- Freeradius-Users - lists.freeradius.org

How freeradius responds in json format to the request to authorize
by Fiorella De Luca 23 Jul '17

23 Jul '17

Hello! I am a new Freeradius user. I'm participating in the Google Summer Code and I'm working on an OpenWISP project regarding the creation of a freeradius web interface. This app Django-freeradius will be a web interface to a manage freeradius database using a Django Rest framework . I I installed FreeRADIUS Version 3.0.12 on Ubuntu. I am using rlm_rest So I can configure freeradius to delegate some or all of its operations (authorization, authentication, accounting, mail order) to a REST API. But I can not understand how freeradius responds in json format to the request to authorize . I tried to accept the user with Auth-Type: = Accept And for the user to refuse: Auth-Type: = Reject but it does not work. If anyone could give me an explanation I'll be more than happy. Thank you!

3 2

Attr-26.135.22.100?
by Stefan Paetow 21 Jul '17

21 Jul '17

Hi Alan, Arran, After an upgrade to FR 3.0.15 on a test system, I suddenly have an unknown attribute 'Attr-26.135.22.100' in the debug output. It appears that EAP-Channel-Binding-Message is no longer recognised as such in the debug output? When I downgrade to 3.0.14 the issue persists, but when I drop back to 3.0.10 it recovers itself to say 'EAP-Channel-Binding-Message' in the debug output... Can someone else reproduce this with 3.0.15? I know this doesn't affect operations, but... it's irksome? *puzzled face* With Regards Stefan Paetow Moonshot Industry & Research Liaison Coordinator t: +44 (0)1235 822 125 gpg: 0x3FCE5142 xmpp: stefanp(a)jabber.dev.ja.net skype: stefan.paetow.janet jisc.ac.uk Jisc is a registered charity (number 1149740) and a company limited by guarantee which is registered in England under Company No. 5747339, VAT No. GB 197 0632 86. Jisc’s registered office is: One Castlepark, Tower Hill, Bristol, BS2 0JA. T 0203 697 5800.

2 4

Radsec config query
by Alex Sharaz 21 Jul '17

21 Jul '17

Been playing with RADSEC (FR3.0.15) and having gt stuff working thought I'd tidy up my config files so ... sites-enabled/tls has the following structure listen { ... clients = radsec limit { ... } tls { <my radse tls config> } } //end of listen clients radsec { .... } home_server tls .... home_server_pool ... realm ..... having sorted out the tls {..} section, I added a tls { $include our_tls/ } to my radiusd.conf file and copied the contents of my original tls section into /usr/local/etc/freeradius/our_tls/prodn2 as shown below prodn2 { <all tls config setting from original sites-enabled/tls file tls section> } In sites-enabled/tls I then replaced tls { .. } with tls = ${tls.prodn2} FR fails to start up with error Fri Jul 21 10:19:24 2017 : Error: /usr/local/etc/freeradius/sites-enabled/tls[87]: Client does not have the same TLS configuration as the listener Fri Jul 21 10:19:24 2017 : Error: /usr/local/etc/freeradius/sites-enabled/tls[7]: Failed to load clients for this listen section but all I've done is move the tls{..} contents into radiusd.conf tls {prodn2 {...}} and added a tls=${tls.prodn2} statement.

3 4

TCP - FR3 client/server connection timeout
by Edelberto Franco 21 Jul '17

21 Jul '17

With TCP/TLS I have a curious comportment Imagine this scenario: # server : port case (1) FR3:33001 -> radsecproxy:2083 case (2) radsecproxy: 44001 -> FR3:2083 For case (1) FR3 is the client, and radsecproxy is the server. Case (2) shows FR3 as a server of radsecproxy for TCP/TLS connections. In case (1) FR3 TCP connection always keeps ESTABLISHED with radsecproxy, but in case (2) FR3 closes its connection with radsecproxy (client) after less than 1 minute (sending a FIN, normal...). So, is it possible to set FR3 to don't send FIN and close the TCP connection with radsecproxy client? Thank you, --E

2 3

Missing groupname in radacct table
by Antonio Silva 21 Jul '17

21 Jul '17

Hi all, I've set the account query to include the groupname in radacct table but it expand the %{SQL-Group} to empty... any idea what i'm doing wrong? You can check the full configuration used for accounting in https://pastebin.com/dnEQRwUf But in resume i do: INSERT INTO ${....acct_table1} \ (${...column_list}) \ VALUES \ ('%{Acct-Session-Id}', \ '%{Acct-Unique-Session-Id}', \ '%{SQL-User-Name}', \ '%{SQL-Group}', \ '%{Realm}', \ ... In the log when authentication is done is see the group been set... But it inserts the groupname empty... (0) sql: Executing select query: SELECT groupname FROM radusergroup WHERE username = 'MyUSER' ORDER BY priority (0) sql: User found in the group table (0) sql: EXPAND SELECT id, groupname, attribute, Value, op FROM radgroupcheck WHERE groupname = '%{SQL-Group}' ORDER BY id (0) sql: --> SELECT id, groupname, attribute, Value, op FROM radgroupcheck WHERE groupname = 'group2' ORDER BY id (0) sql: Executing select query: SELECT id, groupname, attribute, Value, op FROM radgroupcheck WHERE groupname = 'group2' ORDER BY id (0) sql: Group "group2": Conditional check items matched (0) sql: Group "group2": Merging assignment check items (0) sql: Simultaneous-Use := 100 (0) sql: EXPAND SELECT id, groupname, attribute, value, op FROM radgroupreply WHERE groupname = '%{SQL-Group}' ORDER BY id (0) sql: --> SELECT id, groupname, attribute, value, op FROM radgroupreply WHERE groupname = 'group2' ORDER BY id (0) sql: Executing select query: SELECT id, groupname, attribute, value, op FROM radgroupreply WHERE groupname = 'group2' ORDER BY id (0) sql: Group "group2": Merging reply items ... (1) sql: EXPAND INSERT INTO radacct (acctsessionid, acctuniqueid, username, groupname, realm, nasipaddress, nasportid, nasporttype, acctstarttime, acctupdatetime, acctstoptime, acctsessiontime, acctauthentic, connectinfo_start, connectinfo_stop, acctinputoctets, acctoutputoctets, calledstationid, callingstationid, acctterminatecause, servicetype, framedprotocol, framedipaddress) VALUES ('%{Acct-Session-Id}', '%{Acct-Unique-Session-Id}', '%{SQL-User-Name}', '%{SQL-Group}', '%{Realm}', '%{NAS-IP-Address}', '%{%{NAS-Port-ID}:-%{NAS-Port}}', '%{NAS-Port-Type}', FROM_UNIXTIME(%{integer:Event-Timestamp}), FROM_UNIXTIME(%{integer:Event-Timestamp}), NULL, '0', '%{Acct-Authentic}', '%{Connect-Info}', '', '0', '0', '%{Called-Station-Id}', '%{Calling-Station-Id}', '', '%{Service-Type}', '%{Framed-Protocol}', '%{Framed-IP-Address}') (1) sql: --> INSERT INTO radacct (acctsessionid, acctuniqueid, username, groupname, realm, nasipaddress, nasportid, nasporttype, acctstarttime, acctupdatetime, acctstoptime, acctsessiontime, acctauthentic, connectinfo_start, connectinfo_stop, acctinputoctets, acctoutputoctets, calledstationid, callingstationid, acctterminatecause, servicetype, framedprotocol, framedipaddress) VALUES ('5971E477290A00', '3a3680e379da33a7ad1c8436a1f049ed', 'MyUSER', '', '', '127.0.1.1', '0', 'Async', FROM_UNIXTIME(1500636279), FROM_UNIXTIME(1500636279), NULL, '0', 'RADIUS', '', '', '0', '0', 'L2TP:telework_sol1', '', '', 'Framed-User', 'PPP', '192.168.10.200') (1) sql: Executing query: INSERT INTO radacct (acctsessionid, acctuniqueid, username, groupname, realm, nasipaddress, nasportid, nasporttype, acctstarttime, acctupdatetime, acctstoptime, acctsessiontime, acctauthentic, connectinfo_start, connectinfo_stop, acctinputoctets, acctoutputoctets, calledstationid, callingstationid, acctterminatecause, servicetype, framedprotocol, framedipaddress) VALUES ('5971E477290A00', '3a3680e379da33a7ad1c8436a1f049ed', 'MyUSER', '', '', '127.0.1.1', '0', 'Async', FROM_UNIXTIME(1500636279), FROM_UNIXTIME(1500636279), NULL, '0', 'RADIUS', '', '', '0', '0', 'L2TP:telework_sol1', '', '', 'Framed-User', 'PPP', '192.168.10.200') -- Saludos / Regards / Cumprimentos, António silva

2 2

Rotating detail files.
by Alex Sharaz 21 Jul '17

21 Jul '17

FR 3.0.14 Ubuntu 16.04 I'm creating a detail file which is used by an agent to upload contents into our logstash. detail detail-filebeat{ filename = /var/spool/freeradius/detail-filebeat escape_filenames = no permissions = 0600 # group = ${security.group} header = "%t" locking = yes suppress { User-Password } detail-fileberat invoked in both default and inner-tunnel sites Logrotate configured as /var/spool/freeradius/detail-filebeat { rotate 1 postrotate /bin/kill -HUP `cat /var/run/freeradius/freeradius.pid` endscript } Problem is that although logrotate rotates the file, freeradius isn't writing to the newly created file. A FR restart sorts it out but I'd rather not restart the server every day. I'm using radmin on another server to reread files periodically, might I be able to persuade FR to write to the new file via radadmin ? Rgds Alex

2 2

MySQL DB and /n in Cisco-AVPair problem
by Andy Smith 20 Jul '17

20 Jul '17

Hi everyone, we are attempting to migrate a system from FreeRadius 1.x to 3.x and we have an issue with our Cisco network devices. Basically authentication fails. Stepping back a bit and doing some testing with NTRadPing everything looks ok, except for one small detail. With both the 1.x and 3.x systems we get "response: Access-Accept" and a load of details such as Service-Type, Tunnel-Password etc. However I see differences for non printing characters such as "/n". So for the Cisco-AVPair in the output in NTRadPing I see on 1.x: lcp:interface-config=ip unnumbered loopback 2003\n But on 3.x I see: lcp:interface-config=ip unnumbered loopback 2003\0x0a The output from 1.x is exactly how the data is entered and displays direct in MySQL. I've tried double escaping the "\" but it doesn't make any difference. I see that 0x0a is the ASCII encoding for \n, has something changed in FreeRadius WRT this? Or perhaps its an issue at the MySQL level? I also note the output for the Tunnel-Password displays differently between 1.x and 3.x. I'm testing this on FreeBSD 11.0 and FreeRadius 3.0.14 and MySQL 8.0 (although I've previously encountered this issue with 5.x), thanks, Andy.

3 8

Discarding conflicting packet due to recent request
by khouzam yaghi 20 Jul '17

20 Jul '17

i am receiving this error from time to time in the radius log Error: Discarding conflicting packet from client PPPOE1 port 33184 - ID: 1 due to recent request i searched online and found very old posts about this error, what does it mean? is it something related to the database slow? or broken NAS? my NAS is a Linux server running accel-ppp as a pppoe-server. is this something related to the NAS itself or to my configuration with freeradius? also what does this error means? Regards.

2 1

Arris CMTS attributes
by Kalil de A. Carvalho 20 Jul '17

20 Jul '17

Hello all. I'm trying configure a FreeRADIUS to centralize all my devices authentication, it is a simple configuration, I guess. But one of my vendors is Arris and my device is a CMTS, more specifically CMTS_V08.02.01.07. What I want to do is just pass the user level but I looked for this attributes and not found in any site. I tryed to search some examples but I did not have any sucesses. Does any one has this kind of configuration, more precisely, one example of the users file? Here my environment: S.O: CentOS 7 FreeRADIUS version: Version 3.0.4, for host x86_64-redhat-linux-gnu Best regards -- Atenciosamente, Kalil de A. Carvalho

2 3

use detail file to proxy Access-Request
by adrian.p.smith＠bt.com 20 Jul '17

20 Jul '17

For some testing we are doing it's desirable to send some existing Access-Request traffic to an additional remote server. For Accounting we routinely use a detail file with an associated listening server to achieve this. Looking at the source code, it appears that a detail file listener throws access requests away. Is there any other way to get this working please? Regards, Adrian

2 1