- Freeradius-Users - lists.freeradius.org

RE: hex:attribute-name behavior is changed
by Chaigneau, Nicolas 09 May '19

09 May '19

Hello, I've just opened an issue that looks very similar, this is probably the same: https://github.com/FreeRADIUS/freeradius-server/issues/2672 Regards, Nicolas. > Hi, > > Previously the expansion %{hex:DHCP-Client-Hardware-Address} worked correctly by expanding to the mac address value inside the attribute. > Now the latest master(#a88b05513956b21ec037383780f9b568eeb49124) is expanding the raw string "DHCP-Client-Hardware-Address" to hex. > > However, %{hex:%{DHCP-Client-Hardware-Address} is working as expected(expands the value inside the attribute). > > Is this behavior is an intended change or a mistake? > > debug out: > (1) if ("0x%{hex:DHCP-Client-Hardware-Address}" == "%{DHCP-Relay-Remote-Id}") { > (1) EXPAND 0x%{hex:DHCP-Client-Hardware-Address} > (1) EXPAND %{hex:DHCP-Client-Hardware-Address} > (1) --> 444843502d436c69656e742d48617264776172652d41646472657373 > (1) --> 0x444843502d436c69656e742d48617264776172652d41646472657373 > (1) EXPAND %{DHCP-Relay-Remote-Id} > (1) --> 0x00a0bc00000a > > (0) if ("0x%{hex:%{DHCP-Client-Hardware-Address}}" == "%{DHCP-Relay-Remote-Id}") { > (0) EXPAND 0x%{hex:%{DHCP-Client-Hardware-Address}} > (0) EXPAND %{DHCP-Client-Hardware-Address} > (0) --> 00:a0:bc:00:00:0a > (0) EXPAND %{hex:%{DHCP-Client-Hardware-Address}} > (0) (%{hex:00:a0:bc:00:00:0a}) > (0) --> 00a0bc00000a > (0) --> 0x00a0bc00000a > > > This message contains information that may be privileged or confidential and is the property of the Capgemini Group. It is intended only for the person to whom it is addressed. If you are not the intended recipient, you are not authorized to read, print, retain, copy, disseminate, distribute, or use this message or any part thereof. If you receive this message in error, please notify the sender immediately and delete all copies of this message.

2 1

Radacct Reused ?
by Oscar 09 May '19

09 May '19

Hi, I've created a Trigger to save on a new table the las time a user has been stop connection (acctstoptime). So I've createad table and created this trigger: create TRIGGER UpdateStopTime AFTER UPDATE ON radacct FOR EACH ROW BEGIN INSERT into usuario_instalacion_stoptime ( select u.department as user,u.company as insta,if(r.acctstoptime is null,now(),r.acctstoptime) stoptime from radacct r,userinfo u where r.username=u.username and r.radacctid=NEW.radacctid ) ON DUPLICATE KEY UPDATE stoptime=if(NEW.acctstoptime is null,now(),NEW.acctstoptime) ; END$$ But now I'm facing that sems that radius rows from the past are beeign used on the present I mean, my radacctid is now arround 37.000.000 And I can see a user autheticated and updating a really old row: accstoptime=09-2018 and beeing update today with accstarttime=04-2019 How is that possible ? Is it correct ? Thanks,

3 20

Accounting - Input Octets64
by Nicolas Breuer 09 May '19

09 May '19

Hello, FreeRadius v3.0.19 Ready to process requests (0) Received Accounting-Request Id 205 from 112.112.166.34:1812 to 112.112.176.1:1813 length 610 (0) User-Name = "desclinz@XXXXX" (0) Acct-Status-Type = Interim-Update ... (0) Acct-Session-Time = 26401 (0) Acct-Input-Packets = 2241 (0) Acct-Output-Packets = 3514 (0) Acct-Input-Octets = 91936 (0) Acct-Output-Octets = 192756 (0) Acct-Input-Gigawords = 0 (0) Acct-Output-Gigawords = 0 (0) Acct-Input-Packets-64 = 2241 (0) Acct-Output-Packets-64 = 3514 (0) Acct-Input-Octets-64 = 91936 (0) Acct-Output-Octets-64 = 192756 (0) Acct-Mcast-In-Packets = 0 (0) Acct-Mcast-Out-Packets = 0 (0) Acct-Mcast-In-Octets = 0 (0) Acct-Mcast-Out-Octets = 0 (0) Acct-Mcast-In-Packets-64 = 0 I see the Input Octets 64 is decoded by freeradius, is it expected ? The same Accounting packet on Freeradius v2.2 Acct-Session-Time = 464417 Acct-Input-Packets = 3691542 Acct-Output-Packets = 3156045 Acct-Input-Octets = 822225356 Acct-Output-Octets = 709539148 Acct-Input-Gigawords = 0 Acct-Output-Gigawords = 0 Acct-Input-Packets-64 = 0x0000000000385416 Acct-Output-Packets-64 = 0x000000000030284d Acct-Input-Octets-64 = 0x00000000310229cc Acct-Output-Octets-64 = 0x000000002a4ab54c Acct-Mcast-In-Packets = 0 Acct-Mcast-Out-Packets = 0 Acct-Mcast-In-Octets = 0 Acct-Mcast-Out-Octets = 0 On 2.2, the Input Packets 64 is in Hexadecimal. Thanks

2 1

RE: redis_ippool module doesnot process lease_time in ack
by Chinnapaiyan, Nagamani 09 May '19

09 May '19

This works in latest git(#a88b05513956b21ec037383780f9b568eeb49124). (1) redis_ippool - &reply:DHCP-IP-Address-Lease-Time := 900 (1) redis_ippool - Requested IP address' "10.88.64.133" lease updated (1) redis_ippool - &reply:DHCP-Your-IP-Address := 10.88.64.133 (1) redis_ippool (updated) (1) ok (ok) Regards, Nagamani Chinnapaiyan

1 0

hex:attribute-name behavior is changed
by Chinnapaiyan, Nagamani 09 May '19

09 May '19

Hi, Previously the expansion %{hex:DHCP-Client-Hardware-Address} worked correctly by expanding to the mac address value inside the attribute. Now the latest master(#a88b05513956b21ec037383780f9b568eeb49124) is expanding the raw string "DHCP-Client-Hardware-Address" to hex. However, %{hex:%{DHCP-Client-Hardware-Address} is working as expected(expands the value inside the attribute). Is this behavior is an intended change or a mistake? debug out: (1) if ("0x%{hex:DHCP-Client-Hardware-Address}" == "%{DHCP-Relay-Remote-Id}") { (1) EXPAND 0x%{hex:DHCP-Client-Hardware-Address} (1) EXPAND %{hex:DHCP-Client-Hardware-Address} (1) --> 444843502d436c69656e742d48617264776172652d41646472657373 (1) --> 0x444843502d436c69656e742d48617264776172652d41646472657373 (1) EXPAND %{DHCP-Relay-Remote-Id} (1) --> 0x00a0bc00000a (0) if ("0x%{hex:%{DHCP-Client-Hardware-Address}}" == "%{DHCP-Relay-Remote-Id}") { (0) EXPAND 0x%{hex:%{DHCP-Client-Hardware-Address}} (0) EXPAND %{DHCP-Client-Hardware-Address} (0) --> 00:a0:bc:00:00:0a (0) EXPAND %{hex:%{DHCP-Client-Hardware-Address}} (0) (%{hex:00:a0:bc:00:00:0a}) (0) --> 00a0bc00000a (0) --> 0x00a0bc00000a Regards, Nagamani Chinnapaiyan

1 0

Freeradius for eduroam
by Tal Nur 09 May '19

09 May '19

Hi, Could someone give links to simple Freeradius 3.0 configuration for eduroam IdP with storing users in flat file? Regards,

2 1

Integration with Free radius OTP
by Omar Atia 09 May '19

09 May '19

Hello , Could you please provide the flow of messages between Client who authenticate to Radius with OTP. for example input from login page is Passport number and Phone number. Radius will receive the information and send OTP for authentication. I need to implement this use case , so I need the messages flow between login page and Radius server for OTP authentication . thanks, Omar Atia

1 0

Simple sites-enabled file?
by Paul Pathiakis 08 May '19

08 May '19

Hi, I know that this isn't the place for radsecproxy questions..... However, I am trying to get the start of that by creating a sites-enabled file for TLS. Does anyone have a simple example so that I can just 'add to it' as I go? Thank you! P.

1 0

Systemctl start issue on Freeradius 3.0.19
by Giuseppe Russo 08 May '19

08 May '19

Hello, I installed Freeradius 3.0.19 on centos 7. Everything is working properly but if I start the service with systemctl start radius the service remain in “activating” status: radiusd.service - FreeRADIUS multi-protocol policy server Loaded: loaded (/usr/lib/systemd/system/radiusd.service; enabled; vendor preset: disabled) Active: activating (start) since Thu 2019-05-02 19:52:38 CEST; 31s ago Docs: man:radiusd(8) man:radiusd.conf(5) http://wiki.freeradius.org/ http://networkradius.com/doc/ Process: 6786 ExecStartPre=/bin/chown -R root /usr/local/var/run/radiusd (code=exited, status=0/SUCCESS) Process: 6784 ExecStartPre=/usr/local/sbin/radiusd $FREERADIUS_OPTIONS -Cx -lstdout (code=exited, status=0/SUCCESS) Main PID: 6792 (radiusd) Memory: 8.5M (limit: 2.0G) CGroup: /system.slice/radiusd.service └─6792 /usr/local/sbin/radiusd This is the content of the radiusd.service file: [Unit] Description=FreeRADIUS multi-protocol policy server After=network-online.target Documentation=man:radiusd(8) man:radiusd.conf(5) http://wiki.freeradius.org/ http://networkradius.com/doc/ [Service] Type=notify WatchdogSec=60 NotifyAccess=all PIDFile=/usr/local/var/run/radiusd/radiusd.pid EnvironmentFile=-/etc/sysconfig/radiusd # FreeRADIUS can do static evaluation of policy language rules based # on environmental variables which is very useful for doing per-host # customization. # Unfortunately systemd does not allow variable substitutions such # as %H or $(hostname) in the EnvironmentFile. # We provide HOSTNAME here for convenience. Environment=HOSTNAME=%H # Limit memory to 2G this is fine for %99.99 of deployments. FreeRADIUS # is not memory hungry, if it's using more than this, then there's probably # a leak somewhere. MemoryLimit=2G RuntimeDirectory=radiusd RuntimeDirectoryMode=0775 ExecStartPre=/usr/local/sbin/radiusd $FREERADIUS_OPTIONS -Cx -lstdout ExecStartPre=-/bin/chown -R root /usr/local/var/run/radiusd ExecStart=/usr/local/sbin/radiusd $FREERADIUS_OPTIONS Restart=on-failure RestartSec=5 [Install] WantedBy=multi-user.target Can you tell me how to solve this problem? Thank you Giuseppe

3 7

StrLen of an Attribute
by Nicolas Breuer 08 May '19

08 May '19

Hello, Can you help how get the length of an attribute ? (%{#%{reply:Service-Type}} > 3) Returns "0" https://wiki.freeradius.org/config/run_time_variables Thanks

3 3