- Freeradius-Users - lists.freeradius.org

Accounting/Reporting module/wiki
by Aaron Dalla-Longa 03 Apr '17

03 Apr '17

Hello everyone. I am having trouble finding documentation or a usage example on how to generate reports with freeradius. Our reports requirement isn't too deep, it simply requires how many connections, and 2 ldap attributes. -- *Aaron Dalla-Longa* Systems Administrator Shortgrass Library System tf: 1.866.529.0550 | p: 403.529.0550

2 1

User authentication for remote NAS'?
by wefwe fewfew 03 Apr '17

03 Apr '17

Hi, I'm completely new to Freeradius and mysql and have been playing around with it for the past couple of weeks. A lot of fun but also a bit frustrating at times. So far I've managed to get Freeradius and mysql working. I can even authenticate users and send back attributes to them to limit time online, link speed etc. This part I've got working. However one thing I'm totally unable to figure out is how I can base authentication on which NAS a user is trying to log in from. I've been reading the mailing lists, googling, and there are people with similar questions but I've yet to find an answer. Hopefully somebody can give me some pointers :) Goal: Have multiple NAS' in remote locations authenticate with a central Freeradius server. The NAS' will be in remote locations, I won't always know the IP and in some cases they will be using the same IP as they are behind a private network. Setting up radius proxies at the remote locations is not an option. I was thinking about using the NAS-ID or called-station-id to authenticate instead. The NAS-ID is in the rad_recv request so I'm figuring somehow it must be possible to use that? My non-programmer-way-of-thinking Freeradius receives request from NAS NAS request includes NAS-ID Freeradius somehow checks if NAS-ID is present in mysql table If not present -> Reject request If present -> check usergroup that corresponds with the NAS-ID and authenticate against the users in that group. Very simple minded I thought that it might be as simple as modifying the hunt group tutorial on the wiki by replacing the nas-ip with nas-id but that didn't work. After some more reading all the mailing list entries tell me the wiki is wrong and won't work. Right now I'm at a loss and don't know what to do. The mailing list is my last resort. I would like to know if A) its possible to use anything other than the IP to identify the NAS and B) How would I go about achieving that? By the way, if I ever get this working, can I write a guide and submit it to the wiki? Freeradius version 2.2.8 Freeradius -X: None as I don't think that'll answer my question at this point ;) Thanks.

4 7

How to setup a profile that is valid on a schedule
by Kenroy 02 Apr '17

02 Apr '17

Hello, I have the following policy and would love it to be available on the following schedule. How do I modify the profile to allow this Monday - Friday 7 am to 6pm Saturday 7am - 3pm ----------------Profile--------------------------------- test_site { if( &request:NAS-Port == 2030){ update control { Auth-Type := Accept } update reply { Nomadix-Group-Bw-Policy-Id = 3 Nomadix-Group-Bw-Max-Down = 30000 Nomadix-Group-Bw-Max-Up = 30000 Nomadix-Net-VLAN = 2030 Idle-Timeout = 3600 Session-Timeout = 86400 } } }

2 1

FYI, I gave up on eap-tls for OS X and ios.
by John Tobin 02 Apr '17

02 Apr '17

I am currently setup with a cisco 1282 access point running wpa2 supported by free radius under suse linux [tumble weed]. I am supporting students on window 7, [I believe I have a few win-10s] and osx, will be testing ios later this week. The server is the CA, and for testing purposes I had setup a self signed cert, and was testing the client cert. I could not get it to work, went through a number of different efforts with multiple tries / multiple profiles on osx sierra, and el capitan Peap will have to do the job. that’s what is currently running. Sincerely, tob

3 6

Question on Unlang
by Olivier CALVANO 02 Apr '17

02 Apr '17

Hi i request your help for know if it's possible in unlang Actually, in policy.d/my.conf i have: if ((Tunnel-Server-Endpoint:0[0] != '172.16.1.1') && (User-Name =~ /\\.local/) && (User-Name !~ /network\\.local/) && (User-Name !~ /admin\\.local/) && (User-Name !~ /wifi\\.local/) && ("%{Packet-Src-IP-Address}" == "192.168.20.1")) { update reply { <...> } } elsif ((Tunnel-Server-Endpoint:0[0] != '172.16.1.1') && (User-Name =~ /\\.local/) && (User-Name !~ /network\\.local/) && (User-Name !~ /admin\\.local/) && (User-Name !~ /wifi\\.local/) && ("%{Packet-Src-IP-Address}" == "192.168.50.1")) { update reply { <...> } } i put only 3 in my sample of !~ (network,admin and wifi), but i have ~40 and i have ~30 of "elsif" it's a long file ;) i want know if it's possible in unlang to create a list: SubRealm_Exclude { network.local admin.local wifi.local } and after put in if condition : if ((Tunnel-Server-Endpoint:0[0] != '172.16.1.1') && (User-Name =~ /\\.local/) && (User-Name !~ SubRealm_Exclude) && ("%{Packet-Src-IP-Address}" == "192.168.20.1")) { update reply { <...> } } elsif ((Tunnel-Server-Endpoint:0[0] != '172.16.1.1') && (User-Name =~ /\\.local/) && (User-Name !~ SubRealm_Exclude) && ("%{Packet-Src-IP-Address}" == "192.168.50.1")) { update reply { <...> } } Thanks for your help regards

4 14

Initial access requests getting dropped, successive requests succeed
by Jeremy Stretch 31 Mar '17

31 Mar '17

Hi folks, We run three FreeRADIUS servers as proxies in front of some LDAP servers for network authentication. These servers have been running for well over a year without issue until recently. Two of the three servers have started inexplicably dropping access requests, but still respond intermittently. As an isolated test, I have a Juniper switch configured to authenticate to one of the FreeRADIUS servers, which in turn authenticates against one backend LDAP server. When I try to log into the switch, tcpdump on the RADIUS server confirms that it receives an Access-Request packet. I've stopped the normal daemon and am running `freeradius -X` on the server, but it prints only a single line in response to the Access-Request: Ready to process requests. It prints this same line each time a request is dropped. I can't find any information about what's actually happening. tcpdump confirms that FreeRADIUS is receiving the Access-Request packet, but it does not even attempt to contact the LDAP server. However, when I attempt to authenticate again a few seconds later (after the switch's first request has timed out), the RADIUS server responds normally with a successful authentication, with no indication (AFAICT) of any error. I can log out and immediately log back in with no problems, but if I wait for more than a few seconds, the request gets dropped again. Even stranger, this only appears to affect the primary and secondary server; forcing authentication requests to the tertiary server succeeds. To rule out LDAP as a problem, I've been trying to authenticate using an account defined locally on the FreeRADIUS server, but I have the same problem: The initial access request gets dropped; successive requests succeed. Here is my config from /etc/freeradius/sites-enabled/default: authorize { preprocess suffix files ldap expiration logintime } authenticate { Auth-Type LDAP { ldap } } preacct { preprocess acct_unique suffix files } accounting { detail unix radutmp exec attr_filter.accounting_response } session { radutmp } post-auth { exec } The three servers were originally all running v2.1.12. We upgraded the primary to v2.2.9 but it still has the same issue. Hard-coding the IP of the LDAP server didn't help, so it doesn't appear to be related to DNS, nor do there appear to be any disk or memory issues. I'm really at a loss for what to try next, other than blowing them away and rebuilding all three servers. Any pointers are much appreciated. Jeremy

3 4

Correlating request and accept/reject log?
by jm+freeradiususer＠roth.lu 31 Mar '17

31 Mar '17

Hey, Suppose you are logging access requests, access-accepts, and access-rejects (into different log files), how do you link a request to a reject (or accept) message? Can we include additional items (like Calling-Station-Id, NAS-Port, etc.) in the reject log? Thanks, Marki

3 11

ERROR: rlm_sql_mysql: ERROR 1136
by Renato Sousa 31 Mar '17

31 Mar '17

I have noticed several messages in the freeradius logs that appear below: Fri Mar 24 17:18:12 2017 : ERROR: (17331) sql: ERROR: rlm_sql_mysql: ERROR 1136 (Column count doesn't match value count at row 1): 21S01 I made the system update (FreeBSD 10.3) and also updated freeradius to version 3.0.13, but the problem persists. Anyone know how to solve this? Regards, Renato L. Sousa

2 3

Cannot get the return code of rlm_krb5
by LAUDREN Olivier 30 Mar '17

30 Mar '17

Hello, I am using FreeRADIUS v3.0.4 on Red Hat Enterprise Linux Server release 7.2 (Maipo), the authenticate section is below; authenticate { Auth-Type Kerberos { krb5 update control { Reason := "%{Module-Return-Code}" } } } The attribute gets the correct value except (at least) for the "fail" and the "invalid" return codes. According to the document; http://networkradius.com/doc/FreeRADIUS%20Technical%20Guide.pdf Table 4.3.3.2 Action table for the Authenticate section. Code Action default reject reject return fail continue ok return handled return invalid continue userlock return notfound return noop continue updated continue The "fail" should be taken into account but it looks like the action table is as the authorize one below; Code Action default noop reject return fail return ok continue handled return invalid return userlock return notfound continue noop continue updated continue I have tried to override as shown on this page with no success; https://wiki.freeradius.org/config/Fail-over Any idea of how I could get the actual result from rlm_krb5 module? Thank you in advance, Regards, Olivier LAUDREN. Ce message contient des informations confidentielles à l'intention exclusive du destinataire. Il ne peut être utilisé, divulgué ou copié de quelconque façon que ce soit par une personne autre que le destinataire désigné. Si vous n'êtes pas le destinataire désigné, merci de contacter l'expéditeur et d'effacer ce message. L'expéditeur de ce message n'est pas mandaté à représenter le Parlement européen. Dès lors, ce message ne constitue pas nécessairement le point de vue officiel du Parlement européen, ni un engagement juridique opposable à ce dernier. This message contains confidential information intended solely for the attention of the named addressee. It may not be used, disclosed or copied in any way whatsoever by anyone else than the intended addressee. If you are not the intended addressee, please contact the sender and delete this message. The sender of this message is not authorized to represent the European Parliament and therefore this message does not necessarily reflect the official position of the European Parliament and is not legally binding upon it.

3 4

Performance or locking issue with rlm_detail
by Aleš Rygl 30 Mar '17

30 Mar '17

Hello. I would like to kindly ask for help with freeradius server processing Accounting req. I am running freeradius 3.0.11 on Debian stable, kernel 3.16.0-4-amd64. Server is DL380 G9, CPU E5-2680 v3 @ 2.50GHz, 256GB RAM, very fast HP SSD RAID5 2.5 TB. The kernel can see 48 CPU. Radius is processing ~ 3kqps of Accounting (Telco environment). The daemon receives Acct. req. and using module rml_detail it writes it into a detail file(s) - there are 32 file queues based on modulo of Calling-Station-Id. detail detail.mobile { Queue-Number = "%{expr: %{Calling-Station-Id} %% 32 }" filename = ${radacctdir}/detail.mobile_v3/queue-${Queue-Number}/detail-%Y%m%d%H locking = yes } Then there are detail file loaders into DB: server buffered-sql-0 { listen { type = detail filename = "${radacctdir}/detail.mobile_v3/queue-0/detail-*" load_factor = 95 track = yes poll_interval = 1 retry_interval = 60 } preacct { } accounting { sql_instance_mobile if (noop) { ok } } } Some server params: max_request_time = 10 cleanup_delay = 5 max_requests = 20000 hostname_lookups = no max_servers = 1500 min_spare_servers = 100 max_spare_servers = 300 Everything works fine, there is ~15 connections to DB while processing ~2-3 kqps. Freeradius utilize about 3 CPU. This setup can load gigs of logs into DB without slowing down Radius responses. The issue is that freeradius randomly starts to use too much CPU (60-70% of whole server). There are following lines appearing in the log: Wed Mar 29 09:17:43 2017 : WARNING: (44056176) WARNING: Module rlm_detail became unblocked for request 44056176 Wed Mar 29 09:17:43 2017 : WARNING: (44056177) WARNING: Module rlm_detail became unblocked for request 44056177 Wed Mar 29 09:17:43 2017 : WARNING: (44056178) WARNING: Module rlm_detail became unblocked for request 44056178 Wed Mar 29 09:17:43 2017 : WARNING: (44056179) WARNING: Module rlm_detail became unblocked for request 44056179 Wed Mar 29 09:17:43 2017 : WARNING: (44056180) WARNING: Module rlm_detail became unblocked for request 44056180 It seems to be related to high spikes in the incoming radius traffic that occurs every hour - the issue become worse after DST change when certain amount of terminal were restarted in the same moment and their sessions produce Radius Accounting synchronously. But not every time. I have an old server doing the same thing running Freeradius 3.0.8., the kernel can see 24 CPU, and it really never happened here while on the new box it is on daily basis. The configuration of Radius is identical. Thanks Regards Ales

2 3