- Freeradius-Users - lists.freeradius.org

Detail reader concurrency
by Nathan Ward 21 May '18

21 May '18

Hi, We are using the detail file reader to relay accounting from our “frontend” servers to a number of backend servers which have different roles. We write every packet to a detail file per backend, then read them in, and send them on. One of the servers takes around 80ms to respond to a request, regardless of the request rate - if I send 1/s it responds in 80ms. If I send 100/s, it responds in 80ms. I guess you could just imagine that there is 80ms network latency, which is a problem I imagine is somewhat common. It looks like the detail reader’s behaviour is to do one packet at a time. I can understand why this would be - it’s certainly a lot simpler! Is there a way to configure it to relay multiple requests at once? The protocol supports this of course with multiple IDs (and some BNGs even do multiple source ports), but, not sure if the detail reader (or, wherever this would need to live) does. One option open to us of course is to attempt to relay the packet first, and only write to the detail file if relaying fails, which would (I think!) mean multiple requests can be in flight at once. Because we’re sending the requests off to multiple backend servers, this means we’ll be waiting for each of them in turn before responding to the original clients, which is something we want to avoid. I have considered a detached subrequest, and relaying to the slow backend server immediately and not using the detail writer unless the backend is broken - but, I don’t want to respond to the client unless the data is either on the backend server, OR, is written to disk on the frontend. I have also considered writing to many detail files based on some sort of hash, and having many readers.. but that is not very elegant. -- Nathan Ward

2 2

Error while authenticating users on Wifi.
by Saurabh Lahoti 20 May '18

20 May '18

Hi, Whilst trying to authenticate users on Wifi, authentication fails with below error: Error: Ignoring request to auth address 192.168.154.96 port 1812 bound to server default from unknown client 172.18.40.40 port 32774 proto udp Could you please help what missing configuration is leading to this error..? Wifi clients are declared under clients-enabled & included in radiusd.conf ---- *Thanks & Kind Regards,* Saurabh LAHOTI.

2 1

unlang & expr
by petr.linke＠seznam.cz 18 May '18

18 May '18

Hi, I need do some arithmetic operation in the soh-server, so I tried use the expr module. example: server soh-server { ... update control { &Tmp-Integer-1 := %{expr: 1 + 2 + 3} } But from syntax checker I received error message: "Syntax error: Expected comma after '%{expr:': 1 + 2 + 3}" Is possible use expr in this case? Petr Linke

2 2

Strange behaviour (?) on Windows authentication
by Arnaud Forster 17 May '18

17 May '18

Hello all, I requested a few months ago some help about allowing some specific users being able to connect on specific wifi systems. A received some great help by adding a test to check if the user belongs to the specific group. This works like a charm for computers *not *belonging to the ldap domain.Today, I've another problem with that authentication for a computer belonging to the ldap domain. I made a log and there's something I don't understand. the username is there and correc (MyUserName) but suddenly, before checking if it belongs to the group 'Enseignants' here, the text '*5c5c' *is added to my username. It seems that this is the text 5c5cMyUserName that is checked instead of MyUserName. Can someone understand that ? I've no idea from where comes this '5c5c' text and why this works for computers not belonging to the domain... Really thanks for your help ;) Arnaud (1) Received Access-Request Id 193 from <a wifi system> length 219 (1) User-Name = "MyDomain\\MyUserName" (1) NAS-IP-Address = 10.20.32.34 (1) Called-Station-Id = "00-19-3B-10-8C-00:MyDomain" (1) NAS-Port-Type = Wireless-802.11 (1) Service-Type = Framed-User (1) Calling-Station-Id = "DC-53-60-A5-19-50" (1) Connect-Info = "CONNECT 0Mbps 802.11b" (1) Acct-Session-Id = "929C1E7D46CDEAD7" (1) Acct-Multi-Session-Id = "D8478D373078FF2E" (1) WLAN-Pairwise-Cipher = 1027076 (1) WLAN-Group-Cipher = 1027074 (1) WLAN-AKM-Suite = 1027073 (1) Framed-MTU = 1400 (1) EAP-Message = 0x02a800130145534d415c6c656f6e617264696d (1) Message-Authenticator = 0xa790b757b6ea900d68132242a39287d3 (1) # Executing section authorize from file /etc/raddb/sites-enabled/default (1) authorize { (1) policy rewrite_called_station_id { (1) if (&Called-Station-Id && (&Called-Station-Id =~ /^([0-9a-f]{2})[^0-9a-f]?([0-9a-f]{2})[^0-9a-f]?([0-9a-f]{2})[^0-9a-f]?([0-9a-f]{2})[^0-9a-f]?([0-9a-f]{2})[^0-9a-f]?([0-9a-f]{2})([^0-9a-f](.+))?$/i)) { (1) if (&Called-Station-Id && (&Called-Station-Id =~ /^([0-9a-f]{2})[^0-9a-f]?([0-9a-f]{2})[^0-9a-f]?([0-9a-f]{2})[^0-9a-f]?([0-9a-f]{2})[^0-9a-f]?([0-9a-f]{2})[^0-9a-f]?([0-9a-f]{2})([^0-9a-f](.+))?$/i)) -> TRUE (1) if (&Called-Station-Id && (&Called-Station-Id =~ /^([0-9a-f]{2})[^0-9a-f]?([0-9a-f]{2})[^0-9a-f]?([0-9a-f]{2})[^0-9a-f]?([0-9a-f]{2})[^0-9a-f]?([0-9a-f]{2})[^0-9a-f]?([0-9a-f]{2})([^0-9a-f](.+))?$/i)) { (1) update request { (1) EXPAND %{toupper:%{1}-%{2}-%{3}-%{4}-%{5}-%{6}} (1) --> 00-19-3B-10-8C-00 (1) &Called-Station-Id := 00-19-3B-10-8C-00 (1) } # update request = noop (1) if ("%{8}") { (1) EXPAND %{8} (1) --> MyDomain (1) if ("%{8}") -> TRUE (1) if ("%{8}") { (1) update request { (1) EXPAND %{8} (1) --> MyDomain (1) &Called-Station-SSID := MyDomain (1) } # update request = noop (1) } # if ("%{8}") = noop (1) [updated] = updated (1) } # if (&Called-Station-Id && (&Called-Station-Id =~ /^([0-9a-f]{2})[^0-9a-f]?([0-9a-f]{2})[^0-9a-f]?([0-9a-f]{2})[^0-9a-f]?([0-9a-f]{2})[^0-9a-f]?([0-9a-f]{2})[^0-9a-f]?([0-9a-f]{2})([^0-9a-f](.+))?$/i)) = updated (1) ... skipping else: Preceding "if" was taken (1) } # policy rewrite_called_station_id = updated (1) switch &Called-Station-SSID { (1) case MyDomain{ (1) if (&LDAP-Group != "Enseignants") { (1) Searching for user in group "Enseignants" rlm_ldap (ldap): Reserved connection (1) (1) EXPAND (uid=%{%{Stripped-User-Name}:-%{User-Name}}) (1) *--> (uid=**MyDomain**\**5c5c**MyUsername**)* (1) Performing search in "dc=MyDomain,dc=lan" with filter "(*uid=**MyDomain**\**5c5c**MyUserName*)", scope "sub" (1) Waiting for search result... (1) Search returned no results rlm_ldap (ldap): Released connection (1) (1) if (&LDAP-Group != "Enseignants") -> TRUE (1) if (&LDAP-Group != "Enseignants") { (1) [reject] = reject (1) } # if (&LDAP-Group != "Enseignants") = reject (1) } # case MyDomain= reject (1) } # switch &Called-Station-SSID = reject (1) } # authorize = reject (1) Using Post-Auth-Type Reject (1) # Executing group from file /etc/raddb/sites-enabled/default (1) Post-Auth-Type REJECT { (1) attr_filter.access_reject: EXPAND %{User-Name} (1)*attr_filter.access_reject: --> **MyDomain**\\**MyUserName* (1) attr_filter.access_reject: Matched entry DEFAULT at line 11 (1) [attr_filter.access_reject] = updated (1) eap: Request was previously rejected, inserting EAP-Failure (1) eap: Sending EAP Failure (code 4) ID 168 length 4 (1) [eap] = updated (1) policy remove_reply_message_if_eap { (1) if (&reply:EAP-Message && &reply:Reply-Message) { (1) if (&reply:EAP-Message && &reply:Reply-Message) -> FALSE (1) else { (1) [noop] = noop (1) } # else = noop (1) } # policy remove_reply_message_if_eap = noop (1) } # Post-Auth-Type REJECT = updated (1) Delaying response for 1.000000 seconds Waking up in 0.3 seconds. Waking up in 0.6 seconds. (1) Sending delayed response (1) Sent Access-Reject Id 193 from 10.20.32.11:1812 to 10.20.32.34:36521 length 44 (1) EAP-Message = 0x04a80004 (1) Message-Authenticator = 0x00000000000000000000000000000000 Waking up in 1.3 seconds. (0) Cleaning up request packet ID 192 with timestamp +3

2 3

FreeIPA + Active Directory Integration
by Ed Melendez 17 May '18

17 May '18

Hello All- Not sure if this is within the scope of this list, but I'm trying to figure out the best way to authenticate users who are in a different domain (trusted) than the FreeRADIUS server... FreeRADIUS server - FreeIPA Domain (linux.company.net) User - Windows Domain (corp.company.net) Any help would be greatly appreciated. Thanks, -Ed

2 1

Freeradius - LDAP bind as user
by Giorgos Tsirkas 17 May '18

17 May '18

Hello, I need help about Freeradius and OpenLDAP. When a user connects to a device via freeradius with ldap credentials, i want to bind LDAP with the same credentials. Is there any way? If yes can you give me an example? Thank you.

2 1

unlang & variable
by petr.linke＠seznam.cz 17 May '18

17 May '18

Hi, I need use the value from soh-server and use this value for condition check in the inner virtual server, but it looks, that the variable filled in the soh-server is only local, and is not possible use the value from this variable in the inner virtual server. simple scenario: SOME_ATTR is defined in dictionary as integer in mods-enabled/eap in peap section is enabled soh-server soh = yes soh_virtual_server = "soh-server" server soh-server { ... if (some condition) { update control { SOME_ATTR := some_value } ... } server inner-server { ... if ( &control:SOME_ATTR == 1 ) { do something } in debug I can see, that in the soh-server is filled the variable SOME_ATTR, but in inner-server, when should be evaluated the condition if ( &control: SOME_ATTR == 1 ), I receive error message "ERROR: Failed retrieving values required to evaluate condition". I tried use outer.control in soh-server, but without success. My question: is possible take value defined in soh-server and use this value for condition in inner-server? Thank for any idea, Petr Linke

4 7

Default mysql schema
by Dom Latter 17 May '18

17 May '18

Just a couple of suggestions (which I understand may have been discussed and dismissed before!): For the default mysql schema, have a UNIQUE constraint / key on username / attribute pairs in the applicable tables - most importantly for us this is radcheck. Have a key on username in radpostauth.

3 5

response sent after do_not_respond called
by Geoffrey D. Bennett 17 May '18

17 May '18

Hi there, I'm having trouble getting the do_not_respond policy working in the post-auth section with FreeRADIUS 3.0.17. I've got a minimal testcase, reproduced with an almost-default 3.0.17 config built from (I only disabled EAP, removed EAP references from sites-enabled/default and enabled test user "bob" in mods-config/files/authorize). I can insert do_not_respond at the top of the authorize or authenticate sections, and I get the expected behaviour (no response sent and "Not responding to request", "Not sending reply to client" messages in the "radiusd -X" output). E.g.: authenticate { Auth-Type PAP { do_not_respond ... If I insert do_not_respond at the top of the post-auth section, then an Access-Accept response is sent. E.g.: post-auth { do_not_respond ... Here are the differences between the "radiusd -X" output working vs. not-working: Working (do_not_respond in authenticate section): (0) Found Auth-Type = PAP (0) # Executing group from file .../freeradius-server-3.0.17/raddb/sites-enabled/default (0) Auth-Type PAP { (0) policy do_not_respond { (0) update control { (0) &Response-Packet-Type := Do-Not-Respond (0) } # update control = noop (0) [handled] = handled (0) } # policy do_not_respond = handled (0) } # Auth-Type PAP = handled (0) Not responding to request (0) # Executing section post-auth from file .../freeradius-server-3.0.17/raddb/sites-enabled/default (0) post-auth { (0) update { (0) No attributes updated (0) } # update = noop (0) [exec] = noop (0) } # post-auth = noop (0) Not sending reply to client. (0) Finished request Not working (do_not_respond in post-auth section): (0) Found Auth-Type = PAP (0) # Executing group from file .../freeradius-server-3.0.17/raddb/sites-enabled/default (0) Auth-Type PAP { (0) pap: Login attempt with password (0) pap: Comparing with "known good" Cleartext-Password (0) pap: User authenticated successfully (0) [pap] = ok (0) } # Auth-Type PAP = ok (0) # Executing section post-auth from file .../freeradius-server-3.0.17/raddb/sites-enabled/default (0) post-auth { (0) policy do_not_respond { (0) update control { (0) &Response-Packet-Type := Do-Not-Respond (0) } # update control = noop (0) [handled] = handled (0) } # policy do_not_respond = handled (0) } # post-auth = handled (0) Sent Access-Accept Id 73 from 127.0.0.1:1812 to 127.0.0.1:59268 length 0 (0) Reply-Message = "Hello, bob" (0) Finished request My ultimate goal is to do this conditionally from rlm_perl, such as described here: http://lists.freeradius.org/pipermail/freeradius-users/2015-September/07960… but when I try that, I see the same results as above, which is how I came up with this minimal test case. Thanks, Geoffrey.

3 8

Machine auth using Samba
by Tornóci László 17 May '18

17 May '18

Hi, I am using FR 3.0.13 for eduroam (setting VLAN dynamically, auth is EAP-TTLS/PAP using LDAP). It works very well. Now I am planning to set up wifi access for a couple of dozens of Win 10 laptops. I would like to achieve the following: - automatic machine auth (no user intervention) - only these machines should be able to access the VLAN that is designated for them If possible, I want to have more security than just checking MAC addresses. I know you can do that with AD, however I don't have that. Is it possible and do you recommend to do this kind of thing using samba? I appreciate if you send me tips or point me to good descriptions. Yours: Laszlo

3 3