October 2020 - Freeradius-Users - lists.freeradius.org

Ignoring duplicate packet
by Ammad Ali 14 Oct '20

14 Oct '20

Hi Guys, I am continuously having below ERRORs in my radius.log. I am using freeradius 3.0.4 with MySQL DB as backend. Please advise. Tue Oct 13 17:19:38 2020 : Error: (30192740) Ignoring duplicate packet from client BRAS port 43706 - ID: 246 due to unfinished request in component <core> module Tue Oct 13 17:19:38 2020 : Error: (30192747) Ignoring duplicate packet from client BRAS port 57012 - ID: 247 due to unfinished request in component <core> module Tue Oct 13 17:19:38 2020 : Error: (30192752) Ignoring duplicate packet from client BRAS port 45769 - ID: 168 due to unfinished request in component <core> module Tue Oct 13 17:19:38 2020 : Error: (30192771) Ignoring duplicate packet from client BRAS port 39617 - ID: 170 due to unfinished request in component <core> module Tue Oct 13 17:19:38 2020 : Error: (30192757) Ignoring duplicate packet from client BRAS port 59376 - ID: 169 due to unfinished request in component <core> module Tue Oct 13 17:19:38 2020 : Error: (30192774) Ignoring duplicate packet from client BRAS port 59596 - ID: 248 due to unfinished request in component <core> module Tue Oct 13 17:19:39 2020 : Info: rlm_sql (sql): 0 of 37 connections in use. Need more spares Tue Oct 13 17:19:39 2020 : Info: rlm_sql (sql): Opening additional connection (189864) Tue Oct 13 17:19:39 2020 : Error: (30192791) Ignoring duplicate packet from client BRAS port 48742 - ID: 249 due to unfinished request in component <core> module Tue Oct 13 17:19:39 2020 : Error: (30192800) Ignoring duplicate packet from client BRAS port 52267 - ID: 250 due to unfinished request in component <core> module Tue Oct 13 17:19:39 2020 : Error: (30192771) Ignoring duplicate packet from client BRAS port 39617 - ID: 170 due to unfinished request in component <core> module Tue Oct 13 17:19:39 2020 : Error: (30192774) Ignoring duplicate packet from client BRAS port 59596 - ID: 248 due to unfinished request in component <core> module Tue Oct 13 17:19:39 2020 : Error: (30192791) Ignoring duplicate packet from client BRAS port 48742 - ID: 249 due to unfinished request in component <core> module Tue Oct 13 17:19:39 2020 : Error: (30192800) Ignoring duplicate packet from client BRAS port 52267 - ID: 250 due to unfinished request in component <core> module Tue Oct 13 17:19:39 2020 : Error: (30192825) Ignoring duplicate packet from client BRAS port 47240 - ID: 251 due to unfinished request in component <core> module Tue Oct 13 17:19:39 2020 : Error: (30192840) Ignoring duplicate packet from client BRAS port 33382 - ID: 72 due to unfinished request in component <core> module Tue Oct 13 17:19:39 2020 : Error: (30192825) Ignoring duplicate packet from client BRAS port 47240 - ID: 251 due to unfinished request in component <core> module Tue Oct 13 17:19:40 2020 : Error: (30192840) Ignoring duplicate packet from client BRAS port 33382 - ID: 72 due to unfinished request in component <core> module --

3 9

Testing mschapv2 with custom radius attributes
by Munroe Sollog 14 Oct '20

14 Oct '20

I'm trying to set Aruba-Essid-Name using the -N option in the eapol_test command. It says I need to use the numeric ID of the attribute. When I look at the dictionary.aruba file the VENDOR is "14823" and the Aruba-Essid-Name is "5". If I am interpreting this correctly I would do something like: eapol_test -c /etc/eapol_test.conf -a 192.168.10.10 -ss3cr3t -N148235:s:myessid When I run that command I get: 0) Received Access-Request Id 0 from 192.168.0.244:48088 to 192.168.10.10:1812 length 134 (0) User-Name = "testuser" (0) NAS-IP-Address = 127.0.0.1 (0) Calling-Station-Id = "02-00-00-00-00-01" (0) Framed-MTU = 1400 (0) NAS-Port-Type = Wireless-802.11 (0) Service-Type = Framed-User (0) Connect-Info = "CONNECT 11Mbps 802.11b" (0) Filter-Id = "myessid" "Filter-Id" is showing up rather than "Aruba-Essid-Name" so obviously I am interpreting what I need to do incorrectly. Any help would be appreciated. -- Munroe Sollog (He/Him/His) Senior Network Engineer munroe(a)lehigh.edu

3 6

"No EAP session matching state" - logging
by Robert Franklin 13 Oct '20

13 Oct '20

Hello, Please excuse I haven't got a "radiusd -X" debugging output for this -- trying to catch one is quite difficult, given the intermittent nature of the problem, the difficulty matching a problematic supplicant and the volume of traffic I'm sifting through, as well as the issue being on a NAS that's behind a downstream proxy (but I'm responsible for the home server[*]) and with a supplicant I don't have access to, so I thought I'd start with general principles first, just to check my understanding is correct... I am investigating a situation where we're getting an Access-Reject reply being sent, with a Module-Failure-Message of "No EAP session matching state ...". The previous connection successful attempt was several minutes before and the supplicant repeatedly tries for a minute, with errors showing this state number, then I get messages with another state number, etc. Eventually it successfully connects, so I get streams such as: 2020-10-13 15:44:41 [various challenges] + Access-Accept 2020-10-13 15:47:41 Access-Reject: No EAP session matching state 0xc600f921c5e0e014 2020-10-13 15:47:43 Access-Reject: No EAP session matching state 0xc600f921c5e0e014 2020-10-13 15:47:45 Access-Reject: No EAP session matching state 0xc600f921c5e0e014 2020-10-13 15:47:47 Access-Reject: No EAP session matching state 0xc600f921c5e0e014 2020-10-13 15:47:49 Access-Reject: No EAP session matching state 0xc600f921c5e0e014 2020-10-13 15:47:51 Access-Reject: No EAP session matching state 0xc600f921c5e0e014 2020-10-13 15:47:53 Access-Reject: No EAP session matching state 0xc600f921c5e0e014 2020-10-13 15:47:55 Access-Reject: No EAP session matching state 0xc600f921c5e0e014 2020-10-13 15:47:57 Access-Reject: No EAP session matching state 0xc600f921c5e0e014 2020-10-13 15:47:59 Access-Reject: No EAP session matching state 0xc600f921c5e0e014 2020-10-13 15:48:01 Access-Reject: No EAP session matching state 0xc600f921c5e0e014 2020-10-13 15:48:35 Access-Reject: No EAP session matching state 0x3c4d84e73c959d9c 2020-10-13 15:48:37 Access-Reject: No EAP session matching state 0x3c4d84e73c959d9c 2020-10-13 15:48:39 Access-Reject: No EAP session matching state 0x3c4d84e73c959d9c 2020-10-13 15:48:41 Access-Reject: No EAP session matching state 0x3c4d84e73c959d9c 2020-10-13 15:48:43 Access-Reject: No EAP session matching state 0x3c4d84e73c959d9c 2020-10-13 15:48:45 Access-Reject: No EAP session matching state 0x3c4d84e73c959d9c 2020-10-13 15:48:47 Access-Reject: No EAP session matching state 0x3c4d84e73c959d9c 2020-10-13 15:48:49 Access-Reject: No EAP session matching state 0x3c4d84e73c959d9c 2020-10-13 15:48:51 Access-Reject: No EAP session matching state 0x3c4d84e73c959d9c 2020-10-13 15:48:53 Access-Reject: No EAP session matching state 0x3c4d84e73c959d9c 2020-10-13 15:48:55 Access-Reject: No EAP session matching state 0x3c4d84e73c959d9c 2020-10-13 15:54:57 Access-Reject: No EAP session matching state 0x5ea230995b702974 2020-10-13 15:54:59 Access-Reject: No EAP session matching state 0x5ea230995b702974 2020-10-13 15:55:01 Access-Reject: No EAP session matching state 0x5ea230995b702974 2020-10-13 15:55:03 Access-Reject: No EAP session matching state 0x5ea230995b702974 2020-10-13 15:55:05 Access-Reject: No EAP session matching state 0x5ea230995b702974 2020-10-13 15:56:13 Access-Reject: No EAP session matching state 0x5d35a9ea5f31b098 2020-10-13 15:56:15 Access-Reject: No EAP session matching state 0x5d35a9ea5f31b098 2020-10-13 15:56:17 Access-Reject: No EAP session matching state 0x5d35a9ea5f31b098 2020-10-13 15:56:19 Access-Reject: No EAP session matching state 0x5d35a9ea5f31b098 2020-10-13 15:56:21 Access-Reject: No EAP session matching state 0x5d35a9ea5f31b098 2020-10-13 15:56:23 Access-Reject: No EAP session matching state 0x5d35a9ea5f31b098 2020-10-13 15:56:25 Access-Reject: No EAP session matching state 0x5d35a9ea5f31b098 2020-10-13 15:56:27 Access-Reject: No EAP session matching state 0x5d35a9ea5f31b098 2020-10-13 15:56:29 Access-Reject: No EAP session matching state 0x5d35a9ea5f31b098 2020-10-13 15:56:31 Access-Reject: No EAP session matching state 0x5d35a9ea5f31b098 2020-10-13 15:56:33 Access-Reject: No EAP session matching state 0x5d35a9ea5f31b098 2020-10-13 15:56:35 Access-Reject: No EAP session matching state 0x5d35a9ea5f31b098 2020-10-13 15:56:40 [various challenges] + Accept-Accept Is there anything I can infer from this, or would I need a full debug log for an affected supplicant? I assume these sessions either never existed (and the supplicant is just plain broken) or they were previous sessions that have been cleaned up (which I believe happens after 5 seconds - these go on for longer). Does getting these these new state numbers off the bat (i.e. with no previous EAP messages from the supplicant) imply the supplicant is doing something odd and continuing EAP conversations without me having seen the start of them? I linelog a message every time I receive a packet (so a full authentication stream has several lines) and have nothing for this supplicant aside from the above messages. Is there any way I can log the 'EAP session state' field in my linelog from previous messages so I can see if they're related to ones I've seen before? One thing that does look odd is that, from this particular downstream RADIUS proxy, we are seeing a lot of reauthentications (albeit mostly successful): I would normally only expect to see supplicants reauthenticating occasionally, but I'm often seeing things reauthenticate every 2-3 minutes, which looks a bit suspiciously like there are local problems at the visited site. Apologies if there's nothing you can really do to help me without the full debug log and, if I need it, I'll try and get in touch with an affected user and see if we can get it to fail - let me know and I'll come back when I have it. Because problems often only get reported after the event, I try to get as much as possible logged that I can look back through easily (a full debug log probably being too much), if someone reports something. - Bob * this is eduroam -- Robert Franklin <rcf34(a)cam.ac.uk> / (+44 1223 7) 48479 Network Systems, University Information Services, University of Cambridge

2 1

Re: Freeradius 3.0.19 causes 'acctterminatecause' cannot be null
by Volodymyr Litovka 13 Oct '20

13 Oct '20

Hi, On Mar 18, 2020; 1:04am Alan wrote: > > I'm using Freeradius 3.0.19 on Ubuntu 19.10. > > The default schema in > > /etc/freeradius/3.0/mods-config/sql/main/mysql/schema.sql doesn't > seem to > > work. I get the following error message, when connecting with my NAS. > > > > (3) sql: ERROR: rlm_sql_mysql: ERROR 1048 (Column 'acctterminatecause' > > cannot be null): 23000 > > > > I have attached the detailed log. > > The queries added in 3.0.18 had NULL for the 'acctterminatecause' > field. That should just be ''. > > I've pushed a fix to GitHub. > > Alan DEKok. Please, be aware, that queries.conf still contains an error (at least on Ubuntu 20.04, freeradius 3.0.20+dfsg-3build1), which appears when adding sql_session_start in post_auth section - queries.conf/accounting/type/post-auth explicitly inserts NULL for 'acctterminatecause' column. The patch below fixes this (only for MySQL), but I guess same can be done for other dialects: --- mods-config/sql/main/mysql/queries.conf.orig 2020-10-13 08:49:35.841485192 +0300 +++ mods-config/sql/main/mysql/queries.conf 2020-10-13 08:49:58.877127891 +0300 @@ -273,7 +273,7 @@ 0, \ '%{Called-Station-Id}', \ '%{Calling-Station-Id}', \ - NULL, \ + '', \ '%{Service-Type}', \ NULL, \ '', \ Thank you. -- Volodymyr Litovka "Vision without Execution is Hallucination." -- Thomas Edison

2 1

Two questions regards radacct table
by Raul Diaz 12 Oct '20

12 Oct '20

Hello everyone, I am working on a project and I have two questions. I hope you can help me with this. First question. Does acctoutputoctets in radacct table could be use to monitor bandwidth for users inside this table? Second question. How can I monitor bandwidth per user if acctoutputoctets or acctinputoctets are not for achieving this goal. I am running FreeRadius 3.0.13 with CentOS 7.8 Thanks in advance. -- Raúl Díaz García Ingeniero en Telecomunicaciones 0995002337 "I am Immortal I have inside me blood of kings" *Freddie Mercury*

2 4

No response to status-server but radtest status ok
by Arnaud LAURIOU 12 Oct '20

12 Oct '20

Hi, On our eduroam FR proxy, we had a home_server in a dead state for several hours. All status-server requests sent seemed to go unanswered. During this period, I checked this home_server status with radtest : got answers ! I tried to get this host alive by radmin: it fell back to zombie and dead states again. The only solution found to revive this home_server : restart the FR process on our proxy and the home_server remain to alive state. So, here are my questions : - Why the status-server requests sent by FR in dead state did not get answered, while those sent by radtest get response ? - Is there a way to force a revive from a dead state even with unanswered status-server requests ? Regards, Arnaud Lauriou

3 4

How to config FR 3.0.x (<->AD <-Windows 10) Computer(machine) authentication MSCHAP?
by 박지연 09 Oct '20

09 Oct '20

Hi. how can i config FR <-join->AD Client is Windows 10 mschap [auth type mschap, machine authenticaiton] my case below error(machine authenticaiton)... (but auth type mschap user authentication is fine) Thanks. -- ri Oct 9 10:56:30 2020 : Debug: (56) sql: SQL query returned: success Fri Oct 9 10:56:30 2020 : Debug: (56) sql: 1 record(s) updated Fri Oct 9 10:56:30 2020 : Debug: ppx_sql (sql): Released connection (9) Fri Oct 9 10:56:30 2020 : Debug: (56) modsingle[post-auth]: returned from sql (rlm_sql) Fri Oct 9 10:56:30 2020 : Debug: (56) [sql] = ok Fri Oct 9 10:56:30 2020 : Debug: (56) modsingle[post-auth]: calling attr_filter.access_reject (rlm_attr_filter) Fri Oct 9 10:56:30 2020 : Debug: %{User-Name} Fri Oct 9 10:56:30 2020 : Debug: Parsed xlat tree: Fri Oc! t 9 10:56:30 2020 : Debug: attribute --> User-Name Fri Oct 9 10:56:30 2020 : Debug: (56) attr_filter.access_reject: EXPAND %{User-Name} Fri Oct 9 10:56:30 2020 : Debug: (56) attr_filter.access_reject: --> host/park.test.com Fri Oct 9 10:56:30 2020 : Debug: (56) attr_filter.access_reject: Matched entry DEFAULT at line 1 Fri Oct 9 10:56:30 2020 : Debug: (56) attr_filter.access_reject: EAP-Message = 0x040e0004 allowed by EAP-Message =* 0x Fri Oct 9 10:56:30 2020 : Debug: (56) attr_filter.access_reject: Attribute "EAP-Message" allowed by 1 rules, disallowed by 0 rules Fri Oct 9 10:56:30 2020 : Debug: (56) attr_filter.access_reject: Message-Authenticator = 0x00000000000000000000000000000000 allowed by Message-Authenticator =* 0x Fri Oct 9 10:56:30 2020 : Debug: (56) attr_filter.access_reject: Attribute "Message-Authenticator" allowed by 1 rules, disallowed by 0 rules Fri Oct 9 1! 0:56:30 2020 : Debug: (56) modsingle[post-auth]: returned from attr_filter.access_reject (rlm_attr_filter) Fri Oct 9 10:56:30 2020 : Debug: (56) [attr_filter.access_reject] = updated Fri Oct 9 10:56:30 2020 : Debug: (56) } # Post-Auth-Type REJECT = updated Fri Oct 9 10:56:30 2020 : Auth: (56) Login Fail (eap: Failed continuing EAP PEAP (25) session. EAP sub-module failed): [host/park.test.com] (from client ALL port 0 cli F4-5C-89-9C-54-49) Fri Oct 9 10:56:30 2020 : Debug: (56) Delaying response for 1.000000 seconds Fri Oct 9 10:56:30 2020 : Debug: Waking up in 0.3 seconds. Fri Oct 9 10:56:30 2020 : Debug: Waking up in 0.6 seconds. Fri Oct 9 10:56:31 2020 : Debug: (56) Sending delayed response Fri Oct 9 10:56:31 2020 : Debug: (56) Sent Access-Reject Id 40 from 192.168.255.22:1812 to 192.168.255.21:45726 length 44 Fri Oct 9 10:56:31 2020 : Debug: (56) EAP-Message = 0x040e0004 Fri Oct&nb! sp; 9 10:56:31 2020 : Debug: (56) Message-Authenticator = 0x00000000000000000000000000000000 Fri Oct 9 10:56:31 2020 : Debug: Waking up in 3.7 seconds. -- [PutAck.jsp?ack_args=c2VudF9maWxlPWZkZEBrb3JlYS5jb20vLlNlbnQvMTYwMjIxMT Y1Mjc0NC4zMDIzNS5rb3JlYSZzZW5kX2RhdGU9MjAyMDEwMDkxMTQ3MzImc3ViamVjdD1Ib 3cgdG8gY29uZmlnIEZSIDMuMC54ICg8LT5BRCA8LVdpbmRvd3MgMTApIENvbXB1dGVyKG1h Y2hpbmUpIGF1dGhlbnRpY2F0aW9uIE1TQ0hBUD8=&to_email=freeradius-users@list s.freeradius.org_______________________________________________________ __________________________________________________________]

2 1

Questions about EAP-TLS
by mramadany 08 Oct '20

08 Oct '20

Hello everyone, I've recently set-up EAP-TLS on my home access point using freeradius, it works perfectly fine and everything went smoothly. However, I have some questions regarding the protocol and I hope someone on this list will clear things up for me: 1- Before the supplicant sends any certificates to the server, it usually verifies the server's identity. After it does, how can it ensure that it's still talking to the correct server for further communication, does it establish a tunnel after verifying the server's identity? 2- If the above case is correct and it does establish a tunnel, what if the supplicant doesn't verify the server's identity. Does it establish a tunnel using whatever certificate that the server presents? Does it not establish a tunnel at all and simply sends further messages using plaintext? In Android for example, if you choose to not verify the server's identity, it warns: "No certificate specified. Your connection will not be private". What does it mean here? Does it mean that it's potentially not private because an attacker might impersonate the server because it'll accept whatever cert the server provides? If that's the case, then why does authentication with this method generate way fewer lines in `radiusd -X`? RFC 5216 Section 2.1.4 says that privacy (protecting client certificate information and stuff like that) is optional, yet Section 5.5 says that there's integrity protection in the protocol. How does that work if the privacy mode is optional? Does the supplicant sign the information somehow without encrypting it? 3- Since the privacy mode is optional, does freeradius enable it by default? If not, how do I enable it? 4- After the client has been authorized, what happens exactly? How is the shared symmetric key derived? How is it passed along to the Access Point/Client so that it can receive/send data from/to the supplicant (since the RADIUS server's part ends after doing the authentication)? (Resending because my last e-mail doesn't seem to be posted)

3 4

EAP-TTLS works for MacOS supplicants but not Win10
by Evan Sharp 08 Oct '20

08 Oct '20

Hi List, This is my first message so please advise me of any participation gafs. I have a working 801.2x wifi termination with Aruba APs binding Google LDAP users via FreeRADIUS 3.0.21 using EAP-TTLS. It is only successful with MacOS supplicants though. When I start debugging Windows 10 clients, the connection fails somewhere. Comparing debug outputs, the win10 exchange just seems to stop, with no errors thrown, where the mac flow otherwise continues. Pastebin of a successful bind (mac) <https://pastebin.com/wfpDxpMH> Pastebin to a failed bind (win) <https://pastebin.com/BneBgPAN> Although the users for testing are different, there is no explicit Auth-reject to tell me that's the issue. I'd be very grateful for help understanding what's going on! Evan

5 10

How to configure freeRadius with couchbase
by Sagar Shinde 08 Oct '20

08 Oct '20

Hi , Need some basic help to configure FreeRadius and couchbase to track authentication and authorization information. -- Thanks and Regards, Sagar S. Shinde +91-9970375687

2 3

control authentication/authorization by SSID
by Munroe Sollog 07 Oct '20

07 Oct '20

I've been reviewing: https://wiki.freeradius.org/guide/Mac-Auth#additional-modifications_mac-aut… I have two SSIDs. One of them is mac-auth and the other is .1x. My wireless environment presents freeradius with %{Aruba-Essid-Name} to denote the SSID. If I am interpreting the above documentation correctly, it suggests that I alter what I'm storing in the mac address database to also include the SSID so it can compare both the mac address and the SSID. However, as we don't have multiple SSIDs that do mac auth, is it possible to create some sort of logic in the authorize section based on SSID? Something like: if %{Aruba-Essid-Name} == "mac-auth ssid" { do mac auth} elif %{Aruba-Essid-Name} == ".1x ssid" {do eap} else {reject} That seems like a simpler solution,especially since it doesn't require me to mess with the database of mac addresses. Any input would be appreciated. -- Munroe Sollog (He/Him/His) Senior Network Engineer munroe(a)lehigh.edu

2 1

Freeradius latest rpm on centos7
by Ammad Ali 06 Oct '20

06 Oct '20

Hi, I have installed latest RPM of freeradius from https://packetfence.org/downloads/PacketFence/CentOS7/devel/x86_64/RPMS/ on centos 7. Below are the list of installed RPMs. freeradius-mysql-3.0.21-8.1.x86_64 freeradius-config-3.0.21-8.1.x86_64 freeradius-unixODBC-3.0.21-8.1.x86_64 freeradius-utils-3.0.21-8.1.x86_64 freeradius-3.0.21-8.1.x86_64 freeradius-perl-3.0.21-8.1.x86_64 After fresh install when I start radius in debug mode, it gives me below errors of auth and acct protocol. Mon Sep 28 16:34:26 2020 : Debug: Created signal pipe. Read end FD 5, write end FD 6 Mon Sep 28 16:34:26 2020 : Debug: radiusd: #### Opening IP addresses and Ports #### Mon Sep 28 16:34:26 2020 : Debug: Loading proto_auth with path: /usr/lib64/freeradius/proto_auth.so Mon Sep 28 16:34:26 2020 : Debug: Loading proto_auth failed: /usr/lib64/freeradius/proto_auth.so: cannot open shared object file: No such file or directory - No such file or directory Mon Sep 28 16:34:26 2020 : Debug: Loading library using linker search path(s) Mon Sep 28 16:34:26 2020 : Debug: Defaults : /lib:/usr/lib Mon Sep 28 16:34:26 2020 : Debug: Failed with error: proto_auth.so: cannot open shared object file: No such file or directory Mon Sep 28 16:34:26 2020 : Debug: listen { Mon Sep 28 16:34:26 2020 : Debug: type = "auth" Mon Sep 28 16:34:26 2020 : Debug: ipaddr = * Mon Sep 28 16:34:26 2020 : Debug: port = 0 Mon Sep 28 16:34:26 2020 : Debug: limit { Mon Sep 28 16:34:26 2020 : Debug: max_connections = 16 Mon Sep 28 16:34:26 2020 : Debug: lifetime = 0 Mon Sep 28 16:34:26 2020 : Debug: idle_timeout = 30 Mon Sep 28 16:34:26 2020 : Debug: } Mon Sep 28 16:34:26 2020 : Debug: } Mon Sep 28 16:34:26 2020 : Debug: Loading proto_acct with path: /usr/lib64/freeradius/proto_acct.so Mon Sep 28 16:34:26 2020 : Debug: Loading proto_acct failed: /usr/lib64/freeradius/proto_acct.so: cannot open shared object file: No such file or directory - No such file or directory Mon Sep 28 16:34:26 2020 : Debug: Loading library using linker search path(s) Mon Sep 28 16:34:26 2020 : Debug: Defaults : /lib:/usr/lib Mon Sep 28 16:34:26 2020 : Debug: Failed with error: proto_acct.so: cannot open shared object file: No such file or directory Mon Sep 28 16:34:26 2020 : Debug: listen { Mon Sep 28 16:34:26 2020 : Debug: type = "acct" Mon Sep 28 16:34:26 2020 : Debug: ipaddr = * Mon Sep 28 16:34:26 2020 : Debug: port = 0 Mon Sep 28 16:34:26 2020 : Debug: limit { Mon Sep 28 16:34:26 2020 : Debug: max_connections = 16 Mon Sep 28 16:34:26 2020 : Debug: lifetime = 0 Mon Sep 28 16:34:26 2020 : Debug: idle_timeout = 30 Mon Sep 28 16:34:26 2020 : Debug: } Mon Sep 28 16:34:26 2020 : Debug: } Mon Sep 28 16:34:26 2020 : Debug: Loading proto_auth with path: /usr/lib64/freeradius/proto_auth.so Mon Sep 28 16:34:26 2020 : Debug: Loading proto_auth failed: /usr/lib64/freeradius/proto_auth.so: cannot open shared object file: No such file or directory - No such file or directory Mon Sep 28 16:34:26 2020 : Debug: Loading library using linker search path(s) Mon Sep 28 16:34:26 2020 : Debug: Defaults : /lib:/usr/lib Mon Sep 28 16:34:26 2020 : Debug: Failed with error: proto_auth.so: cannot open shared object file: No such file or directory Mon Sep 28 16:34:26 2020 : Debug: listen { Mon Sep 28 16:34:26 2020 : Debug: type = "auth" Mon Sep 28 16:34:26 2020 : Debug: ipv6addr = :: Mon Sep 28 16:34:26 2020 : Debug: port = 0 Mon Sep 28 16:34:26 2020 : Debug: limit { Mon Sep 28 16:34:26 2020 : Debug: max_connections = 16 Mon Sep 28 16:34:26 2020 : Debug: lifetime = 0 Mon Sep 28 16:34:26 2020 : Debug: idle_timeout = 30 Mon Sep 28 16:34:26 2020 : Debug: } Mon Sep 28 16:34:26 2020 : Debug: } Mon Sep 28 16:34:26 2020 : Debug: Loading proto_acct with path: /usr/lib64/freeradius/proto_acct.so Mon Sep 28 16:34:26 2020 : Debug: Loading proto_acct failed: /usr/lib64/freeradius/proto_acct.so: cannot open shared object file: No such file or directory - No such file or directory Mon Sep 28 16:34:26 2020 : Debug: Loading library using linker search path(s) Mon Sep 28 16:34:26 2020 : Debug: Defaults : /lib:/usr/lib Mon Sep 28 16:34:26 2020 : Debug: Failed with error: proto_acct.so: cannot open shared object file: No such file or directory Mon Sep 28 16:34:26 2020 : Debug: listen { Mon Sep 28 16:34:26 2020 : Debug: type = "acct" Mon Sep 28 16:34:26 2020 : Debug: ipv6addr = :: Mon Sep 28 16:34:26 2020 : Debug: port = 0 Mon Sep 28 16:34:26 2020 : Debug: limit { Mon Sep 28 16:34:26 2020 : Debug: max_connections = 16 Mon Sep 28 16:34:26 2020 : Debug: lifetime = 0 Mon Sep 28 16:34:26 2020 : Debug: idle_timeout = 30 Mon Sep 28 16:34:26 2020 : Debug: } Mon Sep 28 16:34:26 2020 : Debug: } Mon Sep 28 16:34:26 2020 : Debug: Loading proto_auth with path: /usr/lib64/freeradius/proto_auth.so Mon Sep 28 16:34:26 2020 : Debug: Loading proto_auth failed: /usr/lib64/freeradius/proto_auth.so: cannot open shared object file: No such file or directory - No such file or directory Mon Sep 28 16:34:26 2020 : Debug: Loading library using linker search path(s) Mon Sep 28 16:34:26 2020 : Debug: Defaults : /lib:/usr/lib Mon Sep 28 16:34:26 2020 : Debug: Failed with error: proto_auth.so: cannot open shared object file: No such file or directory Mon Sep 28 16:34:26 2020 : Debug: listen { Mon Sep 28 16:34:26 2020 : Debug: type = "auth" Mon Sep 28 16:34:26 2020 : Debug: ipaddr = 127.0.0.1 Mon Sep 28 16:34:26 2020 : Debug: port = 18120 Mon Sep 28 16:34:26 2020 : Debug: } Mon Sep 28 16:34:26 2020 : Debug: Listening on auth address * port 1812 bound to server default Mon Sep 28 16:34:26 2020 : Debug: Listening on acct address * port 1813 bound to server default Mon Sep 28 16:34:26 2020 : Debug: Listening on auth address :: port 1812 bound to server default Mon Sep 28 16:34:26 2020 : Debug: Listening on acct address :: port 1813 bound to server default Mon Sep 28 16:34:26 2020 : Debug: Listening on auth address 127.0.0.1 port 18120 bound to server inner-tunnel Mon Sep 28 16:34:26 2020 : Debug: Opened new proxy socket 'proxy address * port 34165' Mon Sep 28 16:34:26 2020 : Debug: Listening on proxy address * port 34165 Mon Sep 28 16:34:26 2020 : Debug: Opened new proxy socket 'proxy address :: port 59302' Mon Sep 28 16:34:26 2020 : Debug: Listening on proxy address :: port 59302 Mon Sep 28 16:34:26 2020 : Info: Ready to process requests Need your advise. --

3 10

Run sql Module after exec in radpostauth
by Muhammed Buvaydani 05 Oct '20

05 Oct '20

Hello I am using external php script for authentication which I configured in users file , the PHP script will return the reason of the reject and I want to save this reason in radpost auth table, the problem is if I set SQL module before exec and the user was accepted as PAP but rejected from my script then the radpost auth will have access-accept even if he is rejected by my PHP script , this is the debug (1) Received Access-Request Id 245 from 127.0.0.1:53576 to 127.0.0.1:1812 length 96 (1) User-Name = "abhibose" (1) User-Password = "1234" (1) Calling-Station-Id = "4e:f9:5e:77:0c:9a" (1) NAS-Port = 102 (1) NAS-IP-Address = 103.200.57.138 (1) Framed-Protocol = PPP (1) Framed-IP-Address = 192.168.0.1 (1) NAS-Identifier = "nas" (1) # Executing section authorize from file /usr/local/etc/raddb/sites-enabled/default (1) authorize { (1) [preprocess] = ok (1) [chap] = noop (1) [mschap] = noop (1) [digest] = noop (1) suffix: Checking for suffix after "@" (1) suffix: No '@' in User-Name = "abhibose", looking up realm NULL (1) suffix: No such realm "NULL" (1) [suffix] = noop (1) eap: No EAP-Message, not doing EAP (1) [eap] = noop (1) files: users: Matched entry DEFAULT at line 48 (1) files: EXPAND /usr/bin/php /var/www/html/cloudradius/captiveportal/auth_new.php "%{User-Name}" "%{User-Password}" "%{Calling-Station-Id}" "%{NAS-Port}" "%{NAS-IP-Address}" "%{Framed-Protocol}" "%{Framed-IP-Address}" "%{Filter-Id}" "%{NAS-Identifier}" (1) files: --> /usr/bin/php /var/www/html/cloudradius/captiveportal/auth_new.php "abhibose" "1234" "4e:f9:5e:77:0c:9a" "102" "103.200.57.138" "PPP" "192.168.0.1" "" "nas" (1) [files] = ok (1) sql: EXPAND %{User-Name} (1) sql: --> abhibose (1) sql: SQL-User-Name set to 'abhibose' rlm_sql (sql): Closing connection (4): Hit idle_timeout, was idle for 68 seconds rlm_sql_mysql: Socket destructor called, closing socket rlm_sql (sql): Reserved connection (0) (1) sql: EXPAND SELECT id, username, attribute, value, op FROM radcheck WHERE username = '%{SQL-User-Name}' ORDER BY id (1) sql: --> SELECT id, username, attribute, value, op FROM radcheck WHERE username = 'abhibose' ORDER BY id (1) sql: Executing select query: SELECT id, username, attribute, value, op FROM radcheck WHERE username = 'abhibose' ORDER BY id (1) sql: User found in radcheck table (1) sql: Conditional check items matched, merging assignment check items (1) sql: Simultaneous-Use := 1 (1) sql: Cleartext-Password := "1234" (1) sql: EXPAND SELECT id, username, attribute, value, op FROM radreply WHERE username = '%{SQL-User-Name}' ORDER BY id (1) sql: --> SELECT id, username, attribute, value, op FROM radreply WHERE username = 'abhibose' ORDER BY id (1) sql: Executing select query: SELECT id, username, attribute, value, op FROM radreply WHERE username = 'abhibose' ORDER BY id rlm_sql (sql): Reserved connection (1) rlm_sql (sql): Released connection (1) Need 6 more connections to reach 10 spares rlm_sql (sql): Opening additional connection (6), 1 of 27 pending slots used rlm_sql_mysql: Starting connect to MySQL server rlm_sql_mysql: Connected to database 'cloudradius' on Localhost via UNIX socket, server version 5.5.65-MariaDB, protocol version 10 (1) sql: EXPAND SELECT groupname FROM radusergroup WHERE username = '%{SQL-User-Name}' ORDER BY priority (1) sql: --> SELECT groupname FROM radusergroup WHERE username = 'abhibose' ORDER BY priority (1) sql: Executing select query: SELECT groupname FROM radusergroup WHERE username = 'abhibose' ORDER BY priority (1) sql: User not found in any groups rlm_sql (sql): Released connection (0) (1) [sql] = ok (1) if (User-Name =~ /([0-9a-f]{2})[-:]?([0-9a-f]{2})[-:.]?([0-9a-f]{2})[-:]?([0-9a-f]{2})[-:.]?([0-9a-f]{2})[-:]?([0-9a-f]{2})/i) { (1) if (User-Name =~ /([0-9a-f]{2})[-:]?([0-9a-f]{2})[-:.]?([0-9a-f]{2})[-:]?([0-9a-f]{2})[-:.]?([0-9a-f]{2})[-:]?([0-9a-f]{2})/i) -> FALSE (1) [pap] = updated (1) } # authorize = updated (1) Found Auth-Type = PAP (1) # Executing group from file /usr/local/etc/raddb/sites-enabled/default (1) Auth-Type PAP { (1) pap: Login attempt with password (1) pap: Comparing with "known good" Cleartext-Password (1) pap: User authenticated successfully (1) [pap] = ok (1) } # Auth-Type PAP = ok (1) # Executing section session from file /usr/local/etc/raddb/sites-enabled/default (1) session { (1) sql: EXPAND %{User-Name} (1) sql: --> abhibose (1) sql: SQL-User-Name set to 'abhibose' rlm_sql (sql): Reserved connection (5) (1) sql: EXPAND SELECT COUNT(*) FROM radacct WHERE username = '%{SQL-User-Name}' AND acctstoptime IS NULL (1) sql: --> SELECT COUNT(*) FROM radacct WHERE username = 'abhibose' AND acctstoptime IS NULL (1) sql: Executing select query: SELECT COUNT(*) FROM radacct WHERE username = 'abhibose' AND acctstoptime IS NULL rlm_sql (sql): Released connection (5) (1) [sql] = ok (1) } # session = ok (1) # Executing section post-auth from file /usr/local/etc/raddb/sites-enabled/default (1) post-auth { (1) sql: EXPAND .query (1) sql: --> .query (1) sql: Using query template 'query' rlm_sql (sql): Reserved connection (2) (1) sql: EXPAND %{User-Name} (1) sql: --> abhibose (1) sql: SQL-User-Name set to 'abhibose' (1) sql: EXPAND INSERT into radpostauth (username, pass, mac,framedipaddress, nasportid, calledstationid, nasipaddress, reply, authdate, reason) values ('%{User-Name}', '%{%{User-Password}:-%{Chap-Password}}', '%{Calling-Station-Id}','%{Framed-IP-Address}', '%{NAS-Port-Id}','%{Called-Station-Id}','%{NAS-IP-Address}', '%{reply:Packet-Type}', NOW(), '%{reply:Reply-Message}') (1) sql: --> INSERT into radpostauth (username, pass, mac,framedipaddress, nasportid, calledstationid, nasipaddress, reply, authdate, reason) values ('abhibose', '1234', '4e:f9:5e:77:0c:9a','192.168.0.1', '','','103.200.57.138', 'Access-Accept', NOW(), '') (1) sql: Executing query: INSERT into radpostauth (username, pass, mac,framedipaddress, nasportid, calledstationid, nasipaddress, reply, authdate, reason) values ('abhibose', '1234', '4e:f9:5e:77:0c:9a','192.168.0.1', '','','103.200.57.138', 'Access-Accept', NOW(), '') (1) sql: SQL query returned: success (1) sql: 1 record(s) updated rlm_sql (sql): Released connection (2) (1) [sql] = ok (1) exec: Executing: /usr/bin/php /var/www/html/cloudradius/captiveportal/auth_new.php "abhibose" "1234" "4e:f9:5e:77:0c:9a" "102" "103.200.57.138" "PPP" "192.168.0.1" "" "nas" : (1) exec: ERROR: Program returned code (1) and output 'Reply-Message := "Your Account has been expired."' (1) [exec] = reject (1) } # post-auth = reject (1) Delaying response for 1.000000 seconds Waking up in 0.1 seconds. Waking up in 0.8 seconds. (1) Sending delayed response (1) Sent Access-Reject Id 245 from 127.0.0.1:1812 to 127.0.0.1:53576 length 52 (1) Reply-Message := "Your Account has been expired." Waking up in 3.9 seconds. (1) Cleaning up request packet ID 245 with timestamp +68 Ready to process requests ^CYou have new mail in /var/spool/mail/root so if I put SQL module after exec , then the sqk will not run at all . so how can I run SQL module after exec thank you in advance

2 4

Acct-Input-Octets Unknown Module
by Osama Zien Adden 04 Oct '20

04 Oct '20

Dears, I installed FreeRadius 3 on CentOS 7. I got this error message: # Instantiating module "post_proxy_log" from file /etc/raddb/mods-enabled/detail.log /etc/raddb/mods-config/sql/main/oracle/queries.conf[28]: Failed parsing expanded string: /etc/raddb/mods-config/sql/main/oracle/queries.conf[28]: ...ed-IP-Address}','%{Service-Type}','%{Acct-Input-Octets:-0}','%{Acct-Output-Octets:-0}','%{NA... /etc/raddb/mods-config/sql/main/oracle/queries.conf[28]: ^ Unknown module The Acct-Input-Octets considered as Unknown Module. I enabled "redis" and "rediswho" and installed redis-server .. even I think that "redis" is not the module that I missed. Kindly advice, why FreeRadius can not deal with "Acct-Input-Octets" ? What is the required module in mods-enabled that I should activate to use "Acct-Input-Octets" ? Best regards

2 2

Question about FreeRADIUS and LDAP
by rainer＠ultra-secure.de 02 Oct '20

02 Oct '20

Hi, I think I've managed to get authentication against a CentOS 8 389-server working. https://www.nasirhafeez.com/freeradius-with-ldaps-on-azure-ad-domain-servic… Now, traditionally, our users and the configuration are just in a text-file "users" with the password in clear-text. If I move the users (and only the users) into 389-server, how would the text-file look like? Currently, an entry is like that? bla@blue Cleartext-Password := "test" Service-Type = Framed-User, Framed-Protocol = PPP, Framed-Address = 192.168.1.5, Framed-Netmask = 255.255.255.0, Framed-Routing = None, Cisco-AVPair = "vpdn:tunnel-id=VRF1", Cisco-AVPair = "vpdn:tunnel-type=l2tp", Cisco-AVPair = "vpdn:ip-addresses=a.b.c.d", Cisco-AVPair = "vpdn:l2tp-tunnel-password=**********", Cisco-AVPair = "lcp:interface-config#1=ip vrf forwarding bla@blue", Cisco-AVPair = "lcp:interface-config#2=ip unnumbered Loopback80" Or is it better to move everything to LDAP anyway? The iplanet schema seems to import, after adding changetype: modify add: attributetypes But it's missing some of the above key-words. How do I add these? Best Regards Rainer

2 1

sending multiple Class attributes in Rest POST
by Mark Grayson (mgrayson) 01 Oct '20

01 Oct '20

Hi there Is there a way to be able to POST multiple Class attributes using Rest? I am currently testing returning multiple class attributes and can see they are being sent in the accounting-request trace: (10) Framed-IP-Address = 10.192.230.1 (10) Class = 0x31323334353637383957424149443d64756d6d792e6d656d6265723a5553 (10) Class = 0x37334a773b51793453716c44264e5548405929 Is there a way I can pass both received class attributes in a rest POST? It looks like the Rest %{Class} simply picks the first one. Cheers, Mark

3 6