- Freeradius-Users - lists.freeradius.org

Freeradius as a loadbalancer - logging dropped accounting requests
by Aleš Rygl 29 Jun '17

29 Jun '17

Hello, I am running several instances of Freeradius 3.0.13 on a single machine and one of them acts as a load balancer distributing just accounting request among four home servers listening on loopback on different ports: thread pool { start_servers = 64 max_servers = 1500 min_spare_servers = 50 max_spare_servers = 80 max_requests_per_server = 0 auto_limit_acct = no } realm NULL { acct_pool = DRACO_acct_pool nostrip } realm DEFAULT { acct_pool = DRACO_acct_pool nostrip } home_server_pool DRACO_acct_pool { type = keyed-balance home_server = rzt-gc-01 home_server = rzt-gc-02 home_server = rzt-gc-03 home_server = rzt-gc-04 } home_server rzt-gc-01 { type = acct ipaddr = 127.0.0.1 port = 2814 secret = testing123 response_window = 20 zombie_period = 40 revive_interval = 120 status_check = status-server check_interval = 10 check_timeout = 4 num_answers_to_alive = 3 coa { irt = 2 mrt = 16 mrc = 5 mrd = 30 } limit { max_connections = 16 max_requests = 0 lifetime = 0 idle_timeout = 0 } } ... and so on. The load is quite heavy - about 3.5k req/s. Balancing works fine, the key is Calling-Station-ID (MSISDN). What I can see is that there are some dropped packets in the stats: # echo "stats client acct" | radmin -d /etc/freeradius_lb/ radmin> stats client acct requests 39511449 responses 39508797 dup 0 invalid 0 malformed 0 bad_authenticator 0 dropped 1584 unknown_types 0 last_packet 1498477859 elapsed.1us 0 elapsed.10us 0 elapsed.100us 33765867 elapsed.1ms 5742921 elapsed.10ms 9 elapsed.100ms 0 elapsed.1s 0 elapsed.10s 0 radmin> The homeservers have no performance issues: # echo "stats client acct" | radmin -d /etc/freeradius_04/ radmin> stats client acct requests 159032334 responses 159030646 dup 21 invalid 0 malformed 0 bad_authenticator 0 dropped 21 unknown_types 0 last_packet 1498478023 elapsed.1us 0 elapsed.10us 0 elapsed.100us 158795858 elapsed.1ms 234786 elapsed.10ms 2 elapsed.100ms 0 elapsed.1s 0 elapsed.10s 0 radmin> Is there a way how to indetify the reason why are some req. dropped? I.e. logging such requestest? LB there is no lack of CPU or memory on the server, no drops in the UDP stack.. Thanks Ales

2 7

Delegated-IPv6-Prefix & sqlippool
by maxime.gerges＠ariane.network 29 Jun '17

29 Jun '17

Hello folks, I am currently checking for the possibility of using the sqlippool module to assign dynamically delegated IPv6 Prefixes. I found out that there is an option in the module to activate the IPv6 support and start assigning IPv6 address as well as traditional IPv4, but this option is only handling the creation of reply attribute 'Framed-IPv6-Prefix'. From the module's code on github, I also confirm that sqlippool doesn't seem to be ready to handle Delegated-IPv6-Prefix attribute. Does anybody know if this option might be interesting to be integrated in the code ? Is there any plan to add such option ? For information we are currently assigning Delegated IPv6 prefixes to customer thanks to an entry per customer in the radreply table and are copying the job of the sqlippool in an algorithm outside of the radius server. We do have a pool of available prefixes in an external database - when a customer subscribes we are picking up a prefix and populate it in the radreply - when the customer unsubscribe we are deleting the radreply entry and make the prefix available again in our external database. Many thanks for your replies. Maxime.

3 4

FR3.x - EAP proxy - EAP-TLS to MS NPS trouble
by Kylián Martin 29 Jun '17

29 Jun '17

Hi to everybody, I use freeradius for mac authentication bypass and as proxy for EAP. Specifically, an EAP-TLS that is routed to one of the MS NPS servers. I run the production environment on debian8 and FreeRadius 2.2.5, where everything works as it should. There is a problem I can not solve on the FreeRadius 3.0.12 (deb9) test server. After forwarding the access-request to the AD server, the request is not processed on the MS NPS server (w2012r2): Reason Code: 3 Reason: The RADIUS Request message that the Network Policy Server received from the network access server was malformed. NPS discards this request and does not respond. When I look at access-request with wireshark, I do not see any problem. (Message-authenticator is different from that sent by the client and which sends FreeRadius to NPS and Proxy-State added.) The same configuration with FR2.2.5 is parsed on NPS and is responded. Is there something I've overlooked when migrating to FR3? Is anyone running a similar configuration? I am doing something wrong? Thank you for any help Log: (2) Received Access-Request Id 27 from 192.168.59.80:1645 to 172.31.12.100:1812 length 340 (2) User-Name = "host/NB106484.example-edu.cz" (2) Service-Type = Framed-User (2) Framed-MTU = 1500 (2) Called-Station-Id = "28-34-A2-F0-7F-83" (2) Calling-Station-Id = "28-92-4A-25-56-CC" (2) EAP-Message = 0x020200710d800000006716030100620100005e03015953650a19b07c0ab643096685c9141950ad6c79abf54fa72736f856abd72b9900001cc014c013003900330035002fc00ac00900380032000a00130005000401000019000a0006000400170018000b0002010000170000ff01000100 (2) Message-Authenticator = 0xbfcf629e3a34b88c37d824ec7358e314 (2) NAS-Port-Type = Ethernet (2) NAS-Port = 50003 (2) NAS-Port-Id = "FastEthernet0/3" (2) State = 0x540106e70000013700011700fe800000000000002114a20fdc26eb140000000448ff01e5 (2) NAS-IP-Address = 192.168.59.80 (2) NAS-Identifier = "d4-cat2960-sw-132-2.net.sitmp.cz" (2) session-state: No cached attributes (2) # Executing section authorize from file /etc/freeradius/3.0/sites-enabled/default (2) authorize { rlm_sql (sql): Reserved connection (0) rlm_sql (sql): Released connection (0) (2) [sql] = notfound (2) if (!EAP-Message) { (2) if (!EAP-Message) -> FALSE (2) else { (2) if ("%{User-Name}" =~ /\.example-edu\.cz$/) { (2) EXPAND %{User-Name} (2) --> host/NB106484.example-edu.cz (2) if ("%{User-Name}" =~ /\.example-edu\.cz$/) -> TRUE (2) if ("%{User-Name}" =~ /\.example-edu\.cz$/) { (2) update control { (2) Proxy-To-Realm := 'EXAMPLE-EDU' (2) } # update control = noop (2) } # if ("%{User-Name}" =~ /\.example-edu\.cz$/) = noop (2) ... skipping elsif: Preceding "if" was taken (2) ... skipping elsif: Preceding "if" was taken (2) ... skipping else: Preceding "if" was taken (2) eap: Request is supposed to be proxied to Realm EXAMPLE-EDU. Not doing EAP. (2) [eap] = noop (2) } # else = noop (2) } # authorize = noop (2) Starting proxy to home server 172.31.12.14 port 1812 (2) Proxying request to home server 172.31.12.14 port 1812 timeout 20.000000 (2) Sent Access-Request Id 243 from 0.0.0.0:59582 to 172.31.12.14:1812 length 342 (2) User-Name = "host/NB106484.example-edu.cz" (2) Service-Type = Framed-User (2) Framed-MTU = 1500 (2) Called-Station-Id = "28-34-A2-F0-7F-83" (2) Calling-Station-Id = "28-92-4A-25-56-CC" (2) EAP-Message = 0x020200710d800000006716030100620100005e03015953650a19b07c0ab643096685c9141950ad6c79abf54fa72736f856abd72b9900001cc014c013003900330035002fc00ac00900380032000a00130005000401000019000a0006000400170018000b0002010000170000ff01000100 (2) Message-Authenticator = 0xbfcf629e3a34b88c37d824ec7358e314 (2) NAS-Port-Type = Ethernet (2) NAS-Port = 50003 (2) NAS-Port-Id = "FastEthernet0/3" (2) State = 0x540106e70000013700011700fe800000000000002114a20fdc26eb140000000448ff01e5 (2) NAS-IP-Address = 192.168.59.80 (2) NAS-Identifier = "d4-cat2960-sw-132-2.net.example.cz" (2) Proxy-State = 0x3237 Waking up in 0.3 seconds. (2) Expecting proxy response no later than 19.671053 seconds from now NPS receives (and discards for unknown reason): RADIUS Protocol Code: Access-Request (1) Packet identifier: 0xf3 (243) Length: 342 Authenticator: 0e4c4171a7c216d63ea6c394e98175bd Attribute Value Pairs AVP: l=28 t=User-Name(1): host/NB106484.plzen-edu.cz AVP: l=6 t=Service-Type(6): Framed(2) AVP: l=6 t=Framed-MTU(12): 1500 AVP: l=19 t=Called-Station-Id(30): 28-34-A2-F0-7F-83 AVP: l=19 t=Calling-Station-Id(31): 28-92-4A-25-56-CC AVP: l=115 t=EAP-Message(79) Last Segment[1] AVP Type: 79 AVP Length: 115 EAP fragment: 020200710d800000006716030100620100005e0301595365... Extensible Authentication Protocol AVP: l=18 t=Message-Authenticator(80): b2b9f1cf1e3ab216e63a949451ba2c69 AVP: l=6 t=NAS-Port-Type(61): Ethernet(15) AVP: l=6 t=NAS-Port(5): 50003 AVP: l=17 t=NAS-Port-Id(87): FastEthernet0/3 AVP: l=38 t=State(24): 540106e70000013700011700fe800000000000002114a20f... AVP: l=6 t=NAS-IP-Address(4): 192.168.59.80 AVP: l=34 t=NAS-Identifier(32): d4-cat2960-sw-132-2.net.sitmp.cz AVP: l=4 t=Proxy-State(33): 3237

3 4

Re: FreeRADIUS 3.0.12 VMPS and logging twice?
by Václav Ovsík 28 Jun '17

28 Jun '17

On Wed, Jun 28, 2017 at 03:49:52PM -0400, Alan DeKok wrote: > On Jun 28, 2017, at 3:27 PM, Václav Ovsík <vaclav.ovsik(a)i.cz> wrote: > > > > Forgot you to attach the patch? > > Hmm.. the mailing list strips it. I've attached it here. ...including the patch hier for completeness -----<snip>----- diff --git a/src/modules/proto_vmps/vmps.c b/src/modules/proto_vmps/vmps.c index f1df128..1fc0a19 100644 --- a/src/modules/proto_vmps/vmps.c +++ b/src/modules/proto_vmps/vmps.c @@ -37,6 +37,7 @@ static int vmps_process(REQUEST *request) process_post_auth(0, request); DEBUG2("Done VMPS"); + request->packet->code = 0; /* hack for VMPS */ request->reply->code = PW_CODE_ACCESS_ACCEPT; return 0; -----<snip>----- I rebuilt Debian package including your patch and it looks ok now! FreeRADIUS Version 3.0.12 Copyright (C) 1999-2016 The FreeRADIUS server project and contributors There is NO warranty; not even for MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE You may redistribute copies of FreeRADIUS under the terms of the GNU General Public License For more information about these matters, see the file named COPYRIGHT Starting - reading configuration files ... including dictionary file /usr/share/freeradius/dictionary including dictionary file /usr/share/freeradius/dictionary.dhcp including dictionary file /usr/share/freeradius/dictionary.vqp including dictionary file /etc/freeradius/3.0/dictionary including configuration file /etc/freeradius/3.0/radiusd.conf including configuration file /etc/freeradius/3.0/clients.conf including files in directory /etc/freeradius/3.0/mods-enabled/ including configuration file /etc/freeradius/3.0/mods-enabled/mac2vlan including configuration file /etc/freeradius/3.0/mods-enabled/linelog_vmps including files in directory /etc/freeradius/3.0/policy.d/ including configuration file /etc/freeradius/3.0/policy.d/control including configuration file /etc/freeradius/3.0/policy.d/canonicalization including configuration file /etc/freeradius/3.0/policy.d/eap including configuration file /etc/freeradius/3.0/policy.d/cui including configuration file /etc/freeradius/3.0/policy.d/dhcp including configuration file /etc/freeradius/3.0/policy.d/filter including configuration file /etc/freeradius/3.0/policy.d/accounting including configuration file /etc/freeradius/3.0/policy.d/abfab-tr including configuration file /etc/freeradius/3.0/policy.d/moonshot-targeted-ids including configuration file /etc/freeradius/3.0/policy.d/debug including configuration file /etc/freeradius/3.0/policy.d/operator-name including files in directory /etc/freeradius/3.0/sites-enabled/ including configuration file /etc/freeradius/3.0/sites-enabled/vmps main { security { user = "freerad" group = "freerad" allow_core_dumps = no } name = "freeradius" prefix = "/usr" localstatedir = "/var" logdir = "/var/log/freeradius" run_dir = "/var/run/freeradius" } main { name = "freeradius" prefix = "/usr" localstatedir = "/var" sbindir = "/usr/sbin" logdir = "/var/log/freeradius" run_dir = "/var/run/freeradius" libdir = "/usr/lib/freeradius" radacctdir = "/var/log/freeradius/radacct" hostname_lookups = no max_request_time = 30 cleanup_delay = 5 max_requests = 16384 pidfile = "/var/run/freeradius/freeradius.pid" checkrad = "/usr/sbin/checkrad" debug_level = 0 proxy_requests = no log { stripped_names = no auth = no auth_badpass = no auth_goodpass = no colourise = yes msg_denied = "You are already logged in - access denied" } resources { } security { max_attributes = 200 reject_delay = 1.000000 status_server = yes } } radiusd: #### Loading Realms and Home Servers #### radiusd: #### Loading Clients #### client localhost { ipaddr = 127.0.0.1 require_message_authenticator = no secret = <<< secret >>> nas_type = "other" proto = "*" limit { max_connections = 16 lifetime = 0 idle_timeout = 30 } } client localhost_ipv6 { ipv6addr = ::1 require_message_authenticator = no secret = <<< secret >>> limit { max_connections = 16 lifetime = 0 idle_timeout = 30 } } Debugger not attached radiusd: #### Instantiating modules #### modules { # Loaded module rlm_passwd # Loading module "mac2vlan" from file /etc/freeradius/3.0/mods-enabled/mac2vlan passwd mac2vlan { filename = "/etc/freeradius/3.0/mods-config/passwd/mac2vlan" format = "*VMPS-Mac:=VMPS-VLAN-Name" delimiter = "," ignore_nislike = yes ignore_empty = yes allow_multiple_keys = no hash_size = 100 } # Loaded module rlm_linelog # Loading module "linelog_vmps" from file /etc/freeradius/3.0/mods-enabled/linelog_vmps linelog linelog_vmps { filename = "/var/log/freeradius/vmps.log" escape_filenames = no syslog_severity = "info" permissions = 384 format = "%S %{VMPS-Client-IP-Address} %{VMPS-Port-Name} %{VMPS-Packet-Type} %{VMPS-Mac} -> %{reply:VMPS-VLAN-Name}" } instantiate { } # Instantiating module "mac2vlan" from file /etc/freeradius/3.0/mods-enabled/mac2vlan rlm_passwd: nfields: 2 keyfield 0(VMPS-Mac) listable: no # Instantiating module "linelog_vmps" from file /etc/freeradius/3.0/mods-enabled/linelog_vmps } # modules radiusd: #### Loading Virtual Servers #### server { # from file /etc/freeradius/3.0/radiusd.conf } # server server vmps { # from file /etc/freeradius/3.0/sites-enabled/vmps # Loading vmps {...} } # server vmps radiusd: #### Opening IP addresses and Ports #### listen { type = "vmps" ipaddr = 10.2.28.97 port = 1589 client cisco-switches { ipaddr = 192.168.0.0 netmask = 16 require_message_authenticator = no secret = <<< secret >>> limit { max_connections = 16 lifetime = 0 idle_timeout = 30 } } client cisco-switches2 { ipaddr = 10.0.0.0 netmask = 11 require_message_authenticator = no secret = <<< secret >>> limit { max_connections = 16 lifetime = 0 idle_timeout = 30 } } client monit { ipaddr = 192.168.30.80 netmask = 28 require_message_authenticator = no secret = <<< secret >>> limit { max_connections = 16 lifetime = 0 idle_timeout = 30 } } client monit2 { ipaddr = 10.0.156.80 netmask = 29 require_message_authenticator = no secret = <<< secret >>> limit { max_connections = 16 lifetime = 0 idle_timeout = 30 } } } Listening on vmps address 10.2.28.97 port 1589 bound to server vmps Ready to process requests VMPS-Packet-Type = VMPS-Join-Request VMPS-Error-Code = VMPS-No-Error VMPS-Sequence-Number = 4660 VMPS-Client-IP-Address = 127.0.0.1 VMPS-Port-Name = "Fa0/1" VMPS-VLAN-Name = "" VMPS-Domain-Name = "" VMPS-Unknown = 0x00 VMPS-MAC = d4:be:d9:68:15:58 (0) Received Access-Request Id 4660 from 192.168.30.82:49212 to 10.2.28.97:1589 length 60 (0) VMPS-Packet-Type = VMPS-Join-Request (0) VMPS-Error-Code = VMPS-No-Error (0) VMPS-Sequence-Number = 4660 (0) VMPS-Client-IP-Address = 127.0.0.1 (0) VMPS-Port-Name = "Fa0/1" (0) VMPS-VLAN-Name = "" (0) VMPS-Domain-Name = "" (0) VMPS-Unknown = 0x00 (0) VMPS-MAC = d4:be:d9:68:15:58 Doing VMPS (0) vmps { (0) if (!&VMPS-Mac) { (0) if (!&VMPS-Mac) -> FALSE (0) mac2vlan: Added VMPS-VLAN-Name: 'TPS' to reply_items (0) [mac2vlan] = ok (0) update reply { (0) &VMPS-Packet-Type = VMPS-Join-Response (0) &VMPS-Cookie = &VMPS-Mac -> d4:be:d9:68:15:58 (0) &VMPS-VLAN-Name = "Guest" (0) } # update reply = noop (0) if (&VMPS-Packet-Type == VMPS-Reconfirm-Request){ (0) if (&VMPS-Packet-Type == VMPS-Reconfirm-Request) -> FALSE (0) linelog_vmps: EXPAND %S %{VMPS-Client-IP-Address} %{VMPS-Port-Name} %{VMPS-Packet-Type} %{VMPS-Mac} -> %{reply:VMPS-VLAN-Name} (0) linelog_vmps: --> 2017-06-28 23:39:04 127.0.0.1 Fa0/1 VMPS-Join-Request d4:be:d9:68:15:58 -> TPS (0) linelog_vmps: EXPAND /var/log/freeradius/vmps.log (0) linelog_vmps: --> /var/log/freeradius/vmps.log (0) [linelog_vmps] = ok (0) } # vmps = ok Done VMPS (0) Sent Access-Accept Id 4660 from 10.2.28.97:1589 to 192.168.30.82:49212 length 0 VMPS-VLAN-Name = "TPS" VMPS-Cookie = d4:be:d9:68:15:58 (0) Finished request (0) Cleaning up request packet ID 4660 with timestamp +2 Ready to process requests Great! Many thanks for solving the problem! Regards -- Zito

1 0

Execute external script triggered by accounting request
by Leandro 28 Jun '17

28 Jun '17

Hi guys , I need to take device ip from accounting request packet, use this ip to run external script to grab some device parameters via ping and snmp. Im working on two methods , both have cons and advantages. 1st Method: "perl module." So far I have the module working with a testing script but when I want to exec net::ping module it yelds that root privileges are needed. I tried "usermod -G root radiusd" to provide radiusd root privileges but have not success. Other consequence of this method could be to get a very large delay considering that every devices takes 5~7 secs to process and send the response back, so I think that it would be good also to run this external script in background. 2nd Method " Tail the raddacct file" I can use a perl tail process to grab the "Framed_ip_address" from the accounting log file and execute the snmp and ping queries from outside the radius process Principal advantage could be that Im not adding extra delay to the radius accounting process. I wanted to know if is possible to change the accounting logging behaviour in the following way: Write always to /var/log/messages file (currently it writes to detail-YYYYMMDD file). Select the fields and write them horizontally instead of writting them in column format. Any idea would be wellcome. Regards Leandro.

2 1

shared secret
by Andrew Meyer 28 Jun '17

28 Jun '17

I have my clients setup with the same shared secret for testing. I have this setup w/ FreeIPA. However I am testing FreeRADIUS in debug mode and i'm running radtest against and not getting anything. I'm not sure why. I have verified that I am typing in the secret correctly. (10) Cleaning up request packet ID 88 with timestamp +475Ready to process requestsReceived Access-Request Id 88 from 127.0.0.1:60005 to 127.0.0.1:1812 length 76(11) Received Access-Request packet from host 127.0.0.1 port 60005, id=88, length=76(11) Dropping packet without response because of error: Received packet from 127.0.0.1 with invalid Message-Authenticator! (Shared secret is incorrect.)

2 2

Migration how to
by Olivier 28 Jun '17

28 Jun '17

Hello, I am migrating my configuration from FreeRadius 2 to 3 and I am struggling to go ahead. I am not really sure what is in the working configuration, nor why it is there. Does it exist some how to to help doing the migration? Best regards, Olivier --

3 2

FreeRADIUS 3.0.12 VMPS and logging twice?
by Václav Ovsík 28 Jun '17

28 Jun '17

Hi, we are using FreeRADIUS VMPS server for a long time on Debian GNU/Linux. It works perfectly and my tiny modification to dist vmps site definition is line log. With FreeRADIUS 2.2.5 it worked fine. I did upgrade of first VMPS yesterday (Debian Stretch) and did a small mods to vmps for FreeRADIUS version 3.0.12. What I didn't know to do with is that vmps processing doubled or two-phase or something (every request is logged twice). Request sent from monitoring site using check_vmps nagios plugin with success: VMPS OK - Vlan: TPS, MAC Address: d4bed9681558, Status: ALLOW response is correct one packet (checked using tcpdump). The output of freeradius -X: FreeRADIUS Version 3.0.12 Copyright (C) 1999-2016 The FreeRADIUS server project and contributors There is NO warranty; not even for MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE You may redistribute copies of FreeRADIUS under the terms of the GNU General Public License For more information about these matters, see the file named COPYRIGHT Starting - reading configuration files ... including dictionary file /usr/share/freeradius/dictionary including dictionary file /usr/share/freeradius/dictionary.dhcp including dictionary file /usr/share/freeradius/dictionary.vqp including dictionary file /etc/freeradius/3.0/dictionary including configuration file /etc/freeradius/3.0/radiusd.conf including configuration file /etc/freeradius/3.0/clients.conf including files in directory /etc/freeradius/3.0/mods-enabled/ including configuration file /etc/freeradius/3.0/mods-enabled/mac2vlan including configuration file /etc/freeradius/3.0/mods-enabled/linelog_vmps including files in directory /etc/freeradius/3.0/policy.d/ including configuration file /etc/freeradius/3.0/policy.d/control including configuration file /etc/freeradius/3.0/policy.d/canonicalization including configuration file /etc/freeradius/3.0/policy.d/eap including configuration file /etc/freeradius/3.0/policy.d/cui including configuration file /etc/freeradius/3.0/policy.d/dhcp including configuration file /etc/freeradius/3.0/policy.d/filter including configuration file /etc/freeradius/3.0/policy.d/accounting including configuration file /etc/freeradius/3.0/policy.d/abfab-tr including configuration file /etc/freeradius/3.0/policy.d/moonshot-targeted-ids including configuration file /etc/freeradius/3.0/policy.d/debug including configuration file /etc/freeradius/3.0/policy.d/operator-name including files in directory /etc/freeradius/3.0/sites-enabled/ including configuration file /etc/freeradius/3.0/sites-enabled/vmps main { security { user = "freerad" group = "freerad" allow_core_dumps = no } name = "freeradius" prefix = "/usr" localstatedir = "/var" logdir = "/var/log/freeradius" run_dir = "/var/run/freeradius" } main { name = "freeradius" prefix = "/usr" localstatedir = "/var" sbindir = "/usr/sbin" logdir = "/var/log/freeradius" run_dir = "/var/run/freeradius" libdir = "/usr/lib/freeradius" radacctdir = "/var/log/freeradius/radacct" hostname_lookups = no max_request_time = 30 cleanup_delay = 5 max_requests = 16384 pidfile = "/var/run/freeradius/freeradius.pid" checkrad = "/usr/sbin/checkrad" debug_level = 0 proxy_requests = no log { stripped_names = no auth = no auth_badpass = no auth_goodpass = no colourise = yes msg_denied = "You are already logged in - access denied" } resources { } security { max_attributes = 200 reject_delay = 1.000000 status_server = yes } } radiusd: #### Loading Realms and Home Servers #### radiusd: #### Loading Clients #### client localhost { ipaddr = 127.0.0.1 require_message_authenticator = no secret = <<< secret >>> nas_type = "other" proto = "*" limit { max_connections = 16 lifetime = 0 idle_timeout = 30 } } client localhost_ipv6 { ipv6addr = ::1 require_message_authenticator = no secret = <<< secret >>> limit { max_connections = 16 lifetime = 0 idle_timeout = 30 } } Debugger not attached radiusd: #### Instantiating modules #### modules { # Loaded module rlm_passwd # Loading module "mac2vlan" from file /etc/freeradius/3.0/mods-enabled/mac2vlan passwd mac2vlan { filename = "/etc/freeradius/3.0/mods-config/passwd/mac2vlan" format = "*VMPS-Mac:=VMPS-VLAN-Name" delimiter = "," ignore_nislike = yes ignore_empty = yes allow_multiple_keys = no hash_size = 100 } # Loaded module rlm_linelog # Loading module "linelog_vmps" from file /etc/freeradius/3.0/mods-enabled/linelog_vmps linelog linelog_vmps { filename = "/var/log/freeradius/vmps.log" escape_filenames = no syslog_severity = "info" permissions = 384 format = "%S %{VMPS-Client-IP-Address} %{VMPS-Port-Name} %{VMPS-Packet-Type} %{VMPS-Mac} -> %{reply:VMPS-VLAN-Name}" } instantiate { } # Instantiating module "mac2vlan" from file /etc/freeradius/3.0/mods-enabled/mac2vlan rlm_passwd: nfields: 2 keyfield 0(VMPS-Mac) listable: no # Instantiating module "linelog_vmps" from file /etc/freeradius/3.0/mods-enabled/linelog_vmps } # modules radiusd: #### Loading Virtual Servers #### server { # from file /etc/freeradius/3.0/radiusd.conf } # server server vmps { # from file /etc/freeradius/3.0/sites-enabled/vmps # Loading vmps {...} } # server vmps radiusd: #### Opening IP addresses and Ports #### listen { type = "vmps" ipaddr = 10.2.28.97 port = 1589 client cisco-switches { ipaddr = 192.168.0.0 netmask = 16 require_message_authenticator = no secret = <<< secret >>> limit { max_connections = 16 lifetime = 0 idle_timeout = 30 } } client cisco-switches2 { ipaddr = 10.0.0.0 netmask = 11 require_message_authenticator = no secret = <<< secret >>> limit { max_connections = 16 lifetime = 0 idle_timeout = 30 } } client monit { ipaddr = 192.168.30.80 netmask = 28 require_message_authenticator = no secret = <<< secret >>> limit { max_connections = 16 lifetime = 0 idle_timeout = 30 } } client monit2 { ipaddr = 10.0.156.80 netmask = 29 require_message_authenticator = no secret = <<< secret >>> limit { max_connections = 16 lifetime = 0 idle_timeout = 30 } } } Listening on vmps address 10.2.28.97 port 1589 bound to server vmps Ready to process requests VMPS-Packet-Type = VMPS-Join-Request VMPS-Error-Code = VMPS-No-Error VMPS-Sequence-Number = 4660 VMPS-Client-IP-Address = 127.0.0.1 VMPS-Port-Name = "Fa0/1" VMPS-VLAN-Name = "" VMPS-Domain-Name = "" VMPS-Unknown = 0x00 VMPS-MAC = d4:be:d9:68:15:58 (0) Received Access-Request Id 4660 from 192.168.30.82:41160 to 10.2.28.97:1589 length 60 (0) VMPS-Packet-Type = VMPS-Join-Request (0) VMPS-Error-Code = VMPS-No-Error (0) VMPS-Sequence-Number = 4660 (0) VMPS-Client-IP-Address = 127.0.0.1 (0) VMPS-Port-Name = "Fa0/1" (0) VMPS-VLAN-Name = "" (0) VMPS-Domain-Name = "" (0) VMPS-Unknown = 0x00 (0) VMPS-MAC = d4:be:d9:68:15:58 Doing VMPS (0) vmps { (0) if (!&VMPS-Mac) { (0) if (!&VMPS-Mac) -> FALSE (0) mac2vlan: Added VMPS-VLAN-Name: 'TPS' to reply_items (0) [mac2vlan] = ok (0) update reply { (0) &VMPS-Packet-Type = VMPS-Join-Response (0) &VMPS-Cookie = &VMPS-Mac -> d4:be:d9:68:15:58 (0) &VMPS-VLAN-Name = "Guest" (0) } # update reply = noop (0) if (&VMPS-Packet-Type == VMPS-Reconfirm-Request){ (0) if (&VMPS-Packet-Type == VMPS-Reconfirm-Request) -> FALSE (0) linelog_vmps: EXPAND %S %{VMPS-Client-IP-Address} %{VMPS-Port-Name} %{VMPS-Packet-Type} %{VMPS-Mac} -> %{reply:VMPS-VLAN-Name} (0) linelog_vmps: --> 2017-06-28 17:21:53 127.0.0.1 Fa0/1 VMPS-Join-Request d4:be:d9:68:15:58 -> TPS (0) linelog_vmps: EXPAND /var/log/freeradius/vmps.log (0) linelog_vmps: --> /var/log/freeradius/vmps.log (0) [linelog_vmps] = ok (0) } # vmps = ok Done VMPS (0) vmps { (0) if (!&VMPS-Mac) { (0) if (!&VMPS-Mac) -> FALSE (0) mac2vlan: Added VMPS-VLAN-Name: 'TPS' to reply_items (0) [mac2vlan] = ok (0) update reply { (0) &VMPS-Packet-Type = VMPS-Join-Response (0) &VMPS-Cookie = &VMPS-Mac -> d4:be:d9:68:15:58 (0) &VMPS-VLAN-Name = "Guest" (0) } # update reply = noop (0) if (&VMPS-Packet-Type == VMPS-Reconfirm-Request){ (0) if (&VMPS-Packet-Type == VMPS-Reconfirm-Request) -> FALSE (0) linelog_vmps: EXPAND %S %{VMPS-Client-IP-Address} %{VMPS-Port-Name} %{VMPS-Packet-Type} %{VMPS-Mac} -> %{reply:VMPS-VLAN-Name} (0) linelog_vmps: --> 2017-06-28 17:21:53 127.0.0.1 Fa0/1 VMPS-Join-Request d4:be:d9:68:15:58 -> TPS (0) linelog_vmps: EXPAND /var/log/freeradius/vmps.log (0) linelog_vmps: --> /var/log/freeradius/vmps.log (0) [linelog_vmps] = ok (0) } # vmps = ok (0) Sent Access-Accept Id 4660 from 10.2.28.97:1589 to 192.168.30.82:41160 length 0 VMPS-VLAN-Name = "TPS" VMPS-Cookie = d4:be:d9:68:15:58 (0) Finished request (0) Cleaning up request packet ID 4660 with timestamp +3 Ready to process requests To distributed Debian configuration I did only * disabled proxy_requests in radiusd.conf * added to site-enabled vmps, removed default and inner-tunnel * removed all mods from mods-enabled and enable linelog-vmps and mac2vlan Any idea why there is second pass after 'Done VMPS'? Regards -- Zito

2 1

LDAP group authentication
by Jake L. 28 Jun '17

28 Jun '17

Hello - I successfully got our Freeradius server to authenticate against our FreeIPA LDAP environment, allowing user access. Currently, all users in here will be granted successful access. However, I'm having trouble trying to identify what to setup to get only a single group in our FreeIPA environment allowed to authenticate while all other groups are denied. In a nutshell, I want to only allow the "network-team" group authenticated access via the Freeradius server, and any/all other groups to be denied. In my wiki and google searches, I've found reference to "group_authorization", but I can't find that module in the policy.d or mods-available folder. Also, I've seen the reference to huntgroups, but only when queried against SQL, which shouldn't be needed in my case. Can anyone point me in the right direction to get this working? TL;DR = Need info on setting up Freeradius authentication to LDAP only for a specific group, denying all other groups. Thank you!Jake

3 4

Freeradius with ldap authentication
by Fatih Naufal 27 Jun '17

27 Jun '17

Hello before i ask this question, i already read and try the freeradius + ldap authentication from https://wiki.freeradius.org/protocol/LDAP and http://confluence.diamond.ac.uk/display/PAAUTH/Using+LDAP+as+authentication…. But now i'm kinda stuck with that both documentation, because everytime i test the user in ldap (using radtest) i get "no DN found". I already check that the dn has properly set up (i'm using phpldapadmin to create user in ldap to make it easier). Here is the debug log : Tue Jun 27 05:54:40 2017 : Debug: (1) Received Access-Request Id 251 from 127.0.0.1:53093 to 127.0.0.1:1812 length 74 Tue Jun 27 05:54:41 2017 : Debug: (1) User-Name = "teke" Tue Jun 27 05:54:41 2017 : Debug: (1) User-Password = "xxx" Tue Jun 27 05:54:41 2017 : Debug: (1) NAS-IP-Address = 127.0.1.1 Tue Jun 27 05:54:41 2017 : Debug: (1) NAS-Port = 1812 Tue Jun 27 05:54:41 2017 : Debug: (1) Message-Authenticator = 0xef22ab207657169978bd2b65ef0f42c6 Tue Jun 27 05:54:41 2017 : Debug: (1) session-state: No State attribute Tue Jun 27 05:54:41 2017 : Debug: (1) # Executing section authorize from file /etc/freeradius/3.0/sites-enabled/default Tue Jun 27 05:54:41 2017 : Debug: (1) authorize { Tue Jun 27 05:54:41 2017 : Debug: (1) policy filter_username { Tue Jun 27 05:54:41 2017 : Debug: (1) if (&User-Name) { Tue Jun 27 05:54:41 2017 : Debug: (1) if (&User-Name) -> TRUE Tue Jun 27 05:54:41 2017 : Debug: (1) if (&User-Name) { Tue Jun 27 05:54:41 2017 : Debug: (1) if (&User-Name =~ /@[^@]*@/ ) { Tue Jun 27 05:54:41 2017 : Debug: No matches Tue Jun 27 05:54:41 2017 : Debug: (1) if (&User-Name =~ /@[^@]*@/ ) -> FALSE Tue Jun 27 05:54:41 2017 : Debug: (1) if (&User-Name =~ /\.\./ ) { Tue Jun 27 05:54:41 2017 : Debug: No matches Tue Jun 27 05:54:41 2017 : Debug: (1) if (&User-Name =~ /\.\./ ) -> FALSE Tue Jun 27 05:54:41 2017 : Debug: (1) if ((&User-Name =~ /@/) && (&User-Name !~ /(a)(.+)\.(.+)$/)) { Tue Jun 27 05:54:41 2017 : Debug: No matches Tue Jun 27 05:54:41 2017 : Debug: (1) if ((&User-Name =~ /@/) && (&User-Name !~ /(a)(.+)\.(.+)$/)) -> FALSE Tue Jun 27 05:54:41 2017 : Debug: (1) if (&User-Name =~ /\.$/) { Tue Jun 27 05:54:41 2017 : Debug: No matches Tue Jun 27 05:54:41 2017 : Debug: (1) if (&User-Name =~ /\.$/) -> FALSE Tue Jun 27 05:54:41 2017 : Debug: (1) if (&User-Name =~ /(a)\./) { Tue Jun 27 05:54:41 2017 : Debug: No matches Tue Jun 27 05:54:41 2017 : Debug: (1) if (&User-Name =~ /(a)\./) -> FALSE Tue Jun 27 05:54:41 2017 : Debug: (1) } # if (&User-Name) = notfound Tue Jun 27 05:54:41 2017 : Debug: (1) } # policy filter_username = notfound Tue Jun 27 05:54:41 2017 : Debug: (1) modsingle[authorize]: calling preprocess (rlm_preprocess) Tue Jun 27 05:54:41 2017 : Debug: (1) modsingle[authorize]: returned from preprocess (rlm_preprocess) Tue Jun 27 05:54:41 2017 : Debug: (1) [preprocess] = ok Tue Jun 27 05:54:41 2017 : Debug: (1) modsingle[authorize]: calling chap (rlm_chap) Tue Jun 27 05:54:41 2017 : Debug: (1) modsingle[authorize]: returned from chap (rlm_chap) Tue Jun 27 05:54:41 2017 : Debug: (1) [chap] = noop Tue Jun 27 05:54:41 2017 : Debug: (1) modsingle[authorize]: calling mschap (rlm_mschap) Tue Jun 27 05:54:41 2017 : Debug: (1) modsingle[authorize]: returned from mschap (rlm_mschap) Tue Jun 27 05:54:41 2017 : Debug: (1) [mschap] = noop Tue Jun 27 05:54:41 2017 : Debug: (1) modsingle[authorize]: calling digest (rlm_digest) Tue Jun 27 05:54:41 2017 : Debug: (1) modsingle[authorize]: returned from digest (rlm_digest) Tue Jun 27 05:54:41 2017 : Debug: (1) [digest] = noop Tue Jun 27 05:54:41 2017 : Debug: (1) modsingle[authorize]: calling suffix (rlm_realm) Tue Jun 27 05:54:41 2017 : Debug: (1) suffix: Checking for suffix after "@" Tue Jun 27 05:54:41 2017 : Debug: (1) suffix: No '@' in User-Name = "teke", looking up realm NULL Tue Jun 27 05:54:41 2017 : Debug: (1) suffix: No such realm "NULL" Tue Jun 27 05:54:41 2017 : Debug: (1) modsingle[authorize]: returned from suffix (rlm_realm) Tue Jun 27 05:54:41 2017 : Debug: (1) [suffix] = noop Tue Jun 27 05:54:41 2017 : Debug: (1) modsingle[authorize]: calling eap (rlm_eap) Tue Jun 27 05:54:41 2017 : Debug: (1) eap: No EAP-Message, not doing EAP Tue Jun 27 05:54:41 2017 : Debug: (1) modsingle[authorize]: returned from eap (rlm_eap) Tue Jun 27 05:54:41 2017 : Debug: (1) [eap] = noop Tue Jun 27 05:54:41 2017 : Debug: (1) modsingle[authorize]: calling files (rlm_files) Tue Jun 27 05:54:41 2017 : Debug: (1) modsingle[authorize]: returned from files (rlm_files) Tue Jun 27 05:54:41 2017 : Debug: (1) [files] = noop Tue Jun 27 05:54:41 2017 : Debug: (1) modsingle[authorize]: calling ldap (rlm_ldap) Tue Jun 27 05:54:41 2017 : Info: rlm_ldap (ldap): Closing connection (1): Hit idle_timeout, was idle for 118721 seconds Tue Jun 27 05:54:41 2017 : Debug: rlm_ldap: Closing libldap handle 0x558ba43988d0 Tue Jun 27 05:54:42 2017 : Info: rlm_ldap (ldap): Closing connection (2): Hit idle_timeout, was idle for 118721 seconds Tue Jun 27 05:54:42 2017 : Debug: rlm_ldap: Closing libldap handle 0x558ba439cf90 Tue Jun 27 05:54:42 2017 : Info: rlm_ldap (ldap): Closing connection (3): Hit idle_timeout, was idle for 118721 seconds Tue Jun 27 05:54:42 2017 : Debug: rlm_ldap: Closing libldap handle 0x558ba438f2e0 Tue Jun 27 05:54:42 2017 : Info: rlm_ldap (ldap): Closing connection (4): Hit idle_timeout, was idle for 118721 seconds Tue Jun 27 05:54:42 2017 : Debug: rlm_ldap (ldap): You probably need to lower "min" Tue Jun 27 05:54:42 2017 : Debug: rlm_ldap: Closing libldap handle 0x558ba4392d70 Tue Jun 27 05:54:42 2017 : Info: rlm_ldap (ldap): Closing connection (0): Hit idle_timeout, was idle for 118711 seconds Tue Jun 27 05:54:42 2017 : Debug: rlm_ldap (ldap): You probably need to lower "min" Tue Jun 27 05:54:42 2017 : Debug: rlm_ldap: Closing libldap handle 0x558ba44fefb0 Tue Jun 27 05:54:42 2017 : Info: rlm_ldap (ldap): Closing connection (5): Hit idle_timeout, was idle for 118711 seconds Tue Jun 27 05:54:42 2017 : Debug: rlm_ldap (ldap): You probably need to lower "min" Tue Jun 27 05:54:42 2017 : Debug: rlm_ldap: Closing libldap handle 0x558ba439f860 Tue Jun 27 05:54:42 2017 : Debug: rlm_ldap (ldap): 0 of 0 connections in use. You may need to increase "spare" Tue Jun 27 05:54:42 2017 : Info: rlm_ldap (ldap): Opening additional connection (6), 1 of 32 pending slots used Tue Jun 27 05:54:42 2017 : Debug: rlm_ldap (ldap): Connecting to ldap://localhost:389 Tue Jun 27 05:54:42 2017 : Debug: rlm_ldap (ldap): New libldap handle 0x558ba438e620 Tue Jun 27 05:54:42 2017 : Debug: rlm_ldap (ldap): Waiting for bind result... Tue Jun 27 05:54:43 2017 : Debug: rlm_ldap (ldap): Bind successful Tue Jun 27 05:54:43 2017 : Debug: rlm_ldap (ldap): Reserved connection (6) Tue Jun 27 05:54:43 2017 : Debug: (1) ldap: EXPAND TMPL XLAT Tue Jun 27 05:54:43 2017 : Debug: (uid=%{%{Stripped-User-Name}:-%{User-Name}}) Tue Jun 27 05:54:43 2017 : Debug: Parsed xlat tree: Tue Jun 27 05:54:43 2017 : Debug: literal --> (uid= Tue Jun 27 05:54:43 2017 : Debug: if { Tue Jun 27 05:54:43 2017 : Debug: attribute --> Stripped-User-Name Tue Jun 27 05:54:43 2017 : Debug: } Tue Jun 27 05:54:43 2017 : Debug: else { Tue Jun 27 05:54:43 2017 : Debug: attribute --> User-Name Tue Jun 27 05:54:43 2017 : Debug: } Tue Jun 27 05:54:43 2017 : Debug: literal --> ) Tue Jun 27 05:54:43 2017 : Debug: (1) ldap: EXPAND (uid=%{%{Stripped-User-Name}:-%{User-Name}}) Tue Jun 27 05:54:43 2017 : Debug: (1) ldap: --> (uid=teke) Tue Jun 27 05:54:43 2017 : Debug: (1) ldap: EXPAND TMPL LITERAL Tue Jun 27 05:54:43 2017 : Debug: (1) ldap: Performing search in "" with filter "(uid=teke)", scope "sub" Tue Jun 27 05:54:43 2017 : Debug: (1) ldap: Waiting for search result... Tue Jun 27 05:54:43 2017 : Debug: (1) ldap: The specified DN wasn't found Tue Jun 27 05:54:43 2017 : Debug: (1) ldap: Search returned no results Tue Jun 27 05:54:43 2017 : Debug: rlm_ldap (ldap): Released connection (6) Tue Jun 27 05:54:43 2017 : Info: rlm_ldap (ldap): Need 2 more connections to reach 10 spares Tue Jun 27 05:54:43 2017 : Info: rlm_ldap (ldap): Opening additional connection (7), 1 of 31 pending slots used Tue Jun 27 05:54:43 2017 : Debug: rlm_ldap (ldap): Connecting to ldap://localhost:389 Tue Jun 27 05:54:43 2017 : Debug: rlm_ldap (ldap): New libldap handle 0x558ba439b660 Tue Jun 27 05:54:43 2017 : Debug: rlm_ldap (ldap): Waiting for bind result... Tue Jun 27 05:54:43 2017 : Debug: rlm_ldap (ldap): Bind successful Tue Jun 27 05:54:43 2017 : Debug: (1) modsingle[authorize]: returned from ldap (rlm_ldap) Tue Jun 27 05:54:43 2017 : Debug: (1) [ldap] = notfound Tue Jun 27 05:54:43 2017 : Debug: (1) } # authorize = notfound Tue Jun 27 05:54:43 2017 : ERROR: (1) No Auth-Type found: rejecting the user via Post-Auth-Type = Reject Tue Jun 27 05:54:43 2017 : Debug: (1) Failed to authenticate the user Tue Jun 27 05:54:43 2017 : Debug: (1) Using Post-Auth-Type Reject Tue Jun 27 05:54:43 2017 : Debug: (1) # Executing group from file /etc/freeradius/3.0/sites-enabled/default Tue Jun 27 05:54:43 2017 : Debug: (1) Post-Auth-Type REJECT { Tue Jun 27 05:54:43 2017 : Debug: (1) modsingle[post-auth]: calling attr_filter.access_reject (rlm_attr_filter) Tue Jun 27 05:54:43 2017 : Debug: %{User-Name} Tue Jun 27 05:54:43 2017 : Debug: Parsed xlat tree: Tue Jun 27 05:54:43 2017 : Debug: attribute --> User-Name Tue Jun 27 05:54:43 2017 : Debug: (1) attr_filter.access_reject: EXPAND %{User-Name} Tue Jun 27 05:54:43 2017 : Debug: (1) attr_filter.access_reject: --> teke Tue Jun 27 05:54:43 2017 : Debug: (1) attr_filter.access_reject: Matched entry DEFAULT at line 11 Tue Jun 27 05:54:43 2017 : Debug: (1) modsingle[post-auth]: returned from attr_filter.access_reject (rlm_attr_filter) Tue Jun 27 05:54:43 2017 : Debug: (1) [attr_filter.access_reject] = updated Tue Jun 27 05:54:43 2017 : Debug: (1) modsingle[post-auth]: calling eap (rlm_eap) Tue Jun 27 05:54:43 2017 : Debug: (1) eap: Request didn't contain an EAP-Message, not inserting EAP-Failure Tue Jun 27 05:54:43 2017 : Debug: (1) modsingle[post-auth]: returned from eap (rlm_eap) Tue Jun 27 05:54:43 2017 : Debug: (1) [eap] = noop Tue Jun 27 05:54:43 2017 : Debug: (1) policy remove_reply_message_if_eap { Tue Jun 27 05:54:43 2017 : Debug: (1) if (&reply:EAP-Message && &reply:Reply-Message) { Tue Jun 27 05:54:43 2017 : Debug: (1) if (&reply:EAP-Message && &reply:Reply-Message) -> FALSE Tue Jun 27 05:54:43 2017 : Debug: (1) else { Tue Jun 27 05:54:43 2017 : Debug: (1) modsingle[post-auth]: calling noop (rlm_always) Tue Jun 27 05:54:43 2017 : Debug: (1) modsingle[post-auth]: returned from noop (rlm_always) Tue Jun 27 05:54:43 2017 : Debug: (1) [noop] = noop Tue Jun 27 05:54:43 2017 : Debug: (1) } # else = noop Tue Jun 27 05:54:43 2017 : Debug: (1) } # policy remove_reply_message_if_eap = noop Tue Jun 27 05:54:43 2017 : Debug: (1) } # Post-Auth-Type REJECT = updated Tue Jun 27 05:54:43 2017 : Debug: (1) Delaying response for 1.000000 seconds Tue Jun 27 05:54:43 2017 : Debug: Waking up in 0.9 seconds. Tue Jun 27 05:54:44 2017 : Debug: (1) Sending delayed response Tue Jun 27 05:54:44 2017 : Debug: (1) Sent Access-Reject Id 251 from 127.0.0.1:1812 to 127.0.0.1:53093 length 20 Tue Jun 27 05:54:44 2017 : Debug: Waking up in 3.9 seconds. Tue Jun 27 05:54:48 2017 : Debug: (1) Cleaning up request packet ID 251 with timestamp +118720 Any kind of help, documentation recommendation would help. thankyou!

2 1