- Freeradius-Users - lists.freeradius.org

Errors reading /etc/freeradius/3.0: No such file or directory
by Юра Фролов 26 Jan '18

26 Jan '18

Hello, I migrate to freeradius 3.0 (from freeradius 2.2) Way of files configuraton freeradius3.0 have additional subfolder ./3.0, i would like to discarding subfolder 3.0 and move conf files to folder freeradius (as I no have sql etc, user`s names saved in files, historicaly inheritence.I have many scripts for update users`s files.) I change one string in file radius.conf to raddbdir = /etc/freeradius/, restart freeradius service and received error *Errors reading /etc/freeradius/3.0: No such file or directory* What I should do yet change? And can i change way of configuration files to /etc/freeradius?

2 1

Re: Segmentation fault - Radius Accounting
by Richard J Palmer 26 Jan '18

26 Jan '18

HI Alan This is 3.0.15 I can upgrade the server to .16 that's not a problem. Also happy to compile a debug version and run here (the server is production with real requests - but can happily run in debug mode with the debug symbols running. Also happy to share the log file (ideally privately since it has some details of the realms - and client data) in it. Initial email was more a generic comment - but will happily run the debug as needed Richard > > --- Original message --- > Subject: Re: Segmentation fault - Radius Accounting > From: Alan DeKok <aland(a)deployingradius.com> > To: FreeRadius users mailing list > <freeradius-users(a)lists.freeradius.org> > Date: Friday, 26/01/2018 1:18 PM > > On Jan 26, 2018, at 8:13 AM, Richard J Palmer <richard(a)merula.net> > wrote: >> >> >> We have a realm that we are trying to proxy. For auth it works fine... >> BUT for accounting it fails. >> Running radiusd -X when we get an accounting packet we get the >> following: > > What version of the server are you using? >> >> ... >> (1) suffix: Proxying request from user 01234567890(a)myrealm.com to >> realm myrealm.com >> Segmentation fault > > See doc/bugs, which describes how to get more information. > >> >> Auth requests that are proxied to the same server. The home server is >> another freeradius server. >> >> After some digging I have found the cause - which MAY be of interest >> .... in proxy.conf one of the realms was duplicated > > Hmm... that should be forbidden. I'll check. > >> >> With a single instance all is good - but occidentally duplicate and >> this is reproducible here. >> >> This is not high prority in any way and was triggered by a config >> issue - BUT I thought this might be interesting. >> >> If you need any extra information let me know - I am more than happy >> to help > > The version and information from: > > https://github.com/FreeRADIUS/freeradius-server/blob/v3.0.x/doc/bugs > > Alan DeKok. > > > - > List info/subscribe/unsubscribe? See > http://www.freeradius.org/list/users.html

2 1

Segmentation fault - Radius Accounting
by Richard J Palmer 26 Jan '18

26 Jan '18

Hi there We have a realm that we are trying to proxy. For auth it works fine... BUT for accounting it fails. Running radiusd -X when we get an accounting packet we get the following: Ready to process requests (0) Received Status-Server Id 0 from 217.146.96.41:3799 to 85.158.159.252:1646 length 62 (0) NAS-Identifier = "Constantine.merula.net" (0) Message-Authenticator = 0x9a68b889142f9146a600a95eff7ef54b (0) Sent Accounting-Response Id 0 from 85.158.159.252:1646 to 217.146.96.41:3799 length 0 (0) Finished request Waking up in 4.9 seconds. (1) Received Accounting-Request Id 194 from 217.146.96.41:3799 to 85.158.159.252:1646 length 192 (1) Acct-Status-Type = Start (1) Event-Timestamp = "Jan 26 2018 11:47:44 GMT" (1) Service-Type = Framed-User (1) Framed-Protocol = PPP (1) Framed-MTU = 1492 (1) Framed-IP-Address = a.b.c.d (1) Framed-IP-Netmask = 255.255.255.255 (1) Tunnel-Client-Endpoint:0 = "TEST-END" (1) User-Name = "01234567890(a)myrealm.com" (1) Calling-Station-Id = "VFC1054807" (1) Chargeable-User-Identity = "VFC1054807" (1) NAS-Identifier = "Constantine.merula.net" (1) Acct-Session-Id = "S600000770120011D13200" (1) NAS-IP-Address = 5.6.9.8 (1) NAS-Port = 51804 (1) Connect-Info = "1953000/724000" (1) # Executing section preacct from file /usr/local/etc/raddb/sites-enabled/default (1) preacct { (1) [preprocess] = ok (1) policy rewrite_data_sim_users { (1) if (Calling-Station-Id =~ /(894420000[0-9]{10})/i) { (1) if (Calling-Station-Id =~ /(894420000[0-9]{10})/i) -> FALSE (1) else { (1) [noop] = noop (1) } # else = noop (1) } # policy rewrite_data_sim_users = noop (1) if (!User-Name && Acct-Session-Id && NAS-IP-Address) { (1) if (!User-Name && Acct-Session-Id && NAS-IP-Address) -> FALSE (1) policy acct_unique { (1) update request { (1) &Tmp-String-9 := "ai:" (1) } # update request = noop (1) if (("%{hex:&Class}" =~ /^%{hex:&Tmp-String-9}/) && ("%{string:&Class}" =~ /^ai:([0-9a-f]{32})/i)) { (1) EXPAND %{hex:&Class} (1) --> (1) EXPAND ^%{hex:&Tmp-String-9} (1) --> ^61693a (1) if (("%{hex:&Class}" =~ /^%{hex:&Tmp-String-9}/) && ("%{string:&Class}" =~ /^ai:([0-9a-f]{32})/i)) -> FALSE (1) else { (1) update request { (1) EXPAND %{md5:%{User-Name},%{Acct-Session-ID},%{%{NAS-IPv6-Address}:-%{NAS-IP-Address}},%{NAS-Identifier},%{NAS-Port-ID},%{NAS-Port}} (1) --> e6620fbb47d41aea4969201b45cdb1f3 (1) &Acct-Unique-Session-Id := e6620fbb47d41aea4969201b45cdb1f3 (1) } # update request = noop (1) } # else = noop (1) } # policy acct_unique = noop (1) suffix: Checking for suffix after "@" (1) suffix: Looking up realm "myrealm.com" for User-Name = "01234567890(a)myrealm.com" (1) suffix: Found realm "myrealm.com" (1) suffix: Adding Realm = "myrealm.com" (1) suffix: Proxying request from user 01234567890(a)myrealm.com to realm myrealm.com Segmentation fault Auth requests that are proxied to the same server. The home server is another freeradius server. After some digging I have found the cause - which MAY be of interest .... in proxy.conf one of the realms was duplicated With a single instance all is good - but occidentally duplicate and this is reproducible here. This is not high prority in any way and was triggered by a config issue - BUT I thought this might be interesting. If you need any extra information let me know - I am more than happy to help Richard Richard Palmer | Director | Merula Limited Company Registered in England and Wales No. 3243995 5 Avro Court, Huntingdon, Cambridgeshire, PE29 6XS Phone 01480 222940 | Support 0845 330 0666 Support Email support(a)merula.net

2 1

How to rotate logs
by Olivier 26 Jan '18

26 Jan '18

Hi, A quick question: how to rotate logs with FreeRadius? I am using the OS newsyslog (FreeBSD), but as a result, FreeRadius do not log in the rotated file and I need to restart the server. The problem seems to arise because I am using chroot. When the server is started, the log file is opened before the chroot, in the /var/log directory. But after that, the server can only open the new log file in the chroot/var/log Thanks in advance, olivier --

2 1

freeradius.pip not found
by Hamid Rahman 26 Jan '18

26 Jan '18

can you help me ? when i stopping freeradius with command : /etc/init.d/freeradius stop * Stopping FreeRADIUS daemon freeradius * /var/run/freeradius/freeradius.pid not found... [ OK ] so i try with another command : service freeradius stop stop : unknown instance i'm so confused with this problem 😞 what's wrong ? thanks

2 1

guide on configuring freeradius 3 LDAP
by Douglas C Ward 25 Jan '18

25 Jan '18

Hello, I just joined the list recently, in hopes to get some help in configuring LDAP on my FreeRADIUS server. I have found a lot of documentation for FreeRADIUS v2, dating from 2011 and 2014, etc. But no clear step-by-step to enable LDAP for v3. My server is version 3.0.15. I have worked through the initial setup on the http://wiki.freeradius.org/guide/Getting-Started <http://wiki.freeradius.org/guide/Getting-Started> and was able to connect with “Access-Accept”. But now I want to connect an LDAP server (specifically, a VLDAP server from OneLogin). I have all their docs, and have all the base DN and Bind DN info. But the documentation at http://wiki.freeradius.org/modules/Rlm_ldap <http://wiki.freeradius.org/modules/Rlm_ldap> seem to “start in the middle” for me. It says you "can"… "To enable LDAP in your FreeRADIUS server, you can: • instantiate an ldap module - which sets up the server name, the base DN, etc • authenticate using an ldap module instance - which makes the FreeRADIUS server verify the user's identity in the LDAP directory, usually involving some form of checking the validity of the password • authorize using an ldap module instance - which makes the FreeRADIUS server verify the user's level of authorization in the LDAP directory, usually involving verifying group membership or similar" … but I don’t have enough experience to evaluate those options, or know how to do any of them. So I am looking for a simple “how to enable LDAP on FreeRADIUS 3” that I can follow to get things working, and learn from there. Thank you. —Douglas

6 28

RE: Re: SQL Module: Inconsistent behavior dealing with the escaping backslash
by Kwak Wookjong 25 Jan '18

25 Jan '18

Great, I just tried out your suggestion and it worked as expected and resolved the issue I had. I also agree that we should use "binary" value for the secrets not the "printed form" string value. Given that, Do you think can this fix be part of the next freeradius 3.x.x release? Thanks for the clarification. Best Regards, Wookjong -----Original Message----- From: Freeradius-Users [mailto:freeradius-users-bounces+wookjong.kwak=gemalto.com@lists.freeradius.org] On Behalf Of Alan DeKok Sent: Thursday, January 25, 2018 3:30 PM To: FreeRadius users mailing list <freeradius-users(a)lists.freeradius.org> Subject: [+SPAM+]: Re: SQL Module: Inconsistent behavior dealing with the escaping backslash On Jan 25, 2018, at 3:02 PM, Kwak Wookjong <Wookjong.Kwak(a)gemalto.com> wrote: > > Yes, in the SQL DB, double slashes "\\" are presented. OK. That's good. > ... > (0) EXPAND %{sql: SELECT secret FROM nas WHERE nasname = '%{Packet-Src-IP-Address}'} > (0) --> test\\123 > (0) FreeRADIUS-Client-Secret = test\123 > > ***** up until here, everything seems good as "\\" becomes to "\" That's fine. > ***** problem below when it is converting control list to client field, "\" becomes to "\\", again. > > (0) Converting control list to client fields > (0) ipv4addr = 192.168.99.1 > (0) secret = test\\123 > (0) shortname = Radius Local Test > (0) nas_type = other > Adding client 192.168.99.1/32 with shared secret "test\\123" > > ***** So, when it is adding the client, it is double backslashes. Hmm... the issue is that there are multiple representations of a string. The "binary" value, where the characters just mean themselves, and the "printed" form, where things are escaped, e.g. \n, \\, \t, etc. For various reasons, the dynamic clients have to print the attributes you defined. But, it should just use the "binary" value for secrets, and not use the "printed" form. I think this change should fix it: --- a/src/main/client.c +++ b/src/main/client.c @@ -1341,7 +1341,7 @@ RADCLIENT *client_afrom_request(RADCLIENT_LIST *clients, REQUEST *request) * We could reuse the CONF_PAIR buff, this just keeps things * consistent between client_afrom_cs, and client_afrom_query. */ - *p = talloc_strdup(c, strvalue); + *p = talloc_strdup(c, vp->vp_strvalue); Hopefully that won't break it for anyone else... Alan DeKok. - List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html ________________________________ This message and any attachments are intended solely for the addressees and may contain confidential information. Any unauthorized use or disclosure, either whole or partial, is prohibited. E-mails are susceptible to alteration. Our company shall not be liable for the message if altered, changed or falsified. If you are not the intended recipient of this message, please delete it and notify the sender. Although all reasonable efforts have been made to keep this transmission free from viruses, the sender will not be liable for damages caused by a transmitted virus.

2 1

RE: Re: Re: SQL Module: Inconsistent behavior dealing with the escaping backslash
by Kwak Wookjong 25 Jan '18

25 Jan '18

Yes, in the SQL DB, double slashes "\\" are presented. Let me put the log with some comments below with ***** to make it clear. id | nasname | shortname | type | ports | secret | server | community | description -----+----------------+----------------------+--------+-------+-------------+--------+----------------+------------- 112 | 192.168.99.1 | Radius Local Test | other | | test\\123 | | | (0) server dynamic_client_server { (0) # Executing section authorize from file /etc/raddb/clients.conf (0) authorize { (0) if ("%{sql: SELECT nasname FROM nas WHERE nasname = '%{Packet-Src-IP-Address}'}") { rlm_sql (sql): Reserved connection (0) (0) Executing select query: SELECT nasname FROM nas WHERE nasname = '192.168.99.1' rlm_sql_postgresql: Status: PGRES_TUPLES_OK rlm_sql_postgresql: query affected rows = 1 , fields = 1 rlm_sql (sql): Released connection (0) (0) EXPAND %{sql: SELECT nasname FROM nas WHERE nasname = '%{Packet-Src-IP-Address}'} (0) --> 192.168.99.1 (0) if ("%{sql: SELECT nasname FROM nas WHERE nasname = '%{Packet-Src-IP-Address}'}") -> TRUE (0) if ("%{sql: SELECT nasname FROM nas WHERE nasname = '%{Packet-Src-IP-Address}'}") { (0) update control { (0) EXPAND %{Packet-Src-IP-Address} (0) --> 192.168.99.1 (0) FreeRADIUS-Client-IP-Address = 192.168.99.1 rlm_sql (sql): Reserved connection (1) (0) Executing select query: SELECT shortname FROM nas WHERE nasname = '192.168.99.1' rlm_sql_postgresql: Status: PGRES_TUPLES_OK rlm_sql_postgresql: query affected rows = 1 , fields = 1 rlm_sql (sql): Released connection (1) (0) EXPAND %{sql: SELECT shortname FROM nas WHERE nasname = '%{Packet-Src-IP-Address}'} (0) --> Radius Local Test (0) FreeRADIUS-Client-Shortname = Radius Local Test rlm_sql (sql): Reserved connection (2) (0) Executing select query: SELECT secret FROM nas WHERE nasname = '192.168.99.1' rlm_sql_postgresql: Status: PGRES_TUPLES_OK rlm_sql_postgresql: query affected rows = 1 , fields = 1 rlm_sql (sql): Released connection (2) (0) EXPAND %{sql: SELECT secret FROM nas WHERE nasname = '%{Packet-Src-IP-Address}'} (0) --> test\\123 (0) FreeRADIUS-Client-Secret = test\123 ***** up until here, everything seems good as "\\" becomes to "\" rlm_sql (sql): Reserved connection (3) (0) Executing select query: SELECT type FROM nas WHERE nasname = '192.168.99.1' rlm_sql_postgresql: Status: PGRES_TUPLES_OK rlm_sql_postgresql: query affected rows = 1 , fields = 1 rlm_sql (sql): Released connection (3) (0) EXPAND %{sql: SELECT type FROM nas WHERE nasname = '%{Packet-Src-IP-Address}'} (0) --> other (0) FreeRADIUS-Client-NAS-Type = other (0) } # update control = noop (0) [ok] = ok (0) } # if ("%{sql: SELECT nasname FROM nas WHERE nasname = '%{Packet-Src-IP-Address}'}") = ok (0) } # authorize = ok (0) } # server dynamic_client_server ***** problem below when it is converting control list to client field, "\" becomes to "\\", again. (0) Converting control list to client fields (0) ipv4addr = 192.168.99.1 (0) secret = test\\123 (0) shortname = Radius Local Test (0) nas_type = other Adding client 192.168.99.1/32 with shared secret "test\\123" ***** So, when it is adding the client, it is double backslashes. Let me know if you need further information. Thanks! Best Regards, WJ -----Original Message----- From: Freeradius-Users [mailto:freeradius-users-bounces+wookjong.kwak=gemalto.com@lists.freeradius.org] On Behalf Of Alan DeKok Sent: Thursday, January 25, 2018 1:18 PM To: FreeRadius users mailing list <freeradius-users(a)lists.freeradius.org> Subject: [+SPAM+]: Re: [+SPAM+]: Re: SQL Module: Inconsistent behavior dealing with the escaping backslash On Jan 25, 2018, at 2:10 PM, Kwak Wookjong <Wookjong.Kwak(a)gemalto.com> wrote: > Thanks for the respond and your suggestion. > But I am still seeing the same problem. (Additional backslash > prepended) > > Even though, using another table (other than NAS) for putting client > information, When, putting the information into attributes, the additional step that you described would be applied. > Then, it would make additional backslash in front of original backslash as it is not *directly* read from the table. > > My question would be how can I make the value read directly from the table as it does for NAS table reading? You can't. You MUST put the value into an attribute. That's how the dynamic clients work. > Or, do we need to check if the escaping is properly done when putting the information into attributes? You need to ensure that the contents of SQL are correct. Which means escaping things properly. Backslashes are special, because they allow escaping. If you want a literal backslash, put "\\" into SQL. Then when you read it from SQL via a SELECT statement, it will be parsed correctly. If this isn't clear, post the *debug output* of the server when it reads a dynamic client from SQL. That will be much clearer. Alan DeKok. - List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html ________________________________ This message and any attachments are intended solely for the addressees and may contain confidential information. Any unauthorized use or disclosure, either whole or partial, is prohibited. E-mails are susceptible to alteration. Our company shall not be liable for the message if altered, changed or falsified. If you are not the intended recipient of this message, please delete it and notify the sender. Although all reasonable efforts have been made to keep this transmission free from viruses, the sender will not be liable for damages caused by a transmitted virus.

2 1

SQL Module: Inconsistent behavior dealing with the escaping backslash
by Kwak Wookjong 25 Jan '18

25 Jan '18

Hi, I have found that the backslash in the shared secret interpreted differently depending on the read_clients option to be set in the /etc/raddb/mods-enable/sql Case 1. When the DB is read while its startup only, by setting read_clients option to be yes, for example, the shared secret, test\123 is read as test\123 and the client is added with having single backslash. Case 2. When the DB is read per each request, by setting read_clients option to be no, the shared secret, test\123 becomes test\\123 and the client is added with having double backslashes. I will put more detail of the Case 2 log, below, $radiusd -X (0) server dynamic_client_server { ........... ........... rlm_sql (sql): Reserved connection (2) (0) Executing select query: SELECT secret FROM nas WHERE nasname = '192.168.99.1' rlm_sql_postgresql: Status: PGRES_TUPLES_OK rlm_sql_postgresql: query affected rows = 1 , fields = 1 rlm_sql (sql): Released connection (2) (0) EXPAND %{sql: SELECT secret FROM nas WHERE nasname = '%{Packet-Src-IP-Address}'} (0) --> test\123 (0) FreeRADIUS-Client-Secret = test\123 rlm_sql (sql): Reserved connection (3) ........... ........... (0) } # server dynamic_client_server (0) Converting control list to client fields (0) ipv4addr = 192.168.99.1 (0) secret = test\\123 (0) shortname = Radius Local Test (0) nas_type = other Adding client 192.168.99.1/32 with shared secret "test\\123" in bold, you will see the additional backslash has added when it is converting control list to client fields. However, in Case 1, It doesn't even print out the log from rlm_sql, So, I assume that it is adding the client information from a different path with the different logic. As a result, the client is added with shared secret test\123, in this case. Suppose, I want to set the read_clients option to be "no", as the shared secret can be modified at any time and it should be reflected at every request, why can't both cases have the same way of treating escaping backslash? Thanks! Best Regards, WJ ________________________________ This message and any attachments are intended solely for the addressees and may contain confidential information. Any unauthorized use or disclosure, either whole or partial, is prohibited. E-mails are susceptible to alteration. Our company shall not be liable for the message if altered, changed or falsified. If you are not the intended recipient of this message, please delete it and notify the sender. Although all reasonable efforts have been made to keep this transmission free from viruses, the sender will not be liable for damages caused by a transmitted virus.

2 3

Howto provide free airtime or no accounting in night for quota base user
by JAHANZAIB SYED 25 Jan '18

25 Jan '18

Scenario: 1) Mikrotik as NAS 2) FREERADIUS as billing server Q1- Suppose, we have few quota base services and our internet bandwidth generally remains empty in night. therefore we want to provide free internet usage by bypassing quota counters in night. like from 8pm till 8am. Q2- This might not be related to FR. Some ISP's provide unlimited data access for FB,YT, whatsapp and other specific without any limit? how they do this? how they bypass accounting for such contents? from there NAS level or via using some magical code in FR ? Regards, Jz <http:///>

4 5