- Freeradius-Users - lists.freeradius.org

Framed-IP-Address not inserted in mysql
by Bernd 07 Dec '16

07 Dec '16

Hi, running FreeRADIUS Version 3.0.4 (built for host x86_64-redhat-linux-gnu, built on Mar 5 2015 at 23:41:36) from stock packages on a CentOS 7 machine. I have the problem that I see Framed-IP-Address entries in radacct log files: Wed Dec 7 15:11:57 2016 Acct-Session-Id = '0004xxxx' Framed-Protocol = PPP Framed-IP-Address = 10.2.3.4 User-Name = 'user(a)example.com' Acct-Session-Time = 111 Acct-Input-Octets = 3499 Acct-Output-Octets = 5252 Acct-Input-Packets = 45 Acct-Output-Packets = 57 Acct-Status-Type = Stop Service-Type = Framed-User Acct-Delay-Time = 0 NAS-IP-Address = 12.13.14.15 Event-Timestamp = 'Dec 7 2016 15:11:57 CET' Acct-Unique-Session-Id = '297cb70bcbc4a02b1d1xyz123' Timestamp = 1481119917 but they're *not* being inserted into the MySQL database (field is empty, tcpdump shows that clearly a '' is being transmitted to MySQL): INSERT INTO radacct (acctsessionid, acctuniqueid, username, realm, nasipaddress, nasportid, nasporttype, acctstarttime, acctupdatetime, acctstoptime, acctsessiontime, acctauthentic, connectinfo_start, connectinfo_stop, acctinputoctets, acctoutputoctets, calledstationid, callingstationid, acctterminatecause, servicetype, framedprotocol, framedipaddress) VALUES ('0004xxxx', '297cb70bcbc4a02b1d1xyz123', 'user(a)example.com', '', '12.13.14.15', '', '', FROM_UNIXTIME(1481119920), FROM_UNIXTIME(1481119920), NULL, '0', '', '', '', '0', '0', '', '', '', 'Framed-User', 'PPP', '') Help very much appreciated. Best, Bernd

2 1

RE: Set up /dev/null (no auth) proxy server on NULL realm
by Alan Buxey 07 Dec '16

07 Dec '16

I told you exactly what to do in my first reply (simple bit of unlang in the authorize section) alan

2 1

Set up /dev/null (no auth) proxy server on NULL realm
by Seiichirou Hiraoka 06 Dec '16

06 Dec '16

Hello folks, I use freeradius 3.0.4 on CentOS 7.2 (RPM) And I want to set up /dev/null (without auth) proxy server on NULL realm. Now, I set up my proxy.conf as follow. ----- realm NULL { authhost = 127.0.0.1:1645 accthost = 127.0.0.1:1646 secret = dummy } ----- No service exist in 127.0.0.1:1645, 1646. When user try to auth without realm (NULL realm), all authentication going to fail. I have some question. 1) Is my setting correct ? 2) Is there a way to set the timeout? (I want to set timeout to 0) 3) Any other advice? Best regards,

2 4

Calculating data usage between interim and stop packets.
by Anuruddha Premalal 05 Dec '16

05 Dec '16

Hi All, I'm trying to get users actual usage between accounting updates. With the folowing method, 1. Extended the python *preacct* method and filterout only interim updates and accounting stop packets. 2. Get the current usage recorded(inputoctets, outputoctets) from the mysql databse for the accounting sessionid group by date and take the latest value. 3. Take the difference between received input and output octets and the valus in the database *tx*= new_input_octets - old_input_octets *rx*= new_output_octets - old_output_octets 3. Send a paylod to a message queue pnly if *tx, rx* values are positive. I am trying to use this method to avoid periodic database polling to perform this operation. The issue is - at point 2 sometimes(intermittently) it returns an empty record set even the session has already been started (already received an accounting start). Is freeradius clearing the existing accouting record from the database as soon as it receives an accounting interim paccket - is there a way to insert my logic before that happens? Thanks & Best Regards, -- *Anuruddha Premalala (MIEEE)Mobile : +94717213122 <071%20721%203122>E-mail : anuruddhapremalal(a)gmail.com <anuruddhapremalal(a)gmail.com>web : www.anuruddha.org <http://www.anuruddha.org>*

2 2

issues with duplicate AcctUniqueId attribute values
by Alex Sharaz 05 Dec '16

05 Dec '16

While I track down why the above is happening .... 1). Can I enable debugging in just the buffered-sql virt server ? Its a pain running all of a server in debug mode 2). Is it possible to manually take a detail.work file and pipe it into buffered sql offline? 3). When buffered-sql sees rlm_sql_postgresql: Status: PGRES_FATAL_ERROR (4) sql: rlm_sql_postgresql: ERROR: duplicate key value violates unique constraint "radacct_acctuniqueid_key" (4) sql: rlm_sql_postgresql: DETAIL: Key (acctuniqueid)=(e5aa2781f1f3842a1b9e7590ce9d2ab6) already exists. (4) sql: SQL query returned: need alt query (4) sql: No additional queries configured rlm_sql (sql): Released connection (3) (4) [sql] = noop (4) } # accounting = noop (4) detail (/var/spool/freeradius/detail): No response to request. Will retry in 30 seconds it seems to block processing of subsequent statements. Any way of telling it to skip that update log an error and move onto the next one? A

2 2

FreeRadius Error
by Albert K 05 Dec '16

05 Dec '16

Hi, I have an installation with Samba 4.3.x (with winbindd) and FreeRadius 3.0.11. I want authentication with Windows AD and authorization with Windows AD LDAP. I am trying setup the PEAP mschap wifi and get the following error when /usr/local/bin/radtest radius tycbf@179963 localhost 0 testing123 Ready to process requests (1) Received Access-Request Id 160 from 127.0.0.1:22166 to 127.0.0.1:1812 length 76 (1) User-Name = "radius" (1) User-Password = "tycbf@179963" (1) NAS-IP-Address = 10.200.1.7 (1) NAS-Port = 0 (1) Message-Authenticator = 0xbd3d0852f4606cda7488d1198c4387bc (1) # Executing section authorize from file /usr/local/etc/raddb/sites-enabled/default (1) authorize { (1) policy filter_username { (1) if (&User-Name) { (1) if (&User-Name) -> TRUE (1) if (&User-Name) { (1) if (&User-Name =~ / /) { (1) if (&User-Name =~ / /) -> FALSE (1) if (&User-Name =~ /@[^@]*@/ ) { (1) if (&User-Name =~ /@[^@]*@/ ) -> FALSE (1) if (&User-Name =~ /\.\./ ) { (1) if (&User-Name =~ /\.\./ ) -> FALSE (1) if ((&User-Name =~ /@/) && (&User-Name !~ /(a)(.+)\.(.+)$/)) { (1) if ((&User-Name =~ /@/) && (&User-Name !~ /(a)(.+)\.(.+)$/)) -> FALSE (1) if (&User-Name =~ /\.$/) { (1) if (&User-Name =~ /\.$/) -> FALSE (1) if (&User-Name =~ /(a)\./) { (1) if (&User-Name =~ /(a)\./) -> FALSE (1) } # if (&User-Name) = notfound (1) } # policy filter_username = notfound (1) [preprocess] = ok (1) [chap] = noop (1) [mschap] = noop (1) [digest] = noop (1) suffix: Checking for suffix after "@" (1) suffix: No '@' in User-Name = "radius", looking up realm NULL (1) suffix: No such realm "NULL" (1) [suffix] = noop (1) eap: No EAP-Message, not doing EAP (1) [eap] = noop (1) [files] = noop rlm_ldap (ldap): Closing connection (1): Hit idle_timeout, was idle for 1543 seconds rlm_ldap (ldap): Closing connection (2): Hit idle_timeout, was idle for 1543 seconds rlm_ldap (ldap): Closing connection (3): Hit idle_timeout, was idle for 1543 seconds rlm_ldap (ldap): You probably need to lower "min" rlm_ldap (ldap): Closing connection (4): Hit idle_timeout, was idle for 1543 seconds rlm_ldap (ldap): You probably need to lower "min" rlm_ldap (ldap): Closing connection (5): Hit idle_timeout, was idle for 1537 seconds rlm_ldap (ldap): You probably need to lower "min" rlm_ldap (ldap): 0 of 0 connections in use. You may need to increase "spare" rlm_ldap (ldap): Opening additional connection (6), 1 of 32 pending slots used rlm_ldap (ldap): Connecting to ldap://10.100.100.10:389 rlm_ldap (ldap): Waiting for bind result... rlm_ldap (ldap): Bind successful rlm_ldap (ldap): Reserved connection (6) (1) ldap: EXPAND (samaccountname=%{%{Stripped-User-Name}:-%{User-Name}}) (1) ldap: --> (samaccountname=radius) (1) ldap: Performing search in "dc=sgcom,dc=co,dc=sg" with filter "(samaccountname=radius)", scope "sub" (1) ldap: Waiting for search result... rlm_ldap (ldap): Rebinding to URL ldap:// DomainDnsZones.sgcom.co.sg/DC=DomainDnsZones,DC=sgcom,DC=co,DC=sg rlm_ldap (ldap): Waiting for bind result... rlm_ldap (ldap): Rebinding to URL ldap:// ForestDnsZones.sgcom.co.sg/DC=ForestDnsZones,DC=sgcom,DC=co,DC=sg rlm_ldap (ldap): Waiting for bind result... rlm_ldap (ldap): Rebinding to URL ldap:// sgcom.co.sg/CN=Configuration,DC=sgcom,DC=co,DC=sg rlm_ldap (ldap): Waiting for bind result... rlm_ldap (ldap): Bind successful rlm_ldap (ldap): Bind successful rlm_ldap (ldap): Bind successful (1) ldap: User object found at DN "CN=radius,OU=LPK USERS,DC=sgcom,DC=co,DC=sg" (1) ldap: Processing user attributes (1) ldap: WARNING: No "known good" password added. Ensure the admin user has permission to read the password attribute (1) ldap: WARNING: PAP authentication will *NOT* work with Active Directory (if that is what you were trying to configure) rlm_ldap (ldap): Deleting connection (6) rlm_ldap (ldap): Need 3 more connections to reach 10 spares rlm_ldap (ldap): Opening additional connection (7), 1 of 32 pending slots used rlm_ldap (ldap): Connecting to ldap://10.100.100.10:389 rlm_ldap (ldap): Waiting for bind result... rlm_ldap (ldap): Bind successful (1) [ldap] = ok (1) [expiration] = noop (1) [logintime] = noop (1) } # authorize = ok (1) ERROR: No Auth-Type found: rejecting the user via Post-Auth-Type = Reject (1) Failed to authenticate the user (1) Using Post-Auth-Type Reject (1) # Executing group from file /usr/local/etc/raddb/sites-enabled/default (1) Post-Auth-Type REJECT { (1) attr_filter.access_reject: EXPAND %{User-Name} (1) attr_filter.access_reject: --> radius (1) attr_filter.access_reject: Matched entry DEFAULT at line 11 (1) [attr_filter.access_reject] = updated (1) [eap] = noop (1) policy remove_reply_message_if_eap { (1) if (&reply:EAP-Message && &reply:Reply-Message) { (1) if (&reply:EAP-Message && &reply:Reply-Message) -> FALSE (1) else { (1) [noop] = noop (1) } # else = noop (1) } # policy remove_reply_message_if_eap = noop (1) } # Post-Auth-Type REJECT = updated (1) Delaying response for 1.000000 seconds Waking up in 0.9 seconds. (1) Sending delayed response (1) Sent Access-Reject Id 160 from 127.0.0.1:1812 to 127.0.0.1:22166 length 20 Waking up in 3.9 seconds. (1) Cleaning up request packet ID 160 with timestamp +1543

2 1

Anyone got a working sites-available/tls file for FR 4.0- ?
by Alex Sharaz 03 Dec '16

03 Dec '16

Once I wrapped the supplied example in "server tls {....} " Get a "Failed to find clients radsec {..} message" even though the config is there. A

4 9

FR 3.1 access-accept (Alan DeKok)
by Chris Howley 02 Dec '16

02 Dec '16

Hi Alan, I was looking for an explanation why the attributes weren't there in 3.1. Thank you for your time. Chris Howley

1 0

Redunant result=action problem
by matus2 01 Dec '16

01 Dec '16

Hello all! I have a small issue with ldap redundancy configuration. My goal is to set up ldap1 and ldap2 module redundancy( if first of listed module fail) with handling return action 'userlock'. I have followed page http://wiki.freeradius.org/config/Fail-over which describes how to assign group RESULT=ACTION specifiers and configured authorize section like this: authorize { redundant { ldap1 ldap2 userlock = 1 } if ( userlock ) { .... } Unfortunately I am not able to start server because of problem on line "userlock = 1" server inner-tunnel { # from file /etc/raddb/sites-enabled/inner-tunnel # Loading authenticate {...} # Loading authorize {...} /etc/raddb/sites-enabled/inner-tunnel[170]: Entry with no value is invalid /etc/raddb/sites-enabled/inner-tunnel[48]: Errors parsing authorize section. I am using FreeRADIUS Version 3.0.12 on CentOS version 7. Thanks for your help. Regards matus2

2 1

buffered-sql debugging
by Alex Sharaz 01 Dec '16

01 Dec '16

Is there any way of selectively enabling debugging of the buffered-sql server ? Having got past my previous problems with my config, verified that it was all working puppetized the config, pushed it to all my outward facing eduroam servers, verified that its working and left it alone ... I've now got 4 servers with ~5G detail files I use if ( "%{client:shortname}" == "xb1sw7" ) { update control { Tmp-String-2 = "%{debug:1}" } } in my "default" server for example A

1 1