- Freeradius-Users - lists.freeradius.org

django-freeradius
by Fiorella De Luca 29 Aug '17

29 Aug '17

Hi everyone, I am Fiorella De Luca and I am a participant of the Google Summer Code. During this three months, I have worked on an OpenWISP project regarding the creation of a freeradius web interface.This app, django-freeradius, is a web interface built in django that can be used to manipulate the data of a freeradius 3 database. The project offers a REST API which can (and should) be used with freeradius 3 rest module. It's not yet ready for production but we are close to completing the first phase. In these links you can find the main information about the project: GSOC project summary: https://delucafiorella2602.blog/2017/08/28/google-summer-of-code-2017-djang… .Repository of the project: https://github.com/openwisp/django-freeradius .Documentation of the project: http://django-freeradius.readthedocs.io/en/latest/ . If you are interested in trying it I would be glad to know your precious opinions and suggestions. Thank you! Fiorella De Luca

1 0

RE: How to log Access-Accept reply attributes/values in radpostauth sql
by James Wood 27 Aug '17

27 Aug '17

Thanks for the replies. I can use %{pairs:reply:} and it provides: "Acct-Interim-Interval =3D 120=2C Session-Timeout =3D 86400" But this doesn't look nice in the DB as it gets inserted exactly like that. Is there a way to unescape the quoted printable text to that =3D is actually = for example? I tried %{unescape:%{pairs:reply:}} but I didn't change it. Thanks James

3 2

How to log Access-Accept reply attributes/values in radpostauth sql
by James Wood 26 Aug '17

26 Aug '17

Hi All FR 3.0.13. Everything working perfectly, including SQL (mysql) for auth/acct logging. When a user authenticates, I would like to log any Access-Accept reply attributes we've set to sql (radpostauth). For example, my typical Access-Accept looks like this: Access-Accept (2), id: 0x2f, Authenticator: 123 Session-Timeout Attribute (27), length: 6, Value: 86400 Idle-Timeout Attribute (28), length: 6, Value: 600 Acct-Interim-Interval Attribute (85), length: 6, Value: 300 Therefore, I would like to log anything that was sent back to the NAS to the DB, in this instance: "Session-Timeout=86400,Idle-Timeout=600,Acct-Interim-Interval=300" or some other format as long as the data is readable... Is that possible? I tried using something like the below in the queries file: post-auth { query = "\ INSERT INTO ${..postauth_table} \ (username, pass, reply, authdate, callingstationid, calledstationid, attributes) \ VALUES ( \ '%{SQL-User-Name}', \ '%{%{User-Password}:-%{Chap-Password}}', \ '%{reply:Packet-Type}', \ '%S', \ '%{Calling-Station-Id}', \ '%{Called-Station-Id}', \ '%{reply:[*]}')" But doesn't appar I can use %{reply[*]} in that way. Thanks James

4 4

vlan assignment
by Zenon Matuszyk 25 Aug '17

25 Aug '17

Hello, I have a problem with vlan assignment on the group. If user is in group wi-fi should get ip with vlan 200 if it is in another group should get ip with vlan 216. I attach file witch freeradius -X. Users and group are in SAMBA4. If i login to wifi i get allways ip on vlan 216. I use login(a)mydomain.pl to connect wifi. I try add in users but this is ignored root@LDAP1 /etc/freeradius # cat users DEFAULT LDAP-Group != "wi-fi", Auth-Type:=Reject Reply-Message="You are not allowed to connnect" DEFAULT Realm == Null Auth-Type := Reject DEFAULT Realm == NULL, Client-IP-Address == 14x.xxx.x.40 Auth-Type := Reject DEFAULT Realm == NULL, Client-IP-Address == 14x.xxx.x.66 Auth-Type := Reject DEFAULT LDAP-Group == "wi-fi" Reply-Message="XXXX HIT: wi-fi", Tunnel-Private-Group-Id := 200, Tunnel-Type = VLAN, Tunnel-Medium-Type = IEEE-802, Please help -- Z poważaniem / Yours sincerely Zenon Matuszyk mobile: 00 48 797 004 938 e-mail: zenon.matuszyk(a)networkers.pl www: http://www.networkers.pl

2 3

Error: Discarding duplicate request from client
by Ceferli Asef 25 Aug '17

25 Aug '17

Hi Colleagues, I encountered such a problem. What are you think, What is the reason this error?: Error: Discarding duplicate request from client BRAS № port № - ID: № due to unfinished request № in component authorize module sql. Please help me to solve this problem. Best regards, Asaf Jafarli | System Administrator Aztelekom LLC Address: 187, Tbilisi str., AZ1122, Baku, Azerbaijan Mobile : +994517487671 <http://aztelekom.net/cabinet/assets/images/logos/logo.png>

2 1

About service down when the number of sessions exceeded
by Seiichirou Hiraoka 25 Aug '17

25 Aug '17

Hello. I use the following version with RHEL 7. # rpm -qa | grep freeradius freeradius-3.0.4-6.el7.x86_64 freeradius-utils-3.0.4-6.el7.x86_64 freeradius-mysql-3.0.4-6.el7.x86_64 We set max_sessions to the default 1024, and when there are many users, radiusd forcibly shut down after outputting the following message. - /var/log/radius/radius.log Tue Jun 13 15:06:01 2017 : Error: rlm_eap (EAP): Too many open sessions. Try increasing "max_sessions" in the EAP moduleconfiguration Increasing the value of max_sessions now works without problems. Here, I have a question. I think that an error message is output in the following part of the source code, Change not to accept requests, not forced shutdown Is there a way? freeradius-server-3.0.4/src/modules/rlm_eap/mem.c ----- ... Done: / * * We do not need this any more. * / If (status> 0) handler-> request = NULL; PTHREAD_MUTEX_UNLOCK (& (inst -> session_mutex)); If (status <= 0) { Pairfree (& state); If (status <0) { Static time_t last_logged = 0; If (last_logged <handler-> timestamp) { Last_logged = handler-> timestamp; ERROR ("rlm_eap (% s): Too many open sessions. Try increasing \" max_sessions \ "" "In the EAP module configuration", inst-> xlat_name); } } Else { ERROR ("rlm_eap (% s): Failed to store handler", inst-> xlat_name); } Return 0; } ----- Thank you.

2 2

Re: How best to map users to domain name for login
by yani＠ecoco.co.uk 24 Aug '17

24 Aug '17

On 24/08/17 17:23, Alan DeKok wrote: > On Aug 24, 2017, at 10:24 AM, yani(a)ecoco.co.uk wrote: >> radiusd -v >> radiusd: FreeRADIUS Version 3.0.4, for host x86_64-redhat-linux-gnu, built on Jan 17 2017 at 18:49:55 > I would suggest using 3.0.15. It has a lot of fixes over 3.0.4. > >> I want to be able to authenticate users to my email service and manage >> them according to the domain they belong to so fred(a)domaina.com is not >> the same as fred(a)domainb.com. But in both cases the first part is the >> login user name within the domain. > That's a pretty common requirement. Yep > >> I have looked at freeradius virtual servers - > Virtual servers are largely for separating functionality. i.e. WiFi rules in one virtual server, DSL rules in another, and VPN rules in a third virtual server. > >> and have considered >> using free radius realms dont see how either are actually the way forward - It seems >> that virtual servers will need a database system creating for every >> instance( am i actually correct here) > No. good suspected I was wrong, but needed confirmation. > >> and that realms are really for >> forwarding requests to other free radius servers - when all i need at >> the moment is a single server handling multiple domain based login >> groups. > Realms are often used for forwarding, but they don't need to be. > >> I understand from the documentation that I can create a local realm >> like this >> >> realm domaina.com { >> type= radius >> authhost= LOCAL >> accthost= LOCAL > Yes. > >> I suspect I'm on the right track here - but haven't figured out how to >> create users in the database/system that reflect this >> >> Please advise on the most appropriate way of configuring >> freeradius to achieve logins for multiple internet domains. > The bigger question is where are the users stored right now? What kind of database contains the name / password for each user? What is the schema used there? > > Once you know that, you just configure FreeRADIUS to query the database. It should be about 10 minutes work. > > I wouldn't suggest creating users via the default SQL schema. That's largely for ISP functionality, and will likely not work well for you. > > For enterprises we just recommend that FreeRADIUS look at the existing enterprise DB. > > i.e. you don't mangle your data to make FreeRADIUS happy. That's a lot of work. Instead, you configure 1-2 simple queries in FreeRADIUS, so that it pulls the correct information from your existing database. That's *much* easier. > > Alan DeKok. Thank you for the quick reply, I'm just a newbie with Freeradius, trying to understand its modus operandi :) I have come to the conclusion that I will need to modify the schema and change the way in which the db is queried after seeing the output below for a test user in the test domain domaina.com . I'm using a mysql back end at the moment. and this system is not live - still in development. ( I've wanted to get radius working for years and only just found the time.) I suppose it's really only adding a realm field to the radius.radcheckdb and using that in the subsequent queries. something like : EXPAND SELECT id, username, attribute, value, op FROM radcheck WHERE username = '%{SQL-User-Name}' and realm = {whatever_realm_is } ORDER BY id if this is what you mean by mangling the data then I'm still missing something - ie how to best relate users to realms/domains. Received Access-Request Id 25 from 10.64.4.111:36127 to 10.64.3.44:1812 length 86 User-Name = 'yani(a)domaina.com' User-Password = 'poppl' NAS-IP-Address = 127.0.1.1 NAS-Port = 0 Message-Authenticator = 0x552204bba16c70744eb4910adeb44f6f (11) Received Access-Request packet from host 10.64.4.111 port 36127, id=25, length=86 (11) User-Name = 'yani(a)domaina.com' (11) User-Password = 'poppl' (11) NAS-IP-Address = 127.0.1.1 (11) NAS-Port = 0 (11) Message-Authenticator = 0x552204bba16c70744eb4910adeb44f6f (11) # Executing section authorize from file /etc/raddb/sites-enabled/default (11) authorize { (11) filter_username filter_username { (11) if (!&User-Name) (11) if (!&User-Name) -> FALSE (11) if (&User-Name =~ / /) (11) if (&User-Name =~ / /) -> FALSE (11) if (&User-Name =~ /@.*@/ ) (11) if (&User-Name =~ /@.*@/ ) -> FALSE (11) if (&User-Name =~ /\\.\\./ ) (11) if (&User-Name =~ /\\.\\./ ) -> FALSE (11) if ((&User-Name =~ /@/) && (&User-Name !~ /(a)(.+)\\.(.+)$/)) (11) if ((&User-Name =~ /@/) && (&User-Name !~ /(a)(.+)\\.(.+)$/)) -> FALSE (11) if (&User-Name =~ /\\.$/) (11) if (&User-Name =~ /\\.$/) -> FALSE (11) if (&User-Name =~ /(a)\\./) (11) if (&User-Name =~ /(a)\\./) -> FALSE (11) } # filter_username filter_username = notfound (11) [preprocess] = ok (11) [chap] = noop (11) [mschap] = noop (11) [digest] = noop (11) suffix : Checking for suffix after "@" (11) suffix : Looking up realm "domaina.com" for User-Name = "yani(a)domaina.com" (11) suffix : Found realm "domaina.com" (11) suffix : Adding Stripped-User-Name = "yani" (11) suffix : Adding Realm = "domaina.com" (11) suffix : Authentication realm is LOCAL (11) [suffix] = ok (11) eap : No EAP-Message, not doing EAP (11) [eap] = noop (11) [files] = noop (11) sql : EXPAND %{User-Name} (11) sql : --> yani(a)domaina.com (11) sql : SQL-User-Name set to 'yani(a)domaina.com' rlm_sql (sql): Reserved connection (7) (11) sql : EXPAND SELECT id, username, attribute, value, op FROM radcheck WHERE username = '%{SQL-User-Name}' ORDER BY id (11) sql : --> SELECT id, username, attribute, value, op FROM radcheck WHERE username = 'yani(a)domaina.com' ORDER BY id rlm_sql (sql): Executing query: 'SELECT id, username, attribute, value, op FROM radcheck WHERE username = 'yani(a)domaina.com' ORDER BY id' (11) sql : User found in radcheck table (11) sql : Check items matched (11) sql : EXPAND SELECT id, username, attribute, value, op FROM radreply WHERE username = '%{SQL-User-Name}' ORDER BY id (11) sql : --> SELECT id, username, attribute, value, op FROM radreply WHERE username = 'yani(a)domaina.com' ORDER BY id rlm_sql (sql): Executing query: 'SELECT id, username, attribute, value, op FROM radreply WHERE username = 'yani(a)domaina.com' ORDER BY id' (11) sql : EXPAND SELECT groupname FROM radusergroup WHERE username = '%{SQL-User-Name}' ORDER BY priority (11) sql : --> SELECT groupname FROM radusergroup WHERE username = 'yani(a)domaina.com' ORDER BY priority rlm_sql (sql): Executing query: 'SELECT groupname FROM radusergroup WHERE username = 'yani(a)domaina.com' ORDER BY priority' (11) sql : User not found in any groups rlm_sql (sql): Released connection (7) rlm_sql (sql): 0 of 3 connections in use. Need more spares rlm_sql (sql): Opening additional connection (8) rlm_sql_mysql: Starting connect to MySQL server (11) [sql] = ok (11) [expiration] = noop (11) [logintime] = noop (11) [pap] = updated (11) } # authorize = updated (11) Found Auth-Type = PAP (11) # Executing group from file /etc/raddb/sites-enabled/default (11) Auth-Type PAP { (11) pap : Login attempt with password (11) pap : User authenticated successfully (11) [pap] = ok (11) } # Auth-Type PAP = ok (11) # Executing section post-auth from file /etc/raddb/sites-enabled/default (11) post-auth { (11) sql : EXPAND .query (11) sql : --> .query (11) sql : Using query template 'query' rlm_sql (sql): Reserved connection (8) (11) sql : EXPAND %{User-Name} (11) sql : --> yani(a)domaina.com (11) sql : SQL-User-Name set to 'yani(a)domaina.com' (11) sql : EXPAND INSERT INTO radpostauth (username, pass, reply, authdate) VALUES ( '%{SQL-User-Name}', '%{%{User-Password}:-%{Chap-Password}}', '%{reply:Packet-Type}', '%S') (11) sql : --> INSERT INTO radpostauth (username, pass, reply, authdate) VALUES ( 'yani(a)domaina.com', 'poppl', 'Access-Accept', '2017-08-24 17:23:57') rlm_sql (sql): Executing query: 'INSERT INTO radpostauth (username, pass, reply, authdate) VALUES ( 'yani(a)domaina.com', 'poppl', 'Access-Accept', '2017-08-24 17:23:57')' rlm_sql (sql): Released connection (8) (11) [sql] = ok (11) [exec] = noop (11) remove_reply_message_if_eap remove_reply_message_if_eap { (11) if (&reply:EAP-Message && &reply:Reply-Message) (11) if (&reply:EAP-Message && &reply:Reply-Message) -> FALSE (11) else else { (11) [noop] = noop (11) } # else else = noop (11) } # remove_reply_message_if_eap remove_reply_message_if_eap = noop (11) } # post-auth = ok (11) Sending Access-Accept packet to host 10.64.4.111 port 36127, id=25, length=0 Sending Access-Accept Id 25 from 10.64.3.44:1812 to 10.64.4.111:36127 (11) Finished request > > - > List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html

2 2

How best to map users to domain name for login
by yani＠ecoco.co.uk 24 Aug '17

24 Aug '17

radiusd -v radiusd: FreeRADIUS Version 3.0.4, for host x86_64-redhat-linux-gnu, built on Jan 17 2017 at 18:49:55 Hi. I've been reading the manuals to attempt to determine the best way to configure free radius for my requirements but can't decide which is the best route to follow. I want to be able to authenticate users to my email service and manage them according to the domain they belong to so fred(a)domaina.com is not the same as fred(a)domainb.com. But in both cases the first part is the login user name within the domain. I have configured all of the systems to work with the default radius configuration (Exim MTA Cyrus sasl and ssh logins working fine) and the mail server is correctly operating with virtual email domains (i.e fred(a)domaina.com is not the same as fred(a)domainb.com) I have looked at freeradius virtual servers - and have considered using free radius realms dont see how either are actually the way forward - It seems that virtual servers will need a database system creating for every instance( am i actually correct here) and that realms are really for forwarding requests to other free radius servers - when all i need at the moment is a single server handling multiple domain based login groups. I understand from the documentation that I can create a local realm like this realm domaina.com { type= radius authhost= LOCAL accthost= LOCAL I suspect I'm on the right track here - but haven't figured out how to create users in the database/system that reflect this Please advise on the most appropriate way of configuring freeradius to achieve logins for multiple internet domains. Yani

2 1

Re: Returning Vendor Specific Attribute in radius reply
by Siddiqui Najam 23 Aug '17

23 Aug '17

> Can you do a test for me? Go to src/modules/rlm_python/rlm_python.c, and find this code: if (tmpl_from_attr_str(&dst, s1, REQUEST_CURRENT, PAIR_LIST_REPLY, false, false) <= 0) { ERROR("%s - Failed to find attribute %s:%s", funcname, list_name, s1); continue; } >change the "false, false" to "true, false". Then re-build && re-install the server. I tested with the change. Still does not work. The change to true for allow_unknown did not make a difference because it is a known attribute. The issue seems to be that the type for 'Attr-26' is set to PW_TYPE_VSA (in tmpl_from_attr_substr) which later is rejected. -Najam ________________________________ This message and any attachments are intended solely for the addressees and may contain confidential information. Any unauthorized use or disclosure, either whole or partial, is prohibited. E-mails are susceptible to alteration. Our company shall not be liable for the message if altered, changed or falsified. If you are not the intended recipient of this message, please delete it and notify the sender. Although all reasonable efforts have been made to keep this transmission free from viruses, the sender will not be liable for damages caused by a transmitted virus.

1 0

Re: Returning Vendor Specific Attribute in radius reply
by Siddiqui Najam 23 Aug '17

23 Aug '17

I am running 3.0.15 $ radiusd -v radiusd: FreeRADIUS Version 3.0.15, for host x86_64-alpine-linux-musl, built on Jul 18 2017 at 09:03:14 FreeRADIUS Version 3.0.15 Copyright (C) 1999-2017 The FreeRADIUS server project and contributors There is NO warranty; not even for MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE You may redistribute copies of FreeRADIUS under the terms of the GNU General Public License For more information about these matters, see the file named COPYRIGHT -Najam -----Original Message----- From: Freeradius-Users [mailto:freeradius-users-bounces+najam.siddiqui=gemalto.com@lists.freeradius.org] On Behalf Of Alan DeKok Sent: Wednesday, August 23, 2017 6:27 AM To: FreeRadius users mailing list <freeradius-users(a)lists.freeradius.org> Subject: [+SPAM+]: Re: Returning Vendor Specific Attribute in radius reply On Aug 22, 2017, at 11:02 PM, Siddiqui Najam <Najam.Siddiqui(a)gemalto.com> wrote: > > Hi Alan, > > I did some debugging and code hits src/lib/value.c:585 and returns -1. This is confusing because we set the attribute name to Attr-26. Then you're running an older version of the server. Please use 3.0.15, which has this issue fixed. Alan DeKok. - List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html ________________________________ This message and any attachments are intended solely for the addressees and may contain confidential information. Any unauthorized use or disclosure, either whole or partial, is prohibited. E-mails are susceptible to alteration. Our company shall not be liable for the message if altered, changed or falsified. If you are not the intended recipient of this message, please delete it and notify the sender. Although all reasonable efforts have been made to keep this transmission free from viruses, the sender will not be liable for damages caused by a transmitted virus.

2 1