- Freeradius-Users - lists.freeradius.org

Elasticsearch config update for detail files
by Matthew Newton 15 Jan '16

15 Jan '16

Hi, I've just done a pull request to update the elasticsearch config for FreeRADIUS. There are much more complete examples for the whole stack now, which should make it quite easy for anyone else to feed RADIUS detail files into elasticsearch for querying. As an overview - - The elasticsearch mapping (i.e. database field formats) has been updated so that common numeric fields such as Acct-Input-Octets are stored as "long" instead of "string". - All other fields are automatically set to "string". The mapping should automatically cope with any RADIUS attributes thrown at it, though some manual tweaking may be required to add additional number types (if they are used as numbers, rather than just identifiers). - The logstash configuration will automatically pull out MAC addresses, IP addresses, SSIDs etc from common attributes such as Calling-Station-Id or Framed-IP-Address and store them as sub-fields. Therefore the stored data includes e.g. Called-Station-Id.ssid to directly get the wireless SSID value. - It also merges Acct-Input/Output-Octets and Acct-Input-Gigawords to become the 64-bit value Acct-Input-Octets.long, removing the need to join these elsewhere and making e.g. plots of data transferred by user much easier. - There is an example log-courier configuration file, which is better than using the mulitline filter in logstash (using this disables threaded filters, which can slow processing down with lots of logs). In addition, example dashboards for both Kibana 3 and Kibana 4 and instructions on importing them. Putting all these together should make it really easy for anyone to feed their RADIUS detail files into elasticsearch for querying, analyzing and reporting. Happy to hear from anyone who tries using this - successful or otherwise. We've found it incredibly useful for all sorts of logs. Thanks, Matthew -- Matthew Newton, Ph.D. <mcn4(a)le.ac.uk> Systems Specialist, Infrastructure Services, I.T. Services, University of Leicester, Leicester LE1 7RH, United Kingdom For IT help contact helpdesk extn. 2253, <ithelp(a)le.ac.uk>

2 1

eap_ttls not setting 'FreeRADIUS-Proxied-To'
by David Lord 14 Jan '16

14 Jan '16

Hi all, I’m porting our config from v2.2.9 to v3.0.11. The problem I’m experiencing is that the eap_peap submodule does set FreeRADIUS-Proxied-To, but eap_ttls does not. In v2, both submodules did. Unfortunately I’m currently relying on this attribute for tunnelling in one server. Time is limited so I’m sticking with the previous architecture, which looks like this (trimmed down): authorize { split_user_realm choose_eduroam_proxy # reject invalid realm, set Proxy-To-Realm to national federation or do nothing so it goes internally eap_eduroam if (“%{%{FreeRADIUS-Proxied-To}:-}” == 127.0.0.1) { # inner tunnel: ensure user exists in LDAP and is permitted access user_search # includes ldap_central and sets auth-type if appropriate } } authenticate { Auth-Type PAP { pap } Auth-Type MS-CHAP { mschap } Auth-Type ldap_central { ldap_central } eap_eduroam } The result is that PEAP and various non-tunnelled EAPs authenticate correctly, but TTLS never enters the if-block and so no Auth-Type is ever set. Has this behaviour been intentionally changed? There’s no mention of it in https://github.com/FreeRADIUS/freeradius-server/blob/v3.0.x/doc/ChangeLog. If my need isn’t utterly terrible, would it be possible to re-add FreeRADIUS-Proxied-To to eap_ttls? Cheers, David Lord

7 20

Questions about RadPerf-u14.04
by Jim 14 Jan '16

14 Jan '16

I'm using RadPerf-u14.04 on Ubuntu 14.04 machine. Why is it that I cannot use -n together with -p? Does the "Packets/s" means Requests/seconds? If so, why is it that when I set -n to 50, the packet/sec is always less than 5, it only goes higher after using -p. Thanks, Jim Well Balatero, Cleversoft, Inc.

1 0

Set Bandwidth attributes from users file
by Andrés Gómez 14 Jan '16

14 Jan '16

Hi everybody!! Usually I set bandwidth limits using attributes set in radreply table of a MySQL database. It works great. but now I need to set bandwidth limits to some user that are set in the Users file like this: user1 Cleartext-Password := "passw1" Reply-Message = "Your bandwidth is 1MBps." user2 Cleartext-Password := "passw2" Reply-Message = "Your bandwidth is 2MBps." ... Using Freeradius 2. I have tried with some attributes, and I have searched information but I couldn't get it. It is possible? Regards -- *C. Andrés Gómez R.*

1 1

linelog to two destinations
by Jonathan Gazeley 13 Jan '16

13 Jan '16

Hi folks, I think I know the answer to this ("no") but I thought I'd ask anyway. Is it possible to configure a linelog instantiation to log to syslog AND a file at the same time? If not, I guess my options are two load two different linelog instantiations with different values for "filename", or to send it all to syslog and let syslog try and work out what the virtual-server-specific filenames should be. Thanks, Jonathan

3 4

User to MAC Address binding
by Mayuresh Bhagwat 13 Jan '16

13 Jan '16

Is it possible to bind username/password with device MAC address using Freeradius. I am using a SQL databse for managing the user list, can someone help with the steps to bind each user to a specific device with this setup? -- B. Mayuresh

2 2

clients in SQL DB
by Cornelius Kölbel 13 Jan '16

13 Jan '16

Hello, I was looking into using MySQL with FreeRADIUS and took a look at http://wiki.freeradius.org/guide/SQL%20HOWTO I was wondering, if it is possible to also put the clients with the RADIUS secrets to the SQL database? From what I was reading I understand: No? Thanks a lot and kind regards Cornelius -- Cornelius Kölbel cornelius.koelbel(a)netknights.it +49 151 2960 1417 NetKnights GmbH http://www.netknights.it Landgraf-Karl-Str. 19, 34131 Kassel, Germany Tel: +49 561 3166797, Fax: +49 561 3166798 Amtsgericht Kassel, HRB 16405 Geschäftsführer: Cornelius Kölbel

3 3

Plain Mac-Auth - server accepts but client does not connect
by Michael Linder 12 Jan '16

12 Jan '16

Hello everyone, I am following the instructions on the wiki (http://wiki.freeradius.org/guide/Mac%20Auth) to configure our freeradius server for "Plain Mac-Auth" and the server is not responding how I expect. I have the server configured and an "authorized_macs" file created that contains the mac address of an android phone that I would like accepted onto the network. When I attempt to join the network from the phone, I am prompted for 802.1X credentials. If I type no credentials, the server won't handle the request at all. If I type something into one or both of the credentials fields, the server handles the request and displays "Auth-Type = Accept, accepting the user" and "Sending Access-Accept of id 7 to 216.54.247.198 port 58063", but my phone does not join the network. It simply times out. The Ubiquiti UniFi AP is in rental office space with a managed network, and the freeradius server is in the ec2 cloud. Does anyone have any ideas how to troubleshoot this? I don't think the UDP return traffic is being blocked, because the same thing happens if I move the AP to my house network with a COTS router. Thanks, Mike [root@freeradius2 ~]# radiusd -X radiusd: FreeRADIUS Version 2.2.6, for host x86_64-redhat-linux-gnu, built on Aug 14 2015 at 16:36:35 Copyright (C) 1999-2013 The FreeRADIUS server project and contributors. There is NO warranty; not even for MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. You may redistribute copies of FreeRADIUS under the terms of the GNU General Public License. For more information about these matters, see the file named COPYRIGHT. Starting - reading configuration files ... including configuration file /etc/raddb/radiusd.conf including configuration file /etc/raddb/proxy.conf including configuration file /etc/raddb/clients.conf including files in directory /etc/raddb/modules/ including configuration file /etc/raddb/modules/perl including configuration file /etc/raddb/modules/digest including configuration file /etc/raddb/modules/smsotp including configuration file /etc/raddb/modules/pam including configuration file /etc/raddb/modules/files including configuration file /etc/raddb/modules/sradutmp including configuration file /etc/raddb/modules/expiration including configuration file /etc/raddb/modules/mac2ip including configuration file /etc/raddb/modules/soh including configuration file /etc/raddb/modules/expr including configuration file /etc/raddb/modules/cache including configuration file /etc/raddb/modules/ntlm_auth including configuration file /etc/raddb/modules/always including configuration file /etc/raddb/modules/logintime including configuration file /etc/raddb/modules/sql_log including configuration file /etc/raddb/modules/dynamic_clients including configuration file /etc/raddb/modules/realm including configuration file /etc/raddb/modules/attr_rewrite including configuration file /etc/raddb/modules/linelog including configuration file /etc/raddb/modules/mac2vlan including configuration file /etc/raddb/modules/unix including configuration file /etc/raddb/modules/detail.log including configuration file /etc/raddb/modules/rediswho including configuration file /etc/raddb/modules/etc_group including configuration file /etc/raddb/modules/preprocess including configuration file /etc/raddb/modules/counter including configuration file /etc/raddb/modules/otp including configuration file /etc/raddb/modules/chap including configuration file /etc/raddb/modules/echo including configuration file /etc/raddb/modules/exec including configuration file /etc/raddb/modules/replicate including configuration file /etc/raddb/modules/acct_unique including configuration file /etc/raddb/modules/radrelay including configuration file /etc/raddb/modules/inner-eap including configuration file /etc/raddb/modules/cui including configuration file /etc/raddb/modules/dhcp_sqlippool including configuration file /etc/raddb/modules/wimax including configuration file /etc/raddb/modules/detail.example.com including configuration file /etc/raddb/modules/pap including configuration file /etc/raddb/modules/checkval including configuration file /etc/raddb/modules/ippool including configuration file /etc/raddb/modules/smbpasswd including configuration file /etc/raddb/modules/radutmp including configuration file /etc/raddb/modules/policy including configuration file /etc/raddb/modules/attr_filter including configuration file /etc/raddb/modules/redis including configuration file /etc/raddb/modules/opendirectory including configuration file /etc/raddb/modules/passwd including configuration file /etc/raddb/modules/detail including configuration file /etc/raddb/modules/mschap including configuration file /etc/raddb/modules/sqlcounter_expire_on_login including configuration file /etc/raddb/eap.conf including configuration file /etc/raddb/policy.conf including files in directory /etc/raddb/sites-enabled/ including configuration file /etc/raddb/sites-enabled/control-socket including configuration file /etc/raddb/sites-enabled/inner-tunnel including configuration file /etc/raddb/sites-enabled/default main { user = "radiusd" group = "radiusd" allow_core_dumps = no } including dictionary file /etc/raddb/dictionary main { name = "radiusd" prefix = "/usr" localstatedir = "/var" sbindir = "/usr/sbin" logdir = "/var/log/radius" run_dir = "/var/run/radiusd" libdir = "/usr/lib64/freeradius" radacctdir = "/var/log/radius/radacct" hostname_lookups = no max_request_time = 30 cleanup_delay = 5 max_requests = 1024 pidfile = "/var/run/radiusd/radiusd.pid" checkrad = "/usr/sbin/checkrad" debug_level = 0 proxy_requests = yes log { stripped_names = no auth = no auth_badpass = no auth_goodpass = no } security { max_attributes = 200 reject_delay = 1 status_server = yes } } radiusd: #### Loading Realms and Home Servers #### proxy server { retry_delay = 5 retry_count = 3 default_fallback = no dead_time = 120 wake_all_if_all_dead = no } home_server localhost { ipaddr = 127.0.0.1 port = 1812 type = "auth" secret = "testing123" response_window = 20.000000 response_timeouts = 1 max_outstanding = 65536 require_message_authenticator = yes zombie_period = 40 status_check = "status-server" ping_interval = 30 check_interval = 30 num_answers_to_alive = 3 num_pings_to_alive = 3 revive_interval = 120 status_check_timeout = 4 coa { irt = 2 mrt = 16 mrc = 5 mrd = 30 } } home_server_pool my_auth_failover { type = fail-over home_server = localhost } realm example.com { auth_pool = my_auth_failover } realm LOCAL { } radiusd: #### Loading Clients #### client localhost { ipaddr = 127.0.0.1 require_message_authenticator = no secret = "testing123" nastype = "other" } client 0.0.0.0/0 { require_message_authenticator = no secret = "<scrubbed>" shortname = "XMDAP" } radiusd: #### Instantiating modules #### instantiate { Module: Linked to module rlm_exec Module: Instantiating module "exec" from file /etc/raddb/modules/exec exec { wait = no input_pairs = "request" shell_escape = yes timeout = 10 } Module: Linked to module rlm_expr Module: Instantiating module "expr" from file /etc/raddb/modules/expr Module: Linked to module rlm_expiration Module: Instantiating module "expiration" from file /etc/raddb/modules/expiration expiration { reply-message = "Password Has Expired " } Module: Linked to module rlm_logintime Module: Instantiating module "logintime" from file /etc/raddb/modules/logintime logintime { reply-message = "You are calling outside your allowed timespan " minimum-timeout = 60 } } radiusd: #### Loading Virtual Servers #### server { # from file ▒▒▒? modules { Module: Creating Auth-Type = digest Module: Creating Post-Auth-Type = REJECT Module: Checking authenticate {...} for more modules to load Module: Linked to module rlm_pap Module: Instantiating module "pap" from file /etc/raddb/modules/pap pap { encryption_scheme = "auto" auto_header = no } Module: Linked to module rlm_chap Module: Instantiating module "chap" from file /etc/raddb/modules/chap Module: Linked to module rlm_mschap Module: Instantiating module "mschap" from file /etc/raddb/modules/mschap mschap { use_mppe = yes require_encryption = no require_strong = no with_ntdomain_hack = no allow_retry = yes } Module: Linked to module rlm_digest Module: Instantiating module "digest" from file /etc/raddb/modules/digest Module: Linked to module rlm_unix Module: Instantiating module "unix" from file /etc/raddb/modules/unix unix { radwtmp = "/var/log/radius/radwtmp" } Module: Linked to module rlm_eap Module: Instantiating module "eap" from file /etc/raddb/eap.conf eap { default_eap_type = "md5" timer_expire = 60 ignore_unknown_eap_types = no cisco_accounting_username_bug = no max_sessions = 1024 } Module: Linked to sub-module rlm_eap_md5 Module: Instantiating eap-md5 Module: Linked to sub-module rlm_eap_leap Module: Instantiating eap-leap Module: Linked to sub-module rlm_eap_gtc Module: Instantiating eap-gtc gtc { challenge = "Password: " auth_type = "PAP" } Module: Linked to sub-module rlm_eap_tls Module: Instantiating eap-tls tls { rsa_key_exchange = no dh_key_exchange = yes rsa_key_length = 512 dh_key_length = 512 verify_depth = 0 CA_path = "/etc/raddb/certs" pem_file_type = yes private_key_file = "/etc/raddb/certs/server.pem" certificate_file = "/etc/raddb/certs/server.pem" CA_file = "/etc/raddb/certs/ca.pem" private_key_password = "whatever" dh_file = "/etc/raddb/certs/dh" fragment_size = 1024 include_length = yes check_crl = no cipher_list = "DEFAULT" ecdh_curve = "prime256v1" cache { enable = no lifetime = 24 max_entries = 255 } verify { } ocsp { enable = no override_cert_url = yes url = "http://127.0.0.1/ocsp/" use_nonce = yes timeout = 0 softfail = no } } Module: Linked to sub-module rlm_eap_ttls Module: Instantiating eap-ttls ttls { default_eap_type = "md5" copy_request_to_tunnel = no use_tunneled_reply = no virtual_server = "inner-tunnel" include_length = yes } Module: Linked to sub-module rlm_eap_peap Module: Instantiating eap-peap peap { default_eap_type = "mschapv2" copy_request_to_tunnel = no use_tunneled_reply = no proxy_tunneled_request_as_eap = yes virtual_server = "inner-tunnel" soh = no } Module: Linked to sub-module rlm_eap_mschapv2 Module: Instantiating eap-mschapv2 mschapv2 { with_ntdomain_hack = no send_error = no } Module: Checking authorize {...} for more modules to load Module: Linked to module rlm_preprocess Module: Instantiating module "preprocess" from file /etc/raddb/modules/preprocess preprocess { huntgroups = "/etc/raddb/huntgroups" hints = "/etc/raddb/hints" with_ascend_hack = no ascend_channels_per_line = 23 with_ntdomain_hack = no with_specialix_jetstream_hack = no with_cisco_vsa_hack = no with_alvarion_vsa_hack = no } reading pairlist file /etc/raddb/huntgroups reading pairlist file /etc/raddb/hints Module: Loading virtual module rewrite_calling_station_id Module: Linked to module rlm_always Module: Instantiating module "noop" from file /etc/raddb/modules/always always noop { rcode = "noop" simulcount = 0 mpp = no } Module: Linked to module rlm_files Module: Instantiating module "authorized_macs" from file /etc/raddb/modules/files files authorized_macs { usersfile = "/etc/raddb/authorized_macs" compat = "no" key = "%{Calling-Station-ID}" } reading pairlist file /etc/raddb/authorized_macs Module: Instantiating module "reject" from file /etc/raddb/modules/always always reject { rcode = "reject" simulcount = 0 mpp = no } Module: Checking preacct {...} for more modules to load Module: Linked to module rlm_acct_unique Module: Instantiating module "acct_unique" from file /etc/raddb/modules/acct_unique acct_unique { key = "User-Name, Acct-Session-Id, NAS-IP-Address, NAS-Identifier, NAS-Port" } Module: Linked to module rlm_realm Module: Instantiating module "suffix" from file /etc/raddb/modules/realm realm suffix { format = "suffix" delimiter = "@" ignore_default = no ignore_null = no } Module: Instantiating module "files" from file /etc/raddb/modules/files files { usersfile = "/etc/raddb/users" acctusersfile = "/etc/raddb/acct_users" preproxy_usersfile = "/etc/raddb/preproxy_users" compat = "no" } reading pairlist file /etc/raddb/users reading pairlist file /etc/raddb/acct_users reading pairlist file /etc/raddb/preproxy_users Module: Checking accounting {...} for more modules to load Module: Linked to module rlm_detail Module: Instantiating module "detail" from file /etc/raddb/modules/detail detail { detailfile = "/var/log/radius/radacct/%{%{Packet-Src-IP-Address}:-%{Packet-Src-IPv6-Address}}/detail-%Y%m%d" header = "%t" detailperm = 384 dirperm = 493 locking = no log_packet_header = no } Module: Linked to module rlm_attr_filter Module: Instantiating module "attr_filter.accounting_response" from file /etc/raddb/modules/attr_filter attr_filter attr_filter.accounting_response { attrsfile = "/etc/raddb/attrs.accounting_response" key = "%{User-Name}" relaxed = no } reading pairlist file /etc/raddb/attrs.accounting_response Module: Checking session {...} for more modules to load Module: Linked to module rlm_radutmp Module: Instantiating module "radutmp" from file /etc/raddb/modules/radutmp radutmp { filename = "/var/log/radius/radutmp" username = "%{User-Name}" case_sensitive = yes check_with_nas = yes perm = 384 callerid = yes } Module: Checking post-proxy {...} for more modules to load Module: Checking post-auth {...} for more modules to load Module: Instantiating module "attr_filter.access_reject" from file /etc/raddb/modules/attr_filter attr_filter attr_filter.access_reject { attrsfile = "/etc/raddb/attrs.access_reject" key = "%{User-Name}" relaxed = no } reading pairlist file /etc/raddb/attrs.access_reject } # modules } # server server inner-tunnel { # from file /etc/raddb/sites-enabled/inner-tunnel modules { Module: Checking authenticate {...} for more modules to load Module: Checking authorize {...} for more modules to load Module: Checking session {...} for more modules to load Module: Checking post-proxy {...} for more modules to load Module: Checking post-auth {...} for more modules to load } # modules } # server radiusd: #### Opening IP addresses and Ports #### listen { type = "auth" ipaddr = * port = 0 } listen { type = "acct" ipaddr = * port = 0 } listen { type = "control" listen { socket = "/var/run/radiusd/radiusd.sock" } } listen { type = "auth" ipaddr = 127.0.0.1 port = 18120 } ... adding new socket proxy address * port 38386 Listening on authentication address * port 1812 Listening on accounting address * port 1813 Listening on command file /var/run/radiusd/radiusd.sock Listening on authentication address 127.0.0.1 port 18120 as server inner-tunnel Listening on proxy address * port 1814 Ready to process requests. rad_recv: Access-Request packet from host 216.54.247.198 port 10027, id=4, length=163 User-Name = "a" NAS-IP-Address = 192.168.0.137 NAS-Identifier = "0418d6cee172" NAS-Port = 0 Called-Station-Id = "0A-18-D6-CF-E1-72:xmd-authorized" Calling-Station-Id = "00-02-71-D3-44-2B" Framed-MTU = 1400 NAS-Port-Type = Wireless-802.11 Connect-Info = "CONNECT 0Mbps 802.11b" EAP-Message = 0x02cd00060161 Message-Authenticator = 0xcb2f355e41f81c5808fb38890f50e2e9 # Executing section authorize from file /etc/raddb/sites-enabled/default +group authorize { ++[preprocess] = ok ++policy rewrite_calling_station_id { +++? if (Calling-Station-Id =~ /([0-9a-f]{2})[-:]?([0-9a-f]{2})[-:.]?([0-9a-f]{2})[-:]?([0-9a-f]{2})[-:.]?([0-9a-f]{2})[-:]?([0-9a-f]{2})/i) ? Evaluating (Calling-Station-Id =~ /([0-9a-f]{2})[-:]?([0-9a-f]{2})[-:.]?([0-9a-f]{2})[-:]?([0-9a-f]{2})[-:.]?([0-9a-f]{2})[-:]?([0-9a-f]{2})/i) -> TRUE +++? if (Calling-Station-Id =~ /([0-9a-f]{2})[-:]?([0-9a-f]{2})[-:.]?([0-9a-f]{2})[-:]?([0-9a-f]{2})[-:.]?([0-9a-f]{2})[-:]?([0-9a-f]{2})/i) -> TRUE +++if (Calling-Station-Id =~ /([0-9a-f]{2})[-:]?([0-9a-f]{2})[-:.]?([0-9a-f]{2})[-:]?([0-9a-f]{2})[-:.]?([0-9a-f]{2})[-:]?([0-9a-f]{2})/i) { ++++update request { expand: %{1}-%{2}-%{3}-%{4}-%{5}-%{6} -> 00-02-71-D3-44-2B expand: %{tolower:%{1}-%{2}-%{3}-%{4}-%{5}-%{6}} -> 00-02-71-d3-44-2b ++++} # update request = noop +++} # if (Calling-Station-Id =~ /([0-9a-f]{2})[-:]?([0-9a-f]{2})[-:.]?([0-9a-f]{2})[-:]?([0-9a-f]{2})[-:.]?([0-9a-f]{2})[-:]?([0-9a-f]{2})/i) = noop +++ ... skipping else for request 0: Preceding "if" was taken ++} # policy rewrite_calling_station_id = noop [authorized_macs] expand: %{Calling-Station-ID} -> 00-02-71-d3-44-2b [authorized_macs] users: Matched entry 00-02-71-d3-44-2b at line 1 [authorized_macs] expand: Mike's Android phone with MAC %{Calling-Station-Id} authorized for network access -> Mike's Android phone with MAC 00-02-71-d3-44-2b authorized for network access ++[authorized_macs] = ok ++? if (!ok) ? Evaluating !(ok) -> FALSE ++? if (!ok) -> FALSE ++else else { +++update control { +++} # update control = noop ++} # else else = noop +} # group authorize = ok Found Auth-Type = Accept Auth-Type = Accept, accepting the user # Executing section post-auth from file /etc/raddb/sites-enabled/default +group post-auth { ++[exec] = noop +} # group post-auth = noop Sending Access-Accept of id 4 to 216.54.247.198 port 10027 Reply-Message = "Mike's Android phone with MAC 00-02-71-d3-44-2b authorized for network access" Finished request 0. Going to the next request Waking up in 4.9 seconds. Cleaning up request 0 ID 4 with timestamp +207 Ready to process requests. ------------------------------------------------- Join the XstremeMD email list.<http://visitor.r20.constantcontact.com/d.jsp?llr=strsmmvab&p=oi&m=112247605…> ------------------------------------------------- XstremeMD EMAIL NOTICE - This transmission may be strictly confidential. If you are not the intended recipient of this message, you may not disclose, print, copy, or disseminate this information. If you have received this in error, please reply and notify the sender (only) and delete the message. Unauthorized interception of this e-mail is a violation of federal criminal law. This communication does not reflect an intention by the sender or the sender's principal to conduct a transaction or make any agreement by electronic means. Nothing contained in this message or in any attachment shall satisfy the requirements for a writing, and nothing contained herein shall constitute a contract or electronic signature under the Electronic Signatures in Global and National Commerce Act, any version of the Uniform Electronic Transactions Act, or any other statute governing electronic transactions.

7 9

Issues with Cached-Session-Policy in versions of FR after 3.0.8.
by Palmer J.D.F. 12 Jan '16

12 Jan '16

Hello, I've issues with fast-reauth using Cached-Session-Policy in FR3.0.9 and above. In the post-auth section of site-enabled/inner-tunnel I update the reply as below... post-auth { ... update reply { &Cached-Session-Policy = &Stripped-User-Name } ... } I then have the code below in site-enabled/default to recover the username from the stored Cached-Session-Policy for use on a fast-reauth, this is then used to run a few scripts to check the user's status and assign VLAN. post-auth { ... if ("%{Realm}" != "jrs") { #don't need to do this for JRS users update control { &Tmp-String-1 := &reply:Cached-Session-Policy } $INCLUDE ${raddbdir}/scripts/dosomestuff.conf $INCLUDE ${raddbdir}/scripts/poolacc.conf } ... } This works in V3.0.8, Tmp-String-1 is set to the stripped username from the saved session, but not in versions after this. Is there a better/another way to recover the username for use within site-enabled/default during fast re-auth / session resumption? Many thanks, Jezz. Jezz Palmer Information Services and Systems Swansea University Singleton Park Swansea SA2 8PP

3 2

question about logging levels, using syslog facility.
by koch＠inbox.lv 12 Jan '16

12 Jan '16

Good day! I'm using freeradius3.0.10. Here is my log configuration from radiusd.cong: log { destination = syslog syslog_facility = local1 stripped_names = no auth = yes auth_badpass = yes auth_goodpass = yes } Here is line from /etc/rsyslog.conf : local1.info -/var/log/radius/radius.log And I use my own perl module for auth-tion, where a lot of debug, info, error and so on information. use constant L_DBG => 1; use constant L_AUTH => 2; use constant L_INFO => 3; use constant L_ERR => 4; use constant L_PROXY => 5; use constant L_ACCT => 6; I've finished my test, so I want to turn off debug info, but it still exist in the /var/log/radius/radius.log file (&radiusd::radlog(L_DBG, "Auth: Calling-Station-Id: ".$RAD_REQUEST{'Calling-Station-Id'}); ). I've restarted rsyslog, radiusd daemon was started without any params. Why debugging information doesn't want to disappear? Any ideas? Log exampe with debug info Jan 12 15:25:36 radiusn-test1 radiusd[11284]: (27673) Login OK: [12345/<via Auth-Type = Perl>] (from client localhost port 0 cli 12345) Jan 12 15:25:36 radiusn-test1 radiusd[11284]: rlm_perl: Auth: Calling-Station-Id: 12345

4 6