- Freeradius-Users - lists.freeradius.org

FreeRadius replaces characters in '%{User-Password}' after upgrade 3.0.16->3.0.19
by belyj＠belyj.eu 18 Jul '19

18 Jul '19

Hello. After upgrade from 3.0.16 to 3.0.19 freeradius is replacing characters in mysql queries. (76475085) Tue Jul 16 16:16:06 2019: Debug: Received Access-Request Id 54 from length 126 (76475085) Tue Jul 16 16:16:06 2019: Debug: NAS-Identifier = "XXXX" (76475085) Tue Jul 16 16:16:06 2019: Debug: User-Password = "p6suf+FyNBebQgLMTdAXD4q0U/yZVIaxSN/w8LzVMlw=" query ... xxx.value = '%{User-Password}' AND ... (76475085) Tue Jul 16 16:16:06 2019: Debug: sql3: Executing select query: SELECT ... xxx.value = 'p6suf=2BFyNBebQgLMTdAXD4q0U/yZVIaxSN/w8LzVMlw=3D' AND ... \+ is replaced and =3D added at the end. `p6suf+FyNBebQgLMTdAXD4q0U/yZVIaxSN/w8LzVMlw=` `p6suf=2BFyNBebQgLMTdAXD4q0U/yZVIaxSN/w8LzVMlw=3D` radiusd: FreeRADIUS Version 3.0.19 (git #1156b5361), for host x86_64-pc-linux-gnu FreeRADIUS Version 3.0.19 On 3.0.16 same config, same query, password is not changed. Any help would be appreciated. Andrzej

5 9

linelog
by Bassem Mettichi 18 Jul '19

18 Jul '19

Hello, please could you tell me how to use linelog module to log accounting requets instead of detail module? i have enabled the module linelog on default file section accounting and disabled detail module but after sending packets i didn't see any log : accounting { # Update accounting packet by adding the CUI attribute # recorded from the corresponding Access-Accept # use it only if your NAS boxes do not support CUI themselves # cui # # Create a 'detail'ed log of the packets. # Note that accounting requests which are proxied # are also logged in the detail file. # detail # daily linelog Thanks Bassem

1 0

Error while trying to just accept user in inner tunnel
by Alberto Martínez Setién 18 Jul '19

18 Jul '19

Hi all, While doing EAP-TTLS-PAP I am trying to have an unknown user get accepted anyway in order to get him into a captive portal. Relevant config is: if (&User-Name && &User-Password) { > update control { > Tmp-String-0 := "%{sql_oracle_dscorp:SELECT > swi_wi.pkg_wifi.f_get_username_code('%{User-Name}') FROM DUAL}" > } > > if (&control:Tmp-String-0 != '') { > update control { > Password-With-Header := > &control:Tmp-String-0 > } > } > else { > update reply { > Filter-Id := 'rol-invitado-logon' > } > > accept > } > } > Unfortunately, I can't apparently accept the user in the authorize section. (7) Virtual server sending reply > (7) Filter-Id := "rol-invitado-logon" > (7) eap_ttls: Tunneled authentication will be proxied to LOCAL > (7) eap: WARNING: Tunneled session will be proxied. Not doing EAP > (7) [eap] = handled > (7) } # authenticate = handled > (7) WARNING: Cancelling proxy as no home pool exists > (7) There was no response configured: rejecting request > (7) Using Post-Auth-Type Reject > What I might be missing? Regards, Alberto

3 3

Confused about ssl caching
by Sven Hartge 18 Jul '19

18 Jul '19

Hello all! I am using freeradius 3.0.17 (waiting on .19 is on the testbed right now) and I am a bit confused about the ssl cache. I am authentication users in WiFi against LDAP (as a database, i.e. the correct way) and also assigning VLANs based on the UserClass, all working fine: if ( "%{toupper:%{control:GIFB-UserClass[*]}}" =~ /(M|P|A|R)/ ) { update reply { &Tunnel-Type = "VLAN" &Tunnel-Medium-Type = "IEEE-802" &Tunnel-Private-Group-id = "701" &Aruba-User-Vlan = 701 } updated } else { update reply { &Tunnel-Type = "VLAN" &Tunnel-Medium-Type = "IEEE-802" &Tunnel-Private-Group-id = "700" &Aruba-User-Vlan = 700 } updated } GIFB-UserClass is a local attribute pulled from LDAP. This works fine, no problems here. Now: in tls-common it says: # The "Cached-Session-Policy" is the name of a # policy which should be applied to the cached # session. This policy can be used to assign # VLANs, IP addresses, etc. It serves as a useful # way to re-apply the policy from the original # Access-Accept to the subsequent Access-Accept # for the cached session. Here is where my confusion starts and searching the web and the list archive only increased it. Do *I* need to do anything here to get the correct VLAN to the user on session resumption or is it just *magic* and will work automagically? Or do I need to add the Xeap.authenticate and Xeap.authorize policies somewhere? I'd like to understand the mechanism before playing with it. Grüße, Sven.

3 6

RE: Proxy issue - Failing proxied request for user error
by James Wood 17 Jul '19

17 Jul '19

There is no firewall on the box itself (all UDP to 1812/1813 open publicly) and the strange thing is that the majority of packets are handled fine by FreeRADIUS (the ones that reach the daemon). So, it appears although tcdump and radsniff shows the packet arriving, it never gets to FreeRADIUS for some reason. radsniff log (filtered for `norsp`) norsp,7798,2019-07-16 23:08:43.462979,,Accounting-Request,ens4,1.2.3.4,41060,10.11.12.13,1813,125,"2a19172c7fc7" norsp,7799,2019-07-16 23:08:43.463001,,Accounting-Request,ens4,1.2.3.4,36239,10.11.12.13,1813,13,"63b8136755ec" norsp,7800,2019-07-16 23:08:43.463112,,Accounting-Request,ens4,1.2.3.4,38841,10.11.12.13,1813,125,"033c1a03cbdd" norsp,7801,2019-07-16 23:08:43.463159,,Accounting-Request,ens4,1.2.3.4,38841,10.11.12.13,1813,241,"b9790286e557" norsp,7802,2019-07-16 23:08:43.463331,,Accounting-Request,ens4,1.2.3.4,39990,10.11.12.13,1813,66,"710250b69ee0" norsp,7803,2019-07-16 23:08:43.463454,,Accounting-Request,ens4,1.2.3.4,39990,10.11.12.13,1813,208,"b940c9c76e96" norsp,7804,2019-07-16 23:08:43.463632,,Accounting-Request,ens4,1.2.3.4,38841,10.11.12.13,1813,187,"5ca284fb563e" norsp,9042,2019-07-16 23:08:45.972261,,Accounting-Request,ens4,1.2.3.4,39990,10.11.12.13,1813,218,"2f5a67f71993" norsp,9043,2019-07-16 23:08:45.972353,,Accounting-Request,ens4,1.2.3.4,39990,10.11.12.13,1813,13,"5e26718c4442" norsp,9044,2019-07-16 23:08:45.972406,,Accounting-Request,ens4,1.2.3.4,39990,10.11.12.13,1813,15,"273bcbb553c8" norsp,9045,2019-07-16 23:08:45.972514,,Accounting-Request,ens4,1.2.3.4,36239,10.11.12.13,1813,113,"b84e7246b3e3" norsp,12595,2019-07-16 23:08:49.990914,,Accounting-Request,ens4,1.2.3.4,38841,10.11.12.13,1813,51,"51683f17d039" So they DO reach the server, but DONT get processed for some reason. Server is a Google Cloud compute VM instance utilising an Intel Xeon E5 v4 (Broadwell) @ 2.8GHz with 16GB RAM Thanks J

2 1

Proxy issue - Failing proxied request for user error
by James Wood 17 Jul '19

17 Jul '19

Dear Group, We have a proxy-based setup but need advice on dropped proxy requests. We were running on 3.0.12 and upgraded to 3.0.19 but not change in behaviour. It's a simple one to one proxy, so packets come in to an external RADIUS server (public IP) and traffic is proxied to an internal one. We are seeing random errors for accounting packets but I can't figure out why. I ran a tcpdump on both sides and can see the traffic is being sent from the master and received on the internal server. But, the internal server must not be handling it nicely it as the master server says: Fri Jul 12 07:38:01 2019 : ERROR: (259008189) ERROR: Failing proxied request for user "689c3148b5a04d73a931534f0dd46f35", due to lack of any response from home server 10.0.0.1 port 1813 Fri Jul 12 07:38:01 2019 : ERROR: (259008191) ERROR: Failing proxied request for user "f1680ea08fff4773b415a4a4a34b9365", due to lack of any response from home server 10.0.0.1 port 1813 Fri Jul 12 07:38:01 2019 : ERROR: (259008193) ERROR: Failing proxied request for user "3b710ab2b4b0497baadd543582b7afc6", due to lack of any response from home server 10.0.0.1 port 1813 Fri Jul 12 07:38:01 2019 : ERROR: (259008194) ERROR: Failing proxied request for user "0f2eec41a0b7488a88d6dc131913538d", due to lack of any response from home server 10.0.0.1 port 1813 Fri Jul 12 07:38:01 2019 : ERROR: (259008195) ERROR: Failing proxied request for user "0c02bd6c5fb2426ea981fa62c51099eb", due to lack of any response from home server 10.0.0.1 port 1813 Fri Jul 12 07:38:01 2019 : ERROR: (259008196) ERROR: Failing proxied request for user "6d6749a71aaf49ec97c472f85af18158", due to lack of any response from home server 10.0.0.1 port 1813 Fri Jul 12 07:38:01 2019 : ERROR: (259008197) ERROR: Failing proxied request for user "39fd72831dbd4236abc055f01bea0d5b", due to lack of any response from home server 10.0.0.1 port 1813 Fri Jul 12 07:38:01 2019 : ERROR: (259008198) ERROR: Failing proxied request for user "1c4c86da12054a099af44d4f0780b666", due to lack of any response from home server 10.0.0.1 port 1813 Notes: 1) The server handles around 50-100 auths/acct packets per second, so nothing major. The majority of requests are proxied without error and the failed ones are not from the same NAS client, spread out across many. 2) This only happens on accounting packets, never auths 3) It happens on Start, Stop and Interim packets 4) It seems to happen in chunks, i.e. i'll get a big block of 30 or so of these errors appear in the lock Any help on how to debug would be much appreciated. Thanks J

4 6

Problem with python module
by Denis Shipilov 16 Jul '19

16 Jul '19

Hello! Is there someone who can help me? Radiusd starting failed, google can not help me. FreeRADIUS Version 3.0.13 Centos 7.6.1810 radiusd -X output: ... Debugger not attached radiusd: #### Instantiating modules #### modules { # Loaded module rlm_python # Loading module "python" from file /etc/raddb/radiusd.conf python { <internal>[73]: Reference "${.module}" not found /etc/raddb/radiusd.conf[73]: Failed expanding variable mod_instantiate /etc/raddb/radiusd.conf[73]: Invalid configuration for module "python" radiusd.conf: ... modules { python { python_path = /usr/lib64/python2.7 mod_authorize = radius func_authorize = authorize mod_accounting = radius func_accounting = accounting mod_preacct = radius func_preacct = preacct mod_postauth = radius func_postauth = postauth } ... python file: /usr/lib64/python2.7/radius.py I can not understand what happened. Same conf works on other servers. I can not find difference. Any suggestions? Sorry if something wrong - I am not native speaker and first time with mailing lists.

2 2

rlm_cache filtering
by liran kessel 15 Jul '19

15 Jul '19

I have activated rlm_cache so as to reduce the amount of times the freeradius will query the DB. I made the Calling-Station-Id the cache key and have added this code to the accounting section: cache if (ok){ sql } else { if ("%{sql:select case when exists(select * from [TABLE_NAME] where ne_id='%{Calling-Station-Id}') then 1 else 0 end}" == 1){ sql } } However what happens is that all Calling-Station-Ids are stored to the cache and so the 2nd time I get a packet they execute the sql module. How can I configure filtering of the cache in the “else” section so as to decide which Calling-Station-Id to save in cache and which not? Thanks Liran

3 3

rlm_cache filtering
by liran kessel 15 Jul '19

15 Jul '19

I have activated rlm_cache so as to reduce the amount of times the freeradius will query the DB. I made the Calling-Station-Id the cache key and have added this code to the accounting section: cache if (ok){ sql } else { if ("%{sql:select case when exists(select * from [TABLE_NAME] where ne_id='%{Calling-Station-Id}') then 1 else 0 end}" == 1){ sql } } However what happens is that all Calling-Station-Ids are stored to the cache and so the 2nd time I get a packet they execute the sql module. How can I configure filtering of the cache in the “else” section so as to decide which Calling-Station-Id to save in cache and which not? Thanks Liran

1 0

Filtering accounting messages
by liran kessel 15 Jul '19

15 Jul '19

Hi, I am receiving accounting messages from the network and storing them to the radacct table. Currently in order to filter I have changed the INSERT/UPDATE commands with a where statement to only insert rows for subscribers I am managing. This is working fine but as my network grows it is creating a lot of overhead to execute SQL commands that don’t do anything and so I am trying to move the filtering to the FreeRADIUS code. I have added the preacct to the attr_filter file: attr_filter attr_filter.preacct { key = "%{User-Name}" filename = ${modconfdir}/${.:name}/preacct } And have this preacct file to try and currently filter only 1 number from being inserted to the DB. # # Configuration file for the rlm_attr_filter module. # Please see rlm_attr_filter(5) manpage for more information. # # # This configuration file is used to remove almost all of the attributes # From an Accounting-Response message. The RFC's say that an # Accounting-Response packet can contain only a few attributes. # We enforce that here. # DEFAULT Vendor-Specific =* ANY, Message-Authenticator =* ANY, Error-Cause =* ANY, Proxy-State =* ANY, Calling-Station-Id == ‘XXXXXXXX' However it seems that the filter is being ignored and all lines are inserted to the DB. Can you please assist in understanding why it isn’t filtering? In addition if I have a list of about 100K subscribers that I do want to store their accounting data to the DB is there a way to manage this list without adding it 1 by 1 to the filter file? I am running Freeradius 3.0.13 with PostgreSQL. Thanks Liran Kessel

3 7