- Freeradius-Users - lists.freeradius.org

doubts about the best way to collect and handle the Status-*
by Jorge Pereira 26 Nov '15

26 Nov '15

Hi, has someone used the Status packets to generate graphics? if 'yes', what has used to collect and plot the graphs? e.g: $ cat ../pack-stats.txt Message-Authenticator = 0x00 FreeRADIUS-Statistics-Type = All Response-Packet-Type = Access-Accept $ $ radclient -x localhost:18121 status adminsecret -f ../pack-stats.txt Sent Status-Server Id 203 from 0.0.0.0:52687 to 127.0.0.1:18121 length 50 Message-Authenticator = 0x00 FreeRADIUS-Statistics-Type = All Response-Packet-Type = Access-Accept Received Access-Accept Id 203 from 127.0.0.1:18121 to 0.0.0.0:0 length 536 FreeRADIUS-Total-Access-Requests = 10 FreeRADIUS-Total-Access-Accepts = 0 FreeRADIUS-Total-Access-Rejects = 0 FreeRADIUS-Total-Access-Challenges = 0 FreeRADIUS-Total-Auth-Responses = 0 FreeRADIUS-Total-Auth-Duplicate-Requests = 0 FreeRADIUS-Total-Auth-Malformed-Requests = 0 FreeRADIUS-Total-Auth-Invalid-Requests = 0 FreeRADIUS-Total-Auth-Dropped-Requests = 0 FreeRADIUS-Total-Auth-Unknown-Types = 0 FreeRADIUS-Total-Accounting-Requests = 0 FreeRADIUS-Total-Accounting-Responses = 0 FreeRADIUS-Total-Acct-Duplicate-Requests = 0 FreeRADIUS-Total-Acct-Malformed-Requests = 0 FreeRADIUS-Total-Acct-Invalid-Requests = 0 FreeRADIUS-Total-Acct-Dropped-Requests = 0 FreeRADIUS-Total-Acct-Unknown-Types = 0 FreeRADIUS-Total-Proxy-Access-Requests = 0 FreeRADIUS-Total-Proxy-Access-Accepts = 0 FreeRADIUS-Total-Proxy-Access-Rejects = 0 FreeRADIUS-Total-Proxy-Access-Challenges = 0 FreeRADIUS-Total-Proxy-Auth-Responses = 0 FreeRADIUS-Total-Proxy-Auth-Duplicate-Requests = 0 FreeRADIUS-Total-Proxy-Auth-Malformed-Requests = 0 FreeRADIUS-Total-Proxy-Auth-Invalid-Requests = 0 FreeRADIUS-Total-Proxy-Auth-Dropped-Requests = 0 FreeRADIUS-Total-Proxy-Auth-Unknown-Types = 0 FreeRADIUS-Total-Proxy-Accounting-Requests = 0 FreeRADIUS-Total-Proxy-Accounting-Responses = 0 FreeRADIUS-Total-Proxy-Acct-Duplicate-Requests = 0 FreeRADIUS-Total-Proxy-Acct-Malformed-Requests = 0 FreeRADIUS-Total-Proxy-Acct-Invalid-Requests = 0 FreeRADIUS-Total-Proxy-Acct-Dropped-Requests = 0 FreeRADIUS-Total-Proxy-Acct-Unknown-Types = 0 FreeRADIUS-Stats-Start-Time = "Nov 26 2015 18:16:07 BRST" FreeRADIUS-Stats-HUP-Time = "Nov 26 2015 18:16:07 BRST" FreeRADIUS-Queue-Len-Internal = 0 FreeRADIUS-Queue-Len-Proxy = 0 FreeRADIUS-Queue-Len-Auth = 0 FreeRADIUS-Queue-Len-Acct = 0 FreeRADIUS-Queue-Len-Detail = 0 FreeRADIUS-Queue-PPS-In = 0 FreeRADIUS-Queue-PPS-Out = 0 $ -- Jorge Pereira

1 0

Failed binding to authentication address
by Federico Olivieri 26 Nov '15

26 Nov '15

Hi All, I know that this topics has been discussed many times but all solution/answers found on the mailing list didn't work for me (sure that is my fault!) When I stop the service and I run freeradius -xxx the message is: Thu Nov 26 15:14:25 2015 : Info: ... adding new socket proxy address * port 47256 Thu Nov 26 15:14:25 2015 : Debug: Listening on authentication address * port 1812 Thu Nov 26 15:14:25 2015 : Debug: Listening on accounting address * port 1813 Thu Nov 26 15:14:25 2015 : Debug: Listening on authentication address 127.0.0.1 port 18120 as server inner-tunnel Thu Nov 26 15:14:25 2015 : Debug: Listening on proxy address * port 1814 Thu Nov 26 15:14:25 2015 : Info: Ready to process requests. then, I start radius and when I try to do radtest I get this error: root@raspberrypi:~# /etc/init.d/freeradius start [ ok ] Starting FreeRADIUS daemon: freeradius. root@raspberrypi:~# radtest "John Doe" hello 127.0.0.1 0 testing123 Sending Access-Request of id 126 to 127.0.0.1 port 1812 User-Name = "John Doe" User-Password = "hello" NAS-IP-Address = 127.0.1.1 NAS-Port = 0 Message-Authenticator = 0x00000000000000000000000000000000 rad_recv: Access-Reject packet from host 127.0.0.1 port 1812, id=126, length=20 Looking into a second debug I can see: Thu Nov 26 15:15:06 2015 : Debug: radiusd: #### Opening IP addresses and Ports #### Thu Nov 26 15:15:06 2015 : Debug: listen { Thu Nov 26 15:15:06 2015 : Debug: type = "auth" Thu Nov 26 15:15:06 2015 : Debug: ipaddr = * Thu Nov 26 15:15:06 2015 : Debug: port = 0 Thu Nov 26 15:15:06 2015 : Error: Failed binding to authentication address * port 1812: Address already in use Thu Nov 26 15:15:06 2015 : Error: /etc/freeradius/radiusd.conf[240]: Error binding to port for 0.0.0.0 port 1812 What I'm doing wrong? For me is normal that the port is 1812 is busy because freeradius is using it! Thanks!

4 12

Freeradius and LDAP/AD integration
by Antoine JOUBERT 26 Nov '15

26 Nov '15

Hi, I've been reading through Freeradius' documentation, various howtos and this mailing-list archives for the past few days, and I'm still not sure if the architecture I'm trying to set up can be achieved, so I figured I'd ask here. My company currently uses a Windows Server running Active Directory for user account management. We would like to setup 802.1x for both wired and WLAN access on Windows, Linux, Mac, iOS and Android devices (using PEAP/MS-CHAPv2). We have three offices where VLANs are configured. Many of our users frequently move between offices. A user who uses VLAN 10 when he is in the office A would use VLAN 20 when he is in the office B and VLAN 30 when he is in the office C. Hence, unless I've missed something, I don't believe we can fully centralize our RADIUS configuration. I'm thinking of setting up a Freeradius server in each office that communicates with our Active Directory to check if the user's credentials are valid, and then checks a local MySQL database for the "Tunnel-Type", "Tunnel-Medium-Type" and "Tunnel-Private-Group-Id" parameters for that user. Can this be achieved ? We'll also need to configure Mac Authentication Bypass for devices that do not handle 802.1x (VOIP phones, printers, etc.). Can those be configured locally in the same MySQL database as well ? Thanks, Antoine

3 2

cache_ocsp
by Scott Armitage 25 Nov '15

25 Nov '15

I might be doing something wrong but I can’t seem to find the cache_ocsp module anywhere which is called in the tls-cache server: /etc/raddb/sites-enabled/tls-cache[114]: Failed to find "cache_ocsp" as a module or policy. /etc/raddb/sites-enabled/tls-cache[114]: Please verify that the configuration exists in /etc/raddb/mods-enabled/cache_ocsp. /etc/raddb/sites-enabled/tls-cache[114]: Failed to parse "cache_ocsp" entry. Has anyone else experienced this problem? Regards Scott

5 11

about radius user password
by Serkan KASAP 25 Nov '15

25 Nov '15

hi. is it possible to insert raddacct password variable or value? username working but password not working. please help. accounting_start_query = " \ INSERT INTO ${acct_table1} \ (acctsessionid, acctuniqueid, username, \ realm, nasipaddress, nasportid, \ nasporttype, acctstarttime, acctstoptime, \ acctsessiontime, acctauthentic, connectinfo_start, \ connectinfo_stop, acctinputoctets, acctoutputoctets, \ calledstationid, callingstationid, acctterminatecause, \ servicetype, framedprotocol, framedipaddress, \ acctstartdelay, acctstopdelay, xascendsessionsvrkey) \ VALUES \ ('%{Acct-Session-Id}', '%{Acct-Unique-Session-Id}', \ '%{SQL-User-Name}', \ '%{Realm}', '%{NAS-IP-Address}', '%{NAS-Port}', \ '%{NAS-Port-Type}', '%S', NULL, \ '0', '%{Acct-Authentic}', '%{Connect-Info}', \ '', '0', '0', \ '%{Called-Station-Id}', '%{Calling-Station-Id}', '', \ '%{Service-Type}', '%{Framed-Protocol}', '%{Framed-IP-Address}', \ '%{%{Acct-Delay-Time}:-0}', '0', '%{X-Ascend-Session-Svr-Key}')"

2 1

EAP-TLS and Active Directory
by Simon Larsson 25 Nov '15

25 Nov '15

Hi there! I’m having a problem where I don’t fully understand exactly how EAP-TLS works in regards to authorization. I'm trying to implement a 802.1x wireless network which uses EAP-TLS for security reasons. I already have a Windows server with a Certificate Authority, so that's not really an issue. All I have to do there is to create the certificates and then insert them into both the FreeRADIUS server and all the clients. Here’s my problem. As I understand it, EAP-TLS uses the certificates for authentication and therefor my users credentials become less important (not needed to log in to the network). Now, if my users never enter their credentials and the FreeRADIUS server never checks with Active Directory for authorization, what decides what network resources a specific user should have access to? My goal here is to have it so that when a user connects to the network, the user should automatically get access that users network resources. Thanks in advance, Simon

5 8

Filtering VLAN assignmen in eduroam
by Angel L. Mateo 25 Nov '15

25 Nov '15

Hello, I'm using freeradius 3.0.10 to authenticate eduroam connections. In my inner server I return attributes to assign VLAN to our internal users and I want these attributes to be filtered when the connection is from an external organization. So in the outer server I have: post-proxy { eduroam_log files_eduroam_outer.authorize attr_filter.post-proxy } and in the attr_filter.post-proxy file I have: DEFAULT Service-Type == Framed-User, Service-Type == Login-User, Login-Service == Telnet, Login-Service == Rlogin, Login-Service == TCP-Clear, Login-TCP-Port <= 65536, Framed-IP-Address == 255.255.255.254, Framed-IP-Netmask == 255.255.255.255, Framed-Protocol == PPP, Framed-Protocol == SLIP, Framed-Compression == Van-Jacobson-TCP-IP, Framed-MTU >= 576, Framed-Filter-ID =* ANY, Reply-Message =* ANY, Proxy-State =* ANY, EAP-Message =* ANY, Message-Authenticator =* ANY, MS-MPPE-Recv-Key =* ANY, MS-MPPE-Send-Key =* ANY, MS-CHAP-MPPE-Keys =* ANY, State =* ANY, Session-Timeout <= 28800, Idle-Timeout <= 600, Calling-Station-Id =* ANY, Operator-Name =* ANY, Port-Limit <= 2, GSS-Acceptor-Service-Name =* ANY, GSS-Acceptor-Host-Name =* ANY, GSS-Acceptor-Service-Specifics =* ANY, GSS-Acceptor-Realm-Name =* ANY, SAML-AAA-Assertion =* ANY, EAP-Channel-Binding-Message =* ANY According to attr_filter documentation, if I don't have the Tunnel-Private-Group-Id in this file, then the attribute should be filtered, isn't it? But, the attribute is not being filtered. It is returned to my upper radius server. Any help? -- Angel L. Mateo Martínez Sección de Telemática Área de Tecnologías de la Información y las Comunicaciones Aplicadas (ATICA) http://www.um.es/atica Tfo: 868887590 Fax: 868888337

3 2

eapol_test question
by Alex Sharaz 24 Nov '15

24 Nov '15

Not a freeradius question as such, but guess people on the list use eapol_test. >From the man page -N attr spec Send arbitrary attribute specific by attr_id:syntax:value, or attr_id alone. attr_id should be the numeric ID of the attribute, and syntax should be one of 's' (string), 'd' (inte‐ ger), or 'x' (octet string). The value is the attribute value to send. When attr_id is given alone, NULL is used as the attribute value. Multiple attributes can be specified by using the option several times. so -N 61:d:19 means set NAS-Port-Type to be Wireless-802.11 ( val=19) Anyone know if I can specify a VSA attribute this way? is it just a case of VSA base val + attribute number ? Rgds Alex

5 7

State of RadSec in FR 3.0.10
by Sebastian Hagedorn 24 Nov '15

24 Nov '15

Hi, we have never used RadSec before but are planning to do so for Eduroam. I found this (three years old) document from GÉANT on it, and was planning on trying it that way: <https://wiki.geant.org/display/H2eduroam/freeradius3-flr> But our national Eduroam center (DFN) recommends using radsecproxy instead, because according to them RadSec isn't yet stable in FR 3.0. What's your take on that? To be honest, I'd rather help fix problems in FR's RadSec implementation than install another piece of software - unless you recommend against it. -- .:.Sebastian Hagedorn - Weyertal 121 (Gebäude 133), Zimmer 2.02.:. .:.Regionales Rechenzentrum (RRZK).:. .:.Universität zu Köln / Cologne University - ✆ +49-221-470-89578.:.

3 3

Segfault on FR 3.0.4 when MySQL server goes away
by Jonathan Gazeley 24 Nov '15

24 Nov '15

I'm currently running a mixed estate of RADIUS 2 and 3 on CentOS 6 and 7 (halfway through a migration project). The older servers are running a home-built FR 2.2.9 and the newer ones are running stock FR 3.0.4, as supplied with CentOS 7. I've noticed the FR 3 boxes segfault from time to time and I think I've pinned it down to odd behaviour when the MySQL server is temporarily unavailable. We have clustered SQL behind an F5 load balancer but there is a small delay during failover when one of the SQL nodes goes away or when the F5 decides to switch to a different node for some other reason. The FR2 boxes cope fine with this transition but the FR3 boxes segfault in about 50% of cases. I understand 3.0.4 is not the latest and I'm happy to build 3.1.x if this will fix the problem but initially I'm trying to work out if this is a bug in the server, or a misconfiguration on my part (although I'd hope a misconfiguration wouldn't cause a crash). Backtrace included below, although this was not built with --enable-developer since it is a busy production system. I tried to replicate this on a dev system but the much lower load makes it hard to cause the crash. Thanks, Jonathan ... rlm_sql (uobsql-write): Reserved connection (4) rlm_sql (uobsql-write): Executing query: 'select count(*) from localprod.all_users_table where suspended is not null and common_username='it000543'' rlm_sql_mysql: MYSQL check_error: 2006, returning RLM_SQL_RECONNECT rlm_sql (uobsql-write): Reconnecting (4) rlm_sql_mysql: Starting connect to MySQL server rlm_sql_mysql: Couldn't connect socket to MySQL server radiusd@db-write.nomadic-core.bris.ac.uk:radius rlm_sql_mysql: Mysql error 'Lost connection to MySQL server at 'reading initial communication packet', system error: 104' rlm_sql (uobsql-write): Reserved connection (3) rlm_sql (uobsql-write): Executing query: 'select count(*) from localprod.all_users_table where suspended is not null and common_username='it000543'' rlm_sql_mysql: MYSQL check_error: 2006, returning RLM_SQL_RECONNECT rlm_sql (uobsql-write): Reconnecting (3) rlm_sql_mysql: Starting connect to MySQL server rlm_sql_mysql: Couldn't connect socket to MySQL server radiusd@db-write.nomadic-core.bris.ac.uk:radius rlm_sql_mysql: Mysql error 'Lost connection to MySQL server at 'reading initial communication packet', system error: 104' rlm_sql (uobsql-write): Reserved connection (2) rlm_sql (uobsql-write): Executing query: 'select count(*) from localprod.all_users_table where suspended is not null and common_username='it000543'' rlm_sql_mysql: MYSQL check_error: 2006, returning RLM_SQL_RECONNECT rlm_sql (uobsql-write): Reconnecting (2) rlm_sql_mysql: Starting connect to MySQL server rlm_sql_mysql: Couldn't connect socket to MySQL server radiusd@db-write.nomadic-core.bris.ac.uk:radius rlm_sql_mysql: Mysql error 'Lost connection to MySQL server at 'reading initial communication packet', system error: 104' rlm_sql (uobsql-write): Reserved connection (1) rlm_sql (uobsql-write): Executing query: 'select count(*) from localprod.all_users_table where suspended is not null and common_username='it000543'' rlm_sql_mysql: MYSQL check_error: 2006, returning RLM_SQL_RECONNECT rlm_sql (uobsql-write): Reconnecting (1) rlm_sql_mysql: Starting connect to MySQL server rlm_sql_mysql: Couldn't connect socket to MySQL server radiusd@db-write.nomadic-core.bris.ac.uk:radius rlm_sql_mysql: Mysql error 'Lost connection to MySQL server at 'reading initial communication packet', system error: 104' rlm_sql (uobsql-write): Reserved connection (0) rlm_sql (uobsql-write): Executing query: 'select count(*) from localprod.all_users_table where suspended is not null and common_username='it000543'' rlm_sql_mysql: MYSQL check_error: 2006, returning RLM_SQL_RECONNECT rlm_sql (uobsql-write): Reconnecting (0) rlm_sql_mysql: Starting connect to MySQL server rlm_sql_mysql: Couldn't connect socket to MySQL server radiusd@db-write.nomadic-core.bris.ac.uk:radius rlm_sql_mysql: Mysql error 'Lost connection to MySQL server at 'reading initial communication packet', system error: 104' rlm_sql (uobsql-write): Failed to reconnect (0), no free connections are available Program received signal SIGSEGV, Segmentation fault. [Switching to Thread 0x7ffff1a5f700 (LWP 23087)] sql_error (handle=0x0, config=0x555555b58b70) at src/modules/rlm_sql/drivers/rlm_sql_mysql/rlm_sql_mysql.c:479 479 rlm_sql_mysql_conn_t *conn = handle->conn; (gdb) bt #0 sql_error (handle=0x0, config=0x555555b58b70) at src/modules/rlm_sql/drivers/rlm_sql_mysql/rlm_sql_mysql.c:479 #1 0x00007ffff298558b in sql_xlat (instance=0x555555b58b70, request=0x555555ca2c90, query=0x7fffd4035970 "select count(*) from localprod.all_users_table where suspended is not null and common_username='it000543'", out=0x7fffd4017980 "", freespace=1024) at src/modules/rlm_sql/rlm_sql.c:185 #2 0x00007ffff7bcc606 in xlat_aprint (ctx=ctx@entry=0x555555ca2c90, request=0x555555ca2c90, node=0x555555c62b30, escape=escape@entry=0x0, escape_ctx=0x0, lvl=0) at src/main/xlat.c:2025 #3 0x00007ffff7bcd1bd in xlat_process (out=0x7ffff1a5df60, request=0x555555ca2c90, head=0x555555c62b30, escape=0x0, escape_ctx=0x0) at src/main/xlat.c:2103 #4 0x00007ffff7bcd210 in xlat_expand_struct (out=0x7ffff1a5e000, outlen=0, request=<optimized out>, node=<optimized out>, escape=<optimized out>, escape_ctx=<optimized out>) at src/main/xlat.c:2175 #5 0x00007ffff7bc105e in radius_expand_tmpl (out=out@entry=0x7ffff1a5e000, request=request@entry=0x555555ca2c90, vpt=0x555555aa28b0) at src/main/evaluate.c:135 #6 0x00007ffff7bc15ca in radius_evaluate_map (request=request@entry=0x555555ca2c90, modreturn=modreturn@entry=10, depth=depth@entry=0, c=c@entry=0x555555aa2620) at src/main/evaluate.c:807 #7 0x00007ffff7bc1be0 in radius_evaluate_cond (request=request@entry=0x555555ca2c90, modreturn=10, depth=depth@entry=0, c=0x555555aa2620) at src/main/evaluate.c:913 #8 0x0000555555577dd8 in modcall_recurse (request=0x555555ca2c90, component=RLM_COMPONENT_POST_AUTH, depth=3, entry=entry@entry=0x7ffff1a5e9d8) at src/main/modcall.c:489 #9 0x0000555555577a70 in modcall_child (request=<optimized out>, component=<optimized out>, depth=<optimized out>, entry=0x7ffff1a5e9c0, c=<optimized out>, result=0x7ffff1a5e3e4) at src/main/modcall.c:420 #10 0x0000555555577c67 in modcall_recurse (request=0x555555ca2c90, component=RLM_COMPONENT_POST_AUTH, depth=2, entry=entry@entry=0x7ffff1a5e9c0) at src/main/modcall.c:798 #11 0x0000555555577a70 in modcall_child (request=<optimized out>, component=<optimized out>, depth=<optimized out>, entry=0x7ffff1a5e9a8, c=<optimized out>, result=0x7ffff1a5e5f4) at src/main/modcall.c:420 #12 0x0000555555577c67 in modcall_recurse (request=0x555555ca2c90, component=RLM_COMPONENT_POST_AUTH, depth=1, entry=entry@entry=0x7ffff1a5e9a8) at src/main/modcall.c:798 #13 0x0000555555577a70 in modcall_child (request=<optimized out>, component=<optimized out>, depth=<optimized out>, entry=0x7ffff1a5e990, c=<optimized out>, result=0x7ffff1a5e804) at src/main/modcall.c:420 #14 0x0000555555577c67 in modcall_recurse (request=request@entry=0x555555ca2c90, component=component@entry=RLM_COMPONENT_POST_AUTH, depth=depth@entry=0, entry=entry@entry=0x7ffff1a5e990) at src/main/modcall.c:798 #15 0x0000555555578e90 in modcall (component=component@entry=RLM_COMPONENT_POST_AUTH, c=c@entry=0x555555c33170, request=request@entry=0x555555ca2c90) at src/main/modcall.c:1138 #16 0x00005555555762bf in indexed_modcall (comp=comp@entry=RLM_COMPONENT_POST_AUTH, idx=idx@entry=0, request=request@entry=0x555555ca2c90) at src/main/modules.c:909 #17 0x0000555555576eef in process_post_auth (postauth_type=postauth_type@entry=0, request=request@entry=0x555555ca2c90) at src/main/modules.c:1930 #18 0x000055555556724e in rad_postauth (request=request@entry=0x555555ca2c90) at src/main/auth.c:305 #19 0x000055555558185c in request_finish (request=request@entry=0x555555ca2c90, action=action@entry=1) at src/main/process.c:1346 #20 0x00005555555866cf in request_running (request=0x555555ca2c90, action=<optimized out>) at src/main/process.c:1535 #21 0x0000555555580617 in request_handler_thread (arg=0x555555c5f250) at src/main/threads.c:678 #22 0x00007ffff625ddf5 in start_thread (arg=0x7ffff1a5f700) at pthread_create.c:308 #23 0x00007ffff5b0e1ad in clone () at ../sysdeps/unix/sysv/linux/x86_64/clone.S:113

2 1