- Freeradius-Users - lists.freeradius.org

IP assignment based on AD group
by Rodrigo Abrantes Antunes 31 Oct '24

31 Oct '24

Hi, I currently have vlan assignment based on ad group working flawlessly for my wireless clients. Now I want ip assignment, is it possible? I tried to achieve that with the ippool module but I think I am missing something. How should I configure the wlc or the dhcp server? mods-enabled/ippool ippool professores-cstsi { filename = ${db_dir}/ippools/professores-cstsi.ippool range_start = 172.17.10.1 range_stop = 172.17.10.20 netmask = 255.255.0.0 cache_size = 20 ip_index = ${db_dir}/ippools/professores-cstsi.ipindex override = yes maximum_timeout = 0 } users DEFAULT LDAP-Group == "test", Pool-Name := "professores-cstsi" Thanks.

5 14

Pass client attributes from client.conf to post-auth section
by Alexey D. Filimonov 30 Oct '24

30 Oct '24

Is it possible to have client shortname (from clients.conf) or any custom per-client property inside post-auth and post-proxy block? Problem: I have multiple physical locations of different "types", each location type has it's own requirement for Tunnel-Private-Group-Id. With MS NPS, I have AAA clients named location-a@location-type-x@ap1 location-a@location-type-x@ap2 location-b@location-type-x@ap1 location-c@location-type-z@ap1 location-c@location-type-z@ap2 And I build access rules logic with conditions like "rule when client name match /@location-type-x@/" and "another rule when client name match /@location-type-z@/". With FreeRADIUS I found no information about client shortname in debug_all output inside post-auth block. I can build huge ruleset of additional unlang logic like this, or maybe more simple... if (&NAS-IP-Address == "1.1.1.1" && Called-Station-Id =~ /:ssid1/) { update response { Tunnel-Private-Group-Id = "100" } } elsif (&NAS-IP-Address == "1.1.1.1" && Called-Station-Id =~ /:ssid2/) { update response { Tunnel-Private-Group-Id = "101" } } elsif (&NAS-IP-Address == "1.1.1.2" && Called-Station-Id =~ /:ssid1/) { update response { Tunnel-Private-Group-Id = "100" } } elsif (&NAS-IP-Address == "1.1.1.2" && Called-Station-Id =~ /:ssid2/) { update response { Tunnel-Private-Group-Id = "101" } } elsif (&NAS-IP-Address == "1.1.2.1" && Called-Station-Id =~ /:ssid1/) { update response { Tunnel-Private-Group-Id = "203" } } elsif (&NAS-IP-Address == "1.1.2.1" && Called-Station-Id =~ /:ssid2/) { update response { Tunnel-Private-Group-Id = "204" } } ... But in my opinion, 1) there must be a way not to duplicate client address information in both post-auth and clients.conf 2) amount of code looks stupid when scaled to tens of locations.

2 2

Can I use diffrent root CA certificates while dynamic loading certificate chains?
by James Fan 28 Oct '24

28 Oct '24

Hi, we have a case that, with multi-tenancy, there will be multiple CA certificates in our FreeRadius server, so we need to load the certificate chains dynamically. But when I use the statements below, I can't include the CA certificates in the certificate files I set. The TLS-Session-Cert-File looks like it is only for the server certificate and intermediate CA certificates. Is there any chance of dynamic loading certificate chains with root CA certificates? Thanks. authenticate { ... Auth-Type eap { if ("%{unpack:&EAP-Message 4 byte}" == 1) { update control { TLS-Session-Cert-File := "${certdir}/realms/%{Realm}" } } eap } ... }

4 8

General Issues
by mohamed almeshal 28 Oct '24

28 Oct '24

Dear Savers , I'm doing lot's of work with FreeRadius , but I'm stuck with 3 major issues. * What is the best max_pps that can handle heavy load , also what is best database software that can handle heavy load . * Doing some modifications to default sites-available what is best way to implement modifications in database queries for custom purpose . * Is modified the queries of the FreeRadius to lower the load like shrink the data being inserted or updated. Will effect the FreerRadius as all Thanks ,

2 1

radiusd service start timeout
by Alan Smith 24 Oct '24

24 Oct '24

Hi all, I am using freeradius 3.0.20 with MariaDB. Radius clients are stored in the database. When I try to start the service, it will attempt to start the service. Then 1 minute 30 seconds later, it will log error message timed out.In /var/log/radius/radius.log, I can check the clients are still being loaded (not completed yet).The output of systemctl status radiusd is as follows. Oct 24 15:17:19 servername systemd[1]: Starting FreeRADIUS high performance RADIUS server....Oct 24 15:18:49 servername systemd[1]: radiusd.service start-pre operation timed out. Terminating.Oct 24 15:18:49 servername systemd[1]: radiusd.service Failed with result 'timeout'.Oct 24 15:18:49 servername systemd[1]: Failed to start FreeRADIUS high performance RADIUS server.. May I know how this can be fixed? Thank you in advance.

2 1

Question / Updated RADIUS attribute before proxying (pre-proxy) not sent to proxy server
by dominic.stalder＠unibe.ch 24 Oct '24

24 Oct '24

Hi guys I would like to achieve this: - if RADIUS request is arriving from a specific IP address (for test purpuses also added 127.0.0.1) and Called-Station-SSID attribute is empty, set this attribute BEFORE proxying to a value “00-11-22-33-44-55:eduroam” - I added the following to the pre-proxy section in /etc/freeradius/sites-enabled/default: pre-proxy { if (Packet-Src-IP-Address == 130.59.31.24 || Packet-Src-IP-Address == 130.59.31.25 || Packet-Src-IP-Address == 127.0.0.1) { if (!&Called-Station-SSID) { update request { &Called-Station-Id := "00-11-22-33-44-55:eduroam" } } } attr_filter.pre-proxy } *** /etc/freeradius/mods-config/attr_filter/pre-proxy looks like this: DEFAULT User-Name =* ANY, User-Password =* ANY, MS-CHAP-Challenge =* ANY, MS-CHAP-Response =* ANY, EAP-Message =* ANY, Message-Authenticator =* ANY, State =* ANY, NAS-IP-Address =* ANY, NAS-Identifier =* ANY, NAS-Port-Type =* ANY, Calling-Station-Id =* ANY, Called-Station-Id =* ANY, Proxy-State =* ANY, Operator-Name := "1unibe.ch" *** In the debug output, I can see, that the request is updated to "00-11-22-33-44-55:eduroam", but it does not reflect it in the RADIUS proxy request to the backend server, it does not send the Called-Station-Id set before: (8) Starting proxy to home server 130.92.14.27 port 1812 (8) server default { (8) # Executing section pre-proxy from file /etc/freeradius/sites-enabled/default (8) pre-proxy { (8) if (Packet-Src-IP-Address == 130.59.31.24 || Packet-Src-IP-Address == 130.59.31.25 || Packet-Src-IP-Address == 127.0.0.1) { (8) EXPAND Packet-Src-IP-Address (8) --> 127.0.0.1 (8) EXPAND Packet-Src-IP-Address (8) --> 127.0.0.1 (8) EXPAND Packet-Src-IP-Address (8) --> 127.0.0.1 (8) if (Packet-Src-IP-Address == 130.59.31.24 || Packet-Src-IP-Address == 130.59.31.25 || Packet-Src-IP-Address == 127.0.0.1) -> TRUE (8) if (Packet-Src-IP-Address == 130.59.31.24 || Packet-Src-IP-Address == 130.59.31.25 || Packet-Src-IP-Address == 127.0.0.1) { (8) if (!&Called-Station-SSID) { (8) if (!&Called-Station-SSID) -> TRUE (8) if (!&Called-Station-SSID) { (8) update request { (8) &Called-Station-Id := "00-11-22-33-44-55:eduroam" (8) } # update request = noop (8) } # if (!&Called-Station-SSID) = noop (8) } # if (Packet-Src-IP-Address == 130.59.31.24 || Packet-Src-IP-Address == 130.59.31.25 || Packet-Src-IP-Address == 127.0.0.1) = noop (8) } # pre-proxy = noop (8) } (8) Proxying request to home server 130.92.14.27 port 1812 timeout 20.000000 (8) Sent Access-Request Id 8 from 0.0.0.0:42294 to 130.92.14.27:1812 length 187 (8) EAP-Message = 0x02fd0028016964696e662e7465737473747564656e744073747564656e74732e756e6962652e6368 (8) User-Name = idinf.teststudent(a)students.unibe.ch<mailto:idinf.teststudent@students.unibe.ch> (8) NAS-IP-Address = 127.0.0.1 (8) Calling-Station-Id := "02-00-00-00-00-01" (8) Framed-MTU = 1400 (8) NAS-Port-Type = Wireless-802.11 (8) Service-Type = Framed-User (8) Connect-Info = "CONNECT 11Mbps 802.11b" (8) Message-Authenticator = 0x (8) Proxy-State = 0x38 What am I missing in this context or am I updating the wrong “context” (= request)? Thanks and best regards Dominic

2 5

Setting up CoA properly.
by Saied Ahadi 24 Oct '24

24 Oct '24

I hope someone can point me in the right direction. I am trying to setup CoA properly. In Free radius 2, we would simply change the clients.conf and proxy.conf file and list our NAS. What is the process like in free radius 3. We currently have CoA working in Freeradius 3 but I am not 100% sure if this is the proper method.

2 7

"anonymous" user connected to wireless
by Eby Mani 24 Oct '24

24 Oct '24

I'm having a strange problem, for one specific user, wireless system dashboard and radius accounting db show connected username as "anonymous". User credentials are stored in database and Calling-Station-Id is used to prevent unauthorized devices from connecting. FreeRADIUS authentication logs are not enabled. On DB, user "anonymous" do not exist. The wireless system is configured to authenticate only with FreeRADIUS server. Changing Calling-Station-Id on radius db prevents this system from connecting. I'm wondering how this is possible and where to check what is causing this. Thanks,

3 7

Error: OCI release failed in sql_finish_query
by Mucci Andrea 22 Oct '24

22 Oct '24

Hi all, I installed FreeRADIUS v.3.2.6 on Red Hat Enterprise Linux release 9.4 (Plow). Using Oracle as database: Oracle Database 19c Enterprise Edition Release 19.0.0.0.0 - Production Version 19.23.0.0.0 As instant client: oracle-instantclient19.19-basic-19.19.0.0.0-1.x86_64 In the log file I notice this error "OCI release failed in sql_finish_query" every time the sql module is called. Tue Oct 15 12:28:49 2024 : Debug: (0) sql_clid: EXPAND SELECT rgr.id as id, rg.name as groupname, decode(ra.has_tag,'Y',ra.name||':'||rgr.tag,ra.name) as attribute, value, op FROM RADIUS_GROUP_REPLY rgr, RADIUS_GROUP rg, RADIUS_ATTR ra WHERE rgr.group_id = rg.id AND rgr.radius_attr_id = ra.id AND (ra.vendor_id in (0,%{&control:HPE-Nas-VendorId}) OR (ra.vendor_id = 9999 AND ra.attr_id = 17)) AND rg.name = '%{sql_clid-SQL-Group}' ORDER BY id Tue Oct 15 12:28:49 2024 : Debug: (0) sql_clid: --> SELECT rgr.id as id, rg.name as groupname, decode(ra.has_tag,'Y',ra.name||':'||rgr.tag,ra.name) as attribute, value, op FROM RADIUS_GROUP_REPLY rgr, RADIUS_GROUP rg, RADIUS_ATTR ra WHERE rgr.group_id = rg.id AND rgr.radius_attr_id = ra.id AND (ra.vendor_id in (0,0) OR (ra.vendor_id = 9999 AND ra.attr_id = 17)) AND rg.name = 'FTTHFIBRAFTTH1000_ETH' ORDER BY id Tue Oct 15 12:28:49 2024 : Debug: (0) sql_clid: Executing select query: SELECT rgr.id as id, rg.name as groupname, decode(ra.has_tag,'Y',ra.name||':'||rgr.tag,ra.name) as attribute, value, op FROM RADIUS_GROUP_REPLY rgr, RADIUS_GROUP rg, RADIUS_ATTR ra WHERE rgr.group_id = rg.id AND rgr.radius_attr_id = ra.id AND (ra.vendor_id in (0,0) OR (ra.vendor_id = 9999 AND ra.attr_id = 17)) AND rg.name = 'FTTHFIBRAFTTH1000_ETH' ORDER BY id Tue Oct 15 12:28:49 2024 : Error: OCI release failed in sql_finish_query Tue Oct 15 12:28:49 2024 : Debug: (0) sql_clid: Group "FTTHFIBRAFTTH1000_ETH": Merging reply items Tue Oct 15 12:28:49 2024 : Debug: (0) sql_clid: Service-Type = Framed-User Tue Oct 15 12:28:49 2024 : Debug: (0) sql_clid: Framed-Protocol = PPP Tue Oct 15 12:28:49 2024 : Debug: (0) sql_clid: Acct-Interim-Interval = 21600 Tue Oct 15 12:28:49 2024 : Debug: (0) sql_clid: Fall-Through = Yes Anyone have any idea?? Best Regards Andrea

2 7

radiusd doesn't dump a core after SIGSEGV?
by Coy Hile (BLOOMBERG/ 919 3RD A) 22 Oct '24

22 Oct '24

Hi all, We've found that radiusd has died a couple times recently (using RedHat's packages on RHEL 8.8) without leaving a core file or even a stack trace that we can use to investigate the issue. Is that expected? I see the panic_action in `radiusd.conf`, but I don't want to run `gdb` on the core; I just want a core left behind so I can investigate the cause of the crash. Any idea what I'm missing? Thanks, -c

2 2