- Freeradius-Users - lists.freeradius.org

Problem with python module
by Denis Shipilov 16 Jul '19

16 Jul '19

Hello! Is there someone who can help me? Radiusd starting failed, google can not help me. FreeRADIUS Version 3.0.13 Centos 7.6.1810 radiusd -X output: ... Debugger not attached radiusd: #### Instantiating modules #### modules { # Loaded module rlm_python # Loading module "python" from file /etc/raddb/radiusd.conf python { <internal>[73]: Reference "${.module}" not found /etc/raddb/radiusd.conf[73]: Failed expanding variable mod_instantiate /etc/raddb/radiusd.conf[73]: Invalid configuration for module "python" radiusd.conf: ... modules { python { python_path = /usr/lib64/python2.7 mod_authorize = radius func_authorize = authorize mod_accounting = radius func_accounting = accounting mod_preacct = radius func_preacct = preacct mod_postauth = radius func_postauth = postauth } ... python file: /usr/lib64/python2.7/radius.py I can not understand what happened. Same conf works on other servers. I can not find difference. Any suggestions? Sorry if something wrong - I am not native speaker and first time with mailing lists.

2 2

rlm_cache filtering
by liran kessel 15 Jul '19

15 Jul '19

I have activated rlm_cache so as to reduce the amount of times the freeradius will query the DB. I made the Calling-Station-Id the cache key and have added this code to the accounting section: cache if (ok){ sql } else { if ("%{sql:select case when exists(select * from [TABLE_NAME] where ne_id='%{Calling-Station-Id}') then 1 else 0 end}" == 1){ sql } } However what happens is that all Calling-Station-Ids are stored to the cache and so the 2nd time I get a packet they execute the sql module. How can I configure filtering of the cache in the “else” section so as to decide which Calling-Station-Id to save in cache and which not? Thanks Liran

3 3

rlm_cache filtering
by liran kessel 15 Jul '19

15 Jul '19

I have activated rlm_cache so as to reduce the amount of times the freeradius will query the DB. I made the Calling-Station-Id the cache key and have added this code to the accounting section: cache if (ok){ sql } else { if ("%{sql:select case when exists(select * from [TABLE_NAME] where ne_id='%{Calling-Station-Id}') then 1 else 0 end}" == 1){ sql } } However what happens is that all Calling-Station-Ids are stored to the cache and so the 2nd time I get a packet they execute the sql module. How can I configure filtering of the cache in the “else” section so as to decide which Calling-Station-Id to save in cache and which not? Thanks Liran

1 0

Filtering accounting messages
by liran kessel 15 Jul '19

15 Jul '19

Hi, I am receiving accounting messages from the network and storing them to the radacct table. Currently in order to filter I have changed the INSERT/UPDATE commands with a where statement to only insert rows for subscribers I am managing. This is working fine but as my network grows it is creating a lot of overhead to execute SQL commands that don’t do anything and so I am trying to move the filtering to the FreeRADIUS code. I have added the preacct to the attr_filter file: attr_filter attr_filter.preacct { key = "%{User-Name}" filename = ${modconfdir}/${.:name}/preacct } And have this preacct file to try and currently filter only 1 number from being inserted to the DB. # # Configuration file for the rlm_attr_filter module. # Please see rlm_attr_filter(5) manpage for more information. # # # This configuration file is used to remove almost all of the attributes # From an Accounting-Response message. The RFC's say that an # Accounting-Response packet can contain only a few attributes. # We enforce that here. # DEFAULT Vendor-Specific =* ANY, Message-Authenticator =* ANY, Error-Cause =* ANY, Proxy-State =* ANY, Calling-Station-Id == ‘XXXXXXXX' However it seems that the filter is being ignored and all lines are inserted to the DB. Can you please assist in understanding why it isn’t filtering? In addition if I have a list of about 100K subscribers that I do want to store their accounting data to the DB is there a way to manage this list without adding it 1 by 1 to the filter file? I am running Freeradius 3.0.13 with PostgreSQL. Thanks Liran Kessel

3 7

EAP-TLS ON WINDOWS 7
by Root Networks 14 Jul '19

14 Jul '19

Hello Guys, i am struggling to make EAP-TLS to work on my Windows 7 but still no good results. I have created ca,server and clients certificates and PEAP is working fine. but EAP-TLS is not working. can you please redirect me to a link or thread explaing EAP-TLS on windows Regards, Kelvin

3 4

Freeradius proxy.conf login based
by Olivier CALVANO 14 Jul '19

14 Jul '19

Hi Actually i use proxy.conf for forward auth-request to the good radius server: realm "~(myrealm.realm)" { auth_pool = pool-auth.myrealm.realm acct_pool = pool-acct.myrealm.realm nostrip } login(a)myrealm.realm work's very good. but for one supplier, i want forward based on login, sample: realm "MSP-*@OTHER" { auth_pool = pool-auth.myrealm.realm acct_pool = pool-acct.myrealm.realm nostrip } it's possible ? i think's that i don't have the good synthaxe of realm because that's don't work thanks for your help regards

2 1

tcp connection for dynamic client
by MaRjAn GoOdAsiAeE 14 Jul '19

14 Jul '19

Hi all. I'm using nas table in the database for dynamic clients. I have a proto field in that table that can have tcp or udp value. but the problem is that there is no proper attribute for protocol in freeradius that i can set in dynamic_client file like FreeRADIUS_Client_protocol or something like that. how can I set tcp protocol for my dynamic clients?

2 1

Dynamic NAS in CoA From Database
by One Zero Art 14 Jul '19

14 Jul '19

Hi, I am wondering if it's possible to add NAS in home_server for CoA dynamically. I want to query NAS IP and secret from the database by SQL and add it in CoA section. Is it even possible anyhow? Right now in my system CoA is working fine. All I need is to somehow able to add NAS info in CoA. Search web for two hours but no luck on this. Note: I am using FR 3.x.x Thank you

2 1

4.0.x - issues with radmin tool
by Milan Nikolic 13 Jul '19

13 Jul '19

Hello, Some recent commit added `-S` option to radmin, to pass secret. I don't understand what secret it is asking for, from localhost that should be secret for localhost client right? Whatever I try to enter if it asks for secret, or with `-S` option it just hangs. I hacked/commented that part of code so I can use radmin as before (also on 4.0.x), but now every command executed with `radmin -e` returns always 1, even if succeeded, i.e. `radmin -f /run/radiusd/control/radiusd.sock -e 'stats network 0 self'` shows stats but returns 1 (btw. nice that now radmin will look for socket file from config, but without `-f` it prints some debug output). Also, I have problems with `radmin -e 'set debug level 2'` for example, it does not do anything. Is radmin still not in usable state? I use it for stats currently but it would be nice to have some easy way to switch debug levels on fly. Thanks, Milan

2 4

NSS DB
by Andrew Meyer 12 Jul '19

12 Jul '19

Hello,I am having some trouble getting FreeRADIUS to work. I am trying to set it up to communicate with my LDAP system (FreeIPA). I am using CentOS 7 latest w/ FreeRADIUS 3.0.13 and receiving the following errors. [root@console02 nssdb]# sudo systemctl status radiusd -l ● radiusd.service - FreeRADIUS high performance RADIUS server. Loaded: loaded (/usr/lib/systemd/system/radiusd.service; enabled; vendor preset: disabled) Active: failed (Result: exit-code) since Fri 2019-07-12 15:11:52 UTC; 11min ago Process: 4068 ExecStart=/usr/sbin/radiusd -d /etc/raddb (code=exited, status=1/FAILURE) Process: 4063 ExecStartPre=/usr/sbin/radiusd -C (code=exited, status=0/SUCCESS) Process: 4060 ExecStartPre=/bin/chown -R radiusd.radiusd /var/run/radiusd (code=exited, status=0/SUCCESS) Main PID: 1079 (code=exited, status=0/SUCCESS) Jul 12 15:11:51 console02.loc.example.local systemd[1]: Starting FreeRADIUS high performance RADIUS server.... Jul 12 15:11:52 console02.loc.example.local radiusd[4068]: TLSMC: MozNSS compatibility interception begins. Jul 12 15:11:52 console02.loc.example.local radiusd[4068]: tlsmc_convert: INFO: cannot open the NSS DB, expecting PEM configuration is present. Jul 12 15:11:52 console02.loc.example.local radiusd[4068]: tlsmc_intercept_initialization: INFO: successfully intercepted TLS initialization. Continuing with OpenSSL only. Jul 12 15:11:52 console02.loc.example.local radiusd[4068]: TLSMC: MozNSS compatibility interception ends. Jul 12 15:11:52 console02.loc.example.local systemd[1]: radiusd.service: control process exited, code=exited status=1 Jul 12 15:11:52 console02.loc.example.local systemd[1]: Failed to start FreeRADIUS high performance RADIUS server.. Jul 12 15:11:52 console02.loc.example.local systemd[1]: Unit radiusd.service entered failed state. Jul 12 15:11:52 console02.loc.example.local systemd[1]: radiusd.service failed. [root@console02 nssdb]# I have been doing some research and found that there is an issue w/ Redhat/CentOS.'Re: TLSMC: MozNSS compatibility interception begins message' - MARC | | | | 'Re: TLSMC: MozNSS compatibility interception begins message' - MARC | | | Is this still true for the version I have? I have tried creating a SSL cert from FreeIPA but that didn't seem to work. It is also possible I have missed a step. All help is greatly appreciated. Thank you!

2 2