = "SQL-Group" > > # Read database-specific queries > #$INCLUDE ${modconfdir}/${.:name}/main/${dialect}/queries.conf > $INCLUDE ${modconfdir}/sql/main/${dialect}/queries.conf > } > > # Create virtual module for SELECTs > instantiate { > redundant sql1_or_sql2 { > sql1 > sql2 > } > } > > server ats_local { > authorize { > update control { > Calling-Station-Id-Status = "%{sql1_or_sql2:SELECT > gtdb_users.status FROM gtdb_users WHERE aon='%{Calling-Station-Id}'}" > Called-Station-Id-Status = "%{sql1_or_sql2:SELECT > gtdb_users.status FROM gtdb_users WHERE aon='%{Called-Station-Id}'}" > > Calling-Station-Id-Is-Exists = "%{sql1_or_sql2:SELECT > COUNT(gtdb_users.status) FROM gtdb_users WHERE > aon='%{Calling-Station-Id}'}" > Called-Station-Id-Is-Exists = "%{sql1_or_sql2:SELECT > COUNT(gtdb_users.status) FROM gtdb_users WHERE > aon='%{Called-Station-Id}'}" > > Called-Station-Id-Emergency = "%{sql1_or_sql2:SELECT > COUNT(aon) FROM emergency_cid WHERE aon='%{Called-Station-Id}'}" > } > > # These attributes in normal condition must contain the number > >= 0 (because we use sql COUNT() ) > # If there is an empty string inside, then sql queries failed > for some reason and we return Access-Accept > > if (&control:Calling-Station-Id-Is-Exists == '' || > &control:Called-Station-Id-Is-Exists == '') { > update control { > Auth-Type := Accept > } > } > else { > if (control:Called-Station-Id-Emergency == '1') { > update control { > Auth-Type := Accept > } > } > > # ... > # bunch of elsif for Calling-Station-Id-Status and > Called-Station-Id-Status > # ... > > else { > update control { > Auth-Type := Reject > } > } > } > } > > > authenticate { > } > > preacct { > acct_unique > } > > $INCLUDE ${confdir}/ats_accounting.conf > > session { > } > > post-auth { > update reply { > cisco-avpair = "h323-credit-time=86400" > } > > if (&User-Name) { > # this not work, because I can't put "ok" to virtual module > "sql1_or_sql2" > # sql1_or_sql2 > redundant { > sql1 > sql2 > ok > } > } > > Post-Auth-Type REJECT { > if (&User-Name) { > redundant { > sql1 > sql2 > ok > } > } > } > > } > > pre-proxy { > } > > post-proxy { > } > } > See raddb/templates.conf You can put all of the configuration > *except* the "server" file into a "template" in that file. Then > configure two SQL modules: > > sql sql1 { > $template sql_template > server = localhost > } > > sql sql2 { > $template sql_template > server = 172.27.65.243 > } > > > > * Is there a way to start freeradius if one or all databases are down? > > See the pool config. This is documented. Set "start = 0", and "min > = 0" > > > * What is the correct way to verify that sql1 and sql2 modules are > fail without checking "Calling-Station-Id-Is-Exists" for empty string? > > Use a "redundant" block. > > > * How can I simplify this configuration? > > It seems OK to me. > > Alan DeKok. Sorry for repeating the message, I mistakenly deleted all previous messages. Thanks for the help. Everything worked out for me. The config began to look more simple. All my problems were due to the fact that I did not read the documentation. And I also deleted all the comments from the configuration files to make it easier to read, but in the end I made it worse for myself. Now I make a copy and rename the file to "*_with_comments" to look into it if necessary.

2 1

Exec and dropped attributes between v2.0 and 3.0
by Luke Cameron 05 Dec '19

05 Dec '19

Hi All, I am upgrading a V2.0 instance to 3.0... They use EXEC to run a perl script which passes in the username and Framed-IP-Address to update there bind DNS server of the clients IP. I know Framed-IP-Address Attribute has been dropped. Has anyone got any ideas how can I achieve the same thing?

3 14

Freeradius crashes with SIGABRT
by Daniel Feuchtinger 04 Dec '19

04 Dec '19

Hi, our radius proxy crashes regularily since we switched from version 2 to 3. First we ran freeradius version 3.0.15 (package from Suse Linux Enterprise 12.4), then version 3.0.17 and 3.0.18 (compiled with rpmbuild) with no difference. Our present configuration is like this: radius@radius-dev1:~> uname -a Linux radius-dev1 4.12.14-95.6-default #1 SMP Thu Jan 17 06:04:39 UTC 2019 (6af4ef8) x86_64 x86_64 x86_64 GNU/Linux radius@radius-dev1:~> /usr/sbin/radiusd -v radiusd: FreeRADIUS Version 3.0.18, for host x86_64-suse-linux-gnu, built on Mar 4 2019 at 00:00 FreeRADIUS Version 3.0.18 I run the radius-daemon inside of gdb with dumps enabled: Starting program: /usr/sbin/radiusd -f -d /etc/raddb ... *** Error in `/usr/sbin/radiusd': double free or corruption (fasttop): 0x00007fffe8009b40 *** ======= Backtrace: ========= /lib64/libc.so.6(+0x7411f)[0x7ffff60ba11f] /lib64/libc.so.6(+0x79596)[0x7ffff60bf596] /lib64/libc.so.6(+0x7a3db)[0x7ffff60c03db] /usr/lib64/libtalloc.so.2(+0x300d)[0x7ffff6e7a00d] /usr/lib64/libtalloc.so.2(+0x2d87)[0x7ffff6e79d87] /usr/lib64/libtalloc.so.2(+0x2d87)[0x7ffff6e79d87] /usr/sbin/radiusd(+0x37ae7)[0x55555558bae7] /usr/sbin/radiusd(+0x3a14d)[0x55555558e14d] /usr/lib64/freeradius/libfreeradius-radius.so(fr_event_run+0x74)[0x7ffff79928d4] /usr/lib64/freeradius/libfreeradius-radius.so(fr_event_loop+0x2c9)[0x7ffff7992ec9] /usr/sbin/radiusd(main+0x706)[0x555555569f06] /lib64/libc.so.6(__libc_start_main+0xf5)[0x7ffff6066725] /usr/sbin/radiusd(_start+0x29)[0x55555556a239] Thread 1 "radiusd" received signal SIGABRT, Aborted. 0x00007ffff607af97 in __GI_raise (sig=sig@entry=6) at ../sysdeps/unix/sysv/linux/raise.c:55 55 ../sysdeps/unix/sysv/linux/raise.c: No such file or directory. (gdb) (gdb) bt #0 0x00007ffff607af97 in __GI_raise (sig=sig@entry=6) at ../sysdeps/unix/sysv/linux/raise.c:55 #1 0x00007ffff607c36a in __GI_abort () at abort.c:78 #2 0x00007ffff60ba124 in __libc_message (do_abort=do_abort@entry=2, fmt=fmt@entry=0x7ffff61b3f48 "*** Error in `%s': %s: 0x%s ***\n") at ../sysdeps/posix/libc_fatal.c:175 #3 0x00007ffff60bf596 in malloc_printerr (action=3, str=0x7ffff61b40a0 "double free or corruption (fasttop)", ptr=<optimized out>, ar_ptr=<optimized out>) at malloc.c:5018 #4 0x00007ffff60c03db in _int_free (av=0x7fffe8000020, p=<optimized out>, have_lock=0) at malloc.c:3872 #5 0x00007ffff6e7a00d in _tc_free_internal (tc=0x7fffe8009b40, location=0x5555555b02ea "src/main/process.c:604") at ../talloc.c:1148 #6 0x00007ffff6e79d87 in _tc_free_children_internal (location=0x5555555b02ea "src/main/process.c:604", ptr=0x7fffe801cb80, tc=0x7fffe801cb20) at ../talloc.c:1593 #7 _tc_free_internal (location=0x5555555b02ea "src/main/process.c:604", tc=0x7fffe801cb20) at ../talloc.c:1104 #8 _tc_free_children_internal (location=0x5555555b02ea "src/main/process.c:604", ptr=0x555555c80a60, tc=0x555555c80a00) at ../talloc.c:1593 #9 _tc_free_internal (tc=0x555555c80a00, location=0x5555555b02ea "src/main/process.c:604") at ../talloc.c:1104 #10 0x00007ffff6e79d87 in _tc_free_children_internal (location=0x5555555b02ea "src/main/process.c:604", ptr=0x555555c808b0, tc=0x555555c80850) at ../talloc.c:1593 #11 _tc_free_internal (location=0x5555555b02ea "src/main/process.c:604", tc=0x555555c80850) at ../talloc.c:1104 #12 _tc_free_children_internal (location=0x5555555b02ea "src/main/process.c:604", ptr=0x555555c80690, tc=0x555555c80630) at ../talloc.c:1593 #13 _tc_free_internal (tc=0x555555c80630, location=0x5555555b02ea "src/main/process.c:604") at ../talloc.c:1104 #14 0x000055555558bae7 in request_done (request=request@entry=0x555555c808b0, action=<optimized out>, action@entry=2) at src/main/process.c:899 #15 0x000055555558e14d in request_cleanup_delay (request=0x555555c808b0, action=<optimized out>) at src/main/process.c:1212 #16 0x00007ffff79928d4 in fr_event_run (el=el@entry=0x555555bd60b0, when=when@entry=0x7fffffffe350) at src/lib/event.c:309 #17 0x00007ffff7992ec9 in fr_event_loop (el=0x555555bd60b0) at src/lib/event.c:632 #18 0x0000555555569f06 in main (argc=<optimized out>, argv=<optimized out>) at src/main/radiusd.c:611 The crash occures always within a few hours, sometimes soon after startup. Version 2.x with a similar setup runs stable. I didn't provide the output of -X because it contains sensible data, but I could provide cleaned logs and configs, if needed. Thanks and greetings, Daniel

4 15

Including same directory twice is not working
by Chinnapaiyan, Nagamani 04 Dec '19

04 Dec '19

Hi, I am using 4.0.x branch(#fed87e6406e291d472c20a5cabbe7324ce7148f2). dhcp site file: recv DHCP-Discover { ... $INCLUDE ${raddbdir}/dhcp-subconfigs/devstack01/ut/subconfigs_discover/ ... } recv DHCP-Request { ... $INCLUDE ${raddbdir}/dhcp-subconfigs/devstack01/ut/subconfigs_request/ ... } recv DHCP-Inform { ... $INCLUDE ${raddbdir}/dhcp-subconfigs/devstack01/ut/subconfigs/ ... } recv DHCP-Release { ... $INCLUDE ${raddbdir}/dhcp-subconfigs/devstack01/ut/subconfigs/ ... } All these ${raddbdir}/dhcp-subconfigs/devstack01/ut/subconfigs*/ directories have same files in them. subconfigs: 1_biz.cfg 2_res.cfg 3_vut.cfg 4_sim.cfg 5_ut.cfg 6_simut.cfg subconfigs_discover: 1_biz.cfg 2_res.cfg 3_vut.cfg 4_sim.cfg 5_ut.cfg 6_simut.cfg subconfigs_request: 1_biz.cfg 2_res.cfg 3_vut.cfg 4_sim.cfg 5_ut.cfg 6_simut.cfg If directory names are different (but same files in them), INCLUDE works without any problem. But if I include same directory twice it segfaults. radius debug output: # /usr/sbin/radiusd -X Info : FreeRADIUS Version 4.0.0 Info : Copyright 1999-2019 The FreeRADIUS server project and contributors Info : There is NO warranty; not even for MERCHANTABILITY or FITNESS FOR A Info : PARTICULAR PURPOSE Info : You may redistribute copies of FreeRADIUS under the terms of the Info : GNU General Public License Info : For more information about these matters, see the file named COPYRIGHT Info : Starting - reading configuration files ... Debug : Including dictionary file "/etc/raddb/dictionary" including configuration file /etc/raddb/radiusd.conf including configuration file /etc/raddb/clients.conf Including files in directory "/etc/raddb/mods-enabled/" including configuration file /etc/raddb/mods-enabled/redis including configuration file /etc/raddb/mods-enabled/redis_ippool including configuration file /etc/raddb/mods-enabled/ldap including configuration file /etc/raddb/mods-enabled/linelog_dhcp including configuration file /etc/raddb/mods-enabled/dhcpv4 including configuration file /etc/raddb/mods-enabled/always including configuration file /etc/raddb/mods-enabled/expr Including files in directory "/etc/raddb/policy.d/" including configuration file /etc/raddb/policy.d/abfab-tr including configuration file /etc/raddb/policy.d/accounting including configuration file /etc/raddb/policy.d/canonicalization including configuration file /etc/raddb/policy.d/control including configuration file /etc/raddb/policy.d/cui including configuration file /etc/raddb/policy.d/debug including configuration file /etc/raddb/policy.d/dhcp including configuration file /etc/raddb/policy.d/eap including configuration file /etc/raddb/policy.d/filter including configuration file /etc/raddb/policy.d/operator-name including configuration file /etc/raddb/policy.d/time including configuration file /etc/raddb/policy.d/vendor Including files in directory "/etc/raddb/sites-enabled/" including configuration file /etc/raddb/sites-enabled/dhcp Loaded module "proto_dhcpv4" Including files in directory "/etc/raddb/dhcp-subconfigs/devstack01/ut/subconfigs_discover/" including configuration file /etc/raddb/dhcp-subconfigs/devstack01/ut/subconfigs_discover/1_biz.cfg including configuration file /etc/raddb/dhcp-subconfigs/devstack01/ut/subconfigs_discover/2_res.cfg including configuration file /etc/raddb/dhcp-subconfigs/devstack01/ut/subconfigs_discover/3_vut.cfg including configuration file /etc/raddb/dhcp-subconfigs/devstack01/ut/subconfigs_discover/4_sim.cfg including configuration file /etc/raddb/dhcp-subconfigs/devstack01/ut/subconfigs_discover/5_ut.cfg including configuration file /etc/raddb/dhcp-subconfigs/devstack01/ut/subconfigs_discover/6_simut.cfg Including files in directory "/etc/raddb/dhcp-subconfigs/devstack01/ut/subconfigs_request/" including configuration file /etc/raddb/dhcp-subconfigs/devstack01/ut/subconfigs_request/1_biz.cfg including configuration file /etc/raddb/dhcp-subconfigs/devstack01/ut/subconfigs_request/2_res.cfg including configuration file /etc/raddb/dhcp-subconfigs/devstack01/ut/subconfigs_request/3_vut.cfg including configuration file /etc/raddb/dhcp-subconfigs/devstack01/ut/subconfigs_request/4_sim.cfg including configuration file /etc/raddb/dhcp-subconfigs/devstack01/ut/subconfigs_request/5_ut.cfg including configuration file /etc/raddb/dhcp-subconfigs/devstack01/ut/subconfigs_request/6_simut.cfg Including files in directory "/etc/raddb/dhcp-subconfigs/devstack01/ut/subconfigs/" including configuration file /etc/raddb/dhcp-subconfigs/devstack01/ut/subconfigs/1_biz.cfg including configuration file /etc/raddb/dhcp-subconfigs/devstack01/ut/subconfigs/2_res.cfg including configuration file /etc/raddb/dhcp-subconfigs/devstack01/ut/subconfigs/3_vut.cfg including configuration file /etc/raddb/dhcp-subconfigs/devstack01/ut/subconfigs/4_sim.cfg including configuration file /etc/raddb/dhcp-subconfigs/devstack01/ut/subconfigs/5_ut.cfg including configuration file /etc/raddb/dhcp-subconfigs/devstack01/ut/subconfigs/6_simut.cfg including configuration file /etc/raddb/dhcp-subconfigs/devstack08/ut/main.cfg including configuration file /etc/raddb/dhcp-subconfigs/devstack10/ut/main.cfg including configuration file /etc/raddb/dhcp-subconfigs/devstack01/host/main.cfg including configuration file /etc/raddb/dhcp-subconfigs/devstack08/host/main.cfg including configuration file /etc/raddb/dhcp-subconfigs/devstack10/host/main.cfg including configuration file /etc/raddb/dhcp-subconfigs/vasn-stackids-switch.out Including files in directory "/etc/raddb/dhcp-subconfigs/devstack01/ut/subconfigs/" CAUGHT SIGNAL: Segmentation fault Backtrace of last 8 frames: /usr/lib64/freeradius/libfreeradius-util.so(fr_fault+0x1ae)[0x7f0136607c2e] /lib64/libpthread.so.0(+0xf5f0)[0x7f0134e595f0] /lib64/libc.so.6(fgets+0x1b)[0x7f013467396b] /usr/lib64/freeradius/libfreeradius-server.so(cf_file_read+0x30e)[0x7f0136ccf9de] /usr/lib64/freeradius/libfreeradius-server.so(main_config_init+0x223)[0x7f0136ce8573] /usr/sbin/radiusd(main+0x526)[0x4040d6] /lib64/libc.so.6(__libc_start_main+0xf5)[0x7f0134627505] /usr/sbin/radiusd[0x404d6d] No panic action set _EXIT(139) CALLED src/lib/util/debug.c[920]. Last error was: Invalid attribute reference, missing '&' prefix Regards, Nagamani Chinnapaiyan

2 3

802.1x dynamic vlan and remote desktop
by Luc Paulin 03 Dec '19

03 Dec '19

Hi Eveyrone, I am currently testing 802.1x dynamic vlan. So far all work great, except for remote dekstop connection. Look like RDP and dynamic vlan doesn't make a good fit, or I may not be doing it correctly. I currently do first computer authentification at bootup and then once user is logging in, user authentication is done and switch's port move to the right vlan. Look like no matter which user logged in a desktop, it's the "computer account/vlan" that has priority over the user's account/vlan. Therefore if user was already logged in his system, then decide later to do an RDP session, the system will switch to "computers" vlan subnet, which cause disconnection/dns update/replication time issues. How do you manage remote desktop and dynamic vlan within your environement? Any hint/clues on how to achieve this? -Luc -- !!!!! ( o o ) --------------oOO----(_)----OOo-------------- Luc Paulin email: paulinster(at)gmail.com Skype: paulinster

2 2

Is it possible to do Vlan assignment based on what nas the login request is coming from?
by Håvard Rabbe 01 Dec '19

01 Dec '19

Hi Im testing vlan assignment on wifi. Freeradius 3 with sql. Looks like it is working ok. But I want a user to be asigned to different vlan based on what nas the login request is coming from. Is this possible? Like if user test log in on nas1 it gets vlan 100 and if the same user log in on nas2 it gets vlan 200 Any ideas? Best Regards, Håvard Rabbe Sendt fra min iPhone Sendt fra min iPhone

3 4