- Freeradius-Users - lists.freeradius.org

Accounting errors.
by Andrés Gómez 22 Jan '16

22 Jan '16

Dear List. I have a Freeradius 2 installed, using a MySQL database to store all accounting data. Usually It works fine, but now I can see that the count of AcctSessionTime is being wrong calculated in SOME cases, not all caases. Check it out these records. "AcctStartTime";"AcctStopTime";"AcctSessionTime" "2016-01-20 18:08:54";"2016-01-20 18:22:10";"337444" "2016-01-20 18:13:26";"2016-01-20 18:22:25";"337172" ""2016-01-20 18:15:24";"2016-01-20 18:22:10";"337054" "2016-01-20 18:15:44";"2016-01-20 18:22:10";"337034" "2016-01-20 18:16:00";"2016-01-20 18:22:10";"337018" "2016-01-20 18:16:34";"2016-01-20 18:22:10";"336984" As you can see each session takes less to 15 minutes (900 seconds) But its calculated about 93 hours (224800 second). What Can I do? My statistics are being damaged!! Regards -- *C. Andrés Gómez R.*

2 2

Local user or DB?
by Tevfik Ceydeliler 22 Jan '16

22 Jan '16

Hi, I want to use both local files and mySQL DB to authenticate my user. But How can I tell to freeradius which user is located where local files or DB. Is there any way to do this? Realm can use for this aim? Have you any hint? Regards.. Bu elektronik postada bulunan tum fikir ve gorusler ve ekindeki dosyalar sadece adres sahip/sahiplerine ait olup, Yasar Toplulugu Sirketleri bu mesajin icerigi ile ilgili olarak hic bir hukuksal sorumlulugu kabul etmez. Eger gonderilmesi dusunulen kisi veya kurulus degilseniz, lutfen gonderen kisiyi derhal haberdar ediniz ve mesaji sisteminizden siliniz. The information contained in this e-mail and any files transmitted with it are intended solely for the use of the individual or entity to whom they are addressed and Yasar Group Companies do not accept legal responsibility for the contents. If you are not the intended recipient, please immediately notify the sender and delete it from your system.

1 0

Virtual server Depending on a radius server
by Andrés Gómez 21 Jan '16

21 Jan '16

Dear List, I'm reading the documentation about virtual server ( http://freeradius.org/features/virtual_servers.html) and the methods to configure them (server and client ip address, home server pool and TLS tunnel), but I don't undestand what method can be useful in this case: - My clients have dymanic Ip address. - My server only have one public IP address. - I can't do TLS tunnels with my client's NAS. I can distinguish my clients by: - NAS ID - NAS MAC address - Radius secret. I think the best way, would be to use the NAS secret to determine the virtual server. It is possible? What do you advice? Regards -- *C. Andrés Gómez R.*

2 2

Accept via calling-station value
by Munroe Sollog 20 Jan '16

20 Jan '16

I have an aruba wireless network where I am trying to get free-radius to auth a device based on calling-station id. Line 35 confirms my re-writing is working, but line 46 looks like it is rejecting the match even though it is listed in the authorized_macs file. Any help would be appreciated. Thanks. Here is my config: sites-enabled/default: http://paste.debian.net/hidden/059033f6/ policy.d/macauth: http://paste.debian.net/hidden/cefd55aa/ authorized_macs: http://paste.debian.net/hidden/992be562/ radius -X output: http://paste.debian.net/hidden/8492e2fd/ -- Munroe Sollog LTS - Network Analyst x85002

3 4

Re: freeradius 3.0.4 can't contact LDAP server
by Blangille Denis 20 Jan '16

20 Jan '16

> Michael Ströder wrote: >> Are you using LDAPS or LDAP with StartTLS? If yes, is the CA cert for validating >> the LDAP server cert properly configured? > Actually i'm work with ldap, i'm not working on security part, the ldaps server is not running. Anirudh Malhotra wrote : > Can you paste the ldap config? I'm using ApacheDS as ldap server, its config is divided in several file. Denis Blangille

2 1

EAP-TLS CRL problem - a PKIX guru around?
by tsouk 20 Jan '16

20 Jan '16

Hi Stefan, Had some CRL problems back in the day, with Apache 2.2 and Apache 2.4 behaving differently (I believe the change is in Apache 2.3, and I will have a whole blog post about this in the BBC internet blog soon). Have a look at the RFC (), under "6.3.3. CRL Processing", specifically: (b) Verify the issuer and scope of the complete CRL as follows: ... (2) If the complete CRL includes an issuing distribution point (IDP) CRL extension, check the following: (i) If the distribution point name is present in the IDP CRL extension and the distribution field is present in the DP, then verify that one of the names in the IDP matches one of the names in the DP. If the distribution point name is present in the IDP CRL extension and the distribution field is omitted from the DP, then verify that one of the names in the IDP matches one of the names in the cRLIssuer field of the DP. So I think this, in your CRL: X509v3 Issuing Distrubution Point: Full Name: URI:https://www.restena.lu/restena-staffauth.crl ...and this in your Cert... X509v3 CRL Distribution Points: Full Name: URI:https://www.restena.lu/ca/restena-root.crl ...might have to match. Let me know if this helps! Nikos

1 0

Re: EAP-TLS CRL problem - a PKIX guru around?
by tsouk 20 Jan '16

20 Jan '16

Hi Stefan, Had some CRL problems back in the day, with Apache 2.2 and Apache 2.4 behaving differently (I believe the change is in Apache 2.3, and I will have a whole blog post about this in the BBC internet blog soon). Have a look at the RFC (), under "6.3.3. CRL Processing", specifically: (b) Verify the issuer and scope of the complete CRL as follows: ... (2) If the complete CRL includes an issuing distribution point (IDP) CRL extension, check the following: (i) If the distribution point name is present in the IDP CRL extension and the distribution field is present in the DP, then verify that one of the names in the IDP matches one of the names in the DP. If the distribution point name is present in the IDP CRL extension and the distribution field is omitted from the DP, then verify that one of the names in the IDP matches one of the names in the cRLIssuer field of the DP. So I think this, in your CRL: X509v3 Issuing Distrubution Point: Full Name: URI:https://www.restena.lu/restena-staffauth.crl ...and this in your Cert... X509v3 CRL Distribution Points: Full Name: URI:https://www.restena.lu/ca/restena-root.crl ...might have to match. Let me know if this helps! Nikos

1 0

Strangeness in work 'radgroup_check_query' through 'rlm_sql_unixodbc'
by vanish 20 Jan '16

20 Jan '16

Hello, need help. 1. i have a test-machine with Ubuntu 14.04, Freeradius-server v2.1.12 and Informix Database Server v 10.00. 2. i use rlm_sql_unixodbc to connect Informix server. 3. When freeradius sends next simple request in Informix: group_membership_query = "select 'simult' groupname from TABLE(SET {1})" gets the answer: - rlm_sql_unixodbc: 07009 [unixODBC][Informix][Informix ODBC Driver]Invalid descriptor index. This request works in isql: SQL> select 'simult' groupname from TABLE(SET {1}); +----------+ | groupname| +----------+ | simul | +----------+ 4. Here the debug with '-X' option: Ready to process requests. rad_recv: Access-Request packet from host 10.10.10.10 port 47385, id=240, length=58 User-Name = "test" CHAP-Password = 0xf05090f9d0fd90909fdfdg112 Framed-Protocol = PPP # Executing section authorize from file /etc/freeradius/sites-enabled/default +- entering group authorize {...} ++[preprocess] returns ok ++? if (Framed-Protocol == PPP) ? Evaluating (Framed-Protocol == PPP) -> TRUE ++? if (Framed-Protocol == PPP) -> TRUE ++- entering if (Framed-Protocol == PPP) {...} [chap] Setting 'Auth-Type := CHAP' +++[chap] returns ok ++- if (Framed-Protocol == PPP) returns ok ++[mschap] returns noop [sql] expand: %{User-Name} -> test [sql] sql_set_user escaped user --> 'test' rlm_sql (sql): Reserving sql socket id: 3 [sql] expand: SELECT first 1 1 id, '%{SQL-User-Name}' username, 'Password' attribute, trim(p.password) value, '==' op FROM acc a inner join details p on a.acc_id = p.acc_id WHERE username = '%{SQL-User-Name}' -> SELECT first 1 1 id, 'test' username, 'Password' attribute, trim(p.password) value, '==' op FROM acc a inner join details p on a.acc_id = p.acc_id WHERE username = 'test' WARNING: Found User-Password == "...". WARNING: Are you sure you don't mean Cleartext-Password? WARNING: See "man rlm_pap" for more information. [sql] User found in radcheck table [sql] expand: select 1 id, a.control username, 'Cisco-Account-Info' attribute, r.value value, '=' op from acc a inner join acc_b b on a.acc_id = b.acc_id inner join tq_p tp on tp.id = a.tq_p_id ............... and so on............... [sql] expand: select 'simult' groupname from TABLE(SET {1}) -> select 'simult' groupname from TABLE(SET {1}) rlm_sql_unixodbc: 07009 [unixODBC][Informix][Informix ODBC Driver]Invalid descriptor index. <---- Problem !!!! rlm_sql (sql): Released sql socket id: 3 ............... and so on............... 5. Others sql queries from dialup.conf such as: - nas_query - authorize_check_query - authorize_reply_query works well. 6. Is this bug only for group_membership_query? Does anyone experienced this ? -- ============================================ С уважением, Богучарский Иван Владимирович. Начальник СУТС ОРЭТС и ШПД ЗАО "Коламбия-Телеком". тел. 8-937-084-25-89.

2 6

Re: freeradius 3.0.4 can't contact LDAP server
by Blangille Denis 19 Jan '16

19 Jan '16

Michael Ströder wrote: > Are you using LDAPS or LDAP with StartTLS? If yes, is the CA cert for validating > the LDAP server cert properly configured? Actually i'm work with ldap, i'm not working on security part, the ldaps server is not running. Denis Blangille

2 1

rlm_ldap (ldap): 0 of 3 connections in use
by Marko Mernik 19 Jan '16

19 Jan '16

Hi! My server logs some strange things. What could be the problem? The radius server is working Ok Tue Jan 19 11:50:16 2016 : Warning: rlm_ldap (ldap): You probably need to lower "min" Tue Jan 19 11:50:18 2016 : Info: rlm_ldap (ldap): 0 of 3 connections in use. Need more spares Tue Jan 19 11:50:18 2016 : Info: rlm_ldap (ldap): Opening additional connection (83) Tue Jan 19 11:50:20 2016 : Info: rlm_ldap (ldap): 0 of 4 connections in use. Need more spares Tue Jan 19 11:50:20 2016 : Info: rlm_ldap (ldap): Opening additional connection (84) Tue Jan 19 11:50:20 2016 : Warning: rlm_ldap (ldap): You probably need to lower "min" Tue Jan 19 11:50:29 2016 : Info: rlm_ldap (ldap): 0 of 4 connections in use. Need more spares Tue Jan 19 11:50:29 2016 : Info: rlm_ldap (ldap): Opening additional connection (85) Tue Jan 19 11:50:29 2016 : Warning: rlm_ldap (ldap): You probably need to lower "min" Tue Jan 19 11:50:31 2016 : Info: rlm_ldap (ldap): 0 of 4 connections in use. Need more spares Tue Jan 19 11:50:31 2016 : Info: rlm_ldap (ldap): Opening additional connection (86) Tue Jan 19 11:50:42 2016 : Warning: rlm_ldap (ldap): You probably need to lower "min" Tue Jan 19 11:50:44 2016 : Info: rlm_ldap (ldap): 0 of 4 connections in use. Need more spares Tue Jan 19 11:50:44 2016 : Info: rlm_ldap (ldap): Opening additional connection (87) Tue Jan 19 11:51:26 2016 : Warning: rlm_ldap (ldap): You probably need to lower "min" Tue Jan 19 11:51:34 2016 : Info: rlm_ldap (ldap): 0 of 4 connections in use. Need more spares Tue Jan 19 11:51:34 2016 : Info: rlm_ldap (ldap): Opening additional connection (88) My config file: ldap { server = "172.17.0.232 172.17.0.27" identity = "cn=Manager,dc=example,dc=local" password = xxxxxxxxxxx base_dn = "dc=example,dc=local" valuepair_attribute = "radiusAttribute" update { control:Password-With-Header += 'userPassword' } user { base_dn = "${..base_dn}" filter = "(uid=%{%{Stripped-User-Name}:-%{User-Name}})" } group { base_dn = "${..base_dn}" filter = "(objectClass=posixGroup)" membership_attribute = "memberOf" } profile { } client { base_dn = "${..base_dn}" filter = '(objectClass=frClient)' attribute { identifier = 'radiusClientIdentifier' secret = 'radiusClientSecret' } } accounting { reference = "%{tolower:type.%{Acct-Status-Type}}" type { start { update { description := "Online at %S" } } interim-update { update { description := "Last seen at %S" } } stop { update { description := "Offline at %S" } } } } post-auth { update { description := "Authenticated at %S" } } options { chase_referrals = yes rebind = yes timeout = 4 timelimit = 3 net_timeout = 1 idle = 60 probes = 3 interval = 3 ldap_debug = 0x0028 } tls { } pool { start = 15 min = 5 max = ${thread[pool].max_servers} spare = 10 uses = 10 lifetime = 120 idle_timeout = 120 } } Thank you for response.

2 2