- Freeradius-Users - lists.freeradius.org

Use LDAP with MySQL
by Charly 12 Apr '18

12 Apr '18

Hello, Do you known how to use LDAP as users database and MySQL for store Cisco-AVPair attributes ? When i only use MySQL it's working : radtest -x test password 127.0.0.1 0 TEST Sent Access-Request Id 75 from 0.0.0.0:32889 to 127.0.0.1:1812 length 81 User-Name = "test" User-Password = "password" NAS-IP-Address = 10.20.20.2 NAS-Port = 0 Message-Authenticator = 0x00 Cleartext-Password = "password" Received Access-Accept Id 75 from 127.0.0.1:1812 to 0.0.0.0:0 length 58 Cisco-AVPair = "ip:inacl#5=permit icmp any any" But i really don't know how to use both Thank for your help Charly

2 4

FreeRadius Server crashed when creating a large number of ipsec gateway tunnels.
by Li Guanqun 12 Apr '18

12 Apr '18

Hi expert, I am trying to create about 260 ipsec gateway tunnels in my femto test environment with FreeRadius(ver.2.2.0) installed. I prerared 1k users on both Femto and FreeRadius server(as "ipsec.db" and "users" file). However, freeRadius Server crashed during creating the 78th tunnel, and only 73 tunnels were created successfully. Can anyone give me some advice on the reason of this symptom ? Is there any limitation for the number of users ? I attached a PPT file to describe in detail, with topology, HW info and logs. If further info is needed, don`t hesitate to let me know. Any advice will be appreciated. Thank you ! Regards, Li

3 7

Public IP Address & static ip over SQL
by Juliano Raymundo dos Santos 12 Apr '18

12 Apr '18

Hi everyone, this is my first post in this fórum, so if I write something and this is ansewred in another time, please tell me. I'm configuring a freeradius server for a ISP provider, and I need to deliver for clients public Ip addresses but this one need to be static at the same time, because is the main poli of the network. I'm using sqlippool for delivery IP addresses for clients but I don't want use this for public IP addresses, just for private. The ippool is working fine. I'm tried to configure at this way the table radcheck: 3 13 juliano ClearText-Password := juliano123 Edit Edit <http://187.85.132.121/phpmyadmin/tbl_change.php?db=radius&table=radcheck&wh…> Copy Copy <http://187.85.132.121/phpmyadmin/tbl_change.php?db=radius&table=radcheck&wh…> Delete Delete <http://187.85.132.121/phpmyadmin/sql.php?db=radius&table=radcheck&sql_query…> 14 juliano Framed-Ip-Address := 191.241.***.*** Edit Edit <http://187.85.132.121/phpmyadmin/tbl_change.php?db=radius&table=radcheck&wh…> Copy Copy <http://187.85.132.121/phpmyadmin/tbl_change.php?db=radius&table=radcheck&wh…> Delete Delete <http://187.85.132.121/phpmyadmin/sql.php?db=radius&table=radcheck&sql_query…> 15 juliano Framed-Route := "191.241.***.***" Edit Edit <http://187.85.132.121/phpmyadmin/tbl_change.php?db=radius&table=radcheck&wh…> Copy Copy <http://187.85.132.121/phpmyadmin/tbl_change.php?db=radius&table=radcheck&wh…> Delete Delete <http://187.85.132.121/phpmyadmin/sql.php?db=radius&table=radcheck&sql_query…> 16 juliano Framed-Netmask := 255.255.255.0 Edit Edit <http://187.85.132.121/phpmyadmin/tbl_change.php?db=radius&table=radcheck&wh…> Copy Copy <http://187.85.132.121/phpmyadmin/tbl_change.php?db=radius&table=radcheck&wh…> Delete Delete <http://187.85.132.121/phpmyadmin/sql.php?db=radius&table=radcheck&sql_query…> 17 juliano Auth-Type := Accept Glad for help, best regards.

2 1

Efficient AD group matching via the new wbclient interface
by Isaac Boukris 12 Apr '18

12 Apr '18

Hello all, I am working on improving AD group matching for mschap authentication, taking advantage of the new wbclient direct interface which returns the user's token (including group membership SIDs) as part of NTLM authentication. Work in progress: https://github.com/frenche/freeradius-server/commit/9af7dfd634a251f68b07064… I'm now thinking on how to implement the caching of group-name to SID mapping with configurable timeout, ideally using existing interface - ideas welcome. @mcnewton, I noticed at last there is a similar group-compare function in v4 branch, though I think the two actually can complete each other. Thoughts? Thank you, Isaac B.

3 9

Catching DB errors in sqlippool
by Бенджамин Томпсон 11 Apr '18

11 Apr '18

Hi I have a test setup consisting of three servers and on each of them is installed FreeRADIUS (3.0.12) and one node of a Percona MySQL cluster. FreeRADIUS is configured to allocate IP addreses from the database using sqlipool. Authentication data is stored elsewhere. The idea was to build a fully redundant system which could cope with loosing one or more nodes of the backend DB. It was very easy to set up and I generated some load with radperf and did some testing and everything generally worked apart from a couple of problems. The first problem I noticed is that when requsts are sent to multiple DB nodes at the same time, the DB sometimes throws a cluster conflict error. This error is picked up by the sqlippool module and this is how it looks in the logs: ERROR: (220) sqlippool: rlm_sql_mysql: ERROR 1213 (WSREP detected deadlock/conflict and aborted the transaction. Try restarting the transaction): 40001 As there was a problem with the transaction I wanted to configure FreeRADIUS either to retry the request to the DB or to silently drop the packet. The problem is that the module returns the code ok: Debug: (220) modsingle[post-auth]: calling sqlippool (rlm_sqlippool) Debug: rlm_sql (sql): Reserved connection (9) Debug: %{User-Name} Debug: Parsed xlat tree: Debug: attribute --> User-Name Debug: (220) sqlippool: EXPAND %{User-Name} Debug: (220) sqlippool: --> testusername111 Debug: (220) sqlippool: SQL-User-Name set to 'testusername111' Debug: START TRANSACTION Debug: Parsed xlat tree: Debug: literal --> START TRANSACTION Debug: (220) sqlippool: EXPAND START TRANSACTION Debug: (220) sqlippool: --> START TRANSACTION Debug: (220) sqlippool: Executing query: START TRANSACTION Debug: SELECT framedipaddress FROM radippool WHERE pool_name = '%{control:Pool-Name}' AND (pool_key = '%{User-Name}' or expiry_time < NOW()) ORDER BY (pool_key <> '%{User-Name}'), expiry_time LIMIT 1 FOR UPDATE Debug: Parsed xlat tree: Debug: literal --> SELECT framedipaddress FROM radippool WHERE pool_name = ' Debug: attribute --> Pool-Name Debug: literal --> ' AND (pool_key = ' Debug: attribute --> User-Name Debug: literal --> ' or expiry_time < NOW()) ORDER BY (pool_key <> ' Debug: attribute --> User-Name Debug: literal --> '), expiry_time LIMIT 1 FOR UPDATE Debug: (220) sqlippool: EXPAND SELECT framedipaddress FROM radippool WHERE pool_name = '%{control:Pool-Name}' AND (pool_key = '%{User-Name}' or expiry_time < NOW()) ORDER BY (pool_key <> '%{User-Name}'), expiry_time LIMIT 1 FOR UPDATE Debug: (220) sqlippool: --> SELECT framedipaddress FROM radippool WHERE pool_name = 'POOL1' AND (pool_key = 'testusername111' or expiry_time < NOW()) ORDER BY (pool_key <> 'testusername111'), expiry_time LIMIT 1 FOR UPDATE Debug: (220) sqlippool: Executing select query: SELECT framedipaddress FROM radippool WHERE pool_name = 'POOL1' AND (pool_key = 'testusername111' or expiry_time < NOW()) ORDER BY (pool_key <> 'testusername111'), expiry_time LIMIT 1 FOR UPDATE Debug: (220) sqlippool: Allocated IP 10.192.0.110 Debug: UPDATE radippool SET nasipaddress = '%{NAS-IP-Address}', pool_key = '%{User-Name}', callingstationid = '%{Calling-Station-Id}', username = '%{User-Name}', expiry_time = NOW() + INTERVAL 3600 SECOND WHERE framedipaddress = '10.192.0.110' Debug: Parsed xlat tree: Debug: literal --> UPDATE radippool SET nasipaddress = ' Debug: attribute --> NAS-IP-Address Debug: literal --> ', pool_key = ' Debug: attribute --> User-Name Debug: literal --> ', callingstationid = ' Debug: attribute --> Calling-Station-Id Debug: literal --> ', username = ' Debug: attribute --> User-Name Debug: literal --> ', expiry_time = NOW() + INTERVAL 3600 SECOND WHERE framedipaddress = '10.192.0.110' Debug: (220) sqlippool: EXPAND UPDATE radippool SET nasipaddress = '%{NAS-IP-Address}', pool_key = '%{User-Name}', callingstationid = '%{Calling-Station-Id}', username = '%{User-Name}', expiry_time = NOW() + INTERVAL 3600 SECOND WHERE framedipaddress = '10.192.0.110' Debug: (220) sqlippool: --> UPDATE radippool SET nasipaddress = '127.0.0.1', pool_key = 'testusername111', callingstationid = 'testusername111', username = 'testusername111', expiry_time = NOW() + INTERVAL 3600 SECOND WHERE framedipaddress = '10.192.0.110' Debug: (220) sqlippool: Executing query: UPDATE radippool SET nasipaddress = '127.0.0.1', pool_key = 'testusername111', callingstationid = 'testusername111', username = 'testusername111', expiry_time = NOW() + INTERVAL 3600 SECOND WHERE framedipaddress = '10.192.0.110' Debug: rlm_sql_mysql: Rows matched: 1 Changed: 1 Warnings: 0 Debug: COMMIT Debug: Parsed xlat tree: Debug: literal --> COMMIT Debug: (220) sqlippool: EXPAND COMMIT Debug: (220) sqlippool: --> COMMIT Debug: (220) sqlippool: Executing query: COMMIT Debug: rlm_sql_mysql: No additional diagnostic info on server ERROR: (220) sqlippool: rlm_sql_mysql: ERROR 1213 (WSREP detected deadlock/conflict and aborted the transaction. Try restarting the transaction): 40001 Debug: rlm_sql (sql): Released connection (9) Debug: Allocated IP: %{reply:Framed-IP-Address} from %{control:Pool-Name} (did %{Called-Station-Id} cli %{Calling-Station-Id} port %{NAS-Port} user %{User-Name}) Debug: Parsed xlat tree: Debug: literal --> Allocated IP: Debug: attribute --> Framed-IP-Address Debug: literal --> from Debug: attribute --> Pool-Name Debug: literal --> (did Debug: attribute --> Called-Station-Id Debug: literal --> cli Debug: attribute --> Calling-Station-Id Debug: literal --> port Debug: attribute --> NAS-Port Debug: literal --> user Debug: attribute --> User-Name Debug: literal --> ) Debug: (220) sqlippool: EXPAND Allocated IP: %{reply:Framed-IP-Address} from %{control:Pool-Name} (did %{Called-Station-Id} cli %{Calling-Station-Id} port %{NAS-Port} user %{User-Name}) Debug: (220) sqlippool: --> Allocated IP: 10.192.0.110 from POOL1 (did cli testusername111 port user testusername111) Debug: (220) modsingle[post-auth]: returned from sqlippool (rlm_sqlippool) Debug: (220) [sqlippool] = ok As the module returns ok I could not see any way to deal with the error. Sometimes I noticed that the SELECT request failed to return an IP address. In this case the module returned notfound and as I understand it I could use some unlang to send the request again (I'm not sure how many times it's wise to to this). However, I also tried to drop the request by calling do_not_respond when Framed-IP-Address is empty, but I found that this did not prevent the request from being sent: Debug: (222) if (!&reply:Framed-IP-Address) { Debug: (222) if (!&reply:Framed-IP-Address) -> TRUE Debug: (222) if (!&reply:Framed-IP-Address) { Debug: (222) policy do_not_respond { Debug: (222) update control { Debug: (222) &Response-Packet-Type := Do-Not-Respond Debug: (222) } # update control = noop Debug: (222) modsingle[post-auth]: calling handled (rlm_always) Debug: (222) modsingle[post-auth]: returned from handled (rlm_always) Debug: (222) [handled] = handled Debug: (222) } # policy do_not_respond = handled Debug: (222) } # if (!&reply:Framed-IP-Address) = handled Debug: (222) } # post-auth = handled Debug: | %{reply:Framed-IP-Address} Debug: Parsed xlat tree: Debug: literal --> | Debug: attribute --> Framed-IP-Address Debug: (222) EXPAND | %{reply:Framed-IP-Address} Debug: (222) --> | Auth: (222) Login OK: [testusername112/testpassword112] (from client localhost port 0 cli testusername112) | Debug: (222) Sent Access-Accept Id 28 from 127.0.0.1:1812 to 127.0.0.1:54122 length 0 I would be grateful for any help or advice on these issues.

2 4

Clients in virtual servers
by Stanislav Lorenc 11 Apr '18

11 Apr '18

Hi Adam, i assign to every radius client separeted IP address a this work fine. It is clear solution. Thanks for your help and suggestion. Best Regards, Stanislav Lorenc

1 0

RADIUS wifi not working on Windows with domain users
by Forster Arnaud 10 Apr '18

10 Apr '18

Hello all, I've a problem in a school with computers connected to the school domain (I'm using samba). For private computers, there's no worry ; they are asked to enter a username/password to connect to the wifi and this works fine. But for laptops belonging to the domain, when I try to connect, no username/password is requested and the connection just fail. It seems this is a windows problem but I wonder If I can don something from the freeradius side ... thanks to all for your help -- Meilleures salutations – Freundliche Grüsse – Best regards MW*PROGRAMMATION*SA *Arnaud Forster* /Ingénieur systèmes// //Rue Charles Schäublin 2/ /CH-2735 Malleray/ /phone: +41 (0)32 491 65 30/ /fax: +41 (0)32 491 65 35/ /web: www.mwprog.ch <http://www.mwprog.ch/>/ /kb: kb.mwprog.ch <http://kb.mwprog.ch/>/

5 9

Clients in virtual servers
by Stanislav Lorenc 10 Apr '18

10 Apr '18

On 9 Apr 2018, at 17:11, Stanislav Lorenc <stanislav.lorenc at cernovice.net <http://lists.freeradius.org/mailman/listinfo/freeradius-users>> wrote: >/i register NAS clients into two virtual servers with the same ip and this fall with duplicate error. / The error is intended - you've added a duplicate client. >/Is there way how to register NAS clients separately. / That's not possible, but what behaviour would you be expecting? Packets randomly assigned to a virtual server? Packets to be sent to both virtual servers simultaneously and two responses returned? Adam Bishop gpg: E75B 1F92 6407 DFDF 9F1C BF10 C993 2504 6609 D460 jisc.ac.uk Jisc is a registered charity (number 1149740) and a company limited by guarantee which is registered in England under Company No. 5747339, VAT No. GB 197 0632 86. Jisc’s registered office is: One Castlepark, Tower Hill, Bristol, BS2 0JA. T 0203 697 5800. Jisc Services Limited is a wholly owned Jisc subsidiary and a company limited by guarantee which is registered in England under company number 2881024, VAT number GB 197 0632 86. The registered office is: One Castle Park, Tower Hill, Bristol BS2 0JA. T 0203 697 5800. -------------------------------------------- -------------------------------------------- -------------------------------------------- Hi i expect if packet is send to concrete virtual server on concrete port will be process within this server. I use radius in mikrotik and i have multiple radius account in mikrotik for different services. Look like this: /radius add address=192.168.1.100 authentication-port=9999 realm=cernovice_net secret=test service=login timeout=3s < -- Check user access to device add address=192.168.1.100 authentication-port=1111 realm=ppp secret=test service=ppp timeout=3s <-- check users for pppoe services One server for ppp services with realm ppp and second server for user access to device. For different purposes i have different virtual servers with own business logic and users separate in virtual server. This device send request from one management IP. More IP is possible but confusing. Problem is occurred if device send packet from port 9999 for check access to device and client is registered in first virtual host(port 1111 - ppp services). Request is process within ppp virtual server instead of login virtual server Mikrotik Log: -> send request to 9999 09:33:58 radius,debug new request 0d:02 code=Access-Request service=login 09:33:58 radius,debug sending 0d:02 to 192.168.1.100:9999 09:33:58 radius,debug,packet sending Access-Request with id 2 to 192.168.1.100:9999 09:33:58 radius,debug,packet Signature = 0x268b43fc121da2883c30f476ee137502 09:33:58 radius,debug,packet Service-Type = 1 09:33:58 radius,debug,packet User-Name = "lorenc" 09:33:58 radius,debug,packet CHAP-Challenge = 0xe593b52e5739b57a979f8a40629e19d2 09:33:58 radius,debug,packet CHAP-Password = 0x0018ab7cf3a5fb9364723bc9343dd086 09:33:58 radius,debug,packet 10 09:33:58 radius,debug,packet Calling-Station-Id = "30:5A:3A:02:ED:BB" 09:33:58 radius,debug,packet NAS-Identifier = "male_rb_test" 09:33:58 radius,debug,packet MT-Realm = 0x6365726e6f766963655f6e6574 09:33:58 radius,debug,packet NAS-IP-Address = 192.168.1.223 09:33:59 radius,debug,packet received Access-Reject with id 2 from 192.168.1.100:9999 09:33:59 radius,debug,packet Signature = 0x27f48d656775fe94bd345924a9988c11 09:33:59 radius,debug received reply for 0d:02 Radius output executed by /etc/freeradius/sites-enabled/test_local_ppp_services.virtual_server.conf ( ppp services and client register inside this virtual server): Tue Apr 10 10:17:23 2018 : Info: Ready to process requests. rad_recv: Access-Request packet from host 192.168.1.223 port 51032, id=10, length=131 Service-Type = Login-User User-Name = "lorenc" CHAP-Challenge = 0x7f54c88e8ff8a895b536c9e4f26f43ba CHAP-Password = 0x0079373826d8a430860427d8691478870e Calling-Station-Id = "30:5A:3A:02:ED:BB" NAS-Identifier = "male_rb_test" Mikrotik-Realm = "cernovice_net" NAS-IP-Address = 192.168.1.223 Tue Apr 10 10:17:28 2018 : Info: server test_local_ppp_services { Tue Apr 10 10:17:28 2018 : Info: # Executing section authorize from file /etc/freeradius/sites-enabled/test_local_ppp_services.virtual_server.conf Tue Apr 10 10:17:28 2018 : Info: +group authorize { Tue Apr 10 10:17:28 2018 : Info: ++[preprocess] = ok Tue Apr 10 10:17:28 2018 : Info: [chap] Setting 'Auth-Type := CHAP' Tue Apr 10 10:17:28 2018 : Info: ++[chap] = ok Tue Apr 10 10:17:28 2018 : Info: ++[mschap] = noop Tue Apr 10 10:17:28 2018 : Info: [test_local_ppp_services_sql] expand: %{User-Name} -> lorenc Tue Apr 10 10:17:28 2018 : Info: [test_local_ppp_services_sql] sql_set_user escaped user --> 'lorenc' Tue Apr 10 10:17:28 2018 : Debug: rlm_sql (test_local_ppp_services_sql): Reserving sql socket id: 3 ... If i register NAS client to the right virtual server - it is executed correctly. So i need make two or more separated clients list for each virtual server. Stanislav Lorenc

2 1

Clients in virtual servers
by Stanislav Lorenc 09 Apr '18

09 Apr '18

Hello, i register NAS clients into two virtual servers with the same ip and this fall with duplicate error. First registration: Mon Apr 9 17:21:59 2018 : Debug: rlm_sql_postgresql: query affected rows = 1 , fields = 6 Mon Apr 9 17:21:59 2018 : Debug: rlm_sql (test_local_auth_sql): Read entry nasname=192.168.1.223,shortname=test_local_auth=::male_rb_test::ether2::192.168.1.223,secret=test Mon Apr 9 17:21:59 2018 : Debug: rlm_sql (test_local_auth_sql): Adding client 192.168.1.223 (test_local_auth::male_rb_test::ether2::192.168.1.223, server=test_local_auth) to clients list and second virtual server registration: Mon Apr 9 17:37:38 2018 : Debug: rlm_sql_postgresql: query affected rows = 1 , fields = 6 Mon Apr 9 17:37:38 2018 : Debug: rlm_sql (test_local_test_sql): Read entry nasname=192.168.1.223,shortname=test_local_test::male_rb_test::ether2::192.168.1.223,secret=test Mon Apr 9 17:37:38 2018 : Debug: rlm_sql (test_local_test_sql): Adding client 192.168.1.223 (test_local_test::male_rb_test::ether2::192.168.1.223, server=test_local_test) to clients list Mon Apr 9 17:37:38 2018 : Error: Failed to add duplicate client test_local_test::male_rb_test::ether2::192.168.1.223 I check source code and registration and every virtual server has own client list. Virtual server names in register info are different. But it look like clients are registred into global list. Is there way how to register NAS clients separately. Thanks Best Regards, Stanislav Lorenc

2 1

freeradius + NTLM + samba AD 4.5.x
by Dr. Peer-Joachim Koch 09 Apr '18

09 Apr '18

Hi, we have updated our samba AD domain from 4.4.x to 4.5.x. The release notes for 4.5.0 included "NTLMv1 authentication disabled by default". So we had to enable it to get our radius (freeradius) server working (for 802.1x). What would be the best way to change the freeradius configuration in such a way, that we can disable NTLMv1 again. The radius server is used for WLAN (802.1x) and for VPN. -- Bye, Peer ________________________________________________________ Max-Planck-Institut für Biogeochemie Dr. Peer-Joachim Koch Hans-Knöll Str.10 Telefon: ++49 3641 57-6705 D-07745 Jena Telefax: ++49 3641 57-7705

6 5