- Freeradius-Users - lists.freeradius.org

update control and reply in 1 php page
by تعلم البرمجة 30 Apr '18

30 Apr '18

hello , I am using freeradius 3.0.11 and iam using this : update{ control: += `/usr/bin/php5.6 /var/www/html/update.php %{User-Name} %{User-Password} 1` } update{ reply: += `/usr/bin/php5.6 /var/www/html/update.php %{User-Name} %{%{User-Password}} 2 ` } update.php <?php $user = @$argv[1]; $pass = @$argv[2]; $val = @$argv[3]; if ($val == 1){ echo "Framed-Pool :=pool1\n"; }else{ echo "Reply-Message :=Hello '\n"; } ?> but this code is very slow and i want do this update{ `/usr/bin/php5.6 /var/www/html/update.php %{User-Name} %{User-Password} 1` } update.php <?php $user = @$argv[1]; $pass = @$argv[2]; $val = @$argv[3]; if ($val == 1){ echo " control: += \n Framed-Pool :=pool1\n"; }else{ echo " reply: += \n Reply-Message :=Hello '\n"; } Sorry for my english

4 5

Access to the attributes lists in different sections
by work vlpl 30 Apr '18

30 Apr '18

Hello, I use rlm_python module to query information about supplicant from backend database and based on retrieved data decide what to do next with request. Also some of data retrieved from database go to a log. Some of requests are eap, and use inner tunnel virtual site. To prevent double log records (one from inner tunnel and one from "outer" virtual site) I do log operation (linelog module) only in "outer" virtual site. And pass necessary data from inner tunnel by using update outer.session-state { ... } I not use reply list, to store necessary data, because python module can set Proxy-To-Realm attribute and redirect some of request to home server (do proxy operation), and after received reply from proxy, freeradius server replace original reply with reply from home server. outer.session-state works for the most of cases, but not work for eap-ttls request, that will be proxied and rejected by home server. For example this is network config for eapol_test util network={ key_mgmt=WPA-EAP eap=TTLS identity="testing_remote" anonymous_identity="anonymous" phase2="autheap=MSCHAPV2" ... } Freeradius server configured to proxy only inner stage, after real identity is revealed. After the home server rejects the request, freeradius server clear session-state list in "outer" virtual site, and I can not access in in Post-Auth-Type REJECT section. To mitigate this I copy necessary data from session-state to control list in post-proxy section update control { Some-Attribute := &session-state:Some-Attribute } And control attributes list is available in Post-Auth-Type REJECT section. And this is basically works. My question is - Is there other way or attribute list, to store some data during full radius authentication session (until freeradius send Access-Reject reply), to be get able access to stored data from all sections (authorize, post-auth, Post-Auth-Type REJECT, pre-proxy, post-proxy etc.)? Or maybe there is a way to configure freeradius to not clear session-state list after Access-Reject reply from home server? -- Vladimir

2 7

Radius crashing with "Failed adding event handler for socket: Too many readers"
by Campbell McKenzie 30 Apr '18

30 Apr '18

Hello, I'm running Free Radius 3.0.16 on Redhat 7 and the about once or 10 times a day the service will "crash" (Exit with error code 1) with the error message "Failed adding event handler for socket: Too many readers". The only messages prior to Radius crashing are: Mar 19 21:37:34 radius1.acme.com radiusd[11344]: ... adding new socket proxy address 202.AA.BB.CC port 57158 Mar 19 21:37:34 radius1.acme.com radiusd[11344]: ... adding new socket proxy address 202.AA.BB.CC port 57158 Mar 19 21:37:34 radius1.acme.com radiusd[11344]:Failed adding event handler for socket: Too many readers Then systemd picks up the failure: Mar 19 21:37:34 radius1.acme.com systemd:radiusd.service: main process exited, code=exited, status=1/FAILURE Mar 19 21:37:34 radius1.acme.com systemd:Unit radiusd.service entered failed state. Mar 19 21:37:34 radius1.acme.com systemd:radiusd.service failed. Our configuration consists of about 157 home_servers (mostly running in auth+acct) and about 276 clients and two upstream proxies. (Eduroam). It seems like a new socket is created for each home_server (auth) + another socket for accounting and with such a high(?) number of home_servers we are running out of sockets (possibly). Is there a limit to the number of home_servers and/or clients? Kind regards, Campbell Campbell McKenzie AARNet Pty Ltd address: Tenancy 1, Ground Floor, 143 Coronation Drive, Milton, QLD, 4064, Australia postal: PO Box 1787, Milton, Qld, 4064 w. www.aarnet.edu.au

2 5

auth and detail logs into json format?
by J E H A N Z A I B 30 Apr '18

30 Apr '18

Hi folks, Is there anyway i can get auth-detail , linelog and detail logs into json instead of plain text ? so currently i have detail reply_log { #filename = ${radacctdir}/auth-detail-%Y%m%d filename = ${radacctdir}/auth-detail.log permissions = 0600 } if there is a way i can atleast convert these auth logs into json format? -- Regards, Jehanzaib

6 14

Authentication against Google Apps domain
by Matt Paska 27 Apr '18

27 Apr '18

Hello, I'm looking for steps to configure a wireless network for WPA2-Enterprise encryption with 802.1X authentication against Google Apps domain. With this, your users should be able to use their Google Apps credentials to access secure wireless network. EAP-TTLS/PAP devices. Similar to what is detailed here ( https://wiki.freeradius.org/guide/Enterprise-WiFi) using configuration files for iOS devices and Mac OS computers. Thanks!

1 0

What is the magic to see the Windows User as DOMAIN\user
by Nick Howitt 27 Apr '18

27 Apr '18

I'm sorry for posting this here as it is really a Windows question but it is driving me scatty trying to authenticate with a Windows client. I only seem to get the User-Name come through with machine credentials like host/machine_name.DOMAIN. For the life of me I can't see how to switch Win10 to pass a real user name through to Radius like DOMAIN\user. There must be a setting in Windows which I am overlooking. Can anyone please help? Thanks, Nick

2 1

Using unlang / SQL with single return value; couple of questions.
by Dom Latter 27 Apr '18

27 Apr '18

(This is partly a continuation of the thread "Perl vs. python vs. Lua?" started late February) [1]. First thanks to Alan for pointing me in the right direction. I thought I would describe the process for the benefit of others. Basically we need to assign wifi users a VLAN based on their location and username. If they are rejected we want to put a reason in the Reply-Message (and this *should* in due course end up in the line log and the postauth table). We have been using a PHP script. To replace it I have put the bulk of the logic in to the SELECT clause of the SQL query. If there's a "normal" VLAN available it's in the range 1 to 4096. Return codes 5000 to 5005 indicate "accepted" but with special conditions. Return codes 5010 to 5014 indicate "reject". Return codes above 10000 indicate a VLAN applied a different way, and so on. So in in our default server in the post-auth block we have (for example): update control { CustomVal := "%{sql:SELECT \ CASE \ WHEN (cs_suspended.value = '1') THEN 5010 \ WHEN (u.deleted != '0') THEN 5011 \ // etc Then the unlang code "decodes" the return value: if ( &control:XL-Vlan < 5000 ) { update reply { Filter-Id := &control:CustomVal Reply-Message += "Accept: MAC found." } } elsif (.... So I have managed quite okay without the map functionality of version 4; in fact, as the query should cache quite nicely it's possible that it's much better to put as much logic as possible into the query... I hope the above is reasonably clear - I have done my best with the time available! 1st question: I am currently using a REGEXP in the query to perform a partial match and would prefer to use a LIKE '%foo%' instead... but the % wildcard seems to conflict with freeradius's own substitution. Anybody know a workaround? 2nd question: we use a "magic" MAC address for non-wifi authentication; which contains for no good reason, an exclamation mark. The problem is that in the query the '%{request:Calling-Station-Id} gets expanded such that the '!' becomes '=21'. So my WHEN clause in the SELECT has to match on '=21'. Any workarounds so that the SQL query would see the "real" value? [1] I only do this gig part-time and only part of *that* is spent on freeradius development,

2 3

Are config and control list equal?
by work vlpl 26 Apr '18

26 Apr '18

Hello, The documentation/wiki for rlm_python module https://wiki.freeradius.org/modules/Rlm_python says, that module can return tuple of 3 elements (return code, reply attributes, config attributes) For debug purposes I added additional instructions in raddb/polici.d/debug debug_config { if("%{debug_attr:config:}" == '') { noop } } And noticed in debug output this (6) policy debug_config { (6) if ("%{debug_attr:config:}" == '') { (6) Attributes matching "config:" (6) &control:Auth-Type = MS-CHAP (6) &control:Cleartext-Password = testing (6) EXPAND %{debug_attr:config:} (6) --> (6) if ("%{debug_attr:config:}" == '') -> TRUE (6) if ("%{debug_attr:config:}" == '') { (6) [noop] = noop (6) } # if ("%{debug_attr:config:}" == '') = noop (6) } # policy debug_config = noop and debug_control policy return the same results (6) policy debug_control { (6) if ("%{debug_attr:control:}" == '') { (6) Attributes matching "control:" (6) &control:Auth-Type = MS-CHAP (6) &control:Cleartext-Password = testing (6) EXPAND %{debug_attr:control:} (6) --> (6) if ("%{debug_attr:control:}" == '') -> TRUE (6) if ("%{debug_attr:control:}" == '') { (6) [noop] = noop (6) } # if ("%{debug_attr:control:}" == '') = noop (6) } # policy debug_control = noop Is this means what control and config lists are equal?

2 1

Issue with EAP authentication on packet loss
by jm+freeradiususer＠roth.lu 26 Apr '18

26 Apr '18

Hello, We have a problem when packet loss occurs at step #4 of the EAP dialogue: 1) Access-Request 2) Access-Challenge 3) Access-Request 4) Accept or Reject (in this case: Access-Accept) 5) Access-Request (duplicate) 6) Reject In this case, #4 is sent by the server but gets lost on its way to the NAS. I've managed to reproduce using iptables dropping the packet. So after some time the NAS sends packet #3 again. At that point I am getting "No EAP session matching state" from the eap module in the "authenticate" section and the request is rejected. This is consistent with what we see in step #4 (upon sending the Access-Accept which gets lost), namely this: (1) eap : Expiring EAP session with state 0x2f8521a02f84259c (1) eap : Finished EAP session with state 0x2f8521a02f84259c (1) eap : Previous EAP request found for state 0x2f8521a02f84259c, released from the list Who's at fault? How do you solve this (except for not using UDP)? Do you set aggressive timeouts/retries on the NAS? Thanks, Marki

5 14

radreply is not queried
by Charly 26 Apr '18

26 Apr '18

Hello, I don't understand why radreply table is not queried whereas radgroupreply is queried : (0) authorize { (0) [preprocess] = ok (0) sql: EXPAND %{User-Name} (0) sql: --> john (0) sql: SQL-User-Name set to 'john' rlm_sql (sql): Reserved connection (0) (0) sql: EXPAND SELECT id, username, attribute, value, op FROM radcheck WHERE username = '%{SQL-User-Name}' ORDER BY id (0) sql: --> SELECT id, username, attribute, value, op FROM radcheck WHERE username = 'john' ORDER BY id (0) sql: Executing select query: SELECT id, username, attribute, value, op FROM radcheck WHERE username = 'john' ORDER BY id (0) sql: EXPAND SELECT groupname FROM radusergroup WHERE username = '%{SQL-User-Name}' ORDER BY priority (0) sql: --> SELECT groupname FROM radusergroup WHERE username = 'john' ORDER BY priority (0) sql: Executing select query: SELECT groupname FROM radusergroup WHERE username = 'john' ORDER BY priority (0) sql: User found in the group table (0) sql: EXPAND SELECT id, groupname, attribute, Value, op FROM radgroupcheck WHERE groupname = '%{sql-SQL-Group}' ORDER BY id (0) sql: --> SELECT id, groupname, attribute, Value, op FROM radgroupcheck WHERE groupname = 'common' ORDER BY id (0) sql: Executing select query: SELECT id, groupname, attribute, Value, op FROM radgroupcheck WHERE groupname = 'common' ORDER BY id (0) sql: Group "common": Conditional check items matched (0) sql: Group "common": Merging assignment check items (0) sql: EXPAND SELECT id, groupname, attribute, value, op FROM radgroupreply WHERE groupname = '%{sql-SQL-Group}' ORDER BY id (0) sql: --> SELECT id, groupname, attribute, value, op FROM radgroupreply WHERE groupname = 'common' ORDER BY id (0) sql: Executing select query: SELECT id, groupname, attribute, value, op FROM radgroupreply WHERE groupname = 'common' ORDER BY id (0) sql: Group "common": Merging reply items Thank for your help Charly

2 2