- Freeradius-Users - lists.freeradius.org

Unexpected termination signal
by Scott McLane Gardner 19 Aug '16

19 Aug '16

FreeRadius version 3.0.4 installed from rhel repos. RedHat Enterprise Linux 7.2 OpenSSL 1.0.1e-fips 11 Feb 2013 When I run radiusd -X from the command line, it runs as expected without issue. If I run radiusd as a service, I get the following messages in my radius.log after about a minute of working normally: > Thu Aug 18 18:23:41 2016 : Info: rlm_ldap (ldap): 0 of 3 connections in use. Need more spares > Thu Aug 18 18:23:41 2016 : Info: rlm_ldap (ldap): Opening additional connection (7) > Thu Aug 18 18:24:25 2016 : Info: Signalled to terminate > Thu Aug 18 18:24:25 2016 : Info: Exiting normally I have been searching the list and banging my head on this all day, so please forgive me if I have overlooked the previously posted solution. My radiusd -X output is below, although I'm not sure how helpful it will be since it runs normally under that circumstance. radiusd: FreeRADIUS Version 3.0.4, for host x86_64-redhat-linux-gnu, built on Dec 28 2014 at 07:00:16 Copyright (C) 1999-2014 The FreeRADIUS server project and contributors There is NO warranty; not even for MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE You may redistribute copies of FreeRADIUS under the terms of the GNU General Public License For more information about these matters, see the file named COPYRIGHT Starting - reading configuration files ... including dictionary file /usr/share/freeradius/dictionary including dictionary file /usr/share/freeradius/dictionary.dhcp including dictionary file /usr/share/freeradius/dictionary.vqp including dictionary file /etc/raddb/dictionary including configuration file /etc/raddb/radiusd.conf including configuration file /etc/raddb/clients.conf including files in directory /etc/raddb/mods-enabled/ including configuration file /etc/raddb/mods-enabled/always including configuration file /etc/raddb/mods-enabled/attr_filter including configuration file /etc/raddb/mods-enabled/cache_eap including configuration file /etc/raddb/mods-enabled/chap including configuration file /etc/raddb/mods-enabled/detail including configuration file /etc/raddb/mods-enabled/detail.log including configuration file /etc/raddb/mods-enabled/dhcp including configuration file /etc/raddb/mods-enabled/digest including configuration file /etc/raddb/mods-enabled/dynamic_clients including configuration file /etc/raddb/mods-enabled/eap including configuration file /etc/raddb/mods-enabled/echo including configuration file /etc/raddb/mods-enabled/exec including configuration file /etc/raddb/mods-enabled/expiration including configuration file /etc/raddb/mods-enabled/expr including configuration file /etc/raddb/mods-enabled/files including configuration file /etc/raddb/mods-enabled/linelog including configuration file /etc/raddb/mods-enabled/logintime including configuration file /etc/raddb/mods-enabled/mschap including configuration file /etc/raddb/mods-enabled/ntlm_auth including configuration file /etc/raddb/mods-enabled/pap including configuration file /etc/raddb/mods-enabled/passwd including configuration file /etc/raddb/mods-enabled/preprocess including configuration file /etc/raddb/mods-enabled/radutmp including configuration file /etc/raddb/mods-enabled/realm including configuration file /etc/raddb/mods-enabled/replicate including configuration file /etc/raddb/mods-enabled/soh including configuration file /etc/raddb/mods-enabled/sradutmp including configuration file /etc/raddb/mods-enabled/unix including configuration file /etc/raddb/mods-enabled/unpack including configuration file /etc/raddb/mods-enabled/utf8 including configuration file /etc/raddb/mods-enabled/ldap including files in directory /etc/raddb/policy.d/ including configuration file /etc/raddb/policy.d/accounting including configuration file /etc/raddb/policy.d/canonicalization including configuration file /etc/raddb/policy.d/control including configuration file /etc/raddb/policy.d/cui including configuration file /etc/raddb/policy.d/debug including configuration file /etc/raddb/policy.d/dhcp including configuration file /etc/raddb/policy.d/eap including configuration file /etc/raddb/policy.d/filter including configuration file /etc/raddb/policy.d/operator-name including files in directory /etc/raddb/sites-enabled/ including configuration file /etc/raddb/sites-enabled/default including configuration file /etc/raddb/sites-enabled/inner-tunnel main { security { user = "radiusd" group = "radiusd" allow_core_dumps = no } } main { name = "redrad01" prefix = "/usr" localstatedir = "/var" sbindir = "/usr/sbin" logdir = "/var/log/radius" run_dir = "/var/run/redrad01" libdir = "/usr/lib64/freeradius" radacctdir = "/var/log/radius/radacct" hostname_lookups = no max_request_time = 30 cleanup_delay = 5 max_requests = 1024 pidfile = "/var/run/redrad01/redrad01.pid" checkrad = "/usr/sbin/checkrad" debug_level = 0 proxy_requests = no log { stripped_names = no auth = no auth_badpass = no auth_goodpass = no colourise = yes msg_denied = "You are already logged in - access denied" } security { max_attributes = 200 reject_delay = 1 status_server = yes } } radiusd: #### Loading Realms and Home Servers #### radiusd: #### Loading Clients #### client red8510.fake.com { ipaddr = 10.250.0.19 require_message_authenticator = no secret = <<< secret >>> nas_type = "cisco" limit { max_connections = 16 lifetime = 0 idle_timeout = 0 } } client blue8510.fake.com { ipaddr = 10.250.0.18 require_message_authenticator = no secret = <<< secret >>> nas_type = "cisco" limit { max_connections = 16 lifetime = 0 idle_timeout = 0 } } client 127.0.0.1 { ipaddr = 127.0.0.1 require_message_authenticator = no secret = <<< secret >>> nas_type = "other" proto = "*" limit { max_connections = 16 lifetime = 0 idle_timeout = 0 } } radiusd: #### Instantiating modules #### instantiate { } modules { # Loaded module rlm_always # Instantiating module "reject" from file /etc/raddb/mods-enabled/always always reject { rcode = "reject" simulcount = 0 mpp = no } # Instantiating module "fail" from file /etc/raddb/mods-enabled/always always fail { rcode = "fail" simulcount = 0 mpp = no } # Instantiating module "ok" from file /etc/raddb/mods-enabled/always always ok { rcode = "ok" simulcount = 0 mpp = no } # Instantiating module "handled" from file /etc/raddb/mods-enabled/always always handled { rcode = "handled" simulcount = 0 mpp = no } # Instantiating module "invalid" from file /etc/raddb/mods-enabled/always always invalid { rcode = "invalid" simulcount = 0 mpp = no } # Instantiating module "userlock" from file /etc/raddb/mods-enabled/always always userlock { rcode = "userlock" simulcount = 0 mpp = no } # Instantiating module "notfound" from file /etc/raddb/mods-enabled/always always notfound { rcode = "notfound" simulcount = 0 mpp = no } # Instantiating module "noop" from file /etc/raddb/mods-enabled/always always noop { rcode = "noop" simulcount = 0 mpp = no } # Instantiating module "updated" from file /etc/raddb/mods-enabled/always always updated { rcode = "updated" simulcount = 0 mpp = no } # Loaded module rlm_attr_filter # Instantiating module "attr_filter.post-proxy" from file /etc/raddb/mods-enabled/attr_filter attr_filter attr_filter.post-proxy { filename = "/etc/raddb/mods-config/attr_filter/post-proxy" key = "%{Realm}" relaxed = no } reading pairlist file /etc/raddb/mods-config/attr_filter/post-proxy # Instantiating module "attr_filter.pre-proxy" from file /etc/raddb/mods-enabled/attr_filter attr_filter attr_filter.pre-proxy { filename = "/etc/raddb/mods-config/attr_filter/pre-proxy" key = "%{Realm}" relaxed = no } reading pairlist file /etc/raddb/mods-config/attr_filter/pre-proxy # Instantiating module "attr_filter.access_reject" from file /etc/raddb/mods-enabled/attr_filter attr_filter attr_filter.access_reject { filename = "/etc/raddb/mods-config/attr_filter/access_reject" key = "%{User-Name}" relaxed = no } reading pairlist file /etc/raddb/mods-config/attr_filter/access_reject # Instantiating module "attr_filter.access_challenge" from file /etc/raddb/mods-enabled/attr_filter attr_filter attr_filter.access_challenge { filename = "/etc/raddb/mods-config/attr_filter/access_challenge" key = "%{User-Name}" relaxed = no } reading pairlist file /etc/raddb/mods-config/attr_filter/access_challenge # Instantiating module "attr_filter.accounting_response" from file /etc/raddb/mods-enabled/attr_filter attr_filter attr_filter.accounting_response { filename = "/etc/raddb/mods-config/attr_filter/accounting_response" key = "%{User-Name}" relaxed = no } reading pairlist file /etc/raddb/mods-config/attr_filter/accounting_response # Loaded module rlm_cache # Instantiating module "cache_eap" from file /etc/raddb/mods-enabled/cache_eap cache cache_eap { key = "%{%{control:State}:-%{%{reply:State}:-%{State}}}" ttl = 15 max_entries = 16384 epoch = 0 add_stats = no } # Loaded module rlm_chap # Instantiating module "chap" from file /etc/raddb/mods-enabled/chap # Loaded module rlm_detail # Instantiating module "detail" from file /etc/raddb/mods-enabled/detail detail { filename = "/var/log/radius/radacct/%{%{Packet-Src-IP-Address}:-%{Packet-Src-IPv6-Address}}/detail-%Y%m%d" header = "%t" permissions = 384 locking = no log_packet_header = no } # Instantiating module "auth_log" from file /etc/raddb/mods-enabled/detail.log detail auth_log { filename = "/var/log/radius/radacct/%{%{Packet-Src-IP-Address}:-%{Packet-Src-IPv6-Address}}/auth-detail-%Y%m%d" header = "%t" permissions = 384 locking = no log_packet_header = no } rlm_detail (auth_log): 'User-Password' suppressed, will not appear in detail output # Instantiating module "reply_log" from file /etc/raddb/mods-enabled/detail.log detail reply_log { filename = "/var/log/radius/radacct/%{%{Packet-Src-IP-Address}:-%{Packet-Src-IPv6-Address}}/reply-detail-%Y%m%d" header = "%t" permissions = 384 locking = no log_packet_header = no } # Instantiating module "pre_proxy_log" from file /etc/raddb/mods-enabled/detail.log detail pre_proxy_log { filename = "/var/log/radius/radacct/%{%{Packet-Src-IP-Address}:-%{Packet-Src-IPv6-Address}}/pre-proxy-detail-%Y%m%d" header = "%t" permissions = 384 locking = no log_packet_header = no } # Instantiating module "post_proxy_log" from file /etc/raddb/mods-enabled/detail.log detail post_proxy_log { filename = "/var/log/radius/radacct/%{%{Packet-Src-IP-Address}:-%{Packet-Src-IPv6-Address}}/post-proxy-detail-%Y%m%d" header = "%t" permissions = 384 locking = no log_packet_header = no } # Loaded module rlm_dhcp # Instantiating module "dhcp" from file /etc/raddb/mods-enabled/dhcp # Loaded module rlm_digest # Instantiating module "digest" from file /etc/raddb/mods-enabled/digest # Loaded module rlm_dynamic_clients # Instantiating module "dynamic_clients" from file /etc/raddb/mods-enabled/dynamic_clients # Loaded module rlm_eap # Instantiating module "eap" from file /etc/raddb/mods-enabled/eap eap { default_eap_type = "peap" timer_expire = 60 ignore_unknown_eap_types = no mod_accounting_username_bug = no max_sessions = 1024 } # Linked to sub-module rlm_eap_md5 # Linked to sub-module rlm_eap_leap # Linked to sub-module rlm_eap_gtc gtc { challenge = "Password: " auth_type = "PAP" } # Linked to sub-module rlm_eap_tls tls { tls = "tls-common" } tls-config tls-common { rsa_key_exchange = no dh_key_exchange = yes rsa_key_length = 512 dh_key_length = 512 verify_depth = 0 ca_path = "/etc/raddb/certs" pem_file_type = yes private_key_file = "/etc/raddb/certs/redrad01.fake.com.key" certificate_file = "/etc/raddb/certs/redrad01.fake.com.cer" ca_file = "/etc/raddb/certs/ca.pem" dh_file = "/etc/raddb/certs/dh" random_file = "/dev/urandom" fragment_size = 1024 include_length = yes check_crl = no cipher_list = "DEFAULT" ecdh_curve = "prime256v1" cache { enable = yes lifetime = 24 max_entries = 255 } verify { } ocsp { enable = no override_cert_url = yes url = "http://127.0.0.1/ocsp/" use_nonce = yes timeout = 0 softfail = yes } } # Linked to sub-module rlm_eap_ttls ttls { tls = "tls-common" default_eap_type = "md5" copy_request_to_tunnel = no use_tunneled_reply = no virtual_server = "inner-tunnel" include_length = yes require_client_cert = no } Using cached TLS configuration from previous invocation # Linked to sub-module rlm_eap_peap peap { tls = "tls-common" default_method = "mschapv2" copy_request_to_tunnel = no use_tunneled_reply = no proxy_tunneled_request_as_eap = yes virtual_server = "inner-tunnel" soh = no require_client_cert = no } Using cached TLS configuration from previous invocation # Linked to sub-module rlm_eap_mschapv2 mschapv2 { with_ntdomain_hack = no send_error = no } # Loaded module rlm_exec # Instantiating module "echo" from file /etc/raddb/mods-enabled/echo exec echo { wait = yes program = "/bin/echo %{User-Name}" input_pairs = "request" output_pairs = "reply" shell_escape = yes } # Instantiating module "exec" from file /etc/raddb/mods-enabled/exec exec { wait = no input_pairs = "request" shell_escape = yes timeout = 10 } # Loaded module rlm_expiration # Instantiating module "expiration" from file /etc/raddb/mods-enabled/expiration # Loaded module rlm_expr # Instantiating module "expr" from file /etc/raddb/mods-enabled/expr expr { safe_characters = "@abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ0123456789.-_: /" } # Loaded module rlm_files # Instantiating module "files" from file /etc/raddb/mods-enabled/files files { filename = "/etc/raddb/mods-config/files/authorize" usersfile = "/etc/raddb/mods-config/files/authorize" acctusersfile = "/etc/raddb/mods-config/files/accounting" preproxy_usersfile = "/etc/raddb/mods-config/files/pre-proxy" compat = "cistron" } reading pairlist file /etc/raddb/mods-config/files/authorize [/etc/raddb/mods-config/files/authorize]:181 Cistron compatibility checks for entry DEFAULT ... [/etc/raddb/mods-config/files/authorize]:188 Cistron compatibility checks for entry DEFAULT ... [/etc/raddb/mods-config/files/authorize]:195 Cistron compatibility checks for entry DEFAULT ... reading pairlist file /etc/raddb/mods-config/files/authorize [/etc/raddb/mods-config/files/authorize]:181 Cistron compatibility checks for entry DEFAULT ... [/etc/raddb/mods-config/files/authorize]:188 Cistron compatibility checks for entry DEFAULT ... [/etc/raddb/mods-config/files/authorize]:195 Cistron compatibility checks for entry DEFAULT ... reading pairlist file /etc/raddb/mods-config/files/accounting reading pairlist file /etc/raddb/mods-config/files/pre-proxy # Loaded module rlm_linelog # Instantiating module "linelog" from file /etc/raddb/mods-enabled/linelog linelog { filename = "/var/log/radius/linelog" permissions = 384 format = "This is a log message for %{User-Name}" reference = "messages.%{%{Packet-Type}:-default}" } # Instantiating module "log_accounting" from file /etc/raddb/mods-enabled/linelog linelog log_accounting { filename = "/var/log/radius/linelog-accounting" permissions = 384 format = "" reference = "Accounting-Request.%{%{Acct-Status-Type}:-unknown}" } # Loaded module rlm_logintime # Instantiating module "logintime" from file /etc/raddb/mods-enabled/logintime logintime { minimum_timeout = 60 } # Loaded module rlm_mschap # Instantiating module "mschap" from file /etc/raddb/mods-enabled/mschap mschap { use_mppe = yes require_encryption = no require_strong = no with_ntdomain_hack = yes ntlm_auth = "/bin/ntlm_auth --request-nt-key --username=%{%{Stripped-User-Name}:-%{%{User-Name}:-None}} --challenge=%{%{mschap:Challenge}:-00} --nt-response=%{%{mschap:NT-Response}:-00}" passchange { } allow_retry = yes } # Instantiating module "ntlm_auth" from file /etc/raddb/mods-enabled/ntlm_auth exec ntlm_auth { wait = yes program = "/path/to/ntlm_auth --request-nt-key --domain=MYDOMAIN --username=%{mschap:User-Name} --password=%{User-Password}" shell_escape = yes } # Loaded module rlm_pap # Instantiating module "pap" from file /etc/raddb/mods-enabled/pap pap { normalise = yes } # Loaded module rlm_passwd # Instantiating module "etc_passwd" from file /etc/raddb/mods-enabled/passwd passwd etc_passwd { filename = "/etc/passwd" format = "*User-Name:Crypt-Password:" delimiter = ":" ignore_nislike = no ignore_empty = yes allow_multiple_keys = no hash_size = 100 } rlm_passwd: nfields: 3 keyfield 0(User-Name) listable: no # Loaded module rlm_preprocess # Instantiating module "preprocess" from file /etc/raddb/mods-enabled/preprocess preprocess { huntgroups = "/etc/raddb/mods-config/preprocess/huntgroups" hints = "/etc/raddb/mods-config/preprocess/hints" with_ascend_hack = no ascend_channels_per_line = 23 with_ntdomain_hack = no with_specialix_jetstream_hack = no with_cisco_vsa_hack = no with_alvarion_vsa_hack = no } reading pairlist file /etc/raddb/mods-config/preprocess/huntgroups reading pairlist file /etc/raddb/mods-config/preprocess/hints # Loaded module rlm_radutmp # Instantiating module "radutmp" from file /etc/raddb/mods-enabled/radutmp radutmp { filename = "/var/log/radius/radutmp" username = "%{User-Name}" case_sensitive = yes check_with_nas = yes permissions = 384 caller_id = yes } # Loaded module rlm_realm # Instantiating module "IPASS" from file /etc/raddb/mods-enabled/realm realm IPASS { format = "prefix" delimiter = "/" ignore_default = no ignore_null = no } # Instantiating module "suffix" from file /etc/raddb/mods-enabled/realm realm suffix { format = "suffix" delimiter = "@" ignore_default = no ignore_null = no } # Instantiating module "realmpercent" from file /etc/raddb/mods-enabled/realm realm realmpercent { format = "suffix" delimiter = "%" ignore_default = no ignore_null = no } # Instantiating module "ntdomain" from file /etc/raddb/mods-enabled/realm realm ntdomain { format = "prefix" delimiter = "\" ignore_default = no ignore_null = no } # Loaded module rlm_replicate # Instantiating module "replicate" from file /etc/raddb/mods-enabled/replicate # Loaded module rlm_soh # Instantiating module "soh" from file /etc/raddb/mods-enabled/soh soh { dhcp = yes } # Instantiating module "sradutmp" from file /etc/raddb/mods-enabled/sradutmp radutmp sradutmp { filename = "/var/log/radius/sradutmp" username = "%{User-Name}" case_sensitive = yes check_with_nas = yes permissions = 420 caller_id = no } # Loaded module rlm_unix # Instantiating module "unix" from file /etc/raddb/mods-enabled/unix unix { radwtmp = "/var/log/radius/radwtmp" } # Loaded module rlm_unpack # Instantiating module "unpack" from file /etc/raddb/mods-enabled/unpack # Loaded module rlm_utf8 # Instantiating module "utf8" from file /etc/raddb/mods-enabled/utf8 # Loaded module rlm_ldap # Instantiating module "ldap" from file /etc/raddb/mods-enabled/ldap ldap { server = "ds.fake.com" port = 636 password = <<< secret >>> identity = "netoc(a)fake.com" user { filter = "(sAMAccountName=%{%{Stripped-User-Name}:-%{User-Name}})" scope = "sub" base_dn = "dc=fake,dc=com" access_positive = yes } group { filter = "(objectClass=posixGroup)" scope = "sub" base_dn = "dc=fake,dc=com" name_attribute = "cn" membership_attribute = "memberOf" cacheable_name = no cacheable_dn = no } client { filter = "(objectClass=frClient)" scope = "sub" base_dn = "dc=fake,dc=com" attribute { identifier = "radiusClientIdentifier" shortname = "cn" secret = "radiusClientSecret" } } profile { filter = "(&)" } options { ldap_debug = 40 chase_referrals = yes rebind = yes net_timeout = 1 res_timeout = 20 srv_timelimit = 20 idle = 60 probes = 3 interval = 3 } tls { start_tls = no require_cert = "never" } } rlm_ldap: Falling back to build time libldap version info. Query for LDAP_OPT_API_INFO returned: -1 rlm_ldap: libldap vendor: OpenLDAP version: 20439 accounting { reference = "%{tolower:type.%{Acct-Status-Type}}" } post-auth { reference = "." } rlm_ldap (ldap): Initialising connection pool pool { start = 5 min = 4 max = 32 spare = 3 uses = 0 lifetime = 0 cleanup_interval = 30 idle_timeout = 0 retry_delay = 1 spread = no } rlm_ldap (ldap): Opening additional connection (0) rlm_ldap (ldap): Connecting to ds.fake.com:636 rlm_ldap (ldap): Waiting for bind result... rlm_ldap (ldap): Bind successful rlm_ldap (ldap): Opening additional connection (1) rlm_ldap (ldap): Connecting to ds.fake.com:636 rlm_ldap (ldap): Waiting for bind result... rlm_ldap (ldap): Bind successful rlm_ldap (ldap): Opening additional connection (2) rlm_ldap (ldap): Connecting to ds.fake.com:636 rlm_ldap (ldap): Waiting for bind result... rlm_ldap (ldap): Bind successful rlm_ldap (ldap): Opening additional connection (3) rlm_ldap (ldap): Connecting to ds.fake.com:636 rlm_ldap (ldap): Waiting for bind result... rlm_ldap (ldap): Bind successful rlm_ldap (ldap): Opening additional connection (4) rlm_ldap (ldap): Connecting to ds.fake.com:636 rlm_ldap (ldap): Waiting for bind result... rlm_ldap (ldap): Bind successful } # modules radiusd: #### Loading Virtual Servers #### server { # from file /etc/raddb/radiusd.conf } # server server default { # from file /etc/raddb/sites-enabled/default # Creating Auth-Type = digest # Loading authenticate {...} # Loading authorize {...} Ignoring "sql" (see raddb/mods-available/README.rst) # Loading preacct {...} # Loading accounting {...} # Loading post-auth {...} } # server default server inner-tunnel { # from file /etc/raddb/sites-enabled/inner-tunnel # Loading authenticate {...} # Loading authorize {...} # Loading session {...} # Loading post-auth {...} } # server inner-tunnel radiusd: #### Opening IP addresses and Ports #### listen { type = "auth" ipaddr = * port = 1812 limit { max_connections = 16 lifetime = 0 idle_timeout = 0 } } listen { type = "acct" ipaddr = * port = 0 limit { max_connections = 16 lifetime = 0 idle_timeout = 30 } } listen { type = "auth" ipv6addr = :: port = 0 limit { max_connections = 16 lifetime = 0 idle_timeout = 30 } } listen { type = "acct" ipv6addr = :: port = 0 limit { max_connections = 16 lifetime = 0 idle_timeout = 30 } } listen { type = "auth" ipaddr = 127.0.0.1 port = 18120 } Listening on auth address * port 1812 as server default Listening on acct address * port 1813 as server default Listening on auth address :: port 1812 as server default Listening on acct address :: port 1813 as server default Listening on auth address 127.0.0.1 port 18120 as server inner-tunnel Ready to process requests

3 5

non ascii characters in exec output
by Oleg Palij 19 Aug '16

19 Aug '16

I am using freeradius 3.0.12 on debian jessie. I have custom 'control' variable mapped to user distinguishedName attribute (it is in UTF-8) in Active Directory: ldap { update { control:ms-distinguishedName := 'distinguishedName' } I want to convert it to custom format and log to postauth table: authorize { update control { &ms-publishedAt := "%{exec:/etc/freeradius/dn2ou.py %{control:ms-distinguishedName}}" } In script I got UTF-8 string from freeradius, but I can't understand in what encoding I should return result. I tried different variants without success. Simple bash script like: echo $@ shows following debug: (2) update control { (2) Executing: /etc/freeradius/test.sh CN\=Сотрудник\ ХХХ,OU\=ОК\ $Р-1$,OU\=орг,DC\=xx,DC\=xx,DC\=xx,DC\=xx: (2) Program returned code (0) and output 'CN\=Сотрудник ХХХ,OU\=ОК $Р-1$,OU\=орг,DC\=xx,DC\=xx,DC\=xx,DC\=xx' (2) EXPAND %{exec:/etc/freeradius/ivc/test.sh %{control:ms-distinguishedName}} (2) --> CN\= ,OU\= $ -1$,OU\= ,DC\=xx,DC\=xx,DC\=xx,DC\=xx (2) &ms-publishedAt := CN\= ,OU\= $ -1$,OU\= ,DC\=xx,DC\=xx,DC\=xx,DC\=xx (2) } # update control = noop So it get output as UTF-8 string, but next EXPAND vanishes non-ascii symbols to spaces. Is it possible to get 'exec' module output with non ascii characters?

2 2

Re: Some Errors
by oscar 18 Aug '16

18 Aug '16

Thanks Alan... > The Errors I'm getting during August: > > > > 1) 41.800 Error lines on log > > Fri Aug 12 22:54:32 2016 : ERROR: (47435677) detail: ERROR: > Couldn't open file /var/log/radius/radacct/81.35.84.203/detail-20160812: Too > many different filenames > > It only happens form 19:00 or 20:00 until 00:00:04 or so .. > > Seems a limitation of Centos 7 ? >> It's a limitation of FreeRADIUS. You >> shouldn't have 100's of detail files opened. Is it possible to desactivate files, i dont use them i delete every month and i m not using them.. is it safe to desactivate? How can i do it ? > 2) 24.981 Error lines on log > > Mon Aug 15 17:41:21 2016 : Error: (48439939) Discarding > duplicate request from client 0.0.0.0/0 port 60621 - ID: 195 due to delayed > response >> It's not really an error. The user was >> rejected, and that reject is being delayed. >> In the mean time, the client retransmits. >> It can be ignored. But there are lots of errors every minut... is not anyrhing i can do to fix this ? Is it posible to identify wich is the id ? I mean the client who is rejected to know witch router ? > 3) 8.545 Errors lines on log > > Wed Aug 17 05:57:24 2016 : Error: Received conflicting > packet from client 0.0.0.0/0 port 59102 - ID: 8 due to unfinished request. > Giving up on old request. > > Wich are the keys parameters to identify each request different ? >> It's RADIUS magic. Don't worry about it. >> The problem is that your database is >> slow. Fix that, and the messages will go >> away. Trust me the database shoudn t be slow... how to identify witch query is not attending database? I have a dedicate server with mariadb and is not really bussie ? I think How to identify whre is the slow? > In my configuration I'm working to identify each hotspot-client with a > different nasipaddress but I don't know if it is enough . >> It may be good enough. Perfect Alan DeKok. Thanks - List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html

3 2

Re: Some Errors
by oscar 18 Aug '16

18 Aug '16

On Aug 18, 2016, at 5:39 PM, oscar <oscar(a)jofre.com> wrote: > Is it possible to desactivate files, i dont use them i delete every month and i m not using them.. is it safe to desactivate? How can i do it ? >> The unused files should get automatically cleaned up. You're probably writing more than 64 detail files at a time, which is generally not recommended. Yes sure, i have more then 400 routers authentificating users with radius so there should be more then 64 details files writing at a time. But the only way i think to solve this should be desactivating detail filea can be donne safte ? How can i do it? > But there are lots of errors every minut... is not anyrhing i can do to fix this ? Is it posible to identify wich is the id ? I mean the client who is rejected to know witch router ? >> Use the v3.0.x branch from git. I've pushed a fix. Sorry for the question but i tryed to find i dind found it. I need to recompile everything or just change some part of code? Where i can download it? >> Or, use 3.0.12 when it (finally) gets released. > >> The problem is that your database is >> slow. Fix that, and the messages will go >> away. > > Trust me the database shoudn t be slow... >> I've been doing this for 20 years. Your database is slow. Jajajjja i know it !! > how to identify witch query is not attending database? I have a dedicate server with mariadb and is not really bussie ? I think > How to identify whre is the slow? >> See your database documentation. Seems all the indicators are ok and no log errors or warning... any light? Alan DeKok. - List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html

1 0

Re: Freeradius integration with EJBCA
by Jitendra 18 Aug '16

18 Aug '16

Hello All, I have installed Ejbca and have it up and running for creating end entity certificates. However i am now unsure on how to configure eap-tls for freeradius with respect to the crl/certs produced by ejbca. Can anyone give me any pointers or a place where i can find some instructions? Regards, Jit On Wed, 17 Aug 2016 at 2:24 PM, Jitendra <jkilambi(a)gmail.com> wrote: > Hello All, > > I have installed Ejbca and have it up and running for creating end entity > certificates. However i am now unsure on how to configure eap-tls for > freeradius with respect to the crl/certs produced by ejbca. Can anyone give > me any pointers or a place where i can find some instructions? > > Regards, > Jit > -- > Kind Regards, > Jitendra > -- Kind Regards, Jitendra

4 5

Some Errors
by Oscar Jofre 18 Aug '16

18 Aug '16

Hi, I have some errors I don't know how to fix. I'm using freeradius 3.0.10 with lots of mikrotiks-hotspots connected and working apparently perfect. I'm adjusting to send on nasipaddress a unique IP for each mikrtoik-hotspot client. But now this is how looks raddact form 3 different hotspot-clients (each one on different ubications ) radacctid acctsessionid acctuniqueid username groupname realm nasipaddress nasportid nasporttype acctstarttime acctupdatetime acctstoptime acctinterval acctsessiontime acctauthentic connectinfo_start connectinfo_stop acctinputoctets acctoutputoctets calledstationid callingstationid acctterminatecause servicetype framedprotocol framedipaddress 16212900 80b0bb84 078cf7cca5b2a613beee2af0316de662 SwB_336391_ins_837_D8:1D:72:9C:35:49 192.168.32.4 bridge-hs Wireless-802.11 "2016-08-17 16:58:12" "2016-08-17 16:58:12" NULL NULL 0 0 0 606B051E73E5 D8:1D:72:9C:35:49 10.1.115.164 16212899 80b0017e 687f7a16adc44bbad5743f50c86e95f3 SwB_720082_ins_126_F4:31:C3:51:12:69 192.168.1.33 bridge-hs Wireless-802.11 "2016-08-17 16:58:09" "2016-08-17 16:58:09" NULL NULL 0 0 0 573205E971AE F4:31:C3:51:12:69 10.1.100.10 16212897 80500074 ca131c5822c708388105edc55430eb18 SwB_667778_ins_1441_58:7F:57:C3:97:E9 192.168.3.34 bridge-hs Wireless-802.11 "2016-08-17 16:58:05" "2016-08-17 16:58:05" NULL NULL 0 0 0 6431052C6C1E 58:7F:57:C3:97:E9 10.1.102.11 I don't know if it can be seen correctly. The Errors I'm getting during August: 1) 41.800 Error lines on log Fri Aug 12 22:54:32 2016 : ERROR: (47435677) detail: ERROR: Couldn't open file /var/log/radius/radacct/81.35.84.203/detail-20160812: Too many different filenames It only happens form 19:00 or 20:00 until 00:00:04 or so .. Seems a limitation of Centos 7 ? 2) 24.981 Error lines on log Mon Aug 15 17:41:21 2016 : Error: (48439939) Discarding duplicate request from client 0.0.0.0/0 port 60621 - ID: 195 due to delayed response This error appears 5 times from 1 to 15 August and from 15 august until now (24.981) lots of times evey hour ! Don't know how to find the client or radius request from ID 195 ... I didn't change anything from radius configuration so don't know why starts this error now. 3) 8.545 Errors lines on log Wed Aug 17 05:57:24 2016 : Error: Received conflicting packet from client 0.0.0.0/0 port 59102 - ID: 8 due to unfinished request. Giving up on old request. Wich are the keys parameters to identify each request differents ? In my configuration I'm working to identify each hotspot-client with a different nasipaddress but I don't know if it is enough . Thanks for the help ! Still difficult for me to understand everything from radius communication.

2 1

check-eap-tls
by Thomas Massip 17 Aug '16

17 Aug '16

Hi all, I try to use the virtual server 'check-eap-tls', but when I start FreeRadius with '-radiusd -XXXX' I have this error : Wed Aug 17 16:18:39 2016 : Error: /opt/fr3/etc/raddb/sites-enabled/check-eap-tls[63]: Parse error in condition Wed Aug 17 16:18:39 2016 : Error: /opt/fr3/etc/raddb/sites-enabled/check-eap-tls[63]: ("host/%{TLS-Client-Cert-Common-Name}" == &User-Name) { Wed Aug 17 16:18:39 2016 : Error: /opt/fr3/etc/raddb/sites-enabled/check-eap-tls[63]: ^ Cannot use attribute reference on right side of condition I dont understand this error because in mods-enable eap.conf, I un-commented virtual_server = check-eap-tls So normaly, he had acces to this attribute no ? Thanks for ur helps Regards, Thomas

3 3

Dynamic VLAN with LDAP group
by Thomas Massip 17 Aug '16

17 Aug '16

Hi all, I know this subject is redondant but I don't arrive to do what I want.. So actually i arrive to do Dynamic VLAN with LDAP user, exemple of LDAP user entry : dn: uid=thomas,cn=test,ou=groups,dc=domaintest,dc=lan objectClass: person objectClass: radiusprofile objectClass: shadowAccount objectClass: posixAccount objectClass: inetOrgPerson cn: thomas massip uid: thomas sn: thomas givenName: Thomas uidNumber: 10003 gidNumber: 1500 loginShell: /bin/bash homeDirectory: /ahome/thomas userPassword: 1B4EDB9F184199B74F58553DC77CD8E5 radiusTunnelType: VLAN radiusTunnelMediumType: 6 radiusTunnelprivateGroupId: 100 When I do that this is Ok, my user go on vlan 100. But now, I want do same but not with user, with GROUPS so i try: dn: cn=test, ou=groups, dc=domaintest,dc=lan objectClass: top objectClass: posixGroup objectClass: radiusprofile cn: test gidNumber: 1500 description: groupe de test vlan memberUid: 10003 radiusTunnelType: VLAN radiusTunnelMediumType: 6 radiusTunnelprivateGroupId: 100 where memberUid: 10003 = dn: uid=thomas,cn=test,ou=groups,dc=domaintest,dc=lan objectClass: person objectClass: radiusprofile objectClass: shadowAccount objectClass: posixAccount objectClass: inetOrgPerson cn: thomas massip uid: thomas sn: thomas givenName: Thomas uidNumber: 10003 gidNumber: 1500 loginShell: /bin/bash homeDirectory: /ahome/thomas userPassword: 1B4EDB9F184199B74F58553DC77CD8E5 But, this solution doesn't work. I know I can use file users with (I test and it's work) : DEFAULT Ldap-Group == "cn=test,ou=groups,dc=domaintest,dc=lan" Tunnel-Type = VLAN, Tunnel-Medium-Type = IEEE-802, Tunnel-Private-Group-Id = "100" #Reply-Message = "Cette methode marche, tu est dans le 100" But I really want to stock all information on LDAP not on file users. So i try to do an update reply on module LDAP subsection 'group' but that doesn't work too (I think it's the good solution but I miss something). So if anyone can help me to return VLAN attribute with the LDAP groups Thanks all and sry for the bad english Regards, Thomas.

2 1

Re: Freeradius-Users Digest, Vol 136, Issue 21
by Philipp Trenz 16 Aug '16

16 Aug '16

Hi Alan, thanks for these tips. 3.0.4 was at the repo of RHEL7, so I used it. But with your advice I'll compile the latest 3.1.X version. Mr Paffrath at the DFN, responsible for the Radius servers, is just in vacation. So I try to collect as much information as possible to question him, when he's back. With RadSec I'm not shure what I need, it should just function with the DFN servers ;) I'll see ... Greetings! Am 2016-08-15 12:00, schrieb freeradius-users-request(a)lists.freeradius.org: Message: 2 Date: Mon, 15 Aug 2016 09:32:19 +0000 From: A.L.M.Buxey(a)lboro.ac.uk To: FreeRadius users mailing list <freeradius-users(a)lists.freeradius.org> Subject: Re: FR3 RadSec for Eduroam (esp. Germany & DFN servers) Message-ID: <20160815093219.GB10649(a)lboro.ac.uk> Content-Type: text/plain; charset=us-ascii Hi, > I heared of different voices. At > https://wiki.geant.org/display/H2eduroam/freeradius3-flr it says FR3 > can replace third party software like RadSecProxy, but I also heared > that the implementation does not work that fine. documentation is always historical.... that was probably based on early implementations..... > At the moment it's going to be FreeRADIUS 3.0.4 on a RHEL7.2, but > also could go up to the latest stable release, if this would fix > issues. 3.0.4 is old and creaky, containing many random bugs. I would recommend that you use the recent 3.1.x - thus getting yourself ready for the 3.2.x stable release and having all latest features but not bleeding edge 4.x stuff. if you must have 3.0.x then use 3.0.11 (or 3.0.12 when that slips out) - but be aware that it'll be legacy release when 3.2 arrives. what RADSEC features do you want? if you chat with your NRO in DFN they'll give you their advice....as there are other things they may expect or wnat you to do.... alan

2 2

Module summary documents
by Arran Cudbard-Bell 16 Aug '16

16 Aug '16

I’ve just added short descriptions for the (many) modules and drivers we ship with the server in the form of a README.md file in each module directory. If anyone wants to expand on what’s already there for their favourite modules, please feel free… The summary descriptions will be used to generate the JSON data for the new website’s module information API, and also as the description field in any automatically generated packages. If you end up with several paragraphs of more descriptive text, feel free to add a ## Description heading. We’ll figure out some way to use it in future… Probably in an accordion fold down on the website. Thanks, -Arran Arran Cudbard-Bell <a.cudbardb(a)freeradius.org> FreeRADIUS Development Team FD31 3077 42EC 7FCD 32FE 5EE2 56CF 27F9 30A8 CAA2

3 3