- Freeradius-Users - lists.freeradius.org

Disabling log entries for rejected users
by Michał B 15 Jan '16

15 Jan '16

Hi guys, I use freeradius for authenticating DHCP/PPPoE clients connected to Mikrotik routers. Freeradius uses users files, not SQL database. If I disable some user in my management software, the "Accept" entry in proper "users" file is not generated. The access request for such user is logged: Jan 13 09:22:13 radsrv freeradius[2152]: Login incorrect (rlm_chap: Clear text password not available): [blockeduser/<CHAP-Password>] (from client mikrotik-main port 0 cli 194.182.13.200) After adding rejects for blocked users, for example: blockeduser Auth-Type := Reject The message still appears in the log file: Jan 13 09:26:14 radsrv freeradius[2152]: Login incorrect: [blockeduser/<CHAP-Password>] (from client mikrotik-main port 0 cli 194.182.13.200) How can I disable log etries for blocked/rejected users? Regards!

5 8

Accounting with external script
by mclaut＠mclaut.com 15 Jan '16

15 Jan '16

Hi ! Sorry, but I can not find the answer to the question - what the external (for example php script) should return to the radius server at accounting? What attributes? I'm use - FreeRADIUS Version 2.2.6, for host x86_64-redhat-linux-gnu, built on Sep 22 2015 at 15:27:25 In Radius log: Fri Jan 15 20:59:12 2016 : Info: Ready to process requests. rad_recv: Accounting-Request packet from host 1.1.4.4 port 62311, id=8, length=32 Acct-Status-Type = Start Acct-Session-Id = "8768" Fri Jan 15 20:59:54 2016 : Info: # Executing section preacct from file /etc/raddb/sites-enabled/mclaut_default_exec Fri Jan 15 20:59:54 2016 : Info: +group preacct { Fri Jan 15 20:59:54 2016 : Info: ++[preprocess] = ok Fri Jan 15 20:59:54 2016 : Info: [bill_acc] expand: %{hex:Attribute} -> Fri Jan 15 20:59:54 2016 : Info: [bill_acc] expand: %{Acct-Session-Id} -> 8768 Fri Jan 15 20:59:54 2016 : Info: [bill_acc] expand: %{Acct-Authentic} -> Fri Jan 15 20:59:54 2016 : Info: [bill_acc] expand: %{Acct-Status-Type} -> Start Fri Jan 15 20:59:54 2016 : Info: [bill_acc] expand: %{NAS-IP-Address} -> 1.1.4.4 Fri Jan 15 20:59:54 2016 : Info: [bill_acc] expand: %{User-Name} -> Fri Jan 15 20:59:54 2016 : Info: [bill_acc] expand: %{NAS-Port} -> Fri Jan 15 20:59:54 2016 : Info: [bill_acc] expand: %{Framed-Protocol} -> Fri Jan 15 20:59:54 2016 : Info: [bill_acc] expand: %{Framed-IP-Address} -> Fri Jan 15 20:59:54 2016 : Info: [bill_acc] expand: %S -> 2016-01-15 20:59:54 Fri Jan 15 20:59:54 2016 : Debug: Exec output: Fri Jan 15 20:59:54 2016 : Info: [bill_acc] Exec: program returned: 0 Fri Jan 15 20:59:54 2016 : Info: ++[bill_acc] = ok Fri Jan 15 20:59:54 2016 : Info: +} # group preacct = ok Fri Jan 15 20:59:54 2016 : Info: WARNING: Empty accounting section. Using default return values. Fri Jan 15 20:59:54 2016 : Info: Finished request 5. Fri Jan 15 20:59:54 2016 : Info: Cleaning up request 5 ID 8 with timestamp +125 Fri Jan 15 20:59:54 2016 : Debug: Going to the next request Fri Jan 15 20:59:54 2016 : Info: Ready to process requests. I do not understand - WARNING: Empty accounting section. Using default return values. But, answer from script: Fri Jan 15 20:59:54 2016 : Debug: Exec output: Fri Jan 15 20:59:54 2016 : Info: [bill_acc] Exec: program returned: 0 Fri Jan 15 20:59:54 2016 : Info: ++[bill_acc] = ok Fri Jan 15 20:59:54 2016 : Info: +} # group preacct = ok And NAS don't recieve any answers from Radius Server.... Tell me please, what am I doing wrong? Thank you in advance

2 1

MAC expiry
by Max .M 15 Jan '16

15 Jan '16

Hi all, I currently have MAC authentication with Freeradius and MAC stored into Mysql db. It works well :) Is it possible to enable MAC auth expiry ? E.G : A user can authenticate using MAC auth for 1 week but must auth again at day 8. Thanks !

2 4

Elasticsearch config update for detail files
by Matthew Newton 15 Jan '16

15 Jan '16

Hi, I've just done a pull request to update the elasticsearch config for FreeRADIUS. There are much more complete examples for the whole stack now, which should make it quite easy for anyone else to feed RADIUS detail files into elasticsearch for querying. As an overview - - The elasticsearch mapping (i.e. database field formats) has been updated so that common numeric fields such as Acct-Input-Octets are stored as "long" instead of "string". - All other fields are automatically set to "string". The mapping should automatically cope with any RADIUS attributes thrown at it, though some manual tweaking may be required to add additional number types (if they are used as numbers, rather than just identifiers). - The logstash configuration will automatically pull out MAC addresses, IP addresses, SSIDs etc from common attributes such as Calling-Station-Id or Framed-IP-Address and store them as sub-fields. Therefore the stored data includes e.g. Called-Station-Id.ssid to directly get the wireless SSID value. - It also merges Acct-Input/Output-Octets and Acct-Input-Gigawords to become the 64-bit value Acct-Input-Octets.long, removing the need to join these elsewhere and making e.g. plots of data transferred by user much easier. - There is an example log-courier configuration file, which is better than using the mulitline filter in logstash (using this disables threaded filters, which can slow processing down with lots of logs). In addition, example dashboards for both Kibana 3 and Kibana 4 and instructions on importing them. Putting all these together should make it really easy for anyone to feed their RADIUS detail files into elasticsearch for querying, analyzing and reporting. Happy to hear from anyone who tries using this - successful or otherwise. We've found it incredibly useful for all sorts of logs. Thanks, Matthew -- Matthew Newton, Ph.D. <mcn4(a)le.ac.uk> Systems Specialist, Infrastructure Services, I.T. Services, University of Leicester, Leicester LE1 7RH, United Kingdom For IT help contact helpdesk extn. 2253, <ithelp(a)le.ac.uk>

2 1

eap_ttls not setting 'FreeRADIUS-Proxied-To'
by David Lord 14 Jan '16

14 Jan '16

Hi all, I’m porting our config from v2.2.9 to v3.0.11. The problem I’m experiencing is that the eap_peap submodule does set FreeRADIUS-Proxied-To, but eap_ttls does not. In v2, both submodules did. Unfortunately I’m currently relying on this attribute for tunnelling in one server. Time is limited so I’m sticking with the previous architecture, which looks like this (trimmed down): authorize { split_user_realm choose_eduroam_proxy # reject invalid realm, set Proxy-To-Realm to national federation or do nothing so it goes internally eap_eduroam if (“%{%{FreeRADIUS-Proxied-To}:-}” == 127.0.0.1) { # inner tunnel: ensure user exists in LDAP and is permitted access user_search # includes ldap_central and sets auth-type if appropriate } } authenticate { Auth-Type PAP { pap } Auth-Type MS-CHAP { mschap } Auth-Type ldap_central { ldap_central } eap_eduroam } The result is that PEAP and various non-tunnelled EAPs authenticate correctly, but TTLS never enters the if-block and so no Auth-Type is ever set. Has this behaviour been intentionally changed? There’s no mention of it in https://github.com/FreeRADIUS/freeradius-server/blob/v3.0.x/doc/ChangeLog. If my need isn’t utterly terrible, would it be possible to re-add FreeRADIUS-Proxied-To to eap_ttls? Cheers, David Lord

7 20

Questions about RadPerf-u14.04
by Jim 14 Jan '16

14 Jan '16

I'm using RadPerf-u14.04 on Ubuntu 14.04 machine. Why is it that I cannot use -n together with -p? Does the "Packets/s" means Requests/seconds? If so, why is it that when I set -n to 50, the packet/sec is always less than 5, it only goes higher after using -p. Thanks, Jim Well Balatero, Cleversoft, Inc.

1 0

Set Bandwidth attributes from users file
by Andrés Gómez 14 Jan '16

14 Jan '16

Hi everybody!! Usually I set bandwidth limits using attributes set in radreply table of a MySQL database. It works great. but now I need to set bandwidth limits to some user that are set in the Users file like this: user1 Cleartext-Password := "passw1" Reply-Message = "Your bandwidth is 1MBps." user2 Cleartext-Password := "passw2" Reply-Message = "Your bandwidth is 2MBps." ... Using Freeradius 2. I have tried with some attributes, and I have searched information but I couldn't get it. It is possible? Regards -- *C. Andrés Gómez R.*

1 1

linelog to two destinations
by Jonathan Gazeley 13 Jan '16

13 Jan '16

Hi folks, I think I know the answer to this ("no") but I thought I'd ask anyway. Is it possible to configure a linelog instantiation to log to syslog AND a file at the same time? If not, I guess my options are two load two different linelog instantiations with different values for "filename", or to send it all to syslog and let syslog try and work out what the virtual-server-specific filenames should be. Thanks, Jonathan

3 4

User to MAC Address binding
by Mayuresh Bhagwat 13 Jan '16

13 Jan '16

Is it possible to bind username/password with device MAC address using Freeradius. I am using a SQL databse for managing the user list, can someone help with the steps to bind each user to a specific device with this setup? -- B. Mayuresh

2 2

clients in SQL DB
by Cornelius Kölbel 13 Jan '16

13 Jan '16

Hello, I was looking into using MySQL with FreeRADIUS and took a look at http://wiki.freeradius.org/guide/SQL%20HOWTO I was wondering, if it is possible to also put the clients with the RADIUS secrets to the SQL database? From what I was reading I understand: No? Thanks a lot and kind regards Cornelius -- Cornelius Kölbel cornelius.koelbel(a)netknights.it +49 151 2960 1417 NetKnights GmbH http://www.netknights.it Landgraf-Karl-Str. 19, 34131 Kassel, Germany Tel: +49 561 3166797, Fax: +49 561 3166798 Amtsgericht Kassel, HRB 16405 Geschäftsführer: Cornelius Kölbel

3 3