- Freeradius-Users - lists.freeradius.org

If block in authenticate statement
by Franks Andy (IT Technical Architecture Manager) 06 Nov '15

06 Nov '15

Hi all, I'm doing something off-piste again probably. Can I get away with doing an if statement within the mschap auth block? I'm trying to allow peap-eap-mschap inner tunnel auth on certain ssids only; without the if statement, it works ok, but when I check against a control variable containing SSID, it produces this : mschap: --> --nt-response=10fe5a0664f0f3debffdcd61b60865947601331bdefef81c (9) mschap: Program returned code (0) and output 'NT_KEY: CD7018318BC2359E8A362E0557384BEC' (9) mschap: Adding MS-CHAPv2 MPPE keys (9) [mschap] = ok (9) if (!ok) { (9) if (!ok) -> FALSE (9) } # if (( control:SSID == "A_WiFi" ) || ( control:SSID == "Another_WiFi" )) = ok (9) } # Auth-Type MS-CHAP = noop (9) inner-eap: Freeing handler (9) [inner-eap] = reject Mschap returns ok, but the auth returns noop, and thus rejection happens. I've tried various combinations of "ok", handled etc after the if block but I'm probably doing something that's not allowed or better done another way. Auth-type MS-CHAP { if (( control:SSID == "A_WiFi" ) || ( control:SSID == "Another_WiFi" )) { mschap { reject = 1 invalid = 1 } if (!ok) { if (Module-Failure-Message) { update outer.control { Debug-RejectInformation := "%{Module-Failure-Message}" } } reject } } else { # mschap not allowed on this wifi ssid reject } } Thanks as always Andy

2 1

Urgent help, radius is crashing due to Child is hung for request
by bbnlrad＠bbnldevices.in 06 Nov '15

06 Nov '15

Hi, I am new to radius, hence please forgive me if i am asking very basic stupid questions. We have a production box having radius 2.2. it is talking to a mysql server 5.1. The broadband clients are coming in through mikrotik router 6x >From past a month a month we are seeing that the radius is getting into issues intermittently and does not respond. we keep seeing the following errors during that time. ue Nov 3 22:25:59 2015 : Info: WARNING: Child is hung for request 12221 in component <core> module <queue>. Tue Nov 3 22:25:59 2015 : Info: WARNING: Child is hung for request 11643 in component <core> module <queue>. Tue Nov 3 22:25:59 2015 : Info: WARNING: Child is hung for request 12795 in component <core> module <queue>. The connections on the db side is around In the radacct table we see around 8 to 9k users online. the mysql database is running on a dual core with around 1% loadaverage and the user cpu is just getting consume around 12%. Based on this i do presume the db is running fine. A small obseravtion from my team is that if the users crsossed around 10k the the issues starts. Can somebody please do help me out as to what configuration needs to be done in the radius server for a large volume we have around 60k customers, what internal tweaking needs to be done on the radius server side. Also please help me out as to what recommendation needs to set on the db side too. one the radiusd.conf file down below is what i see which is un commented max_request_time = 30 cleanup_delay = 5 max_requests = 2048 thread pool { start_servers = 5 max_servers = 32 min_spare_servers = 3 max_spare_servers = 10 max_requests_per_server = 0 } sql.conf has num_sql_socks = 200 connect_failure_retry_delay = 60 lifetime = 0 max_queries = 0 nas_table = "nas" the db has symbolic-links=0 innodb_stats_on_metadata=0 key_buffer=128M myisam_sort_buffer_size=128M sort_buffer_size=32M innodb_buffer_pool_size=5120M innodb_log_file_size=256M innodb_file_per_table innodb_flush_log_at_trx_commit=2 innodb_flush_method=O_DIRECT when we start seeing the errors in the adius logs, i have tried to login to the mysql from the radius server, it takes time to login. The machine is a quad core with 8 gb ram Your help is greatly appreciated. Thanks Arun

2 2

[freeradius-users] Bug in dictionary.starent (freeradius-3.0.10)
by Aleksander Nycz 05 Nov '15

05 Nov '15

Hello, Please check dictionary.starent for freeradius-3.0.10: ATTRIBUTE SNA-Input-Gigawords 206 integer ATTRIBUTE SN-WiMAX-Auth-Only 206 integer Attribute 'SN-WiMAX-Auth-Only' should have code 306 except 206. Regards Aleksander Nycz -- Aleksander Nycz Chief Designer Telco_021 BSS R&D Comarch SA Phone: +48 17 785 5909 Mobile: +48 691 464 275 website: www.comarch.pl

2 1

Slight issue after having migrated to v3.0.10 from v2.5
by Bertalan Voros 05 Nov '15

05 Nov '15

Hello All, I have just migrated our existing v2.5 server's config to a new one using the most recent stable version. The migration was done by editing each configuration file one by one, none of the files were directly copied. All is well, everything appears to be working as expected apart from one slight problem. There is a mac address check in the Authorize section that doesn't seem to take effect any more. Nobody gets rejected. Code and debug log below. I know it might be staring me in the eye but has been unable to find what could be causing it. Code: if (Called-Station-ID =~ /:SSID-Here$/) { rewrite_calling_station_id if(!"%{sql_mac:SELECT COUNT(*) FROM wifi.macaddress WHERE mac = '%{Calling-Station-ID}' = 1}"){ reject } } Debug log: (991) Received Access-Request Id 39 from 10.x.x.x:40001 to 10.11.0.83:1812 length 170 (991) User-Name = "Nexus7xx" (991) NAS-IP-Address = (991) NAS-Port = 0 (991) Called-Station-Id = "02-18-4A-14-82-B0:SSID-Here" (991) Calling-Station-Id = "BC-EE-7B-A3-6D-D9" (991) Framed-MTU = 1400 (991) NAS-Port-Type = Wireless-802.11 (991) Connect-Info = "CONNECT 0Mbps 802.11b" (991) EAP-Message = 0x02b800061900 (991) State = 0xc63b617ec58378d04d8f1ca50d306f26 (991) Message-Authenticator = 0x16faf8f9d4f9b38c39415aee (991) session-state: No cached attributes (991) # Executing section authorize from file /etc/freeradius/sites-enabled/default (991) authorize { (991) policy filter_username { (991) if (!&User-Name) { (991) if (!&User-Name) -> FALSE (991) if (&User-Name =~ / /) { (991) if (&User-Name =~ / /) -> FALSE (991) if (&User-Name =~ /@.*@/ ) { (991) if (&User-Name =~ /@.*@/ ) -> FALSE (991) if (&User-Name =~ /\.\./ ) { (991) if (&User-Name =~ /\.\./ ) -> FALSE (991) if ((&User-Name =~ /@/) && (&User-Name !~ /(a)(.+)\.(.+)$/)) { (991) if ((&User-Name =~ /@/) && (&User-Name !~ /(a)(.+)\.(.+)$/)) -> FALSE (991) if (&User-Name =~ /\.$/) { (991) if (&User-Name =~ /\.$/) -> FALSE (991) if (&User-Name =~ /(a)\./) { (991) if (&User-Name =~ /(a)\./) -> FALSE (991) } # policy filter_username = notfound (991) [preprocess] = ok (991) if (Called-Station-ID =~ /:SSID-Here$/) { (991) if (Called-Station-ID =~ /:SSID-Here$/) -> TRUE (991) if (Called-Station-ID =~ /:SSID-Here$/) { (991) policy rewrite_calling_station_id { (991) if (Calling-Station-Id =~ /([0-9a-f]{2})[-:]?([0-9a-f]{2})[-:]?([0-9a-f]{2})[-:]?([0-9a-f]{2})[-:]?([0-9a-f]{2})[-:]?([0-9a-f]{2})/i){ (991) if (Calling-Station-Id =~ /([0-9a-f]{2})[-:]?([0-9a-f]{2})[-:]?([0-9a-f]{2})[-:]?([0-9a-f]{2})[-:]?([0-9a-f]{2})[-:]?([0-9a-f]{2})/i) -> TRUE (991) if (Calling-Station-Id =~ /([0-9a-f]{2})[-:]?([0-9a-f]{2})[-:]?([0-9a-f]{2})[-:]?([0-9a-f]{2})[-:]?([0-9a-f]{2})[-:]?([0-9a-f]{2})/i) { (991) update request { (991) EXPAND %{tolower:%{1}-%{2}-%{3}-%{4}-%{5}-%{6}} (991) --> bc-ee-7b-a3-6d-d9 (991) Calling-Station-Id := bc-ee-7b-a3-6d-d9 (991) } # update request = noop (991) } # if (Calling-Station-Id =~ /([0-9a-f]{2})[-:]?([0-9a-f]{2})[-:]?([0-9a-f]{2})[-:]?([0-9a-f]{2})[-:]?([0-9a-f]{2})[-:]?([0-9a-f]{2})/i) = noop (991) ... skipping else for request 991: Preceding "if" was taken (991) } # policy rewrite_calling_station_id = noop (991) if (!"%{sql_mac:SELECT COUNT(*) FROM wifi.macaddress WHERE mac = '%{Calling-Station-ID}' = 1}"){ rlm_sql (sql_mac): Reserved connection (13) (991) Executing select query: SELECT COUNT(*) FROM wifi.macaddress WHERE mac = 'bc-ee-7b-a3-6d-d9' = 1 rlm_sql (sql_mac): Released connection (13) (991) EXPAND %{sql_mac:SELECT COUNT(*) FROM wifi.macaddress WHERE mac = '%{Calling-Station-ID}' = 1} (991) --> 0 (991) if (!"%{sql_mac:SELECT COUNT(*) FROM wifi.macaddress WHERE mac = '%{Calling-Station-ID}' = 1}") -> FALSE (991) } # if (Called-Station-ID =~ /:SSID-Here$/) = noop (991) [mschap] = noop (991) if (!EAP-Message) { (991) if (!EAP-Message) -> FALSE (991) eap: Peer sent EAP Response (code 2) ID 184 length 6 (991) eap: Continuing tunnel setup (991) [eap] = ok (991) } # authorize = ok

1 1

RE: Calling a module name from a dynamic variable
by Franks Andy (IT Technical Architecture Manager) 05 Nov '15

05 Nov '15

Ok, good plan. I'll do that. :-) -----Original Message----- From: Freeradius-Users [mailto:freeradius-users-bounces+andy.franks=sath.nhs.uk@lists.freeradius.org] On Behalf Of Arran Cudbard-Bell Sent: 05 November 2015 15:23 To: FreeRadius users mailing list Subject: Re: Calling a module name from a dynamic variable > On Nov 5, 2015, at 10:15 AM, Franks Andy (IT Technical Architecture Manager) <Andy.Franks(a)sath.nhs.uk> wrote: > > Ok, that settles it, thought as much - I've done some code for switch/case now. > Just one last question - if we previously had something like: > > Auth-type inner-eap { > Inner-eap { > reject = 1 > ok = 1 > invalid = 1 > } > If (!ok) { > .. > } > } > > The question is if I did a switch statement : > > Auth-type inner-eap { > Switch (somevar) { > Case somevalue { > Custom-inner-eap { > Reject =1 > Ok = 1 > Invalid = 1 > } > Case someothervalue { > Custom-other-inner-eap { > Reject =1 > Ok = 1 > Invalid = 1 > } > } > } > If (!ok) { > .. > } > } > > Does the !ok bit still belong to whatever module is called in the switch statement? I guess so, but wanted to make sure the ok doesn't belong to the switch/case block. In that instance you should just set control:Auth-Type and use different Auth-Type sections. -Arran

1 0

RE: Calling a module name from a dynamic variable
by Franks Andy (IT Technical Architecture Manager) 05 Nov '15

05 Nov '15

Ok, that settles it, thought as much - I've done some code for switch/case now. Just one last question - if we previously had something like: Auth-type inner-eap { Inner-eap { reject = 1 ok = 1 invalid = 1 } If (!ok) { .. } } The question is if I did a switch statement : Auth-type inner-eap { Switch (somevar) { Case somevalue { Custom-inner-eap { Reject =1 Ok = 1 Invalid = 1 } Case someothervalue { Custom-other-inner-eap { Reject =1 Ok = 1 Invalid = 1 } } } If (!ok) { .. } } Does the !ok bit still belong to whatever module is called in the switch statement? I guess so, but wanted to make sure the ok doesn't belong to the switch/case block. Thanks -----Original Message----- From: Freeradius-Users [mailto:freeradius-users-bounces+andy.franks=sath.nhs.uk@lists.freeradius.org] On Behalf Of Arran Cudbard-Bell Sent: 05 November 2015 14:53 To: FreeRadius users mailing list Subject: Re: Calling a module name from a dynamic variable > On Nov 5, 2015, at 9:47 AM, Franks Andy (IT Technical Architecture Manager) <Andy.Franks(a)sath.nhs.uk> wrote: > > It's an SQL "named" module, just logs results from post-auth. > Its name is really sql-radius-lan0 or sql-radius-lan1 or whatever, depending on certain circumstances. You can't do that and with the way the code is structured it'd be very hard to support that. Use switch and enumerate the possible modules you want to call. -Arran

2 1

RE: Calling a module name from a dynamic variable
by Franks Andy (IT Technical Architecture Manager) 05 Nov '15

05 Nov '15

It's an SQL "named" module, just logs results from post-auth. Its name is really sql-radius-lan0 or sql-radius-lan1 or whatever, depending on certain circumstances. -----Original Message----- From: Freeradius-Users [mailto:freeradius-users-bounces+andy.franks=sath.nhs.uk@lists.freeradius.org] On Behalf Of Jorge Pereira Sent: 05 November 2015 14:26 To: FreeRadius users mailing list Subject: Re: Calling a module name from a dynamic variable Frank, What is your "mymodule"? a xlat function? tell more about the "mymodule" -- Jorge Pereira On Thu, Nov 5, 2015 at 12:15 PM, Franks Andy (IT Technical Architecture Manager) <Andy.Franks(a)sath.nhs.uk> wrote: > Hi Jorge, > Still the same : > Failed to find "%{%{control:Tmp-String-0}}" as a module or policy. > > Oh well. > Thanks > Andy > > -----Original Message----- > From: Freeradius-Users [mailto:freeradius-users-bounces+andy.franks= > sath.nhs.uk(a)lists.freeradius.org] On Behalf Of Jorge Pereira > Sent: 05 November 2015 13:26 > To: FreeRadius users mailing list > Subject: Re: Calling a module name from a dynamic variable > > Hi Frank, > > try this... > > update control { > Tmp-String-0 := "mymodule" > } > > "%{%{control:Tmp-String-0}}" { > Fail =1 > } > > -- > Jorge Pereira > > On Thu, Nov 5, 2015 at 11:19 AM, Franks Andy (IT Technical > Architecture > Manager) <Andy.Franks(a)sath.nhs.uk> wrote: > > > Hi all, > > Freeradius 3.1 from git. > > > > Just wanted to know if I can do this : > > > > Update control { > > Tmp-String-0 := "mymodule" > > } > > > > "%{control:Tmp-String-0}" { > > Fail =1 > > } > > > > Hopefully it's obvious - I want to prepare a variable and call a > > matching module name from the variable, in this case mymodule. > > It doesn't work at the moment as the string isn't evaluated - it > > just > says: > > > > Failed to find "%{control:Tmp-String-0}" as a module or policy. > > > > If I can't, I can't no worries, I would just stop me searching if I knew. > > > > Thanks > > Andy > > - > > List info/subscribe/unsubscribe? See > > http://www.freeradius.org/list/users.html > - > List info/subscribe/unsubscribe? See > http://www.freeradius.org/list/users.html > > - > List info/subscribe/unsubscribe? See > http://www.freeradius.org/list/users.html > - List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html

2 1

RE: Calling a module name from a dynamic variable
by Franks Andy (IT Technical Architecture Manager) 05 Nov '15

05 Nov '15

Hi Jorge, Still the same : Failed to find "%{%{control:Tmp-String-0}}" as a module or policy. Oh well. Thanks Andy -----Original Message----- From: Freeradius-Users [mailto:freeradius-users-bounces+andy.franks=sath.nhs.uk@lists.freeradius.org] On Behalf Of Jorge Pereira Sent: 05 November 2015 13:26 To: FreeRadius users mailing list Subject: Re: Calling a module name from a dynamic variable Hi Frank, try this... update control { Tmp-String-0 := "mymodule" } "%{%{control:Tmp-String-0}}" { Fail =1 } -- Jorge Pereira On Thu, Nov 5, 2015 at 11:19 AM, Franks Andy (IT Technical Architecture Manager) <Andy.Franks(a)sath.nhs.uk> wrote: > Hi all, > Freeradius 3.1 from git. > > Just wanted to know if I can do this : > > Update control { > Tmp-String-0 := "mymodule" > } > > "%{control:Tmp-String-0}" { > Fail =1 > } > > Hopefully it's obvious - I want to prepare a variable and call a > matching module name from the variable, in this case mymodule. > It doesn't work at the moment as the string isn't evaluated - it just says: > > Failed to find "%{control:Tmp-String-0}" as a module or policy. > > If I can't, I can't no worries, I would just stop me searching if I knew. > > Thanks > Andy > - > List info/subscribe/unsubscribe? See > http://www.freeradius.org/list/users.html - List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html

2 1

Calling a module name from a dynamic variable
by Franks Andy (IT Technical Architecture Manager) 05 Nov '15

05 Nov '15

Hi all, Freeradius 3.1 from git. Just wanted to know if I can do this : Update control { Tmp-String-0 := "mymodule" } "%{control:Tmp-String-0}" { Fail =1 } Hopefully it's obvious - I want to prepare a variable and call a matching module name from the variable, in this case mymodule. It doesn't work at the moment as the string isn't evaluated - it just says: Failed to find "%{control:Tmp-String-0}" as a module or policy. If I can't, I can't no worries, I would just stop me searching if I knew. Thanks Andy

2 1

Incremental Reject delay
by Krzysztof Grobelak 05 Nov '15

05 Nov '15

Hello List, Apologies if this was asked here before. I would like to configure freeRadius to send Access-Reject with values that increment with each failed attempt. I noticed in the mailing list some discussion about an "FreeRADIUS-Response-Delay-Usec" is there an attribute that would allow for full seconds delay? Something like "FreeRADIUS-Response-Delay" maybe? I could then query the database for the last delay and increment it accordingly like such: update reply { Tmp-String-0 := "%{sql:SELECT delay+delay FROM failed_login_delay WHERE username=&User-Name}" FreeRADIUS-Response-Delay := &Tmp-String-0 } I hope this does makes sense... Obviously i'm aware of the reject_delay setting in radiusd.conf but I would like to be able to increment the delay dynamically. Or is there some other obvious way to do this? Thanks in advance. Regards, Krzysztof Airspeed Telecom

3 7