- Freeradius-Users - lists.freeradius.org

FYI, I gave up on eap-tls for OS X and ios.
by John Tobin 02 Apr '17

02 Apr '17

I am currently setup with a cisco 1282 access point running wpa2 supported by free radius under suse linux [tumble weed]. I am supporting students on window 7, [I believe I have a few win-10s] and osx, will be testing ios later this week. The server is the CA, and for testing purposes I had setup a self signed cert, and was testing the client cert. I could not get it to work, went through a number of different efforts with multiple tries / multiple profiles on osx sierra, and el capitan Peap will have to do the job. that’s what is currently running. Sincerely, tob

3 6

Question on Unlang
by Olivier CALVANO 02 Apr '17

02 Apr '17

Hi i request your help for know if it's possible in unlang Actually, in policy.d/my.conf i have: if ((Tunnel-Server-Endpoint:0[0] != '172.16.1.1') && (User-Name =~ /\\.local/) && (User-Name !~ /network\\.local/) && (User-Name !~ /admin\\.local/) && (User-Name !~ /wifi\\.local/) && ("%{Packet-Src-IP-Address}" == "192.168.20.1")) { update reply { <...> } } elsif ((Tunnel-Server-Endpoint:0[0] != '172.16.1.1') && (User-Name =~ /\\.local/) && (User-Name !~ /network\\.local/) && (User-Name !~ /admin\\.local/) && (User-Name !~ /wifi\\.local/) && ("%{Packet-Src-IP-Address}" == "192.168.50.1")) { update reply { <...> } } i put only 3 in my sample of !~ (network,admin and wifi), but i have ~40 and i have ~30 of "elsif" it's a long file ;) i want know if it's possible in unlang to create a list: SubRealm_Exclude { network.local admin.local wifi.local } and after put in if condition : if ((Tunnel-Server-Endpoint:0[0] != '172.16.1.1') && (User-Name =~ /\\.local/) && (User-Name !~ SubRealm_Exclude) && ("%{Packet-Src-IP-Address}" == "192.168.20.1")) { update reply { <...> } } elsif ((Tunnel-Server-Endpoint:0[0] != '172.16.1.1') && (User-Name =~ /\\.local/) && (User-Name !~ SubRealm_Exclude) && ("%{Packet-Src-IP-Address}" == "192.168.50.1")) { update reply { <...> } } Thanks for your help regards

4 14

Initial access requests getting dropped, successive requests succeed
by Jeremy Stretch 31 Mar '17

31 Mar '17

Hi folks, We run three FreeRADIUS servers as proxies in front of some LDAP servers for network authentication. These servers have been running for well over a year without issue until recently. Two of the three servers have started inexplicably dropping access requests, but still respond intermittently. As an isolated test, I have a Juniper switch configured to authenticate to one of the FreeRADIUS servers, which in turn authenticates against one backend LDAP server. When I try to log into the switch, tcpdump on the RADIUS server confirms that it receives an Access-Request packet. I've stopped the normal daemon and am running `freeradius -X` on the server, but it prints only a single line in response to the Access-Request: Ready to process requests. It prints this same line each time a request is dropped. I can't find any information about what's actually happening. tcpdump confirms that FreeRADIUS is receiving the Access-Request packet, but it does not even attempt to contact the LDAP server. However, when I attempt to authenticate again a few seconds later (after the switch's first request has timed out), the RADIUS server responds normally with a successful authentication, with no indication (AFAICT) of any error. I can log out and immediately log back in with no problems, but if I wait for more than a few seconds, the request gets dropped again. Even stranger, this only appears to affect the primary and secondary server; forcing authentication requests to the tertiary server succeeds. To rule out LDAP as a problem, I've been trying to authenticate using an account defined locally on the FreeRADIUS server, but I have the same problem: The initial access request gets dropped; successive requests succeed. Here is my config from /etc/freeradius/sites-enabled/default: authorize { preprocess suffix files ldap expiration logintime } authenticate { Auth-Type LDAP { ldap } } preacct { preprocess acct_unique suffix files } accounting { detail unix radutmp exec attr_filter.accounting_response } session { radutmp } post-auth { exec } The three servers were originally all running v2.1.12. We upgraded the primary to v2.2.9 but it still has the same issue. Hard-coding the IP of the LDAP server didn't help, so it doesn't appear to be related to DNS, nor do there appear to be any disk or memory issues. I'm really at a loss for what to try next, other than blowing them away and rebuilding all three servers. Any pointers are much appreciated. Jeremy

3 4

Correlating request and accept/reject log?
by jm+freeradiususer＠roth.lu 31 Mar '17

31 Mar '17

Hey, Suppose you are logging access requests, access-accepts, and access-rejects (into different log files), how do you link a request to a reject (or accept) message? Can we include additional items (like Calling-Station-Id, NAS-Port, etc.) in the reject log? Thanks, Marki

3 11

ERROR: rlm_sql_mysql: ERROR 1136
by Renato Sousa 31 Mar '17

31 Mar '17

I have noticed several messages in the freeradius logs that appear below: Fri Mar 24 17:18:12 2017 : ERROR: (17331) sql: ERROR: rlm_sql_mysql: ERROR 1136 (Column count doesn't match value count at row 1): 21S01 I made the system update (FreeBSD 10.3) and also updated freeradius to version 3.0.13, but the problem persists. Anyone know how to solve this? Regards, Renato L. Sousa

2 3

Cannot get the return code of rlm_krb5
by LAUDREN Olivier 30 Mar '17

30 Mar '17

Hello, I am using FreeRADIUS v3.0.4 on Red Hat Enterprise Linux Server release 7.2 (Maipo), the authenticate section is below; authenticate { Auth-Type Kerberos { krb5 update control { Reason := "%{Module-Return-Code}" } } } The attribute gets the correct value except (at least) for the "fail" and the "invalid" return codes. According to the document; http://networkradius.com/doc/FreeRADIUS%20Technical%20Guide.pdf Table 4.3.3.2 Action table for the Authenticate section. Code Action default reject reject return fail continue ok return handled return invalid continue userlock return notfound return noop continue updated continue The "fail" should be taken into account but it looks like the action table is as the authorize one below; Code Action default noop reject return fail return ok continue handled return invalid return userlock return notfound continue noop continue updated continue I have tried to override as shown on this page with no success; https://wiki.freeradius.org/config/Fail-over Any idea of how I could get the actual result from rlm_krb5 module? Thank you in advance, Regards, Olivier LAUDREN. Ce message contient des informations confidentielles à l'intention exclusive du destinataire. Il ne peut être utilisé, divulgué ou copié de quelconque façon que ce soit par une personne autre que le destinataire désigné. Si vous n'êtes pas le destinataire désigné, merci de contacter l'expéditeur et d'effacer ce message. L'expéditeur de ce message n'est pas mandaté à représenter le Parlement européen. Dès lors, ce message ne constitue pas nécessairement le point de vue officiel du Parlement européen, ni un engagement juridique opposable à ce dernier. This message contains confidential information intended solely for the attention of the named addressee. It may not be used, disclosed or copied in any way whatsoever by anyone else than the intended addressee. If you are not the intended addressee, please contact the sender and delete this message. The sender of this message is not authorized to represent the European Parliament and therefore this message does not necessarily reflect the official position of the European Parliament and is not legally binding upon it.

3 4

Performance or locking issue with rlm_detail
by Aleš Rygl 30 Mar '17

30 Mar '17

Hello. I would like to kindly ask for help with freeradius server processing Accounting req. I am running freeradius 3.0.11 on Debian stable, kernel 3.16.0-4-amd64. Server is DL380 G9, CPU E5-2680 v3 @ 2.50GHz, 256GB RAM, very fast HP SSD RAID5 2.5 TB. The kernel can see 48 CPU. Radius is processing ~ 3kqps of Accounting (Telco environment). The daemon receives Acct. req. and using module rml_detail it writes it into a detail file(s) - there are 32 file queues based on modulo of Calling-Station-Id. detail detail.mobile { Queue-Number = "%{expr: %{Calling-Station-Id} %% 32 }" filename = ${radacctdir}/detail.mobile_v3/queue-${Queue-Number}/detail-%Y%m%d%H locking = yes } Then there are detail file loaders into DB: server buffered-sql-0 { listen { type = detail filename = "${radacctdir}/detail.mobile_v3/queue-0/detail-*" load_factor = 95 track = yes poll_interval = 1 retry_interval = 60 } preacct { } accounting { sql_instance_mobile if (noop) { ok } } } Some server params: max_request_time = 10 cleanup_delay = 5 max_requests = 20000 hostname_lookups = no max_servers = 1500 min_spare_servers = 100 max_spare_servers = 300 Everything works fine, there is ~15 connections to DB while processing ~2-3 kqps. Freeradius utilize about 3 CPU. This setup can load gigs of logs into DB without slowing down Radius responses. The issue is that freeradius randomly starts to use too much CPU (60-70% of whole server). There are following lines appearing in the log: Wed Mar 29 09:17:43 2017 : WARNING: (44056176) WARNING: Module rlm_detail became unblocked for request 44056176 Wed Mar 29 09:17:43 2017 : WARNING: (44056177) WARNING: Module rlm_detail became unblocked for request 44056177 Wed Mar 29 09:17:43 2017 : WARNING: (44056178) WARNING: Module rlm_detail became unblocked for request 44056178 Wed Mar 29 09:17:43 2017 : WARNING: (44056179) WARNING: Module rlm_detail became unblocked for request 44056179 Wed Mar 29 09:17:43 2017 : WARNING: (44056180) WARNING: Module rlm_detail became unblocked for request 44056180 It seems to be related to high spikes in the incoming radius traffic that occurs every hour - the issue become worse after DST change when certain amount of terminal were restarted in the same moment and their sessions produce Radius Accounting synchronously. But not every time. I have an old server doing the same thing running Freeradius 3.0.8., the kernel can see 24 CPU, and it really never happened here while on the new box it is on daily basis. The configuration of Radius is identical. Thanks Regards Ales

2 3

FR 3.0.13 "swallowing" Requests when acting as a home server?
by Martin Pauly 30 Mar '17

30 Mar '17

Hi, apart from the Debian package issues reported earlier, I ran into another problem which I'm pretty sure can be attributed to some change between 3.0.12 and 3.0.13. After I had worked around the Debian package issues (on Jessie) and installed 3.0.13, I found proxied requests from my "border server" to NOT show up in the home server -- but only every now and then. Due to the intermittent nature of that problem and because we have two servers of each kind for redundancy, it took me some time to realize what was going on. So after more than a week of intermittent, short-lived failures, I first migrated the home servers back to 3.0.12. That moment, the problem was gone. Meanwhile the border servers are back to 3.0.12, too, and things have remained well. The _only_ thing I changed during the 3.0.13 period was a Samba/winbind security update which had no visible effect. Sorry for this pretty superficial report, but right now I do not have the time to set up a test environment where I could test the current development versions from git. Martin -- Dr. Martin Pauly Phone: +49-6421-28-23527 HRZ Univ. Marburg Fax: +49-6421-28-26994 Hans-Meerwein-Str. E-Mail: pauly(a)HRZ.Uni-Marburg.DE D-35032 Marburg

2 1

rlm_perl returning attributes
by Ryan De Kock 30 Mar '17

30 Mar '17

Hi. I'm trying to return an attribute using the rlm_rest module. Authentication works fine but when a response is sent, an Access-Reject is generated. I'm hoping someone can point me in the right direction. *Working auth *(with no attributes in the response) (8) Cleaning up request packet ID 178 with timestamp +606 Ready to process requests (9) Received Access-Request Id 17 from 127.0.0.1:45433 to 127.0.0.1:1812 length 77 (9) User-Name = "585c208457bf8c3820c9e431(a)test.com" (9) User-Password = "password" (9) # Executing section authorize from file /usr/local/etc/raddb/sites-enabled/default (9) authorize { rlm_rest (rest): Reserved connection (16) (9) rest: Expanding URI components (9) rest: EXPAND http://127.0.0.1:1337 (9) rest: --> http://127.0.0.1:1337 (9) rest: EXPAND /Radius/auth?username=%{User-Name}&password=%{User-Password} (9) rest: --> /Radius/auth?username=585c208457bf8c3820c9e431%40test.com &password=password (9) rest: Sending HTTP GET to " http://127.0.0.1:1337/Radius/auth?username=585c208457bf8c3820c9e431%40test.… " (9) rest: Processing response header (9) rest: Status : 201 (Created) (9) rest: Type : json (application/json) rlm_rest (rest): Released connection (16) rlm_rest (rest): Need 1 more connections to reach 10 spares rlm_rest (rest): Opening additional connection (17), 1 of 30 pending slots used rlm_rest (rest): Connecting to "http://127.0.0.1:1337" (9) [rest] = ok (9) if (ok || updated) { (9) if (ok || updated) -> TRUE (9) if (ok || updated) { (9) update control { (9) Auth-Type := Rest (9) } # update control = noop (9) } # if (ok || updated) = noop (9) policy filter_username { (9) if (&User-Name) { (9) if (&User-Name) -> TRUE (9) if (&User-Name) { (9) if (&User-Name =~ / /) { (9) if (&User-Name =~ / /) -> FALSE (9) if (&User-Name =~ /@[^@]*@/ ) { (9) if (&User-Name =~ /@[^@]*@/ ) -> FALSE (9) if (&User-Name =~ /\.\./ ) { (9) if (&User-Name =~ /\.\./ ) -> FALSE (9) if ((&User-Name =~ /@/) && (&User-Name !~ /(a)(.+)\.(.+)$/)) { (9) if ((&User-Name =~ /@/) && (&User-Name !~ /(a)(.+)\.(.+)$/)) -> FALSE (9) if (&User-Name =~ /\.$/) { (9) if (&User-Name =~ /\.$/) -> FALSE (9) if (&User-Name =~ /(a)\./) { (9) if (&User-Name =~ /(a)\./) -> FALSE (9) } # if (&User-Name) = ok (9) } # policy filter_username = ok (9) [preprocess] = ok (9) [chap] = noop (9) [mschap] = noop (9) [digest] = noop (9) suffix: Checking for suffix after "@" (9) suffix: Looking up realm "test.com" for User-Name = " 585c208457bf8c3820c9e431(a)test.com" (9) suffix: No such realm "test.com" (9) [suffix] = noop (9) eap: No EAP-Message, not doing EAP (9) [eap] = noop (9) [files] = noop (9) [expiration] = noop (9) [logintime] = noop (9) pap: WARNING: No "known good" password found for the user. Not setting Auth-Type (9) pap: WARNING: Authentication will fail unless a "known good" password is available (9) [pap] = noop (9) } # authorize = ok (9) Found Auth-Type = Rest (9) # Executing group from file /usr/local/etc/raddb/sites-enabled/default (9) Auth-Type Rest { rlm_rest (rest): Reserved connection (15) (9) rest: Expanding URI components (9) rest: EXPAND http://127.0.0.1:1337 (9) rest: --> http://127.0.0.1:1337 (9) rest: EXPAND /Radius/auth?username=%{User-Name}&password=%{User-Password} (9) rest: --> /Radius/auth?username=585c208457bf8c3820c9e431%40test.com &password=password (9) rest: Sending HTTP GET to " http://127.0.0.1:1337/Radius/auth?username=585c208457bf8c3820c9e431%40test.… " (9) rest: Processing response header (9) rest: Status : 201 (Created) (9) rest: Type : json (application/json) rlm_rest (rest): Released connection (15) (9) [rest] = ok (9) } # Auth-Type Rest = ok (9) # Executing section post-auth from file /usr/local/etc/raddb/sites-enabled/default (9) post-auth { (9) update { (9) No attributes updated (9) } # update = noop (9) [exec] = noop (9) policy remove_reply_message_if_eap { (9) if (&reply:EAP-Message && &reply:Reply-Message) { (9) if (&reply:EAP-Message && &reply:Reply-Message) -> FALSE (9) else { (9) [noop] = noop (9) } # else = noop (9) } # policy remove_reply_message_if_eap = noop (9) } # post-auth = noop (9) Sent Access-Accept Id 17 from 127.0.0.1:1812 to 127.0.0.1:45433 length 0 (9) Finished request Waking up in 4.9 seconds. *exactly the same auth*, except I try return some values (8) Received Access-Request Id 178 from 127.0.0.1:41930 to 127.0.0.1:1812 length 77 (8) User-Name = "585c208457bf8c3820c9e431(a)test.com" (8) User-Password = "password" (8) # Executing section authorize from file /usr/local/etc/raddb/sites-enabled/default (8) authorize { rlm_rest (rest): Closing connection (13): Hit idle_timeout, was idle for 239 seconds rlm_rest (rest): You probably need to lower "min" rlm_rest (rest): Closing connection (14): Hit idle_timeout, was idle for 239 seconds rlm_rest (rest): You probably need to lower "min" rlm_rest (rest): Closing connection (12): Hit idle_timeout, was idle for 239 seconds rlm_rest (rest): You probably need to lower "min" rlm_rest (rest): 0 of 0 connections in use. You may need to increase "spare" rlm_rest (rest): Opening additional connection (15), 1 of 32 pending slots used rlm_rest (rest): Connecting to "http://127.0.0.1:1337" rlm_rest (rest): Reserved connection (15) (8) rest: Expanding URI components (8) rest: EXPAND http://127.0.0.1:1337 (8) rest: --> http://127.0.0.1:1337 (8) rest: EXPAND /Radius/auth?username=%{User-Name}&password=%{User-Password} (8) rest: --> /Radius/auth?username=585c208457bf8c3820c9e431%40test.com &password=password (8) rest: Sending HTTP GET to " http://127.0.0.1:1337/Radius/auth?username=585c208457bf8c3820c9e431%40test.… " (8) rest: Processing response header (8) rest: Status : 201 (Created) (8) rest: Type : json (application/json) (8) rest: Parsing attribute "Mikrotik-Address-List" (8) rest: EXPAND myList (8) rest: --> myList (8) rest: Mikrotik-Address-List := "myList" rlm_rest (rest): Released connection (15) rlm_rest (rest): Need 2 more connections to reach 10 spares rlm_rest (rest): Opening additional connection (16), 1 of 31 pending slots used rlm_rest (rest): Connecting to "http://127.0.0.1:1337" (8) [rest] = updated (8) if (ok || updated) { (8) if (ok || updated) -> TRUE (8) if (ok || updated) { (8) update control { (8) Auth-Type := Rest (8) } # update control = noop (8) } # if (ok || updated) = noop (8) policy filter_username { (8) if (&User-Name) { (8) if (&User-Name) -> TRUE (8) if (&User-Name) { (8) if (&User-Name =~ / /) { (8) if (&User-Name =~ / /) -> FALSE (8) if (&User-Name =~ /@[^@]*@/ ) { (8) if (&User-Name =~ /@[^@]*@/ ) -> FALSE (8) if (&User-Name =~ /\.\./ ) { (8) if (&User-Name =~ /\.\./ ) -> FALSE (8) if ((&User-Name =~ /@/) && (&User-Name !~ /(a)(.+)\.(.+)$/)) { (8) if ((&User-Name =~ /@/) && (&User-Name !~ /(a)(.+)\.(.+)$/)) -> FALSE (8) if (&User-Name =~ /\.$/) { (8) if (&User-Name =~ /\.$/) -> FALSE (8) if (&User-Name =~ /(a)\./) { (8) if (&User-Name =~ /(a)\./) -> FALSE (8) } # if (&User-Name) = updated (8) } # policy filter_username = updated (8) [preprocess] = ok (8) [chap] = noop (8) [mschap] = noop (8) [digest] = noop (8) suffix: Checking for suffix after "@" (8) suffix: Looking up realm "test.com" for User-Name = " 585c208457bf8c3820c9e431(a)test.com" (8) suffix: No such realm "test.com" (8) [suffix] = noop (8) eap: No EAP-Message, not doing EAP (8) [eap] = noop (8) [files] = noop (8) [expiration] = noop (8) [logintime] = noop (8) pap: WARNING: No "known good" password found for the user. Not setting Auth-Type (8) pap: WARNING: Authentication will fail unless a "known good" password is available (8) [pap] = noop (8) } # authorize = updated (8) Found Auth-Type = Rest (8) # Executing group from file /usr/local/etc/raddb/sites-enabled/default (8) Auth-Type Rest { rlm_rest (rest): Reserved connection (15) (8) rest: Expanding URI components (8) rest: EXPAND http://127.0.0.1:1337 (8) rest: --> http://127.0.0.1:1337 (8) rest: EXPAND /Radius/auth?username=%{User-Name}&password=%{User-Password} (8) rest: --> /Radius/auth?username=585c208457bf8c3820c9e431%40test.com &password=password (8) rest: Sending HTTP GET to " http://127.0.0.1:1337/Radius/auth?username=585c208457bf8c3820c9e431%40test.… " (8) rest: Processing response header (8) rest: Status : 201 (Created) (8) rest: Type : json (application/json) (8) rest: Parsing attribute "Mikrotik-Address-List" (8) rest: EXPAND myList (8) rest: --> myList (8) rest: Mikrotik-Address-List := "myList" rlm_rest (rest): Released connection (15) (8) [rest] = updated (8) } # Auth-Type Rest = updated (8) Failed to authenticate the user (8) Using Post-Auth-Type Reject (8) # Executing group from file /usr/local/etc/raddb/sites-enabled/default (8) Post-Auth-Type REJECT { (8) attr_filter.access_reject: EXPAND %{User-Name} (8) attr_filter.access_reject: --> 585c208457bf8c3820c9e431(a)test.com (8) attr_filter.access_reject: Matched entry DEFAULT at line 11 (8) [attr_filter.access_reject] = updated (8) [eap] = noop (8) policy remove_reply_message_if_eap { (8) if (&reply:EAP-Message && &reply:Reply-Message) { (8) if (&reply:EAP-Message && &reply:Reply-Message) -> FALSE (8) else { (8) [noop] = noop (8) } # else = noop (8) } # policy remove_reply_message_if_eap = noop (8) } # Post-Auth-Type REJECT = updated (8) Delaying response for 1.000000 seconds Waking up in 0.2 seconds. Waking up in 0.7 seconds. (8) Sending delayed response (8) Sent Access-Reject Id 178 from 127.0.0.1:1812 to 127.0.0.1:41930 length 20 Waking up in 3.9 seconds. It seems that because rest updated the user that it now fails for some reason (8) [rest] = updated (8) } # Auth-Type Rest = updated (8) Failed to authenticate the user What do I need to change to allow this process to go through? I would appreciate any light shedding.

2 3

Newly added user dont get authentication in free radius
by Rauf Khan 30 Mar '17

30 Mar '17

Hi there! I have recently configured free radius. The users i created first time works well but when i added new users to the user file i got error while trying radtest for new users. Rauf Khan IT Manager KUST, Kohat Phone: 92-922-554434 Cell: 0334-8343004

3 2