- Freeradius-Users - lists.freeradius.org

Problem in postgresql query timeout
by Raghu nathan 02 Jul '19

02 Jul '19

*Hello Team,* In the mod-available/sql configuration we have kept query_timeout = 5 But this is not working for postgresql queries, do we have any suggestion for postgresql query timeout? Regards, Raghu.

2 1

ERROR: No Auth-Type found:
by Tal Nur 02 Jul '19

02 Jul '19

Dear All, I'm struggling with FR 3.0.20 configuring for eduroam.Today I've got the following error message:ERROR: No Auth-Type found: rejecting the user via Post-Auth-Type = Reject Here is the output of radiusd -X command:(0) Received Access-Request Id 197 from 89.250.80.7:1026 to 89.250.80.6:1812 length 133(0) User-Name = "bob(a)turan.kz"(0) NAS-IP-Address = 192.168.0.1(0) NAS-Port = 0(0) Called-Station-Id = "C8-3A-35-40-1C-F0"(0) Calling-Station-Id = "4C-49-E3-15-5D-CA"(0) Framed-MTU = 1400(0) NAS-Port-Type = Wireless-802.11(0) EAP-Message = 0x0201001101626f6240747572616e2e6b7a(0) Message-Authenticator = 0x3d081e4d2e965e5f7661f8b80ad0b6ef(0) # Executing section authorize from file /usr/local/etc/raddb/sites-enabled/eduroam(0) authorize {(0) policy filter_username {(0) if (&User-Name) {(0) if (&User-Name) -> TRUE(0) if (&User-Name) {(0) if (&User-Name =~ / /) {(0) if (&User-Name =~ / /) -> FALSE(0) if (&User-Name =~ /@[^@]*@/ ) {(0) if (&User-Name =~ /@[^@]*@/ ) -> FALSE(0) if (&User-Name =~ /\.\./ ) {(0) if (&User-Name =~ /\.\./ ) -> FALSE(0) if ((&User-Name =~ /@/) && (&User-Name !~ /(a)(.+)\.(.+)$/)) {(0) if ((&User-Name =~ /@/) && (&User-Name !~ /(a)(.+)\.(.+)$/)) -> FALSE(0) if (&User-Name =~ /\.$/) {(0) if (&User-Name =~ /\.$/) -> FALSE(0) if (&User-Name =~ /(a)\./) {(0) if (&User-Name =~ /(a)\./) -> FALSE(0) } # if (&User-Name) = notfound(0) } # policy filter_username = notfound(0) update request {(0) Operator-Name := "1turan.kz"(0) } # update request = noop(0) auth_log: EXPAND /usr/local/var/log/radius/radacct/%{%{Packet-Src-IP-Address}:-%{Packet-Src-IPv6-Address}}/auth-detail-%Y%m%d(0) auth_log: --> /usr/local/var/log/radius/radacct/89.250.80.7/auth-detail-20190702(0) auth_log: /usr/local/var/log/radius/radacct/%{%{Packet-Src-IP-Address}:-%{Packet-Src-IPv6-Address}}/auth-detail-%Y%m%d expands to /usr/local/var/log/radius/radacct/89.250.80.7/auth-detail-20190702(0) auth_log: EXPAND %t(0) auth_log: --> Tue Jul 2 05:28:46 2019(0) [auth_log] = ok(0) suffix: Checking for suffix after "@"(0) suffix: Looking up realm "turan.kz" for User-Name = "bob(a)turan.kz"(0) suffix: Found realm "turan.kz"(0) suffix: Adding Realm = "turan.kz"(0) suffix: Authentication realm is LOCAL(0) [suffix] = ok(0) } # authorize = ok(0) ERROR: No Auth-Type found: rejecting the user via Post-Auth-Type = Reject(0) Failed to authenticate the user(0) Using Post-Auth-Type Reject(0) # Executing group from file /usr/local/etc/raddb/sites-enabled/eduroam(0) Post-Auth-Type REJECT {(0) reply_log: EXPAND /usr/local/var/log/radius/radacct/%{%{Packet-Src-IP-Address}:-%{Packet-Src-IPv6-Address}}/reply-detail-%Y%m%d(0) reply_log: --> /usr/local/var/log/radius/radacct/89.250.80.7/reply-detail-20190702(0) reply_log: /usr/local/var/log/radius/radacct/%{%{Packet-Src-IP-Address}:-%{Packet-Src-IPv6-Address}}/reply-detail-%Y%m%d expands to /usr/local/var/log/radius/radacct/89.250.80.7/reply-detail-20190702(0) reply_log: EXPAND %t(0) reply_log: --> Tue Jul 2 05:28:46 2019(0) [reply_log] = ok(0) } # Post-Auth-Type REJECT = ok(0) Delaying response for 1.000000 secondsWaking up in 0.3 seconds.Waking up in 0.6 seconds.(0) Sending delayed response(0) Sent Access-Reject Id 197 from 89.250.80.6:1812 to 89.250.80.7:1026 length 20Waking up in 3.9 seconds.(0) Cleaning up request packet ID 197 with timestamp +191Ready to process requests I used eduroam (default) file in /sites-enabled directory taken from wiki.geant.org: server eduroam { listen { type = "auth" ipaddr = * port = 0 } listen { type = "acct" ipaddr = * port = 0 } listen { type = "auth" ipv6addr = :: port = 0 } listen { type = "acct" ipv6addr = :: port = 0 } authorize { # only use filter_username from version > 3.0.7 on filter_username update request { Operator-Name := "1turan.kz" # the literal number "1" above is an important prefix! Do not change it! } # if you want detailed logging auth_log suffix } authenticate { eap } preacct { suffix } accounting { } post-auth { # if you want detailed logging reply_log Post-Auth-Type REJECT { reply_log } } pre-proxy { # if you want detailed logging pre_proxy_log if("%{Packet-Type}" != "Accounting-Request") { attr_filter.pre-proxy } } post-proxy { # if you want detailed logging post_proxy_log attr_filter.post-proxy }} In authenticate section I tried empty value, as was on wiki.geant.org and then I wrote eap option as shown in the above, but nothing was changed.The same error message: No Auth-Type foundWhat should be done to fix the problem?

2 1

double-quoted strings: a literal %
by Stefan Winter 02 Jul '19

02 Jul '19

Hello, I'm currently running into a wall with what should be a simple escaping question. Apologies if this is documented in unlang.5 - I looked but didn't find it there. The thing is that I want to run an authorize_check_query: authorize_check_query = "\ SELECT 1 as id, username, 'Expiration' AS attribute, date_format(stoptime, '\%d \%b \%Y \%H:\%i') AS value, ':=' AS op \ FROM expirationinfo \ WHERE username = '%{SQL-User-Name}' AND starttime <= NOW() ORDER BY value DESC LIMIT 1" The whole thing needs to be a double-quoted string because I want the expansion of %{SQL-User-Name} to happen. However, there is a problem with the part that does date_format. date_format wants literal % characters. The above while FreeRADIUS-syntactically correct does not yield the expected results: the \ characters are coming back as part of the format string of the date_format function in MySql, like "\19 \Jul \2099 \23:\59" But if I omit the \ in front of the % then the FreeRADIUS parser fails on the string because the % is not followed by a valid expansion. Now the unlang manpage tells me that \" leads to a literal " but apparently \% does not lead to a literal %. So the question really is: how do I keep a literal % inside a double-quoted string? Greetings, Stefan Winter -- Stefan WINTER Ingenieur de Recherche Fondation RESTENA - Réseau Téléinformatique de l'Education Nationale et de la Recherche 2, avenue de l'Université L-4365 Esch-sur-Alzette Tel: +352 424409 1 Fax: +352 422473 PGP key updated to 4096 Bit RSA - I will encrypt all mails if the recipient's key is known to me http://pgp.mit.edu:11371/pks/lookup?op=get&search=0xC0DE6A358A39DC66

2 1

rlm_detail
by Bassem Mettichi 01 Jul '19

01 Jul '19

hello, could you explain what means the value 256 on this function and if we can incraese it to optimise detail module? rlm_detail.c: inst->ef = exfile_init(inst, 256, 30, inst->locking); Thanks Bassem

3 2

query_timeout in rlm_sql_postgresql v3.0.20
by Arran Cudbard-Bell 28 Jun '19

28 Jun '19

The query_timeout configuration item in the rlm_sql module will be respected in rlm_sql_postgresql as of 3.0.20. This required switching to the libpq asynchronous query interface. We've done internal testing and not found any issues, but if you're using the postgresql driver, it would be useful if you could try v3.0.x HEAD and report your experiences, that would help ensure when 3.0.20 is released there are no breakages. -Arran

1 0

Concurrency Check
by Aurélio de Souza Ribeiro Neto 27 Jun '19

27 Jun '19

Hello ALL, Using a scenario with FreeRadius 3-0-19 and MySQL, when checkrad is used? In what conditions? What's the sequence Freeradius uses? MySQL, checkrad? Aurelio

2 2

Failed authentication on FreeRadius
by Tal Nur 27 Jun '19

27 Jun '19

I installed FR 3.0.20 with plain text file storing users and their passwords.When I tried to connect end user bob(a)turan.kz via WiFi AP I failed.What is my mistake? Here is output of freeradius -X command during connection attempt: Received Access-Request Id 30 from 89.250.80.7:1026 to 89.250.80.6:1812 length 182 User-Name = "bob(a)turan.kz" NAS-IP-Address = 192.168.0.1 NAS-Port = 0 Called-Station-Id = "C8-3A-35-40-1C-F0" Calling-Station-Id = "84-B1-53-DF-3E-BC" Framed-MTU = 1400 NAS-Port-Type = Wireless-802.11 EAP-Message = 0x02070030190017030300253bc5db1b0542fe953989206abc908f78fc9bd5babd5d93bf8913bf3d361ea67cccdf066be5 State = 0xfefad346fbfdca45684956ecf2b10489 Message-Authenticator = 0x1d94ee8285d897bee4e535fc3012a89a Restoring &session-state &session-state:TLS-Session-Cipher-Suite = "ECDHE-RSA-AES256-GCM-SHA384" &session-state:TLS-Session-Version = "TLS 1.2" # Executing section authorize from file /usr/local/etc/raddb/sites-enabled/default authorize { policy filter_username { if (&User-Name) { if (&User-Name) -> TRUE if (&User-Name) { if (&User-Name =~ / /) { if (&User-Name =~ / /) -> FALSE if (&User-Name =~ /@[^@]*@/ ) { if (&User-Name =~ /@[^@]*@/ ) -> FALSE if (&User-Name =~ /\.\./ ) { if (&User-Name =~ /\.\./ ) -> FALSE if ((&User-Name =~ /@/) && (&User-Name !~ /(a)(.+)\.(.+)$/)) { if ((&User-Name =~ /@/) && (&User-Name !~ /(a)(.+)\.(.+)$/)) -> FALSE if (&User-Name =~ /\.$/) { if (&User-Name =~ /\.$/) -> FALSE if (&User-Name =~ /(a)\./) { if (&User-Name =~ /(a)\./) -> FALSE } # if (&User-Name) = notfound } # policy filter_username = notfound [preprocess] = ok [chap] = noop [mschap] = noop [digest] = noop suffix: Checking for suffix after "@" suffix: Looking up realm "turan.kz" for User-Name = "bob(a)turan.kz" suffix: Found realm "turan.kz" suffix: Adding Realm = "turan.kz" suffix: Authentication realm is LOCAL [suffix] = ok eap: Peer sent EAP Response (code 2) ID 7 length 48 eap: Continuing tunnel setup [eap] = ok } # authorize = ok Found Auth-Type = eap # Executing group from file /usr/local/etc/raddb/sites-enabled/default authenticate { eap: Expiring EAP session with state 0xfefad346fbfdca45 eap: Finished EAP session with state 0xfefad346fbfdca45 eap: Previous EAP request found for state 0xfefad346fbfdca45, released from the list eap: Peer sent packet with method EAP PEAP (25) eap: Calling submodule eap_peap to process data eap_peap: Continuing EAP-TLS eap_peap: [eaptls verify] = ok eap_peap: Done initial handshake eap_peap: [eaptls process] = ok eap_peap: Session established. Decoding tunneled attributes eap_peap: PEAP state WAITING FOR INNER IDENTITY eap_peap: Identity - bob(a)turan.kz eap_peap: Got inner identity 'bob(a)turan.kz' eap_peap: Setting default EAP type for tunneled EAP session eap_peap: Got tunneled request eap_peap: EAP-Message = 0x0207001101626f6240747572616e2e6b7a eap_peap: Setting User-Name to bob(a)turan.kz eap_peap: Sending tunneled request to eduroam-inner-tunnel eap_peap: EAP-Message = 0x0207001101626f6240747572616e2e6b7a eap_peap: FreeRADIUS-Proxied-To = 127.0.0.1 eap_peap: User-Name = "bob(a)turan.kz" eap_peap: NAS-IP-Address = 192.168.0.1 eap_peap: NAS-Port = 0 eap_peap: Called-Station-Id = "C8-3A-35-40-1C-F0" eap_peap: Calling-Station-Id = "84-B1-53-DF-3E-BC" eap_peap: Framed-MTU = 1400 eap_peap: NAS-Port-Type = Wireless-802.11 eap_peap: Event-Timestamp = "Jun 26 2019 07:06:42 UTC" Virtual server eduroam-inner-tunnel received request EAP-Message = 0x0207001101626f6240747572616e2e6b7a FreeRADIUS-Proxied-To = 127.0.0.1 User-Name = "bob(a)turan.kz" NAS-IP-Address = 192.168.0.1 NAS-Port = 0 Called-Station-Id = "C8-3A-35-40-1C-F0" Calling-Station-Id = "84-B1-53-DF-3E-BC" Framed-MTU = 1400 NAS-Port-Type = Wireless-802.11 Event-Timestamp = "Jun 26 2019 07:06:42 UTC" WARNING: Outer and inner identities are the same. User privacy is compromised. server eduroam-inner-tunnel { # Executing section authorize from file /usr/local/etc/raddb/sites-enabled/inner-tunnel authorize { auth_log: EXPAND /usr/local/var/log/radius/radacct/%{%{Packet-Src-IP-Address}:-%{Packet-Src-IPv6-Address}}/auth-detail-%Y%m%d auth_log: --> /usr/local/var/log/radius/radacct/89.250.80.7/auth-detail-20190626 auth_log: /usr/local/var/log/radius/radacct/%{%{Packet-Src-IP-Address}:-%{Packet-Src-IPv6-Address}}/auth-detail-%Y%m%d expands to /usr/local/var/log/radius/radacct/89.250.80.7/auth-detail-20190626 auth_log: EXPAND %t auth_log: --> Wed Jun 26 07:06:42 2019 [auth_log] = ok eap: Peer sent EAP Response (code 2) ID 7 length 17 eap: EAP-Identity reply, returning 'ok' so we can short-circuit the rest of authorize [eap] = ok files: users: Matched entry bob(a)turan.kz at line 87 files: EXPAND Hello, %{User-Name} files: --> Hello, bob(a)turan.kz [files] = ok [mschap] = noop pap: WARNING: Auth-Type already set. Not setting to PAP [pap] = noop } # authorize = ok Found Auth-Type = eap # Executing group from file /usr/local/etc/raddb/sites-enabled/inner-tunnel authenticate { eap: Peer sent packet with method EAP Identity (1) eap: Calling submodule eap_mschapv2 to process data eap_mschapv2: Issuing Challenge eap: Sending EAP Request (code 1) ID 8 length 43 eap: EAP session adding &reply:State = 0x58cb71f258c36b09 [eap] = handled } # authenticate = handled } # server eduroam-inner-tunnel Virtual server sending reply Reply-Message = "Hello, bob(a)turan.kz" EAP-Message = 0x0108002b1a01080026106a0612ff605c3452f6e178745c8eba94667265657261646975732d332e302e3230 Message-Authenticator = 0x00000000000000000000000000000000 State = 0x58cb71f258c36b095384618a82349908 eap_peap: Got tunneled reply code 11 eap_peap: Reply-Message = "Hello, bob(a)turan.kz" eap_peap: EAP-Message = 0x0108002b1a01080026106a0612ff605c3452f6e178745c8eba94667265657261646975732d332e302e3230 eap_peap: Message-Authenticator = 0x00000000000000000000000000000000 eap_peap: State = 0x58cb71f258c36b095384618a82349908 eap_peap: Got tunneled reply RADIUS code 11 eap_peap: Reply-Message = "Hello, bob(a)turan.kz" eap_peap: EAP-Message = 0x0108002b1a01080026106a0612ff605c3452f6e178745c8eba94667265657261646975732d332e302e3230 eap_peap: Message-Authenticator = 0x00000000000000000000000000000000 eap_peap: State = 0x58cb71f258c36b095384618a82349908 eap_peap: Got tunneled Access-Challenge eap: Sending EAP Request (code 1) ID 8 length 74 eap: EAP session adding &reply:State = 0xfefad346f8f2ca45 [eap] = handled } # authenticate = handled Using Post-Auth-Type Challenge # Executing group from file /usr/local/etc/raddb/sites-enabled/default Challenge { ... } # empty sub-section is ignored session-state: Saving cached attributes TLS-Session-Cipher-Suite = "ECDHE-RSA-AES256-GCM-SHA384" TLS-Session-Version = "TLS 1.2" Sent Access-Challenge Id 30 from 89.250.80.6:1812 to 89.250.80.7:1026 length 0 EAP-Message = 0x0108004a1900170303003f65d2d81fede8586ad658fe2ef68148cdd00a0fe7d7b86fc891c73f2c4382c50fe3d4c8d8c75decf5ed2e079ab13f12c470df1c6d7eba8b61fcf7cfda3a4603 Message-Authenticator = 0x00000000000000000000000000000000 State = 0xfefad346f8f2ca45684956ecf2b10489 Finished request

2 1

Write additional accounting fields to sql
by Matthew McTague 27 Jun '19

27 Jun '19

Hi, I have two additional fields that I receive in Accounting-Request packets from my NAS, and I want to write these to radacct, or if that is not possible, to another table. The fields are: ADSL-Agent-Circuit-Id ADSL-Agent-Remote-Id Is it correct alter the table, then amend column_list within the accounting section of mods-config/sql/main/mysql/queries.conf? Warm Regards, Matthew McTague Head of Infrastructure, Reliance Networks d. +64 3 222 6013 t. 0800 483 882 (+64 3 683 9090) Website | Service Desk | Internet Services Reliance Networks Ltd accepts no liability for the content of this email, or for the consequences of any actions taken on the basis of the information provided, unless that information is subsequently confirmed in writing. Any views or opinions presented in this email are solely those of the author and do not necessarily represent those of the company.

2 3

Bug?
by Aurélio de Souza Ribeiro Neto 26 Jun '19

26 Jun '19

Hello Alan, I'm using Freeradius 3.0.19 in Ubuntu 16. I was having trouble when I tried to update control in authenticate session in default file, for Auth-Type mschap, when authentication is rejected. The condition wasn't reached. In debug mode, I see this line (complete dump below): (7) mschap: Found MS-CHAP attributes. Setting 'Auth-Type = mschap' So I changed "Auth-Type MS-CHAP { " to "Auth-Type mschap" in default file and all works fine!! It's a bug or just my fault? :: "ERROR DUMP" Ready to process requests (7) Received Access-Request Id 114 from 172.17.6.2:33846 to XXX.XXX.XXX.XXX:1812 length 193 (7) Service-Type = Framed-User (7) Framed-Protocol = PPP (7) NAS-Port = 15729015 (7) NAS-Port-Type = Ethernet (7) User-Name = "XXXXXXXXXXX" (7) Calling-Station-Id = "XX:XX:XX:XX:XX:XX" (7) Called-Station-Id = "CE - POP ITPM5" (7) NAS-Port-Id = "ether5" (7) MS-CHAP-Challenge = 0xdb9cf50eb227ee11 (7) MS-CHAP-Response = 0x01010000000000000000000000000000000000000000000000006bc5f0726031baa47 5638dca8a9348c12d6d0d8d21ffe29e (7) NAS-Identifier = "CE-ITPM" (7) NAS-IP-Address = 172.17.6.2 (7) # Executing section authorize from file /etc/freeradius/sites-enabled/default (7) authorize { (7) [preprocess] = ok (7) [chap] = noop (7) mschap: Found MS-CHAP attributes. Setting 'Auth-Type = mschap' (7) [mschap] = ok (7) sql: EXPAND %{User-Name} (7) sql: --> XXXXXXXXXXXXX (7) sql: SQL-User-Name set to 'XXXXXXXXXXXXXXX' rlm_sql (sql): Reserved connection (9) (7) sql: EXPAND SELECT DISTINCT (R.id), R.username, R.attribute, R.value, R.op FROM mpc_freeradius.radcheck R, mpc_freeradius.nas N, mpc_lw.maclist M WHERE R.username = BINARY '%{SQL-User-Name}' AND M.usuario_login = BINARY '%{SQL-User-Name}' AND N.nasname = '%{Nas-IP-Address}' AND N.gw_id = (SELECT gateway_id FROM mpc_lw.maclist WHERE usuario_login = BINARY '%{SQL-User-Name}' AND plano_id NOT IN (6,8,9,793) AND gateway_id = ( SELECT gw_id FROM mpc_freeradius.nas WHERE nasname = '%{Nas-IP-Address}' ) ORDER BY ID) UNION ALL SELECT DISTINCT (R.id), R.username, R.attribute, R.value, R.op FROM mpc_freeradius.radcheck R, mpc_freeradius.nas N, mpc_lw.maclist M WHERE R.username = BINARY '%{SQL-User-Name}' AND M.usuario_login = BINARY '%{SQL-User-Name}' AND M.grupocliente = 'ALL-POPS' (7) sql: --> SELECT DISTINCT (R.id), R.username, R.attribute, R.value, R.op FROM mpc_freeradius.radcheck R, mpc_freeradius.nas N, mpc_lw.maclist M WHERE R.username = BINARY 'XXXXXXXXXXXXX' AND M.usuario_login = BINARY 'XXXXXXXXXXXXX' AND N.nasname = '172.17.6.2' AND N.gw_id = (SELECT gateway_id FROM mpc_lw.maclist WHERE usuario_login = BINARY 'XXXXXXXXXXXXX' AND plano_id NOT IN (6,8,9,793) AND gateway_id = ( SELECT gw_id FROM mpc_freeradius.nas WHERE nasname = '172.17.6.2' ) ORDER BY ID) UNION ALL SELECT DISTINCT (R.id), R.username, R.attribute, R.value, R.op FROM mpc_freeradius.radcheck R, mpc_freeradius.nas N, mpc_lw.maclist M WHERE R.username = BINARY 'XXXXXXXXXXXXX' AND M.usuario_login = BINARY 'XXXXXXXXXXXXX' AND M.grupocliente = 'ALL-POPS' (7) sql: Executing select query: SELECT DISTINCT (R.id), R.username, R.attribute, R.value, R.op FROM mpc_freeradius.radcheck R, mpc_freeradius.nas N, mpc_lw.maclist M WHERE R.username = BINARY 'XXXXXXXXXXXXX' AND M.usuario_login = BINARY 'XXXXXXXXXXXXX' AND N.nasname = '172.17.6.2' AND N.gw_id = (SELECT gateway_id FROM mpc_lw.maclist WHERE usuario_login = BINARY 'XXXXXXXXXXXXX' AND plano_id NOT IN (6,8,9,793) AND gateway_id = ( SELECT gw_id FROM mpc_freeradius.nas WHERE nasname = '172.17.6.2' ) ORDER BY ID) UNION ALL SELECT DISTINCT (R.id), R.username, R.attribute, R.value, R.op FROM mpc_freeradius.radcheck R, mpc_freeradius.nas N, mpc_lw.maclist M WHERE R.username = BINARY 'XXXXXXXXXXXXX' AND M.usuario_login = BINARY 'XXXXXXXXXXXXX' AND M.grupocliente = 'ALL-POPS' rlm_sql (sql): Closing expired connection (7): Hit lifetime limit rlm_sql_mysql: Socket destructor called, closing socket rlm_sql (sql): Reserved connection (10) rlm_sql (sql): Released connection (10) Need 8 more connections to reach 10 spares rlm_sql (sql): Opening additional connection (11), 1 of 29 pending slots used rlm_sql_mysql: Starting connect to MySQL server rlm_sql_mysql: Connected to database 'mpc_freeradius' on mysql.mpc.com.br via TCP/IP, server version 5.7.26-0ubuntu0.16.04.1-log, protocol version 10 (7) sql: EXPAND SELECT groupname FROM radusergroup WHERE username = '%{SQL-User-Name}' ORDER BY priority (7) sql: --> SELECT groupname FROM radusergroup WHERE username = 'XXXXXXXXXXXXX' ORDER BY priority (7) sql: Executing select query: SELECT groupname FROM radusergroup WHERE username = 'XXXXXXXXXXXXX' ORDER BY priority (7) sql: User not found in any groups rlm_sql (sql): Released connection (9) (7) [sql] = notfound (7) [expiration] = noop (7) [logintime] = noop Not doing PAP as Auth-Type is already set. (7) [pap] = noop (7) } # authorize = ok (7) Found Auth-Type = mschap (7) # Executing group from file /etc/freeradius/sites-enabled/default (7) authenticate { (7) mschap: WARNING: No Cleartext-Password configured. Cannot create NT-Password (7) mschap: WARNING: No Cleartext-Password configured. Cannot create LM-Password (7) mschap: Client is using MS-CHAPv1 with NT-Password (7) mschap: ERROR: FAILED: No NT/LM-Password. Cannot perform authentication (7) mschap: ERROR: MS-CHAP2-Response is incorrect (7) [mschap] = reject (7) } # authenticate = reject (7) Failed to authenticate the user (7) Using Post-Auth-Type Reject (7) # Executing group from file /etc/freeradius/sites-enabled/default (7) Post-Auth-Type REJECT { (7) attr_filter.access_reject: EXPAND %{User-Name} (7) attr_filter.access_reject: --> XXXXXXXXXXXXX (7) attr_filter.access_reject: Matched entry DEFAULT at line 11 (7) [attr_filter.access_reject] = updated (7) linelog: EXPAND messages.%{%{reply:Packet-Type}:-default} (7) linelog: --> messages.Access-Reject (7) linelog: No such entry ".messages.Access-Reject" (7) [linelog] = noop (7) } # Post-Auth-Type REJECT = updated (7) Login incorrect (mschap: FAILED: No NT/LM-Password. Cannot perform authentication): [XXXXXXXXXXXXX/<via Auth-Type = mschap>] (from client ce-popitpm-rb port 15729015 cli XX:XX:XX:XX:XX:XX) (7) Delaying response for 1.000000 seconds Waking up in 0.6 seconds. Waking up in 0.3 seconds. (7) Sending delayed response (7) Sent Access-Reject Id 114 from 187.120.197.140:1812 to 172.17.6.2:33846 length 61 (7) MS-CHAP-Error = "\001E=691 R=1 C=aa56c73c463c7a63 V=2" Waking up in 8.9 seconds. :: "ALL OK DUMP" (1) Received Access-Request Id 209 from 172.17.6.2:59186 to XXX.XXX.XXX.XXX:1812 length 193 (1) Service-Type = Framed-User (1) Framed-Protocol = PPP (1) NAS-Port = 15729042 (1) NAS-Port-Type = Ethernet (1) User-Name = "XXXXXXXXXXXXX" (1) Calling-Station-Id = "XX:XX:XX:XX:XX:XX" (1) Called-Station-Id = "CE - POP ITPM5" (1) NAS-Port-Id = "ether5" (1) MS-CHAP-Challenge = 0xdf11a990dc9e9fb7 (1) MS-CHAP-Response = 0x010100000000000000000000000000000000000000000000000075ad989b83ff7ae24 102c6e3a0f272e11ff159260152f933 (1) NAS-Identifier = "CE-ITPM" (1) NAS-IP-Address = 172.17.6.2 (1) # Executing section authorize from file /etc/freeradius/sites-enabled/default (1) authorize { (1) [preprocess] = ok (1) [chap] = noop (1) mschap: Found MS-CHAP attributes. Setting 'Auth-Type = mschap' (1) [mschap] = ok (1) sql: EXPAND %{User-Name} (1) sql: --> XXXXXXXXXXXXX (1) sql: SQL-User-Name set to 'XXXXXXXXXXXXX' rlm_sql (sql): Reserved connection (3) (1) sql: EXPAND SELECT DISTINCT (R.id), R.username, R.attribute, R.value, R.op FROM mpc_freeradius.radcheck R, mpc_freeradius.nas N, mpc_lw.maclist M WHERE R.username = BINARY '%{SQL-User-Name}' AND M.usuario_login = BINARY '%{SQL-User-Name}' AND N.nasname = '%{Nas-IP-Address}' AND N.gw_id = (SELECT gateway_id FROM mpc_lw.maclist WHERE usuario_login = BINARY '%{SQL-User-Name}' AND plano_id NOT IN (6,8,9,793) AND gateway_id = ( SELECT gw_id FROM mpc_freeradius.nas WHERE nasname = '%{Nas-IP-Address}' ) ORDER BY ID) UNION ALL SELECT DISTINCT (R.id), R.username, R.attribute, R.value, R.op FROM mpc_freeradius.radcheck R, mpc_freeradius.nas N, mpc_lw.maclist M WHERE R.username = BINARY '%{SQL-User-Name}' AND M.usuario_login = BINARY '%{SQL-User-Name}' AND M.grupocliente = 'ALL-POPS' (1) sql: --> SELECT DISTINCT (R.id), R.username, R.attribute, R.value, R.op FROM mpc_freeradius.radcheck R, mpc_freeradius.nas N, mpc_lw.maclist M WHERE R.username = BINARY 'XXXXXXXXXXXXX' AND M.usuario_login = BINARY 'XXXXXXXXXXXXX' AND N.nasname = '172.17.6.2' AND N.gw_id = (SELECT gateway_id FROM mpc_lw.maclist WHERE usuario_login = BINARY 'XXXXXXXXXXXXX' AND plano_id NOT IN (6,8,9,793) AND gateway_id = ( SELECT gw_id FROM mpc_freeradius.nas WHERE nasname = '172.17.6.2' ) ORDER BY ID) UNION ALL SELECT DISTINCT (R.id), R.username, R.attribute, R.value, R.op FROM mpc_freeradius.radcheck R, mpc_freeradius.nas N, mpc_lw.maclist M WHERE R.username = BINARY 'XXXXXXXXXXXXX' AND M.usuario_login = BINARY 'XXXXXXXXXXXXX' AND M.grupocliente = 'ALL-POPS' (1) sql: Executing select query: SELECT DISTINCT (R.id), R.username, R.attribute, R.value, R.op FROM mpc_freeradius.radcheck R, mpc_freeradius.nas N, mpc_lw.maclist M WHERE R.username = BINARY 'XXXXXXXXXXXXX' AND M.usuario_login = BINARY 'XXXXXXXXXXXXX' AND N.nasname = '172.17.6.2' AND N.gw_id = (SELECT gateway_id FROM mpc_lw.maclist WHERE usuario_login = BINARY 'XXXXXXXXXXXXX' AND plano_id NOT IN (6,8,9,793) AND gateway_id = ( SELECT gw_id FROM mpc_freeradius.nas WHERE nasname = '172.17.6.2' ) ORDER BY ID) UNION ALL SELECT DISTINCT (R.id), R.username, R.attribute, R.value, R.op FROM mpc_freeradius.radcheck R, mpc_freeradius.nas N, mpc_lw.maclist M WHERE R.username = BINARY 'XXXXXXXXXXXXX' AND M.usuario_login = BINARY 'XXXXXXXXXXXXX' AND M.grupocliente = 'ALL-POPS' rlm_sql (sql): Reserved connection (4) rlm_sql (sql): Released connection (4) Need 4 more connections to reach 10 spares rlm_sql (sql): Opening additional connection (7), 1 of 25 pending slots used rlm_sql_mysql: Starting connect to MySQL server rlm_sql_mysql: Connected to database 'mpc_freeradius' on mysql.mpc.com.br via TCP/IP, server version 5.7.26-0ubuntu0.16.04.1-log, protocol version 10 (1) sql: EXPAND SELECT groupname FROM radusergroup WHERE username = '%{SQL-User-Name}' ORDER BY priority (1) sql: --> SELECT groupname FROM radusergroup WHERE username = 'XXXXXXXXXXXXX' ORDER BY priority (1) sql: Executing select query: SELECT groupname FROM radusergroup WHERE username = 'XXXXXXXXXXXXX' ORDER BY priority (1) sql: User not found in any groups rlm_sql (sql): Released connection (3) (1) [sql] = notfound (1) [expiration] = noop (1) [logintime] = noop Not doing PAP as Auth-Type is already set. (1) [pap] = noop (1) } # authorize = ok (1) Found Auth-Type = mschap (1) # Executing group from file /etc/freeradius/sites-enabled/default (1) Auth-Type mschap { (1) mschap: WARNING: No Cleartext-Password configured. Cannot create NT-Password (1) mschap: WARNING: No Cleartext-Password configured. Cannot create LM-Password (1) mschap: Client is using MS-CHAPv1 with NT-Password (1) mschap: ERROR: FAILED: No NT/LM-Password. Cannot perform authentication (1) mschap: ERROR: MS-CHAP2-Response is incorrect (1) [mschap] = reject (1) if (reject) { (1) if (reject) -> TRUE (1) if (reject) { (1) update control { (1) Pool-Name := "mkt_pool" (1) } # update control = noop (1) update reply { (1) Mikrotik-Rate-Limit := "300K/2M 600K/2200K 450K/1500K 10/10" (1) } # update reply = noop (1) [ok] = ok (1) } # if (reject) = ok (1) } # Auth-Type mschap = ok (1) # Executing section post-auth from file /etc/freeradius/sites-enabled/default (1) post-auth { (1) if (session-state:User-Name && reply:User-Name && request:User-Name && (reply:User-Name == request:User-Name)) { (1) if (session-state:User-Name && reply:User-Name && request:User-Name && (reply:User-Name == request:User-Name)) -> FALSE (1) update { (1) No attributes updated for RHS &session-state: (1) } # update = noop (1) sql: EXPAND .query (1) sql: --> .query (1) sql: Using query template 'query' rlm_sql (sql): Reserved connection (0) (1) sql: EXPAND %{User-Name} (1) sql: --> XXXXXXXXXXXXX (1) sql: SQL-User-Name set to 'XXXXXXXXXXXXX' (1) sql: EXPAND INSERT INTO radpostauth (username, pass, reply, authdate) VALUES ( '%{SQL-User-Name}', '%{%{User-Password}:-%{Chap-Password}}', '%{reply:Packet-Type}', '%S') (1) sql: --> INSERT INTO radpostauth (username, pass, reply, authdate) VALUES ( 'XXXXXXXXXXXXX', '', 'Access-Accept', '2019-06-26 11:44:54') (1) sql: Executing query: INSERT INTO radpostauth (username, pass, reply, authdate) VALUES ( 'XXXXXXXXXXXXX', '', 'Access-Accept', '2019-06-26 11:44:54') (1) sql: SQL query returned: success (1) sql: 1 record(s) updated rlm_sql (sql): Released connection (0) (1) [sql] = ok rlm_sql (sql): Reserved connection (5) (1) sqlippool: EXPAND %{User-Name} (1) sqlippool: --> XXXXXXXXXXXXX (1) sqlippool: SQL-User-Name set to 'XXXXXXXXXXXXX' (1) sqlippool: EXPAND START TRANSACTION (1) sqlippool: --> START TRANSACTION (1) sqlippool: Executing query: START TRANSACTION (1) sqlippool: EXPAND UPDATE radippool SET nasipaddress = '', pool_key = 0, callingstationid = '', username = '', expiry_time = NULL WHERE expiry_time <= NOW() - INTERVAL 1 SECOND AND nasipaddress = '%{%{Nas-IP-Address}:-%{Nas-IPv6-Address}}' (1) sqlippool: --> UPDATE radippool SET nasipaddress = '', pool_key = 0, callingstationid = '', username = '', expiry_time = NULL WHERE expiry_time <= NOW() - INTERVAL 1 SECOND AND nasipaddress = '172.17.6.2' (1) sqlippool: Executing query: UPDATE radippool SET nasipaddress = '', pool_key = 0, callingstationid = '', username = '', expiry_time = NULL WHERE expiry_time <= NOW() - INTERVAL 1 SECOND AND nasipaddress = '172.17.6.2' rlm_sql_mysql: Rows matched: 0 Changed: 0 Warnings: 0 (1) sqlippool: EXPAND COMMIT (1) sqlippool: --> COMMIT (1) sqlippool: Executing query: COMMIT (1) sqlippool: EXPAND START TRANSACTION (1) sqlippool: --> START TRANSACTION (1) sqlippool: Executing query: START TRANSACTION (1) sqlippool: EXPAND SELECT framedipaddress FROM radippool WHERE pool_name = '%{control:Pool-Name}' AND (expiry_time < NOW() OR expiry_time IS NULL) ORDER BY (username <> '%{User-Name}'), (callingstationid <> '%{Calling-Station-Id}'), expiry_time LIMIT 1 FOR UPDATE (1) sqlippool: --> SELECT framedipaddress FROM radippool WHERE pool_name = 'mkt_pool' AND (expiry_time < NOW() OR expiry_time IS NULL) ORDER BY (username <> 'XXXXXXXXXXXXX'), (callingstationid <> 'XX:XX:XX:XX:XX:XX'), expiry_time LIMIT 1 FOR UPDATE (1) sqlippool: Executing select query: SELECT framedipaddress FROM radippool WHERE pool_name = 'mkt_pool' AND (expiry_time < NOW() OR expiry_time IS NULL) ORDER BY (username <> 'XXXXXXXXXXXXX'), (callingstationid <> 'XX:XX:XX:XX:XX:XX'), expiry_time LIMIT 1 FOR UPDATE (1) sqlippool: Allocated IP 10.10.10.6 (1) sqlippool: EXPAND UPDATE radippool SET nasipaddress = '%{NAS-IP-Address}', pool_key = '%{Calling-Station-Id}', callingstationid = '%{Calling-Station-Id}', username = '%{User-Name}', expiry_time = NOW() + INTERVAL 3600 SECOND WHERE framedipaddress = '10.10.10.6' AND expiry_time IS NULL (1) sqlippool: --> UPDATE radippool SET nasipaddress = '172.17.6.2', pool_key = 'XX:XX:XX:XX:XX:XX', callingstationid = 'XX:XX:XX:XX:XX:XX', username = 'XXXXXXXXXXXXX', expiry_time = NOW() + INTERVAL 3600 SECOND WHERE framedipaddress = '10.10.10.6' AND expiry_time IS NULL (1) sqlippool: Executing query: UPDATE radippool SET nasipaddress = '172.17.6.2', pool_key = 'XX:XX:XX:XX:XX:XX', callingstationid = 'XX:XX:XX:XX:XX:XX', username = 'XXXXXXXXXXXXX', expiry_time = NOW() + INTERVAL 3600 SECOND WHERE framedipaddress = '10.10.10.6' AND expiry_time IS NULL rlm_sql_mysql: Rows matched: 1 Changed: 1 Warnings: 0 (1) sqlippool: EXPAND COMMIT (1) sqlippool: --> COMMIT (1) sqlippool: Executing query: COMMIT rlm_sql (sql): Released connection (5) (1) sqlippool: EXPAND Allocated IP: %{reply:Framed-IP-Address} from %{control:Pool-Name} (did %{Called-Station-Id} cli %{Calling-Station-Id} port %{NAS-Port} user %{User-Name}) (1) sqlippool: --> Allocated IP: 10.10.10.6 from mkt_pool (did CE - POP ITPM5 cli XX:XX:XX:XX:XX:XX port 15729042 user XXXXXXXXXXXXX) (1) [sqlippool] = ok (1) log_post_auth: EXPAND %{reply:Packet-Type} (1) log_post_auth: --> Access-Accept (1) log_post_auth: EXPAND %t : Info: Allocated IP: %{reply:Framed-IP-Address} from %{control:Pool-Name} (did %{Called-Station-Id} cli %{Calling-Station-Id} port %{NAS-Port} user %{User-Name}) (1) log_post_auth: --> Wed Jun 26 11:44:54 2019 : Info: Allocated IP: 10.10.10.6 from mkt_pool (did CE - POP ITPM5 cli XX:XX:XX:XX:XX:XX port 15729042 user XXXXXXXXXXXXX) (1) log_post_auth: EXPAND /var/log/freeradius/radius.log (1) log_post_auth: --> /var/log/freeradius/radius.log (1) [log_post_auth] = ok (1) [exec] = noop (1) } # post-auth = ok (1) Login OK: [XXXXXXXXXXXXX] (from client ce-popitpm-rb port 15729042 cli XX:XX:XX:XX:XX:XX) (1) Sent Access-Accept Id 209 from 187.120.197.140:1812 to 172.17.6.2:59186 length 0 (1) MS-CHAP-Error = "\001E=691 R=1 C=6514e8f833e51125 V=2" (1) Mikrotik-Rate-Limit := "300K/2M 600K/2200K 450K/1500K 10/10" (1) Framed-IP-Address = 10.10.10.6 (1) Finished request

2 1

Freeradius 3 DHCP server with SQL and 'anty dos' protection, how?
by Kamil de Bardon 26 Jun '19

26 Jun '19

Hello, I configure freeradius to be a unicast dhcp server for working with Cisco ASR. client --> cisco relay -> freeradius My configuration is: dhcp DHCP-Discover { if ( "%{mms: ${..ip_query}}" ) { update reply { DHCP-Message-Type = DHCP-Offer } update reply { &DHCP-Your-IP-Address = "%{mms: ${....ip_query} }" &DHCP-Subnet-Mask = "%{mms: ${....mask_query} }" &DHCP-Router-Address = "%{mms: ${....gw_query} }" &DHCP-Domain-Name-Server = "%{mms: ${....ns1_query} }" &DHCP-Domain-Name-Server += "%{mms: ${....ns2_query} }" &DHCP-IP-Address-Lease-Time = _DHCP_LEASE_TIME_ } ok } else { update reply { &DHCP-Message-Type = DHCP-Do-Not-Respond } reject } } dhcp DHCP-Request { update reply { &DHCP-Message-Type = DHCP-Ack } update reply { &DHCP-Your-IP-Address = "%{mms: ${...ip_query} }" &DHCP-Subnet-Mask = "%{mms: ${...mask_query} }" &DHCP-Router-Address = "%{mms: ${...gw_query} }" &DHCP-Domain-Name-Server = "%{mms: ${...ns1_query} }" &DHCP-Domain-Name-Server += "%{mms: ${...ns2_query} }" &DHCP-IP-Address-Lease-Time = _DHCP_LEASE_TIME_ } ok } This is working, but my concern is, if client's mac adres is not in the database, they dhcp client will send dhcp-discovery all the time, and one discovery = one sql query. Is there any way to prevent that? Some cache or so? Thanks for help.

3 5