- Freeradius-Users - lists.freeradius.org

Run sql Module after exec in radpostauth
by Muhammed Buvaydani 05 Oct '20

05 Oct '20

Hello I am using external php script for authentication which I configured in users file , the PHP script will return the reason of the reject and I want to save this reason in radpost auth table, the problem is if I set SQL module before exec and the user was accepted as PAP but rejected from my script then the radpost auth will have access-accept even if he is rejected by my PHP script , this is the debug (1) Received Access-Request Id 245 from 127.0.0.1:53576 to 127.0.0.1:1812 length 96 (1) User-Name = "abhibose" (1) User-Password = "1234" (1) Calling-Station-Id = "4e:f9:5e:77:0c:9a" (1) NAS-Port = 102 (1) NAS-IP-Address = 103.200.57.138 (1) Framed-Protocol = PPP (1) Framed-IP-Address = 192.168.0.1 (1) NAS-Identifier = "nas" (1) # Executing section authorize from file /usr/local/etc/raddb/sites-enabled/default (1) authorize { (1) [preprocess] = ok (1) [chap] = noop (1) [mschap] = noop (1) [digest] = noop (1) suffix: Checking for suffix after "@" (1) suffix: No '@' in User-Name = "abhibose", looking up realm NULL (1) suffix: No such realm "NULL" (1) [suffix] = noop (1) eap: No EAP-Message, not doing EAP (1) [eap] = noop (1) files: users: Matched entry DEFAULT at line 48 (1) files: EXPAND /usr/bin/php /var/www/html/cloudradius/captiveportal/auth_new.php "%{User-Name}" "%{User-Password}" "%{Calling-Station-Id}" "%{NAS-Port}" "%{NAS-IP-Address}" "%{Framed-Protocol}" "%{Framed-IP-Address}" "%{Filter-Id}" "%{NAS-Identifier}" (1) files: --> /usr/bin/php /var/www/html/cloudradius/captiveportal/auth_new.php "abhibose" "1234" "4e:f9:5e:77:0c:9a" "102" "103.200.57.138" "PPP" "192.168.0.1" "" "nas" (1) [files] = ok (1) sql: EXPAND %{User-Name} (1) sql: --> abhibose (1) sql: SQL-User-Name set to 'abhibose' rlm_sql (sql): Closing connection (4): Hit idle_timeout, was idle for 68 seconds rlm_sql_mysql: Socket destructor called, closing socket rlm_sql (sql): Reserved connection (0) (1) sql: EXPAND SELECT id, username, attribute, value, op FROM radcheck WHERE username = '%{SQL-User-Name}' ORDER BY id (1) sql: --> SELECT id, username, attribute, value, op FROM radcheck WHERE username = 'abhibose' ORDER BY id (1) sql: Executing select query: SELECT id, username, attribute, value, op FROM radcheck WHERE username = 'abhibose' ORDER BY id (1) sql: User found in radcheck table (1) sql: Conditional check items matched, merging assignment check items (1) sql: Simultaneous-Use := 1 (1) sql: Cleartext-Password := "1234" (1) sql: EXPAND SELECT id, username, attribute, value, op FROM radreply WHERE username = '%{SQL-User-Name}' ORDER BY id (1) sql: --> SELECT id, username, attribute, value, op FROM radreply WHERE username = 'abhibose' ORDER BY id (1) sql: Executing select query: SELECT id, username, attribute, value, op FROM radreply WHERE username = 'abhibose' ORDER BY id rlm_sql (sql): Reserved connection (1) rlm_sql (sql): Released connection (1) Need 6 more connections to reach 10 spares rlm_sql (sql): Opening additional connection (6), 1 of 27 pending slots used rlm_sql_mysql: Starting connect to MySQL server rlm_sql_mysql: Connected to database 'cloudradius' on Localhost via UNIX socket, server version 5.5.65-MariaDB, protocol version 10 (1) sql: EXPAND SELECT groupname FROM radusergroup WHERE username = '%{SQL-User-Name}' ORDER BY priority (1) sql: --> SELECT groupname FROM radusergroup WHERE username = 'abhibose' ORDER BY priority (1) sql: Executing select query: SELECT groupname FROM radusergroup WHERE username = 'abhibose' ORDER BY priority (1) sql: User not found in any groups rlm_sql (sql): Released connection (0) (1) [sql] = ok (1) if (User-Name =~ /([0-9a-f]{2})[-:]?([0-9a-f]{2})[-:.]?([0-9a-f]{2})[-:]?([0-9a-f]{2})[-:.]?([0-9a-f]{2})[-:]?([0-9a-f]{2})/i) { (1) if (User-Name =~ /([0-9a-f]{2})[-:]?([0-9a-f]{2})[-:.]?([0-9a-f]{2})[-:]?([0-9a-f]{2})[-:.]?([0-9a-f]{2})[-:]?([0-9a-f]{2})/i) -> FALSE (1) [pap] = updated (1) } # authorize = updated (1) Found Auth-Type = PAP (1) # Executing group from file /usr/local/etc/raddb/sites-enabled/default (1) Auth-Type PAP { (1) pap: Login attempt with password (1) pap: Comparing with "known good" Cleartext-Password (1) pap: User authenticated successfully (1) [pap] = ok (1) } # Auth-Type PAP = ok (1) # Executing section session from file /usr/local/etc/raddb/sites-enabled/default (1) session { (1) sql: EXPAND %{User-Name} (1) sql: --> abhibose (1) sql: SQL-User-Name set to 'abhibose' rlm_sql (sql): Reserved connection (5) (1) sql: EXPAND SELECT COUNT(*) FROM radacct WHERE username = '%{SQL-User-Name}' AND acctstoptime IS NULL (1) sql: --> SELECT COUNT(*) FROM radacct WHERE username = 'abhibose' AND acctstoptime IS NULL (1) sql: Executing select query: SELECT COUNT(*) FROM radacct WHERE username = 'abhibose' AND acctstoptime IS NULL rlm_sql (sql): Released connection (5) (1) [sql] = ok (1) } # session = ok (1) # Executing section post-auth from file /usr/local/etc/raddb/sites-enabled/default (1) post-auth { (1) sql: EXPAND .query (1) sql: --> .query (1) sql: Using query template 'query' rlm_sql (sql): Reserved connection (2) (1) sql: EXPAND %{User-Name} (1) sql: --> abhibose (1) sql: SQL-User-Name set to 'abhibose' (1) sql: EXPAND INSERT into radpostauth (username, pass, mac,framedipaddress, nasportid, calledstationid, nasipaddress, reply, authdate, reason) values ('%{User-Name}', '%{%{User-Password}:-%{Chap-Password}}', '%{Calling-Station-Id}','%{Framed-IP-Address}', '%{NAS-Port-Id}','%{Called-Station-Id}','%{NAS-IP-Address}', '%{reply:Packet-Type}', NOW(), '%{reply:Reply-Message}') (1) sql: --> INSERT into radpostauth (username, pass, mac,framedipaddress, nasportid, calledstationid, nasipaddress, reply, authdate, reason) values ('abhibose', '1234', '4e:f9:5e:77:0c:9a','192.168.0.1', '','','103.200.57.138', 'Access-Accept', NOW(), '') (1) sql: Executing query: INSERT into radpostauth (username, pass, mac,framedipaddress, nasportid, calledstationid, nasipaddress, reply, authdate, reason) values ('abhibose', '1234', '4e:f9:5e:77:0c:9a','192.168.0.1', '','','103.200.57.138', 'Access-Accept', NOW(), '') (1) sql: SQL query returned: success (1) sql: 1 record(s) updated rlm_sql (sql): Released connection (2) (1) [sql] = ok (1) exec: Executing: /usr/bin/php /var/www/html/cloudradius/captiveportal/auth_new.php "abhibose" "1234" "4e:f9:5e:77:0c:9a" "102" "103.200.57.138" "PPP" "192.168.0.1" "" "nas" : (1) exec: ERROR: Program returned code (1) and output 'Reply-Message := "Your Account has been expired."' (1) [exec] = reject (1) } # post-auth = reject (1) Delaying response for 1.000000 seconds Waking up in 0.1 seconds. Waking up in 0.8 seconds. (1) Sending delayed response (1) Sent Access-Reject Id 245 from 127.0.0.1:1812 to 127.0.0.1:53576 length 52 (1) Reply-Message := "Your Account has been expired." Waking up in 3.9 seconds. (1) Cleaning up request packet ID 245 with timestamp +68 Ready to process requests ^CYou have new mail in /var/spool/mail/root so if I put SQL module after exec , then the sqk will not run at all . so how can I run SQL module after exec thank you in advance

2 4

Acct-Input-Octets Unknown Module
by Osama Zien Adden 04 Oct '20

04 Oct '20

Dears, I installed FreeRadius 3 on CentOS 7. I got this error message: # Instantiating module "post_proxy_log" from file /etc/raddb/mods-enabled/detail.log /etc/raddb/mods-config/sql/main/oracle/queries.conf[28]: Failed parsing expanded string: /etc/raddb/mods-config/sql/main/oracle/queries.conf[28]: ...ed-IP-Address}','%{Service-Type}','%{Acct-Input-Octets:-0}','%{Acct-Output-Octets:-0}','%{NA... /etc/raddb/mods-config/sql/main/oracle/queries.conf[28]: ^ Unknown module The Acct-Input-Octets considered as Unknown Module. I enabled "redis" and "rediswho" and installed redis-server .. even I think that "redis" is not the module that I missed. Kindly advice, why FreeRadius can not deal with "Acct-Input-Octets" ? What is the required module in mods-enabled that I should activate to use "Acct-Input-Octets" ? Best regards

2 2

Question about FreeRADIUS and LDAP
by rainer＠ultra-secure.de 02 Oct '20

02 Oct '20

Hi, I think I've managed to get authentication against a CentOS 8 389-server working. https://www.nasirhafeez.com/freeradius-with-ldaps-on-azure-ad-domain-servic… Now, traditionally, our users and the configuration are just in a text-file "users" with the password in clear-text. If I move the users (and only the users) into 389-server, how would the text-file look like? Currently, an entry is like that? bla@blue Cleartext-Password := "test" Service-Type = Framed-User, Framed-Protocol = PPP, Framed-Address = 192.168.1.5, Framed-Netmask = 255.255.255.0, Framed-Routing = None, Cisco-AVPair = "vpdn:tunnel-id=VRF1", Cisco-AVPair = "vpdn:tunnel-type=l2tp", Cisco-AVPair = "vpdn:ip-addresses=a.b.c.d", Cisco-AVPair = "vpdn:l2tp-tunnel-password=**********", Cisco-AVPair = "lcp:interface-config#1=ip vrf forwarding bla@blue", Cisco-AVPair = "lcp:interface-config#2=ip unnumbered Loopback80" Or is it better to move everything to LDAP anyway? The iplanet schema seems to import, after adding changetype: modify add: attributetypes But it's missing some of the above key-words. How do I add these? Best Regards Rainer

2 1

sending multiple Class attributes in Rest POST
by Mark Grayson (mgrayson) 01 Oct '20

01 Oct '20

Hi there Is there a way to be able to POST multiple Class attributes using Rest? I am currently testing returning multiple class attributes and can see they are being sent in the accounting-request trace: (10) Framed-IP-Address = 10.192.230.1 (10) Class = 0x31323334353637383957424149443d64756d6d792e6d656d6265723a5553 (10) Class = 0x37334a773b51793453716c44264e5548405929 Is there a way I can pass both received class attributes in a rest POST? It looks like the Rest %{Class} simply picks the first one. Cheers, Mark

3 6

Radius and LDAP permissions
by lingctam 30 Sep '20

30 Sep '20

Hello, Currently, my radius server is configured to use ldap. Would there be an issue if the radius and ldap daemons are ran with a different id group? Radius: ran by user (w/o root privilege) LDAP: ran by root If this would cause an issue, what would resolve the issue of radius requests not being able to go through the ldap server? Thanks.

2 1

Getting more info on radpostauth
by Andrés Gómez 29 Sep '20

29 Sep '20

Hi Alan and dear list. Currently I use freeradius 3 to authenticate wifi users using SQL module. After each authentication request I can see a new entry on radpostauth table in my database.... Everything OK. Radpostauth table has the information about username, pass, reply message and authdate. I need a record about the callingstationid parameter that is arriving in each request. So, If I create a new row in that table, how can I modify the SQL query in order to insert the callingstationid in that table? Thanks a lot -- *C. Andrés Gómez R.*

3 3

Perl script error when testing locally
by HORMAZABAL PI�ONES BARBARA FRANCISCA 28 Sep '20

28 Sep '20

Hello again, I'm trying to follow the tutorial from this site <https://kerker.website/freeradiusgmail802-1x%E8%A8%AD%E5%AE%9Apop3s/> (it's in chinese but it's pretty understandable if you translate it) basically using a perl script for authentication against gmail accounts using POP3. So far I have reached to the part where it tests the script locally and the error occurs, I haven't yet reached to the part where it configures the eap file to EAP-GTC for the 802.1X. Even though it's not in the tutorial I still added the user in the users file anyway and the error is still there. This is the output I get when doing radtest locally: (0) Received Access-Request Id 63 from 127.0.0.1:41319 to 127.0.0.1:1812 length 93 (0) User-Name = "pruebaucnperl(a)gmail.com" (0) User-Password = "password" (0) NAS-IP-Address = 146.83.124.26 (0) NAS-Port = 0 (0) Message-Authenticator = 0xf081ea4e44b9ed006a1316a93828157f (0) # Executing section authorize from file /etc/freeradius/3.0/sites-enabled/default (0) authorize { (0) policy filter_username { (0) if (&User-Name) { (0) if (&User-Name) -> TRUE (0) if (&User-Name) { (0) if (&User-Name =~ / /) { (0) if (&User-Name =~ / /) -> FALSE (0) if (&User-Name =~ /@[^@]*@/ ) { (0) if (&User-Name =~ /@[^@]*@/ ) -> FALSE (0) if (&User-Name =~ /\.\./ ) { (0) if (&User-Name =~ /\.\./ ) -> FALSE (0) if ((&User-Name =~ /@/) && (&User-Name !~ /(a)(.+)\.(.+)$/)) { (0) if ((&User-Name =~ /@/) && (&User-Name !~ /(a)(.+)\.(.+)$/)) -> FALSE (0) if (&User-Name =~ /\.$/) { (0) if (&User-Name =~ /\.$/) -> FALSE (0) if (&User-Name =~ /(a)\./) { (0) if (&User-Name =~ /(a)\./) -> FALSE (0) } # if (&User-Name) = notfound (0) } # policy filter_username = notfound (0) [preprocess] = ok (0) [chap] = noop (0) [mschap] = noop (0) [digest] = noop (0) suffix: Checking for suffix after "@" (0) suffix: Looking up realm "gmail.com" for User-Name = " pruebaucnperl(a)gmail.com" (0) suffix: Found realm "gmail.com" (0) suffix: Adding Realm = "gmail.com" (0) suffix: Authentication realm is LOCAL (0) [suffix] = ok (0) eap: No EAP-Message, not doing EAP (0) [eap] = noop (0) [files] = noop (0) [expiration] = noop (0) [logintime] = noop (0) pap: WARNING: No "known good" password found for the user. Not setting Auth-Type (0) pap: WARNING: Authentication will fail unless a "known good" password is available (0) [pap] = noop (0) if (!control:Auth-Type && User-Password){ (0) if (!control:Auth-Type && User-Password) -> TRUE (0) if (!control:Auth-Type && User-Password) { (0) update control { (0) Auth-Type := Perl (0) } # update control = noop (0) } # if (!control:Auth-Type && User-Password) = noop (0) } # authorize = ok (0) Found Auth-Type = Perl (0) # Executing group from file /etc/freeradius/3.0/sites-enabled/default (0) Auth-Type Perl { (0) perl: $RAD_REQUEST{'User-Name'} = &request:User-Name -> ' pruebaucnperl(a)gmail.com' (0) perl: $RAD_REQUEST{'User-Password'} = &request:User-Password -> 'password' (0) perl: $RAD_REQUEST{'NAS-IP-Address'} = &request:NAS-IP-Address -> '146.83.124.26' (0) perl: $RAD_REQUEST{'NAS-Port'} = &request:NAS-Port -> '0' (0) perl: $RAD_REQUEST{'Event-Timestamp'} = &request:Event-Timestamp -> 'sep 22 2020 18:33:00 -03' (0) perl: $RAD_REQUEST{'Message-Authenticator'} = &request:Message-Authenticator -> '0xf081ea4e44b9ed006a1316a93828157f' (0) perl: $RAD_REQUEST{'Realm'} = &request:Realm -> 'gmail.com' (0) perl: $RAD_CHECK{'Auth-Type'} = &control:Auth-Type -> 'Perl' (0) perl: $RAD_CONFIG{'Auth-Type'} = &control:Auth-Type -> 'Perl' POP3 <- +OK Gpop ready for requests from 146.83.124.26 d17mb25011424qvc at /etc/freeradius/3.0/mods-config/perl/pop3.pl line 149. POP3 -> QUIT at /etc/freeradius/3.0/mods-config/perl/pop3.pl line 149. POP3 <- +OK Bye d17mb25011424qvc at /etc/freeradius/3.0/mods-config/perl/pop3.pl line 149. (0) perl: &request:Realm = $RAD_REQUEST{'Realm'} -> 'gmail.com' (0) perl: &request:User-Name = $RAD_REQUEST{'User-Name'} -> ' pruebaucnperl(a)gmail.com' (0) perl: &request:Message-Authenticator = $RAD_REQUEST{'Message-Authenticator'} -> '0xf081ea4e44b9ed006a1316a93828157f' (0) perl: &request:NAS-Port = $RAD_REQUEST{'NAS-Port'} -> '0' (0) perl: &request:NAS-IP-Address = $RAD_REQUEST{'NAS-IP-Address'} -> '146.83.124.26' (0) perl: &request:User-Password = $RAD_REQUEST{'User-Password'} -> 'password' (0) perl: &request:Event-Timestamp = $RAD_REQUEST{'Event-Timestamp'} -> 'sep 22 2020 18:33:00 -03' (0) perl: &control:Auth-Type = $RAD_CHECK{'Auth-Type'} -> 'Perl' (0) [perl] = reject (0) } # Auth-Type Perl = reject (0) Failed to authenticate the user (0) Using Post-Auth-Type Reject (0) Post-Auth-Type sub-section not found. Ignoring. (0) # Executing group from file /etc/freeradius/3.0/sites-enabled/default (0) Delaying response for 1.000000 seconds Waking up in 0.9 seconds. (0) Sending delayed response (0) Sent Access-Reject Id 63 from 127.0.0.1:1812 to 127.0.0.1:41319 length 20 Thank you in advance.

2 5

Re: External trigger for CoA
by vcargats＠cisco.com 27 Sep '20

27 Sep '20

Hi I have been able to implement this approach with coa-relay and it mostly working, but there are a couple of issues with that. Here are my observations (note I am talking about FR 3.0.x branch): 1) We may specify Packet-DST-IP-Address/Packet-Dst-IPv6-Address or Home-Server-Pool to be able to forward CoA request to the particular NAS. 2) If Packet-DST-IP-Address is specified then FR searches the home_server by port type UDP and this is hardcoded. Of course, if I have configured the home_server with RADSEC/TCP FR cannot find it. But at this step that would not be such a big issue if I would be able to specify the NAS via Home-Server-Pool. 3) If Home-Server-Pool is used, FR still cannot find the home_server. Moreover, it is crashed with SIGSEGV. The reason for this is: a) listener is set to null in request_coa_originate in process.c coa->listener = NULL; /* copied here by request_alloc_fake(), but not needed */ here is the git ref: https://github.com/FreeRADIUS/freeradius-server/commit/d9dd706503897a4c271b… b) listener type is checked in home_server_ldb in realms.c if ((request->listener->type == RAD_LISTEN_DETAIL) && (request->packet->code == PW_CODE_ACCOUNTING_REQUEST) && (fr_ipaddr_cmp(&home->ipaddr, &request->packet->src_ipaddr) == 0)) { continue; } Here the listener is NULL and hence the SIGSEGV. Once I deleted the "coa->listener = NULL;" The flow started to be working as expected. Also, if I check if the listener is NULL before checking its type in home_server_ldb - that also worked. The questions are: 1) May you recall the reason for "coa->listener = NULL;" in request_coa_originate? 2) Is it safe to remove that line, essentially to revert the commit referenced above? 3) Alternatively, will that be better to check for the listener is NULL just to avoid the crash in home_server_ldb? Thanks, Vadim _____________________________________ Sent from http://freeradius.1045715.n5.nabble.com

2 1

-simeltenious-1
by MEjaz 27 Sep '20

27 Sep '20

Thanks for your usual instant support. And sorry for annoying you with the config files. Rest assure that I will not repeat it what you told not to, however I revert back original queries.config for mssql. When I tested to connect user multiple times through NTRadPing utility, Yes they can connect which I don’t want. It should allow only once. I noticed following warning in the debug level. " sql: WARNING: Simultaneous-Use checking requires 'simul_count_query' to be configured. Attached is full debug file your information " I have searched few forums for where/how to configure this statement "'simul_count_query'" in which file? But no luck. Would you please help. almost all done. Except this default simultaneous-use to 1, database side is already done. Once again thanks in advance… Ejaz -----Original Message----- From: Freeradius-Users [mailto:freeradius-users-bounces+mejaz=cyberia.net.sa@lists.freeradius.org] On Behalf Of Alan DeKok Sent: Sunday, September 20, 2020 7:09 PM To: FreeRadius users mailing list <freeradius-users(a)lists.freeradius.org> Subject: Re: auth-type-error On Sep 20, 2020, at 11:33 AM, MEjaz < <mailto:mejaz@cyberia.net.sa> mejaz(a)cyberia.net.sa> wrote: > So far I have successfully achieved the below request type through radpingutility > > * Authentication > * Accounting start > * Accounting stop That's good. > Now only remaining is to set default simultaneous-use to 1. As i want to limit user's behavior, such as a username can login only once at the same time... > > But got error as “rlm_sql_unixodbc: 22002 [Microsoft][ODBC Driver 17 for SQL Server]Indicator variable required but not supplied (2) sql: ERROR: Error fetching row” debug is attached fyi. Ok... > 1、modifiy default and inner-tunnel in For pretty much the last time... we do NOT need to see config files. If I haven't gotten that point across before, please pay attention now. If you keep posting config files when told not to, I will just start ignoring your messages. > 2、modify queris.coonf in /usr/local/etc/raddb/mods-config/sql/main/mssql, > > below statment i have copeied from /usr/local/etc/raddb/mods-config/sql/main/mysql/quries.conf, as it was not exists by default under the msssql/queries.coonf Don't do that. The databases have different syntaxes. You *cannot* just copy queries from one config file to another one. There's a *reason* that the configuration files are different. Go fix the queries to be correct for MSSQL. How? I don't know. I don't run MSSQL. Alan DeKok. - List info/subscribe/unsubscribe? See <http://www.freeradius.org/list/users.html> http://www.freeradius.org/list/users.html

2 1

PEAP mschapv2 E= 691 R=0 code is correct?
by 엔트로링크(주) 25 Sep '20

25 Sep '20

atteched full log. Thanks

2 3