- Freeradius-Users - lists.freeradius.org

DHCP in FreeRadius 3 and logging
by Thore Krüss 28 Mar '18

28 Mar '18

Good evening, we are running a freeradius 3.0.12+dfsg-5+deb9u1 (debian stretch package). After a bit of hassle I got the dhcp module to work with the sql ippool and the general authentication. The only thing I'm missing now is a feature logging the assigned leases into the journal (authentication logging is working fine). I assumed the section in mods-enabled (see below) would do so, but apparently it doesn't. In the configuration for the dhcp virtual host I've also found no parameters which should enable logging. For convenience I've also appended the log section of freeradius -X. The log destination is set to syslog. Any help why the dhcp module does no logging or which option is missing is really appreciated. Best regards Thore ``` /etc/freeradius/3.0/mods-enabled/dhcpippool ------------------------------------------- sqlippool dhcp_sqlippool { sql_module_instance = "sql" ippool_table = "radippool" lease_duration = 7200 # Client's MAC address is mapped to Calling-Station-Id in policy.conf pool_key = "%{Calling-Station-Id}" # Use queries modified for postgres $INCLUDE ${modconfdir}/sql/ippool-dhcp/queries.conf sqlippool_log_exists = "DHCP: Existing IP: %{reply:Framed-IP-Address} (did %{Called-Station-Id} cli %{Calling-Station-Id} port %{NAS-Port} user %{User-Name})" sqlippool_log_success = "DHCP: Allocated IP: %{reply:Framed-IP-Address} from %{control:Pool-Name} (did %{Called-Station-Id} cli %{Calling-Station-Id} port %{NAS-Port} user %{User-Name})" sqlippool_log_clear = "DHCP: Released IP %{Framed-IP-Address} (did %{Called-Station-Id} cli %{Calling-Station-Id} user %{User-Name})" sqlippool_log_failed = "DHCP: IP Allocation FAILED from %{control:Pool-Name} (did %{Called-Station-Id} cli %{Calling-Station-Id} port %{NAS-Port} user %{User-Name})" sqlippool_log_nopool = "DHCP: No Pool-Name defined (did %{Called-Station-Id} cli %{Calling-Station-Id} port %{NAS-Port} user %{User-Name})" } ``` ``` /etc/freeradius/3.0/sites-enabled/dhcp (this is just the template) ------------------------------------------------------------------ server dhcp { listen { type = dhcp ipaddr = {{ ansible_default_ipv4.address }} src_ipaddr = {{ ansible_default_ipv4.address }} port = 67 interface = {{ ansible_default_ipv4.interface }} broadcast = no } dhcp DHCP-Discover { update reply { DHCP-Message-Type = DHCP-Offer } update control { &Pool-Name := "%{sql: SELECT pool_name FROM radpostauth WHERE callingstationid ILIKE replace('%{&DHCP-Client-Hardware-Address}', ':','') AND pool_name != '' ORDER BY authdate DESC LIMIT 1;}" } dhcp_sqlippool update reply { &DHCP-Domain-Name-Server = 141.70.124.5 &DHCP-Subnet-Mask = 255.255.255.252 &DHCP-Router-Address = "%{sql:SELECT framedroute FROM radippool WHERE callingstationid = '%{&DHCP-Client-Hardware-Address}' LIMIT 1;}" &DHCP-IP-Address-Lease-Time = 3600 &DHCP-DHCP-Server-Identifier = {{ ansible_default_ipv4.address }} } ok } dhcp DHCP-Request { update reply { &DHCP-Message-Type = DHCP-Ack } update control { &Pool-Name := "%{sql: SELECT pool_name FROM radpostauth WHERE callingstationid ILIKE replace('%{&DHCP-Client-Hardware-Address}', ':','') AND pool_name != '' ORDER BY authdate DESC LIMIT 1;}" } dhcp_sqlippool update reply { &DHCP-Domain-Name-Server = 141.70.124.4 &DHCP-Subnet-Mask = 255.255.255.252 &DHCP-Router-Address = "%{sql:SELECT framedroute FROM radippool WHERE callingstationid = '%{&DHCP-Client-Hardware-Address}' LIMIT 1;}" &DHCP-IP-Address-Lease-Time = 3600 &DHCP-DHCP-Server-Identifier = {{ ansible_default_ipv4.address }} } ok } dhcp DHCP-Decline { update reply { &DHCP-Message-Type = DHCP-Do-Not-Respond } reject } dhcp DHCP-Inform { update reply { &DHCP-Message-Type = DHCP-Do-Not-Respond } reject } dhcp DHCP-Release { update reply { &DHCP-Message-Type = DHCP-Do-Not-Respond } reject } } ``` from freeradius -X ``` log { stripped_names = yes auth = yes auth_badpass = no auth_goodpass = no colourise = yes msg_denied = "You are already logged in - access denied" } ```

2 1

Airspace dictionary
by Michal Gust 27 Mar '18

27 Mar '18

Hello everybody, I just want to point out that Cisco in their documentation publish few more attributes then they are in the dictionary.airspace in FreeRadius 3.0. It would be nice if somebody kindly updates the dictionary. https://www.cisco.com/c/en/us/td/docs/wireless/controller/8-5/config-guide/… Best Regards, Michal Gust

2 1

Change Packet-Type after proxy
by Bryce Meyer 27 Mar '18

27 Mar '18

I am running Freeradius 2.2.8 on Ubuntu 16.04. Is it possible to change the Packet Type after a proxy response? My goal is to query my home server, then if it rejects, id like to change that reject to accept and change some other attributes as well. I have it working to get a response from home server and I can change attributes but no the packet type. Any help would be greatly appreciated. Thank you, Bryce

2 3

AcctSessionTime missing in Interims-Update / calculated by FR
by Michael Markstaller 27 Mar '18

27 Mar '18

Hi, FR: 2.1.12 on Debian I have a probably easy and stupid problem: The Cisco ASA (5525-X, 9.4.4) doesn't send AcctSessionTime in "Interim-Update" so I want FR to just calculate it to be able to purge stale sessions (by a sep. cronjob) The f* ASA also doesn't send updates more than once an hour, so debugging is very time-consuming.. I have changed in /etc/freeradius/sql_log: --- cut --- Interim-Update = "UPDATE ${acct_table} \ SET AcctSessionTime = unix_timestamp(now()) - unix_timestamp(acctstarttime), \ AcctInputOctets = '%{Acct-Input-Octets}', \ AcctOutputOctets = '%{Acct-Output-Octets}' \ WHERE AcctSessionId = '%{Acct-Session-Id}' \ AND UserName = '%{User-Name}';" --- cut --- but it doesn't work, AcctSesssionTime in DB stays at 0 - though the remainder works still fine and logs to MySQL.. Any hints? Michael

3 7

Run time variable in sql
by rob-ml＠mailbox.org 27 Mar '18

27 Mar '18

Hey list, after problems in an older version I changed to the newest one (3.0.16). Now the attributes are processed but not delivered correctly. I want to process %{Actual-Data-Rate-Downstream} and set it as attribute Huawei-Output-Average-Rate. +-----------+----------------------------+----+------------------------------------------+ | groupname | attribute | op | value | +-----------+----------------------------+----+------------------------------------------+ | 50m | Huawei-Input-Average-Rate | = | `%{request:Actual-Data-Rate-Upstream}00` | | 50m | Huawei-Output-Average-Rate | = | `%{request:Actual-Data-Rate-Downstream}00` | +-----------+----------------------------+----+------------------------------------------+ Debug looks OK: Expand of attribute: (96) sql: EXPAND `%{request:Actual-Data-Rate-Upstream}00` (96) sql: --> `4199900` But it is allready 0: Result to the client/bras: (96) Huawei-Input-Average-Rate = 0 it sure is just a simpler one, but I can not find it, like a quote error or anything Best wishes Rob Sample Debug: (96) Received Access-Request Id 22 from <brasip>:1812 to radiusip:1812 length 362 (96) User-Name = "user123" (96) User-Password = "userpasschap" (96) NAS-Port = 3166215 (96) NAS-IP-Address = <brasip> (96) Service-Type = Framed-User (96) Framed-Protocol = PPP (96) Calling-Station-Id = "<cpemac>" (96) NAS-Identifier = "bras3" (96) NAS-Port-Type = Ethernet (96) NAS-Port-Id = "10.126.41.171/0.0.0.0 eth 2/7" (96) Acct-Session-Id = "bras30030342352307b37b9d003a40" (96) Connect-Info = "1000000000" (96) Huawei-Startup-Stamp = 1516351868 (96) Huawei-IPHost-Addr = "255.255.255.255 <cpemac>" (96) Huawei-Connect-ID = 14912 (96) Huawei-Version = "Huawei NE20E" (96) Huawei-Product-ID = "NE20E" (96) Huawei-Domain-Name = "example.com" (96) Huawei-User-Mac = "<cpemac>" (96) ADSL-Agent-Circuit-Id = 0x31302e3132362e34safasghasdasfasd2e302e302065746820322f37 (96) ADSL-Agent-Remote-Id = 0x4445552asdasfasdasd441472e414d525436 (96) Actual-Data-Rate-Upstream = 41999 (96) Actual-Data-Rate-Downstream = 109066 (96) Access-Loop-Encapsulation = 0x010000 (96) # Executing section authorize from file /usr/local/freeradius3/etc/raddb/sites-enabled/default (96) authorize { (96) policy filter_username { (96) if (&User-Name) { (96) if (&User-Name) -> TRUE (96) if (&User-Name) { (96) if (&User-Name =~ / /) { (96) if (&User-Name =~ / /) -> FALSE (96) if (&User-Name =~ /@[^@]*@/ ) { (96) if (&User-Name =~ /@[^@]*@/ ) -> FALSE (96) if (&User-Name =~ /\.\./ ) { (96) if (&User-Name =~ /\.\./ ) -> FALSE (96) if ((&User-Name =~ /@/) && (&User-Name !~ /(a)(.+)\.(.+)$/)) { (96) if ((&User-Name =~ /@/) && (&User-Name !~ /(a)(.+)\.(.+)$/)) -> FALSE (96) if (&User-Name =~ /\.$/) { (96) if (&User-Name =~ /\.$/) -> FALSE (96) if (&User-Name =~ /(a)\./) { (96) if (&User-Name =~ /(a)\./) -> FALSE (96) } # if (&User-Name) = notfound (96) } # policy filter_username = notfound (96) [preprocess] = ok (96) [chap] = noop (96) suffix: Checking for suffix after "@" (96) suffix: Looking up realm "example.com" for User-Name = "user123" (96) suffix: No such realm "example.com" (96) [suffix] = noop (96) sql: EXPAND %{User-Name} (96) sql: --> user123 (96) sql: SQL-User-Name set to 'user123' rlm_sql (sql): Reserved connection (113) (96) sql: EXPAND SELECT id, username, attribute, value, op FROM radcheck WHERE username = '%{SQL-User-Name}' ORDER BY id (96) sql: --> SELECT id, username, attribute, value, op FROM radcheck WHERE username = 'user123' ORDER BY id (96) sql: Executing select query: SELECT id, username, attribute, value, op FROM radcheck WHERE username = 'user123' ORDER BY id (96) sql: User found in radcheck table (96) sql: Conditional check items matched, merging assignment check items (96) sql: Cleartext-Password := "userpasschap" (96) sql: EXPAND SELECT id, username, attribute, value, op FROM radreply WHERE username = '%{SQL-User-Name}' ORDER BY id (96) sql: --> SELECT id, username, attribute, value, op FROM radreply WHERE username = 'user123' ORDER BY id (96) sql: Executing select query: SELECT id, username, attribute, value, op FROM radreply WHERE username = 'user123' ORDER BY id (96) sql: EXPAND SELECT groupname FROM radusergroup WHERE username = '%{SQL-User-Name}' ORDER BY priority (96) sql: --> SELECT groupname FROM radusergroup WHERE username = 'user123' ORDER BY priority (96) sql: Executing select query: SELECT groupname FROM radusergroup WHERE username = 'user123' ORDER BY priority (96) sql: User found in the group table (96) sql: EXPAND SELECT id, groupname, attribute, Value, op FROM radgroupcheck WHERE groupname = '%{SQL-Group}' ORDER BY id (96) sql: --> SELECT id, groupname, attribute, Value, op FROM radgroupcheck WHERE groupname = 'dyn' ORDER BY id (96) sql: Executing select query: SELECT id, groupname, attribute, Value, op FROM radgroupcheck WHERE groupname = 'dyn' ORDER BY id (96) sql: Group "dyn": Conditional check items matched (96) sql: Group "dyn": Merging assignment check items (96) sql: Pool-Name := "DIALPOOL-DYN-1" (96) sql: EXPAND SELECT id, groupname, attribute, value, op FROM radgroupreply WHERE groupname = '%{SQL-Group}' ORDER BY id (96) sql: --> SELECT id, groupname, attribute, value, op FROM radgroupreply WHERE groupname = 'dyn' ORDER BY id (96) sql: Executing select query: SELECT id, groupname, attribute, value, op FROM radgroupreply WHERE groupname = 'dyn' ORDER BY id (96) sql: Group "dyn": Merging reply items (96) sql: MS-Primary-DNS-Server = <primarydns> (96) sql: MS-Secondary-DNS-Server = <secondarydns> (96) sql: Session-Timeout := 86400 (96) sql: Fall-Through = Yes (96) sql: EXPAND SELECT id, groupname, attribute, Value, op FROM radgroupcheck WHERE groupname = '%{SQL-Group}' ORDER BY id (96) sql: --> SELECT id, groupname, attribute, Value, op FROM radgroupcheck WHERE groupname = '50m' ORDER BY id (96) sql: Executing select query: SELECT id, groupname, attribute, Value, op FROM radgroupcheck WHERE groupname = '50m' ORDER BY id (96) sql: Group "50m": Conditional check items matched (96) sql: Group "50m": Merging assignment check items (96) sql: EXPAND SELECT id, groupname, attribute, value, op FROM radgroupreply WHERE groupname = '%{SQL-Group}' ORDER BY id (96) sql: --> SELECT id, groupname, attribute, value, op FROM radgroupreply WHERE groupname = '50m' ORDER BY id (96) sql: Executing select query: SELECT id, groupname, attribute, value, op FROM radgroupreply WHERE groupname = '50m' ORDER BY id (96) sql: Group "50m": Merging reply items (96) sql: Huawei-Input-Average-Rate = "`%{request:Actual-Data-Rate-Upstream}00`" (96) sql: EXPAND `%{request:Actual-Data-Rate-Upstream}00` (96) sql: --> `4199900` rlm_sql (sql): Released connection (113) Need 1 more connections to reach min connections (3) rlm_sql (sql): Opening additional connection (114), 1 of 30 pending slots used rlm_sql_mysql: Starting connect to MySQL server rlm_sql_mysql: Connected to database 'radius' on Localhost via UNIX socket, server version 10.1.26-MariaDB-0+deb9u1, protocol version 10 (96) [sql] = ok (96) [expiration] = noop (96) [logintime] = noop (96) [pap] = updated (96) } # authorize = updated (96) Found Auth-Type = PAP (96) # Executing group from file /usr/local/freeradius3/etc/raddb/sites-enabled/default (96) Auth-Type PAP { (96) pap: Login attempt with password (96) pap: Comparing with "known good" Cleartext-Password (96) pap: User authenticated successfully (96) [pap] = ok (96) } # Auth-Type PAP = ok (96) # Executing section post-auth from file /usr/local/freeradius3/etc/raddb/sites-enabled/default (96) post-auth { (96) update { (96) No attributes updated (96) } # update = noop rlm_sql (sql): Reserved connection (112) (96) sql: EXPAND .query (96) sql: --> .query (96) sql: Using query template 'query' rlm_sql (sql): Reserved connection (113) (96) sql: EXPAND %{User-Name} (96) sql: --> user123 (96) sql: SQL-User-Name set to 'user123' (96) sql: EXPAND INSERT INTO radpostauth (username, pass, reply, authdate) VALUES ( '%{SQL-User-Name}', '%{%{User-Password}:-%{Chap-Password}}', '%{reply:Packet-Type}', '%S') (96) sql: --> INSERT INTO radpostauth (username, pass, reply, authdate) VALUES ( 'user123', 'userpass', 'Access-Accept', '2018-03-23 15:25:35') (96) sql: Executing query: INSERT INTO radpostauth (username, pass, reply, authdate) VALUES ( 'user123', 'userpass', 'Access-Accept', '2018-03-23 15:25:35') (96) sql: SQL query returned: success (96) sql: 1 record(s) updated rlm_sql (sql): Released connection (113) (96) [sql] = ok (96) [exec] = noop (96) policy remove_reply_message_if_eap { (96) if (&reply:EAP-Message && &reply:Reply-Message) { (96) if (&reply:EAP-Message && &reply:Reply-Message) -> FALSE (96) else { (96) [noop] = noop (96) } # else = noop (96) } # policy remove_reply_message_if_eap = noop (96) } # post-auth = ok (96) Sent Access-Accept Id 22 from <radiusip>:1812 to <brasip>:1812 length 0 (96) MS-Primary-DNS-Server = <primarydns> (96) MS-Secondary-DNS-Server = <secondarydns> (96) Session-Timeout = 86400 (96) Huawei-Input-Average-Rate = 0 (96) Framed-IP-Address = <usercpeip> (96) Finished request Waking up in 4.9 seconds.

4 12

Re: Is it possible to change a session's or account's lifetime
by 张强 27 Mar '18

27 Mar '18

Hi Alan, thanks for your reply. A captive portal is excatly what I'm trying to make, but our scenario is rather complicated. The user have to be taken from the portal to a mobile application to continue the authentication process which will need Internet access. That's why I need to temporarily allow the user's access. If I understood you right, I have to make the user to re-authenticate to let the NAS know the Expiration attribute has changed? If so, I think configuring the NAS to authenticate with freeRADIUS every 10 minutes, and making the initial expiration value to a little longer than 10 min will solve the problem. Am I right? And I'm terribly sorry if this post doesn't follow the thread I started previously, I don't know how to follow a thread when replying to a mailing list.

2 1

samba 4.7 AD and freeradius ntlm_auth/winbind
by Kacper Wirski 27 Mar '18

27 Mar '18

Hello, I have freeradius 3.0.14 integrated with samba AD DC using ntlm_auth. As of samba 4.7 version, theere is now option to explicitly allow only mschapv2 and disable all other ntlmv1 via smb.conf option ntlm auth = mschpav2-and-ntlmv2-only I've done today some tests, and I have mixed results, and I'm not sure who the "culprit" is. So let's start with what works: on the AD i set ntlm auth = mschpav2-and-ntlmv2-only on the freeradius (with samba 4.6.2 as domain member) in mods-enabled/mschap using winbind method i have put according to the guide in wiki.freeradius.org/active-directory-direct-via-winbind winbind_username = "%{mschap:User-Name}" winbind_domain = "*WINDOWSDOMAIN*" With this setup it works as expected, that is freeradius is able to authenticate via eap-peap AD users, in samba audit_log i clearly see that it's explicitly mschpav2 being used instead of more general "ntlmv1". What boggles my mind is that when i change in mods-enabled/mschap from "winbind" method to traditional "ntlm auth = /path/to/ntlm_auth etc....." I'm getting access-rejects. In samba audit log i see that request is coming using ntlmv1, and with the above smb.conf ntlmv1 (en general) is blocked. As soon, as in smb.conf i change to "ntlm auth = yes" I have everything working, but at the obvious loss of security. I read in this mailing list (I think), that this winbind authentication method also in the end uses ntlm_auth, but there is clearly difference. So my question is: is this something on samba-side that makes actual difference between those two methods, or freeradius for whatever reason doesn't send "proper" mschap2 flag that will be recognized by the samba AD server? Also a follow up question: is it possible to set "winbind" method for password change in the same way it's used for authentication? Regards, Kacper

2 2

Empty (not ended) session - freeradius 3.0.16
by dg 26 Mar '18

26 Mar '18

Hello, I have strange problem. >From time to time I have session not ended (and without any user assigned to that session). So i have time when session starts but stop time is NULL. example below: SELECT radacct.RadAcctId, hotspots.name as hotspot, radacct.UserName, radacct.FramedIPAddress, radacct.AcctStartTime, radacct.AcctStopTime, radacct.AcctSessionTime, radacct.AcctInputOctets, radacct.AcctOutputOctets, radacct.AcctTerminateCause, radacct.NASIPAddress FROM radacct LEFT JOIN hotspots ON radacct.calledstationid = hotspots.mac WHERE FramedIPAddress='' ORDER BY radacctid asc LIMIT 0, 1000; results ... | 1438 | NULL | user1 | | 2018-02-27 10:31:04 | 2018-02-27 10:35:33 | 269 | 1414483 | 40634419 | Admin-Reset | 192.168.1.110 | | 1439 | NULL | user2 | | 2018-02-27 10:31:11 | 2018-02-27 10:36:07 | 296 | 1714244 | 27071082 | Port-Error | 192.168.1.106 | | 1445 | NULL | | | 2018-02-27 09:49:24 | NULL | 6215 | 89145682 | 1799384 | | 192.168.1.110 | | 1446 | NULL | | | 2018-02-27 09:49:46 | NULL | 6242 | 89124192 | 1803157 | | 192.168.1.110 | | 1447 | NULL | | | 1993-03-01 01:01:22 | NULL | 788783565 | 92045995 | 1920254 | | 192.168.1.110 | | 1448 | NULL | | | 1993-03-01 01:01:24 | NULL | 788783603 | 93859941 | 1975125 | | 192.168.1.110 | so you can see that AcctStopTime is sometimes NULL. Can someone help me ? why its happening ? i am using cisco switches best regards

2 2

Is it possible to change a session's or account's lifetime
by 张强 26 Mar '18

26 Mar '18

Hi, What I want to do is temporarily allowing a user's access for a short time, say 2 minutes, and if the user takes further authentication process, the user's access can be allowed without limit. I tried to use the Expiration attribute in radcheck, set the value to be 2 minutes later in the beginning, and set it to be 1 day later after the required authentication process is completed. But it seems the NAS only reads the initial value. It expires the user in 2 minutes and never reads the new value. So the question is how to limit and change the lifetime of a session or of an account? Thanks for your help.

2 1

Radius acctstarttime
by Oscar Jofre 25 Mar '18

25 Mar '18

Hi, I've noticed that the acctstarttime on radacct table have some values I don't understand. In fact I have some routers (I work with mikrotik and hotspot + freeradius) that are in Taiwan and others on Spain. I thought that acctstarttime was set according the date time from the system where is installed freeradius (centos + mariadb for me) But I've seen today some rows from today (according radacctid) with a different time stamp (1970-04-13): I had an incorrect date on the mikrotik from the example, just the same date that is on the database, so then I thought that the acctstartime comes from router clock. but the routers I have In Taiwan with Taiwan clock don't save on accstarttime the router clock, they still saving data according the system where I have installed freeradius. What do I miss ? Thanks, Oscar.

3 6