- Freeradius-Users - lists.freeradius.org

dhcp server and logging
by BASSAGET Cédric 25 Oct '18

25 Oct '18

Hello. I don't understand what is missing in my config to make freeradius (3.0.12) logging what is doing about DHCP queries / replies. I'm using module dhcp_sqlippool, which set things like : sqlippool_log_exists = "DHCP: Existing IP: %{reply:Framed-IP-Address} (did %{Called-Station-Id} cli %{Calling-Station-Id} port %{NAS-Port} user %{User-Name})" sqlippool_log_success = "DHCP: Allocated IP: %{reply:Framed-IP-Address} from %{control:Pool-Name} (did %{Called-Station-Id} cli %{Calling-Station-Id} port %{NAS-Port} user %{User-Name})" sqlippool_log_clear = "DHCP: Released IP %{Framed-IP-Address} (did %{Called-Station-Id} cli %{Calling-Station-Id} user %{User-Name})" sqlippool_log_failed = "DHCP: IP Allocation FAILED from %{control:Pool-Name} (did %{Called-Station-Id} cli %{Calling-Station-Id} port %{NAS-Port} user %{User-Name})" sqlippool_log_nopool = "DHCP: No Pool-Name defined (did %{Called-Station-Id} cli %{Calling-Station-Id} port %{NAS-Port} user %{User-Name})" But nothing is logged. And I can not find the good doc to learn how linelog works.I found this thread : http://freeradius.1045715.n5.nabble.com/DHCP-in-FreeRadius-3-and-logging-td… But It did not help me. I'm missing something... Can somebody help me / point me in the right direction ? Regards.

3 4

Accounting-Request Re write Rule
by Maile Halatuituia 25 Oct '18

25 Oct '18

Hi I need to rewrite this attribute Cisco-AVPair = "acct-input-octets-ipv6=xxx" upon receiving it in the accounting request from my BRAS to my Radius Server so I can further process. I received this Cisco-AVPair = "acct-input-octets-ipv6=xxx" I have done this on the Radius Server /etc/freeradius/sites-available/default if( &Cisco-AVPair[*]=~/\(acct-input-octets-ipv6\)=\(\d+)/ ) { update request { &acct-input-octets-ipv6 := "%{2}" } } But I have this on my debug if ( &Cisco-AVPair[*]=~/\(acct-input-octets-ipv6\)=\(\d+)/ ) { (0) if ( &Cisco-AVPair[*]=~/\(acct-input-octets-ipv6\)=\(\d+)/ ) -> FALSE Not sure if I can read it correctly but seem the rule does not matched .. Appreciate anyone comments if didn't do it correctly Confidentiality Notice: This email (including any attachment) is intended for internal use only. Any unauthorized use, dissemination or copying of the content is prohibited. If you are not the intended recipient and have received this e-mail in error, please notify the sender by email and delete this email and any attachment.

2 2

Optimize the authentication time
by Tom Yard 24 Oct '18

24 Oct '18

Hi people, we have a Freeradius with AD authentication and SQL authorization. I could notice that several Windows 10 clients spend severalk seconds in authorization and authentication. Is there any way to optimize the time of authentication/authorization? Thanking in advance, Tommy

2 1

Several Access Requests after a succesfully authentication
by Tom Yard 24 Oct '18

24 Oct '18

Dear people, I have a Freeradius server that authenticate users against an AD in order to access the WiFi network: Once a user authenticates OK and access the WiFi network, in the debug log of Freeradius I notice that this user has several access requests at the same time he is using the WiFi correctly. The access request frames are as the shown below: rad_recv: Access-Request packet from host 192.168.10.1 port 32768, id=103, length=432 User-Name = "jsmith" Chargeable-User-Identity = "" Location-Capable = Civix-Location Calling-Station-Id = "80:ab:17:46:69:10" Called-Station-Id = "6c:99:89:8b:62:50:Employees" NAS-Port = 13 Cisco-AVPair = "audit-session-id=ac1f0c620001129d5bd059a8" Acct-Session-Id = "5bd059a8/80:ad:16:46:69:10/117467" Cisco-AVPair = "mDNS=true" NAS-IP-Address = 192.168.10.1 NAS-Identifier = "CC-803" Airespace-Wlan-Id = 8 Service-Type = Framed-User Framed-MTU = 1300 NAS-Port-Type = Wireless-802.11 Tunnel-Type:0 = VLAN Tunnel-Medium-Type:0 = IEEE-802 Tunnel-Private-Group-Id:0 = "803" EAP-Message = 0x0207006b1900170301006097b83712638612527a05475ecd25d67e6076490aee95d35c489925635aee89c40643f7792122452628ac3c6deb27afd73a619069eab529f5afcc4646fa17195991294d33614f549480f045e3a0aba117ff7c4182bdfdbd935055c2577f056d01 State = 0x413cfeec443be7e0d7f6ff4a2526d7aa Message-Authenticator = 0xc54014a6929ff04d4e13b6a8be7b79ad Why is this behaviour? Because I thougth the access requests are used only when the user is going to authenticate and never. Thanks a lot, regards !!!

2 1

Filter-Id in Accounting-Request
by Alessandro Romano 24 Oct '18

24 Oct '18

Dear All, i need to have the attribute Filter-Id in the accounting request packet to replicate it to anoter external server BR Alessandro Romano C.T.O. Cell: 3351402534 Positivo SRL Via San Leonardo 52 84131 Salerno ( Sa )

2 2

set an ldap attribute in the ldap file
by Yaël Rozanes 24 Oct '18

24 Oct '18

Hello, everyone, I would have liked to know if it was possible to "fix" an ldap attr in the ldap file, such as : Tunnel-Type is always equal to VLAN and Tunnel-Medium-Type is always equal to 6 I searched with the operators but I didn't fully understand how they work. for now my file looks like this: [...] update { control:Password-With-Header += 'userPassword' # control:NT-Password := 'ntPassword' # reply:Reply-Message := 'radiusReplyMessage' # reply:Tunnel-Type := 'radiusTunnelType' # reply:Tunnel-Medium-Type := 'radiusTunnelMediumType' # reply:Tunnel-Private-Group-ID := 'radiusTunnelPrivategroupId' reply:Tunnel-Type := "description" reply:Tunnel-Medium-Type := "textelibre" reply:Tunnel-Private-Group-ID := "givenName" # Where only a list is specified as the RADIUS attribute, # the value of the LDAP attribute is parsed as a valuepair # in the same format as the 'valuepair_attribute' (above). control: += 'radiusControlAttribute' request: += 'radiusRequestAttribute' reply: += 'radiusReplyAttribute' } [...] and I would have liked something like this [...] reply:Tunnel-Type == "VLAN" reply:Tunnel-Medium-Type == "6" reply:Tunnel-Private-Group-ID := "givenName [...] in my ldap, description = VLAN and textelibre = 6 but I'd like to free these fields from my ldap thank you in advance for your answers -------------------------------------------------------------------------------------------------------------- Rozanes Yaël Student in License ASUR ( france ;)

2 2

rlm_rest in pre-proxy
by Fabrice Durand 23 Oct '18

23 Oct '18

Hello, just a quick question, is there any reason why rlm_rest module is not available in the pre-proxy section ? (post-proxy too) I would like to use it to be able to add dynamic radius attributes before sending the request to a remote server. Regards Fabrice -- Fabrice Durand fdurand(a)inverse.ca :: +1.514.447.4918 (x135) :: www.inverse.ca Inverse inc. :: Leaders behind SOGo (http://www.sogo.nu) and PacketFence (http://packetfence.org)

2 2

Re: Post-Auth LDAP with computer names rather than usernames
by Kevin Virk 22 Oct '18

22 Oct '18

I recently sparked a discussion regarding post-auth with computer names rather than usernames and I did not include complete information, my apologies. I am currently using EAP-TLS and have crafted certificates based on usernames. Alan had responded saying that post-auth via Ldap was possible if you make certs with workstations names included. I can do this my question is then does the stripped username take the computer name and then do my ldap queries just need to change to check workstation groups rather than security groups ? Thank you in advance for any help.

2 1

freeradius3 couldnt connect to mysql-server
by Lukas Nuth 22 Oct '18

22 Oct '18

Hi, FreeRADIUS starts with my virtual machine. Therefore Ubuntu created the file "radiusd.service" itself. I activated "radius.service" with "systemctl enable radiusd.service" so that FR starts with the virtual machine. Now the problem when FR starts with the virtual machine is that the following error message can be found in the log file: Mon Oct 22 08:45:40 2018 : Info: Debugger not attached Mon Oct 22 08:45:41 2018 : Info: rlm_sql (sql): Driver rlm_sql_mysql (module rlm_sql_mysql) loaded and linked Mon Oct 22 08:45:42 2018 : Info: rlm_sql_mysql: libmysql version: 5.7.23 Mon Oct 22 08:45:42 2018 : Info: rlm_sql (sql): Attempting to connect to database "radius" Mon Oct 22 08:45:42 2018 : Info: rlm_sql (sql): Opening additional connection (0), 1 of 32 pending slots used Mon Oct 22 08:45:42 2018 : Error: rlm_sql_mysql: Couldn't connect to MySQL server radius@localhost:radius Mon Oct 22 08:45:42 2018 : Error: rlm_sql_mysql: MySQL error: Can't connect to local MySQL server through socket '/var/run/mysqld/mysqld.sock' (2) Mon Oct 22 08:45:42 2018 : Error: rlm_sql (sql): Opening connection failed (0) Mon Oct 22 08:45:42 2018 : Error: /etc/raddb/mods-enabled/sql[20]: Instantiation failed for module "sql" If I restart FR with "systemctl restart radiusd.service" this error does not occur. Can anyone help me? regards Lukas

3 4

Add bandwidth to user
by me＠erikthiart.com 21 Oct '18

21 Oct '18

Hello, What is the best way to go about adding additional bandwidth to a user in freeradius? Scenario: I have mikrotik hotspots using mac auth and in freeradius I have a realm setup with a bandwidth limit of 400mb, when some users perform a certain action I want to increase the bandwidth for said users by 200mb for example.

3 2