- Freeradius-Users - lists.freeradius.org

Unable to find user in DB.
by mustafa mujahid 07 Mar '17

07 Mar '17

Hello all, I've been trying to get LAN authentication working on a test radius server v2.2.8 and have run into a problem. My server can't seem to find the user in database. I have verified the exact same query on th DB and it returns the correct query result but somehow radius is unable to find the user. Please see below the debug output : ... adding new socket proxy address * port 41532 Listening on authentication address * port 1812 Listening on accounting address * port 1813 Listening on command file /var/log/radius/run/radiusd/radiusd.sock Listening on authentication address 127.0.0.1 port 18120 as server inner-tunnel Listening on proxy address * port 1814 Ready to process requests. rad_recv: Access-Request packet from host 10.10.99.5 port 1645, id=84, length=166 User-Name = "test.user" Service-Type = Framed-User Framed-MTU = 1500 Called-Station-Id = "F4-1F-C2-29-F2-04" Calling-Station-Id = "5C-B9-01-82-7F-64" EAP-Message = 0x02010015017a65657368616e2e6368617564617279 Message-Authenticator = 0xef5d9c130e4c84779ee2942be69f84ac NAS-Port-Type = Ethernet NAS-Port = 50004 NAS-Port-Id = "FastEthernet0/4" NAS-IP-Address = 10.10.99.5 # Executing section authorize from file /etc/raddb/sites-enabled/default +group authorize { ++[preprocess] = ok ++[digest] = noop [suffix] No '@' in User-Name = "test.user", looking up realm NULL [suffix] No such realm "NULL" ++[suffix] = noop [sql] expand: %{User-Name} -> test.user [sql] sql_set_user escaped user --> 'test.user' rlm_sql (sql): Reserving sql socket id: 4 [sql] expand: SELECT id,UserName,Attribute,Value,op FROM backup.radcheck_office_replica where username = '%{SQL-User-Name}' order by id -> SELECT id,UserName,Attribute,Value,op FROM backup.radcheck_office_replica where username = 'test.user' order by id rlm_sql (sql): Released sql socket id: 4 [sql] User test.user not found ++[sql] = notfound ++[expiration] = noop ++[logintime] = noop [pap] WARNING! No "known good" password found for the user. Authentication may fail because of this. ++[pap] = noop +} # group authorize = ok ERROR: No authenticate method (Auth-Type) found for the request: Rejecting the user Failed to authenticate the user. Login incorrect: [test.user] (from client ops-switch port 50004 cli 5C-B9-01-82-7F-64) Using Post-Auth-Type Reject # Executing group from file /etc/raddb/sites-enabled/default +group REJECT { [sql] expand: %{User-Name} -> test.user [sql] sql_set_user escaped user --> 'test.user' ++[sql] = noop +} # group REJECT = noop Delaying reject of request 0 for 1 seconds Going to the next request Waking up in 0.9 seconds. Sending delayed reject for request 0 Sending Access-Reject of id 84 to 10.10.99.5 port 1645 Waking up in 4.9 seconds. Cleaning up request 0 ID 84 with timestamp +40 Ready to process requests. But when the exact same query is run on the DB it returns positive results. please see attached screen shot from DB. Currently my sql.conf file only contains : authorize_check_query ="SELECT id,UserName,Attribute,Value,op FROM ${authcheck_table} where username = '%{SQL-User-Name}' order by id" and queries for accounting but they are not of concern as I only need authentication from this radius so I can match MAC Address against user name, but that comes after. I'm stuck at the first stage. I don't understand what the issue might be . Kindly let me know if I'm missing something or if further information is required. Any help on this would be greatly appreciated. -- Mustafa

3 5

Version 3.0.13 has been released
by Alan DeKok 07 Mar '17

07 Mar '17

After a bit of a delay, we're happy to announce that 3.0.13 has been released. Change log follows: Feature improvements * Add dictionary.rfc7930. Note that we do not implement the RFC. * Added 'cipher_server_preference' to mods-available/eap Patch from #1797. * OpenSSL 1.1.0 compatibility fixes. * rlm_perl: radiusd::xlat to evaluate xlat string within perl script * Allow authentication retry in winbind. Patch from Herwin Weststrate. See raddb/mods-available/mschap. * Added "recv-coa" method to rlm_rest. It behaves the same as "authorize". * Document Trust Router tr_port option. Patch from Stefan Paetow. * Update elasticsearch/logstash examples so that they work with elastic stack v5. Patch from Matthew Newton. * Print information about packets, replies, and contents in the detail file reader. * Update abfab-tr policy. Pull request #1893 from Stefan Paetow. * Reject packets which contain User-Password and EAP-Message. * Add example for filtering Access-Challenge. See sites-enabled/default. * Pull symlink fixes from v4.0.x. Fixes #1859. * Add systemd reload. Not everything is reloaded, but some is. Fixes #1662. * Better documentation for listen "ipaddr". Fixes #1921 * Add dictionary.cnergee, updated dictionary.nomadix. * radclient no longer needs -x to print statistics with -s. Bug fixes * Minor typos. Fixes #1763 * Fix typo in RPM build. Closes #1767. * rlm_mschap check for password expiry only if password was correct. Fixes #1762. * Update debian build. * update rlm_counter "man" page. Fixes #1775. * Remove erroneous assert. Fixes #1778. * fix mschap password change test. Fixes #1792. * Cleanup config file on data remove. Fixes #1795. * passwd module returns "notfound" if not found. * Check for old OpenSSL, and don't build rlm_eap_fast if it necessary. Fixes #1803 * Cleanup memory better after ldap version query. Patch from Aleksey Katargin. * Rename lt_* functions to avoid linker issues with libtool. Fixes #1277 * Many miscellaneous fixes and typos. * Allow long strings in %{%{foo} bar:-%{baz} blah". Fixes #1866 * Fix filtering operators, along with more documentation and more tests for them. * Fix OpenSSL fixes. Fixes #1876. * Finish SQL select queries even when SELECT returns no rows. Fixes #1879. * Set Module-Failure-Message for more EAP errors. * Correct typo in dictionary.rfc5580. Fixes #1882 * Remove obselete systemd syslog.target. * Client-Port-Balance load-balancing now uses client port. * Radrelay examples fixed from Alex Clouter. * Update systemd target. Pull request #1896. * Trim starting whitespace in xlat strings. * Get MySQL result lengths using normal API. * suid down after fchown(). Fixes #1914. * Fix cases of comparing pointer to NUL character. Fixes #1915. * OpenSSL v1.1 fixes. Pull request #1921. * Better Handle v4/v6 host names. Pull request #1919. * Remove "Auth-Type = System" from docs and examples. * Don't crash on malformed %{home_server}. Fixes #1922 * fix erroneous use of talloc destructor in rlm_eap * Issue trigger modules.sql.fail. Fixes #1923 * Document python_path gotcha's. Fixes #1845 * dlopen() the specific version of Python. Fixes #1592

2 2

Group membership by SSID
by Ethariel 07 Mar '17

07 Mar '17

Hello to all again, FreeRADIUS Version 2.2.8, for host x86_64-pc-linux-gnu, built on Apr 5 2016 at 13:40:43 I've got two SSID (Name_Lan and Name_Perso). Freeradius authentication using Active Directory (working fine, with and without require-membership-of) I wish to have a variable in modules/mschap linked to SSID. --require-membership-of=DOMAIN/Group1 for Name_Lan --require-membership-of=DOMAIN/Group2 for Name_Perso I don't find how to replace Group1 and Group2 with a variable (which variable ?). As I understand the unlang doc I cannot create new variables. I've also try to duplicate mschap module in mschap_perso and mschap_lan, then modify sites-available/default (and inner-tunnel) to add a test in authenticate section with : rewrite.called-station-id if (Called-Station-Id == "Name_Lan") { mschap_lan } but the is a syntax conf error when starting freeradius. TL;DR : how to test user group in AD based on SSID ? Thks a lot for any help/hint

3 7

[Freeradius-Users] Execptions for users in Freeradius.
by Isidro Hortelano 06 Mar '17

06 Mar '17

Hello list, I would like to know if it's possible to configure Freeradius to have users with dual factor of authentication and create an exceptions for certain users to use just password authentication. Thanks,

2 2

maintenance of radacct table
by bbnlradius 06 Mar '17

06 Mar '17

Hi, We are running a free radius version 2.2.0. It is talking to a mariadb database having 32 gb ram with 24 core cpu. From many days we are seeing major performance issue on the radius database. Seeing radacct table getting bombarded with high hits of update statement. The radacct table has been daily partitioned and has around 6 months of data. The total rows is Data_length: 17732239360 Index_length: 27330428928 Data_free: 1644167168 Auto_increment: 131859985 I need to drop the old data by dropping the partitions, but we are seeing that the gb limit goes hay wire, when we do this. Even when the table was not partitioned we saw the same issue. Can somebody please do help me out as to how to update the right data when the radacct table data is dropped. I saw a script from my colleague who had a maintenance script for radacct, it is using rm_radacct table too, but i see no rows in this table. Is this what supposed to be? Please do help me out as to how to do maintenance of the radacct table. thanks in advance Arun

4 7

redis vs traditional sql
by Peter Lambrechtsen 06 Mar '17

06 Mar '17

I'm looking to store delta usage information on a temporary basis so it can be exported out as a CSV style and fed off to an upstream billing system. Using redis seem to meed my needs of high performance and light, I especially like the expire feature so I don't need to worry about cleaning up stale sessions as they will just fall off at the end of the day. The main use case is just allowing FR to calculate the delta from the last time period, using the Acct-Session-Id as the primary key. Store the current timestamp, bytes up, bytes down against the Session ID. Then when the interim turns up calculate the difference and spit that out to a linelog then update the record in redis with the new timestamp + new byte counts and reset the expiry. Then send DMs to the subscribers if I get a timestamp that's wildly outside the expected period, with a tollerace since then if there was a FR outage / patching for a period of time the accounting events turning up wouldn't cause a mass-DM of the end-users. This means much of the pain with managing a large dynamic DB goes away as the redis db is self cleaning. Or is it just easier to stick with the traditional mysql/postgre model and not get too clever log everything and then run cron jobs afterwards to do the typical cleanup: DELETE FROM events WHERE timestamp < (NOW() - INTERVAL 1 HOUR) I also love the raw transactional throughput of redis which means I don't need to have as sigificant db running this log.

2 1

any maintenance script for taking care of radacct table
by bbnlradius 05 Mar '17

05 Mar '17

Hi, Does anybody have any maintenance script for purging the old data of radacct table. Cause, if I purge the old data, then the customers gb limit is going hay wire. Hence wanted to know if there is a method to purge this table Please do let me know thanks in advance Arun

1 0

3.0.12: Failed registering counter attribute ChilliSpot-Max-Output-Octets: Attribute 'ChilliSpot-Max-Output-Octets' already exists
by David Pires 03 Mar '17

03 Mar '17

Hi, I am in the process of upgrading my radius servers from v2.1.12 to v3.0.12 on Ubuntu xenial 64bit. I have successfully got sql and sqlcounter mods working, (I have tested dailycounter/Max-Daily-Session) however when trying to add a counter to sqlcounter, I have run into the following error: = Failed registering counter attribute ChilliSpot-Max-Output-Octets: Attribute 'ChilliSpot-Max-Output-Octets' already exists = When first adding the attribute I ran into this integer error: = /etc/freeradius/mods-enabled/sqlcounter[101]: Counter attribute ChilliSpot-Max-Output-Octets MUST be integer64 = I rectified this by editing the chillispot dictionary and changing integer to integer64. I also manually changed sqlcounter dialect sections to reference mysql directly, as I was getting an error about referencing modules that haven't loaded yet, which was answered previously on this list. Apart from adding sql to authorize {} in the default and inner-tunnel sites as per the FAQ, my configuration is default. Log: = FreeRADIUS Version 3.0.12 Copyright (C) 1999-2016 The FreeRADIUS server project and contributors There is NO warranty; not even for MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE You may redistribute copies of FreeRADIUS under the terms of the GNU General Public License For more information about these matters, see the file named COPYRIGHT Starting - reading configuration files ... including dictionary file /usr/share/freeradius/dictionary including dictionary file /usr/share/freeradius/dictionary.dhcp including dictionary file /usr/share/freeradius/dictionary.vqp including dictionary file /etc/freeradius/dictionary including configuration file /etc/freeradius/radiusd.conf including configuration file /etc/freeradius/proxy.conf including configuration file /etc/freeradius/clients.conf including files in directory /etc/freeradius/mods-enabled/ including configuration file /etc/freeradius/mods-enabled/dynamic_clients including configuration file /etc/freeradius/mods-enabled/mschap including configuration file /etc/freeradius/mods-enabled/eap including configuration file /etc/freeradius/mods-enabled/detail including configuration file /etc/freeradius/mods-enabled/utf8 including configuration file /etc/freeradius/mods-enabled/sqlcounter including configuration file /etc/freeradius/mods-config/sql/counter/mysql/dailycounter.conf including configuration file /etc/freeradius/mods-config/sql/counter/mysql/monthlycounter.conf including configuration file /etc/freeradius/mods-config/sql/counter/mysql/noresetcounter.conf including configuration file /etc/freeradius/mods-config/sql/counter/mysql/expire_on_login.conf including configuration file /etc/freeradius/mods-enabled/radutmp including configuration file /etc/freeradius/mods-enabled/sql including configuration file /etc/freeradius/mods-config/sql/main/mysql/queries.conf including configuration file /etc/freeradius/mods-enabled/files including configuration file /etc/freeradius/mods-enabled/preprocess including configuration file /etc/freeradius/mods-enabled/expr including configuration file /etc/freeradius/mods-enabled/unpack including configuration file /etc/freeradius/mods-enabled/replicate including configuration file /etc/freeradius/mods-enabled/digest including configuration file /etc/freeradius/mods-enabled/logintime including configuration file /etc/freeradius/mods-enabled/chap including configuration file /etc/freeradius/mods-enabled/soh including configuration file /etc/freeradius/mods-enabled/sradutmp including configuration file /etc/freeradius/mods-enabled/realm including configuration file /etc/freeradius/mods-enabled/expiration including configuration file /etc/freeradius/mods-enabled/always including configuration file /etc/freeradius/mods-enabled/date including configuration file /etc/freeradius/mods-enabled/exec including configuration file /etc/freeradius/mods-enabled/cache_eap including configuration file /etc/freeradius/mods-enabled/attr_filter including configuration file /etc/freeradius/mods-enabled/passwd including configuration file /etc/freeradius/mods-enabled/echo including configuration file /etc/freeradius/mods-enabled/linelog including configuration file /etc/freeradius/mods-enabled/ntlm_auth including configuration file /etc/freeradius/mods-enabled/pap including configuration file /etc/freeradius/mods-enabled/detail.log including configuration file /etc/freeradius/mods-enabled/unix including files in directory /etc/freeradius/policy.d/ including configuration file /etc/freeradius/policy.d/operator-name including configuration file /etc/freeradius/policy.d/eap including configuration file /etc/freeradius/policy.d/dhcp including configuration file /etc/freeradius/policy.d/cui including configuration file /etc/freeradius/policy.d/moonshot-targeted-ids including configuration file /etc/freeradius/policy.d/filter including configuration file /etc/freeradius/policy.d/abfab-tr including configuration file /etc/freeradius/policy.d/canonicalization including configuration file /etc/freeradius/policy.d/debug including configuration file /etc/freeradius/policy.d/control including configuration file /etc/freeradius/policy.d/accounting including files in directory /etc/freeradius/sites-enabled/ including configuration file /etc/freeradius/sites-enabled/default including configuration file /etc/freeradius/sites-enabled/inner-tunnel main { security { user = "freerad" group = "freerad" allow_core_dumps = no } name = "freeradius" prefix = "/usr" localstatedir = "/var" logdir = "/var/log/freeradius" run_dir = "/var/run/freeradius" } main { name = "freeradius" prefix = "/usr" localstatedir = "/var" sbindir = "/usr/sbin" logdir = "/var/log/freeradius" run_dir = "/var/run/freeradius" libdir = "/usr/lib/freeradius" radacctdir = "/var/log/freeradius/radacct" hostname_lookups = no max_request_time = 30 cleanup_delay = 5 max_requests = 16384 pidfile = "/var/run/freeradius/freeradius.pid" checkrad = "/usr/sbin/checkrad" debug_level = 0 proxy_requests = yes log { stripped_names = no auth = no auth_badpass = no auth_goodpass = no colourise = yes msg_denied = "You are already logged in - access denied" } resources { } security { max_attributes = 200 reject_delay = 1.000000 status_server = yes } } radiusd: #### Loading Realms and Home Servers #### proxy server { retry_delay = 5 retry_count = 3 default_fallback = no dead_time = 120 wake_all_if_all_dead = no } home_server localhost { ipaddr = 127.0.0.1 port = 1812 type = "auth" secret = <<< secret >>> response_window = 20.000000 response_timeouts = 1 max_outstanding = 65536 zombie_period = 40 status_check = "status-server" ping_interval = 30 check_interval = 30 check_timeout = 4 num_answers_to_alive = 3 revive_interval = 120 limit { max_connections = 16 max_requests = 0 lifetime = 0 idle_timeout = 0 } coa { irt = 2 mrt = 16 mrc = 5 mrd = 30 } } home_server_pool my_auth_failover { type = fail-over home_server = localhost } realm example.com { auth_pool = my_auth_failover } realm LOCAL { } radiusd: #### Loading Clients #### client localhost { ipaddr = 127.0.0.1 require_message_authenticator = no secret = <<< secret >>> nas_type = "other" proto = "*" limit { max_connections = 16 lifetime = 0 idle_timeout = 30 } } client localhost_ipv6 { ipv6addr = ::1 require_message_authenticator = no secret = <<< secret >>> limit { max_connections = 16 lifetime = 0 idle_timeout = 30 } } client 0.0.0.0/0 { ipaddr = 0.0.0.0 require_message_authenticator = no secret = <<< secret >>> shortname = "test_name" limit { max_connections = 16 lifetime = 0 idle_timeout = 30 } } Debugger not attached # Creating Auth-Type = mschap # Creating Auth-Type = digest # Creating Auth-Type = eap # Creating Auth-Type = PAP # Creating Auth-Type = CHAP # Creating Auth-Type = MS-CHAP radiusd: #### Instantiating modules #### modules { # Loaded module rlm_dynamic_clients # Loading module "dynamic_clients" from file /etc/freeradius/mods-enabled/dynamic_clients # Loaded module rlm_mschap # Loading module "mschap" from file /etc/freeradius/mods-enabled/mschap mschap { use_mppe = yes require_encryption = no require_strong = no with_ntdomain_hack = yes passchange { } allow_retry = yes } # Loaded module rlm_eap # Loading module "eap" from file /etc/freeradius/mods-enabled/eap eap { default_eap_type = "md5" timer_expire = 60 ignore_unknown_eap_types = no cisco_accounting_username_bug = no max_sessions = 16384 } # Loaded module rlm_detail # Loading module "detail" from file /etc/freeradius/mods-enabled/detail detail { filename = "/var/log/freeradius/radacct/%{%{Packet-Src-IP-Address}:-%{Packet-Src-IPv6-Address}}/detail-%Y%m%d" header = "%t" permissions = 384 locking = no escape_filenames = no log_packet_header = no } # Loaded module rlm_utf8 # Loading module "utf8" from file /etc/freeradius/mods-enabled/utf8 # Loaded module rlm_sqlcounter # Loading module "dailycounter" from file /etc/freeradius/mods-enabled/sqlcounter sqlcounter dailycounter { sql_module_instance = "sql" key = "User-Name" query = "SELECT SUM(acctsessiontime - GREATEST((%%b - UNIX_TIMESTAMP(acctstarttime)), 0)) FROM radacct WHERE username = '%{User-Name}' AND UNIX_TIMESTAMP(acctstarttime) + acctsessiontime > '%%b'" reset = "daily" counter_name = "Daily-Session-Time" check_name = "Max-Daily-Session" reply_name = "Session-Timeout" } # Loading module "monthlycounter" from file /etc/freeradius/mods-enabled/sqlcounter sqlcounter monthlycounter { sql_module_instance = "sql" key = "User-Name" query = "SELECT SUM(acctsessiontime - GREATEST((%%b - UNIX_TIMESTAMP(acctstarttime)), 0)) FROM radacct WHERE username='%{User-Name}' AND UNIX_TIMESTAMP(acctstarttime) + acctsessiontime > '%%b'" reset = "monthly" counter_name = "Monthly-Session-Time" check_name = "Max-Monthly-Session" reply_name = "Session-Timeout" } # Loading module "noresetcounter" from file /etc/freeradius/mods-enabled/sqlcounter sqlcounter noresetcounter { sql_module_instance = "sql" key = "User-Name" query = "SELECT IFNULL(SUM(AcctSessionTime),0) FROM radacct WHERE UserName='%{User-Name}'" reset = "never" counter_name = "Max-All-Session-Time" check_name = "Max-All-Session" reply_name = "Session-Timeout" } # Loading module "expire_on_login" from file /etc/freeradius/mods-enabled/sqlcounter sqlcounter expire_on_login { sql_module_instance = "sql" key = "User-Name" query = "SELECT IFNULL( MAX(TIME_TO_SEC(TIMEDIFF(NOW(), acctstarttime))),0) FROM radacct WHERE UserName='%{User-Name}' ORDER BY acctstarttime LIMIT 1;" reset = "never" counter_name = "Expire-After-Initial-Login" check_name = "Expire-After" reply_name = "Session-Timeout" } # Loading module "chillispot_download_limit" from file /etc/freeradius/mods-enabled/sqlcounter sqlcounter chillispot_download_limit { sql_module_instance = "sql" key = "User-Name" query = "SELECT SUM(AcctOutputOctets) FROM radacct WHERE UserName='%{%k}'" reset = "daily" counter_name = "ChilliSpot-Max-Output-Octets" check_name = "ChilliSpot-Max-Output-Octets" reply_name = "ChilliSpot-Max-Output-Octets" } /etc/freeradius/mods-enabled/sqlcounter[101]: Failed registering counter attribute ChilliSpot-Max-Output-Octets: Attribute 'ChilliSpot-Max-Output-Octets' already exists. /etc/freeradius/mods-enabled/sqlcounter[101]: Instantiation failed for module "chillispot_download_limit" = The counter that I have added to sqlcounter: = sqlcounter chillispot_download_limit { sql_module_instance = sql dialect = "mysql" counter_name = ChilliSpot-Max-Output-Octets check_name = ChilliSpot-Max-Output-Octets reply_name = ChilliSpot-Max-Output-Octets key = User-Name reset = daily $INCLUDE ${modconfdir}/sql/counter/${dialect}/${.:instance}.conf } = The query file: = query = "SELECT SUM(AcctInputOctets) FROM radacct WHERE UserName='%{${key}}'" = Is there something critical configuration-wise that I have missed between 2.x.x and 3.x.x? David

2 1

TruBrain user activation
by Team at TruBrain 03 Mar '17

03 Mar '17

Hi FreeRadius users mailing list, A new TruBrain account has been created for you. Click the url below to activate your account and select a password! https://trubrain.freshdesk.com/register/TBf64nacozMxHd7NG9K If the above URL does not work try copying and pasting it into your browser. If you continue to have problems, please feel free to contact us. Regards, TruBrain

1 0

Help with redundant autz
by Paolo Cecchini 03 Mar '17

03 Mar '17

Hello everybody. First at all a few words about me, I’m from Italy and I work at my city, Urbino, University. Our AAA is freeradius based. Student credential’s authoritative source is an Oracle database located outside of the local net, because the application is outsourced. Credentials went synced hourly to our internal LDAP. We experienced sporadic black out with that database and in effort to mitigate the issue we’re planning to switch the first source to LDAP. Something like this. Users …. DEFAULT Realm == "stud",Autz-Type := stud, Auth-Type := PAP Sites-available/default … Autz-Type stud { group { ldap_stud { ok= return fail= 1 notfound = 2 default = return } sql_stud } } Now, scenarios. a)The user is found in ldap, ldap_stud module returns ok, the password is checked via pap and matches, access-accept. The sql module is skipped, as intended. b)The user is NOT found in ldap, the module returns notfound, proceed to sql_stud module (the same if ldap crashes, via fail) c)The user IS FOUND in ldap but the user made a password change and ldap is not synced. The ldap_stud module returns ok, but now the pap will reject the authentication. Btw the sql_stud module is skipped, of course, because the previous returned ok. I tried my best to solve the issue but that’s apparently far beyond my skill J May add that the reverse approach, sql first then ldap, will work in abstract Autz-Type stud { group { sql_stud { ok= return fail= 1 notfound = 2 default = return } ldap_stud } } But when the sql is unattainable the radius will time-out a lot. So in the end thanks a lot for any hint. Greetings. Paolo Cecchini

2 2