- Freeradius-Users - lists.freeradius.org

Crashes FreeRadius 3.0.11 using rlm_rest/libcurl + rlm_cache_rbtree
by RANJALAHY RASOLOFOMANANA, Bija 01 Sep '17

01 Sep '17

Hi all, We are frequently facing a crash of our freeradius server on live production environment (8 times in 2 months). The crash can't be reproduced on our test environment so we need help. Sometimes, we have a core dump (case 1- the server crashes), sometimes, we don't (case 2- the server freezes). Unfortunately, the core dumps don't provide useful informations: Here are examples of the core dumps : core 1: #0 0x00000034b680f5db in ?? () #1 0x00007fa718d066c6 in ?? () #2 0x0000000000000000 in ?? () core 2: #0 0x00000034b680f5db in ?? () #1 0x00007f169f94e6c6 in ?? () #2 0x0000000000000000 in ?? () Freeradius version : 3.0.11 Context : our server sends REST request to a http server to retrieve data which are then stored in a cache during 1 hour. The problem started when we added this feature. Leads : 1- The server logs all http requests that are sent. Somehow, the line log is truncated when the problem appears. Maybe, it is just a coincidence but we are suspecting this part. We use the rlm_rest module + libcurl to make our requests. Have you encountered a problem using those module/library ? We tried to upgrade libcurl from 7.50.3 to 7.54.0 but this doesn't fix the problem. 2- In the case 2 (the server freezes), we've got the following message in our log files: Mon Jun 26 22:00:31 2017 : Error: (10180900) Ignoring duplicate packet from client xxx port 21665 - ID: 164 due to unfinished request in component authorize module <our cache module> Our cache module is based on the rlm_cache_rbtree module: cache <cache name> { driver = "rlm_cache_rbtree" Have you encountered a problem using rlm_cache_rbtree module ? Thanks for your help. This message contains information that may be privileged or confidential and is the property of the Capgemini Group. It is intended only for the person to whom it is addressed. If you are not the intended recipient, you are not authorized to read, print, retain, copy, disseminate, distribute, or use this message or any part thereof. If you receive this message in error, please notify the sender immediately and delete all copies of this message.

5 11

Freeradius Proxy - Framed IP Address Accounting attribute
by Byron Jeffery 01 Sep '17

01 Sep '17

Hi All We are trailing a wifi system that does not send through the Framed IP Address attribute to our accounting server after the clients have successfully authenticated (EAP-PEAP-MSCHAP authentication) against a FreeRadius server hosted at another site within our WAN. I am of the mindset of setting up a Freeradius proxy server locally onsite with the purpose of sending back an accounting start with the Framed IP Address attribute to the accounting server but am unsure if this is even possible as I am unsure if the freeradius server would be able to determine the clients IP address as only the clients MAC address is passed to the radius server during authentication. I was unable to find any documentation that would support this, and would hope that someone could point me in the right direction. - Regards - Byron

5 21

django-freeradius
by Fiorella De Luca 01 Sep '17

01 Sep '17

Hi everyone, I am Fiorella De Luca and I am a participant of the Google Summer Code. During this three months, I have worked on an OpenWISP project regarding the creation of a freeradius web interface.This app, django-freeradius, is a web interface built in django that can be used to manipulate the data of a freeradius 3 database. The project offers a REST API which can (and should) be used with freeradius 3 rest module. It's not yet ready for production but we are close to completing the first phase. In these links you can find the main information about the project: - GSOC project summary: https://delucafiorella2602.blog/2017/08/28/google-summer-of-code-2017-djang… - Repository of the project: https://github.com/openwisp/django-freeradius - Documentation of the project: http://django-freeradius.readthedocs.io/en/latest/ If you are interested in trying it I would be glad to know your precious opinions and suggestions. Thank you! Fiorella De Luca

2 1

new table and query
by Johansson, Daniel (GIS) 31 Aug '17

31 Aug '17

Hi I use FreeRADIUS Version 2.2.6 I want to make a custom table and query for freeradius. sql is enabled in sites-enabled/default for 'post-auth {sql}' and postauth_query is populating radpostauth However my 'macuseradd_query ' is not run can anyone tell me why? I have inserted a new table to my mysql for radius 'authorizedmacs'. mysql> show tables; +------------------+ | Tables_in_radius | +------------------+ | authorizedmacs | | radacct | | radcheck | | radgroupcheck | | radgroupreply | | radpostauth | | radreply | | radusergroup | +------------------+ mysql> describe authorizedmacs; +------------+----------------------+------+-----+-------------------+-----------------------------+ | Field | Type | Null | Key | Default | Extra | +------------+----------------------+------+-----+-------------------+-----------------------------+ | id | smallint(5) unsigned | NO | PRI | NULL | auto_increment | | macaddress | varchar(12) | NO | MUL | NULL | | | created | timestamp | NO | | CURRENT_TIMESTAMP | on update CURRENT_TIMESTAMP | +------------+----------------------+------+-----+-------------------+-----------------------------+ I also added a entry in sql.conf macauth_table = "authorizedmacs" Then I created query in dailup.conf 'macuseradd_query ' ####################################################################### # Authentication Logging Queries ####################################################################### # postauth_query - Insert some info after authentication ####################################################################### postauth_query = "INSERT INTO ${postauth_table} \ (username, pass, reply, authdate) \ VALUES ( \ '%{User-Name}', \ '%{%{User-Password}:-%{Chap-Password}}', \ '%{reply:Packet-Type}', '%S')" macuseradd_query = "INSERT INTO ${macauth_table} \ (macaddress) \ VALUES ( \ '%{Calling-Station-Id}')" It would be much appreciated if anyone can tell me why macuseradd_query isn’t run as postauth_query is. BR /Daniel

5 11

Update on v4
by Alan DeKok 30 Aug '17

30 Aug '17

Version 4 has been under heavy development for the past year. The goal is to enable new features and new capabilities. Well, we're making progress. :) As background, in v4 proxying has been replaced by a "radius" module. The "radius" module sends RADIUS packets and waits (asynchronously) for a response. You can create one "radius" module for each home_server. e.g. radius home_server_1 { ... ip, port, secret, etc. } This also means that proxy.conf goes away (sorry), and that home_server_pools get replaced with "unlang": Home server pool *type = load-balance` gets replaced with 'unlang' load-balance { home_server_1 home_server_2 home_server_3 } Even better, you can now add proxying *anywhere*: if (User-Name == "bob") { home_server_1 } else if (User-Name == "doug") { home_server_2 } Or you can proxy multiple times: if (User-Name == "bob") { home_server_1 home_server_2 } Or catch proxy failures: home_server_1 if (fail) { linelog } Or (even more magically), proxy to multiple destinations at the same time: parallel { home_server_1 home_server_2 home_server_3 } i.e. it sends packets t home_server_1, then 2, then 3. It waits until it receives responses (or timeouts) from all of them. It then continues with processing the request. We're still not recommending average people install v4. There are some caveats which means it's best suited for people who know those caveats. But, the long wait has been worth it, I think. Things which used to be impossible in previous versions of the server are now *trivial* to do. The next step is to finalize the functionality which creates child requests. e.g. originate-coa, but more standardized. Once that's done, you should be able to do something like: if (... bandwidth exceeded...) { create child Disconnect-Request send to NAS } Which mimics the "originate-coa" functionality, but in 3 unlang statements. You can also take an Access-Request, and create one (or more) Accounting-Requests which are sent to home servers. The "radius" module also supports a "fire and forget" method, so that you can send packets to home servers, and continue without waiting for a response. We hope to release an alpha of version 4 this fall. Alan DeKok.

2 3

Freeradius and Winbindd Issue
by Kinglok Fong 30 Aug '17

30 Aug '17

Hi all, I am using freeradius 3.0.15. Samba version is 4.6.7. I compile both software on a Debian 9 machine. With nmbd and winbindd running flawlessly at the background, the domain user identification is working with using tools like wbinfo and id. However, when try to configure it with freeradius, it cannot authenticate. First of all, this configuration file: /usr/local/freeradius/etc/raddb/mods-enabled/mschap =============== winbind_username = “%{schap:User-Name}” winbind_domain = “SAMBADOM” #ntlm_auth = blahblahblah ============== Authentication was test using radtest =============== /usr/local/freeradius/bin/radtest -t mschap a_user thepassword 127.0.0.1 0 testing123 Sent Access-Request Id 191 from 0.0.0.0:39893 to 127.0.0.1:1812 length 129 User-Name = "a_user" MS-CHAP-Password = "thepassword" NAS-IP-Address = 192.168.107.7 NAS-Port = 0 Message-Authenticator = 0x00 Cleartext-Password = "thepassword" MS-CHAP-Challenge = 0xde5c70d1225f3f6c MS-CHAP-Response = 0x0001000000000000000000000000000000000000000000000000e1a8009205e77b1fbbf020022ba3e20b70df576b57c71971 Sent Access-Request Id 191 from 0.0.0.0:39893 to 127.0.0.1:1812 length 129 User-Name = "a_user" MS-CHAP-Password = "thepassword" NAS-IP-Address = 192.168.107.7 NAS-Port = 0 Message-Authenticator = 0x00 Cleartext-Password = "thepassword" MS-CHAP-Challenge = 0xde5c70d1225f3f6c MS-CHAP-Response = 0x0001000000000000000000000000000000000000000000000000e1a8009205e77b1fbbf020022ba3e20b70df576b57c71971 Sent Access-Request Id 191 from 0.0.0.0:39893 to 127.0.0.1:1812 length 129 User-Name = "a_user" MS-CHAP-Password = "thepassword" NAS-IP-Address = 192.168.107.7 NAS-Port = 0 Message-Authenticator = 0x00 Cleartext-Password = "thepassword" MS-CHAP-Challenge = 0xde5c70d1225f3f6c MS-CHAP-Response = 0x0001000000000000000000000000000000000000000000000000e1a8009205e77b1fbbf020022ba3e20b70df576b57c71971 (0) No reply from server for ID 191 socket 3 =================== log.winbindd (in log level 10) =================== [2017/08/29 15:03:44.139816, 10, pid=25544, effective(0, 0), real(0, 0), class=winbind] ../source3/winbindd/winbindd.c:761(process_request) process_request: request fn INTERFACE_VERSION [2017/08/29 15:03:44.141735, 3, pid=25544, effective(0, 0), real(0, 0), class=winbind] ../source3/winbindd/winbindd_misc.c:395(winbindd_interface_version) [25579]: request interface version (version = 28) [2017/08/29 15:03:44.143656, 10, pid=25544, effective(0, 0), real(0, 0), class=winbind] ../source3/winbindd/winbindd.c:864(winbind_client_response_written) winbind_client_response_written[25579:INTERFACE_VERSION]: delivered response to client [2017/08/29 15:03:44.145639, 10, pid=25544, effective(0, 0), real(0, 0), class=winbind] ../source3/winbindd/winbindd.c:761(process_request) process_request: request fn WINBINDD_PRIV_PIPE_DIR [2017/08/29 15:03:44.147727, 3, pid=25544, effective(0, 0), real(0, 0), class=winbind] ../source3/winbindd/winbindd_misc.c:428(winbindd_priv_pipe_dir) [25579]: request location of privileged pipe [2017/08/29 15:03:44.150965, 10, pid=25544, effective(0, 0), real(0, 0), class=winbind] ../source3/winbindd/winbindd.c:864(winbind_client_response_written) winbind_client_response_written[25579:WINBINDD_PRIV_PIPE_DIR]: delivered response to client [2017/08/29 15:03:44.153161, 6, pid=25544, effective(0, 0), real(0, 0), class=winbind] ../source3/winbindd/winbindd.c:919(new_connection) accepted socket 27 [2017/08/29 15:03:44.155338, 6, pid=25544, effective(0, 0), real(0, 0), class=winbind] ../source3/winbindd/winbindd.c:968(winbind_client_request_read) closing socket 25, client exited [2017/08/29 15:03:44.157538, 10, pid=25544, effective(0, 0), real(0, 0), class=winbind] ../source3/winbindd/winbindd.c:734(process_request) process_request: Handling async request 25579:GETGROUPS [2017/08/29 15:03:44.159669, 3, pid=25544, effective(0, 0), real(0, 0), class=winbind] ../source3/winbindd/winbindd_getgroups.c:60(winbindd_getgroups_send) getgroups freerad [2017/08/29 15:03:44.162646, 1, pid=25544, effective(0, 0), real(0, 0)] ../librpc/ndr/ndr.c:468(ndr_print_function_debug) wbint_LookupName: struct wbint_LookupName in: struct wbint_LookupName domain : * domain : 'SAMBADOM' name : * name : 'FREERAD' flags : 0x00000008 (8) [2017/08/29 15:03:44.171620, 1, pid=25544, effective(0, 0), real(0, 0)] ../librpc/ndr/ndr.c:468(ndr_print_function_debug) wbint_LookupName: struct wbint_LookupName out: struct wbint_LookupName type : * type : SID_NAME_USE_NONE (0) sid : * sid : S-0-0 result : NT_STATUS_NONE_MAPPED [2017/08/29 15:03:44.180970, 5, pid=25544, effective(0, 0), real(0, 0), class=winbind] ../source3/winbindd/winbindd_getgroups.c:235(winbindd_getgroups_recv) Could not convert sid S-0-0: NT_STATUS_NONE_MAPPED [2017/08/29 15:03:44.183154, 10, pid=25544, effective(0, 0), real(0, 0), class=winbind] ../source3/winbindd/winbindd.c:796(wb_request_done) wb_request_done[25579:GETGROUPS]: NT_STATUS_NONE_MAPPED [2017/08/29 15:03:44.192083, 10, pid=25544, effective(0, 0), real(0, 0), class=winbind] ../source3/winbindd/winbindd.c:864(winbind_client_response_written) winbind_client_response_written[25579:GETGROUPS]: delivered response to client ============== When I switch back using ntlm_auth instead, it is working flawlessly. Hope someone would help. Thanks for attending. Kinglok, Fong

4 10

django-freeradius
by Fiorella De Luca 29 Aug '17

29 Aug '17

Hi everyone, I am Fiorella De Luca and I am a participant of the Google Summer Code. During this three months, I have worked on an OpenWISP project regarding the creation of a freeradius web interface.This app, django-freeradius, is a web interface built in django that can be used to manipulate the data of a freeradius 3 database. The project offers a REST API which can (and should) be used with freeradius 3 rest module. It's not yet ready for production but we are close to completing the first phase. In these links you can find the main information about the project: GSOC project summary: https://delucafiorella2602.blog/2017/08/28/google-summer-of-code-2017-djang… .Repository of the project: https://github.com/openwisp/django-freeradius .Documentation of the project: http://django-freeradius.readthedocs.io/en/latest/ . If you are interested in trying it I would be glad to know your precious opinions and suggestions. Thank you! Fiorella De Luca

1 0

RE: How to log Access-Accept reply attributes/values in radpostauth sql
by James Wood 27 Aug '17

27 Aug '17

Thanks for the replies. I can use %{pairs:reply:} and it provides: "Acct-Interim-Interval =3D 120=2C Session-Timeout =3D 86400" But this doesn't look nice in the DB as it gets inserted exactly like that. Is there a way to unescape the quoted printable text to that =3D is actually = for example? I tried %{unescape:%{pairs:reply:}} but I didn't change it. Thanks James

3 2

How to log Access-Accept reply attributes/values in radpostauth sql
by James Wood 26 Aug '17

26 Aug '17

Hi All FR 3.0.13. Everything working perfectly, including SQL (mysql) for auth/acct logging. When a user authenticates, I would like to log any Access-Accept reply attributes we've set to sql (radpostauth). For example, my typical Access-Accept looks like this: Access-Accept (2), id: 0x2f, Authenticator: 123 Session-Timeout Attribute (27), length: 6, Value: 86400 Idle-Timeout Attribute (28), length: 6, Value: 600 Acct-Interim-Interval Attribute (85), length: 6, Value: 300 Therefore, I would like to log anything that was sent back to the NAS to the DB, in this instance: "Session-Timeout=86400,Idle-Timeout=600,Acct-Interim-Interval=300" or some other format as long as the data is readable... Is that possible? I tried using something like the below in the queries file: post-auth { query = "\ INSERT INTO ${..postauth_table} \ (username, pass, reply, authdate, callingstationid, calledstationid, attributes) \ VALUES ( \ '%{SQL-User-Name}', \ '%{%{User-Password}:-%{Chap-Password}}', \ '%{reply:Packet-Type}', \ '%S', \ '%{Calling-Station-Id}', \ '%{Called-Station-Id}', \ '%{reply:[*]}')" But doesn't appar I can use %{reply[*]} in that way. Thanks James

4 4

vlan assignment
by Zenon Matuszyk 25 Aug '17

25 Aug '17

Hello, I have a problem with vlan assignment on the group. If user is in group wi-fi should get ip with vlan 200 if it is in another group should get ip with vlan 216. I attach file witch freeradius -X. Users and group are in SAMBA4. If i login to wifi i get allways ip on vlan 216. I use login(a)mydomain.pl to connect wifi. I try add in users but this is ignored root@LDAP1 /etc/freeradius # cat users DEFAULT LDAP-Group != "wi-fi", Auth-Type:=Reject Reply-Message="You are not allowed to connnect" DEFAULT Realm == Null Auth-Type := Reject DEFAULT Realm == NULL, Client-IP-Address == 14x.xxx.x.40 Auth-Type := Reject DEFAULT Realm == NULL, Client-IP-Address == 14x.xxx.x.66 Auth-Type := Reject DEFAULT LDAP-Group == "wi-fi" Reply-Message="XXXX HIT: wi-fi", Tunnel-Private-Group-Id := 200, Tunnel-Type = VLAN, Tunnel-Medium-Type = IEEE-802, Please help -- Z poważaniem / Yours sincerely Zenon Matuszyk mobile: 00 48 797 004 938 e-mail: zenon.matuszyk(a)networkers.pl www: http://www.networkers.pl

2 3