- Freeradius-Users - lists.freeradius.org

extending mysql accounting for IPv6
by Blake Hudson 17 Feb '16

17 Feb '16

We are deploying IPv6 capable CPE devices on a Cisco ASR9k BRAS. The ASR provides the following attributes in its accounting packets: Framed-IPv6-Address and Delegated-IPv6-Prefix. These are present in the freeradius dictionary, however, the current MySQL schema has no way to store these. I'd like to extend the existing schema to handle these additional attributes. Is it as simple as modifying the existing accounting table and accounting mysql queries? Any guidance or advice would be appreciated (freeradius-2.2.6-6.el6_7.x86_64). Thanks, --Blake

2 1

FreeRADIUS 3.1 estimated release date
by Jonathan Gazeley 17 Feb '16

17 Feb '16

Is there an estimated date for the release of FreeRADIUS 3.1.x? We're interested in the new caching features. Thanks, Jonathan

4 7

3.0.11 update broke my PEAP
by Stefan Winter 17 Feb '16

17 Feb '16

Hi, this looks suspiciously like a bug to me. I updated from 3.0.10 to 3.0.11 with a perfectly working and unchanged configuration. In 3.0.11, all PEAP is broken with a slightly enigmatic error message which suggests my config may be sub-par; I can't really determine what should be wrong with it. Here's -X, the end of authorize and beginning of authenticate inside inner-tunnel: (484) sql-commonauth: User found in radcheck table (484) sql-commonauth: Conditional check items matched, merging assignment check items (484) sql-commonauth: NT-Password := 0xREALLYITISTHEPASSWORDBUTIREDACTEDIT rlm_sql (sql-commonauth): Released connection (0) (484) [sql-commonauth] = ok (484) } # redundant = ok (484) [mschap] = noop (484) pap: Normalizing NT-Password from hex encoding, 32 bytes -> 16 bytes (484) pap: WARNING: Auth-Type already set. Not setting to PAP (484) [pap] = noop (484) } # authorize = updated (484) Found Auth-Type = eap (484) # Executing group from file /usr/local/freeradius/config/raddb/sites-enabled/inner-tunnel (484) authenticate { (484) eap: Expiring EAP session with state 0x3a79dfac3a78c68e (484) eap: Finished EAP session with state 0x4db614dc4dbc0e2d (484) eap: Previous EAP request found for state 0x4db614dc4dbc0e2d, released from the list (484) eap: Peer sent packet with method EAP MSCHAPv2 (26) (484) eap: Calling submodule eap_mschapv2 to process data (484) eap_mschapv2: Auth-Type sub-section not found. Ignoring. (484) eap_mschapv2: # Executing group from file /usr/local/freeradius/config/raddb/sites-enabled/inner-tunnel (484) eap: Sending EAP Failure (code 4) ID 10 length 4 (484) eap: Freeing handler (484) [eap] = reject (484) } # authenticate = reject (484) Failed to authenticate the user (484) Using Post-Auth-Type Reject So... the inner-tunnel eap comes as far as realising it should call the eap_mschapv2 sub-module; but that one bails out claiming it can't find its own config? Well mods-enabled/eap has a mschapv2 EAP type configuration just fine: eap { default_eap_type = peap [...] peap { tls = tls-common default_eap_type = mschapv2 copy_request_to_tunnel = yes use_tunneled_reply = yes virtual_server = "inner-tunnel" } mschapv2 { } } So which sub-section would be missing here? Strange. I've rolled back with the exact same config to 3.0.10 and things started working again like a charm. Greetings, Stefan Winter -- Stefan WINTER Ingenieur de Recherche Fondation RESTENA - Réseau Téléinformatique de l'Education Nationale et de la Recherche 2, avenue de l'Université L-4365 Esch-sur-Alzette Tel: +352 424409 1 Fax: +352 422473 PGP key updated to 4096 Bit RSA - I will encrypt all mails if the recipient's key is known to me http://pgp.mit.edu:11371/pks/lookup?op=get&search=0xC0DE6A358A39DC66

3 9

Juniper ERX Dictionary and missing tagged VSAs
by Peter Lambrechtsen 17 Feb '16

17 Feb '16

Just spent the last few hours scratching my head about why something was working fine with a different Radius provider and not with FreeRadius. It seems the standard dictionary.erx doesn't include the has_tag for a number of VSAs. As per: https://www.juniper.net/techpubs/software/junos/junos114/radius-dictionary/… # please note that tunnel attributes (8, 9, 33, 35, 39 - 41) # and service attributes (65 - 69) may be tagged I'm just wondering with 3.0.x has the ERX dictionary in it, without the has_tags on VSA 8 & 9 https://github.com/FreeRADIUS/freeradius-server/blob/v3.0.x/share/dictionar… Yet the Unisphere dictionary in 3.1.x does: https://github.com/FreeRADIUS/freeradius-server/blob/v3.1.x/share/dictionar… ATTRIBUTE Unisphere-Tunnel-Virtual-Router 8 string has_tag ATTRIBUTE Unisphere-Tunnel-Password 9 string has_tag Serves me right for not going for 3.1.. :/

1 0

Fwd: Using session resumption with Wifi PEAP/MSCHAPv2
by Sylvain Munaut 17 Feb '16

17 Feb '16

Hi, I'm using FreeRadius 3.0.10 and I start with a working setup that has the tls cache disabled. Originally I was using use_tunneled_reply=yes and I would get a successfull resumption at the TLS layer : (16) eap_peap: Skipping Phase2 because of session resumption (16) eap_peap: SUCCESS but in the next AccessRequest, I'd get : (17) eap: Identity does not match User-Name. Authentication failed (17) eap: Failed in handler (17) [eap] = invalid (17) } # authenticate = invalid (17) Failed to authenticate the user and it would send a AccessReject accordingly and it would fail. Since I noticed that use_tunneled_reply is deprecated, I tried setting it to "no" and uncommented the two "updates" section in inner-tunnel server. Using this, it doesn't even attempt to do a session resumption at all. Auth works now but only because it does a full auth everytime. My configuration is pretty much the default that comes shipped with FreeRadius, I just commented out the stuff not used (like other auth modes not used in PEAP/MSCHAPv2) and did the change recommended to replace the deprecated use_tunneled_reply=yes . Cheers, Sylvain Munaut ---- This is the full log of the two last AccessRequest when using use_tunneled_reply=yes (16) Received Access-Request Id 161 from 192.168.1.4:1645 to 192.168.1.64:1812 length 270 (16) User-Name = "anonymous" (16) Framed-MTU = 1400 (16) Called-Station-Id = "7426.ac84.5240:Whatever" (16) Calling-Station-Id = "7cdd.9079.f91b" (16) Cisco-AVPair = "ssid=Whatever" (16) Service-Type = Login-User (16) Cisco-AVPair = "service-type=Login" (16) Message-Authenticator = 0x73fc123c4a4585fdc156814fce66bed0 (16) EAP-Message = 0x020300411900140301000101160301003066fd2450a9f285364308c3e54c9c5673ac7e7627ad24ff52efb282958a551f7637f5a591d37a5ff790526ae5cabf1a6b (16) NAS-Port-Type = Wireless-802.11 (16) Cisco-NAS-Port = "5714" (16) NAS-Port = 5714 (16) NAS-Port-Id = "5714" (16) State = 0x3f9102863e921be7e6003aed13497217 (16) NAS-IP-Address = 192.168.1.4 (16) session-state: No cached attributes (16) # Executing section authorize from file /etc/freeradius/sites-enabled/default (16) authorize { (16) policy filter_username { (16) if (!&User-Name) { (16) if (!&User-Name) -> FALSE (16) if (&User-Name =~ / /) { (16) if (&User-Name =~ / /) -> FALSE (16) if (&User-Name =~ /@.*@/ ) { (16) if (&User-Name =~ /@.*@/ ) -> FALSE (16) if (&User-Name =~ /\.\./ ) { (16) if (&User-Name =~ /\.\./ ) -> FALSE (16) if ((&User-Name =~ /@/) && (&User-Name !~ /(a)(.+)\.(.+)$/)) { (16) if ((&User-Name =~ /@/) && (&User-Name !~ /(a)(.+)\.(.+)$/)) -> FALSE (16) if (&User-Name =~ /\.$/) { (16) if (&User-Name =~ /\.$/) -> FALSE (16) if (&User-Name =~ /(a)\./) { (16) if (&User-Name =~ /(a)\./) -> FALSE (16) } # policy filter_username = notfound (16) [preprocess] = ok (16) [mschap] = noop (16) suffix: Checking for suffix after "@" (16) suffix: No '@' in User-Name = "anonymous", looking up realm NULL (16) suffix: No such realm "NULL" (16) [suffix] = noop (16) eap: Peer sent EAP Response (code 2) ID 3 length 65 (16) eap: Continuing tunnel setup (16) [eap] = ok (16) } # authorize = ok (16) Found Auth-Type = EAP (16) # Executing group from file /etc/freeradius/sites-enabled/default (16) authenticate { (16) eap: Expiring EAP session with state 0x3f9102863e921be7 (16) eap: Finished EAP session with state 0x3f9102863e921be7 (16) eap: Previous EAP request found for state 0x3f9102863e921be7, released from the list (16) eap: Peer sent packet with method EAP PEAP (25) (16) eap: Calling submodule eap_peap to process data (16) eap_peap: Continuing EAP-TLS (16) eap_peap: [eaptls verify] = ok (16) eap_peap: Done initial handshake (16) eap_peap: <<< TLS 1.0 ChangeCipherSpec [length 0001] (16) eap_peap: <<< TLS 1.0 Handshake [length 0010], Finished (16) eap_peap: TLS_accept: SSLv3 read finished A (16) eap_peap: (other): SSL negotiation finished successfully (16) eap_peap: SSL Connection Established (16) eap_peap: SSL Application Data (16) eap_peap: Adding cached attributes from session df917e29315e01166598f3cb2427c211832e14953e5ec48144debb103f8c1a3b (16) eap_peap: reply:User-Name = "myusername" (16) eap_peap: [eaptls process] = success (16) eap_peap: Session established. Decoding tunneled attributes (16) eap_peap: PEAP state TUNNEL ESTABLISHED (16) eap_peap: Skipping Phase2 because of session resumption (16) eap_peap: SUCCESS (16) eap: Sending EAP Request (code 1) ID 4 length 43 (16) eap: EAP session adding &reply:State = 0x3f9102863d951be7 (16) [eap] = handled (16) } # authenticate = handled (16) Using Post-Auth-Type Challenge (16) Post-Auth-Type sub-section not found. Ignoring. (16) # Executing group from file /etc/freeradius/sites-enabled/default (16) Sent Access-Challenge Id 161 from 192.168.1.64:1812 to 192.168.1.4:1645 length 0 (16) User-Name = "myusername" (16) EAP-Message = 0x0104002b19001703010020132a5838752548b20b79cdfd19856492990d8e2db97e7f38c178cf3861177ef6 (16) Message-Authenticator = 0x00000000000000000000000000000000 (16) State = 0x3f9102863d951be7e6003aed13497217 (16) Finished request Waking up in 3.2 seconds. (17) Received Access-Request Id 162 from 192.168.1.4:1645 to 192.168.1.64:1812 length 285 (17) User-Name = "myusername" (17) Framed-MTU = 1400 (17) Called-Station-Id = "7426.ac84.5240:Whatever" (17) Calling-Station-Id = "7cdd.9079.f91b" (17) Cisco-AVPair = "ssid=Whatever" (17) Service-Type = Login-User (17) Cisco-AVPair = "service-type=Login" (17) Message-Authenticator = 0x8a4fd50b06dea4edb525ac6122810d25 (17) EAP-Message = 0x02040050190017030100202fdd4dca1d915eae9fecc2d267e51466c313b8f900260490946f092d20620a3817030100204ab2fccae9b6725bbd722af7a7ecb1d9de91f87d2cafcc61956f18d3a8753c67 (17) NAS-Port-Type = Wireless-802.11 (17) Cisco-NAS-Port = "5714" (17) NAS-Port = 5714 (17) NAS-Port-Id = "5714" (17) State = 0x3f9102863d951be7e6003aed13497217 (17) NAS-IP-Address = 192.168.1.4 (17) session-state: No cached attributes (17) # Executing section authorize from file /etc/freeradius/sites-enabled/default (17) authorize { (17) policy filter_username { (17) if (!&User-Name) { (17) if (!&User-Name) -> FALSE (17) if (&User-Name =~ / /) { (17) if (&User-Name =~ / /) -> FALSE (17) if (&User-Name =~ /@.*@/ ) { (17) if (&User-Name =~ /@.*@/ ) -> FALSE (17) if (&User-Name =~ /\.\./ ) { (17) if (&User-Name =~ /\.\./ ) -> FALSE (17) if ((&User-Name =~ /@/) && (&User-Name !~ /(a)(.+)\.(.+)$/)) { (17) if ((&User-Name =~ /@/) && (&User-Name !~ /(a)(.+)\.(.+)$/)) -> FALSE (17) if (&User-Name =~ /\.$/) { (17) if (&User-Name =~ /\.$/) -> FALSE (17) if (&User-Name =~ /(a)\./) { (17) if (&User-Name =~ /(a)\./) -> FALSE (17) } # policy filter_username = notfound (17) [preprocess] = ok (17) [mschap] = noop (17) suffix: Checking for suffix after "@" (17) suffix: No '@' in User-Name = "myusername", looking up realm NULL (17) suffix: No such realm "NULL" (17) [suffix] = noop (17) eap: Peer sent EAP Response (code 2) ID 4 length 80 (17) eap: Continuing tunnel setup (17) [eap] = ok (17) } # authorize = ok (17) Found Auth-Type = EAP (17) # Executing group from file /etc/freeradius/sites-enabled/default (17) authenticate { (17) eap: Expiring EAP session with state 0x3f9102863d951be7 (17) eap: Finished EAP session with state 0x3f9102863d951be7 (17) eap: Previous EAP request found for state 0x3f9102863d951be7, released from the list (17) eap: Identity does not match User-Name. Authentication failed (17) eap: Failed in handler (17) [eap] = invalid (17) } # authenticate = invalid (17) Failed to authenticate the user (17) Using Post-Auth-Type Reject (17) # Executing group from file /etc/freeradius/sites-enabled/default (17) Post-Auth-Type REJECT { (17) sql: EXPAND .query (17) sql: --> .query (17) sql: Using query template 'query' rlm_sql (sql): Reserved connection (2) (17) sql: EXPAND %{User-Name} (17) sql: --> myusername (17) sql: SQL-User-Name set to 'myusername' (17) sql: EXPAND INSERT INTO radpostauth (username, pass, reply, authdate) VALUES('%{User-Name}', '%{%{User-Password}:-Chap-Password}', '%{reply:Packet-Type}', NOW()) (17) sql: --> INSERT INTO radpostauth (username, pass, reply, authdate) VALUES('myusername', 'Chap-Password', 'Access-Reject', NOW()) (17) sql: Executing query: INSERT INTO radpostauth (username, pass, reply, authdate) VALUES('myusername', 'Chap-Password', 'Access-Reject', NOW()) rlm_sql_postgresql: Status: PGRES_COMMAND_OK rlm_sql_postgresql: query affected rows = 1 (17) sql: SQL query returned: success (17) sql: 1 record(s) updated rlm_sql (sql): Released connection (2) (17) [sql] = ok (17) attr_filter.access_reject: EXPAND %{User-Name} (17) attr_filter.access_reject: --> myusername (17) attr_filter.access_reject: Matched entry DEFAULT at line 11 (17) [attr_filter.access_reject] = updated rlm_eap (EAP): No EAP session matching state 0x3f9102863d951be7 (17) eap: Either EAP-request timed out OR EAP-response to an unknown EAP-request (17) eap: Failed to get handler, probably already removed, not inserting EAP-Failure (17) [eap] = noop (17) policy remove_reply_message_if_eap { (17) if (&reply:EAP-Message && &reply:Reply-Message) { (17) if (&reply:EAP-Message && &reply:Reply-Message) -> FALSE (17) else { (17) [noop] = noop (17) } # else = noop (17) } # policy remove_reply_message_if_eap = noop (17) } # Post-Auth-Type REJECT = updated (17) Delaying response for 1.000000 seconds Waking up in 0.6 seconds. Waking up in 0.3 seconds. (17) Sending delayed response (17) Sent Access-Reject Id 162 from 192.168.1.64:1812 to 192.168.1.4:1645 length 20

1 0

Error building Freeradius 3.0.11 in OpenSuse 13.1
by Daniel Lopez 17 Feb '16

17 Feb '16

Hello. I'm trying to build last version of freeradius in Opensuse 13.1. After installing all needed dependences I started to build freeradius: rpmbuild -ba /usr/src/packages/SPECS/freeradius.spec But it gives to me this error message: (...) + ln -sf ../../etc/init.d/freeradius /usr/src/packages/BUILDROOT/freeradius-server-3.0.11-0.x86_64/usr/sbin/rcfreeradius + install -d /usr/src/packages/BUILDROOT/freeradius-server-3.0.11-0.x86_64/etc/tmpfiles.d + install -m 0644 /usr/src/packages/SOURCES/freeradius-server-tmpfiles.conf /usr/src/packages/BUILDROOT/freeradius-server-3.0.11-0.x86_64/etc/tmpfiles.d/radiusd.conf *install: cannot stat ‘/usr/src/packages/SOURCES/freeradius-server-tmpfiles.conf’: No such file or directory* *error: Bad exit status from /var/tmp/rpm-tmp.Rr5zIS (%install)* *RPM build errors:* * Bad exit status from /var/tmp/rpm-tmp.Rr5zIS (%install)* Could someone help me with this? Thanks

3 4

RE: sql: ERROR: rlm_sql_oracle: ORA-01403: no data found
by Vincent MARCEL 16 Feb '16

16 Feb '16

No answer anymore ? For refresh, my radius 3.0.11 server works perfectly except unjustified errors ORA-01403 each time that authorize_check_query is executed. However, query is still nicely executed, as radius server always take good decisions depending the result of the query. Regards, Vincent.

3 4

Session resumption
by Jonathan Gazeley 16 Feb '16

16 Feb '16

We've upgraded our FreeRADIUS 2.2.x servers to FreeRADIUS 3.0.11 because it was about time. Since then, we're having a subtle problem with session resumption where in some cases, FreeRADIUS returns two Access-Accept packets, each with differing VLAN information which breaks the client. The double reply only occurs when EAP sessions have been resumed, but not with every resumed session. This happens relatively infrequently so we are having to wait a long time (hours) in debug mode before we capture one of these faulty authentications to see if our latest attempt at fixing has worked. Is there are a way to fabricate EAP/MSCHAPv2 packets such that we can reliably provoke the server into using session resumption or not? This way we would be able able to test->capture->debug->fix->repeat much more quickly. I hope today to capture enough debug information to be able to submit a detailed report to this list. Thanks, Jonathan

5 9

group_attribute is never put in (Freeradius 3.0.10)
by Luescher Claude 15 Feb '16

15 Feb '16

Hello list, I have spent quite a lot of time on trying to figure out this issue. In the sql query config I have: group_attribute = "Sql-Group" # Freeradius 3.x default, this does not work either authorize_group_reply_query = "SELECT id, groupname, attribute, value, op \ FROM ${groupreply_table} \ WHERE groupname = '%{${group_attribute}}' \ ORDER BY id" Here the enumerated group never gets put in so I get: (0) sql_config: EXPAND SELECT id, groupname, attribute, value, op FROM radgroupreply WHERE groupname = '%{Sql-Group}' ORDER BY id (0) sql_config: --> SELECT id, groupname, attribute, value, op FROM radgroupreply WHERE groupname = '' ORDER BY id (0) sql_config: Executing select query: SELECT id, groupname, attribute, value, op FROM radgroupreply WHERE groupname = '' ORDER BY id If I make a query with the static variable value (the real group of the user) then it works of course. I have tried now all possible variations SQL-Group, sql-group etc. Also the: group_attribute = "Sql-Group" # Freeradius 3.x default, this does not work either should be defined in the main sql.conf which is loaded first by the server but if I put it there then my custom sql section does not see it. Why is that? Thanks

2 1

How to Setup a Coa Listener using Freeradius
by Durgesh Mishra 15 Feb '16

15 Feb '16

Hi All,I am working on a NAS where ,I am able to authenticate, authorize and accounting users from radius server using php scripts . But i am unable to find out how can i listen to radius coa and disconnect requests.Should i install a radius server on NAS or I have to read packets by using programs. Currently using FreeRADIUS Version 2.1.12Please Help ..

2 1