- Freeradius-Users - lists.freeradius.org

Upgrade form 3.0.17 to 3.0.19 and error "Unable to set parent list"
by Marek Zarychta 15 Apr '19

15 Apr '19

Dear list, it looks like after upgrade from 3.0.17 to 3.0.19 successfully authenticated users are rejected in post-auth section with the error "Unable to set parent list". This applies only to users from our realm (self-proxied requests). Should configuration files be updated with regard to this update ? Almost the same config worked fine for 3.0.14, 3.0.15 and 3.0.17 (3.0.16 had issues with self-proxied requests though, but it had been fixed in tree just after release date). Please see attached diffs: # diff -U 2 sesjaok sesjafail --- sesjaok 2019-04-14 22:13:01.784098000 +0200 +++ sesjafail 2019-04-14 22:10:32.664311000 +0200 (...) @@ -4772,14 +4823,14 @@ (9) sql: --> .query (9) sql: Using query template 'query' -rlm_sql (sql): Reserved connection (6) +rlm_sql (sql): Reserved connection (0) (9) sql: EXPAND %{User-Name} (9) sql: --> testuser(a)realm.tld (9) sql: SQL-User-Name set to 'testuser(a)realm.tld' (9) sql: EXPAND INSERT INTO radpostauth (username, pass, reply, apid, authdate) VALUES ( '%{SQL-User-Name}', '%{Calling-Station-Id}', '%{reply:Packet-Type}', '%{Aruba-Location-Id}', '%S') -(9) sql: --> INSERT INTO radpostauth (username, pass, reply, apid, authdate) VALUES ( 'testuser(a)realm.tld', '02-00-00-00-00-01', 'Access-Accept', '', '2019-04-14 22:13:01') -(9) sql: Executing query: INSERT INTO radpostauth (username, pass, reply, apid, authdate) VALUES ( 'testuser(a)realm.tld', '02-00-00-00-00-01', 'Access-Accept', '', '2019-04-14 22:13:01') +(9) sql: --> INSERT INTO radpostauth (username, pass, reply, apid, authdate) VALUES ( 'testuser(a)realm.tld', '02-00-00-00-00-01', 'Access-Accept', '', '2019-04-14 22:10:31') +(9) sql: Executing query: INSERT INTO radpostauth (username, pass, reply, apid, authdate) VALUES ( 'testuser(a)realm.tld', '02-00-00-00-00-01', 'Access-Accept', '', '2019-04-14 22:10:31') (9) sql: SQL query returned: success (9) sql: 1 record(s) updated -rlm_sql (sql): Released connection (6) +rlm_sql (sql): Released connection (0) (9) [sql] = ok (9) if (1) { @@ -4797,21 +4848,48 @@ (9) } # update reply = noop (9) update { -(9) &outer.session-state::Chargeable-User-Identity += &reply:Chargeable-User-Identity[*] -> 0x63353435653635306130656261383366316437303930663232336264326334373266666533613930 -(9) } # update = noop -(9) } # if (1) = noop -(9) } # post-auth = ok -(9) Login OK: [testuser(a)realm.tld] (from client TEST-NET port 0 cli 02-00-00-00-00-01 via TLS tunnel) +(9) ERROR: Unable to set parent list +(9) } # update = fail +(9) } # if (1) = fail +(9) } # post-auth = fail +(9) Using Post-Auth-Type Reject +(9) # Executing group from file /usr/local/etc/raddb/sites-enabled/inner-tunnel +(9) Post-Auth-Type REJECT { +(9) sql: EXPAND .query +(9) sql: --> .query +(9) sql: Using query template 'query' +rlm_sql (sql): Reserved connection (1) +(9) sql: EXPAND %{User-Name} +(9) sql: --> testuser(a)realm.tld +(9) sql: SQL-User-Name set to 'testuser(a)realm.tld' +(9) sql: EXPAND INSERT INTO radpostauth (username, pass, reply, apid, authdate) VALUES ( '%{SQL-User-Name}', '%{Calling-Station-Id}', '%{reply:Packet-Type}', '%{Aruba-Location-Id}', '%S') +(9) sql: --> INSERT INTO radpostauth (username, pass, reply, apid, authdate) VALUES ( 'testuser(a)realm.tld', '02-00-00-00-00-01', 'Access-Reject', '', '2019-04-14 22:10:31') +(9) sql: Executing query: INSERT INTO radpostauth (username, pass, reply, apid, authdate) VALUES ( 'testuser(a)realm.tld', '02-00-00-00-00-01', 'Access-Reject', '', '2019-04-14 22:10:31') +(9) sql: SQL query returned: success +(9) sql: 1 record(s) updated +rlm_sql (sql): Released connection (1) +(9) [sql] = ok +(9) inner_auth_log: EXPAND inner_auth_log.%{%{reply:Packet-Type}:-format} +(9) inner_auth_log: --> inner_auth_log.Access-Reject +(9) inner_auth_log: EXPAND user-auth#VISINST=%{request:Operator-Name}#USER=%{User-Name}#CSI=%{%{Calling-Station-Id}:-Unknown Caller Id}#NAS=%{%{Called-Station-Id}:-Unknown Access Point}#CUI=%{%{%{reply:Chargeable-User-Identity}:-%{outer.reply:Chargeable-User-Identity}}:-Local User}#RESULT=FAIL# +(9) inner_auth_log: --> user-auth#VISINST=1realm.tld#USER=testuser(a)realm.tld#CSI=02-00-00-00-00-01#NAS=Unknown Access Point#CUI=0x63353435653635306130656261383366316437303930663232336264326334373266666533613930#RESULT=FAIL# +(9) [inner_auth_log] = ok +(9) attr_filter.access_reject: EXPAND %{User-Name} +(9) attr_filter.access_reject: --> testuser(a)realm.tld +(9) attr_filter.access_reject: Matched entry DEFAULT at line 11 +(9) [attr_filter.access_reject] = updated +(9) update outer.session-state { +(9) ERROR: Unable to set parent list +(9) } # update outer.session-state = fail +(9) } # Post-Auth-Type REJECT = fail +(9) Rejected in post-auth: [testuser(a)realm.tld] (from client TEST-NET port 0 cli 02-00-00-00-00-01 via TLS tunnel) +(9) Login incorrect (Unable to set parent list): [testuser(a)realm.tld] (from client TEST-NET port 0 cli 02-00-00-00-00-01 via TLS tunnel) (9) } # server inner-tunnel (9) Virtual server sending reply -(9) Chargeable-User-Identity := 0x63353435653635306130656261383366316437303930663232336264326334373266666533613930 -(9) eap_peap: Got tunneled reply code 2 -(9) eap_peap: Chargeable-User-Identity := 0x63353435653635306130656261383366316437303930663232336264326334373266666533613930 -(9) eap_peap: Got tunneled reply RADIUS code 2 -(9) eap_peap: Chargeable-User-Identity := 0x63353435653635306130656261383366316437303930663232336264326334373266666533613930 -(9) eap_peap: Tunneled authentication was successful -(9) eap_peap: SUCCESS -(9) eap_peap: Saving tunneled attributes for later +(9) eap_peap: Got tunneled reply code 3 +(9) eap_peap: Got tunneled reply RADIUS code 3 +(9) eap_peap: Tunneled authentication was rejected +(9) eap_peap: FAILURE (9) eap: Sending EAP Request (code 1) ID 10 length 43 -(9) eap: EAP session adding &reply:State = 0x21a3f50328a9ec83 +(9) eap: EAP session adding &reply:State = 0xabcbb745a2c1aea2 (9) [eap] = handled (9) } # authenticate = handled @@ -4819,6 +4897,4 @@ (9) # Executing group from file /usr/local/etc/raddb/sites-enabled/radius.realm.tld (9) Challenge { ... } # empty sub-section is ignored -(9) session-state: Saving cached attributes -(9) Chargeable-User-Identity += 0x63353435653635306130656261383366316437303930663232336264326334373266666533613930 (9) Finished internally proxied request. (9) Clearing existing &reply: attributes @@ -4830,5 +4906,5 @@ (9) post_proxy_log: /var/log/radacct/%{%{Packet-Src-IP-Address}:-%{Packet-Src-IPv6-Address}}/post-proxy-detail-%Y%m%d expands to /var/log/radacct/172.x.y.z/post-proxy-detail-20190414 (9) post_proxy_log: EXPAND %t -(9) post_proxy_log: --> Sun Apr 14 22:13:01 2019 +(9) post_proxy_log: --> Sun Apr 14 22:10:31 2019 (9) [post_proxy_log] = ok (9) attr_filter.post-proxy: EXPAND %{Realm} -- Marek Zarychta

2 2

FreeRadius sends Access-Reject for MAC-AUTH, if shared secret on NAS and server differ
by Phani Siriki 15 Apr '19

15 Apr '19

Phani Siriki has sent you an email via Gmail confidential mode: Gmail logo [1]FreeRadius sends Access-Reject for MAC-AUTH, if shared secret on NAS and server differ This message was sent on Apr 14, 2019 at 1:01:48 PM PDT You can open it by clicking the link below. This link will only work for freeradius-users(a)lists.freeradius.org. [2]View the email Gmail confidential mode gives you more control over the messages you send. Set an expiration time, disable printing or forwarding of a message and more. [3]Learn more Gmail: Email by Google Use is subject to the [4]Google Privacy Policy Google LLC, 1600 Amphitheatre Parkway, Mountain View, CA 94043, USA You have received this message because someone sent you an email via Gmail co! nfidential mode. Google logo References 1. https://confidential-mail.google.com/msg/ABTZP1zGEVczYo2ysdPSvuSn7Rhd1YYM2m… 2. https://confidential-mail.google.com/msg/ABTZP1zGEVczYo2ysdPSvuSn7Rhd1YYM2m… 3. https://support.google.com/mail/answer/7674059 4. https://myaccount.google.com/privacypolicy?hl=en

4 9

Unknown username and password matching
by Dan Strong 12 Apr '19

12 Apr '19

I'm trying authenticate users on to different networks but without their usernames and passwords. Basically they input a specific psk on wireless and this then hits the radius and sends them onto a vlan. So I have this working using DEFAULT auth-type = accept. It's matching a Cisco avpair psk and vlan attribute, they get dropped on to a specific vlan. This works. If I put the wrong psk in, I don't get on the network so this is good and expected. It's matching the Cisco avpair psk in radius. Is there any way to have a 2nd DEFAULT and have it match a 2nd cisco avpair? So in essence it looks at the first and says no, moves to the 2nd set of attributes? Validates a different password and drops them on a different vlan. I know I'm using default and it's matching anything, maybe there is another way? I don't want to match a sent username and password to confirm as this is sent as the devices Mac address which would be unknown to me. Feel like this should work somehow but I'm missing something...

3 9

FreeRADIUS server is not recognizing updates from my users file
by Aaron Dalla-Longa 12 Apr '19

12 Apr '19

for example, lines from my users file: testing Cleartext-Password := "52345" guestuser Cleartext-Password := "16109" Debug file 1 (Notice how it is authenticating with password 12345, an old password) -- *Aaron Dalla-Longa* Systems Administrator Shortgrass Library System tf: 1.866.529.0550 | p: 403.529.0550

2 5

Radius stale sessions
by Renato Sousa 12 Apr '19

12 Apr '19

Hello everyone, I am fine-tuning the radius accountig sql information and noticed that there are multiple stale sessions. I would like to use a script in cron to delete these sessions but I have a question. How should I select a session as stale? Time difference (acctstarttime and now()) ? Other records with the same mac-address and open sessions (acctstoptime is null) ? Regards, Renato L. Sousa

3 3

Identity attribute
by Elias Pereira 12 Apr '19

12 Apr '19

hello, In the EAP-tls access, the textbox "Identity" on smartphones have a correspondent attribute in freeradius? eap_tls: TLS-Cert-Common-Name := "COMPANY CA" Wed Apr 10 15:09:30 2019 : Debug: (2957) eap_tls: chain-depth : 1 Wed Apr 10 15:09:30 2019 : Debug: (2957) eap_tls: error : 0 Wed Apr 10 15:09:30 2019 : Debug: (2957) eap_tls: *identity : 99171* -- Elias Pereira

4 4

acct terminate cause -supplicant-restart
by Somanath Mishra 12 Apr '19

12 Apr '19

Hi Team, We are now getting new acctterminatecause type i.e supplicant-restart . We have not set any attribute like that in radreply. and disconnecting user automatically. So what does it mean? Is it any radius attribute? Kind regards, Somanath Mishra Software Engineer Luscious Software Pvt Ltd m: 8095019974 Skype ID: pbsomanath w: http://www.luscious-it.com/

2 2

repo error
by Aditya Vijjan 12 Apr '19

12 Apr '19

Hi Team, I am getting below error while running sudo apt-get update on freeradius server. PPA repo was added for freeradius and the source didn't have a release file, it was causing validation issues with APT Python API. Please refer to the error below: ----------ERROR------- Traceback (most recent call last): File "/usr/lib/python3/dist-packages/apt/cache.py", line 544, in update pulse_interval) apt_pkg.Error: E:The repository ' http://ppa.launchpad.net/freeradius/stable-3.0/ubuntu bionic Release' does not have a Release file. Regards Aditya Vijjan

2 1

data format of Acct-Input-Octets
by Somanath Mishra 11 Apr '19

11 Apr '19

Hi Team, Can anyone please tell me we are storing data in Acct-Input-Octets and Acct-Output-Octets is bits or bytes or any other format ? Kind regards, Somanath Mishra

4 4

Daily usage Limitation,
by myxmail1919＠yahoo.com 11 Apr '19

11 Apr '19

Hello, im still busy with configuring freeradius to limit users,anyone can help please ?I have to limit daily usage for all users to 3 hours per day,There is no pre-defined users , have MAC-based access control and allow everyone to connect, and need to limit daily usage to 3 hours per day, As I know I can run a SQL query to authenticate user, need to know how !! sql query have made to check SUM(acctsessiontime) but don’t know where and how to limit Max-Daily-Session for users ! Have no Database for users ! have to run sql query to che SUM of Acct session time per day and if not more than 10.800 seconds permit user to log in. have not much experience in freeradius,I don’t know where to set counters ! and where have to set sql authentication ! and etc …Every search result just telling me how to limit a pre-defined users, but didn’t find anything for not pre-defined users ! Thanks

1 0