- Freeradius-Users - lists.freeradius.org

Linelog not creating file in /var/log
by Raghu nathan 26 Oct '18

26 Oct '18

We are using v3.0.13 - We have enabled the linelog but its not creating any log file under /var/log. - We kept no change in linelog module. Is there anything we need to enable to make it work? ******* # Loading module "linelog" from file /etc/raddb/mods-enabled/linelog linelog { filename = "/var/log/radius/linelog" escape_filenames = no syslog_facility = "auth" syslog_severity = "info" permissions = 384 group = "radiusd" format = "This is a log message for %{User-Name}" reference = "messages.%{%{reply:Packet-Type}:-default}" } ******* Regards, Raghu.

2 2

help
by Diwakar Bhardwaj 25 Oct '18

25 Oct '18

I'm just trying to use Redis DB with radius server by default it uses MySQL server for authentication and authorization. I tried by changing the default config (used redis instead of sql) but it didn't work, it complains like "*redis" modules aren't allowed in 'authorization' sections -- they have no such method*". I am just wanted to know What are the config changes are required for that? I haven't found any such documentation that explains it. Can anyone please help with this?

2 1

Error: Unresponsive child for request
by CALMELS, Thierry (SOGETI REGIONS SAS) 25 Oct '18

25 Oct '18

Hello freeradius support team, We have currently a new infrastucture using freeRadius 3 (freeradius-3.0.13-8.) on RHEL7.5. The infrastructure implements in front a layer “PROXY RADIUS” (not based on proxy.conf usage) allowing to forward requests either to a service RADIUS A or a service RADIUS B depending on the type of OTP. Service A handles/valids OTP A Service B handles/valids OTP B The infrastructure works as expected. However when a service disruption occurs on service B, the PROXY RADIUS is no longer able to forward the requests to service A. The PROXY is in a state stuck with the below error messages. Thu Oct 25 08:14:11 2018 : Error: Unresponsive child for request 5735, in component authenticate module perl Thu Oct 25 08:14:13 2018 : WARNING: (5735) WARNING: Module rlm_perl became unblocked :::::: Thu Oct 25 09:41:25 2018 : Error: Unresponsive child for request 5791, in component authenticate module perl Thu Oct 25 09:41:53 2018 : WARNING: (5783) WARNING: Module rlm_perl became unblocked How can we manage this kind of errors? Is there some parameters to release connections. I'm assuming the error indicates some sort of timeout in communication between rlm_perl and service B. Assuming this is a timeout-related error, what is an acceptable processing time? Thanks, Thierry - List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html The information in this e-mail is confidential. The contents may not be disclosed or used by anyone other than the addressee. Access to this e-mail by anyone else is unauthorised. If you are not the intended recipient, please notify Airbus immediately and delete this e-mail. Airbus cannot accept any responsibility for the accuracy or completeness of this e-mail as it has been sent over public networks. If you have any concerns over the content of this message or its Accuracy or Integrity, please contact Airbus immediately. All outgoing e-mails from Airbus are checked using regularly updated virus scanning software but you should take whatever measures you deem to be appropriate to ensure that this message and any attachments are virus free.

2 1

dhcp server and logging
by BASSAGET Cédric 25 Oct '18

25 Oct '18

Hello. I don't understand what is missing in my config to make freeradius (3.0.12) logging what is doing about DHCP queries / replies. I'm using module dhcp_sqlippool, which set things like : sqlippool_log_exists = "DHCP: Existing IP: %{reply:Framed-IP-Address} (did %{Called-Station-Id} cli %{Calling-Station-Id} port %{NAS-Port} user %{User-Name})" sqlippool_log_success = "DHCP: Allocated IP: %{reply:Framed-IP-Address} from %{control:Pool-Name} (did %{Called-Station-Id} cli %{Calling-Station-Id} port %{NAS-Port} user %{User-Name})" sqlippool_log_clear = "DHCP: Released IP %{Framed-IP-Address} (did %{Called-Station-Id} cli %{Calling-Station-Id} user %{User-Name})" sqlippool_log_failed = "DHCP: IP Allocation FAILED from %{control:Pool-Name} (did %{Called-Station-Id} cli %{Calling-Station-Id} port %{NAS-Port} user %{User-Name})" sqlippool_log_nopool = "DHCP: No Pool-Name defined (did %{Called-Station-Id} cli %{Calling-Station-Id} port %{NAS-Port} user %{User-Name})" But nothing is logged. And I can not find the good doc to learn how linelog works.I found this thread : http://freeradius.1045715.n5.nabble.com/DHCP-in-FreeRadius-3-and-logging-td… But It did not help me. I'm missing something... Can somebody help me / point me in the right direction ? Regards.

3 4

Accounting-Request Re write Rule
by Maile Halatuituia 25 Oct '18

25 Oct '18

Hi I need to rewrite this attribute Cisco-AVPair = "acct-input-octets-ipv6=xxx" upon receiving it in the accounting request from my BRAS to my Radius Server so I can further process. I received this Cisco-AVPair = "acct-input-octets-ipv6=xxx" I have done this on the Radius Server /etc/freeradius/sites-available/default if( &Cisco-AVPair[*]=~/\(acct-input-octets-ipv6\)=\(\d+)/ ) { update request { &acct-input-octets-ipv6 := "%{2}" } } But I have this on my debug if ( &Cisco-AVPair[*]=~/\(acct-input-octets-ipv6\)=\(\d+)/ ) { (0) if ( &Cisco-AVPair[*]=~/\(acct-input-octets-ipv6\)=\(\d+)/ ) -> FALSE Not sure if I can read it correctly but seem the rule does not matched .. Appreciate anyone comments if didn't do it correctly Confidentiality Notice: This email (including any attachment) is intended for internal use only. Any unauthorized use, dissemination or copying of the content is prohibited. If you are not the intended recipient and have received this e-mail in error, please notify the sender by email and delete this email and any attachment.

2 2

Optimize the authentication time
by Tom Yard 24 Oct '18

24 Oct '18

Hi people, we have a Freeradius with AD authentication and SQL authorization. I could notice that several Windows 10 clients spend severalk seconds in authorization and authentication. Is there any way to optimize the time of authentication/authorization? Thanking in advance, Tommy

2 1

Several Access Requests after a succesfully authentication
by Tom Yard 24 Oct '18

24 Oct '18

Dear people, I have a Freeradius server that authenticate users against an AD in order to access the WiFi network: Once a user authenticates OK and access the WiFi network, in the debug log of Freeradius I notice that this user has several access requests at the same time he is using the WiFi correctly. The access request frames are as the shown below: rad_recv: Access-Request packet from host 192.168.10.1 port 32768, id=103, length=432 User-Name = "jsmith" Chargeable-User-Identity = "" Location-Capable = Civix-Location Calling-Station-Id = "80:ab:17:46:69:10" Called-Station-Id = "6c:99:89:8b:62:50:Employees" NAS-Port = 13 Cisco-AVPair = "audit-session-id=ac1f0c620001129d5bd059a8" Acct-Session-Id = "5bd059a8/80:ad:16:46:69:10/117467" Cisco-AVPair = "mDNS=true" NAS-IP-Address = 192.168.10.1 NAS-Identifier = "CC-803" Airespace-Wlan-Id = 8 Service-Type = Framed-User Framed-MTU = 1300 NAS-Port-Type = Wireless-802.11 Tunnel-Type:0 = VLAN Tunnel-Medium-Type:0 = IEEE-802 Tunnel-Private-Group-Id:0 = "803" EAP-Message = 0x0207006b1900170301006097b83712638612527a05475ecd25d67e6076490aee95d35c489925635aee89c40643f7792122452628ac3c6deb27afd73a619069eab529f5afcc4646fa17195991294d33614f549480f045e3a0aba117ff7c4182bdfdbd935055c2577f056d01 State = 0x413cfeec443be7e0d7f6ff4a2526d7aa Message-Authenticator = 0xc54014a6929ff04d4e13b6a8be7b79ad Why is this behaviour? Because I thougth the access requests are used only when the user is going to authenticate and never. Thanks a lot, regards !!!

2 1

Filter-Id in Accounting-Request
by Alessandro Romano 24 Oct '18

24 Oct '18

Dear All, i need to have the attribute Filter-Id in the accounting request packet to replicate it to anoter external server BR Alessandro Romano C.T.O. Cell: 3351402534 Positivo SRL Via San Leonardo 52 84131 Salerno ( Sa )

2 2

set an ldap attribute in the ldap file
by Yaël Rozanes 24 Oct '18

24 Oct '18

Hello, everyone, I would have liked to know if it was possible to "fix" an ldap attr in the ldap file, such as : Tunnel-Type is always equal to VLAN and Tunnel-Medium-Type is always equal to 6 I searched with the operators but I didn't fully understand how they work. for now my file looks like this: [...] update { control:Password-With-Header += 'userPassword' # control:NT-Password := 'ntPassword' # reply:Reply-Message := 'radiusReplyMessage' # reply:Tunnel-Type := 'radiusTunnelType' # reply:Tunnel-Medium-Type := 'radiusTunnelMediumType' # reply:Tunnel-Private-Group-ID := 'radiusTunnelPrivategroupId' reply:Tunnel-Type := "description" reply:Tunnel-Medium-Type := "textelibre" reply:Tunnel-Private-Group-ID := "givenName" # Where only a list is specified as the RADIUS attribute, # the value of the LDAP attribute is parsed as a valuepair # in the same format as the 'valuepair_attribute' (above). control: += 'radiusControlAttribute' request: += 'radiusRequestAttribute' reply: += 'radiusReplyAttribute' } [...] and I would have liked something like this [...] reply:Tunnel-Type == "VLAN" reply:Tunnel-Medium-Type == "6" reply:Tunnel-Private-Group-ID := "givenName [...] in my ldap, description = VLAN and textelibre = 6 but I'd like to free these fields from my ldap thank you in advance for your answers -------------------------------------------------------------------------------------------------------------- Rozanes Yaël Student in License ASUR ( france ;)

2 2

rlm_rest in pre-proxy
by Fabrice Durand 23 Oct '18

23 Oct '18

Hello, just a quick question, is there any reason why rlm_rest module is not available in the pre-proxy section ? (post-proxy too) I would like to use it to be able to add dynamic radius attributes before sending the request to a remote server. Regards Fabrice -- Fabrice Durand fdurand(a)inverse.ca :: +1.514.447.4918 (x135) :: www.inverse.ca Inverse inc. :: Leaders behind SOGo (http://www.sogo.nu) and PacketFence (http://packetfence.org)

2 2