- Freeradius-Users - lists.freeradius.org

Framed-Ip-Address - IpPool 0.0.0.0
by Luiz Fernando Softov 07 Mar '16

07 Mar '16

Hi, I'm using FreeRadius with sql_ippool (postgresql) I am using default config. So, I make the configuration in Mikrotik to use FreeRadius. In Mikrotik i have ~1500 clients making pppoe and grabbing IP from FreeRadius. The problem is: sometimes clients get IP 0.0.0.0. I already activate debug log, but can't figure the problem. Someone know this problem and can help me? Thanks...

2 3

Trying to restrict simultaneous-use
by Michael Martinez 07 Mar '16

07 Mar '16

I'm doing some tests from localhost to restrict simultaneous-use. * I have a user defined in the users file with Simultaneous-Use := 1. * I have the following file which I feed to radclient to initiate an accounting session for this user: Packet-Type=4 Packet-Dst-Port=1813 Acct-Session-Id = "4D2BB8AC-00000098" Acct-Status-Type = Start Acct-Authentic = RADIUS User-Name = "spackle" NAS-Port = 0 Connect-Info = "CONNECT 48Mbps 802.11b" * In sites-enabled/default I have uncommented "radutmp" and "sradumtp" in accounting{} and I have uncommented radutmp in session{} (yes I know sql is faster but this is just for testing) After running radclient, I see the following with "radwho": Login Name What TTY When From Location spackle spackle shell S0 Sat 08:08 127.0.0.1 All good so far. Now i try to simulate logging in again: radtest spartan password 127.0.0.1 101 hello I am expecting this to be Rejected, but it gets Accepted instead: Received Access-Accept Id 212 from 127.0.0.1:1812 to 0.0.0.0:0 length 35 The debug file shows: (2) # Executing section session from file /usr/local/freeradius/etc/raddb/sites-enabled/default (2) session { (2) radutmp: EXPAND /usr/local/freeradius/var/log/radius/radutmp (2) radutmp: --> /usr/local/freeradius/var/log/radius/radutmp (2) radutmp: EXPAND %{User-Name} (2) radutmp: --> spackle checkrad: No NAS type, or type "other" not checking (2) [radutmp] = fail (2) } # session = fail radutmp is failing but it still sends an Access-Accept. Any thoughts? -- --- Michael Martinez http://www.michael--martinez.com

2 5

Freeradius with sql
by Mr Dini 06 Mar '16

06 Mar '16

Hello! I'm using freeradius server 3.0.11 compiled from source on a zyxel nsa320s. It is an arm5 based nas which has 2.6.31.8 kernel. It works perfectly, but I decided to use it with a mysql database. I Can't found the sql in mods-available folder, so i looked for what is wrong. I found the error. The redis package missing... So i compiled the redis and i recompiled freeradius. After it the sql module appeared and now useable. I edited the module and I tried to start it. It seems like started, but when I make a radtest in a parallel ssh window it rejects the attempt... Here is the output: http://pastebin.com/raw/pkEDuSrC And here is my module edit: http://pastebin.com/raw/nHTv8uQ2 Some technical info: - the nas ssh has chroot to /ffp - it has uClibc If you know the answer, please tell me about it! Best regards, Dan Ps: sorry for my bad English...

2 6

Freeradius 3.0.11 SQL Xlat problem
by Devrim Seral 05 Mar '16

05 Mar '16

Hello freeradius Users, I have some strange problem with SQL Xlat that i haven't find out the way to fix it. I was used freeradius 2.x before and my SQL Xlat working. But when i was switched to 3.0.11 my SQL Xlat not working anymore. As you can see following debug log has; sql: ERROR: Error marking pair for xlat sql: ERROR: Error parsing user data from database result sql: ERROR: Error retrieving reply pairs for group 15GB_Quota_2048KBurst My database contains following lines in radgroupreply table; 15GB_Quota_2048KBurst Mikrotik-Recv-Limit := `%{sql:SELECT trafsumdw('%{User-Name}',15360)}` 15GB_Quota_2048KBurst Mikrotik-Xmit-Limit := `%{sql:SELECT trafsumup('%{User-Name}',3840)}` As i understand %{sql: SQL } routines has a problem. How can i fix it.. Thanks devrim Following part have my debug output; radiusd: FreeRADIUS Version 3.0.11, for host x86_64-pc-linux-gnu, built on Feb 13 2016 at 16:58:54 (4) Received Access-Request Id 161 from 127.0.0.1:38043 to 127.0.0.1:1812 length 76 (4) User-Name = "dseral" (4) User-Password = "123" (4) NAS-IP-Address = 127.0.1.1 (4) NAS-Port = 111 (4) Message-Authenticator = 0x01a430a9fdf69589934e577266f130f2 (4) # Executing section authorize from file /etc/freeradius/sites-enabled/default (4) authorize { (4) policy filter_username { (4) if (&User-Name) { (4) if (&User-Name) -> TRUE (4) if (&User-Name) { (4) if (&User-Name =~ / /) { (4) if (&User-Name =~ / /) -> FALSE (4) if (&User-Name =~ /@[^@]*@/ ) { (4) if (&User-Name =~ /@[^@]*@/ ) -> FALSE (4) if (&User-Name =~ /\.\./ ) { (4) if (&User-Name =~ /\.\./ ) -> FALSE (4) if ((&User-Name =~ /@/) && (&User-Name !~ /(a)(.+)\.(.+)$/)) { (4) if ((&User-Name =~ /@/) && (&User-Name !~ /(a)(.+)\.(.+)$/)) -> FALSE (4) if (&User-Name =~ /\.$/) { (4) if (&User-Name =~ /\.$/) -> FALSE (4) if (&User-Name =~ /(a)\./) { (4) if (&User-Name =~ /(a)\./) -> FALSE (4) } # if (&User-Name) = notfound (4) } # policy filter_username = notfound (4) [preprocess] = ok (4) [chap] = noop (4) [mschap] = noop (4) [digest] = noop (4) suffix: Checking for suffix after "@" (4) suffix: No '@' in User-Name = "dseral", looking up realm NULL (4) suffix: No such realm "NULL" (4) [suffix] = noop (4) eap: No EAP-Message, not doing EAP (4) [eap] = noop (4) [files] = noop (4) sql: EXPAND %{User-Name} (4) sql: --> dseral (4) sql: SQL-User-Name set to 'dseral' rlm_sql (sql): You probably need to lower "min" rlm_sql_mysql: Socket destructor called, closing socket rlm_sql (sql): Closing connection (10): Hit idle_timeout, was idle for 4561 seconds rlm_sql (sql): You probably need to lower "min" rlm_sql_mysql: Socket destructor called, closing socket rlm_sql (sql): Closing connection (8): Hit idle_timeout, was idle for 4561 seconds rlm_sql (sql): You probably need to lower "min" rlm_sql_mysql: Socket destructor called, closing socket rlm_sql (sql): 0 of 0 connections in use. You may need to increase "spare" rlm_sql (sql): Opening additional connection (11), 1 of 32 pending slots used rlm_sql_mysql: Starting connect to MySQL server rlm_sql_mysql: Connected to database 'radius' on Localhost via UNIX socket, server version 5.5.47-0+deb8u1, protocol version 10 rlm_sql (sql): Reserved connection (11) (4) sql: EXPAND SELECT id, username, attribute, value, op FROM radcheck WHERE username = '%{SQL-User-Name}' ORDER BY id (4) sql: --> SELECT id, username, attribute, value, op FROM radcheck WHERE username = 'dseral' ORDER BY id (4) sql: Executing select query: SELECT id, username, attribute, value, op FROM radcheck WHERE username = 'dseral' ORDER BY id (4) sql: User found in radcheck table (4) sql: Conditional check items matched, merging assignment check items (4) sql: Cleartext-Password := "123" (4) sql: Expiration := "Feb 24 2017 00:00:00 EET" (4) sql: EXPAND SELECT id, username, attribute, value, op FROM radreply WHERE username = '%{SQL-User-Name}' ORDER BY id (4) sql: --> SELECT id, username, attribute, value, op FROM radreply WHERE username = 'dseral' ORDER BY id (4) sql: Executing select query: SELECT id, username, attribute, value, op FROM radreply WHERE username = 'dseral' ORDER BY id (4) sql: EXPAND SELECT groupname FROM radusergroup WHERE username = '%{SQL-User-Name}' ORDER BY priority (4) sql: --> SELECT groupname FROM radusergroup WHERE username = 'dseral' ORDER BY priority (4) sql: Executing select query: SELECT groupname FROM radusergroup WHERE username = 'dseral' ORDER BY priority (4) sql: User found in the group table (4) sql: EXPAND SELECT id, groupname, attribute, Value, op FROM radgroupcheck WHERE groupname = '%{SQL-Group}' ORDER BY id (4) sql: --> SELECT id, groupname, attribute, Value, op FROM radgroupcheck WHERE groupname = '15GB_Quota_2048KBurst' ORDER BY id (4) sql: Executing select query: SELECT id, groupname, attribute, Value, op FROM radgroupcheck WHERE groupname = '15GB_Quota_2048KBurst' ORDER BY id (4) sql: Group "15GB_Quota_2048KBurst": Conditional check items matched (4) sql: Group "15GB_Quota_2048KBurst": Merging assignment check items (4) sql: Simultaneous-Use := 1 (4) sql: EXPAND SELECT id, groupname, attribute, value, op FROM radgroupreply WHERE groupname = '%{SQL-Group}' ORDER BY id (4) sql: --> SELECT id, groupname, attribute, value, op FROM radgroupreply WHERE groupname = '15GB_Quota_2048KBurst' ORDER BY id (4) sql: Executing select query: SELECT id, groupname, attribute, value, op FROM radgroupreply WHERE groupname = '15GB_Quota_2048KBurst' ORDER BY id (4) sql: ERROR: Error marking pair for xlat (4) sql: ERROR: Error parsing user data from database result (4) sql: ERROR: Error retrieving reply pairs for group 15GB_Quota_2048KBurst rlm_sql (sql): Released connection (11) rlm_sql (sql): Need 2 more connections to reach 10 spares rlm_sql (sql): Opening additional connection (12), 1 of 31 pending slots used rlm_sql_mysql: Starting connect to MySQL server rlm_sql_mysql: Connected to database 'radius' on Localhost via UNIX socket, server version 5.5.47-0+deb8u1, protocol version 10 (4) [sql] = fail (4) } # authorize = fail (4) Using Post-Auth-Type Reject (4) # Executing group from file /etc/freeradius/sites-enabled/default (4) Post-Auth-Type REJECT { (4) sql: EXPAND .query (4) sql: --> .query (4) sql: Using query template 'query' rlm_sql (sql): Reserved connection (11) (4) sql: EXPAND %{User-Name} (4) sql: --> dseral (4) sql: SQL-User-Name set to 'dseral' (4) sql: EXPAND INSERT INTO radpostauth (username, pass, reply, date) VALUES ( '%{SQL-User-Name}', '%{%{User-Password}:-%{Chap-Password}}', '%{reply:Packet-Type}', '%S') (4) sql: --> INSERT INTO radpostauth (username, pass, reply, date) VALUES ( 'dseral', '123', 'Access-Reject', '2016-03-03 20:48:36') (4) sql: Executing query: INSERT INTO radpostauth (username, pass, reply, date) VALUES ( 'dseral', '123', 'Access-Reject', '2016-03-03 20:48:36') ...

3 6

segfault in master 3.0.x checking for empty realm
by Peter Lambrechtsen 04 Mar '16

04 Mar '16

Ran into an interesting issue with my realm code that should have just given me a reject rather than a segfault. In my default site I have added to the end the realm: realm "~.*$" { } So that suffix matches every realm as I don't have control over the realm names and need to perform lookups in the database on the realm. But if I then try and run suffix with an empty realm and do if check to see if it's not a particular realm I get a segfault. suffix if ( Realm == "testing" ) { reject } or if ( &Realm == "testing" ) { reject } or if ( "%{Realm}" == "testing" ) { reject } I always get the segfault. (0) Received Access-Request Id 46 from 127.0.0.1:34518 to 127.0.0.1:1812 length 256 (0) User-Password = "1234" (0) User-Name = "user" (0) # Executing section authorize from file ./sites-enabled/default ... (0) suffix: Checking for suffix after "@" (0) suffix: No '@' in User-Name = "user", looking up realm NULL (0) suffix: Found realm "~.*$" (0) suffix: Adding Stripped-User-Name = "user" (0) suffix: Adding Realm = "(null)" (0) suffix: Authentication realm is LOCAL (0) [suffix] = ok (0) if ( Realm == "testing" ) { Segmentation fault That's a bit nasty response really. Granted it's not exactly elegant that I am doing the lookup in the first place. But I didn't expect a segfault from that. I've worked around it by doing a check to make sure the realm isn't empty first. if ( !&Realm == "" ) { if ( Realm == "testing" ) { reject } } else { reject } And that drops into the else nicely (0) if ( !&Realm == "" ) { (0) if ( !&Realm == "" ) -> FALSE (0) else { (0) [reject] = reject (0) } # else = reject (0) } # authorize = reject Haven't gone looking into the code to see where the issue is yet, but I will have a look tomorrow.

2 3

moving ahead with eap-sim under 3.0.11
by Michael Martinez 04 Mar '16

04 Mar '16

I've done some research and now I understand how eap-sim works: in theory the server generates a random number (RAND) and gives this to the client. The client uses it along with some secret key Ki to generate response values RES and Kc. It gives these back to the server. If the server also knows what Ki is, then it can generate those response values itself and check to make sure they match. But in practice the only two places where Ki is known is on the SIM card and the mobile network operator. The mobile network operator will probably never give out those values (and if they did it would probably be a bureaucratic nightmare to get them). So the next best thing is the following workaround: obtain a SIM card reader and some reader software, feed some different RAND numbers to it to get the RES and Kc values and hard code these into the Radius server. The radius server will then know what the expected RES and Kc values are for said RANDs. The drawback is that it is not truly randomizing the numbers,it's picking from a small set of hardcoded values every time. But it's the only thing we can do. That's my understanding to this point; hopefully I am understanding correctly. Here's where I'm stuck. It appears there is a scarcity of SIM card readers. I found one at my local electronics store: a Sunpak 72-in-1 high speed card reader - a $10 piece of junk (i guess USB 2.0 is "high speed" to these folks) that not only fails to read any sort of card I put into it, but also rather consistently locks up both my Window 8 laptop and my Windows 7 PC. Online doesn't look any better. There's a couple cheap SIM card readers in the $5 range. Of course I have doubts about these. So my first question is: can anyone recommend a reliable, quality Sim reader? -- --- Michael Martinez http://www.michael--martinez.com

4 10

Re: RadPerf '-A delay,lifetime' arg does not copy the 'Calling-Station-Id' from Accept-Request
by Jim 03 Mar '16

03 Mar '16

Thank you very much. On 2016-03-03 15:24, freeradius-users-request(a)lists.freeradius.org wrote: > Send Freeradius-Users mailing list submissions to > freeradius-users(a)lists.freeradius.org > > To subscribe or unsubscribe via the World Wide Web, visit > http://lists.freeradius.org/mailman/listinfo/freeradius-users [1] > or, via email, send a message with subject or body 'help' to > freeradius-users-request(a)lists.freeradius.org > > You can reach the person managing the list at > freeradius-users-owner(a)lists.freeradius.org > > When replying, please edit your Subject line so it is more specific > than "Re: Contents of Freeradius-Users digest..." > > Today's Topics: > > 1. Re: RadPerf '-A delay, lifetime' arg does not copy the > 'Calling-Station-Id' from Accept-Request (Alan DeKok) > 2. linelog problem (Maja Wolniewicz) > 3. Stripping prefix with unlang (Bernd) > 4. Re: Stripping prefix with unlang (Herwin Weststrate) > 5. Re: Stripping prefix with unlang (Alan DeKok) > 6. Re: linelog problem (Alan DeKok) > > ---------------------------------------------------------------------- > > Message: 1 > Date: Thu, 3 Mar 2016 08:17:24 -0500 > From: Alan DeKok <aland(a)deployingradius.com> > To: jbaltero(a)gmail.com, FreeRadius users mailing list > <freeradius-users(a)lists.freeradius.org> > Subject: Re: RadPerf '-A delay, lifetime' arg does not copy the > 'Calling-Station-Id' from Accept-Request > Message-ID: <D0CC71E0-6386-4864-A2A4-865E115DC78A(a)deployingradius.com> > Content-Type: text/plain; charset=us-ascii > > On Mar 2, 2016, at 11:24 PM, Jim <jbalatero(a)visp.net> wrote: > >> As you can see on the Accounting-Request, there's no >> Calling-Station-Id. How do I get it to be included on the Accounting >> Packet? > > We'll see if we can get a new version of radperf out soon to fix this. > > Alan DeKok. > > ------------------------------ > > Message: 2 > Date: Thu, 3 Mar 2016 14:28:45 +0100 > From: Maja Wolniewicz <mgw(a)umk.pl> > To: FreeRadius users mailing list > <freeradius-users(a)lists.freeradius.org> > Subject: linelog problem > Message-ID: <56D83C0D.5070709(a)umk.pl> > Content-Type: text/plain; charset="utf-8"; Format="flowed" > > We are running freeradius 3.0.11 on CentOS 6.7. > Recently we experienced a few radius process hangs - it didn't handle > any request and in the log > appeared only a lot of: > > Thu Mar 3 08:48:24 2016 : Error: (187540) Ignoring duplicate packet > from client CM port 1814 - ID: 118 due to unfinished request in > component post-auth module eduroam_log > Thu Mar 3 08:48:33 2016 : Error: (187814) Ignoring duplicate packet > from client CM port 1814 - ID: 152 due to unfinished request in > component <core> module <queue> > > Our investigation showed that these problems start after requests > containing a "strange" username > Wed Mar 2 08:01:52 2016 : Auth: (127068) Login incorrect: [юз] (from > client AP-UMK port 20526 cli 88-A7-3C-DB-35-02) > Thu Mar 3 08:48:14 2016 : Auth: (187534) Login incorrect: [በᑱ] (from > client AP-SPEC port 36865 cli 24-0A-64-1F-C1-D3) > Thu Mar 3 09:38:19 2016 : Auth: (53871) Login incorrect: [юз] (from > client AP-UMK port 20613 cli 88-A7-3C-DB-35-02) > > It turned out that it is caused by linelog module. After we removed > %{User-Name} from this line > > Access-Reject = "%S > eduroam-auth#ORG=%{request:Realm}#USER=%{User-Name}#CSI=%{%{Calling-Station-Id}:-Unknown > Caller Id}#NAS=%{%{request:NAS-IP-Address}:-No NAS > IP}#CUI=%{%{reply:Chargeable-User-Identity}:-Unknown}#MSG=%{%{reply:Reply-Message}:-No > Failure Reason}#RESULT=FAIL#" > > the problem disappeared and strange usernames are handled smoothly. > > It looks like a linelog bug. > > Maja > > -- > Maja Gorecka-Wolniewicz mgw(a)umk.pl > Uczelniane Centrum Information & Communication > Informatyczne Technology Centre > Uniwersytet Mikolaja Kopernika Nicolaus Copernicus University > Coll. Maximum, pl. Rapackiego 1, 87-100 Torun, Poland > tel.: +48 56-611-27-40 fax: +48 56-622-18-50 tel. kom.: +48-693032574 > >

1 0

linelog problem
by Maja Wolniewicz 03 Mar '16

03 Mar '16

We are running freeradius 3.0.11 on CentOS 6.7. Recently we experienced a few radius process hangs - it didn't handle any request and in the log appeared only a lot of: Thu Mar 3 08:48:24 2016 : Error: (187540) Ignoring duplicate packet from client CM port 1814 - ID: 118 due to unfinished request in component post-auth module eduroam_log Thu Mar 3 08:48:33 2016 : Error: (187814) Ignoring duplicate packet from client CM port 1814 - ID: 152 due to unfinished request in component <core> module <queue> Our investigation showed that these problems start after requests containing a "strange" username Wed Mar 2 08:01:52 2016 : Auth: (127068) Login incorrect: [юз] (from client AP-UMK port 20526 cli 88-A7-3C-DB-35-02) Thu Mar 3 08:48:14 2016 : Auth: (187534) Login incorrect: [በᑱ] (from client AP-SPEC port 36865 cli 24-0A-64-1F-C1-D3) Thu Mar 3 09:38:19 2016 : Auth: (53871) Login incorrect: [юз] (from client AP-UMK port 20613 cli 88-A7-3C-DB-35-02) It turned out that it is caused by linelog module. After we removed %{User-Name} from this line Access-Reject = "%S eduroam-auth#ORG=%{request:Realm}#USER=%{User-Name}#CSI=%{%{Calling-Station-Id}:-Unknown Caller Id}#NAS=%{%{request:NAS-IP-Address}:-No NAS IP}#CUI=%{%{reply:Chargeable-User-Identity}:-Unknown}#MSG=%{%{reply:Reply-Message}:-No Failure Reason}#RESULT=FAIL#" the problem disappeared and strange usernames are handled smoothly. It looks like a linelog bug. Maja -- Maja Gorecka-Wolniewicz mgw(a)umk.pl Uczelniane Centrum Information & Communication Informatyczne Technology Centre Uniwersytet Mikolaja Kopernika Nicolaus Copernicus University Coll. Maximum, pl. Rapackiego 1, 87-100 Torun, Poland tel.: +48 56-611-27-40 fax: +48 56-622-18-50 tel. kom.: +48-693032574

2 1

RadPerf '-A delay,lifetime' arg does not copy the 'Calling-Station-Id' from Accept-Request
by Jim 03 Mar '16

03 Mar '16

This is my Access-Request packet: Calling-Station-Id = 'DD:F2:42:8A:DF:6D' Mikrotik-Realm = 'betacleversoft.net' User-Name = 'nflamel' User-Password = 'weWE122123' NAS-Port = 0 And the Accounting-Request: User-Name = 'nflamel' NAS-Port = 0 Acct-Status-Type := Start Acct-Session-Id := '0000e88b968f' Acct-Input-Octets := 0 Acct-Output-Octets := 0 FreeRADIUS-Acct-Session-Start-Time = 'Mar 3 2016 04:22:04 UTC' As you can see on the Accounting-Request, there's no Calling-Station-Id. How do I get it to be included on the Accounting Packet? Thanks.

3 3

Unmetered content
by Joshua Cameron 02 Mar '16

02 Mar '16

I'm trying to allow unmetered content over my network. Just shy of 1000 users. I'm looking to use freeradius for this, and want to know if/how it's possible. I don't think it's possible/under the purview of freeradius itself to distinguish between metered and unmetered traffic, I can have it done by another device and just come in on different physical ports on the machine. My first thoughts are having freeradius virtual servers defined. I can have the unmetered and metered traffic come in on different physical ports with separate IPs. The first port takes the metered content and authentication to one virtual server. The second port takes the unmetered content, with authentication proxied to the other virtual server. Then I'd measure data usage for both metered/unmetered networks by looking into each of the accounting tables for the virtual servers. Is this how it would work? How else could it be done? Are there any how-tos? Joshua C

2 5