June 2019 - Freeradius-Users - lists.freeradius.org

Exec-Program-Wait not working
by Gianni Costanzi 19 Jun '19

19 Jun '19

Hi, I was using the following syntax on Freeradius 2.x to determine if a user could connect to a particular IP address, even if the authentication succeeds, based on some parameters passed to a script: XXX747 Auth-Type = System, Realm == imp Service-Type := Login-User, cisco-avpair = "shell:priv-lvl=2", Exec-Program-Wait = "/opt/script/radius/bin/check_operator_access.sh %{NAS-IP-Address} %{User-Name} %{Realm}" It worked on my old 2.x installation, now I'm on the last version available on Red Hat Enterprise 7, which is 3.0.13-10.el7_6. The syntax gives no error, but the script is not invoked (it contains an invocation to logger system command to put an entry in /var/log/messages and I can't see it), even if the above entry in the users (authorize) file is mached. What could be the problem? If this is the wrong way to implement this check can you give me an hint on how should I do it on 3.x Freeradius installation? Wed Jun 19 17:01:52 2019 : Debug: (12) files: users: Matched entry XXX747 at line 497 Wed Jun 19 17:01:52 2019 : Debug: /opt/script/radius/bin/check_operator_access.sh %{NAS-IP-Address} %{User-Name} %{Realm} Wed Jun 19 17:01:52 2019 : Debug: Parsed xlat tree: Wed Jun 19 17:01:52 2019 : Debug: literal --> /opt/script/radius/bin/check_operator_access.sh Wed Jun 19 17:01:52 2019 : Debug: attribute --> NAS-IP-Address Wed Jun 19 17:01:52 2019 : Debug: literal --> Wed Jun 19 17:01:52 2019 : Debug: attribute --> User-Name Wed Jun 19 17:01:52 2019 : Debug: literal --> Wed Jun 19 17:01:52 2019 : Debug: attribute --> Realm Wed Jun 19 17:01:52 2019 : Debug: (12) files: EXPAND /opt/script/radius/bin/check_operator_access.sh %{NAS-IP-Address} %{User-Name} %{Realm} Wed Jun 19 17:01:52 2019 : Debug: (12) files: --> /opt/script/radius/bin/check_operator_access.sh 172.16.120.218 XXX747@imp imp Wed Jun 19 17:01:52 2019 : Debug: (12) modsingle[authorize]: returned from files (rlm_files) Wed Jun 19 17:01:52 2019 : Debug: (12) [files] = ok Thank you in advance for any help. Best regards, Gianni Costanzi

3 14

get statistics for sql connection pool
by Daniel Finger 18 Jun '19

18 Jun '19

Hi! If the radius server is running for about a month, I get messages like "No connections available and at max connection limit". Looking at the database, only very few connections are really connected (for example 2 out of 50), there are no slow queries, not much traffic (maybe one or two packets per second) and I really don't see a reason for this. Restarting freeRADIUS immediately fixes the problem. I suspect I am using a module (I have 2 own modules running) which does not return a connection to the connection pool under some circumstances. Is it possible to get statistics about the sql connection pool usage? This could help me size the number of connections I need and get a hint, if I am reaching the limit, before I hit it. Greetings, Daniel Finger

2 2

hourly auth logs -> change to daily
by Colleen Morrissey 18 Jun '19

18 Jun '19

Hopefully easy question - I recently rebuilt to v3.0.18 and the authentication logs in /usr/local/var/log/radius.log are being created hourly. I want to change this to daily - where is the config for this? I have my radacct detail files going daily via mods-enabled/detail but can't figure out config for the file = ${logdir}/radius.log Thank you in advance, Colleen

2 1

Debian buster packages from packages.freeradius.com?
by Mathieu Simon (Lists) 17 Jun '19

17 Jun '19

Hi I didn't want to hijack that other thread about Ubuntu bionic but was reminded about the question that I wanted to ask but then forgot to for some time: Are there plans to provide packags for Debian buster on that repository? I've been testing Debian buster, even though it is not yet officially released, however the stream of significant updates has slowed quite a bit (due to the version freeze in effect) and for many cases it already looks quite OK thus the Debian project looks like it might release make it a release in the next month or so. I've done a random package build from source and for what I can tell, it seems to be working for on my testing system, but I take these results with a grain of salt. ;-) Regards Mathieu

2 1

Rebuild of bionic package from packages.networkradius.com?
by Enno Gröper 17 Jun '19

17 Jun '19

Hi, last week Ubuntu pushed their libssl 1.1.0 -> 1.1.1 updates to the bionic-updates channel [1]. Since then the "upstream" package of freeradius from packages.networkradius.com stopped working: libssl version mismatch. built: 1010007f linked: 1010100f Are there any plans to publish an updated version? At the moment we need to put libssl on hold, which I'm not very comfortable with. Micha Ballmann asked a similar question last Friday, but didn't get an answer using this channel. Unfortunately I wasn't able to find the other channel(s) he seems to have used. Best regards, Enno [1] https://lists.ubuntu.com/archives/ubuntu-devel/2018-December/040567.html

3 2

Re: Need help on "ERROR: No Auth-Type found: rejecting the user via Post-Auth-Type = Reject"
by Parth Gajjar (pagajjar) 17 Jun '19

17 Jun '19

Hi Team, I am facing below error, while using free radius. < radiusd.conf is attached> We are using dot1x, we have enabled pap & chap in the config. Added clients & users in both files. Ready to process requests (0) Received Access-Request Id 137 from 10.106.26.212:1645 to 10.105.41.247:1812 length 51 (0) User-Password = "hello" (0) User-Name = "parth" (0) NAS-IP-Address = 10.106.26.212 (0) ERROR: No Auth-Type found: rejecting the user via Post-Auth-Type = Reject (0) Failed to authenticate the user (0) Using Post-Auth-Type Reject (0) Post-Auth-Type sub-section not found. Ignoring. (0) Login incorrect (No Auth-Type found: rejecting the user via Post-Auth-Type = Reject): [parth/hello] (from client 10.106.26.212 port 0) (0) Delaying response for 1.000000 seconds Waking up in 0.6 seconds. Waking up in 0.3 seconds. (1) Received Access-Request Id 119 from 10.106.26.212:62566 to 10.105.41.247:1812 length 57 (1) User-Password = "hello" (1) User-Name = "parth" (1) NAS-IP-Address = 10.106.26.212 (1) Event-Timestamp = "Jan 1 1970 05:30:01 IST" (1) ERROR: No Auth-Type found: rejecting the user via Post-Auth-Type = Reject (1) Failed to authenticate the user (1) Using Post-Auth-Type Reject (1) Post-Auth-Type sub-section not found. Ignoring. (1) Login incorrect (No Auth-Type found: rejecting the user via Post-Auth-Type = Reject): [parth/hello] (from client 10.106.26.212 port 0) (1) Delaying response for 1.000000 seconds (0) Sending delayed response (0) Sent Access-Reject Id 137 from 10.105.41.247:1812 to 10.106.26.212:1645 length 20 Waking up in 0.6 seconds. Waking up in 0.3 seconds. (1) Sending delayed response (1) Sent Access-Reject Id 119 from 10.105.41.247:1812 to 10.106.26.212:62566 length 20 Waking up in 3.0 seconds. (0) Cleaning up request packet ID 137 with timestamp +8 Waking up in 0.9 seconds. (2) Received Access-Request Id 137 from 10.106.26.212:1645 to 10.105.41.247:1812 length 51 (2) User-Password = "hello" (2) User-Name = "parth" (2) NAS-IP-Address = 10.106.26.212 (2) ERROR: No Auth-Type found: rejecting the user via Post-Auth-Type = Reject (2) Failed to authenticate the user (2) Using Post-Auth-Type Reject (2) Post-Auth-Type sub-section not found. Ignoring. (2) Login incorrect (No Auth-Type found: rejecting the user via Post-Auth-Type = Reject): [parth/hello] (from client 10.106.26.212 port 0) (2) Delaying response for 1.000000 seconds Waking up in 0.6 seconds. Thanks & Regards, Parth Gajjar

2 4

Is there way to convert output octets and input octets to KB
by Mustafa Nassir 17 Jun '19

17 Jun '19

Hi there As I say from title is there any way to convert output and input octets to KB because I have small problem when I add to mysql value with 12 number in radtest I get small error it's give me the result just 10 number and note what I insert in SQL , I insert I SQL 10737418240 to limit my users 10 GB for total octets but in radtest I get other result but if I add 10 8 number I get same number in result any help for this ?

3 11

Retrieving the NAS-ID content
by Philemon Jaomalaza 15 Jun '19

15 Jun '19

Bonjour, How can I retrieve the NAS-ID content sent by a NAS during an Acces Request? the goal is to use it in a PHP query Thank's JMLZ --- L'absence de virus dans ce courrier électronique a été vérifiée par le logiciel antivirus Avast. https://www.avast.com/antivirus

2 1

Freeradius SSL probelm
by Micha Ballmann 14 Jun '19

14 Jun '19

Hello, today i patched my freeradius server. The version of openssl has changed from 1.1.0g-2ubuntu4.3 to 1.1.1-1ubuntu2.1~18.04.2. Now freeradius wont start. When im trying to start with debug following message appears: # radiusd -X *libssl version mismatch. built: 1010007f linked: 1010100f* How can i fix this? Best regards Micha

2 1

DHCP metrics
by Damon Munhall 14 Jun '19

14 Jun '19

This is a high-level question, but my searching hasn't yielded anything similar, thus far. Are DHCP metrics generated and accessible, somehow? Specifically, the number of each type of DHCP packet sent/received, and any DHCP-related errors generated. The status module has similar functionality, but only appears to report-on RADIUS metrics. I'm interested in, and working with, different DHCP functionality in the latest 3.x and 4.x (primarily 4.x). My 'plan-B' would likely involve some logging/log-scraping, but that will certainly have more performance overhead. Thanks, Damon

2 1