- Freeradius-Users - lists.freeradius.org

rlm_rest module - authenticate
by philippe2.legoff＠orange.com 07 Nov '17

07 Nov '17

Hello, I’m using a Freeradius 4.0.x release with the rlm_rest module to store the accounting datas inside a key/value database. Storing accounting items works well, and also authorization, but I’m not able to perform authentication using the stored datas (as for MySQL). If anyone have an idea ? rlm_rest/accounting section accounting { uri = "${..connect_uri}/v2/keys/%{Framed-IP-Address}" method = 'put' body = 'post' data = "value=\"Cleartext-Password\": \"%{Framed-IP-Address}\",\"Calling-Station-Id\": \"%{Calling-Station-ID}\",\"3GPP-Location-Info\": \"%{3GPP-User-Location-Info}\",\"3GPP-SGSN-Address\": \"%{3GPP-SGSN-Address}\",\"3GPP-RAT-Type\": \"%{3GPP-RAT-Type}\"" } CLI command is : echo "Calling-Station-Id=237100000002,Framed-IP-Address=201.16.124.239,Service-Type=2,Framed-Protocol=ppp,Acct-Status-Type=Start,3GPP-SGSN-Address=70.70.70.70,3GPP-Location-Info=0x5c2730783030315c27,NAS-IP-Address=10.171.23.53,NAS-Port=1,3GPP-Rat-Type=0x01" | /opt/freeradius/current/bin/radclient -x 10.104.145.4:1813 acct testing123 Sent Accounting-Request Id 49 from 0.0.0.0:47843 to 10.104.145.4:1813 length 108 Calling-Station-Id = "237100000002" Framed-IP-Address = 201.16.124.239 Service-Type = Framed-User Framed-Protocol = PPP Acct-Status-Type = Start 3GPP-SGSN-Address = 70.70.70.70 3GPP-Location-Info = 0x5c2730783030315c27 NAS-IP-Address = 10.171.23.53 NAS-Port = 1 3GPP-RAT-Type = UTRAN Received Accounting-Response Id 49 from 10.104.145.4:1813 to 0.0.0.0:47843 via lo length 20 And the datas are correctly stored. Raddebug seems fine for accounting : Network received packet size 108 Ready to process requests Resetting worker cleanup timer to +30s (0) running request (0) Received Accounting-Request ID 49 (0) Calling-Station-Id = "237100000002" (0) Framed-IP-Address = 201.16.124.239 (0) Service-Type = Framed-User (0) Framed-Protocol = PPP (0) Acct-Status-Type = Start (0) 3GPP-SGSN-Address = 70.70.70.70 (0) 3GPP-Location-Info = 0x5c2730783030315c27 (0) NAS-IP-Address = 10.171.23.53 (0) NAS-Port = 1 (0) 3GPP-RAT-Type = UTRAN (0) Running 'recv Accounting-Request' from file /opt/freeradius/v.4.0.x/etc/raddb/sites-enabled/default (0) recv Accounting-Request { (0) acct_unique { (0) if ("%{string:Class}" =~ /ai:([0-9a-f]{32})/i) { (0) EXPAND %{string:Class} (0) --> (0) ... (0) } (0) else { (0) update request { (0) EXPAND %{md5:%{User-Name},%{Acct-Multi-Session-ID},%{Acct-Session-ID},%{%{NAS-IPv6-Address}:-%{NAS-IP-Address}},%{NAS-Identifier},%{NAS-Port-ID},%{NAS-Port}} (0) --> 6f0ca34d8adc2578048d2d1f4bb0f025 (0) &Acct-Unique-Session-Id := 6f0ca34d8adc2578048d2d1f4bb0f025 (0) } # update request (noop) (0) } # else (noop) (0) } # acct_unique (noop) (0) check_accounting_attributes { (0) if (Acct-Status-Type == Start) { (0) if ((!NAS-IP-Address) || (!Service-Type) || (!Framed-Protocol) || (!Framed-IP-Address) || (!3GPP-SGSN-Address) || (!3GPP-RAT-Type) || (!Calling-Station-Id)) { (0) ... (0) } (0) else { (0) ok (ok) (0) } # else (ok) (0) } # if (Acct-Status-Type == Start) (ok) (0) } # check_accounting_attributes (ok) (0) } # recv Accounting-Request (ok) (0) Running 'send Accounting-Response' from file /opt/freeradius/v.4.0.x/etc/raddb/sites-enabled/default (0) send Accounting-Response { (0) detail - EXPAND /opt/freeradius/logs/%{%{Packet-Src-IP-Address}:-%{Packet-Src-IPv6-Address}}/detail-%Y%m%d (0) detail - --> /opt/freeradius/logs/10.104.145.4/detail-20171107 (0) detail - /opt/freeradius/logs/%{%{Packet-Src-IP-Address}:-%{Packet-Src-IPv6-Address}}/detail-%Y%m%d expands to /opt/freeradius/logs/10.104.145.4/detail-20171107 (0) detail - EXPAND %t (0) detail - --> Tue Nov 7 10:23:22 2017 (0) detail (ok) (0) unix (noop) (0) rest - Reserved connection (4) (0) rest - Expanding URI components (0) rest - EXPAND http://10.104.145.4:2379 (0) rest - --> http://10.104.145.4:2379 (0) rest - EXPAND /v2/keys/%{Framed-IP-Address} (0) rest - --> /v2/keys/201.16.124.239 (0) rest - Sending HTTP PUT to "http://10.104.145.4:2379/v2/keys/201.16.124.239" (0) rest - EXPAND value="Cleartext-Password": "%{Framed-IP-Address}","Calling-Station-Id": "%{Calling-Station-ID}","3GPP-Location-Info": "%{3GPP-Location-Info}","3GPP-SGSN-Address": "%{3GPP-SGSN-Address}","3GPP-RAT-Type": "%{3GPP-RAT-Type}" (0) rest - --> value="Cleartext-Password": "201.16.124.239","Calling-Station-Id": "237100000002","3GPP-Location-Info": "0x5c2730783030315c27","3GPP-SGSN-Address": "70.70.70.70","3GPP-RAT-Type": "UTRAN" (0) rest - Content-Length will be 186 bytes (0) rest (yield) Waking up in 2.9 seconds. (0) Processing response header (0) Status : 200 (OK) (0) Type : json (application/json) (0) running request (0) rest - &REST-HTTP-Status-Code := 200 (0) rest - Parsing attribute "action" (0) rest - EXPAND set (0) rest - --> set (0) rest - &action := "set" (0) rest - Parsing attribute "node" (0) rest - Parsing attribute "key" (0) rest - EXPAND /201.16.124.239 (0) rest - --> /201.16.124.239 (0) rest - &key := "/201.16.124.239" (0) rest - Parsing attribute "value" (0) rest - EXPAND "Cleartext-Password": "201.16.124.239","Calling-Station-Id": "237100000002","3GPP-Location-Info": "0x5c2730783030315c27","3GPP-SGSN-Address": "70.70.70.70","3GPP-RAT-Type": "UTRAN" (0) rest - --> "Cleartext-Password": "201.16.124.239","Calling-Station-Id": "237100000002","3GPP-Location-Info": "0x5c2730783030315c27","3GPP-SGSN-Address": "70.70.70.70","3GPP-RAT-Type": "UTRAN" (0) rest - &value := "\"Cleartext-Password\": \"201.16.124.239\",\"Calling-Station-Id\": \"237100000002\",\"3GPP-Location-Info\": \"0x5c2730783030315c27\",\"3GPP-SGSN-Address\": \"70.70.70.70\",\"3GPP-RAT-Type\": \"UTRAN\"" (0) rest - Parsing attribute "modifiedIndex" (0) rest - WARNING: Ignoring do_xlat on 'int', attribute "modifiedIndex" (0) rest - &modifiedIndex := 200088 (0) rest - Parsing attribute "createdIndex" (0) rest - WARNING: Ignoring do_xlat on 'int', attribute "createdIndex" (0) rest - &createdIndex := 200088 (0) rest - Parsing attribute "prevNode" (0) rest - Parsing attribute "key" (0) rest - EXPAND /201.16.124.239 (0) rest - --> /201.16.124.239 (0) rest - &key := "/201.16.124.239" (0) rest - Parsing attribute "value" (0) rest - EXPAND "Cleartext-Password": "201.16.124.239","Calling-Station-Id": "237100000002","3GPP-Location-Info": "0x5c2730783030315c27","3GPP-SGSN-Address": "70.70.70.70","3GPP-RAT-Type": "UTRAN" (0) rest - --> "Cleartext-Password": "201.16.124.239","Calling-Station-Id": "237100000002","3GPP-Location-Info": "0x5c2730783030315c27","3GPP-SGSN-Address": "70.70.70.70","3GPP-RAT-Type": "UTRAN" (0) rest - &value := "\"Cleartext-Password\": \"201.16.124.239\",\"Calling-Station-Id\": \"237100000002\",\"3GPP-Location-Info\": \"0x5c2730783030315c27\",\"3GPP-SGSN-Address\": \"70.70.70.70\",\"3GPP-RAT-Type\": \"UTRAN\"" (0) rest - Parsing attribute "modifiedIndex" (0) rest - WARNING: Ignoring do_xlat on 'int', attribute "modifiedIndex" (0) rest - &modifiedIndex := 200087 (0) rest - Parsing attribute "createdIndex" (0) rest - WARNING: Ignoring do_xlat on 'int', attribute "createdIndex" (0) rest - &createdIndex := 200087 (0) rest - Released connection (4) (0) rest - Closing expired connection (3): Needs reconnecting (0) rest - You probably need to lower "min" (0) rest - Closing expired connection (2): Needs reconnecting (0) rest - You probably need to lower "min" (0) rest - Closing expired connection (1): Needs reconnecting (0) rest - You probably need to lower "min" (0) rest - Closing expired connection (0): Needs reconnecting (0) rest - You probably need to lower "min" (0) rest (updated) (0) if (noop) { (0) ... (0) } (0) attr_filter.accounting_response - EXPAND %{User-Name} (0) attr_filter.accounting_response - --> (0) attr_filter.accounting_response - Matched entry DEFAULT at line 12 (0) attr_filter.accounting_response (updated) (0) } # send Accounting-Response (updated) (0) Sent Accounting-Response Id 49 from 10.104.145.4:1813 to 10.104.145.4:47843 via lo length 0 (0) done request (0) finished request. Ready to process requests Ready to process requests Ready to process requests For authorize and authenticate sections, I'm trying a GET using the URI on the User-name authorize { uri = "${..connect_uri}/v2/keys/%{User-Name}" method = 'get' body = ''' data = """ # tls = ${..tls} } (action, node, key and value words are declared in dictionary). echo "User-Name=201.16.124.239,NAS-Port=1812,Service-Type=8,NAS-Ip-Address=70.70.70.70,NAS-Identifier=1,Chap-Password=201.16.124.239,Chap-Challenge=1,Cleartext-Password=201.16.124.239" | /opt/freeradius/current/bin/radclient -x 10.104.145.4:1812 auth testing123 Sent Access-Request Id 128 from 0.0.0.0:50628 to 10.104.145.4:1812 length 79 User-Name = "201.16.124.239" NAS-Port = 1812 Service-Type = Authenticate-Only NAS-IP-Address = 70.70.70.70 NAS-Identifier = "1" CHAP-Password = 0x49c87256c50220fee804602c892c713d48 CHAP-Challenge = 0x31 Cleartext-Password = "201.16.124.239" Cleartext-Password = "201.16.124.239" Received Access-Reject Id 128 from 10.104.145.4:1812 to 0.0.0.0:50628 via lo length 20 (0) -: Expected Access-Accept got Access-Reject: Invalid character '' in attribute name I don’t see why the &value attribute isn’t parsed after Expanded : with raddebug : (1) running request (1) Received Access-Request ID 128 (1) User-Name = "201.16.124.239" (1) NAS-Port = 1812 (1) Service-Type = Authenticate-Only (1) NAS-IP-Address = 70.70.70.70 (1) NAS-Identifier = "1" (1) CHAP-Password = 0x49c87256c50220fee804602c892c713d48 (1) CHAP-Challenge = 0x31 (1) Running 'recv Access-Request' from file /opt/freeradius/v.4.0.x/etc/raddb/sites-enabled/default (1) recv Access-Request { (1) filter_user_password { (1) if (&User-Password) { (1) ... (1) } (1) } # filter_user_password (...) (1) rest - Closing connection (4): Hit idle_timeout, was idle for 1259 seconds (1) rest - You probably need to lower "min" (1) rest - 0 of 0 connections in use. You may need to increase "spare" (1) rest - Opening additional connection (5), 1 of 10 pending slots used (1) rest - Reserved connection (5) (1) rest - Expanding URI components (1) rest - EXPAND http://10.104.145.4:2379 (1) rest - --> http://10.104.145.4:2379 (1) rest - EXPAND /v2/keys/%{User-Name} (1) rest - --> /v2/keys/201.16.124.239 (1) rest - Sending HTTP GET to "http://10.104.145.4:2379/v2/keys/201.16.124.239" (1) rest (yield) Waking up in 2.9 seconds. (1) Processing response header (1) Status : 200 (OK) (1) Type : json (application/json) (1) running request (1) rest - &REST-HTTP-Status-Code := 200 (1) rest - Parsing attribute "action" (1) rest - EXPAND get (1) rest - --> get (1) rest - &action := "get" (1) rest - Parsing attribute "node" (1) rest - Parsing attribute "key" (1) rest - EXPAND /201.16.124.239 (1) rest - --> /201.16.124.239 (1) rest - &key := "/201.16.124.239" (1) rest - Parsing attribute "value" (1) rest - EXPAND "Cleartext-Password": "201.16.124.239","Calling-Station-Id": "237100000002","3GPP-Location-Info": "0x5c2730783030315c27","3GPP-SGSN-Address": "70.70.70.70","3GPP-RAT-Type": "UTRAN" (1) rest - --> "Cleartext-Password": "201.16.124.239","Calling-Station-Id": "237100000002","3GPP-Location-Info": "0x5c2730783030315c27","3GPP-SGSN-Address": "70.70.70.70","3GPP-RAT-Type": "UTRAN" (1) rest - &value := "\"Cleartext-Password\": \"201.16.124.239\",\"Calling-Station-Id\": \"237100000002\",\"3GPP-Location-Info\": \"0x5c2730783030315c27\",\"3GPP-SGSN-Address\": \"70.70.70.70\",\"3GPP-RAT-Type\": \"UTRAN\"" (1) rest - Parsing attribute "modifiedIndex" (1) rest - WARNING: Ignoring do_xlat on 'int', attribute "modifiedIndex" (1) rest - &modifiedIndex := 200088 (1) rest - Parsing attribute "createdIndex" (1) rest - WARNING: Ignoring do_xlat on 'int', attribute "createdIndex" (1) rest - &createdIndex := 200088 (1) rest - Released connection (5) (1) rest - Need 4 more connections to reach min connections (5) (1) rest - Opening additional connection (6), 1 of 9 pending slots used (1) rest - Closing expired connection (5): Needs reconnecting (1) rest - You probably need to lower "min" (1) rest (updated) (1) check_authenticate_attributes { (1) if (!User-Password) { (1) update request { (1) &User-Password = &User-Name -> "201.16.124.239" (1) } # update request (noop) (1) update control { (1) &control:Auth-Type = rest (1) } # update control (noop) (1) } # if (!User-Password) (noop) (1) if ((!User-Name) || (!NAS-IP-Address) || (!Service-Type) || (!NAS-Identifier)) { (1) ... (1) } (1) else { (1) ok (ok) (1) } # else (ok) (1) } # check_authenticate_attributes (ok) (1) } # recv Access-Request (updated) (1) Running 'authenticate rest' from file /opt/freeradius/v.4.0.x/etc/raddb/sites-enabled/default (1) authenticate rest { (1) rest - Reserved connection (6) (1) rest - Expanding URI components (1) rest - EXPAND http://10.104.145.4:2379 (1) rest - --> http://10.104.145.4:2379 (1) rest - EXPAND /v2/keys/%{User-Name} (1) rest - --> /v2/keys/201.16.124.239 (1) rest - Sending HTTP GET to "http://10.104.145.4:2379/v2/keys/201.16.124.239" (1) rest (yield) Waking up in 2.9 seconds. (1) Processing response header (1) Status : 200 (OK) (1) Type : json (application/json) (1) running request (1) rest - &REST-HTTP-Status-Code := 200 (1) rest - Parsing attribute "action" (1) rest - EXPAND get (1) rest - --> get (1) rest - &action := "get" (1) rest - Parsing attribute "node" (1) rest - Parsing attribute "key" (1) rest - EXPAND /201.16.124.239 (1) rest - --> /201.16.124.239 (1) rest - &key := "/201.16.124.239" (1) rest - Parsing attribute "value" (1) rest - EXPAND "Cleartext-Password": "201.16.124.239","Calling-Station-Id": "237100000002","3GPP-Location-Info": "0x5c2730783030315c27","3GPP-SGSN-Address": "70.70.70.70","3GPP-RAT-Type": "UTRAN" (1) rest - --> "Cleartext-Password": "201.16.124.239","Calling-Station-Id": "237100000002","3GPP-Location-Info": "0x5c2730783030315c27","3GPP-SGSN-Address": "70.70.70.70","3GPP-RAT-Type": "UTRAN" (1) rest - &value := "\"Cleartext-Password\": \"201.16.124.239\",\"Calling-Station-Id\": \"237100000002\",\"3GPP-Location-Info\": \"0x5c2730783030315c27\",\"3GPP-SGSN-Address\": \"70.70.70.70\",\"3GPP-RAT-Type\": \"UTRAN\"" (1) rest - Parsing attribute "modifiedIndex" (1) rest - WARNING: Ignoring do_xlat on 'int', attribute "modifiedIndex" (1) rest - &modifiedIndex := 200088 (1) rest - Parsing attribute "createdIndex" (1) rest - WARNING: Ignoring do_xlat on 'int', attribute "createdIndex" (1) rest - &createdIndex := 200088 (1) rest - Released connection (6) (1) rest (updated) (1) } # authenticate rest (updated) (1) Failed to authenticate the user (1) Login incorrect: [201.16.124.239] (from client freeradius-cb-02 port 1812) (1) Running 'send Access-Reject' from file /opt/freeradius/v.4.0.x/etc/raddb/sites-enabled/default (1) send Access-Reject { (1) attr_filter.access_reject - EXPAND %{User-Name} (1) attr_filter.access_reject - --> 201.16.124.239 (1) attr_filter.access_reject - Matched entry DEFAULT at line 11 (1) attr_filter.access_reject (updated) (1) } # send Access-Reject (updated) (1) Sent Access-Reject Id 128 from 10.104.145.4:1812 to 10.104.145.4:50628 via lo length 0 (1) done request (1) finished request. Ready to process requests Waking up in 29.9 seconds. Where is my error ? Best regards, Philippe _________________________________________________________________________________________________________________________ Ce message et ses pieces jointes peuvent contenir des informations confidentielles ou privilegiees et ne doivent donc pas etre diffuses, exploites ou copies sans autorisation. Si vous avez recu ce message par erreur, veuillez le signaler a l'expediteur et le detruire ainsi que les pieces jointes. Les messages electroniques etant susceptibles d'alteration, Orange decline toute responsabilite si ce message a ete altere, deforme ou falsifie. Merci. This message and its attachments may contain confidential or privileged information that may be protected by law; they should not be distributed, used or copied without authorisation. If you have received this email in error, please notify the sender and delete this message and its attachments. As emails may be altered, Orange is not liable for messages that have been modified, changed or falsified. Thank you.

4 3

accounting and rlm_cache
by Dmitry Yashin 07 Nov '17

07 Nov '17

Hi, I have a bug in the network and sometimes the stop pack comes before updates. to fix this i write some like this accounting { if (Acct-Status-Type == Start) { rest } if (Acct-Status-Type == Interim-Update) { update control { Cache-Status-Only = 'yes' } cache if (notfound) { rest } else { ok } } if (Acct-Status-Type == Stop) { cache rest } #ok #rest } but this not work , in debug mode i see Tue Nov 7 21:51:00 2017 : Debug: (222) accounting { Tue Nov 7 21:51:00 2017 : Debug: (222) if (Acct-Status-Type == Start) { Tue Nov 7 21:51:00 2017 : Debug: (222) if (Acct-Status-Type == Start) -> FALSE Tue Nov 7 21:51:00 2017 : Debug: (222) if (Acct-Status-Type == Interim-Update) { Tue Nov 7 21:51:00 2017 : Debug: (222) if (Acct-Status-Type == Interim-Update) -> TRUE Tue Nov 7 21:51:00 2017 : Debug: (222) if (Acct-Status-Type == Interim-Update) { Tue Nov 7 21:51:00 2017 : Debug: (222) update control { Tue Nov 7 21:51:00 2017 : Debug: (222) Cache-Status-Only = yes Tue Nov 7 21:51:00 2017 : Debug: (222) } # update control = noop Tue Nov 7 21:51:00 2017 : Debug: (222) modsingle[accounting]: calling cache (rlm_cache) Tue Nov 7 21:51:00 2017 : Debug: %{Acct-Unique-Session-Id} Tue Nov 7 21:51:00 2017 : Debug: Parsed xlat tree: Tue Nov 7 21:51:00 2017 : Debug: attribute --> Acct-Unique-Session-Id Tue Nov 7 21:51:00 2017 : Debug: (222) cache: EXPAND %{Acct-Unique-Session-Id} Tue Nov 7 21:51:00 2017 : Debug: (222) cache: --> cc815c1b8cb89841330796a5f48bfa12 Tue Nov 7 21:51:00 2017 : Debug: (222) cache: Mutex acquired Tue Nov 7 21:51:00 2017 : Debug: (222) cache: No cache entry found for "cc815c1b8cb89841330796a5f48bfa12" Tue Nov 7 21:51:00 2017 : Debug: (222) cache: Mutex released Tue Nov 7 21:51:00 2017 : Debug: (222) modsingle[accounting]: returned from cache (rlm_cache) Tue Nov 7 21:51:00 2017 : Debug: (222) [cache] = notfound Tue Nov 7 21:51:00 2017 : Debug: (222) } # if (Acct-Status-Type == Interim-Update) = notfound Tue Nov 7 21:51:00 2017 : Debug: (222) } # accounting = notfound Tue Nov 7 21:51:00 2017 : Debug: (222) Not sending reply to client. Tue Nov 7 21:51:00 2017 : Debug: (222) Finished request why not work if (notfound) in accounting ? thx

2 2

Deadlocks in Freeradius MySQL Database
by Claudio Carvalho 06 Nov '17

06 Nov '17

Hi, I am testing freeradius version 3 with RedHat Enterprise Server 7.4 and MySQL 5.6.35, even in a newly fresh/initialized database I get these messages in radius.log, has anyone else been through this situation yet? what would be the best choice of operating system, database and freeradius version that recommend as more stable? ############################################################################### ERROR: (1526654) sqlippool: ERROR: rlm_sql_mysql: ERROR 1213 (Deadlock found when trying to get lock; try restarting transaction): 40001 [root@rad-a-01 radius]# cat radius.log | wc -l 197357 [root@rad-a-01 radius]# cat radius.log | grep Deadlock | wc -l 2468 [root@rad-a-01 radius]# rpm -qa | grep freeradius freeradius-3.0.13-8.el7_4.x86_64 freeradius-mysql-3.0.13-8.el7_4.x86_64 freeradius-utils-3.0.13-8.el7_4.x86_64 freeradius-ldap-3.0.13-8.el7_4.x86_64 [root@rad-a-01 radius]# uname -a Linux rad-a-01 3.10.0-693.5.2.el7.x86_64 #1 SMP Fri Oct 13 10:46:25 EDT 2017 x86_64 x86_64 x86_64 GNU/Linux ############################################################################### Thanks, Claudio.

4 8

Building from source with postgres support
by Toby Walsh 06 Nov '17

06 Nov '17

Hi list, I am a reasonable long-time user of Freeradius on a single monolithic host but I'm setting up a new server and putting my services in containers. I have postgres in a Docker container running nicely, fully configured with my old user base migrated from MySQL. I am compiling Freeradius 3.0.15 on a separate container and hoping to use Postgres as the store. radtest with bob/hello works fine. However I realised when I tried to set up Postgres support that it fails with rlm_sql_postgresql.so not found. I'm guessing that the compile process detects database support and only builds in binding libraries if it finds that database on the same system? Can you tell me what the requirements are that Freeradius' build process builds rlm_sql_postgresql.so for me? One that is hopefully compatible with driving Freeradius on that end but independent of Postgres on the other container? Freeradius is on a Centos 7.4 container, Postgres 10 is on Debian container. Thanks

3 5

two questions about migration from FR 2.X to 3.X
by Anton Kiryushkin 03 Nov '17

03 Nov '17

Hello. I have two question about migration from oldest to newest version. 1. After migration, the process authorization by MSCHAP-V2 wrote that can't make NT-password: Fri Nov 3 10:27:52 2017 : WARNING: (4) mschap: No Cleartext-Password configured. Cannot create NT-Password Fri Nov 3 10:27:52 2017 : WARNING: (4) mschap: No Cleartext-Password configured. Cannot create LM-Password Fri Nov 3 10:27:52 2017 : Debug: (4) mschap: Client is using MS-CHAPv1 with NT-Password Fri Nov 3 10:27:52 2017 : ERROR: (4) mschap: FAILED: No NT/LM-Password. Cannot perform authentication Fri Nov 3 10:27:52 2017 : ERROR: (4) mschap: MS-CHAP2-Response is incorrect This happened in inner-tunnel site with config: server inner-tunnel { authorize { chap mschap suffix update control { Proxy-To-Realm := LOCAL } eap { ok = return } files expiration logintime pap } authenticate { Auth-Type PAP { pap } Auth-Type CHAP { chap } Auth-Type MS-CHAP { mschap } eap } session { radutmp } post-auth { Post-Auth-Type REJECT { attr_filter.access_reject } } pre-proxy { } post-proxy { eap } } But I have the same config on FR 2.X in it worked. Could tell me why? The second question with another client. I've got the next error message: Thu Nov 2 21:44:19 2017 : ERROR: (159) eap_peap: Failed in __FUNCTION__ (SSL_read): s3_srvr.c[1240]:error:1408A0E3:SSL routines:ssl3_get_client_hello:parse tlsext Thu Nov 2 21:44:19 2017 : ERROR: (159) eap_peap: System call (I/O) error (-1) Thu Nov 2 21:44:19 2017 : ERROR: (159) eap_peap: TLS receive handshake failed during operation Thu Nov 2 21:44:19 2017 : ERROR: (159) eap_peap: [eaptls process] = fail Thu Nov 2 21:44:19 2017 : ERROR: (159) eap: Failed continuing EAP PEAP (25) session. EAP sub-module failed This is printer Canon 5240i and I can't change his software. As well as in the previous question, all work with FR 2.X. -- Best regards, Anton Kiryushkin

2 6

How Radperf increase values of "Acct-Input-Octets" and "Acct-Output-Octets" fields
by Claudio Carvalho 02 Nov '17

02 Nov '17

Hi, I'm testing radperf and i need manipulate the values of fields "Acct-Input-Octets" and "Acct-Output-Octets". Is it possible for each "Interim-Update" the software increase the values of these fields? Thanks, Claudio.

2 2

Freeradius and Role based access control
by Tony Pedley 02 Nov '17

02 Nov '17

Sorry, this is a bit of a newbie question, but something I have been trying to work out for a while IEC 62351 specifies that access permission to a device is based on the authentication of the user and also the role(s) associated with that user. To allow us to use RADIUS to authenticate an access request, we would the radius server to authenticate both the user name password, but also whether the the user has the rights to the role requested. Their does not seem to be any obvious attribute to pass requested role information to a freeradius server, so what is generally the merthod to implement Role Based access control via Radius?

2 1

Proxying MS-CHAPv2
by Norman Elton 02 Nov '17

02 Nov '17

We've been running FreeRADIUS for our wireless 802.1x infrastructure for years, without problem (thanks!). FreeRADIUS basically proxies back to our Windows NPS servers, then injects a VLAN assignment using unlang on the Access-Accept. Now we're deploying the same architecture for our wired infrastructure. I've noticed that the authentication requests between the FreeRADIUS servers and NPS for our wired infrastructure is all EAP, which is getting rejected since our NPS servers are expecting PEAP. I'm assuming I need to specifically tell FreeRADIUS that the back-end authentication needs to take place over PEAP, but don't see where that would be configured. It's basically the same config as our wireless infrastructure, but in that case, PEAP/MS-CHAPv2 is configured on the access points. Am I missing something obvious here? Thanks, Norman Elton

2 1

Username with dot issue
by Satish Patel 01 Nov '17

01 Nov '17

I have setup freeradius with LDAP and we have may user account starting with "dot" example "foo.bar" but i found somewhere it getting strip off and only showing "foo" in logs. I have this setting in hint file, we are doing proxy to other radius too. I have check policy file too but nothing matching there. DEFAULT User-Name =~ "^([a-z]{1,25})" User-Name := "%{1}@EXAMPLE" Tue Oct 31 17:12:57 2017 : Debug: (2) Cleaning up request packet ID 11 with timestamp +110 Tue Oct 31 17:12:57 2017 : Info: Ready to process requests Tue Oct 31 17:13:01 2017 : Debug: (3) Received Access-Request Id 147 from 127.0.0.1:58804 to 127.0.0.1:1812 length 77 Tue Oct 31 17:13:01 2017 : Debug: (3) User-Name = "foo.bar" Tue Oct 31 17:13:01 2017 : Debug: (3) User-Password = “password123” Tue Oct 31 17:13:01 2017 : Debug: (3) NAS-IP-Address = 10.5.3.31 Tue Oct 31 17:13:01 2017 : Debug: (3) NAS-Port = 1812 Tue Oct 31 17:13:01 2017 : Debug: (3) Message-Authenticator = 0x07a42e3b1de836e011b2a15c196f8486 Tue Oct 31 17:13:01 2017 : Debug: (3) session-state: No State attribute Tue Oct 31 17:13:01 2017 : Debug: (3) # Executing section authorize from file /etc/raddb/sites-enabled/default Tue Oct 31 17:13:01 2017 : Debug: (3) authorize { Tue Oct 31 17:13:01 2017 : Debug: (3) policy filter_username { Tue Oct 31 17:13:01 2017 : Debug: (3) if (&User-Name) { Tue Oct 31 17:13:01 2017 : Debug: (3) if (&User-Name) -> TRUE Tue Oct 31 17:13:01 2017 : Debug: (3) if (&User-Name) { Tue Oct 31 17:13:01 2017 : Debug: (3) if (&User-Name =~ / /) { Tue Oct 31 17:13:01 2017 : Debug: No matches Tue Oct 31 17:13:01 2017 : Debug: (3) if (&User-Name =~ / /) -> FALSE Tue Oct 31 17:13:01 2017 : Debug: (3) if (&User-Name =~ /@[^@]*@/ ) { Tue Oct 31 17:13:01 2017 : Debug: No matches Tue Oct 31 17:13:01 2017 : Debug: (3) if (&User-Name =~ /@[^@]*@/ ) -> FALSE Tue Oct 31 17:13:01 2017 : Debug: (3) if (&User-Name =~ /\.\./ ) { Tue Oct 31 17:13:01 2017 : Debug: No matches Tue Oct 31 17:13:01 2017 : Debug: (3) if (&User-Name =~ /\.\./ ) -> FALSE Tue Oct 31 17:13:01 2017 : Debug: (3) if ((&User-Name =~ /@/) && (&User-Name !~ /(a)(.+)\.(.+)$/)) { Tue Oct 31 17:13:01 2017 : Debug: No matches Tue Oct 31 17:13:01 2017 : Debug: (3) if ((&User-Name =~ /@/) && (&User-Name !~ /(a)(.+)\.(.+)$/)) -> FALSE Tue Oct 31 17:13:01 2017 : Debug: (3) if (&User-Name =~ /\.$/) { Tue Oct 31 17:13:01 2017 : Debug: No matches Tue Oct 31 17:13:01 2017 : Debug: (3) if (&User-Name =~ /\.$/) -> FALSE Tue Oct 31 17:13:01 2017 : Debug: (3) if (&User-Name =~ /(a)\./) { Tue Oct 31 17:13:01 2017 : Debug: No matches Tue Oct 31 17:13:01 2017 : Debug: (3) if (&User-Name =~ /(a)\./) -> FALSE Tue Oct 31 17:13:01 2017 : Debug: (3) } # if (&User-Name) = notfound Tue Oct 31 17:13:01 2017 : Debug: (3) } # policy filter_username = notfound Tue Oct 31 17:13:01 2017 : Debug: (3) modsingle[authorize]: calling preprocess (rlm_preprocess) Tue Oct 31 17:13:01 2017 : Debug: No matches Tue Oct 31 17:13:01 2017 : Debug: Adding 2 matches Tue Oct 31 17:13:01 2017 : Debug: (3) preprocess: hints: Matched DEFAULT at 65 Tue Oct 31 17:13:01 2017 : Debug: (3) preprocess: ::: FROM 1 TO 6 MAX 7 Tue Oct 31 17:13:01 2017 : Debug: (3) preprocess: ::: Examining User-Name Tue Oct 31 17:13:01 2017 : Debug: %{1}@EXAMPLE Tue Oct 31 17:13:01 2017 : Debug: Parsed xlat tree: Tue Oct 31 17:13:01 2017 : Debug: regex-var --> 1 Tue Oct 31 17:13:01 2017 : Debug: literal --> @EXAMPLE Tue Oct 31 17:13:01 2017 : Debug: (3) preprocess: 1/2 Found: foo (4) Tue Oct 31 17:13:01 2017 : Debug: (3) preprocess: EXPAND %{1}@EXAMPLE Tue Oct 31 17:13:01 2017 : Debug: (3) preprocess: --> foo@EXAMPLE

2 1

Class attributes
by Satish Patel 31 Oct '17

31 Oct '17

I am configuring freeradius for Cisco ASA VPN and i have create multiple Group Policy on ASA now i want to send those group name back to NAS using Class Attributes #25 as per following document (they are using Windows IAS) http://www.dasblinkenlichten.com/using-radius-attributes-during-webvpn-logo… Same setup i want to do in Linux Freeradius so where should i definite that attribute? Should i use that in /etc/raddb/user or /etc/raddb/sites-enabled/default file in post-auth section? I did following and i am getting following result but not sure i am doing it right or not post-auth { update reply { Class := OU=Group_VPN; } } Sent Access-Request Id 40 from 0.0.0.0:35534 to 127.0.0.1:1812 length 76 User-Name = "user1" User-Password = "password1" NAS-IP-Address = 10.5.3.31 NAS-Port = 1812 Message-Authenticator = 0x00 Cleartext-Password = "password1" Received Access-Accept Id 40 from 127.0.0.1:1812 to 0.0.0.0:0 length 35 Class = 0x4f553d47726f75705f56504e3b

5 12