- Freeradius-Users - lists.freeradius.org

Does effective Simultaneous-Use requires radutmp or database to work OK ?
by Olivier 05 Apr '22

05 Apr '22

Hello, In a WPA2 Enterprise wireless environment, I'm trying to control the number of simultaneous connections a user can have. My setup includes Freeradius 3.0.21 from Debian Bullseye's repo. I've seen this Simultaneous-Use setting in documentation. When testing it, I thought I first needed to have radutmp working OK. Unfortunately, my WiFi AP (Unifi AP) do not send NAS-Port AVP in Account-Requests. This seems to prevent radutmp (and checkrad) to work OK. At the same time, I can see meaningful and accurate data in my /var/log/freeradius/racacct directory. So my my question are: 1. When both NAS-IP-Address and NAS-Port are present in Accounting-Requests, is checkrad or radwho using them to send some request to the NAS ? 2. Is radutmp required for Simultaneous-Use enabling ? 3. If radutmp is not required, is an SQL database required for Simultaneous-Use ? Best regards

3 5

RADIUS Debugging
by P.Thirunavukkarasu 05 Apr '22

05 Apr '22

Hi Team, Greetings of the day Kindly help me in RADIUS debugging.... *Linux packetfence 5.10.0-11-amd64 #1 SMP Debian 5.10.92-1 (2022-01-18) x86_64 (ZEN)* I don't know how to debug the RADIUS in packetfence. As given in the Installation guide I tried the debugging *Herewith I am sending the RADIUS log* Apr 4 00:00:02 packetfence auth[1288515]: /usr/local/pf/raddb/auth.conf[19]: Error binding to port for 172.16.11.10 port 1812 Apr 4 00:00:06 packetfence auth[1288559]: Ignoring "response_window = 20.000000", forcing to "response_window = 10.000000" Apr 4 00:00:06 packetfence auth[1288559]: Ignoring "response_window = 30.000000", forcing to "response_window = 10.000000" Apr 4 00:00:06 packetfence auth[1288559]: Ignoring "response_window = 30.000000", forcing to "response_window = 10.000000" Apr 4 00:00:06 packetfence auth[1288559]: Ignoring "response_window = 30.000000", forcing to "response_window = 10.000000" Apr 4 00:00:06 packetfence auth[1288559]: Debugger not attached Apr 4 00:00:06 packetfence auth[1288559]: systemd watchdog interval is 5.00 secs Apr 4 00:00:06 packetfence auth[1288559]: rlm_sql (sql): Driver rlm_sql_mysql (module rlm_sql_mysql) loaded and linked Apr 4 00:00:06 packetfence auth[1288559]: rlm_sql (pfguest): Driver rlm_sql_mysql (module rlm_sql_mysql) loaded and linked Apr 4 00:00:06 packetfence auth[1288559]: rlm_sql (pfsponsor): Driver rlm_sql_mysql (module rlm_sql_mysql) loaded and linked Apr 4 00:00:06 packetfence auth[1288559]: rlm_sql (pfsms): Driver rlm_sql_mysql (module rlm_sql_mysql) loaded and linked Apr 4 00:00:06 packetfence auth[1288559]: rlm_sql (pflocal): Driver rlm_sql_mysql (module rlm_sql_mysql) loaded and linked Apr 4 00:00:06 packetfence auth[1288559]: rlm_sql (sql_reject): Driver rlm_sql_mysql (module rlm_sql_mysql) loaded and linked Apr 4 00:00:06 packetfence auth[1288559]: rlm_sql (sql_degraded): Driver rlm_sql_mysql (module rlm_sql_mysql) loaded and linked Apr 4 00:00:06 packetfence auth[1288559]: Perl version: 5.32.0 Apr 4 00:00:06 packetfence auth[1288559]: Perl version: 5.32.0 Apr 4 00:00:06 packetfence auth[1288559]: Perl version: 5.32.0 Apr 4 00:00:06 packetfence auth[1288559]: Perl version: 5.32.0 Apr 4 00:00:06 packetfence auth[1288559]: Perl version: 5.32.0 Apr 4 00:00:06 packetfence auth[1288559]: rlm_redis: libhiredis version: 0.14.1 Apr 4 00:00:06 packetfence auth[1288559]: rlm_redis: libhiredis version: 0.14.1 Apr 4 00:00:06 packetfence auth[1288559]: rlm_rest: libcurl version: libcurl/7.74.0 OpenSSL/1.1.1k zlib/1.2.11 brotli/1.0.9 libidn2/2.3.0 libpsl/0.21.0 (+libidn2/2.3.0) libssh2/1.9.0 nghttp2/1.43.0 librtmp/2.3 Apr 4 00:00:06 packetfence auth[1288559]: rlm_sql_mysql: libmysql version: 10.5.15 Apr 4 00:00:06 packetfence auth[1288559]: rlm_sql (sql): Attempting to connect to database "pf" Apr 4 00:00:06 packetfence auth[1288559]: rlm_sql (pfguest): Attempting to connect to database "pf" Apr 4 00:00:06 packetfence auth[1288559]: rlm_sql (pfsponsor): Attempting to connect to database "pf" Apr 4 00:00:06 packetfence auth[1288559]: rlm_sql (pfsms): Attempting to connect to database "pf" Apr 4 00:00:06 packetfence auth[1288559]: rlm_sql (pflocal): Attempting to connect to database "pf" Apr 4 00:00:06 packetfence auth[1288559]: rlm_sql (sql_reject): groupmemb_query is empty. Please delete it from the configuration Apr 4 00:00:06 packetfence auth[1288559]: rlm_sql (sql_reject): authorize_check_query is empty. Please delete it from the configuration Apr 4 00:00:06 packetfence auth[1288559]: rlm_sql (sql_reject): Attempting to connect to database "pf" Apr 4 00:00:06 packetfence auth[1288559]: rlm_sql (sql_degraded): groupmemb_query is empty. Please delete it from the configuration Apr 4 00:00:06 packetfence auth[1288559]: rlm_sql (sql_degraded): Ignoring read_groups as group_membership_query is not configured Apr 4 00:00:06 packetfence auth[1288559]: rlm_sql (sql_degraded): Attempting to connect to database "pf" Apr 4 00:00:07 packetfence auth[1288559]: rlm_ldap: libldap vendor: OpenLDAP, version: 20457 Apr 4 00:00:07 packetfence auth[1288559]: [/usr/local/pf/raddb/mods-config/attr_filter/access_reject]:11 Check item "FreeRADIUS-Response-Delay" found in filter list for realm "DEFAULT". Apr 4 00:00:07 packetfence auth[1288559]: [/usr/local/pf/raddb/mods-config/attr_filter/access_reject]:11 Check item "FreeRADIUS-Response-Delay-USec" found in filter list for realm "DEFAULT". Apr 4 00:00:07 packetfence auth[1288559]: Loaded virtual server <default> Apr 4 00:00:07 packetfence auth[1288559]: Loaded virtual server status Apr 4 00:00:07 packetfence auth[1288559]: Loaded virtual server packetfence-tunnel Apr 4 00:00:07 packetfence auth[1288559]: Loaded virtual server packetfence-tunnel-fast Apr 4 00:00:07 packetfence auth[1288559]: Loaded virtual server packetfence Apr 4 00:00:07 packetfence auth[1288559]: Loaded virtual server pf-remote Apr 4 00:00:07 packetfence auth[1288559]: Loaded virtual server pf.degraded Apr 4 00:00:07 packetfence auth[1288559]: Loaded virtual server packetfence-degraded-tunnel Apr 4 00:00:07 packetfence auth[1288559]: Loaded virtual server dynamic_clients Apr 4 00:00:07 packetfence auth[1288559]: Loaded virtual server eduroam Apr 4 00:00:07 packetfence auth[1288559]: Loaded virtual server packetfence-cli *Apr 4 00:00:07 packetfence auth[1288559]: Failed binding to auth address 172.16.11.10 port 1812 bound to server packetfence: Address already in useApr 4 00:00:07 packetfence auth[1288559]: /usr/local/pf/raddb/auth.conf[19]: Error binding to port for 172.16.11.10 port 1812* I tried a lot to debug the RADIUS. But not able to succeed.... *freeradiud -X -d /usr/local/pf/raddb -n auth* listen { type = "auth" virtual_server = "packetfence" ipaddr = 172.16.11.10 port = 0 Failed binding to auth address 172.16.11.10 port 1812 bound to server packetfence: Address already in use /usr/local/pf/raddb/auth.conf[19]: Error binding to port for 172.16.11.10 port 1812 *freeradius -X -d /usr/local/pf/raddb -n acct* acct: #### Opening IP addresses and Ports #### listen { type = "acct" virtual_server = "packetfence" ipaddr = 172.16.11.10 port = 0 Failed binding to acct address 172.16.11.10 port 1813 bound to server packetfence: Address already in use /usr/local/pf/raddb/acct.conf[8]: Error binding to port for 172.16.11.10 port 1813 The O/P shows that the port is already in use. Indicated that the RADIUS is running by using the ports.... *root@packetfence:~# raddebug -t 300 -f /usr/local/pf/var/run/radiusd.sock* radmin: Failed connecting to /usr/local/pf/var/run/radiusd.sock: No such file or directory Perhaps you need to run the commands: cd /etc/raddb ln -s sites-available/control-socket sites-enabled/control-socket and then re-start the server? r*oot@packetfence:~# raddebug -t 300 -f /usr/local/pf/var/run/radiusd-acct.sock* radmin: Failed connecting to /usr/local/pf/var/run/radiusd-acct.sock: No such file or directory Perhaps you need to run the commands: cd /etc/raddb ln -s sites-available/control-socket sites-enabled/control-socket and then re-start the server? Regards, *Thirunavukkarasu*

2 1

NetworkRadius Debian repo lacks freeradius-python3 package
by Rahman DURAN 05 Apr '22

05 Apr '22

Hi, We just switched to the NetworkRadius Debian 11 repo as the official Debian repo has a relatively old version. But it seems there is no freeradius-python3 package in the NetworkRadius Debian repo. But Rocky Linux repo has it: http://packages.networkradius.com/freeradius-3.0/rocky/8/ Is it possible to add a python package to the repo? Regards, Rahman Duran Bilgi İşlem Daire Başkanlığı Erzurum Teknik Üniversitesi 444 5 388 - 2730

1 0

SQL Logging quirks with cisco-avpair
by Mike Manning 04 Apr '22

04 Apr '22

Hi all, I have a strange issue that I have seen pop up on a thread years ago but cannot for the life of me find the answer to it anymore. I have a freeradius 3.0 server set up handling authentication requests from Cisco ASR's for our internet users. We're sending through extended attributes in our AAA data from our ASR's and can see the details in our radacct files (details removed for privacy): Mon Apr 4 00:01:09 2022 Acct-Session-Id = "0003E6A0" Framed-Protocol = PPP Framed-IP-Address = x.x.x.x User-Name = "username@realm" X-Ascend-Connect-Progress = LAN-Session-Up Cisco-AVPair = "connect-progress=LAN Ses Up" X-Ascend-PreSession-Time = 1 X-Ascend-Xmit-Rate = 1410065408 Cisco-AVPair = "nas-tx-speed=1410065408" Cisco-AVPair = "nas-tx-speed-kbps=1410065" X-Ascend-Data-Rate = 1410065408 Cisco-AVPair = "nas-rx-speed=1410065408" Cisco-AVPair = "nas-rx-speed-kbps=1410065" Acct-Session-Time = 888770 Acct-Input-Gigawords = 151 Acct-Output-Gigawords = 18 Acct-Input-Octets = 1877053998 Acct-Output-Octets = 3577481241 WLAN-RF-Band = 83 X-Ascend-Pre-Output-Octets = 53 Acct-Input-Packets = 494627556 Acct-Output-Packets = 336289465 X-Ascend-Pre-Input-Packets = 4 X-Ascend-Pre-Output-Packets = 4 Acct-Authentic = RADIUS Acct-Status-Type = Interim-Update NAS-Port-Type = Virtual NAS-Port = 0 NAS-Port-Id = "0/1/0/2066.123" Cisco-AVPair = "client-mac-address=7c5a.xxxx.xxxx" Cisco-AVPair = "circuit-id-tag=AVC000xxxxxxxx" Service-Type = Framed-User NAS-IP-Address = y.y.y.y Acct-Delay-Time = 0 Event-Timestamp = "Apr 4 2022 00:01:09 AEST" Tmp-String-9 = "ai:" As you can see in the radacct files, the Cisco-AVPair is being written correctly for the client-mac-address and circuit-id tag. This also appears correctly in the /var/log/freeradius/radius.log file as I have the following 2 lines in radiusd.conf msg_goodpass = "Mac: %{Cisco-AVPair[0]}, Circuit ID: %{Cisco-AVPair[1]}" msg_badpass = "Mac: %{Cisco-AVPair[0]}, Circuit ID: %{Cisco-AVPair[1]}" Mon Apr 4 15:23:43 2022 : Auth: (3463054) Login OK: [username@realm] (from client CLIENTNAME port 0) Mac: client-mac-address=7483.xxxx.yyyy, Circuit ID: circuit-id-tag=AVC00xxxxxxx Here's the strange part. I am logging the circuit-id and also mac address to the postauth table as follows in the SQL db. Here is the extract from /etc/freeradius/3.0/mods-config/sql/main/mysql/queries.conf: post-auth { # Write SQL queries to a logfile. This is potentially useful for bulk inserts # when used with the rlm_sql_null driver. # logfile = ${logdir}/post-auth.sql query = "\ INSERT IGNORE INTO ${..postauth_table} \ (username, pass, reply, authdate, macaddress, circuitid) \ VALUES ( \ '%{SQL-User-Name}', \ '%{%{User-Password}:-%{Chap-Password}}', \ '%{reply:Packet-Type}', \ '%S', \ '%{Cisco-AVPair[0]}', \ '%{Cisco-AVPair[1]}')" This proceeds to log the details in the SQL DB however both cisco-avpair entries are prepended with a "3D" entry: INSERT INTO `radpostauth` (`id`, `username`, `reply`, `authdate`, `macaddress`, `circuitid`) VALUES (131788, 'username@realm', 'Access-Accept', '2022-04-04 05:08:41', 'client-mac-address=3D7c5a.xxxx.yyyy', 'circuit-id-tag=3DAVC0000xxxxxx'); This does not appear in any other log files, is there something to remove the "3D" header that these entries have when logging? Cheers, Mike

2 1

Discard / no Log
by Nicolas Breuer 04 Apr '22

04 Apr '22

Hello, We are flooded by a wrong CPE configuration. Is there a way if the realm is not configured in proxy.conf to discard the packet silently and discard the log in the radius.log ? I tried to return if “noop” but logging is still there 😊 Disable the logging for auth_reject is not an option 😊 authorize { # The preprocess module takes care of sanitizing some bizarre # attributes in the request, and turning them into attributes # which are more standard. # # It takes care of processing the 'raddb/mods-config/preprocess/hints' # and the 'raddb/mods-config/preprocess/huntgroups' files. preprocess # # The chap module will set 'Auth-Type := CHAP' if we are # handling a CHAP request and Auth-Type has not already been set chap # # If the users are logging in with an MS-CHAP-Challenge # attribute for authentication, the mschap module will find # the MS-CHAP-Challenge attribute, and add 'Auth-Type := MS-CHAP' # to the request, which will cause the server to then use # the mschap module for authentication. mschap # # Look for realms in user@domain format suffix if (noop){ return } …….

3 2

[pam_radius_auth] Is it possible that an account might be workable, while the user is not available on device.
by zhangguo200588＠126.com 03 Apr '22

03 Apr '22

Hello， I am new to freeradius and trying pam_radius_auth now. Is it possible that an account might be workable, while the user is not available on device(Ubuntu PC). It is always failed in my test environmen. Thank you for your time in any case. zhangguo200588(a)126.com

3 2

[freeradius] cannot find the Dockerfile for the image
by Ajay Tripathi 01 Apr '22

01 Apr '22

Hi, I am unable to find the dockerfile of the image uploaded on docker hub: https://hub.docker.com/r/freeradius/freeradius-server/ I would really appreciate pointers to help me find it. Thanks, Ajay T.

3 5

Assign DNS server when authenticate
by Carina V. Barca 01 Apr '22

01 Apr '22

I have a freeradius: FreeRADIUS Version 2.1.12, for host i486-pc-linux-gnu, I need it to assign dns when authenticating, is it possible? How can I do this? Best regards, FreeRADIUS Version 2.1.12, for host i486-pc-linux-gnu, built on Dec 16 2012 at 22:03:33 Copyright (C) 1999-2009 The FreeRADIUS server project and contributors. Enviado desde Outlook<http://aka.ms/weboutlook>

3 2

Bash Script not exec-uting in Daemon Mode
by Mike Ruebner 01 Apr '22

01 Apr '22

Hi, Strange doings executing a bash script from the 'exec' module in v.3.0.21 on Debian 11.3. Everything works fine in debug mode ('-X'), but script execution fails in daemon mode. This used to work before a recent upgrade from v.3.0.17. Any pointers greatly appreciated! Mike <--- rlm_exec exec failmail { wait = no input_pairs = request shell_escape = no timeout = 1 program = "/etc/freeradius/3.0/execscripts/mailbot.sh %{User-Name}" } ---> <--- ls -al ../execscripts drwxr-xr-x 2 freerad freerad 4096 Mar 29 23:46 . drwxr-xr-x 10 freerad freerad 4096 Mar 25 20:18 .. -rwxr-x--x 1 freerad freerad 1503 Mar 28 18:47 mailbot.sh -rw-r----- 1 freerad freerad 428 Feb 29 2020 template.mail --->

2 5

Azure AD and freeradius
by a.sinnige＠sae.edu 31 Mar '22

31 Mar '22

Hi all, A bit of an open question about Azure. I currently have running : AzureAD->on prem AD->samba/ldap-> freeradius Running every type of hardwarePC/Mac/Phones/BYOD for Staff/Students/External Eduroam users. Doing user/password type logins for wifi/ethernet/computers etc.. (not certs) Most users are doing PEAP->mschapv2 by default. All without requiring to provision devices with profiles/certs. This works quite well and THX to all freeradius staff for this wonderful product :-) But we are setting up a new company and I was thinking if there is maybe a way to cut out the onprem/cloud based AD ? So AzureAD->freeradius without losing the capability to do TTLS-pap AND Peap-mschapv2 ? (no certificates) Any ideas ? Arjan Sinnige

4 3