- Freeradius-Users - lists.freeradius.org

Interpretation of Linked Unlinked and MA lines in the radsniff output
by Fekete Tamás 11 Feb '19

11 Feb '19

Hello! I would like to ask help with understanding the radsniff output as there are some lines I can not interpret. When I have run radsniff -W 1, I got the following output: ... Access-Request counters: Total : 66.000/s Linked : 64.000/s Unlinked : 0.000/s Access-Request latency: High : 1000.607ms Low : 0.260ms Average : 17.473ms MA : 23.723ms Access-Request retransmits & loss: RT (0) : 56.000/s ... I don't understand what is the difference between an Access-Request which is linked or unlinked. Can you explain this? And another question is: do you know what is the MA in the Access-Request latency? - Tamas Fekete

2 2

Problem with migrating from macOS Server to FreeRADIUS 3.0.17
by Stephan Jung 10 Feb '19

10 Feb '19

Unfortunately the log was stripped from my last mail. This is the complete output I get, when checking my FreeRADIUS installation: $ sudo /usr/local/Cellar/freeradius-server/3.0.17/bin/radiusd -XC FreeRADIUS Version 3.0.17 Copyright (C) 1999-2017 The FreeRADIUS server project and contributors There is NO warranty; not even for MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE You may redistribute copies of FreeRADIUS under the terms of the GNU General Public License For more information about these matters, see the file named COPYRIGHT Starting - reading configuration files ... including dictionary file /usr/local/Cellar/freeradius-server/3.0.17/share/freeradius/dictionary including dictionary file /usr/local/Cellar/freeradius-server/3.0.17/share/freeradius/dictionary.dhcp including dictionary file /usr/local/Cellar/freeradius-server/3.0.17/share/freeradius/dictionary.vqp including dictionary file /usr/local/Cellar/freeradius-server/3.0.17/etc/raddb/dictionary including configuration file /usr/local/Cellar/freeradius-server/3.0.17/etc/raddb/radiusd.conf including configuration file /usr/local/Cellar/freeradius-server/3.0.17/etc/raddb/proxy.conf including configuration file /usr/local/Cellar/freeradius-server/3.0.17/etc/raddb/clients.conf including files in directory /usr/local/Cellar/freeradius-server/3.0.17/etc/raddb/mods-enabled/ including configuration file /usr/local/Cellar/freeradius-server/3.0.17/etc/raddb/mods-enabled/detail.log including configuration file /usr/local/Cellar/freeradius-server/3.0.17/etc/raddb/mods-enabled/eap including configuration file /usr/local/Cellar/freeradius-server/3.0.17/etc/raddb/mods-enabled/echo including configuration file /usr/local/Cellar/freeradius-server/3.0.17/etc/raddb/mods-enabled/utf8 including configuration file /usr/local/Cellar/freeradius-server/3.0.17/etc/raddb/mods-enabled/always including configuration file /usr/local/Cellar/freeradius-server/3.0.17/etc/raddb/mods-enabled/digest including configuration file /usr/local/Cellar/freeradius-server/3.0.17/etc/raddb/mods-enabled/date including configuration file /usr/local/Cellar/freeradius-server/3.0.17/etc/raddb/mods-enabled/preprocess including configuration file /usr/local/Cellar/freeradius-server/3.0.17/etc/raddb/mods-enabled/pap including configuration file /usr/local/Cellar/freeradius-server/3.0.17/etc/raddb/mods-enabled/expr including configuration file /usr/local/Cellar/freeradius-server/3.0.17/etc/raddb/mods-enabled/radutmp including configuration file /usr/local/Cellar/freeradius-server/3.0.17/etc/raddb/mods-enabled/linelog including configuration file /usr/local/Cellar/freeradius-server/3.0.17/etc/raddb/mods-enabled/unix including configuration file /usr/local/Cellar/freeradius-server/3.0.17/etc/raddb/mods-enabled/detail including configuration file /usr/local/Cellar/freeradius-server/3.0.17/etc/raddb/mods-enabled/attr_filter including configuration file /usr/local/Cellar/freeradius-server/3.0.17/etc/raddb/mods-enabled/ntlm_auth including configuration file /usr/local/Cellar/freeradius-server/3.0.17/etc/raddb/mods-enabled/exec including configuration file /usr/local/Cellar/freeradius-server/3.0.17/etc/raddb/mods-enabled/files including configuration file /usr/local/Cellar/freeradius-server/3.0.17/etc/raddb/mods-enabled/replicate including configuration file /usr/local/Cellar/freeradius-server/3.0.17/etc/raddb/mods-enabled/chap including configuration file /usr/local/Cellar/freeradius-server/3.0.17/etc/raddb/mods-enabled/unpack including configuration file /usr/local/Cellar/freeradius-server/3.0.17/etc/raddb/mods-enabled/logintime including configuration file /usr/local/Cellar/freeradius-server/3.0.17/etc/raddb/mods-enabled/expiration including configuration file /usr/local/Cellar/freeradius-server/3.0.17/etc/raddb/mods-enabled/cache_eap including configuration file /usr/local/Cellar/freeradius-server/3.0.17/etc/raddb/mods-enabled/soh including configuration file /usr/local/Cellar/freeradius-server/3.0.17/etc/raddb/mods-enabled/sradutmp including configuration file /usr/local/Cellar/freeradius-server/3.0.17/etc/raddb/mods-enabled/mschap including configuration file /usr/local/Cellar/freeradius-server/3.0.17/etc/raddb/mods-enabled/dynamic_clients including configuration file /usr/local/Cellar/freeradius-server/3.0.17/etc/raddb/mods-enabled/passwd including configuration file /usr/local/Cellar/freeradius-server/3.0.17/etc/raddb/mods-enabled/realm including configuration file /usr/local/Cellar/freeradius-server/3.0.17/etc/raddb/mods-enabled/opendirectory including configuration file /usr/local/Cellar/freeradius-server/3.0.17/etc/raddb/mods-enabled/sql including configuration file /usr/local/Cellar/freeradius-server/3.0.17/etc/raddb/mods-config/sql/main/sqlite/queries.conf including files in directory /usr/local/Cellar/freeradius-server/3.0.17/etc/raddb/policy.d/ including configuration file /usr/local/Cellar/freeradius-server/3.0.17/etc/raddb/policy.d/accounting including configuration file /usr/local/Cellar/freeradius-server/3.0.17/etc/raddb/policy.d/eap including configuration file /usr/local/Cellar/freeradius-server/3.0.17/etc/raddb/policy.d/canonicalization including configuration file /usr/local/Cellar/freeradius-server/3.0.17/etc/raddb/policy.d/abfab-tr including configuration file /usr/local/Cellar/freeradius-server/3.0.17/etc/raddb/policy.d/dhcp including configuration file /usr/local/Cellar/freeradius-server/3.0.17/etc/raddb/policy.d/cui including configuration file /usr/local/Cellar/freeradius-server/3.0.17/etc/raddb/policy.d/filter including configuration file /usr/local/Cellar/freeradius-server/3.0.17/etc/raddb/policy.d/moonshot-targeted-ids including configuration file /usr/local/Cellar/freeradius-server/3.0.17/etc/raddb/policy.d/operator-name including configuration file /usr/local/Cellar/freeradius-server/3.0.17/etc/raddb/policy.d/control including configuration file /usr/local/Cellar/freeradius-server/3.0.17/etc/raddb/policy.d/debug including files in directory /usr/local/Cellar/freeradius-server/3.0.17/etc/raddb/sites-enabled/ including configuration file /usr/local/Cellar/freeradius-server/3.0.17/etc/raddb/sites-enabled/default including configuration file /usr/local/Cellar/freeradius-server/3.0.17/etc/raddb/sites-enabled/inner-tunnel main { security { allow_core_dumps = no } name = "radiusd" prefix = "/usr/local/Cellar/freeradius-server/3.0.17" localstatedir = "/usr/local/var" logdir = "/usr/local/var/log/radius" run_dir = "/usr/local/var/run/radiusd" } main { name = "radiusd" prefix = "/usr/local/Cellar/freeradius-server/3.0.17" localstatedir = "/usr/local/var" sbindir = "/usr/local/Cellar/freeradius-server/3.0.17/bin" logdir = "/usr/local/var/log/radius" run_dir = "/usr/local/var/run/radiusd" libdir = "/usr/local/Cellar/freeradius-server/3.0.17/lib" radacctdir = "/usr/local/var/log/radius/radacct" hostname_lookups = no max_request_time = 30 cleanup_delay = 5 max_requests = 16384 pidfile = "/usr/local/var/run/radiusd/radiusd.pid" checkrad = "/usr/local/Cellar/freeradius-server/3.0.17/bin/checkrad" debug_level = 0 proxy_requests = yes log { stripped_names = no auth = no auth_badpass = no auth_goodpass = no colourise = yes msg_denied = "You are already logged in - access denied" } resources { } security { max_attributes = 200 reject_delay = 1.000000 status_server = yes allow_vulnerable_openssl = "no" } } radiusd: #### Loading Realms and Home Servers #### proxy server { retry_delay = 5 retry_count = 3 default_fallback = no dead_time = 120 wake_all_if_all_dead = no } home_server localhost { ipaddr = 127.0.0.1 port = 1812 type = "auth" secret = <<< secret >>> response_window = 20.000000 response_timeouts = 1 max_outstanding = 65536 zombie_period = 40 status_check = "status-server" ping_interval = 30 check_interval = 30 check_timeout = 4 num_answers_to_alive = 3 revive_interval = 120 limit { max_connections = 16 max_requests = 0 lifetime = 0 idle_timeout = 0 } coa { irt = 2 mrt = 16 mrc = 5 mrd = 30 } } home_server_pool my_auth_failover { type = fail-over home_server = localhost } realm example.com { auth_pool = my_auth_failover } realm LOCAL { } radiusd: #### Loading Clients #### client localhost { ipaddr = 127.0.0.1 require_message_authenticator = no secret = <<< secret >>> nas_type = "other" proto = "*" limit { max_connections = 16 lifetime = 0 idle_timeout = 30 } } client localhost_ipv6 { ipv6addr = ::1 require_message_authenticator = no secret = <<< secret >>> limit { max_connections = 16 lifetime = 0 idle_timeout = 30 } } Debugger not attached # Creating Auth-Type = mschap # Creating Auth-Type = digest # Creating Auth-Type = eap # Creating Auth-Type = PAP # Creating Auth-Type = CHAP # Creating Auth-Type = MS-CHAP # Creating Auth-Type = opendirectory radiusd: #### Instantiating modules #### modules { # Loaded module rlm_detail # Loading module "auth_log" from file /usr/local/Cellar/freeradius-server/3.0.17/etc/raddb/mods-enabled/detail.log detail auth_log { filename = "/usr/local/var/log/radius/radacct/%{%{Packet-Src-IP-Address}:-%{Packet-Src-IPv6-Address}}/auth-detail-%Y%m%d" header = "%t" permissions = 384 locking = no escape_filenames = no log_packet_header = no } # Loading module "reply_log" from file /usr/local/Cellar/freeradius-server/3.0.17/etc/raddb/mods-enabled/detail.log detail reply_log { filename = "/usr/local/var/log/radius/radacct/%{%{Packet-Src-IP-Address}:-%{Packet-Src-IPv6-Address}}/reply-detail-%Y%m%d" header = "%t" permissions = 384 locking = no escape_filenames = no log_packet_header = no } # Loading module "pre_proxy_log" from file /usr/local/Cellar/freeradius-server/3.0.17/etc/raddb/mods-enabled/detail.log detail pre_proxy_log { filename = "/usr/local/var/log/radius/radacct/%{%{Packet-Src-IP-Address}:-%{Packet-Src-IPv6-Address}}/pre-proxy-detail-%Y%m%d" header = "%t" permissions = 384 locking = no escape_filenames = no log_packet_header = no } # Loading module "post_proxy_log" from file /usr/local/Cellar/freeradius-server/3.0.17/etc/raddb/mods-enabled/detail.log detail post_proxy_log { filename = "/usr/local/var/log/radius/radacct/%{%{Packet-Src-IP-Address}:-%{Packet-Src-IPv6-Address}}/post-proxy-detail-%Y%m%d" header = "%t" permissions = 384 locking = no escape_filenames = no log_packet_header = no } # Loaded module rlm_eap # Loading module "eap" from file /usr/local/Cellar/freeradius-server/3.0.17/etc/raddb/mods-enabled/eap eap { default_eap_type = "ttls" timer_expire = 60 ignore_unknown_eap_types = no cisco_accounting_username_bug = no max_sessions = 16384 } # Loaded module rlm_exec # Loading module "echo" from file /usr/local/Cellar/freeradius-server/3.0.17/etc/raddb/mods-enabled/echo exec echo { wait = yes program = "/bin/echo %{User-Name}" input_pairs = "request" output_pairs = "reply" shell_escape = yes } # Loaded module rlm_utf8 # Loading module "utf8" from file /usr/local/Cellar/freeradius-server/3.0.17/etc/raddb/mods-enabled/utf8 # Loaded module rlm_always # Loading module "reject" from file /usr/local/Cellar/freeradius-server/3.0.17/etc/raddb/mods-enabled/always always reject { rcode = "reject" simulcount = 0 mpp = no } # Loading module "fail" from file /usr/local/Cellar/freeradius-server/3.0.17/etc/raddb/mods-enabled/always always fail { rcode = "fail" simulcount = 0 mpp = no } # Loading module "ok" from file /usr/local/Cellar/freeradius-server/3.0.17/etc/raddb/mods-enabled/always always ok { rcode = "ok" simulcount = 0 mpp = no } # Loading module "handled" from file /usr/local/Cellar/freeradius-server/3.0.17/etc/raddb/mods-enabled/always always handled { rcode = "handled" simulcount = 0 mpp = no } # Loading module "invalid" from file /usr/local/Cellar/freeradius-server/3.0.17/etc/raddb/mods-enabled/always always invalid { rcode = "invalid" simulcount = 0 mpp = no } # Loading module "userlock" from file /usr/local/Cellar/freeradius-server/3.0.17/etc/raddb/mods-enabled/always always userlock { rcode = "userlock" simulcount = 0 mpp = no } # Loading module "notfound" from file /usr/local/Cellar/freeradius-server/3.0.17/etc/raddb/mods-enabled/always always notfound { rcode = "notfound" simulcount = 0 mpp = no } # Loading module "noop" from file /usr/local/Cellar/freeradius-server/3.0.17/etc/raddb/mods-enabled/always always noop { rcode = "noop" simulcount = 0 mpp = no } # Loading module "updated" from file /usr/local/Cellar/freeradius-server/3.0.17/etc/raddb/mods-enabled/always always updated { rcode = "updated" simulcount = 0 mpp = no } # Loaded module rlm_digest # Loading module "digest" from file /usr/local/Cellar/freeradius-server/3.0.17/etc/raddb/mods-enabled/digest # Loaded module rlm_date # Loading module "date" from file /usr/local/Cellar/freeradius-server/3.0.17/etc/raddb/mods-enabled/date date { format = "%b %e %Y %H:%M:%S %Z" utc = no } # Loaded module rlm_preprocess # Loading module "preprocess" from file /usr/local/Cellar/freeradius-server/3.0.17/etc/raddb/mods-enabled/preprocess preprocess { huntgroups = "/usr/local/Cellar/freeradius-server/3.0.17/etc/raddb/mods-config/preprocess/huntgroups" hints = "/usr/local/Cellar/freeradius-server/3.0.17/etc/raddb/mods-config/preprocess/hints" with_ascend_hack = no ascend_channels_per_line = 23 with_ntdomain_hack = no with_specialix_jetstream_hack = no with_cisco_vsa_hack = no with_alvarion_vsa_hack = no } # Loaded module rlm_pap # Loading module "pap" from file /usr/local/Cellar/freeradius-server/3.0.17/etc/raddb/mods-enabled/pap pap { normalise = yes } # Loaded module rlm_expr # Loading module "expr" from file /usr/local/Cellar/freeradius-server/3.0.17/etc/raddb/mods-enabled/expr expr { safe_characters = "@abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ0123456789.-_: /äéöüàâæçèéêëîïôœùûüaÿÄÉÖÜßÀÂÆÇÈÉÊËÎÏÔŒÙÛÜŸ" } # Loaded module rlm_radutmp # Loading module "radutmp" from file /usr/local/Cellar/freeradius-server/3.0.17/etc/raddb/mods-enabled/radutmp radutmp { filename = "/usr/local/var/log/radius/radutmp" username = "%{User-Name}" case_sensitive = yes check_with_nas = yes permissions = 384 caller_id = yes } # Loaded module rlm_linelog # Loading module "linelog" from file /usr/local/Cellar/freeradius-server/3.0.17/etc/raddb/mods-enabled/linelog linelog { filename = "/usr/local/var/log/radius/linelog" escape_filenames = no syslog_severity = "info" permissions = 384 format = "This is a log message for %{User-Name}" reference = "messages.%{%{reply:Packet-Type}:-default}" } # Loading module "log_accounting" from file /usr/local/Cellar/freeradius-server/3.0.17/etc/raddb/mods-enabled/linelog linelog log_accounting { filename = "/usr/local/var/log/radius/linelog-accounting" escape_filenames = no syslog_severity = "info" permissions = 384 format = "" reference = "Accounting-Request.%{%{Acct-Status-Type}:-unknown}" } # Loaded module rlm_unix # Loading module "unix" from file /usr/local/Cellar/freeradius-server/3.0.17/etc/raddb/mods-enabled/unix unix { radwtmp = "/usr/local/var/log/radius/radwtmp" } Creating attribute Unix-Group # Loading module "detail" from file /usr/local/Cellar/freeradius-server/3.0.17/etc/raddb/mods-enabled/detail detail { filename = "/usr/local/var/log/radius/radacct/%{%{Packet-Src-IP-Address}:-%{Packet-Src-IPv6-Address}}/detail-%Y%m%d" header = "%t" permissions = 384 locking = no escape_filenames = no log_packet_header = no } # Loaded module rlm_attr_filter # Loading module "attr_filter.post-proxy" from file /usr/local/Cellar/freeradius-server/3.0.17/etc/raddb/mods-enabled/attr_filter attr_filter attr_filter.post-proxy { filename = "/usr/local/Cellar/freeradius-server/3.0.17/etc/raddb/mods-config/attr_filter/post-proxy" key = "%{Realm}" relaxed = no } # Loading module "attr_filter.pre-proxy" from file /usr/local/Cellar/freeradius-server/3.0.17/etc/raddb/mods-enabled/attr_filter attr_filter attr_filter.pre-proxy { filename = "/usr/local/Cellar/freeradius-server/3.0.17/etc/raddb/mods-config/attr_filter/pre-proxy" key = "%{Realm}" relaxed = no } # Loading module "attr_filter.access_reject" from file /usr/local/Cellar/freeradius-server/3.0.17/etc/raddb/mods-enabled/attr_filter attr_filter attr_filter.access_reject { filename = "/usr/local/Cellar/freeradius-server/3.0.17/etc/raddb/mods-config/attr_filter/access_reject" key = "%{User-Name}" relaxed = no } # Loading module "attr_filter.access_challenge" from file /usr/local/Cellar/freeradius-server/3.0.17/etc/raddb/mods-enabled/attr_filter attr_filter attr_filter.access_challenge { filename = "/usr/local/Cellar/freeradius-server/3.0.17/etc/raddb/mods-config/attr_filter/access_challenge" key = "%{User-Name}" relaxed = no } # Loading module "attr_filter.accounting_response" from file /usr/local/Cellar/freeradius-server/3.0.17/etc/raddb/mods-enabled/attr_filter attr_filter attr_filter.accounting_response { filename = "/usr/local/Cellar/freeradius-server/3.0.17/etc/raddb/mods-config/attr_filter/accounting_response" key = "%{User-Name}" relaxed = no } # Loading module "ntlm_auth" from file /usr/local/Cellar/freeradius-server/3.0.17/etc/raddb/mods-enabled/ntlm_auth exec ntlm_auth { wait = yes program = "/path/to/ntlm_auth --request-nt-key --domain=MYDOMAIN --username=%{mschap:User-Name} --password=%{User-Password}" shell_escape = yes } # Loading module "exec" from file /usr/local/Cellar/freeradius-server/3.0.17/etc/raddb/mods-enabled/exec exec { wait = no input_pairs = "request" shell_escape = yes timeout = 10 } # Loaded module rlm_files # Loading module "files" from file /usr/local/Cellar/freeradius-server/3.0.17/etc/raddb/mods-enabled/files files { filename = "/usr/local/Cellar/freeradius-server/3.0.17/etc/raddb/mods-config/files/authorize" acctusersfile = "/usr/local/Cellar/freeradius-server/3.0.17/etc/raddb/mods-config/files/accounting" preproxy_usersfile = "/usr/local/Cellar/freeradius-server/3.0.17/etc/raddb/mods-config/files/pre-proxy" } # Loaded module rlm_replicate # Loading module "replicate" from file /usr/local/Cellar/freeradius-server/3.0.17/etc/raddb/mods-enabled/replicate # Loaded module rlm_chap # Loading module "chap" from file /usr/local/Cellar/freeradius-server/3.0.17/etc/raddb/mods-enabled/chap # Loaded module rlm_unpack # Loading module "unpack" from file /usr/local/Cellar/freeradius-server/3.0.17/etc/raddb/mods-enabled/unpack # Loaded module rlm_logintime # Loading module "logintime" from file /usr/local/Cellar/freeradius-server/3.0.17/etc/raddb/mods-enabled/logintime logintime { minimum_timeout = 60 } # Loaded module rlm_expiration # Loading module "expiration" from file /usr/local/Cellar/freeradius-server/3.0.17/etc/raddb/mods-enabled/expiration # Loaded module rlm_cache # Loading module "cache_eap" from file /usr/local/Cellar/freeradius-server/3.0.17/etc/raddb/mods-enabled/cache_eap cache cache_eap { driver = "rlm_cache_rbtree" key = "%{%{control:State}:-%{%{reply:State}:-%{State}}}" ttl = 15 max_entries = 0 epoch = 0 add_stats = no } # Loaded module rlm_soh # Loading module "soh" from file /usr/local/Cellar/freeradius-server/3.0.17/etc/raddb/mods-enabled/soh soh { dhcp = yes } # Loading module "sradutmp" from file /usr/local/Cellar/freeradius-server/3.0.17/etc/raddb/mods-enabled/sradutmp radutmp sradutmp { filename = "/usr/local/var/log/radius/sradutmp" username = "%{User-Name}" case_sensitive = yes check_with_nas = yes permissions = 420 caller_id = no } # Loaded module rlm_mschap # Loading module "mschap" from file /usr/local/Cellar/freeradius-server/3.0.17/etc/raddb/mods-enabled/mschap mschap { use_mppe = yes require_encryption = no require_strong = no with_ntdomain_hack = yes passchange { } allow_retry = yes winbind_retry_with_normalised_username = no use_open_directory = yes } # Loaded module rlm_dynamic_clients # Loading module "dynamic_clients" from file /usr/local/Cellar/freeradius-server/3.0.17/etc/raddb/mods-enabled/dynamic_clients # Loaded module rlm_passwd # Loading module "etc_passwd" from file /usr/local/Cellar/freeradius-server/3.0.17/etc/raddb/mods-enabled/passwd passwd etc_passwd { filename = "/etc/passwd" format = "*User-Name:Crypt-Password:" delimiter = ":" ignore_nislike = no ignore_empty = yes allow_multiple_keys = no hash_size = 100 } # Loaded module rlm_realm # Loading module "IPASS" from file /usr/local/Cellar/freeradius-server/3.0.17/etc/raddb/mods-enabled/realm realm IPASS { format = "prefix" delimiter = "/" ignore_default = no ignore_null = no } # Loading module "suffix" from file /usr/local/Cellar/freeradius-server/3.0.17/etc/raddb/mods-enabled/realm realm suffix { format = "suffix" delimiter = "@" ignore_default = no ignore_null = no } # Loading module "realmpercent" from file /usr/local/Cellar/freeradius-server/3.0.17/etc/raddb/mods-enabled/realm realm realmpercent { format = "suffix" delimiter = "%" ignore_default = no ignore_null = no } # Loading module "ntdomain" from file /usr/local/Cellar/freeradius-server/3.0.17/etc/raddb/mods-enabled/realm realm ntdomain { format = "prefix" delimiter = "\\" ignore_default = no ignore_null = no } /usr/local/Cellar/freeradius-server/3.0.17/etc/raddb/mods-enabled/opendirectory[20]: Failed to link to module 'rlm_opendirectory': dlopen(/usr/local/Cellar/freeradius-server/3.0.17/lib/rlm_opendirectory.dylib, 6): image not found [certificates]$ Thank you all in advance, Stephan

1 0

Framed-Pool
by One Zero Art 09 Feb '19

09 Feb '19

Hi, I am new in freeradius so need some help to understand Framed-Pool attribute reply. I am using a Mysql database. For AAA. I want my user to get an IP pool. Now where I will add this attribute in "radreply" or in "radgroupreply". I have a few groups like 1M, 2M etc. Thank you

2 2

About FreeRADIUS configuration file
by 水上ナツ 08 Feb '19

08 Feb '19

I first touched FreeRADIUS. I have a question about the setting file. · What is the role of sites-enabled/default? When will it be used? · There are many files in mods-enabled, but can I delete unnecessary files? Is there no problem even if it does not delete? I am waiting for reply. Thank you.

2 3

Trouble Getting Mac-Auth to Work
by Seth Turner 07 Feb '19

07 Feb '19

I'm new to FreeRadius, but have managed to get LDAP authentication working properly. Now I am trying to add in mac-auth as well for certain devices, but all devices are being rejected when they connect to the SSID regardless if the MAC is in the file. Based on what I am seeing, the calling-station-Id is being rewritten to the proper format, which matches what I have in the mac file, but RADIUS still rejects the connection. Can somebody help direct me as to what the issue may be? *NOTE: The end goal is actually to block certain MAC's from connecting to an SSID, which is why the file is called blocked_macs instead of authorized_mac like the documentation. I'm just trying to follow the guide for mac_auth atm before I try using it to restrict by MAC.* This is what I have under the Authorize section of default.conf. * preprocess* * # If cleaning up the Calling-Station-Id...* * rewrite_calling_station_id* * # Now check against the blocked_macs file* * blocked_macs* * if (!ok) {* * # No match was found, so reject* * reject* * }* * else {* * # The MAC address was found, so update Auth-Type* * # to accept this auth.* * update control {* * Auth-Type := Accept* * }* * }* This is what I get while running radiusd -X. Hopefully that is the proper logging needed for troubleshooting. *(0) [preprocess] = ok* *(0) policy rewrite_calling_station_id {* *(0) if (&Calling-Station-Id && (&Calling-Station-Id =~ /^([0-9a-f]{2})[^0-9a-f]?([0-9a-f]{2})[^0-9a-f]?([0-9a-f]{2})[^0-9a-f]?([0-9a-f]{2})[^0-9a-f]?([0-9a-f]{2})[^0-9a-f]?([0-9a-f]{2})$/i)) {* *(0) if (&Calling-Station-Id && (&Calling-Station-Id =~ /^([0-9a-f]{2})[^0-9a-f]?([0-9a-f]{2})[^0-9a-f]?([0-9a-f]{2})[^0-9a-f]?([0-9a-f]{2})[^0-9a-f]?([0-9a-f]{2})[^0-9a-f]?([0-9a-f]{2})$/i)) -> TRUE* *(0) if (&Calling-Station-Id && (&Calling-Station-Id =~ /^([0-9a-f]{2})[^0-9a-f]?([0-9a-f]{2})[^0-9a-f]?([0-9a-f]{2})[^0-9a-f]?([0-9a-f]{2})[^0-9a-f]?([0-9a-f]{2})[^0-9a-f]?([0-9a-f]{2})$/i)) {* *(0) update request {* *(0) EXPAND %{toupper:%{1}-%{2}-%{3}-%{4}-%{5}-%{6}}* *(0) --> 60-D8-19-D4-F0-83* *(0) &Calling-Station-Id := 60-D8-19-D4-F0-83* *(0) } # update request = noop* *(0) [updated] = updated* *(0) } # if (&Calling-Station-Id && (&Calling-Station-Id =~ /^([0-9a-f]{2})[^0-9a-f]?([0-9a-f]{2})[^0-9a-f]?([0-9a-f]{2})[^0-9a-f]?([0-9a-f]{2})[^0-9a-f]?([0-9a-f]{2})[^0-9a-f]?([0-9a-f]{2})$/i)) = updated* *(0) ... skipping else: Preceding "if" was taken* *(0) } # policy rewrite_calling_station_id = updated* *(0) blocked_macs: EXPAND %{Calling-Station-ID}* *(0) blocked_macs: --> 60-D8-19-D4-F0-83* *(0) [blocked_macs] = noop* *(0) if (!ok) {* *(0) if (!ok) -> TRUE* *(0) if (!ok) {* *(0) [reject] = reject* *(0) } # if (!ok) = reject* *(0) } # authorize = reject* *(0) Using Post-Auth-Type Reject* -- *Seth Turner*Gasconade County R-2 School District Network Manager OHS Hunting and Fishing Club Sponsor Phone (573)-437-2172

2 2

Proxy-tester nagios check for Freeradius
by Fekete Tamás 06 Feb '19

06 Feb '19

Hello! I would like to make a proxy-tester Nagios check for Freeradius and would like to ask some help for debugging as I experience some problem with using eapol_test. The design is that a user wants to authenticate at realm "A" with credentials stored at realm "B". The infrastructure already set up for proxying based on the realm names and the Access-Requests are do forwarded. I tried this proxy scenario with radtest. And with radtest it works. However, I have some questions regarding this developer work. Maybe you can help me. The first is: is it true, that radtest doesn't encrypt it's messages so proxy requests will contain the password in a recoverable manner? - Tamas Fekete

2 2

Improve IO wait
by Sajad Tahernejad 06 Feb '19

06 Feb '19

Hi all, I'm installed freeradius on vps with this details 2 Core CPU - 4G RAM - HDD 100G 10k I see iowaot always +25% I see disk IO is +3MB/s with mysql I have about 200 users online. How can improve performance for iowait. Thanks. Regards

2 3

Meaning of zero queue size in a Freeradius prod environment
by Fekete Tamás 05 Feb '19

05 Feb '19

Hello! I would like to develop a Nagios check for Freeradius which periodically checks the queue. My idea it to use radclient with statistics type 16 (or similar) and grep out the useful informations. I queried our prod server which handles about 3000-5000 requests in a minute and got a result that the queue is zero: [root@radius1 sites-enabled]# echo "Message-Authenticator = 0x00, FreeRADIUS-Statistics-Type = 16, Response-Packet-Type = Access-Accept" | radclient -x localhost:18121 status <somethingpass> Sent Status-Server Id 230 from 0.0.0.0:37413 to 127.0.0.1:18121 length 50 Message-Authenticator = 0x00 FreeRADIUS-Statistics-Type = Internal Response-Packet-Type = Access-Accept Received Access-Accept Id 230 from 127.0.0.1:18121 to 0.0.0.0:0 length 128 FreeRADIUS-Stats-Start-Time = "Feb 4 2019 08:33:06 CET" FreeRADIUS-Stats-HUP-Time = "Feb 4 2019 08:33:06 CET" FreeRADIUS-Queue-Len-Internal = 0 FreeRADIUS-Queue-Len-Proxy = 0 FreeRADIUS-Queue-Len-Auth = 0 FreeRADIUS-Queue-Len-Acct = 0 FreeRADIUS-Queue-Len-Detail = 0 FreeRADIUS-Queue-PPS-In = 0 FreeRADIUS-Queue-PPS-Out = 0 I am asking just for the sure understanding. Does Freeradius show me zero values regardless of the load because the operation of the program is so quick and all the requests are handled less than a second so it is hard to catch a queue value different than 0? - Tamas Fekete

2 2

New member of FreeRADIUS
by Alan DeKok 04 Feb '19

04 Feb '19

This is a short message announcing that we (Network RADIUS) have hired Jorge Pereira as a full-time person working on FreeRADIUS. He has contributed to FreeRADIUS in the past, and we're looking forward to more contributions from him in the future. He will largely be working on updating the documentation for version 4. And also miscellaneous bug fixes, features, etc. as needed. Alan DeKok.

1 0

How to Authorize group from AD
by Maicon Luis 04 Feb '19

04 Feb '19

Hello people, I’m newcomer here as well as on freeradius. I have a environment with Radius integrated with Active directory so I can login on Cisco’s Switches with AD account. All it’s working but I should like give privilege 15 for users that login. I have done the follow lines on “user” file user1 Service-Type = NAS-Prompt-User, Cisco-AVPair = "shell:priv-lvl=15", Fall-Through = Yes When user1 do login on cisco switch he need type “enable” more local password for enable instead your password from Active Directory I should like when user “user1” login on Cisco Switch and type enable he earn privileges 15 directly without any password or your password from AD instead local enable password. What I have to do for reach this ? I’m using freeradius 3.0 Thanks.

4 3