- Freeradius-Users - lists.freeradius.org

Disable accounting logging
by Patrick Oberli 04 Jun '21

04 Jun '21

Hello all I'm currently trying to disable accounting logging on a Freeradius 3.0 installation, which I exclusively use as an eduroam radius proxy (https://wiki.geant.org/display/H2eduroam/freeradius-sp) On my old 2.x installation I did not get any accounting logging, but I don't know why it is generated now in 3.0. My configuration of the sites-enabled/eduroam is exactly as shown at that site. The accounting section looks like this: accounting { } The accounting log is now filling my disk (it's also not compressed, unlike the radius.log file). I don't need the accounting logs as there should be no accounting at all. The only other link in sites-enabled is the default file. I did uncomment the word "detail" in the accounting section there and restarted the service, but it continued to log accounting information. Thanks Patrick Oberli

2 3

Changing format for $RAD_REQUEST{'Event-Timestamp'} in Perl module
by Юрий Иванов 04 Jun '21

04 Jun '21

Hi, I need to change $RAD_REQUEST{'Event-Timestamp'} format before inserting to database. Looks like $RAD_REQUEST{'date:Event-Timestamp'}, $RAD_REQUEST{'integer:Event-Timestamp'} are not working. Is there any method to use date module or standard keywords in perl code or I should do it manually.

3 4

ntlm_auth not being invoked
by Shaun donovan 04 Jun '21

04 Jun '21

Hi All. I have configured FreeRADIUS Version 3.0.20 on a CentOS Linux release 8.3.2011 machine with daloRadius. I have then followed the instructions at http://deployingradius.com/documents/configuration/active_directory.html to allow FreeRADIUS to authenticate against an Active Directory. Everything works up to the point that I must remove the "testing entry" in raddb/mods-config/files/authorize, namely the "DEFAULT Auth-Type = ntlm_auth" and uncomment the "ntlm_auth =" line in raddb/modules/mschap. Once I do this and test using radtest, I get: (0) pap: WARNING: No "known good" password found for the user. Not setting Auth-Type (0) pap: WARNING: Authentication will fail unless a "known good" password is available (0) [pap] = noop (0) } # authorize = ok (0) ERROR: No Auth-Type found: rejecting the user via Post-Auth-Type = Reject from Radius -X. I can see that it is trying to do PAP authentication, but does not "Fall Through" to try ntlm_auth. I have tried to google this extensively, but cannot find where I should configure FreeRADIUS to first try PAP and the try ntlm_auth. Any help appreciated. Kind Regards. Shaun

2 1

Problems with Samba
by Klemen forneci 04 Jun '21

04 Jun '21

Hello. I hope someone can shine a light on my problem with Freeradius 3 and mschap (running on centos7 with samba/winbind) So long story short, I notice that every ~5 minutes there is a problem with NTLM_AUTH. Even with testing with radtest -t mscahp at the same time, I get: (10) Auth-Type MS-CHAP { (10) if (Realm == "um.si") { (10) if (Realm == "um.si") -> TRUE (10) if (Realm == "um.si") { (10) mschap_thor: Client is using MS-CHAPv1 with NT-Password (10) mschap_thor: Executing: /usr/bin/ntlm_auth --allow-mschapv2 --request-nt-key --username=%{%{Stripped-User-Name}:-%{%{User-Name}:-None}} --domain=%{%{mschap:NT-Domain}:-THOR} --challenge=%{%{mschap:Challenge}:-00} --nt-response=%{%{mschap:NT-Response}:-00}: (10) mschap_thor: EXPAND --username=%{%{Stripped-User-Name}:-%{%{User-Name}:-None}} (10) mschap_thor: --> --username=****** (10) mschap_thor: ERROR: No NT-Domain was found in the User-Name (10) mschap_thor: EXPAND --domain=%{%{mschap:NT-Domain}:-THOR} (10) mschap_thor: --> --domain=THOR (10) mschap_thor: mschap1: 31 (10) mschap_thor: EXPAND --challenge=%{%{mschap:Challenge}:-00} (10) mschap_thor: --> --challenge=316c3b72847b74c7 (10) mschap_thor: EXPAND --nt-response=%{%{mschap:NT-Response}:-00} (10) mschap_thor: --> --nt-response=273c482ad6ee3eeb8c21239368764a42d66c1b6ca8f0e98e Child PID 5238 is taking too much time: forcing failure and killing child. (10) mschap_thor: ERROR: Failed to read from child output (10) mschap_thor: External script failed (10) mschap_thor: ERROR: External script says: (10) mschap_thor: ERROR: MS-CHAP2-Response is incorrect I know this may not be a radius issue, beause of the fact that in-between the system works as expected and the line: Child PID 5238 is taking too much time: forcing failure and killing child, but I have my hopes up someone can point me in the right direction. On the backend there is a Windows AD, multiple DC (tried setting only 1 in samba, same issue), the server is domain joined. I have multiple servers with the same issue (in the same environment) What allso puzzles me, are the logs: Server 1: Fri May 28 14:35:27 2021 : ERROR: (59476) mschap_thor: ERROR: Failed to read from child output Fri May 28 14:35:31 2021 : ERROR: (59508) mschap_loki: ERROR: Failed to read from child output Fri May 28 14:35:35 2021 : ERROR: (59534) mschap_loki: ERROR: Failed to read from child output Fri May 28 14:40:03 2021 : ERROR: (60960) mschap_loki: ERROR: Failed to read from child output Fri May 28 14:40:08 2021 : ERROR: (60993) mschap_loki: ERROR: Failed to read from child output Fri May 28 14:40:12 2021 : ERROR: (61017) mschap_loki: ERROR: Failed to read from child output Fri May 28 14:40:14 2021 : ERROR: (61030) mschap_loki: ERROR: Failed to read from child output Fri May 28 14:40:15 2021 : ERROR: (61040) mschap_loki: ERROR: Failed to read from child output Server 2: Fri May 28 14:38:29 2021 : ERROR: (4) mschap_thor: ERROR: Failed to read from child output Fri May 28 14:38:44 2021 : ERROR: (5) mschap_thor: ERROR: Failed to read from child output It's like a blinker. One works, the other doesnt. Thank you for any tips. Klemen

4 4

Lockout
by Victor, Eben, Vodacom South Africa (External) 04 Jun '21

04 Jun '21

Hi All, I’m hoping someone could assist me. Is it possible to deny/lockout users with the calling-stattion-id? I’m trying to lockout users connecting to my wifi with x connections a week from x called-stattion-id. Regards C2 General This e-mail is classified C2 - Vodacom Restricted - Information to be used inside Vodacom but it may be shared with authorised partners.

2 1

rlm_sql_null: No connections available and at max connection limit
by Artis Caune 03 Jun '21

03 Jun '21

Hi guys, We use rlm_sql_null for accounting and auth logs which allow us to respond quickly and defer inserts from regional nodes when db or link is down. Config is simple: accounting { ... sql_accounting } sql sql_accounting { driver = "rlm_sql_null" accounting { logfile = "${sql_write_dir}/accounting.sql" query = "INSERT INTO accounting ..." } } We get around 10-15 auth requests per sec and I don't see any errors for post-auth log. But we get around 180-200 acct requests per sec and I'm getting those errors for rlm_sql_null module: rlm_sql (sql_accounting): Cannot open new connection, already at max rlm_sql (sql_accounting): No connections available and at max connection limit README.rst says we can leave the pool definition or delete it for _null module. Wondering if there are some tweaks for the null module or it's a bug as there should be no max connection limit on this module ? Also noticed that null module tries to connect to radius table but no db_name is configured: rlm_sql (sql_accounting): Driver rlm_sql_null (module rlm_sql_null) loaded and linked rlm_sql (sql_accounting): Attempting to connect to database "radius" Why is it trying to connect to something if it should just append to logfile ? Thanks, Artis

2 2

How to enable rlp_perl debugging.
by Юрий Иванов 03 Jun '21

03 Jun '21

Hello, My custom perl module (which using threads for accounting buffer) which works good but when load increases freeradius stops working with only message: Jun 3 16:21:38 radius systemd: radiusd.service: main process exited, code=killed, status=6/ABRT Jun 3 16:21:38 radius systemd: Unit radiusd.service entered failed state. Jun 3 16:21:38 radius systemd: radiusd.service failed. How to enable more verbouse debbug for rlm_perl or there is only way is to recompile rlm_perl with -g option?

2 1

Proxy and realm
by Andrés Gómez 02 Jun '21

02 Jun '21

Hi dear list I want to test a Freeradius v3 as a proxy to another freeradius. I have read documentation about proxy feature, so I have configured */etc/raddb/proxy.conf with something similar like this:* *realm office { type = radius authhost = 4.7.8.2:1812 <http://4.7.8.2:1812> accthost = 4.7.8.2:1813 <http://4.7.8.2:1813> secret = mysecret123 nostrip}* I have enabled realm modules on /etc/raddb/mods-enabled/ But when I try a simple user like: radtest user1@office password 127.0.0.1 1812 mysecret123 Freeradius takes "user1@office" like the username, it doesn't use the realm feature, so FR tries to find the user in Users file. What am I missing? Thanks in advance -- *C. Andrés Gómez R.*

3 5

eduroam howto log failure mschapv2
by Francesco Malvezzi 02 Jun '21

02 Jun '21

> Fix the samba parts to this and you should be good. > > Read : > https://wiki.samba.org/index.php/Authenticating_Freeradius_against_Active_D… > > Might help. > > Greetz, > > Louis > > Yes, it would definitely work to log the event on the Directory (it's OpenLDAP here, I wouldn't be able to log anything more than the authentication attempt, but I get it). But it is a lot friendlier to be able to collect all radius logs on radius server, isn'it? Thank you for the hint, Francesco

2 1

ARTICLE: How we made FreeRADIUS the best open source DHCP server
by Network RADIUS 02 Jun '21

02 Jun '21

** DHCP enhancements to FreeRADIUS 3 —————————————————————————————— As part of our contributions to the FreeRADIUS community, Network RADIUS took on the task of overhauling its DHCP support. The result is the same highly flexible and configurable DHCP server, but now easier to configure and outperforms both ISC and Kea DHCP in most common scenarios. And it’s available now, in FreeRADIUS 3.0.22 (https://freeradius.org/releases/) After running a battery of tests against ISC DHCP and Kea, we identified issues with FreeRADIUS that needed to be addressed in order to improve compliance as well as performance. We like to think that we understand network administrators pretty well. We know that performance is important, but it’s not the only consideration. In FreeRADIUS 3.0.22 we are excited to provide a DHCP server that: • Outperforms ISC DHCP and Kea • Has the flexibility to adapt to your network rather than the other way around • Implements query strategies that are optimized for the most common databases • Simplifies data workflow • Empowers real time monitoring In this post, we’ll provide a high-level overview of the changes we made and why, as well as the final performance results. Read the full article… https://networkradius.com/articles/2021/05/20/DHCP-enhancements-in-FreeRADI… ** Sign up to get this content directly --------------------------------------------- Want to get these articles in all their HTML glory? Sign up here: http://eepurl.com/hwuWrn ** Need RADIUS help? --------------------------------------------- Get commercial support from the team behind FreeRADIUS. https://networkradius.com/contact/ ** What is the relationship between Network RADIUS and FreeRADIUS? ---------------------------------------------- FreeRADIUS is an open source implementation of the RADIUS protocol and was written by Alan DeKok in 1999. Network RADIUS is a private, for-profit company founded by Alan DeKok which provides commercial support for FreeRADIUS. The Network RADIUS team has been the primary contributor to FreeRADIUS for the last 20 years. The FreeRADIUS mailing list, wiki, and documentation are all moderated and maintained by the Network RADIUS team. FreeRADIUS has always been, and will always continue to be, open source. The Network RADIUS team provides commercial support to paying clients, and free product development for the FreeRADIUS community at large. All of our software development for FreeRADIUS is integrated into the Open Source platform, and will always continue to be.

1 0