- Freeradius-Users - lists.freeradius.org

Improve IO wait
by Sajad Tahernejad 06 Feb '19

06 Feb '19

Hi all, I'm installed freeradius on vps with this details 2 Core CPU - 4G RAM - HDD 100G 10k I see iowaot always +25% I see disk IO is +3MB/s with mysql I have about 200 users online. How can improve performance for iowait. Thanks. Regards

2 3

Meaning of zero queue size in a Freeradius prod environment
by Fekete Tamás 05 Feb '19

05 Feb '19

Hello! I would like to develop a Nagios check for Freeradius which periodically checks the queue. My idea it to use radclient with statistics type 16 (or similar) and grep out the useful informations. I queried our prod server which handles about 3000-5000 requests in a minute and got a result that the queue is zero: [root@radius1 sites-enabled]# echo "Message-Authenticator = 0x00, FreeRADIUS-Statistics-Type = 16, Response-Packet-Type = Access-Accept" | radclient -x localhost:18121 status <somethingpass> Sent Status-Server Id 230 from 0.0.0.0:37413 to 127.0.0.1:18121 length 50 Message-Authenticator = 0x00 FreeRADIUS-Statistics-Type = Internal Response-Packet-Type = Access-Accept Received Access-Accept Id 230 from 127.0.0.1:18121 to 0.0.0.0:0 length 128 FreeRADIUS-Stats-Start-Time = "Feb 4 2019 08:33:06 CET" FreeRADIUS-Stats-HUP-Time = "Feb 4 2019 08:33:06 CET" FreeRADIUS-Queue-Len-Internal = 0 FreeRADIUS-Queue-Len-Proxy = 0 FreeRADIUS-Queue-Len-Auth = 0 FreeRADIUS-Queue-Len-Acct = 0 FreeRADIUS-Queue-Len-Detail = 0 FreeRADIUS-Queue-PPS-In = 0 FreeRADIUS-Queue-PPS-Out = 0 I am asking just for the sure understanding. Does Freeradius show me zero values regardless of the load because the operation of the program is so quick and all the requests are handled less than a second so it is hard to catch a queue value different than 0? - Tamas Fekete

2 2

New member of FreeRADIUS
by Alan DeKok 04 Feb '19

04 Feb '19

This is a short message announcing that we (Network RADIUS) have hired Jorge Pereira as a full-time person working on FreeRADIUS. He has contributed to FreeRADIUS in the past, and we're looking forward to more contributions from him in the future. He will largely be working on updating the documentation for version 4. And also miscellaneous bug fixes, features, etc. as needed. Alan DeKok.

1 0

How to Authorize group from AD
by Maicon Luis 04 Feb '19

04 Feb '19

Hello people, I’m newcomer here as well as on freeradius. I have a environment with Radius integrated with Active directory so I can login on Cisco’s Switches with AD account. All it’s working but I should like give privilege 15 for users that login. I have done the follow lines on “user” file user1 Service-Type = NAS-Prompt-User, Cisco-AVPair = "shell:priv-lvl=15", Fall-Through = Yes When user1 do login on cisco switch he need type “enable” more local password for enable instead your password from Active Directory I should like when user “user1” login on Cisco Switch and type enable he earn privileges 15 directly without any password or your password from AD instead local enable password. What I have to do for reach this ? I’m using freeradius 3.0 Thanks.

4 3

Re: Problem with MSCHAP when migrating from freeradius2 to freeradius3
by koehne 04 Feb '19

04 Feb '19

Hi Alan, thanks for your quick response. > Which should be clear. The server is unable to get the Cleartext-Password from LDAP. As such, it can't do MS-CHAP. >> Do you mean, I shall get back the password from LDAP in Cleartext form?? Our eDir sends it in a hashed form. It works so with freeradius2 for years. > Read what you've done to the "inner-tunnel" virtual server, >> I´ve gone through this module several times in the last weeks and have no further idea ... and ask yourself: "Where is Cleartext-Password supposed to be coming from?" >> this is exactly what I´m asking myself ... with no clear answer and idea what to change. Sorry, I´m no Server-, Freeradius- or Linux-Expert. Normally I´m working with Network-Devices, but now trying to migrate a very old freeradius installation, because there´s no other person in our office able to do this. Thanks for your patience. Regards Ronald

1 0

Problem with MSCHAP when migrating from freeradius2 to freeradius3
by koehne 04 Feb '19

04 Feb '19

Hello, I´ve now spent so much time on troubleshooting, testing and searching for hints in the internet, I hope someone here from this mailing-list can support me. We are using freeradius to authenticate CLI-Access to Network-Devices, VPN-Access and WLAN-Access. As User-Database we are using Novell eDirectory via LDAP. I want to migrate from freeradius2 to freeradius3 on a new server. I´ve allready succeeded with migrating Network-CLI- and VPN-Access, however WLAN-Access is not working. These are the significant messages from the DEBUG saying "*mschap: No Cleartext-Password configured*". ... Executing group from file /etc/raddb/sites-enabled/inner-tunnel Fri Feb 1 10:18:31 2019 : Debug: (8) eap_mschapv2: authenticate { Fri Feb 1 10:18:31 2019 : Debug: (8) eap_mschapv2: modsingle[authenticate]: calling mschap (rlm_mschap) *Fri Feb 1 10:18:31 2019 : WARNING: (8) mschap: No Cleartext-Password configured. Cannot create NT-Password Fri Feb 1 10:18:31 2019 : WARNING: (8) mschap: No Cleartext-Password configured. Cannot create LM-Password* Fri Feb 1 10:18:31 2019 : Debug: (8) mschap: Creating challenge hash with username: koehne Fri Feb 1 10:18:31 2019 : Debug: (8) mschap: Client is using MS-CHAPv2 Fri Feb 1 10:18:31 2019 : ERROR: (8) mschap: FAILED: No NT/LM-Password. Cannot perform authentication ... Enclosed is a full debug. I´ve compared "old" and "new" configuration of the relevant modules several times and adapted the necessary changes in the configuration from freeradius2 to freeradius3. Here are the configs of the virtual-server and the ldap module: server mdwwlan { listen { .... } } authorize { filter_username preprocess auth_log detail suffix files -ldap eap { ok = return } Autz-Type LDAP { mdwacc_wlan mschap update { &MS-CHAP-User-Name := "%{mschap:User-Name}" } } } authenticate { Auth-Type MSCHAP { mschap } eap } } ldap mdwacc_wlan { server = "ldap.mdw.ac.at" port = 636 identity = "cn=ldap_radius,o=MDWds" password = frtz56uit33 basedn = "o=MDWds" access_attr = "mdwaccAllowwlan" filter = "(cn=%{%{Stripped-User-Name}:-%{User-Name}})" update { control:NT-Password := 'mdwaccPwwlan' } edir_autz = yes user { basedn = "o=MDWds" filter = "(cn=%{%{Stripped-User-Name}:-%{User-Name}})" scope = 'sub' access_attr = 'mdwaccAllowwlan' } group { basedn = "o=MDWds" filter = "(cn=%{%{Stripped-User-Name}:-%{User-Name}})" scope = 'sub' membership_attribute = 'radiusGroupName' } options { timeout = 4 srv_timelimit = 3 net_timeout = 1 } tls { start_tls = no } pool { start = ${thread[pool].start_servers} min = ${thread[pool].min_spare_servers} max = ${thread[pool].max_servers} uses = 0 lifetime = 0 } } And the "users" File: DEFAULT Huntgroup-Name == WISM, Autz-Type := LDAP Fall-Through = yes Do you have any hints for me, what could be missing or wrong in my configuration of version 3? Thank You!! Best Regards Ronald

2 1

FR3 odd log indentation
by Diggins Mike 02 Feb '19

02 Feb '19

Just started logging wireless authentications to my FR3 server today and noticed a couple changes from FR2. Two questions, what does the value in the brackets () represent and what's with the odd indentation on the Login OK lines. This is the way it appears in my syslog. Feb 1 09:22:41 frsrv3 radiusd[14322]: (10) Login OK: [nettest] (from client IPSentry port 0) Feb 1 09:25:59 frsrv3 radiusd[14322]: (42) Login OK: [user1] (from client WLC-TEST port 0 via TLS tunnel) Feb 1 09:25:59 frsrv3 radiusd[14322]: (43) Login OK: [user1] (from client WLC-TEST port 13 cli 94-65-2d-6c-94-82) Feb 1 09:26:19 frsrv3 radiusd[14322]: (57) Login OK: [user2] (from client WLC-TEST port 0 via TLS tunnel) Feb 1 09:26:19 frsrv3 radiusd[14322]: (58) Login OK: [user2] (from client WLC-TEST port 13 cli 58-e6-ba-45-66-c7) Feb 1 09:26:21 frsrv3 radiusd[14322]: (72) Login OK: [user3] (from client WLC-TEST port 0 via TLS tunnel) Feb 1 09:26:21 frsrv3 radiusd[14322]: (73) Login OK: [user3] (from client WLC-TEST port 13 cli b8-d7-af-05-d3-5d) Feb 1 09:26:24 frsrv3 radiusd[14322]: (87) Login OK: [user4] (from client WLC-TEST port 0 via TLS tunnel) Feb 1 09:26:24 frsrv3 radiusd[14322]: (88) Login OK: [user4] (from client WLC-TEST port 13 cli 58-e6-ba-45-66-c7) Feb 1 09:26:34 frsrv3 radiusd[14322]: (102) Login OK: [user4] (from client WLC-TEST port 0 via TLS tunnel) Feb 1 09:26:34 frsrv3 radiusd[14322]: (103) Login OK: [user4] (from client WLC-TEST port 13 cli 58-e6-ba-45-66-c7) Feb 1 09:27:23 frsrv3 radiusd[14322]: (117) Login OK: [user5] (from client WLC-TEST port 0 via TLS tunnel) Feb 1 09:27:23 frsrv3 radiusd[14322]: (118) Login OK: [user5] (from client WLC-TEST port 13 cli a4-5e-60-d5-01-d5) Feb 1 09:27:42 frsrv3 radiusd[14322]: (132) Login OK: [user6] (from client WLC-TEST port 0 via TLS tunnel) Feb 1 09:27:42 frsrv3 radiusd[14322]: (133) Login OK: [user6] (from client WLC-TEST port 13 cli 20-2d-07-03-01-34) -Mike

3 3

Historic connection error
by Leonardo Piña 01 Feb '19

01 Feb '19

I have migrated from FreeRadius 2 to FreeRadius 3, and I found the novelty that when carrying the production DB of version 2 does not work correctly in version 3, the amount in FreeRadius 3 stops saving the connection information

2 1

radius accounting issue.
by slnarayanan＠nitt.edu 31 Jan '19

31 Jan '19

Dear All, I have a problem with accounting .Everything is working fine on freeradius.Login& authentication sql everything is working fine.But i have a problem in accounting pocket.We are using sonciwall firwall in our campus.Those who logged through our radius server the login information (Radius Accounting) information need to display on sonicwall user's page.The UDP pocket 1813 not send to our firewall ip.In the firewall i have enable policy allow to all our local network.I have attached my radiususd -X log to this mail.Kindly provide the solution for resolve my issue.The Radius Accounting information now shows on radacct in the phpmyadmin. Regards. S.Lakshmi narayanan

4 10

Outer vs. inner ID in Login OK messages
by Martin Pauly 31 Jan '19

31 Jan '19

Hi, I have a question about the "Login OK" messages in radius.log. We offer both PEAP/MS-CHAPv2 and EAP-TTLS/PAP to our clients Server is FR 3.0.17 on Debian. Upon succesful authentication, the outer and inner virtual server each append a Login OK message to radius.log - so far, so good. Assume the outer id is set to eduroam(a)staff.uni-marburg.de. With PEAP, I get Wed Jan 23 15:43:45 2019 : Auth: (4903823) Login OK: [pauly1] (from client wlc3 port 13 cli 20:64:32:00:00:01 via TLS tunnel) Wed Jan 23 15:43:45 2019 : Auth: (4903824) Login OK: [eduroam(a)staff.uni-marburg.de] (from client wlc3 port 13 cli 20:64:32:00:00:01) With EAP-TTLS/PAP, I get Wed Jan 23 15:42:52 2019 : Auth: (4902040) Login OK: [pauly1] (from client rst2 port 13 cli 20:64:32:00:00:01 via TLS tunnel) Wed Jan 23 15:42:52 2019 : Auth: (4902040) Login OK: [pauly1] (from client rst2 port 13 cli 20:64:32:00:00:01) So it would seem that in the latter case the outer server still logs the inner id. Is this normal default behavior? Logging the outer id consistently would be really helpful in our case as we use it to trigger a different certificate to be presented to the client. In the post-auth sections of the virtual servers I have: ----------------- sites-available/default -------------- post-auth { ... update { &reply: += &session-state: } ---------------------------------------------------------- -------------- sites-available/inner-tunnel -------------- post-auth { ... update { &outer.session-state: += &reply: &outer.request:User-Name := &User-Name } ---------------------------------------------------------- The debug log does not tell me much in either case, here are the respective post-auth snippets (can provide full if needed): PEAP/MS-CHAPv2: (18) # Executing section post-auth from file /etc/freeradius/sites-enabled/inner-tunnel (18) post-auth { (18) update { (18) &outer.session-state::Airespace-Interface-Name += &reply:Airespace-Interface-Name[*] -> 'edu_staff_nat' (18) &outer.session-state::Tunnel-Medium-Type += &reply:Tunnel-Medium-Type[*] -> 802 (18) &outer.session-state::MS-MPPE-Encryption-Policy += &reply:MS-MPPE-Encryption-Policy[*] -> Encryption-Allowed (18) &outer.session-state::MS-MPPE-Encryption-Types += &reply:MS-MPPE-Encryption-Types[*] -> RC4-40or128-bit-Allowed (18) &outer.session-state::MS-MPPE-Send-Key += &reply:MS-MPPE-Send-Key[*] -> 0xb7ea5ac23b2680523f909d667460c17d (18) &outer.session-state::MS-MPPE-Recv-Key += &reply:MS-MPPE-Recv-Key[*] -> 0x2c8284d442c7f3d635501c3df519b1ec (18) &outer.session-state::EAP-Message += &reply:EAP-Message[*] -> 0x030e0004 (18) &outer.session-state::Message-Authenticator += &reply:Message-Authenticator[*] -> 0x00000000000000000000000000000000 (18) &outer.session-state::User-Name += &reply:User-Name[*] -> 'pauly1(a)staff.uni-marburg.de' (18) &outer.request:User-Name := &User-Name -> 'pauly1(a)staff.uni-marburg.de' (18) } # update = noop (18) update outer.session-state { (18) MS-MPPE-Encryption-Policy !* ANY (18) MS-MPPE-Encryption-Types !* ANY (18) MS-MPPE-Send-Key !* ANY (18) MS-MPPE-Recv-Key !* ANY (18) Message-Authenticator !* ANY (18) EAP-Message !* ANY (18) Proxy-State !* ANY (18) } # update outer.session-state = noop (18) } # post-auth = noop (18) Login OK: [pauly1(a)staff.uni-marburg.de] (from client rst2 port 13 cli 4c:34:88:e0:aa:42 via TLS tunnel) (18) } # server inner-tunnel (19) # Executing section post-auth from file /etc/freeradius/sites-enabled/default (19) post-auth { (19) update { (19) &reply::Airespace-Interface-Name += &session-state:Airespace-Interface-Name[*] -> 'edu_staff_nat' (19) &reply::Tunnel-Medium-Type += &session-state:Tunnel-Medium-Type[*] -> 802 (19) &reply::User-Name += &session-state:User-Name[*] -> 'pauly1(a)staff.uni-marburg.de' (19) } # update = noop (19) [exec] = noop (19) policy remove_reply_message_if_eap { (19) if (&reply:EAP-Message && &reply:Reply-Message) { (19) if (&reply:EAP-Message && &reply:Reply-Message) -> FALSE (19) else { (19) [noop] = noop (19) } # else = noop (19) } # policy remove_reply_message_if_eap = noop (19) } # post-auth = noop (19) Login OK: [eduroam(a)staff.uni-marburg.de] (from client rst2 port 13 cli 4c:34:88:e0:aa:42) EAP-TTLS/PAP: (231) # Executing section post-auth from file /etc/freeradius/sites-enabled/inner-tunnel (231) post-auth { (231) update { (231) &outer.session-state::Airespace-Interface-Name += &reply:Airespace-Interface-Name[*] -> 'edu_staff_nat' (231) &outer.session-state::Tunnel-Medium-Type += &reply:Tunnel-Medium-Type[*] -> 802 (231) &outer.request:User-Name := &User-Name -> 'pauly1' (231) } # update = noop (231) update outer.session-state { (231) MS-MPPE-Encryption-Policy !* ANY (231) MS-MPPE-Encryption-Types !* ANY (231) MS-MPPE-Send-Key !* ANY (231) MS-MPPE-Recv-Key !* ANY (231) Message-Authenticator !* ANY (231) EAP-Message !* ANY (231) Proxy-State !* ANY (231) } # update outer.session-state = noop (231) } # post-auth = noop (231) Login OK: [pauly1] (from client rst2 port 13 cli 20:64:32:3f:80:ef via TLS tunnel) (231) } # server inner-tunnel (231) # Executing section post-auth from file /etc/freeradius/sites-enabled/default (231) post-auth { (231) update { (231) &reply::Airespace-Interface-Name += &session-state:Airespace-Interface-Name[*] -> 'edu_staff_nat' (231) &reply::Tunnel-Medium-Type += &session-state:Tunnel-Medium-Type[*] -> 802 (231) } # update = noop (231) [exec] = noop (231) policy remove_reply_message_if_eap { (231) if (&reply:EAP-Message && &reply:Reply-Message) { (231) if (&reply:EAP-Message && &reply:Reply-Message) -> FALSE (231) else { (231) [noop] = noop (231) } # else = noop (231) } # policy remove_reply_message_if_eap = noop (231) } # post-auth = noop (231) Login OK: [pauly1] (from client rst2 port 13 cli 20:64:32:3f:80:ef) Any ideas? TIA, Martin -- Dr. Martin Pauly Phone: +49-6421-28-23527 HRZ Univ. Marburg Fax: +49-6421-28-26994 Hans-Meerwein-Str. E-Mail: pauly(a)HRZ.Uni-Marburg.DE D-35032 Marburg

2 6