- Freeradius-Users - lists.freeradius.org

Re: Proposal for online users
by Haviaras Kostas 23 Jan '17

23 Jan '17

>> On Jan 23, 2017, at 8:10 AM, Haviaras Kostas <[hidden email] <http://freeradius.1045715.n5.nabble.com/user/SendEmail.jtp?type=node&node=5…>> wrote: >> >> Thanks for your response, Alan DeKok, my point is that I want to have limit >> at the online users. When let's say the online users is 100, to reject >> every new request. > > My point is that the information you need is in the SQL database. Use an SQL SELECT >statements to count the number of online users, and then reject the new one if there's more than >100 online. > > FreeRADIUS does *not* provide you with a pre-packaged solution to every single thing you want >to do. It has solutions for most common cases (e.g. accounting in radacct). > > If you want a custom solution, you need to understand all of the pieces, and then design / build >the solution yourself. > > Alan DeKok. I totaly agree with you, I only want your advice based on your experience, is better to develop my own module or to modify the exist (sql).

2 1

Re: Proposal for online users
by Haviaras Kostas 23 Jan '17

23 Jan '17

Thanks for your response, Alan DeKok, my point is that I want to have limit at the online users. When let's say the online users is 100, to reject every new request.

3 2

Proposal for online users
by Haviaras Kostas 23 Jan '17

23 Jan '17

Thanks for your response Matthew Newton, but I found this on the freeradius list ( http://lists.freeradius.org/pipermail/freeradius-users/2013-February/065116…) and I would like to implement what the Alan DeKok.

2 1

Windows 8.1 Wi-Fi client handshake failure REVISITED
by ChoongHotmail Kim 22 Jan '17

22 Jan '17

Hello. I've been having issues with my Windows 8.1 laptop as well as my Windows 10 laptop when trying to connect to my FreeRADIUS server via EAP-TTLS. My FreeRADIUS server is running on an Asus RT-AC68U router and was installed and configured per the instructions on https://github.com/RMerl/asuswrt-merlin/wiki/Setting-up-FreeRadius2-through… . My problem is identical to the issue reported on http://lists.freeradius.org/pipermail/freeradius-users/2014-October/074177.… , and unfortunately, the thread ended without any resolution. I was hoping to find any advice with regards to resolving this particular use-case as I started as Mr. Rowe has by setting the "cipher-list" attribute to "ALL" as well as checking the installed status of my certificates. I am only having issues with the handshake when trying to connect with Windows 8.1 or Windows 10, but have none when connecting via Android. For reference, I've a sanitized version of the output for radius -XX when successfully connecting via my Android device. Thank you. admin@ROUTER:/tmp/mnt/sda2/entware-ng.arm/etc/freeradius2# radiusd -XX Sun Jan 22 08:39:20 2017 : Info: radiusd: FreeRADIUS Version 2.2.9, for host arm-openwrt-linux-gnu, built on Dec 26 2016 at 19:02:57 Sun Jan 22 08:39:20 2017 : Debug: Server was built with: Sun Jan 22 08:39:20 2017 : Debug: accounting Sun Jan 22 08:39:20 2017 : Debug: authentication Sun Jan 22 08:39:20 2017 : Debug: WITH_DHCP Sun Jan 22 08:39:20 2017 : Debug: WITH_VMPS Sun Jan 22 08:39:20 2017 : Debug: Server core libs: Sun Jan 22 08:39:20 2017 : Debug: ssl: OpenSSL 1.0.2j 26 Sep 2016 Sun Jan 22 08:39:20 2017 : Info: Copyright (C) 1999-2015 The FreeRADIUS server project and contributors. Sun Jan 22 08:39:20 2017 : Info: There is NO warranty; not even for MERCHANTABILITY or FITNESS FOR A Sun Jan 22 08:39:20 2017 : Info: PARTICULAR PURPOSE. Sun Jan 22 08:39:20 2017 : Info: You may redistribute copies of FreeRADIUS under the terms of the Sun Jan 22 08:39:20 2017 : Info: GNU General Public License. Sun Jan 22 08:39:20 2017 : Info: For more information about these matters, see the file named COPYRIGHT. Sun Jan 22 08:39:20 2017 : Info: Starting - reading configuration files ... Sun Jan 22 08:39:20 2017 : Debug: including configuration file /opt/etc/freeradius2/radiusd.conf Sun Jan 22 08:39:20 2017 : Debug: including configuration file /opt/etc/freeradius2/clients.conf Sun Jan 22 08:39:20 2017 : Debug: including files in directory /opt/etc/freeradius2/modules/ Sun Jan 22 08:39:20 2017 : Debug: including configuration file /opt/etc/freeradius2/modules/ldap Sun Jan 22 08:39:20 2017 : Debug: including configuration file /opt/etc/freeradius2/modules/pap Sun Jan 22 08:39:20 2017 : Debug: including configuration file /opt/etc/freeradius2/modules/mschap Sun Jan 22 08:39:20 2017 : Debug: including configuration file /opt/etc/freeradius2/modules/files Sun Jan 22 08:39:20 2017 : Debug: including configuration file /opt/etc/freeradius2/eap.conf Sun Jan 22 08:39:20 2017 : Debug: including files in directory /opt/etc/freeradius2/sites/ Sun Jan 22 08:39:20 2017 : Debug: including configuration file /opt/etc/freeradius2/sites/default Sun Jan 22 08:39:20 2017 : Debug: including configuration file /opt/etc/freeradius2/sites/inner-tunnel Sun Jan 22 08:39:20 2017 : Debug: main { Sun Jan 22 08:39:20 2017 : Debug: allow_core_dumps = no Sun Jan 22 08:39:20 2017 : Debug: } Sun Jan 22 08:39:20 2017 : Debug: including dictionary file /opt/etc/freeradius2/dictionary Sun Jan 22 08:39:20 2017 : Debug: main { Sun Jan 22 08:39:20 2017 : Debug: name = "radiusd" Sun Jan 22 08:39:20 2017 : Debug: prefix = "/opt" Sun Jan 22 08:39:20 2017 : Debug: localstatedir = "/opt/var" Sun Jan 22 08:39:20 2017 : Debug: sbindir = "/opt/sbin" Sun Jan 22 08:39:20 2017 : Debug: logdir = "/opt/var/log" Sun Jan 22 08:39:20 2017 : Debug: run_dir = "/opt/var/run/radius" Sun Jan 22 08:39:20 2017 : Debug: libdir = "/opt/lib/freeradius2" Sun Jan 22 08:39:20 2017 : Debug: radacctdir = "/opt/var/db/radacct" Sun Jan 22 08:39:20 2017 : Debug: hostname_lookups = no Sun Jan 22 08:39:20 2017 : Debug: max_request_time = 15 Sun Jan 22 08:39:20 2017 : Debug: cleanup_delay = 7 Sun Jan 22 08:39:20 2017 : Debug: max_requests = 512 Sun Jan 22 08:39:20 2017 : Debug: pidfile = "/opt/var/run/radius/radiusd.pid" Sun Jan 22 08:39:20 2017 : Debug: checkrad = "/opt/sbin/checkrad" Sun Jan 22 08:39:20 2017 : Debug: debug_level = 0 Sun Jan 22 08:39:20 2017 : Debug: proxy_requests = no Sun Jan 22 08:39:20 2017 : Debug: log { Sun Jan 22 08:39:20 2017 : Debug: stripped_names = no Sun Jan 22 08:39:20 2017 : Debug: auth = no Sun Jan 22 08:39:20 2017 : Debug: auth_badpass = no Sun Jan 22 08:39:20 2017 : Debug: auth_goodpass = no Sun Jan 22 08:39:20 2017 : Debug: } Sun Jan 22 08:39:20 2017 : Debug: security { Sun Jan 22 08:39:20 2017 : Debug: max_attributes = 200 Sun Jan 22 08:39:20 2017 : Debug: reject_delay = 5 Sun Jan 22 08:39:20 2017 : Debug: status_server = no Sun Jan 22 08:39:20 2017 : Debug: } Sun Jan 22 08:39:20 2017 : Debug: } Sun Jan 22 08:39:20 2017 : Debug: radiusd: #### Loading Realms and Home Servers #### Sun Jan 22 08:39:20 2017 : Debug: radiusd: #### Loading Clients #### Sun Jan 22 08:39:20 2017 : Debug: client localhost { Sun Jan 22 08:39:20 2017 : Debug: ipaddr = 127.0.0.1 Sun Jan 22 08:39:20 2017 : Debug: require_message_authenticator = yes Sun Jan 22 08:39:20 2017 : Debug: secret = "*removed1*" Sun Jan 22 08:39:20 2017 : Debug: nastype = "other" Sun Jan 22 08:39:20 2017 : Debug: } Sun Jan 22 08:39:20 2017 : Debug: radiusd: #### Instantiating modules #### Sun Jan 22 08:39:20 2017 : Debug: radiusd: #### Loading Virtual Servers #### Sun Jan 22 08:39:20 2017 : Debug: server { # from file /opt/etc/freeradius2/radiusd.conf Sun Jan 22 08:39:20 2017 : Debug: modules { Sun Jan 22 08:39:20 2017 : Debug: Module: Checking authenticate {...} for more modules to load Sun Jan 22 08:39:20 2017 : Debug: (Loaded rlm_eap, checking if it's valid) Sun Jan 22 08:39:20 2017 : Debug: Module: Linked to module rlm_eap Sun Jan 22 08:39:20 2017 : Debug: Module: Instantiating module "eap" from file /opt/etc/freeradius2/eap.conf Sun Jan 22 08:39:20 2017 : Debug: eap { Sun Jan 22 08:39:20 2017 : Debug: default_eap_type = "ttls" Sun Jan 22 08:39:20 2017 : Debug: timer_expire = 60 Sun Jan 22 08:39:20 2017 : Debug: ignore_unknown_eap_types = no Sun Jan 22 08:39:20 2017 : Debug: cisco_accounting_username_bug = no Sun Jan 22 08:39:20 2017 : Debug: max_sessions = 4096 Sun Jan 22 08:39:20 2017 : Debug: } Sun Jan 22 08:39:20 2017 : Debug: Module: Linked to sub-module rlm_eap_tls Sun Jan 22 08:39:20 2017 : Debug: Module: Instantiating eap-tls Sun Jan 22 08:39:20 2017 : Debug: tls { Sun Jan 22 08:39:20 2017 : Debug: rsa_key_exchange = no Sun Jan 22 08:39:20 2017 : Debug: dh_key_exchange = yes Sun Jan 22 08:39:20 2017 : Debug: rsa_key_length = 512 Sun Jan 22 08:39:20 2017 : Debug: dh_key_length = 512 Sun Jan 22 08:39:20 2017 : Debug: verify_depth = 0 Sun Jan 22 08:39:20 2017 : Debug: pem_file_type = yes Sun Jan 22 08:39:20 2017 : Debug: private_key_file = "/opt/etc/freeradius2/certs/ec-server_key.pem" Sun Jan 22 08:39:20 2017 : Debug: certificate_file = "/opt/etc/freeradius2/certs/ec-server_cert.pem" Sun Jan 22 08:39:20 2017 : Debug: private_key_password = "*removed5*" Sun Jan 22 08:39:20 2017 : Debug: dh_file = "/opt/etc/freeradius2/certs/dh" Sun Jan 22 08:39:20 2017 : Debug: random_file = "/dev/urandom" Sun Jan 22 08:39:20 2017 : Debug: fragment_size = 1024 Sun Jan 22 08:39:20 2017 : Debug: include_length = yes Sun Jan 22 08:39:20 2017 : Debug: check_crl = no Sun Jan 22 08:39:20 2017 : Debug: check_all_crl = no Sun Jan 22 08:39:20 2017 : Debug: cipher_list = "ALL" Sun Jan 22 08:39:20 2017 : Debug: check_cert_issuer = "/C=US/ST=NY/L=New York/O=Admin/OU=IT/CN=cert/emailAddress=admin(a)admin.com" Sun Jan 22 08:39:20 2017 : Debug: ecdh_curve = "secp521r1" Sun Jan 22 08:39:20 2017 : Debug: } Sun Jan 22 08:39:21 2017 : Debug: Module: Linked to sub-module rlm_eap_ttls Sun Jan 22 08:39:21 2017 : Debug: Module: Instantiating eap-ttls Sun Jan 22 08:39:21 2017 : Debug: ttls { Sun Jan 22 08:39:21 2017 : Debug: default_eap_type = "md5" Sun Jan 22 08:39:21 2017 : Debug: copy_request_to_tunnel = no Sun Jan 22 08:39:21 2017 : Debug: use_tunneled_reply = yes Sun Jan 22 08:39:21 2017 : Debug: virtual_server = "inner-tunnel" Sun Jan 22 08:39:21 2017 : Debug: include_length = yes Sun Jan 22 08:39:21 2017 : Debug: } Sun Jan 22 08:39:21 2017 : Debug: Module: Checking authorize {...} for more modules to load Sun Jan 22 08:39:21 2017 : Debug: } # modules Sun Jan 22 08:39:21 2017 : Debug: } # server Sun Jan 22 08:39:21 2017 : Debug: server inner-tunnel { # from file /opt/etc/freeradius2/sites/inner-tunnel Sun Jan 22 08:39:21 2017 : Debug: modules { Sun Jan 22 08:39:21 2017 : Debug: Module: Checking authenticate {...} for more modules to load Sun Jan 22 08:39:21 2017 : Debug: (Loaded rlm_pap, checking if it's valid) Sun Jan 22 08:39:21 2017 : Debug: Module: Linked to module rlm_pap Sun Jan 22 08:39:21 2017 : Debug: Module: Instantiating module "pap" from file /opt/etc/freeradius2/modules/pap Sun Jan 22 08:39:21 2017 : Debug: pap { Sun Jan 22 08:39:21 2017 : Debug: encryption_scheme = "auto" Sun Jan 22 08:39:21 2017 : Debug: auto_header = yes Sun Jan 22 08:39:21 2017 : Debug: } Sun Jan 22 08:39:21 2017 : Debug: Module: Checking authorize {...} for more modules to load Sun Jan 22 08:39:21 2017 : Debug: (Loaded rlm_files, checking if it's valid) Sun Jan 22 08:39:21 2017 : Debug: Module: Linked to module rlm_files Sun Jan 22 08:39:21 2017 : Debug: Module: Instantiating module "files" from file /opt/etc/freeradius2/modules/files Sun Jan 22 08:39:21 2017 : Debug: files { Sun Jan 22 08:39:21 2017 : Debug: usersfile = "/opt/etc/freeradius2/users" Sun Jan 22 08:39:21 2017 : Debug: compat = "no" Sun Jan 22 08:39:21 2017 : Debug: } Sun Jan 22 08:39:21 2017 : Debug: reading pairlist file /opt/etc/freeradius2/users Sun Jan 22 08:39:21 2017 : Debug: } # modules Sun Jan 22 08:39:21 2017 : Debug: } # server Sun Jan 22 08:39:21 2017 : Debug: radiusd: #### Opening IP addresses and Ports #### Sun Jan 22 08:39:21 2017 : Debug: listen { Sun Jan 22 08:39:21 2017 : Debug: type = "auth" Sun Jan 22 08:39:21 2017 : Debug: ipaddr = 127.0.0.1 Sun Jan 22 08:39:21 2017 : Debug: port = 1812 Sun Jan 22 08:39:21 2017 : Debug: } Sun Jan 22 08:39:21 2017 : Debug: listen { Sun Jan 22 08:39:21 2017 : Debug: type = "auth" Sun Jan 22 08:39:21 2017 : Debug: ipaddr = 127.0.0.1 Sun Jan 22 08:39:21 2017 : Debug: port = 18120 Sun Jan 22 08:39:21 2017 : Debug: } Sun Jan 22 08:39:21 2017 : Debug: Listening on authentication address 127.0.0.1 port 1812 Sun Jan 22 08:39:21 2017 : Debug: Listening on authentication address 127.0.0.1 port 18120 as server inner-tunnel Sun Jan 22 08:39:21 2017 : Info: Ready to process requests. rad_recv: Access-Request packet from host 127.0.0.1 port 37394, id=0, length=131 User-Name = "anonymous" NAS-IP-Address = 127.0.0.1 Called-Station-Id = "*removed2*" Calling-Station-Id = "*removed3*" NAS-Identifier = "*removed4*" NAS-Port = 109 Framed-MTU = 1400 NAS-Port-Type = Wireless-802.11 EAP-Message = 0x0200000e01616e6f6e796d6f7573 Message-Authenticator = 0xdc4dde7c42159b142e2d300745db62e9 Sun Jan 22 08:39:35 2017 : Info: # Executing section authorize from file /opt/etc/freeradius2/sites/default Sun Jan 22 08:39:35 2017 : Info: +group authorize { Sun Jan 22 08:39:35 2017 : Info: [eap] EAP packet type response id 0 length 14 Sun Jan 22 08:39:35 2017 : Info: [eap] No EAP Start, assuming it's an on-going EAP conversation Sun Jan 22 08:39:35 2017 : Info: ++[eap] = updated Sun Jan 22 08:39:35 2017 : Info: +} # group authorize = updated Sun Jan 22 08:39:35 2017 : Info: Found Auth-Type = EAP Sun Jan 22 08:39:35 2017 : Info: # Executing group from file /opt/etc/freeradius2/sites/default Sun Jan 22 08:39:35 2017 : Info: +group authenticate { Sun Jan 22 08:39:35 2017 : Info: [eap] EAP Identity Sun Jan 22 08:39:35 2017 : Info: [eap] processing type tls Sun Jan 22 08:39:35 2017 : Info: [tls] Initiate Sun Jan 22 08:39:35 2017 : Info: [tls] Start returned 1 Sun Jan 22 08:39:35 2017 : Info: ++[eap] = handled Sun Jan 22 08:39:35 2017 : Info: +} # group authenticate = handled Sending Access-Challenge of id 0 to 127.0.0.1 port 37394 EAP-Message = 0x010100061520 Message-Authenticator = 0x00000000000000000000000000000000 State = 0x33ba028433bb1704dfebfff672d73f51 Sun Jan 22 08:39:35 2017 : Info: Finished request 0. Sun Jan 22 08:39:35 2017 : Debug: Going to the next request Sun Jan 22 08:39:35 2017 : Debug: Waking up in 6.9 seconds. rad_recv: Access-Request packet from host 127.0.0.1 port 37394, id=0, length=339 Sun Jan 22 08:39:35 2017 : Info: Cleaning up request 0 ID 0 with timestamp +14 User-Name = "anonymous" NAS-IP-Address = 127.0.0.1 Called-Station-Id = "*removed11*" Calling-Station-Id = "*removed12*" NAS-Identifier = "*removed13*" NAS-Port = 109 Framed-MTU = 1400 State = 0x33ba028433bb1704dfebfff672d73f51 NAS-Port-Type = Wireless-802.11 EAP-Message = 0x020100cc150016030100c1010000bd030158846fc7d8809f2085f98605d86439ecd041d6e190377d2be4e9a02cf3b2b980000054c014c00ac022c02100390038c00fc0050035c012c008c01cc01b00160013c00dc003000ac013c009c01fc01e00330032c00ec004002fc011c007c00cc002000500040015001200090014001100080006000300ff01000040000b000403000102000a00340032000e000d0019000b000c00180009000a00160017000800060007001400150004000500120013000100020003000f00100011 Message-Authenticator = 0xc06c7e7bb5daec74806b049ab8bb7d0c Sun Jan 22 08:39:35 2017 : Info: # Executing section authorize from file /opt/etc/freeradius2/sites/default Sun Jan 22 08:39:35 2017 : Info: +group authorize { Sun Jan 22 08:39:35 2017 : Info: [eap] EAP packet type response id 1 length 204 Sun Jan 22 08:39:35 2017 : Info: [eap] Continuing tunnel setup. Sun Jan 22 08:39:35 2017 : Info: ++[eap] = ok Sun Jan 22 08:39:35 2017 : Info: +} # group authorize = ok Sun Jan 22 08:39:35 2017 : Info: Found Auth-Type = EAP Sun Jan 22 08:39:35 2017 : Info: # Executing group from file /opt/etc/freeradius2/sites/default Sun Jan 22 08:39:35 2017 : Info: +group authenticate { Sun Jan 22 08:39:35 2017 : Info: [eap] Request found, released from the list Sun Jan 22 08:39:35 2017 : Info: [eap] EAP/ttls Sun Jan 22 08:39:35 2017 : Info: [eap] processing type ttls Sun Jan 22 08:39:35 2017 : Info: [ttls] Authenticate Sun Jan 22 08:39:35 2017 : Info: [ttls] processing EAP-TLS Sun Jan 22 08:39:35 2017 : Info: [ttls] eaptls_verify returned 7 Sun Jan 22 08:39:35 2017 : Info: [ttls] Done initial handshake Sun Jan 22 08:39:35 2017 : Info: [ttls] (other): before/accept initialization Sun Jan 22 08:39:35 2017 : Info: [ttls] TLS_accept: before/accept initialization Sun Jan 22 08:39:35 2017 : Info: [ttls] <<< Unknown TLS version [length 0005] Sun Jan 22 08:39:35 2017 : Info: [ttls] <<< TLS 1.0 Handshake [length 00c1], ClientHello Sun Jan 22 08:39:35 2017 : Info: [ttls] TLS_accept: unknown state Sun Jan 22 08:39:35 2017 : Info: [ttls] >>> Unknown TLS version [length 0005] Sun Jan 22 08:39:35 2017 : Info: [ttls] >>> TLS 1.0 Handshake [length 0039], ServerHello Sun Jan 22 08:39:35 2017 : Info: [ttls] TLS_accept: unknown state Sun Jan 22 08:39:35 2017 : Info: [ttls] >>> Unknown TLS version [length 0005] Sun Jan 22 08:39:35 2017 : Info: [ttls] >>> TLS 1.0 Handshake [length 03f9], Certificate Sun Jan 22 08:39:35 2017 : Info: [ttls] TLS_accept: unknown state Sun Jan 22 08:39:35 2017 : Info: [ttls] >>> Unknown TLS version [length 0005] Sun Jan 22 08:39:35 2017 : Info: [ttls] >>> TLS 1.0 Handshake [length 0119], ServerKeyExchange Sun Jan 22 08:39:35 2017 : Info: [ttls] TLS_accept: unknown state Sun Jan 22 08:39:35 2017 : Info: [ttls] >>> Unknown TLS version [length 0005] Sun Jan 22 08:39:35 2017 : Info: [ttls] >>> TLS 1.0 Handshake [length 0004], ServerHelloDone Sun Jan 22 08:39:35 2017 : Info: [ttls] TLS_accept: unknown state Sun Jan 22 08:39:35 2017 : Info: [ttls] TLS_accept: unknown state Sun Jan 22 08:39:35 2017 : Info: [ttls] TLS_accept: unknown state Sun Jan 22 08:39:35 2017 : Info: [ttls] TLS_accept: Need to read more data: unknown state Sun Jan 22 08:39:35 2017 : Info: [ttls] TLS_accept: Need to read more data: unknown state Sun Jan 22 08:39:35 2017 : Debug: In SSL Handshake Phase Sun Jan 22 08:39:35 2017 : Debug: In SSL Accept mode Sun Jan 22 08:39:35 2017 : Info: [ttls] eaptls_process returned 13 Sun Jan 22 08:39:35 2017 : Info: ++[eap] = handled Sun Jan 22 08:39:35 2017 : Info: +} # group authenticate = handled Sending Access-Challenge of id 0 to 127.0.0.1 port 37394 EAP-Message = 0x0102040015c000000563160301003902000035030191fab5ecc2a72a6100304fb55ecb4ab9487f48a79086bb74a18155747aacdcfc00c00a00000dff01000100000b00040300010216030103f90b0003f50003f20003ef308203eb3082034da003020102020101300a06082a8648ce3d04030430818b310b3009060355040613025553310b300906035504080c0243413114301206035504070c0b4c6f7320416e67656c657331123010060355040a0c0945766572677265656e310b3009060355040b0c024954310f300d06035504030c067175696c74793127302506092a864886f70d0109011618636f6e63656e74726963313240686f746d61696c EAP-Message = 0x2e636f6d301e170d3136313130323035333532325a170d3236313033313035333532325a30818b310b3009060355040613025553310b300906035504080c0243413114301206035504070c0b4c6f7320416e67656c657331123010060355040a0c0945766572677265656e310b3009060355040b0c024954310f300d06035504030c067175696c74793127302506092a864886f70d0109011618636f6e63656e74726963313240686f746d61696c2e636f6d30819b301006072a8648ce3d020106052b81040023038186000400f07d650a69a067774af98c6e31536aaa2537f36512017e620d7e104f39b0f4a6046d2a375f1e316a74660eee1a7620e5 EAP-Message = 0x51e7b8b42411342af74b8946ba7723aa17017827f5dff7491d3d3cb8eadb6764a706c09164b601cde0acf797e686073fb6f651aa488356fa11a9ca62815eeee6f88cb1e3ebcadce6f8fd76c719c01b496edb17a382015b3082015730090603551d1304023000301106096086480186f8420101040403020640303306096086480186f842010d042616244f70656e53534c2047656e65726174656420536572766572204365727469666963617465301d0603551d0e04160414199f83c6183ee1343dd00a8cfedac804195db9f13081c00603551d230481b83081b58014956479ceb6825479147296a4672a7d22264c4b8da18191a4818e30818b310b30 EAP-Message = 0x09060355040613025553310b300906035504080c0243413114301206035504070c0b4c6f7320416e67656c657331123010060355040a0c0945766572677265656e310b3009060355040b0c024954310f300d06035504030c067175696c74793127302506092a864886f70d0109011618636f6e63656e74726963313240686f746d61696c2e636f6d820900883fa5aaf29fc76b30130603551d25040c300a06082b06010505070301300b0603551d0f0404030205a0300a06082a8648ce3d04030403818b00308187024101cf9236626271c7ae49d6a8c4dd59a719f3d6c9e1b3a9d8f85ef7386582084537f4f5d7a125b92e77aa2add03a2220b624d78 EAP-Message = 0xeaa78fe101ded4031e55bc73 Message-Authenticator = 0x00000000000000000000000000000000 State = 0x33ba028432b81704dfebfff672d73f51 Sun Jan 22 08:39:35 2017 : Info: Finished request 1. Sun Jan 22 08:39:35 2017 : Debug: Going to the next request Sun Jan 22 08:39:35 2017 : Debug: Waking up in 6.9 seconds. rad_recv: Access-Request packet from host 127.0.0.1 port 37394, id=0, length=141 Sun Jan 22 08:39:35 2017 : Info: Cleaning up request 1 ID 0 with timestamp +14 User-Name = "anonymous" NAS-IP-Address = 127.0.0.1 Called-Station-Id = "*removed13*" Calling-Station-Id = "*removed14*" NAS-Identifier = "*removed15*" NAS-Port = 109 Framed-MTU = 1400 State = 0x33ba028432b81704dfebfff672d73f51 NAS-Port-Type = Wireless-802.11 EAP-Message = 0x020200061500 Message-Authenticator = 0x134e376d22a73051434e5f01b9c6c362 Sun Jan 22 08:39:35 2017 : Info: # Executing section authorize from file /opt/etc/freeradius2/sites/default Sun Jan 22 08:39:35 2017 : Info: +group authorize { Sun Jan 22 08:39:35 2017 : Info: [eap] EAP packet type response id 2 length 6 Sun Jan 22 08:39:35 2017 : Info: [eap] Continuing tunnel setup. Sun Jan 22 08:39:35 2017 : Info: ++[eap] = ok Sun Jan 22 08:39:35 2017 : Info: +} # group authorize = ok Sun Jan 22 08:39:35 2017 : Info: Found Auth-Type = EAP Sun Jan 22 08:39:35 2017 : Info: # Executing group from file /opt/etc/freeradius2/sites/default Sun Jan 22 08:39:35 2017 : Info: +group authenticate { Sun Jan 22 08:39:35 2017 : Info: [eap] Request found, released from the list Sun Jan 22 08:39:35 2017 : Info: [eap] EAP/ttls Sun Jan 22 08:39:35 2017 : Info: [eap] processing type ttls Sun Jan 22 08:39:35 2017 : Info: [ttls] Authenticate Sun Jan 22 08:39:35 2017 : Info: [ttls] processing EAP-TLS Sun Jan 22 08:39:35 2017 : Info: [ttls] Received TLS ACK Sun Jan 22 08:39:35 2017 : Info: [ttls] ACK handshake fragment handler Sun Jan 22 08:39:35 2017 : Info: [ttls] eaptls_verify returned 1 Sun Jan 22 08:39:35 2017 : Info: [ttls] eaptls_process returned 13 Sun Jan 22 08:39:35 2017 : Info: ++[eap] = handled Sun Jan 22 08:39:35 2017 : Info: +} # group authenticate = handled Sending Access-Challenge of id 0 to 127.0.0.1 port 37394 EAP-Message = 0x0103017715800000056330db0242013b408b3f1975bfcee706ab640ce0885b4c97fbe652592ab4fc3969a27771b8d8b536d9a1260f6aabc6bd4922054078488670864589f983cabfedd44c880e69745516030101190c000115030019850401b77f49bc6b1797ee770a5424a59e4f3170a6ff87ebc887b1448c0696a842a67f82d2770554c6a5629b79a257f435bf671c39d6ec651cf3ab227bbb8a240134f62700f034bbf09939e9dc8bf1838c523ec3c1c650bcc0b9fb171a97be015ae9770ccd62cff839c34a1b83cbfdc1960d6a5068816aa03b8aa9f52a0c0fc430c60500e2db008a308187024200801453769b7e29283c35b4a00ad31fa9e1f90b EAP-Message = 0xc854ff2ea32d475dcab6ce05337b5886e52bc15349303acb7e905fa056f4e6c80afa7efbf8e53112a41fae0a92190241478c805797fc606c365d70e6c7a1f9f09826c325cfc93f387e1f4277741ff9a10df8f5122af7d4d8cf280f495406994e860930576409da5c5a6a0af976e46f400d16030100040e000000 Message-Authenticator = 0x00000000000000000000000000000000 State = 0x33ba028431b91704dfebfff672d73f51 Sun Jan 22 08:39:35 2017 : Info: Finished request 2. Sun Jan 22 08:39:35 2017 : Debug: Going to the next request Sun Jan 22 08:39:35 2017 : Debug: Waking up in 6.9 seconds. rad_recv: Access-Request packet from host 127.0.0.1 port 37394, id=0, length=343 Sun Jan 22 08:39:36 2017 : Info: Cleaning up request 2 ID 0 with timestamp +14 User-Name = "anonymous" NAS-IP-Address = 127.0.0.1 Called-Station-Id = "*removed6*" Calling-Station-Id = "*removed7*" NAS-Identifier = "*removed8*" NAS-Port = 109 Framed-MTU = 1400 State = 0x33ba028431b91704dfebfff672d73f51 NAS-Port-Type = Wireless-802.11 EAP-Message = 0x020300d01500160301008a10000086850401f6a9402a58c058354414ef10493bb876a435d6ad1cd62954455bfe855111315a398f5c32d04070ee0942123275435dbf78c04683acf409a2bd1dd8580e5672a193018e8a832b15664fabe8e784b612dde5db6b8276b688111efc6efeafbbef1ec3a83e1e626d3be5a812826480b44e99b18f23cfff9172ff0be2e6a673139bb83389411403010001011603010030d8b1e1011f6b286e5ab9694d7117ba7df608ea60890450c8a8a171ee292fde0d3d19330ffbe9f7cf5ab6aab9b58600f7 Message-Authenticator = 0x9330962a55c7b0a352d20bfbfbbc4d41 Sun Jan 22 08:39:36 2017 : Info: # Executing section authorize from file /opt/etc/freeradius2/sites/default Sun Jan 22 08:39:36 2017 : Info: +group authorize { Sun Jan 22 08:39:36 2017 : Info: [eap] EAP packet type response id 3 length 208 Sun Jan 22 08:39:36 2017 : Info: [eap] Continuing tunnel setup. Sun Jan 22 08:39:36 2017 : Info: ++[eap] = ok Sun Jan 22 08:39:36 2017 : Info: +} # group authorize = ok Sun Jan 22 08:39:36 2017 : Info: Found Auth-Type = EAP Sun Jan 22 08:39:36 2017 : Info: # Executing group from file /opt/etc/freeradius2/sites/default Sun Jan 22 08:39:36 2017 : Info: +group authenticate { Sun Jan 22 08:39:36 2017 : Info: [eap] Request found, released from the list Sun Jan 22 08:39:36 2017 : Info: [eap] EAP/ttls Sun Jan 22 08:39:36 2017 : Info: [eap] processing type ttls Sun Jan 22 08:39:36 2017 : Info: [ttls] Authenticate Sun Jan 22 08:39:36 2017 : Info: [ttls] processing EAP-TLS Sun Jan 22 08:39:36 2017 : Info: [ttls] eaptls_verify returned 7 Sun Jan 22 08:39:36 2017 : Info: [ttls] Done initial handshake Sun Jan 22 08:39:36 2017 : Info: [ttls] <<< Unknown TLS version [length 0005] Sun Jan 22 08:39:36 2017 : Info: [ttls] <<< TLS 1.0 Handshake [length 008a], ClientKeyExchange Sun Jan 22 08:39:36 2017 : Info: [ttls] TLS_accept: unknown state Sun Jan 22 08:39:36 2017 : Info: [ttls] TLS_accept: unknown state Sun Jan 22 08:39:36 2017 : Info: [ttls] <<< Unknown TLS version [length 0005] Sun Jan 22 08:39:36 2017 : Info: [ttls] <<< TLS 1.0 ChangeCipherSpec [length 0001] Sun Jan 22 08:39:36 2017 : Info: [ttls] <<< Unknown TLS version [length 0005] Sun Jan 22 08:39:36 2017 : Info: [ttls] <<< TLS 1.0 Handshake [length 0010], Finished Sun Jan 22 08:39:36 2017 : Info: [ttls] TLS_accept: unknown state Sun Jan 22 08:39:36 2017 : Info: [ttls] >>> Unknown TLS version [length 0005] Sun Jan 22 08:39:36 2017 : Info: [ttls] >>> TLS 1.0 ChangeCipherSpec [length 0001] Sun Jan 22 08:39:36 2017 : Info: [ttls] TLS_accept: unknown state Sun Jan 22 08:39:36 2017 : Info: [ttls] >>> Unknown TLS version [length 0005] Sun Jan 22 08:39:36 2017 : Info: [ttls] >>> TLS 1.0 Handshake [length 0010], Finished Sun Jan 22 08:39:36 2017 : Info: [ttls] TLS_accept: unknown state Sun Jan 22 08:39:36 2017 : Info: [ttls] TLS_accept: unknown state Sun Jan 22 08:39:36 2017 : Info: [ttls] (other): SSL negotiation finished successfully Sun Jan 22 08:39:36 2017 : Debug: SSL Connection Established Sun Jan 22 08:39:36 2017 : Info: [ttls] eaptls_process returned 13 Sun Jan 22 08:39:36 2017 : Info: ++[eap] = handled Sun Jan 22 08:39:36 2017 : Info: +} # group authenticate = handled Sending Access-Challenge of id 0 to 127.0.0.1 port 37394 EAP-Message = 0x0104004515800000003b14030100010116030100306c5718901210a53f7cb47324d4f06c38c95221bb1bb1a4fd190d8cac2800704128557b41fd3e9172fb584c444cd4b65e Message-Authenticator = 0x00000000000000000000000000000000 State = 0x33ba028430be1704dfebfff672d73f51 Sun Jan 22 08:39:36 2017 : Info: Finished request 3. Sun Jan 22 08:39:36 2017 : Debug: Going to the next request Sun Jan 22 08:39:36 2017 : Debug: Waking up in 6.9 seconds. rad_recv: Access-Request packet from host 127.0.0.1 port 37394, id=0, length=247 Sun Jan 22 08:39:36 2017 : Info: Cleaning up request 3 ID 0 with timestamp +15 User-Name = "anonymous" NAS-IP-Address = 127.0.0.1 Called-Station-Id = "*removed9*" Calling-Station-Id = "*removed10*" NAS-Identifier = "*removed11*" NAS-Port = 109 Framed-MTU = 1400 State = 0x33ba028430be1704dfebfff672d73f51 NAS-Port-Type = Wireless-802.11 EAP-Message = 0x020400701500170301002056e79f700170cf200b740f59f5d1130bcb65f93e1ba1add723b477774adfe37f17030100400b3dfe771e2a0348c26660fea52c503a2cf1cf9d6e93b269505e756453bd5f7156ce08993cf213bb2da11488871a65233f6ccb8154984c43433caec786540593 Message-Authenticator = 0x8f418cc5f855ccc079daa09b41c9e087 Sun Jan 22 08:39:36 2017 : Info: # Executing section authorize from file /opt/etc/freeradius2/sites/default Sun Jan 22 08:39:36 2017 : Info: +group authorize { Sun Jan 22 08:39:36 2017 : Info: [eap] EAP packet type response id 4 length 112 Sun Jan 22 08:39:36 2017 : Info: [eap] Continuing tunnel setup. Sun Jan 22 08:39:36 2017 : Info: ++[eap] = ok Sun Jan 22 08:39:36 2017 : Info: +} # group authorize = ok Sun Jan 22 08:39:36 2017 : Info: Found Auth-Type = EAP Sun Jan 22 08:39:36 2017 : Info: # Executing group from file /opt/etc/freeradius2/sites/default Sun Jan 22 08:39:36 2017 : Info: +group authenticate { Sun Jan 22 08:39:36 2017 : Info: [eap] Request found, released from the list Sun Jan 22 08:39:36 2017 : Info: [eap] EAP/ttls Sun Jan 22 08:39:36 2017 : Info: [eap] processing type ttls Sun Jan 22 08:39:36 2017 : Info: [ttls] Authenticate Sun Jan 22 08:39:36 2017 : Info: [ttls] processing EAP-TLS Sun Jan 22 08:39:36 2017 : Info: [ttls] eaptls_verify returned 7 Sun Jan 22 08:39:36 2017 : Info: [ttls] Done initial handshake Sun Jan 22 08:39:36 2017 : Info: [ttls] <<< Unknown TLS version [length 0005] Sun Jan 22 08:39:36 2017 : Info: [ttls] <<< Unknown TLS version [length 0005] Sun Jan 22 08:39:36 2017 : Info: [ttls] eaptls_process returned 7 Sun Jan 22 08:39:36 2017 : Info: [ttls] Session established. Proceeding to decode tunneled attributes. Sun Jan 22 08:39:36 2017 : Info: [ttls] Got tunneled request User-Name = "user" User-Password = "pass" FreeRADIUS-Proxied-To = 127.0.0.1 Sun Jan 22 08:39:36 2017 : Info: [ttls] Sending tunneled request User-Name = "user" User-Password = "pass" FreeRADIUS-Proxied-To = 127.0.0.1 server inner-tunnel { Sun Jan 22 08:39:36 2017 : Info: # Executing section authorize from file /opt/etc/freeradius2/sites/inner-tunnel Sun Jan 22 08:39:36 2017 : Info: +group authorize { Sun Jan 22 08:39:36 2017 : Info: [files] users: Matched entry user at line 7 Sun Jan 22 08:39:36 2017 : Info: ++[files] = ok Sun Jan 22 08:39:36 2017 : Info: ++[pap] = updated Sun Jan 22 08:39:36 2017 : Info: +} # group authorize = updated Sun Jan 22 08:39:36 2017 : Info: Found Auth-Type = PAP Sun Jan 22 08:39:36 2017 : Info: # Executing group from file /opt/etc/freeradius2/sites/inner-tunnel Sun Jan 22 08:39:36 2017 : Info: +group PAP { Sun Jan 22 08:39:36 2017 : Info: [pap] login attempt with password "pass" Sun Jan 22 08:39:36 2017 : Info: [pap] Using clear text password "pass" Sun Jan 22 08:39:36 2017 : Info: [pap] User authenticated successfully Sun Jan 22 08:39:36 2017 : Info: ++[pap] = ok Sun Jan 22 08:39:36 2017 : Info: +} # group PAP = ok Sun Jan 22 08:39:36 2017 : Info: WARNING: Empty post-auth section. Using default return values. } # server inner-tunnel Sun Jan 22 08:39:36 2017 : Info: [ttls] Got tunneled reply code Access-Accept Session-Timeout := 21600 Sun Jan 22 08:39:36 2017 : Info: [ttls] Got tunneled Access-Accept Sun Jan 22 08:39:36 2017 : Info: [eap] Freeing handler Sun Jan 22 08:39:36 2017 : Info: ++[eap] = ok Sun Jan 22 08:39:36 2017 : Info: +} # group authenticate = ok Sun Jan 22 08:39:36 2017 : Info: WARNING: Empty post-auth section. Using default return values. Sending Access-Accept of id 0 to 127.0.0.1 port 37394 Session-Timeout := 21600 MS-MPPE-Recv-Key = 0xe98f09cadffcf56264b1e1cd574e373caad532adab6b9fadcfc2e521c15bb667 MS-MPPE-Send-Key = 0xe427cd87c5f09f746b2e214b668fceac6bf0f86245916ec6062e146ac433beea EAP-Message = 0x03040004 Message-Authenticator = 0x00000000000000000000000000000000 User-Name = "anonymous" Sun Jan 22 08:39:36 2017 : Info: Finished request 4. Sun Jan 22 08:39:36 2017 : Debug: Going to the next request Sun Jan 22 08:39:36 2017 : Debug: Waking up in 6.9 seconds. Sun Jan 22 08:39:43 2017 : Info: Cleaning up request 4 ID 0 with timestamp +15 Sun Jan 22 08:39:43 2017 : Info: Ready to process requests.

4 3

Script execute if all Proxies are dead
by Chris Taylor (chtaylo2) 21 Jan '17

21 Jan '17

We’re using freeradius-2.2.6-6.el6_7 to proxy inbound radius requests to home servers. proxy.conf home_server_pool primary_radius_auth { type = fail-over home_server = server1.fqdn.com home_server = server2.fqdn.com home_server = server3.fqdn.com home_server = server4.fqdn.com } Works great, until last night when we found all home servers were erroring in the log file. Jan 19 21:48:55 proxy-server radiusd[17073]: No response to status check 16506 for home server 00.00.00.01 port 1812 Jan 19 21:48:57 proxy-server radiusd[17073]: No response to status check 16509 for home server 00.00.00.02 port 1812 Jan 19 21:49:00 proxy-server radiusd[17073]: No response to status check 16510 for home server 00.00.00.03 port 1812 Jan 19 21:49:00 proxy-server radiusd[17073]: No response to status check 16510 for home server 00.00.00.04 port 1812 After this was noticed, we restarted the radiusd service on, and it fixed the issue. My question is, any suggestions on how we could kick a shell script if the status check determines all home servers are down at a given point? I’d like to have it restart the service, in an attempt to self-heal. Thanks Chris

3 4

using x mode to monitor and analyse users
by firing neurons 19 Jan '17

19 Jan '17

Hi, I am using freeradius 3 to auth our users. I keep a tab of freeradius in x mode to monitor live activity in the network. How do I interpret and feed this data to my script to automate actions in the network? FN

3 2

Re: Freeradius-Users Digest, Vol 140, Issue 43
by firing neurons 19 Jan '17

19 Jan '17

Thank you. I will update here after trying it. I used unlang to do the disconnect on data exaustion, for now atleast. FN Message: 2 Date: Wed, 21 Dec 2016 19:56:15 +0100 From: "firing neurons" <firingneurons(a)mail.com> To: freeradius-users(a)lists.freeradius.org Subject: Re: Freeradius-Users Digest, Vol 140, Issue 40 Message-ID: <trinity-e6dd36b2-c9ac-4988-834c-3e00f870b29e-1482346575724@3capp-mailc om-lxa09> Content-Type: text/plain; charset="UTF-8" I used a Tmp-String-x and that also fixed it. About spliting the Tmp-Integer64 for sqlcounter reply name, where would I split this? Can I just put two reply attributes in sqlcounter? May be do the math there? or updating the reply list with the two attributes, calculating their value using expr in unlang is the only way? Message: 1 Date: Tue, 20 Dec 2016 20:32:54 -0500 From: Alan DeKok <aland(a)deployingradius.com> To: FreeRadius users mailing list <freeradius-users(a)lists.freeradius.org> Subject: Re: attribute overflow from sql query in unlang Message-ID: <BF8722F4-167C-48A7-BD00-53C729BECA4D(a)deployingradius.com> Content-Type: text/plain; charset=us-ascii On Dec 20, 2016, at 7:32 PM, firing neurons <firingneurons(a)mail.com> wrote: > Why is their an overflow in the first case? I am using radius3 Because Tmp-Integer is a 32-bit integer. > The same query is used by the relevant sqlcounter module and it works > as expected and doesn't overflow. > > I am trying to send CoA disconnect to the NAS after the user exhuasts > their data with sql and unlang logic in accounting section. > > I also tried simply using the reply attribute Mikrotik-Total-Limit but > the the NAS also expected Mikrotik-Total-Limit-Gigawords. > > The sqlcounter I made simply sent overflown value in > Mikrotik-Total-Limit and hence lmit of more than 4Gb couldn't be > enforced. Use a 64-bit attribute. e.g. Tmp-Integer64 > Any way I can send the extra reply attribute from the sqlcounter? You will need to manually split Tmp-Integer64 into two different 32-bit attributes. Alan DeKok. ------------------------------ ------------------------------ Message: 3 Date: Wed, 21 Dec 2016 14:53:14 -0500 From: Alan DeKok <aland(a)deployingradius.com> To: FreeRadius users mailing list <freeradius-users(a)lists.freeradius.org> Subject: Re: Freeradius-Users Digest, Vol 140, Issue 40 Message-ID: <DA471185-C0EE-4E37-9EFA-CA198ECC1538(a)deployingradius.com> Content-Type: text/plain; charset=us-ascii > On Dec 21, 2016, at 1:56 PM, firing neurons <firingneurons(a)mail.com> wrote: > > I used a Tmp-String-x and that also fixed it. > > About spliting the Tmp-Integer64 for sqlcounter reply name, where would > I split this? In "unlang", right after you call the sqlcounter module. > Can I just put two reply attributes in sqlcounter? May be do the math > there? No. The sqlcounter module has one counter. > or updating the reply list with the two attributes, calculating their > value using expr in unlang is the only way? Yes. Alan DeKok.

1 0

RE: ERROR: No Auth-Type found: rejecting the user via Post-Auth-Type = Reject
by Alan Buxey 19 Jan '17

19 Jan '17

You’ve got == . You want to have := - As per the documentation alan

2 1

User-Password to Cleartext-Password Conversion.
by Mustafa Mujahid/SYS 19 Jan '17

19 Jan '17

Hello, In which file exactly do I need to add this? Qoute > If it really is impossible to do this, the following unlang inserted above the call to the pap module may be used to copy User-Password to the correct attribute: if (!control:Cleartext-Password && control:User-Password) { update control { Cleartext-Password := "%{control:User-Password}" } } However, this should only be seen as a temporary, not permanent, fix. It is better to fix your databases to use the correct configuration. <Unqoute I changed the attribute temporarily in my DB and it worked, I would prefer using the same attribute as no specific detrimental effects about the above have been mentioned. Secondly I keep getting. -- *Mustafa Mujahid | Systems* /Operations Engineer/

4 10

ERROR: No Auth-Type found: rejecting the user via Post-Auth-Type = Reject
by Mustafa Mujahid/SYS 19 Jan '17

19 Jan '17

Hello, I was working with free radius 3.0.12 and received the below errors in debug output. lm_sql (sql): Released connection (0) (0) [sql] = ok (0) [expiration] = noop (0) [logintime] = noop (0) pap: WARNING: No "known good" password found for the user. Not setting Auth-Type (0) pap: WARNING: Authentication will fail unless a "known good" password is available (0) [pap] = noop (0) } # authorize = ok (0) ERROR: No Auth-Type found: rejecting the user via Post-Auth-Type = Reject (0) Failed to authenticate the user (0) Using Post-Auth-Type Reject I was reading this : Qoute < When a RADIUS packet contains a clear-text password in the form of a User-Password attribute, the/rlm_pap/module may be used for authentication. The module requires a "known good" password, which it uses to validate the password given in the RADIUS packet. That "known good" password must be supplied by another module (e.g./rlm_files/,/rlm_ldap/, etc.), and is usually taken from a database. Unqoute > But I'm having a bit of trouble understanding. In my DB the Attribute is Cleartext-Password , which corresponds to a plain text password. So then why is this error generated. And how to mitigate it. What am I missing. The authorize section of my /etc/raddb/sites-enabled/default is read as: authorize { preprocess digest suffix sql expiration logintime pap } and authenticate as : authenticate { } Auth-Type PAP { pap } digest } Please let me know if any further information is required. Any help is greatly appreciated. -- *Mustafa Mujahid | Systems* /Operations Engineer/

2 2