- Freeradius-Users - lists.freeradius.org

problem with table radacct column acctstarttime acctstoptime
by Александр Михайлов 23 May '18

23 May '18

freeradius -v3.0.18 Instead db mysql in table radacct shows incorrect time column acctstartime and acctstoptime in v.3 , if I will use v.2 or v.4 it will be ok. It's a bug ? /var/log Tue May 22 14:10:14 2018 Acct-Status-Type = Start Acct-Authentic = RADIUS User-Name = "systemn" Called-Station-Id = "18-A6-F7-77-34-20:U_need?" NAS-Port-Type = Wireless-802.11 Service-Type = Framed-User NAS-Port = 1 Calling-Station-Id = "38-2D-D1-32-61-1E" Connect-Info = "CONNECT 54Mbps 802.11g" Acct-Session-Id = "50405B44E552BE9F" WLAN-Pairwise-Cipher = 1027076 WLAN-Group-Cipher = 1027076 WLAN-AKM-Suite = 1027073 Event-Timestamp = "May 22 2018 14:06:04 MSK" Acct-Delay-Time = 0 NAS-IP-Address = 192.168.1.3 Tmp-String-9 = "ai:" Acct-Unique-Session-Id = "4eebe6180c8f71124f48580c88965921" Timestamp = 1526987414 Tue May 22 16:06:56 2018 Acct-Status-Type = Stop Acct-Authentic = RADIUS User-Name = "systemn" Called-Station-Id = "18-A6-F7-77-34-20:U_need?" NAS-Port-Type = Wireless-802.11 Service-Type = Framed-User NAS-Port = 1 Calling-Station-Id = "38-2D-D1-32-61-1E" Connect-Info = "CONNECT 54Mbps 802.11g" Acct-Session-Id = "50405B44E552BE9F" WLAN-Pairwise-Cipher = 1027076 WLAN-Group-Cipher = 1027076 WLAN-AKM-Suite = 1027073 Event-Timestamp = "May 22 2018 16:02:46 MSK" Acct-Delay-Time = 0 Acct-Session-Time = 7002 Acct-Input-Packets = 3576 Acct-Output-Packets = 1851 Acct-Input-Octets = 429484 Acct-Input-Gigawords = 0 Acct-Output-Octets = 729649 Acct-Output-Gigawords = 0 NAS-IP-Address = 192.168.1.3 Tmp-String-9 = "ai:" Acct-Unique-Session-Id = "4eebe6180c8f71124f48580c88965921" Timestamp = 1526994416 On AP (access point openwrt) seted correct time MYSQL: mysql> select acctstarttime, acctsessiontime, acctstoptime, acctinputoctets, acctoutputoctets, acctsessionid from radacct; +---------------------+-----------------+---------------------+-----------------+------------------+------------------+ | acctstarttime | acctsessiontime | acctstoptime | acctinputoctets | acctoutputoctets | acctsessionid | +---------------------+-----------------+---------------------+-----------------+------------------+------------------+ | 0000-00-00 00:00:00 | 68 | 0000-00-00 00:00:00 | 38240 | 55976 | 6443639F657526A9 | | 0000-00-00 00:00:00 | 1982 | 0000-00-00 00:00:00 | 225720 | 340295 | 0E1A73B95E5440A2 | | 0000-00-00 00:00:00 | 37 | 0000-00-00 00:00:00 | 15182 | 17591 | 13A640668372BE96 | | 0000-00-00 00:00:00 | 7040 | 0000-00-00 00:00:00 | 214251 | 198763 | 7218BBDC869071C0 | | 0000-00-00 00:00:00 | 7034 | 0000-00-00 00:00:00 | 1258946 | 3001674 | 6F167E9A04670B6E | | 0000-00-00 00:00:00 | 7033 | 0000-00-00 00:00:00 | 2809545 | 50253172 | 5EBC5DA61E869DAE | | 0000-00-00 00:00:00 | 7002 | 0000-00-00 00:00:00 | 429484 | 729649 | 50405B44E552BE9F | | 0000-00-00 00:00:00 | 3882 | 0000-00-00 00:00:00 | 832739 | 4944760 | 4524CB7AF305309D | | 0000-00-00 00:00:00 | 0 | NULL | 0 | 0 | D0A7050D8D899789 | +---------------------+-----------------+---------------------+-----------------+------------------+------------------+ mysql> select now(); +---------------------+ | now() | +---------------------+ | 2018-05-23 10:34:46 | +---------------------+

1 0

REST Module vs Perl/Ruby REST
by Mohammad Mahefooz 22 May '18

22 May '18

I want to handle the authentication and authorisation on Nodejs server instead of SQL. Is it better to use rlm_rest module or use Perl/Ruby script and access REST within the script? The objective here is to select the most stable method. Is rlm_rest stable enough to get into production? Thanks Mohammad Mahefooz

3 5

Hide User-Password Attribute in eap_ttls and inner_tunnel
by Giorgos Tsirkas 22 May '18

22 May '18

Hello, Is there any way to hide User-Password attribute in logs when execute eap_ttls or inner-tunnel virtual server? /Tue May 22 15:04:32 2018 : Debug: (46) eap_ttls: [eaptls process] = ok// //Tue May 22 15:04:32 2018 : Debug: (46) eap_ttls: Session established. Proceeding to decode tunneled attributes// //Tue May 22 15:04:32 2018 : Debug: (46) eap_ttls: Got tunneled request// //Tue May 22 15:04:32 2018 : Debug: (46) eap_ttls: User-Name = "test_user"// //Tue May 22 15:04:32 2018 : Debug: (46) eap_ttls: User-Password = "test_password"// //Tue May 22 15:04:32 2018 : Debug: (46) eap_ttls: FreeRADIUS-Proxied-To = 127.0.0.1// //Tue May 22 15:04:32 2018 : Debug: (46) eap_ttls: Sending tunneled request// //Tue May 22 15:04:32 2018 : Debug: (46) Virtual server inner-tunnel received request// //Tue May 22 15:04:32 2018 : Debug: (46) User-Name = "test_user"// //Tue May 22 15:04:32 2018 : Debug: (46) User-Password = "test_password"// //Tue May 22 15:04:32 2018 : Debug: (46) FreeRADIUS-Proxied-To = 127.0.0.1// //Tue May 22 15:04:32 2018 : Debug: (46) NAS-IP-Address = 10.10.10.36// //Tue May 22 15:04:32 2018 : Debug: (46) NAS-Port-Type = Ethernet// //Tue May 22 15:04:32 2018 : Debug: (46) NAS-Port = 22// /

2 1

NAS Send Different Ip Address
by Muhammed Buvaydani 22 May '18

22 May '18

Hello I don't know if my quetion related to the list or not , but I must try because I have tried in many places without result . I have fortigate firewall which ip address is 10.10.0.88 and when I send authentication request or test request to freeradius freeradius Show error msg which contain ignore the request because comming from unknown ip address 77.25.44.22 . why that happend is the problem is in freeradius or firewall Thank you very much

1 0

Detail reader concurrency
by Nathan Ward 21 May '18

21 May '18

Hi, We are using the detail file reader to relay accounting from our “frontend” servers to a number of backend servers which have different roles. We write every packet to a detail file per backend, then read them in, and send them on. One of the servers takes around 80ms to respond to a request, regardless of the request rate - if I send 1/s it responds in 80ms. If I send 100/s, it responds in 80ms. I guess you could just imagine that there is 80ms network latency, which is a problem I imagine is somewhat common. It looks like the detail reader’s behaviour is to do one packet at a time. I can understand why this would be - it’s certainly a lot simpler! Is there a way to configure it to relay multiple requests at once? The protocol supports this of course with multiple IDs (and some BNGs even do multiple source ports), but, not sure if the detail reader (or, wherever this would need to live) does. One option open to us of course is to attempt to relay the packet first, and only write to the detail file if relaying fails, which would (I think!) mean multiple requests can be in flight at once. Because we’re sending the requests off to multiple backend servers, this means we’ll be waiting for each of them in turn before responding to the original clients, which is something we want to avoid. I have considered a detached subrequest, and relaying to the slow backend server immediately and not using the detail writer unless the backend is broken - but, I don’t want to respond to the client unless the data is either on the backend server, OR, is written to disk on the frontend. I have also considered writing to many detail files based on some sort of hash, and having many readers.. but that is not very elegant. -- Nathan Ward

2 2

Error while authenticating users on Wifi.
by Saurabh Lahoti 20 May '18

20 May '18

Hi, Whilst trying to authenticate users on Wifi, authentication fails with below error: Error: Ignoring request to auth address 192.168.154.96 port 1812 bound to server default from unknown client 172.18.40.40 port 32774 proto udp Could you please help what missing configuration is leading to this error..? Wifi clients are declared under clients-enabled & included in radiusd.conf ---- *Thanks & Kind Regards,* Saurabh LAHOTI.

2 1

unlang & expr
by petr.linke＠seznam.cz 18 May '18

18 May '18

Hi, I need do some arithmetic operation in the soh-server, so I tried use the expr module. example: server soh-server { ... update control { &Tmp-Integer-1 := %{expr: 1 + 2 + 3} } But from syntax checker I received error message: "Syntax error: Expected comma after '%{expr:': 1 + 2 + 3}" Is possible use expr in this case? Petr Linke

2 2

Strange behaviour (?) on Windows authentication
by Arnaud Forster 17 May '18

17 May '18

Hello all, I requested a few months ago some help about allowing some specific users being able to connect on specific wifi systems. A received some great help by adding a test to check if the user belongs to the specific group. This works like a charm for computers *not *belonging to the ldap domain.Today, I've another problem with that authentication for a computer belonging to the ldap domain. I made a log and there's something I don't understand. the username is there and correc (MyUserName) but suddenly, before checking if it belongs to the group 'Enseignants' here, the text '*5c5c' *is added to my username. It seems that this is the text 5c5cMyUserName that is checked instead of MyUserName. Can someone understand that ? I've no idea from where comes this '5c5c' text and why this works for computers not belonging to the domain... Really thanks for your help ;) Arnaud (1) Received Access-Request Id 193 from <a wifi system> length 219 (1) User-Name = "MyDomain\\MyUserName" (1) NAS-IP-Address = 10.20.32.34 (1) Called-Station-Id = "00-19-3B-10-8C-00:MyDomain" (1) NAS-Port-Type = Wireless-802.11 (1) Service-Type = Framed-User (1) Calling-Station-Id = "DC-53-60-A5-19-50" (1) Connect-Info = "CONNECT 0Mbps 802.11b" (1) Acct-Session-Id = "929C1E7D46CDEAD7" (1) Acct-Multi-Session-Id = "D8478D373078FF2E" (1) WLAN-Pairwise-Cipher = 1027076 (1) WLAN-Group-Cipher = 1027074 (1) WLAN-AKM-Suite = 1027073 (1) Framed-MTU = 1400 (1) EAP-Message = 0x02a800130145534d415c6c656f6e617264696d (1) Message-Authenticator = 0xa790b757b6ea900d68132242a39287d3 (1) # Executing section authorize from file /etc/raddb/sites-enabled/default (1) authorize { (1) policy rewrite_called_station_id { (1) if (&Called-Station-Id && (&Called-Station-Id =~ /^([0-9a-f]{2})[^0-9a-f]?([0-9a-f]{2})[^0-9a-f]?([0-9a-f]{2})[^0-9a-f]?([0-9a-f]{2})[^0-9a-f]?([0-9a-f]{2})[^0-9a-f]?([0-9a-f]{2})([^0-9a-f](.+))?$/i)) { (1) if (&Called-Station-Id && (&Called-Station-Id =~ /^([0-9a-f]{2})[^0-9a-f]?([0-9a-f]{2})[^0-9a-f]?([0-9a-f]{2})[^0-9a-f]?([0-9a-f]{2})[^0-9a-f]?([0-9a-f]{2})[^0-9a-f]?([0-9a-f]{2})([^0-9a-f](.+))?$/i)) -> TRUE (1) if (&Called-Station-Id && (&Called-Station-Id =~ /^([0-9a-f]{2})[^0-9a-f]?([0-9a-f]{2})[^0-9a-f]?([0-9a-f]{2})[^0-9a-f]?([0-9a-f]{2})[^0-9a-f]?([0-9a-f]{2})[^0-9a-f]?([0-9a-f]{2})([^0-9a-f](.+))?$/i)) { (1) update request { (1) EXPAND %{toupper:%{1}-%{2}-%{3}-%{4}-%{5}-%{6}} (1) --> 00-19-3B-10-8C-00 (1) &Called-Station-Id := 00-19-3B-10-8C-00 (1) } # update request = noop (1) if ("%{8}") { (1) EXPAND %{8} (1) --> MyDomain (1) if ("%{8}") -> TRUE (1) if ("%{8}") { (1) update request { (1) EXPAND %{8} (1) --> MyDomain (1) &Called-Station-SSID := MyDomain (1) } # update request = noop (1) } # if ("%{8}") = noop (1) [updated] = updated (1) } # if (&Called-Station-Id && (&Called-Station-Id =~ /^([0-9a-f]{2})[^0-9a-f]?([0-9a-f]{2})[^0-9a-f]?([0-9a-f]{2})[^0-9a-f]?([0-9a-f]{2})[^0-9a-f]?([0-9a-f]{2})[^0-9a-f]?([0-9a-f]{2})([^0-9a-f](.+))?$/i)) = updated (1) ... skipping else: Preceding "if" was taken (1) } # policy rewrite_called_station_id = updated (1) switch &Called-Station-SSID { (1) case MyDomain{ (1) if (&LDAP-Group != "Enseignants") { (1) Searching for user in group "Enseignants" rlm_ldap (ldap): Reserved connection (1) (1) EXPAND (uid=%{%{Stripped-User-Name}:-%{User-Name}}) (1) *--> (uid=**MyDomain**\**5c5c**MyUsername**)* (1) Performing search in "dc=MyDomain,dc=lan" with filter "(*uid=**MyDomain**\**5c5c**MyUserName*)", scope "sub" (1) Waiting for search result... (1) Search returned no results rlm_ldap (ldap): Released connection (1) (1) if (&LDAP-Group != "Enseignants") -> TRUE (1) if (&LDAP-Group != "Enseignants") { (1) [reject] = reject (1) } # if (&LDAP-Group != "Enseignants") = reject (1) } # case MyDomain= reject (1) } # switch &Called-Station-SSID = reject (1) } # authorize = reject (1) Using Post-Auth-Type Reject (1) # Executing group from file /etc/raddb/sites-enabled/default (1) Post-Auth-Type REJECT { (1) attr_filter.access_reject: EXPAND %{User-Name} (1)*attr_filter.access_reject: --> **MyDomain**\\**MyUserName* (1) attr_filter.access_reject: Matched entry DEFAULT at line 11 (1) [attr_filter.access_reject] = updated (1) eap: Request was previously rejected, inserting EAP-Failure (1) eap: Sending EAP Failure (code 4) ID 168 length 4 (1) [eap] = updated (1) policy remove_reply_message_if_eap { (1) if (&reply:EAP-Message && &reply:Reply-Message) { (1) if (&reply:EAP-Message && &reply:Reply-Message) -> FALSE (1) else { (1) [noop] = noop (1) } # else = noop (1) } # policy remove_reply_message_if_eap = noop (1) } # Post-Auth-Type REJECT = updated (1) Delaying response for 1.000000 seconds Waking up in 0.3 seconds. Waking up in 0.6 seconds. (1) Sending delayed response (1) Sent Access-Reject Id 193 from 10.20.32.11:1812 to 10.20.32.34:36521 length 44 (1) EAP-Message = 0x04a80004 (1) Message-Authenticator = 0x00000000000000000000000000000000 Waking up in 1.3 seconds. (0) Cleaning up request packet ID 192 with timestamp +3

2 3

FreeIPA + Active Directory Integration
by Ed Melendez 17 May '18

17 May '18

Hello All- Not sure if this is within the scope of this list, but I'm trying to figure out the best way to authenticate users who are in a different domain (trusted) than the FreeRADIUS server... FreeRADIUS server - FreeIPA Domain (linux.company.net) User - Windows Domain (corp.company.net) Any help would be greatly appreciated. Thanks, -Ed

2 1

Freeradius - LDAP bind as user
by Giorgos Tsirkas 17 May '18

17 May '18

Hello, I need help about Freeradius and OpenLDAP. When a user connects to a device via freeradius with ldap credentials, i want to bind LDAP with the same credentials. Is there any way? If yes can you give me an example? Thank you.

2 1