- Freeradius-Users - lists.freeradius.org

Unstable freeRADIUS (authorization) work
by Манцуров Дмитрий Вячеславович 03 Jun '16

03 Jun '16

I have freeRADIUS version 2.2.5 installed on Debian GNU/Linux 8.4 (Jessie). freeRADIUS use with telephone station. Now testing with two users. Their User-Names 682808 and 686038. When I run freeRADIUS as daemon, it works about one hour (sometimes less). Then I get for one of users: "Auth: [preprocess] No huntgroup access..." (log below). And another user can continue to work When I run FreeRADIUS in debug mode (freeradius -X), it can work for three days, I did not check longer. Detailed log, when user was authorize: Fri Jun 3 14:57:46 2016 : Info: expand: %{debug:3} -> 0 Fri Jun 3 14:57:46 2016 : Info: +++} # update control = noop Fri Jun 3 14:57:46 2016 : Info: ++} # if ("%{User-Name}" == "682808") = noop Fri Jun 3 14:57:46 2016 : Info: modsingle[authorize]: calling preprocess (rlm_preprocess) for request 1434 Fri Jun 3 14:57:46 2016 : Info: modsingle[authorize]: returned from preprocess (rlm_preprocess) for request 1434 Fri Jun 3 14:57:46 2016 : Info: ++[preprocess] = ok Fri Jun 3 14:57:46 2016 : Info: modsingle[authorize]: calling auth_log (rlm_detail) for request 1434 Fri Jun 3 14:57:46 2016 : Info: [auth_log] expand: %{Packet-Src-IP-Address} -> 10.10.10.200 Fri Jun 3 14:57:46 2016 : Info: [auth_log] expand: /var/log/freeradius/radacct/%{%{Packet-Src-IP-Address}:-%{Packet-Src-IPv6-Address}}/auth-detail-%Y%m%d -> /var/log/freeradius/radacc$ Fri Jun 3 14:57:46 2016 : Info: [auth_log] /var/log/freeradius/radacct/%{%{Packet-Src-IP-Address}:-%{Packet-Src-IPv6-Address}}/auth-detail-%Y%m%d expands to /var/log/freeradius/radacct/10$ Fri Jun 3 14:57:46 2016 : Info: [auth_log] expand: %t -> Fri Jun 3 14:57:46 2016 Fri Jun 3 14:57:46 2016 : Info: modsingle[authorize]: returned from auth_log (rlm_detail) for request 1434 Fri Jun 3 14:57:46 2016 : Info: ++[auth_log] = ok Fri Jun 3 14:57:46 2016 : Info: modsingle[authorize]: calling files (rlm_files) for request 1434 Fri Jun 3 14:57:46 2016 : Info: [files] users: Matched entry DEFAULT at line 62 Fri Jun 3 14:57:46 2016 : Info: [files] users: Matched entry DEFAULT at line 65 Fri Jun 3 14:57:46 2016 : Info: modsingle[authorize]: returned from files (rlm_files) for request 1434 Fri Jun 3 14:57:46 2016 : Info: ++[files] = ok Fri Jun 3 14:57:46 2016 : Info: modsingle[authorize]: calling monthlycounter (rlm_counter) for request 1434 Fri Jun 3 14:57:46 2016 : Info: modsingle[authorize]: returned from monthlycounter (rlm_counter) for request 1434 Fri Jun 3 14:57:46 2016 : Info: ++[monthlycounter] = ok Fri Jun 3 14:57:46 2016 : Info: modsingle[authorize]: calling expiration (rlm_expiration) for request 1434 Fri Jun 3 14:57:46 2016 : Info: modsingle[authorize]: returned from expiration (rlm_expiration) for request 1434 Fri Jun 3 14:57:46 2016 : Info: ++[expiration] = noop Fri Jun 3 14:57:46 2016 : Info: modsingle[authorize]: calling logintime (rlm_logintime) for request 1434 Fri Jun 3 14:57:46 2016 : Info: modsingle[authorize]: returned from logintime (rlm_logintime) for request 1434 Fri Jun 3 14:57:46 2016 : Info: ++[logintime] = noop Fri Jun 3 14:57:46 2016 : Info: +} # group authorize = ok Fri Jun 3 14:57:46 2016 : Info: Found Auth-Type = Accept Fri Jun 3 14:57:46 2016 : Info: Auth-Type = Accept, accepting the user Fri Jun 3 14:57:46 2016 : Auth: Login OK: [682808/<via Auth-Type = Accept>] (from client localhost port 0 cli 682808) Fri Jun 3 14:57:46 2016 : Info: WARNING: Empty post-auth section. Using default return values. Fri Jun 3 14:57:46 2016 : Info: Sending Access-Accept packet to host 10.10.10.200 port 49777, id=15, length=0 Fri Jun 3 14:57:46 2016 : Info: Auth-Type := Reject Fri Jun 3 14:57:46 2016 : Info: h323-credit-time = "h323-credit-time=900" Fri Jun 3 14:57:46 2016 : Info: Session-Timeout = 5977 Fri Jun 3 14:57:46 2016 : Info: Finished request 1434. Fri Jun 3 14:57:48 2016 : Info: Cleaning up request 1434 ID 15 with timestamp +2483 Not authorize: Fri Jun 3 15:18:27 2016 : Info: expand: %{debug:3} -> 0 Fri Jun 3 15:18:27 2016 : Info: +++} # update control = noop Fri Jun 3 15:18:27 2016 : Info: ++} # if ("%{User-Name}" == "682808") = noop Fri Jun 3 15:18:27 2016 : Info: modsingle[authorize]: calling preprocess (rlm_preprocess) for request 2273 Fri Jun 3 15:18:27 2016 : Auth: [preprocess] No huntgroup access: [682808] (from client localhost port 0 cli 682808) Fri Jun 3 15:18:27 2016 : Info: modsingle[authorize]: returned from preprocess (rlm_preprocess) for request 2273 Fri Jun 3 15:18:27 2016 : Info: ++[preprocess] = reject Fri Jun 3 15:18:27 2016 : Info: +} # group authorize = reject Fri Jun 3 15:18:27 2016 : Auth: Invalid user: [682808/<no User-Password attribute>] (from client localhost port 0 cli 682808) Fri Jun 3 15:18:27 2016 : Info: Using Post-Auth-Type REJECT Fri Jun 3 15:18:27 2016 : Info: WARNING: Unknown value specified for Post-Auth-Type. Cannot perform requested action. Fri Jun 3 15:18:27 2016 : Info: Delaying reject of request 2273 for 1 seconds Fri Jun 3 15:18:28 2016 : Info: Sending delayed reject for request 2273 Fri Jun 3 15:18:28 2016 : Info: Sending Access-Reject packet to host 10.10.10.200 port 46827, id=42, length=0 Fri Jun 3 15:18:30 2016 : Info: Cleaning up request 2273 ID 42 with timestamp +3724 I would be grateful for any ideas.

2 1

Classic double radius, how to configure accounting
by Fabrizio Fiore Donati 02 Jun '16

02 Jun '16

Hi, i need to configure a classic setup, with some cisco router that do AAA versus two radius server. The radius database is on a mysql cluster. How i must configure the two radius for accounting ? They can have a simple configuration or i need to do something other ? Each router have two radius configured. Thanks

2 3

Multiple access-request + access-accept packets in one conversation.
by Vlad Kratsberg 02 Jun '16

02 Jun '16

Hi Freeradius Users, I will appreciate some help here. We are running FR3.0.11 + ldap + 802.1x peap + gtc. When client tries to get on the network for the first time, everything is good. Server issues cert, client accepts, vlan id is attached to access-accept packet, and client gets an ip. The whole exchange is fast and only consists of 8 request packets. http://pastebin.com/P35eNW4C However , when client tries to re-authenticate -- communication between client and a server grows to 100 + request packets while server responds with multiple access-accept packets and none of them contain Tunnel-Id ( not cached ?) http://pastebin.com/y1HGF4PP When i disable cache subsection of eap module, and client tries to re-authenticate, i also get a very long conversation (100+ requests ) involving multiple access-request and access-accept messages, however access-accept messages return with Tunnel-id attribute. Can someone point me in the right direction as to why communication is so long and involves multiple access-accept packets when client tries to re-authenticate and what needs to be done with cache so it works properly and caches Tunnel-Id. Thanks

2 7

radacct.pl
by Alex Moen 01 Jun '16

01 Jun '16

Until just last month, we were using FreeRADIUS circa 2007? 2008? IDK for sure, because that server has been put out to pasture. Anyway, in the good old days, we were able to parse the accounting logs using a perl script named radacct.pl. We use this to determine dialup usage overage (yes, we still have some users that want to use dialup, even though it's as expensive as a DSL connection. Don't ask me... I just work here.) However, with our NEW and IMPROVED FreeRADIUS 3.0.4, and with the new versions of Perl, radacct.pl no longer works. I guess I can't blame it, the last time it was updated was, like, 1998. So, what is the modern way to parse the logs and get the usage information? Thanks!! -- Alex Moen NSTII North Dakota Telephone Company 701-662-6481

2 1

Thought 3.0.12 was coming out on the 31st
by Alex Sharaz 01 Jun '16

01 Jun '16

A

2 2

determining conditions to differentiate message? types
by Brendan Kearney 30 May '16

30 May '16

i was told that the "if (EAP-Message)" condition would not differentiate between MAC auth and normal .1x, and that i need to capture and read the packets a bit more to make that differentiation. where can i go to find more info about how to do that? how do i find what are conditions that i can key off of? i am looking to do radius vlan assignment, and need to work through getting the conditions identified properly and replying correctly. thanks in advance, brendan

2 3

Using rlm_perl freeradiis 3.0.11
by khouzam.yaghi＠gmail.com 30 May '16

30 May '16

I read the documentation for rlm_perl but i didnt understand where should i write the function , in /mods-available/perl i should uncomment the function i want and then i write it in example.pl , or i should write in the same file (/mods-available/perl) ??? Also after writting the function i just add perl in the specified section in sites-available/default?? Thanks in advance.

2 1

Use stripped username in SQL
by Tornoci Laszlo 28 May '16

28 May '16

Hi, I am using ldap for authentication, and sql for adding dynamic VLAN IDs. For ldap, the domain is stripped, and the Stripped-User-Name is used for the lookup. However, when the the SQL-User-Name is generated, the domain is added back. I'd like to use the Stripped-User-Name for the SQL lookups as well (in the radusergroup table). How should I do that? I have 3.0.11. Laszlo

2 1

Deleting attributtes for Access-Accept
by Juanjo Abenza 27 May '16

27 May '16

Hello, In my radius server (Ver. 2.2.0), i would like to delete one attributte from the access-accept if a condition is met. The condition would be: If the access-accept packet contains a "Framed-IP-Address" and a "l" attributte, DELETE the "Framed-IP-Address". I was trying to write into "Authorize" section the following statement: if (&Framed-IP_Address !* ANY) && (&Framed-Pool !* ANY) { update reply { Framed-IP-Address -= * } } But doesn´t seems to work If its neccesary i will replicate the configuration on another server for can put here the radius -X output.. Can someone help me with this code lines? Best regards, Juanjo. Sent with Stampery <https://stampery.com/gmail>

4 5

Unlang statement
by Clement Ogedengbe 27 May '16

27 May '16

Can someone please help me with unlang statement that rejects users (without bothering to carry out authentication) if the User-Name ends with "XYZ" Clement

3 2