July 2019 - Freeradius-Users - lists.freeradius.org

Filtering accounting messages
by liran kessel 15 Jul '19

15 Jul '19

Hi, I am receiving accounting messages from the network and storing them to the radacct table. Currently in order to filter I have changed the INSERT/UPDATE commands with a where statement to only insert rows for subscribers I am managing. This is working fine but as my network grows it is creating a lot of overhead to execute SQL commands that don’t do anything and so I am trying to move the filtering to the FreeRADIUS code. I have added the preacct to the attr_filter file: attr_filter attr_filter.preacct { key = "%{User-Name}" filename = ${modconfdir}/${.:name}/preacct } And have this preacct file to try and currently filter only 1 number from being inserted to the DB. # # Configuration file for the rlm_attr_filter module. # Please see rlm_attr_filter(5) manpage for more information. # # # This configuration file is used to remove almost all of the attributes # From an Accounting-Response message. The RFC's say that an # Accounting-Response packet can contain only a few attributes. # We enforce that here. # DEFAULT Vendor-Specific =* ANY, Message-Authenticator =* ANY, Error-Cause =* ANY, Proxy-State =* ANY, Calling-Station-Id == ‘XXXXXXXX' However it seems that the filter is being ignored and all lines are inserted to the DB. Can you please assist in understanding why it isn’t filtering? In addition if I have a list of about 100K subscribers that I do want to store their accounting data to the DB is there a way to manage this list without adding it 1 by 1 to the filter file? I am running Freeradius 3.0.13 with PostgreSQL. Thanks Liran Kessel

3 7

EAP-TLS ON WINDOWS 7
by Root Networks 14 Jul '19

14 Jul '19

Hello Guys, i am struggling to make EAP-TLS to work on my Windows 7 but still no good results. I have created ca,server and clients certificates and PEAP is working fine. but EAP-TLS is not working. can you please redirect me to a link or thread explaing EAP-TLS on windows Regards, Kelvin

3 4

Freeradius proxy.conf login based
by Olivier CALVANO 14 Jul '19

14 Jul '19

Hi Actually i use proxy.conf for forward auth-request to the good radius server: realm "~(myrealm.realm)" { auth_pool = pool-auth.myrealm.realm acct_pool = pool-acct.myrealm.realm nostrip } login(a)myrealm.realm work's very good. but for one supplier, i want forward based on login, sample: realm "MSP-*@OTHER" { auth_pool = pool-auth.myrealm.realm acct_pool = pool-acct.myrealm.realm nostrip } it's possible ? i think's that i don't have the good synthaxe of realm because that's don't work thanks for your help regards

2 1

tcp connection for dynamic client
by MaRjAn GoOdAsiAeE 14 Jul '19

14 Jul '19

Hi all. I'm using nas table in the database for dynamic clients. I have a proto field in that table that can have tcp or udp value. but the problem is that there is no proper attribute for protocol in freeradius that i can set in dynamic_client file like FreeRADIUS_Client_protocol or something like that. how can I set tcp protocol for my dynamic clients?

2 1

Dynamic NAS in CoA From Database
by One Zero Art 14 Jul '19

14 Jul '19

Hi, I am wondering if it's possible to add NAS in home_server for CoA dynamically. I want to query NAS IP and secret from the database by SQL and add it in CoA section. Is it even possible anyhow? Right now in my system CoA is working fine. All I need is to somehow able to add NAS info in CoA. Search web for two hours but no luck on this. Note: I am using FR 3.x.x Thank you

2 1

4.0.x - issues with radmin tool
by Milan Nikolic 13 Jul '19

13 Jul '19

Hello, Some recent commit added `-S` option to radmin, to pass secret. I don't understand what secret it is asking for, from localhost that should be secret for localhost client right? Whatever I try to enter if it asks for secret, or with `-S` option it just hangs. I hacked/commented that part of code so I can use radmin as before (also on 4.0.x), but now every command executed with `radmin -e` returns always 1, even if succeeded, i.e. `radmin -f /run/radiusd/control/radiusd.sock -e 'stats network 0 self'` shows stats but returns 1 (btw. nice that now radmin will look for socket file from config, but without `-f` it prints some debug output). Also, I have problems with `radmin -e 'set debug level 2'` for example, it does not do anything. Is radmin still not in usable state? I use it for stats currently but it would be nice to have some easy way to switch debug levels on fly. Thanks, Milan

2 4

NSS DB
by Andrew Meyer 12 Jul '19

12 Jul '19

Hello,I am having some trouble getting FreeRADIUS to work. I am trying to set it up to communicate with my LDAP system (FreeIPA). I am using CentOS 7 latest w/ FreeRADIUS 3.0.13 and receiving the following errors. [root@console02 nssdb]# sudo systemctl status radiusd -l ● radiusd.service - FreeRADIUS high performance RADIUS server. Loaded: loaded (/usr/lib/systemd/system/radiusd.service; enabled; vendor preset: disabled) Active: failed (Result: exit-code) since Fri 2019-07-12 15:11:52 UTC; 11min ago Process: 4068 ExecStart=/usr/sbin/radiusd -d /etc/raddb (code=exited, status=1/FAILURE) Process: 4063 ExecStartPre=/usr/sbin/radiusd -C (code=exited, status=0/SUCCESS) Process: 4060 ExecStartPre=/bin/chown -R radiusd.radiusd /var/run/radiusd (code=exited, status=0/SUCCESS) Main PID: 1079 (code=exited, status=0/SUCCESS) Jul 12 15:11:51 console02.loc.example.local systemd[1]: Starting FreeRADIUS high performance RADIUS server.... Jul 12 15:11:52 console02.loc.example.local radiusd[4068]: TLSMC: MozNSS compatibility interception begins. Jul 12 15:11:52 console02.loc.example.local radiusd[4068]: tlsmc_convert: INFO: cannot open the NSS DB, expecting PEM configuration is present. Jul 12 15:11:52 console02.loc.example.local radiusd[4068]: tlsmc_intercept_initialization: INFO: successfully intercepted TLS initialization. Continuing with OpenSSL only. Jul 12 15:11:52 console02.loc.example.local radiusd[4068]: TLSMC: MozNSS compatibility interception ends. Jul 12 15:11:52 console02.loc.example.local systemd[1]: radiusd.service: control process exited, code=exited status=1 Jul 12 15:11:52 console02.loc.example.local systemd[1]: Failed to start FreeRADIUS high performance RADIUS server.. Jul 12 15:11:52 console02.loc.example.local systemd[1]: Unit radiusd.service entered failed state. Jul 12 15:11:52 console02.loc.example.local systemd[1]: radiusd.service failed. [root@console02 nssdb]# I have been doing some research and found that there is an issue w/ Redhat/CentOS.'Re: TLSMC: MozNSS compatibility interception begins message' - MARC | | | | 'Re: TLSMC: MozNSS compatibility interception begins message' - MARC | | | Is this still true for the version I have? I have tried creating a SSL cert from FreeIPA but that didn't seem to work. It is also possible I have missed a step. All help is greatly appreciated. Thank you!

2 2

Reasons for "MS-CHAP2-Response is incorrect"
by Sven Hartge 12 Jul '19

12 Jul '19

Hi all! The 1st level support group here has asked me to clarify the reasons behind authentication errors where the message is "mschap: MS-CHAP2-Response is incorrect" so they can better point the end users in the right direction. The obvious one is of course "wrong password", another one is "mucking about with the Username in the RADIUS server" (which I don't do). What other reasons are there for this error type to occur? Grüße, Sven.

2 2

Framed-IP-Address, debit pool conflict
by Ali Arslan 12 Jul '19

12 Jul '19

Hello, In our system we put users that have unpaid invoices in debit group which has Framed-Pool = debit_pool so they can't access internet. But this does not work for users that have static IP because in that case user does not get ip from debit pool. Not to delete radreply record for Framed-IP-Address and to give the same ip back after payment my solution is to add a column named IsActive (tinyint -bool) to radreply table and change authorize_reply_query in /etc/freeradius/3.0/mods-config/sql/main/mysql/queries.conf file.as follows: authorize_reply_query = "\ SELECT id, username, attribute, value, op \ FROM ${authreply_table} \ WHERE username = '%{SQL-User-Name}' AND IsActive = 1 \ ORDER BY id" and when putting user in debit group IsActive field is set as 0 and after payment it is set as 1. Is it an acceptable solution without side effects, or are there better solutions? Thanks.

2 1

Fwd: Expected Access-Accept got Access-Reject
by David Musoke 12 Jul '19

12 Jul '19

*RegardsDavid Musoke* *ICT Department* *Mob: +256773731776* * +256776039250* * +256757414650* ---------- Forwarded message --------- From: David Musoke <dmusoke(a)umu.ac.ug> Date: Fri, Jul 12, 2019 at 12:35 PM Subject: Expected Access-Accept got Access-Reject To: <reeradius-users(a)lists.freeradius.org> Hello Group, I have just installed FreeRADIUS Version 3.0.16 but when i run radtest sqltest testpwd localhost 1813 testing123 i get Sent Access-Request Id 126 from 0.0.0.0:46109 to 127.0.0.1:1812 length 77 Received Access-Reject Id 126 from 127.0.0.1:1812 to 0.0.0.0:0 length 20 (0) -: Expected Access-Accept *got Access-Reject* I get an access reject. Please help me what the problem is *RegardsDavid Musoke* *ICT Department* *Mob: +256773731776* * +256776039250* * +256757414650* --

4 6