- Freeradius-Users - lists.freeradius.org

Freeradius and VMPS MAC problem
by Daniel Pogac 29 Oct '15

29 Oct '15

Hi, I'm trying to FreeRADIUS 3.0.4 with MySQL backend and VMPS on CentOS 7.1 64bit. Everything seems to work, except one thing. When i testing VMPS with vqpcli.pl, FreeRADIUS shows in debug other MAC than i send by vqpcli.pl. This is request what i send by vqpcli.pl: [root@centos7 tmp]# ./vqpcli.pl -s localhost -v ISEPP -w 10.0.0.1 -i 2/4 -m 0010.a49f.30e3 ============================== MESSAGE SENT: 0000000 0101 0600 0000 3412 0000 010c 0400 000a 0000010 0100 0000 020c 0300 2f32 0034 0c00 0003 0000020 0000 0c00 0004 4905 4553 5050 0000 070c 0000030 0100 0000 0c00 0006 0006 a410 309f 00e3 000003f ============================== MESSAGE RECV: 0000000 0201 0200 0000 3412 0000 030c 1900 6c70 0000010 6165 6573 755f 6573 725f 6165 5f6c 6c76 0000020 6e61 685f 7265 0065 0c00 0008 0006 a410 0000030 309f 00e3 0000033 ============================== Vlan: please_use_real_vlan_here MAC Address: 0010a49f30e3 Status: ALLOW and this is from debug of FrreeRADIUS: VMPS-Packet-Type = VMPS-Join-Request VMPS-Error-Code = VMPS-No-Error VMPS-Sequence-Number = 4660 VMPS-Client-IP-Address = 10.0.0.1 VMPS-Port-Name = '2/4' VMPS-VLAN-Name = '' VMPS-Domain-Name = 'ISEPP' VMPS-Unknown = 0x00 VMPS-MAC = f0:a6:c0:15:55:7f (0) Received Access-Request packet from host 127.0.0.1 port 34832, id=4660, length=63 (0) VMPS-Packet-Type = VMPS-Join-Request (0) VMPS-Error-Code = VMPS-No-Error (0) VMPS-Sequence-Number = 4660 (0) VMPS-Client-IP-Address = 10.0.0.1 (0) VMPS-Port-Name = '2/4' (0) VMPS-VLAN-Name = '' (0) VMPS-Domain-Name = 'ISEPP' (0) VMPS-Unknown = 0x00 (0) VMPS-MAC = f0:a6:c0:15:55:7f Doing VMPS (0) vmps { (0) [mac2vlan] = ok (0) update reply { (0) VMPS-Packet-Type = VMPS-Join-Response (0) EXPAND %{VMPS-Mac} (0) --> f0:a6:c0:15:55:7f (0) VMPS-Cookie = f0:a6:c0:15:55:7f (0) VMPS-VLAN-Name = 'please_use_real_vlan_here' (0) } # update reply = noop (0) if (VMPS-Packet-Type == VMPS-Reconfirm-Request) (0) if (VMPS-Packet-Type == VMPS-Reconfirm-Request) -> FALSE (0) } # vmps = ok Done VMPS (0) vmps { (0) [mac2vlan] = ok (0) update reply { (0) VMPS-Packet-Type = VMPS-Join-Response (0) EXPAND %{VMPS-Mac} (0) --> f0:a6:c0:15:55:7f (0) VMPS-Cookie = f0:a6:c0:15:55:7f (0) VMPS-VLAN-Name = 'please_use_real_vlan_here' (0) } # update reply = noop (0) if (VMPS-Packet-Type == VMPS-Reconfirm-Request) (0) if (VMPS-Packet-Type == VMPS-Reconfirm-Request) -> FALSE (0) } # vmps = ok (0) Sending Access-Accept packet to host 127.0.0.1 port 34832, id=4660, length=0 (0) VMPS-Packet-Type = VMPS-Join-Response (0) VMPS-Cookie = f0:a6:c0:15:55:7f (0) VMPS-VLAN-Name = 'please_use_real_vlan_here' VMPS-VLAN-Name = 'please_use_real_vlan_here' VMPS-Cookie = f0:a6:c0:15:55:7f (0) Finished request Waking up in 0.3 seconds. Waking up in 4.6 seconds. (0) Cleaning up request packet ID 4660 with timestamp +312 As you can see I'm sending MAC:00:10:a4:9f:30:e3 but in debug log is MAC: f0:a6:c0:15:55:7f. If i ran vqpcli.pl three times the MAC address in debug change to another. Can some explain to me what am I doing wrong ? Daniel

2 2

VMPS with MySQL default VLAN
by Daniel Pogac 29 Oct '15

29 Oct '15

Good afternoon. I've got problem with configuring VMPS with MySQL and default VLAN. This is relevant part of vmps config which i use: update reply { &VMPS-Packet-Type = VMPS-Join-Response &VMPS-Cookie = &VMPS-Mac &VMPS-VLAN-Name = "Public_INET" # If you have VLAN's in a database, you can select # the VLAN name based on the MAC address. # &VMPS-VLAN-Name = "%{sql:select vlan from mac2vlan where mac='%{VMPS-Mac}'}" } In this configuration, VMPS always return VLAN value as Public_INET. Even if i use MAC address which is in MySQL database. In debug output i can see that VLAN is successfully returned from MySQL, but return from FreeRADIUS is Public_INET. Debug output is as follows : VMPS-Packet-Type = VMPS-Join-Request VMPS-Error-Code = VMPS-No-Error VMPS-Sequence-Number = 4660 VMPS-Client-IP-Address = 127.0.0.1 VMPS-Port-Name = "Fa0/1" VMPS-VLAN-Name = "" VMPS-Domain-Name = "" VMPS-Unknown = 0x00 VMPS-MAC = 68:f7:28:e7:d8:ec (1) Received Access-Request Id 4660 from 127.0.0.1:59323 to 127.0.0.1:1589 length 60 (1) VMPS-Packet-Type = VMPS-Join-Request (1) VMPS-Error-Code = VMPS-No-Error (1) VMPS-Sequence-Number = 4660 (1) VMPS-Client-IP-Address = 127.0.0.1 (1) VMPS-Port-Name = "Fa0/1" (1) VMPS-VLAN-Name = "" (1) VMPS-Domain-Name = "" (1) VMPS-Unknown = 0x00 (1) VMPS-MAC = 68:f7:28:e7:d8:ec Doing VMPS (1) vmps { (1) if (!&VMPS-Mac) { (1) if (!&VMPS-Mac) -> FALSE (1) [mac2vlan] = ok (1) update reply { (1) &VMPS-Packet-Type = VMPS-Join-Response (1) &VMPS-Cookie = &VMPS-Mac -> 68:f7:28:e7:d8:ec (1) &VMPS-VLAN-Name = "Public_INET" (1) EXPAND %{User-Name} (1) --> (1) SQL-User-Name set to '' rlm_sql (sql): Reserved connection (2) (1) Executing select query: select vlan from mac2vlan where mac='68:f7:28:e7:d8:ec' rlm_sql (sql): Released connection (2) rlm_sql (sql): Need 4 more connections to reach 10 spares rlm_sql (sql): Opening additional connection (6), 1 of 26 pending slots used rlm_sql_mysql: Starting connect to MySQL server rlm_sql_mysql: Connected to database 'radius' on Localhost via UNIX socket, server version 5.1.73, protocol version 10 (1) EXPAND %{sql:select vlan from mac2vlan where mac='%{VMPS-Mac}'} (1) --> OFFICE (1) VMPS-VLAN-Name = OFFICE (1) } # update reply = noop (1) if (&VMPS-Packet-Type == VMPS-Reconfirm-Request){ (1) if (&VMPS-Packet-Type == VMPS-Reconfirm-Request) -> FALSE (1) } # vmps = ok Done VMPS (1) vmps { (1) if (!&VMPS-Mac) { (1) if (!&VMPS-Mac) -> FALSE (1) [mac2vlan] = ok (1) update reply { (1) &VMPS-Packet-Type = VMPS-Join-Response (1) &VMPS-Cookie = &VMPS-Mac -> 68:f7:28:e7:d8:ec (1) &VMPS-VLAN-Name = "Public_INET" (1) EXPAND %{User-Name} (1) --> (1) SQL-User-Name set to '' rlm_sql (sql): Reserved connection (3) (1) Executing select query: select vlan from mac2vlan where mac='68:f7:28:e7:d8:ec' rlm_sql (sql): Released connection (3) (1) EXPAND %{sql:select vlan from mac2vlan where mac='%{VMPS-Mac}'} (1) --> OFFICE (1) VMPS-VLAN-Name = OFFICE (1) } # update reply = noop (1) if (&VMPS-Packet-Type == VMPS-Reconfirm-Request){ (1) if (&VMPS-Packet-Type == VMPS-Reconfirm-Request) -> FALSE (1) } # vmps = ok (1) Sent Access-Accept Id 4660 from 127.0.0.1:1589 to 127.0.0.1:59323 length 0 VMPS-VLAN-Name = "Public_INET" VMPS-Cookie = 68:f7:28:e7:d8:ec (1) Finished request (1) Cleaning up request packet ID 4660 with timestamp +24 Ready to process requests When i place first mysql request and then i set default VLAN, than returned VLAN from VMPS is correct when i use MAC address which is in DB, but when i use other MAC returned VLAN is empty. Config as follows: update reply { &VMPS-Packet-Type = VMPS-Join-Response &VMPS-Cookie = &VMPS-Mac # If you have VLAN's in a database, you can select # the VLAN name based on the MAC address. # &VMPS-VLAN-Name = "%{sql:select vlan from mac2vlan where mac='%{VMPS-Mac}'}" &VMPS-VLAN-Name = "Public_INET" } Debug output with MAC from DB: VMPS-Packet-Type = VMPS-Join-Request VMPS-Error-Code = VMPS-No-Error VMPS-Sequence-Number = 4660 VMPS-Client-IP-Address = 127.0.0.1 VMPS-Port-Name = "Fa0/1" VMPS-VLAN-Name = "" VMPS-Domain-Name = "" VMPS-Unknown = 0x00 VMPS-MAC = 68:f7:28:e7:d8:ec (0) Received Access-Request Id 4660 from 127.0.0.1:60360 to 127.0.0.1:1589 length 60 (0) VMPS-Packet-Type = VMPS-Join-Request (0) VMPS-Error-Code = VMPS-No-Error (0) VMPS-Sequence-Number = 4660 (0) VMPS-Client-IP-Address = 127.0.0.1 (0) VMPS-Port-Name = "Fa0/1" (0) VMPS-VLAN-Name = "" (0) VMPS-Domain-Name = "" (0) VMPS-Unknown = 0x00 (0) VMPS-MAC = 68:f7:28:e7:d8:ec Doing VMPS (0) vmps { (0) if (!&VMPS-Mac) { (0) if (!&VMPS-Mac) -> FALSE (0) [mac2vlan] = ok (0) update reply { (0) &VMPS-Packet-Type = VMPS-Join-Response (0) &VMPS-Cookie = &VMPS-Mac -> 68:f7:28:e7:d8:ec (0) EXPAND %{User-Name} (0) --> (0) SQL-User-Name set to '' rlm_sql (sql): Reserved connection (0) (0) Executing select query: select vlan from mac2vlan where mac='68:f7:28:e7:d8:ec' rlm_sql (sql): Released connection (0) rlm_sql (sql): Need 5 more connections to reach 10 spares rlm_sql (sql): Opening additional connection (5), 1 of 27 pending slots used rlm_sql_mysql: Starting connect to MySQL server rlm_sql_mysql: Connected to database 'radius' on Localhost via UNIX socket, server version 5.1.73, protocol version 10 (0) EXPAND %{sql:select vlan from mac2vlan where mac='%{VMPS-Mac}'} (0) --> OFFICE (0) VMPS-VLAN-Name = OFFICE (0) &VMPS-VLAN-Name = "Public_INET" (0) } # update reply = noop (0) if (&VMPS-Packet-Type == VMPS-Reconfirm-Request){ (0) if (&VMPS-Packet-Type == VMPS-Reconfirm-Request) -> FALSE (0) } # vmps = ok Done VMPS (0) vmps { (0) if (!&VMPS-Mac) { (0) if (!&VMPS-Mac) -> FALSE (0) [mac2vlan] = ok (0) update reply { (0) &VMPS-Packet-Type = VMPS-Join-Response (0) &VMPS-Cookie = &VMPS-Mac -> 68:f7:28:e7:d8:ec (0) EXPAND %{User-Name} (0) --> (0) SQL-User-Name set to '' rlm_sql (sql): Reserved connection (1) (0) Executing select query: select vlan from mac2vlan where mac='68:f7:28:e7:d8:ec' rlm_sql (sql): Released connection (1) (0) EXPAND %{sql:select vlan from mac2vlan where mac='%{VMPS-Mac}'} (0) --> OFFICE (0) VMPS-VLAN-Name = OFFICE (0) &VMPS-VLAN-Name = "Public_INET" (0) } # update reply = noop (0) if (&VMPS-Packet-Type == VMPS-Reconfirm-Request){ (0) if (&VMPS-Packet-Type == VMPS-Reconfirm-Request) -> FALSE (0) } # vmps = ok (0) Sent Access-Accept Id 4660 from 127.0.0.1:1589 to 127.0.0.1:60360 length 0 VMPS-VLAN-Name = "OFFICE" VMPS-Cookie = 68:f7:28:e7:d8:ec (0) Finished request (0) Cleaning up request packet ID 4660 with timestamp +5 Ready to process requests This is debug output with MAC not present in DB: VMPS-Packet-Type = VMPS-Join-Request VMPS-Error-Code = VMPS-No-Error VMPS-Sequence-Number = 4660 VMPS-Client-IP-Address = 127.0.0.1 VMPS-Port-Name = "Fa0/1" VMPS-VLAN-Name = "" VMPS-Domain-Name = "" VMPS-Unknown = 0x00 VMPS-MAC = 68:f7:28:e7:d8:ea (1) Received Access-Request Id 4660 from 127.0.0.1:58809 to 127.0.0.1:1589 length 60 (1) VMPS-Packet-Type = VMPS-Join-Request (1) VMPS-Error-Code = VMPS-No-Error (1) VMPS-Sequence-Number = 4660 (1) VMPS-Client-IP-Address = 127.0.0.1 (1) VMPS-Port-Name = "Fa0/1" (1) VMPS-VLAN-Name = "" (1) VMPS-Domain-Name = "" (1) VMPS-Unknown = 0x00 (1) VMPS-MAC = 68:f7:28:e7:d8:ea Doing VMPS (1) vmps { (1) if (!&VMPS-Mac) { (1) if (!&VMPS-Mac) -> FALSE (1) [mac2vlan] = ok (1) update reply { (1) &VMPS-Packet-Type = VMPS-Join-Response (1) &VMPS-Cookie = &VMPS-Mac -> 68:f7:28:e7:d8:ea (1) EXPAND %{User-Name} (1) --> (1) SQL-User-Name set to '' rlm_sql (sql): Reserved connection (2) (1) Executing select query: select vlan from mac2vlan where mac='68:f7:28:e7:d8:ea' (1) SQL query returned no results rlm_sql (sql): Released connection (2) rlm_sql (sql): Need 4 more connections to reach 10 spares rlm_sql (sql): Opening additional connection (6), 1 of 26 pending slots used rlm_sql_mysql: Starting connect to MySQL server rlm_sql_mysql: Connected to database 'radius' on Localhost via UNIX socket, server version 5.1.73, protocol version 10 (1) EXPAND %{sql:select vlan from mac2vlan where mac='%{VMPS-Mac}'} (1) --> (1) VMPS-VLAN-Name = (1) &VMPS-VLAN-Name = "Public_INET" (1) } # update reply = noop (1) if (&VMPS-Packet-Type == VMPS-Reconfirm-Request){ (1) if (&VMPS-Packet-Type == VMPS-Reconfirm-Request) -> FALSE (1) } # vmps = ok Done VMPS (1) vmps { (1) if (!&VMPS-Mac) { (1) if (!&VMPS-Mac) -> FALSE (1) [mac2vlan] = ok (1) update reply { (1) &VMPS-Packet-Type = VMPS-Join-Response (1) &VMPS-Cookie = &VMPS-Mac -> 68:f7:28:e7:d8:ea (1) EXPAND %{User-Name} (1) --> (1) SQL-User-Name set to '' rlm_sql (sql): Reserved connection (3) (1) Executing select query: select vlan from mac2vlan where mac='68:f7:28:e7:d8:ea' (1) SQL query returned no results rlm_sql (sql): Released connection (3) (1) EXPAND %{sql:select vlan from mac2vlan where mac='%{VMPS-Mac}'} (1) --> (1) VMPS-VLAN-Name = (1) &VMPS-VLAN-Name = "Public_INET" (1) } # update reply = noop (1) if (&VMPS-Packet-Type == VMPS-Reconfirm-Request){ (1) if (&VMPS-Packet-Type == VMPS-Reconfirm-Request) -> FALSE (1) } # vmps = ok (1) Sent Access-Accept Id 4660 from 127.0.0.1:1589 to 127.0.0.1:58809 length 0 VMPS-VLAN-Name = "" VMPS-Cookie = 68:f7:28:e7:d8:ea (1) Finished request (1) Cleaning up request packet ID 4660 with timestamp +44 Ready to process requests It looks like first value set to attribute &VMPS-VLAN-Name is mandatory and it cant be overwrited. Is there any possibility to read VLANs from DB but if MAC is not in DB table to set some default VLAN? Thank You Daniel

1 0

rlm_digest failing after upgrade from 2.1.12 to 2.2.5
by Daniel Pocock 29 Oct '15

29 Oct '15

Hi, We just updated a Debian server from wheezy to jessie The freeradius server package updated from 2.1.12+dfsg-1.2 to 2.2.5+dfsg-0.2 This particular server is used for SIP users (for debian.org itself) The users are in a text file and it is loaded like this in radiusd.conf: modules { $INCLUDE modules/attr_filter $INCLUDE modules/digest passwd rtc_users { filename = /var/local/rtc-passwords.freerad format = "*User-Name:Digest-HA1:" hashsize = 1000 ignorenislike = no allowmultiplekeys = no } } Since the upgrade, the server is complaining: Auth: [digest] Cleartext-Password or Digest-HA1 is required for authentication. When the server is started or given HUP, it doesn't give any hints that anything is wrong: Wed Oct 21 07:51:05 2015 : Info: Received HUP signal. Wed Oct 21 07:51:05 2015 : Info: HUP - Re-reading configuration files Wed Oct 21 07:51:05 2015 : Info: HUP - loading modules Wed Oct 21 07:51:05 2015 : Info: Module: Reloaded module "attr_filter.access_reject" Wed Oct 21 07:51:05 2015 : Info: Module: Reloaded module "rtc_users" Wed Oct 21 07:51:05 2015 : Info: Loaded virtual server <default> Wed Oct 21 07:51:05 2015 : Info: Loaded virtual server rtc.debian.org I looked at the changelog, it only mentions passwd in one place and digest is not mentioned anywhere: FreeRADIUS 2.2.0 Mon 10 Sep 2012 12:00:00 CEST, urgency=medium Feature improvements * 100% configuration file compatible with 2.1.x. The only fix needed is to disallow "hashsize=0" for rlm_passwd The freeradius-client library is being used, it is the same version before and after the upgrade, 1.1.6. Can anybody give any feedback on this or suggest the best way to troubleshoot the issue? Regards, Daniel

3 8

Setting up a Proxy Server as a load balancer to bypass winbind/samba bottleneck
by Walter Reynolds 29 Oct '15

29 Oct '15

We are running to the same problems with winbind/samba bottlenecks as many other universities. While one of our servers does quite well we are starting to get hung modules at peak hitting as many as 150 authentications per second while averaging over 70/sec for several minutes. Since wireless controllers are getting bigger and with Cisco we are limited to sending radius auth request to one server at a time we need another way to balance things out. I thought setting up a freeradius proxy that pointed to two separate servers might be a way to go about this. Problem is I thought I read somewhere in the freeradius lists that that would create other problems, but now I can not find that. I also am not sure I followed this right, but in looking at proxy home_server_pool it looks like my options for load balancing will still send all auth request from my one large controller to a single server as the source IP will all be the same under client-balance. Thanks. ------------------------ Walter Reynolds Principal Systems Security Development Engineer Information and Technology Services University of Michigan (734) 615-9438

7 6

Return codes in policies
by Jonathan Gazeley 29 Oct '15

29 Oct '15

Hi folks, I am porting my FreeRADIUS config from 2.x to 3.x and I've run into an issue I don't understand. I have this policy "wism-checks" which allows the server to respond to probes sent by the WLAN controllers. It is invoked in the authorize section of my virtual servers. wism-checks { if (Service-Type == "NAS-Prompt-User") { if (NAS-IP-Address =~ /^172\.17\.107\./) { if (User-Name =~ /^wism\-probe/) { update control { Auth-Type := Accept } updated } else { reject } } updated = return } } This works quite happily on FR2 but chokes on FR3 with the following: /etc/raddb/policy.d/policies[178] Invalid return code assigment inside of a if section /etc/raddb/policy.d/policies[166]: Failed to parse "if" subsection. Line 178 is the "updated = return" line. I've read the Fail-over docs[1] but that seems to deal with overriding return codes from modules rather than setting them explicitly in a policy. What's the best way to tweak this? Thanks, Jonathan [1] http://wiki.freeradius.org/config/Fail-over

3 4

3.0.10 fails to start (OpenSuse 13.2)
by Thomas Stather 29 Oct '15

29 Oct '15

Hello I installed freeradius-server 3.0.10 from the OpenSuse "network" repo (OpenSuse OBS) -------------------------------------- radius1:~ # zypper info freeradius-server Loading repository data... Reading installed packages... Information for package freeradius-server: ------------------------------------------ Repository: Networking services and related tools (openSUSE_Tumbleweed) Name: freeradius-server Version: 3.0.10-91.3 Arch: x86_64 Vendor: obs://build.opensuse.org/network Installed: Yes Status: up-to-date Installed Size: 3.0 MiB Summary: Very Highly Configurable Radius Server Description: The FreeRADIUS server has a number of features found in other servers and additional features not found in any other server. -------------------------------------- but when i try to start it, i get: -------------------------------------- radius1:~ # radiusd -X libssl version mismatch. built: 1000204f linked: 100010bf -------------------------------------- How can i fix this? I assume this is because of a mismatched OpenSSL version. The info of the installed package is: -------------------------------------- radius1:~ # zypper info openssl Loading repository data... Reading installed packages... Information for package openssl: -------------------------------- Repository: openSUSE-13.2-Update Name: openssl Version: 1.0.1k-2.24.1 Arch: x86_64 Vendor: openSUSE Installed: Yes Status: up-to-date Installed Size: 1.4 MiB Summary: Secure Sockets and Transport Layer Security Description: The OpenSSL Project is a collaborative effort to develop a robust, commercial-grade, full-featured, and open source toolkit implementing the Secure Sockets Layer (SSL v2/v3) and Transport Layer Security (TLS v1) protocols with full-strength cryptography. The project is managed by a worldwide community of volunteers that use the Internet to communicate, plan, and develop the OpenSSL toolkit and its related documentation. Derivation and License OpenSSL is based on the excellent SSLeay library developed by Eric A. Young and Tim J. Hudson. The OpenSSL toolkit is licensed under an Apache-style license, which basically means that you are free to get it and to use it for commercial and noncommercial purposes. -------------------------------------- Best, Thomas -- Thomas Stather IT Services Tel: +49 6221-486 628 Fax: +49 6221-486 561 ------------------------------------------------------------------------ Max Planck Institute for Medical Research (MPImF) Jahnstrasse 29, 69120 Heidelberg Germany

8 28

Define coa_server for clients in nas table
by Bryan Mesich 28 Oct '15

28 Oct '15

Hello, I have a functioning FreeRadius 3.0.10 installation that currently uses the rlm_sql module for accounting and authorization. The setup is composed of 2 FreeRadius servers with a MariaDB/Galara cluster. I'm interested in using the nas table in the database rather than clients.conf when configuring my clients. Each NAS "client" has a corresponding home_server defined in sites-enabled/originate-coa, which the client gets tied to with the coa_server parameter in clients.conf: [clients.conf] client hk-wlc1 { ipaddr = 10.129.3.13 secret = secret nas_type = cisco coa_server = hk-wlc1-coa } [originate-coa] home_server hk-wlc1-coa { type = coa ipaddr = 10.129.3.13 port = 1700 secret = secret coa { irt = 2 mrt = 16 mrc = 5 mrd = 30 } } The provided radius schema does not include a coa_server field in the nas table. One would think that would be needed in order for clients that are defined in the db to use the appropriate CoA server. Looking at the source code, I located the function generate_sql_clients(), which appears to parse the records returned from the query defined for the particular DB platform (mods-config/sql/main/mysql/queries.conf in this case). It doesn't appear to be possible to define a coa_server for a client that is defined in the nas table. Is it possible for FreeRadius to identify the appropriate CoA home_server based on the IP address that originated the request (thus not requiring the coa_server parameter)? Bryan

3 2

Re: Welcome to the "Freeradius-Users" mailing list
by Orion Timbale 28 Oct '15

28 Oct '15

Thanks to all freeradius users!!!! I'm using freeradius v3.0.4 under Fedora 22. I try to proxy some Access-Request and add some check item/attribute before proxying. The radiusd -X output regarding this problem looks like this: "Wed Oct 21 18:31:19 2015 : Debug: (0) # Executing section pre-proxy from file /etc/raddb/sites-enabled/default Wed Oct 21 18:31:19 2015 : Debug: (0) pre-proxy { Wed Oct 21 18:31:19 2015 : Debug: (0) node.pre-proxy node.pre-proxy { Wed Oct 21 18:31:19 2015 : Debug: (0) if ("%{request:Packet-Type}" == 'Access-Request') Wed Oct 21 18:31:19 2015 : Debug: (0) EXPAND %{request:Packet-Type} Wed Oct 21 18:31:19 2015 : Debug: (0) --> Access-Request Wed Oct 21 18:31:19 2015 : Debug: (0) if ("%{request:Packet-Type}" == 'Access-Request') -> TRUE Wed Oct 21 18:31:19 2015 : Debug: (0) if ("%{request:Packet-Type}" == 'Access-Request') { Wed Oct 21 18:31:19 2015 : Debug: (0) update proxy-request { Wed Oct 21 18:31:19 2015 : Debug: (0) &NodeID == '0000000002' Wed Oct 21 18:31:19 2015 : Debug: (0) No existing attribute to filter, adding instead Wed Oct 21 18:31:19 2015 : Debug: (0) } # update proxy-request = noop Wed Oct 21 18:31:19 2015 : Debug: (0) } # if ("%{request:Packet-Type}" == 'Access-Request') = noop Wed Oct 21 18:31:19 2015 : Debug: (0) } # byon-node.pre-proxy byon-node.pre-proxy = noop Wed Oct 21 18:31:19 2015 : Debug: (0) } # pre-proxy = noop Wed Oct 21 18:31:19 2015 : Debug: (0) proxy: Trying to allocate ID (0/2) Wed Oct 21 18:31:19 2015 : Debug: (0) proxy: Failed allocating ID: Failed finding socket, caller must allocate a new one Wed Oct 21 18:31:19 2015 : Debug: (0) proxy: Trying to open a new listener to the home server Wed Oct 21 18:31:19 2015 : Debug: Opening new proxy socket 'proxy address * port 0' Wed Oct 21 18:31:19 2015 : Debug: Listening on proxy address * port 45141 Wed Oct 21 18:31:19 2015 : Debug: (0) proxy: Trying to allocate ID (1/2) Wed Oct 21 18:31:19 2015 : Debug: (0) proxy: request is now in proxy hash Wed Oct 21 18:31:19 2015 : Debug: (0) proxy: allocating destination 192.168.42.193 port 1812 - Id 16 Wed Oct 21 18:31:19 2015 : Debug: (0) Proxying request to home server 192.168.42.193 port 1812 timeout 14.000000 Wed Oct 21 18:31:19 2015 : Debug: (0) Sending Access-Request packet to host 192.168.42.193 port 1812, id=16, length=0 Wed Oct 21 18:31:19 2015 : Debug: (0) User-Name = 'fname.lname(a)my-network.com' Wed Oct 21 18:31:19 2015 : Debug: (0) User-Password = 'passme' Wed Oct 21 18:31:19 2015 : Debug: (0) NAS-IP-Address = 127.0.0.1 Wed Oct 21 18:31:19 2015 : Debug: (0) NAS-Port = 100 Wed Oct 21 18:31:19 2015 : Debug: (0) Message-Authenticator = 0x29fc545638a7a1c6ec10b5f7e2c860c9 Wed Oct 21 18:31:19 2015 : Debug: (0) Event-Timestamp = 'Oct 21 2015 18:31:19 CEST' Wed Oct 21 18:31:19 2015 : Debug: (0) Realm = 'DEFAULT' Wed Oct 21 18:31:19 2015 : Debug: (0) Proxy-State = 0x3337 Wed Oct 21 18:31:19 2015 : Debug: (0) NodeID == '0000000002' Sending Access-Request Id 16 from 0.0.0.0:45141 to 192.168.42.193:1812 User-Name = 'fname.lname(a)my-network.com' User-Password = 'passme' NAS-IP-Address = 127.0.0.1 NAS-Port = 100 Message-Authenticator = 0x29fc545638a7a1c6ec10b5f7e2c860c9 Event-Timestamp = 'Oct 21 2015 18:31:19 CEST' Proxy-State = 0x3337" As you can see Realm and NodeID are not passed to the radius proxy in the access request. Can anyone suggest me something ? Sincerely yours. Tim

2 3

problem compiling eapol_test under OpenSuse 13.2
by Thomas Stather 28 Oct '15

28 Oct '15

Hello I wanted to compile the eapol_test binary to test my eap setup (Eduroam service, EAP-PEAP/MSCHAPv2 and EAP-TTLS/MSCHAPv2). The manual is here: http://deployingradius.com/scripts/eapol_test/ I downloaded the 2.5 source, additionally the OpenSuse Pattern "devel_basis" and the package "libopenss-devel" However when i do a "make eapol_test" i get: ... CC ../src/utils/ip_addr.c /usr/lib64/gcc/x86_64-suse-linux/4.8/../../../../x86_64-suse-linux/bin/ld: cannot find -lnl collect2: error: ld returned 1 exit status Makefile:1677: recipe for target 'eapol_test' failed make: *** [eapol_test] Error 1 Does sombody have a clue? Best, Thomas -- Thomas Stather IT Services Tel: +49 6221-486 628 Fax: +49 6221-486 561 ------------------------------------------------------------------------ Max Planck Institute for Medical Research (MPImF) Jahnstrasse 29, 69120 Heidelberg Germany

2 2

RV: FreeRadius 3.0.6 failed
by Oscar Jofre 27 Oct '15

27 Oct '15

Hi, I have configuring a new FreeRadius 3.0.6 on Centos7 and MariaDB. Is has been working ok (had to increase max connextion and other values) but now I'm getting the radius down every time. MariaDB has radacct with over 10.000.000 rows. I'm connecting 10.000 PPTP users authentication with this Radius, Interim every 30seconds and client-pptp-session 10minutes, but after start mariadb and freeradius exits with this message: [root@rad ~]# systemctl status radiusd radiusd.service - FreeRADIUS high performance RADIUS server. Loaded: loaded (/usr/lib/systemd/system/radiusd.service; disabled) Active: failed (Result: signal) since mar 2015-10-27 22:41:14 CET; 17min ago Process: 12086 ExecStart=/usr/sbin/radiusd -d /etc/raddb (code=exited, status=0/SUCCESS) Process: 12083 ExecStartPre=/usr/sbin/radiusd -C (code=exited, status=0/SUCCESS) Process: 12080 ExecStartPre=/bin/chown -R radiusd.radiusd /var/run/radiusd (code=exited, status=0/SUCCESS) Main PID: 12090 (code=killed, signal=ABRT) CGroup: /system.slice/radiusd.service oct 27 22:36:16 rad.aaa.com systemd[1]: Starting FreeRADIUS high performance RADIUS server.... oct 27 22:36:17 rad.aaa.com systemd[1]: Started FreeRADIUS high performance RADIUS server.. oct 27 22:41:14 rad.aaa.com systemd[1]: radiusd.service: main process exited, code=killed, status=6/ABRT oct 27 22:41:14 rad.aaa.com systemd[1]: Unit radiusd.service entered failed state. Last Lines from radius.log Tue Oct 27 23:14:20 2015 : ERROR: (73758) ERROR: <queue> : Received conflicting packet from client 0.0.0.0/0 port 53359 - ID: 220 due to unfinished request. Giving up on old request. Tue Oct 27 23:14:20 2015 : ERROR: (73736) ERROR: detail : Received conflicting packet from client 0.0.0.0/0 port 48163 - ID: 146 due to unfinished request. Giving up on old request. Tue Oct 27 23:14:20 2015 : ERROR: (73737) ERROR: detail : Received conflicting packet from client 0.0.0.0/0 port 59445 - ID: 144 due to unfinished request. Giving up on old request. Tue Oct 27 23:14:20 2015 : Warning: No such configuration item .type..query Tue Oct 27 23:14:20 2015 : Warning: No such configuration item .type..query Tue Oct 27 23:14:20 2015 : ERROR: (73751) ERROR: <queue> : Received conflicting packet from client 0.0.0.0/0 port 33445 - ID: 148 due to unfinished request. Giving up on old request. Tue Oct 27 23:14:20 2015 : ERROR: (73757) ERROR: <queue> : Received conflicting packet from client 0.0.0.0/0 port 53686 - ID: 147 due to unfinished request. Giving up on old request. Tue Oct 27 23:14:20 2015 : Warning: No such configuration item .type..query Tue Oct 27 23:14:20 2015 : ERROR: (73752) ERROR: detail : Received conflicting packet from client 0.0.0.0/0 port 43723 - ID: 144 due to unfinished request. Giving up on old request. Tue Oct 27 23:14:20 2015 : ERROR: (73753) ERROR: sql : Received conflicting packet from client 0.0.0.0/0 port 44422 - ID: 145 due to unfinished request. Giving up on old request. Also I have all this warnings/errors on log. What is really important to fix and how ??? 1) START RADIUS Tue Oct 27 22:36:17 2015 : Warning: No 'ipaddr' or 'ipv4addr' or 'ipv6addr' field found in client 0.0.0.0/0. Please fix your configuration Tue Oct 27 22:36:17 2015 : Warning: Support for old-style clients will be removed in a future release Tue Oct 27 22:36:17 2015 : Info: rlm_sql (sql): Driver rlm_sql_mysql (module rlm_sql_mysql) loaded and linked Tue Oct 27 22:36:17 2015 : Info: rlm_sql (sql): Attempting to connect to database "radius" Tue Oct 27 22:36:17 2015 : Info: Loaded virtual server <default> Tue Oct 27 22:36:17 2015 : Warning: Ignoring "ldap" (see raddb/mods-available/README.rst) Tue Oct 27 22:36:17 2015 : Info: Loaded virtual server default Tue Oct 27 22:36:17 2015 : Info: Loaded virtual server inner-tunnel Tue Oct 27 22:36:17 2015 : Warning: No 'ipaddr' or 'ipv4addr' or 'ipv6addr' field found in client 0.0.0.0/0. Please fix your configuration Tue Oct 27 22:36:17 2015 : Warning: Support for old-style clients will be removed in a future release Tue Oct 27 22:36:17 2015 : Info: rlm_sql (sql): Driver rlm_sql_mysql (module rlm_sql_mysql) loaded and linked Tue Oct 27 22:36:17 2015 : Info: rlm_sql (sql): Attempting to connect to database "radius" Tue Oct 27 22:36:17 2015 : Info: rlm_sql (sql): Opening additional connection (0) Tue Oct 27 22:36:17 2015 : Info: Loaded virtual server <default> Tue Oct 27 22:36:17 2015 : Warning: Ignoring "ldap" (see raddb/mods-available/README.rst) Tue Oct 27 22:36:17 2015 : Info: Loaded virtual server default Tue Oct 27 22:36:17 2015 : Info: Loaded virtual server inner-tunnel Tue Oct 27 22:36:17 2015 : Info: Ready to process requests 2) Tue Oct 27 22:36:17 2015 : Warning: rlm_sql (sql): 1 of 1 connections in use. You probably need to increase "spare" Tue Oct 27 22:36:17 2015 : Info: rlm_sql (sql): Opening additional connection (1) Tue Oct 27 22:36:17 2015 : Warning: rlm_sql (sql): 2 of 2 connections in use. You probably need to increase "spare" Tue Oct 27 22:36:17 2015 : Info: rlm_sql (sql): Opening additional connection (2) Tue Oct 27 22:36:17 2015 : Warning: rlm_sql (sql): 3 of 3 connections in use. You probably need to increase "spare" Tue Oct 27 22:36:17 2015 : Info: rlm_sql (sql): Opening additional connection (3) Tue Oct 27 22:36:17 2015 : Info: rlm_sql (sql): 3 of 4 connections in use. Need more spares Tue Oct 27 22:36:17 2015 : Info: rlm_sql (sql): Opening additional connection (4) Tue Oct 27 22:36:17 2015 : Info: rlm_sql (sql): 2 of 4 connections in use. Need more spares 3) Tue Oct 27 22:36:51 2015 : ERROR: (4217) ERROR: sql : Received conflicting packet from client 0.0.0.0/0 port 39418 - ID: 59 due to unfinished request. Giving up on old request. Tue Oct 27 22:36:51 2015 : ERROR: (4220) ERROR: sql : Received conflicting packet from client 0.0.0.0/0 port 50628 - ID: 62 due to unfinished request. Giving up on old request. Tue Oct 27 22:36:51 2015 : ERROR: (4221) ERROR: sql : Received conflicting packet from client 0.0.0.0/0 port 55753 - ID: 63 due to unfinished request. Giving up on old request. Tue Oct 27 22:36:51 2015 : ERROR: (4224) ERROR: sql : Received conflicting packet from client 0.0.0.0/0 port 41959 - ID: 66 due to unfinished request. Giving up on old request. Tue Oct 27 22:36:51 2015 : ERROR: (4229) ERROR: sql : Received conflicting packet from client 0.0.0.0/0 port 57022 - ID: 71 due to unfinished request. Giving up on old request. Tue Oct 27 22:36:52 2015 : ERROR: (4260) ERROR: sql : Received conflicting packet from client 0.0.0.0/0 port 45267 - ID: 104 due to unfinished request. Giving up on old request. Tue Oct 27 22:36:52 2015 : ERROR: (4287) ERROR: sql : Received conflicting packet from client 0.0.0.0/0 port 47887 - ID: 120 due to unfinished request. Giving up on old request. Tue Oct 27 22:36:52 2015 : ERROR: (4292) ERROR: sql : Received conflicting packet from client 0.0.0.0/0 port 40463 - ID: 128 due to unfinished request. Giving up on old request. Tue Oct 27 22:36:52 2015 : ERROR: (4294) ERROR: sql : Received conflicting packet from client 0.0.0.0/0 port 44484 - ID: 129 due to unfinished request. Giving up on old request. Tue Oct 27 22:36:52 2015 : ERROR: (4303) ERROR: sql : Received conflicting packet from client 0.0.0.0/0 port 47015 - ID: 137 due to unfinished request. Giving up on old request. Tue Oct 27 22:36:52 2015 : ERROR: (4304) ERROR: sql : Received conflicting packet from client 0.0.0.0/0 port 48617 - ID: 138 due to unfinished request. Giving up on old request. 4) Tue Oct 27 22:36:54 2015 : Warning: No such configuration item .type..query Tue Oct 27 22:36:54 2015 : Warning: No such configuration item .type..query Tue Oct 27 22:36:54 2015 : Warning: No such configuration item .type..query Tue Oct 27 22:36:54 2015 : Warning: No such configuration item .type..query Tue Oct 27 22:36:54 2015 : Warning: No such configuration item .type..query Tue Oct 27 22:36:54 2015 : Warning: No such configuration item .type..query Tue Oct 27 22:36:54 2015 : Warning: No such configuration item .type..query Tue Oct 27 22:36:54 2015 : Warning: No such configuration item .type..query Tue Oct 27 22:36:54 2015 : Warning: No such configuration item .type..query Tue Oct 27 22:36:54 2015 : Warning: No such configuration item .type..query 5) Tue Oct 27 22:37:04 2015 : Error: (7162) Ignoring duplicate packet from client 0.0.0.0/0 port 47432 - ID: 116 due to unfinished request in component <core> module <queue> 6) Tue Oct 27 22:37:09 2015 : Error: rlm_sql (sql): Duplicate entry '30a1ada7fbf7328ec740200d6042f02b' for key 'acctuniqueid' Tue Oct 27 22:37:09 2015 : Error: rlm_sql_mysql: Cannot store result Tue Oct 27 22:37:09 2015 : Error: rlm_sql_mysql: MySQL error 'Duplicate entry '30a1ada7fbf7328ec740200d6042f02b' for key 'acctuniqueid'' Tue Oct 27 22:40:14 2015 : Error: rlm_sql (sql): Duplicate entry '51208897d76ba70d93d0a5d4486b3622' for key 'acctuniqueid' Tue Oct 27 22:40:14 2015 : Error: rlm_sql_mysql: Cannot store result Tue Oct 27 22:40:14 2015 : Error: rlm_sql_mysql: MySQL error 'Duplicate entry '51208897d76ba70d93d0a5d4486b3622' for key 'acctuniqueid'' Tue Oct 27 22:40:14 2015 : Error: rlm_sql (sql): Duplicate entry 'a2ccf69a14f3eb13105c3a5df8dcb81f' for key 'acctuniqueid' Tue Oct 27 22:40:14 2015 : Error: rlm_sql_mysql: Cannot store result Tue Oct 27 22:40:14 2015 : Error: rlm_sql_mysql: MySQL error 'Duplicate entry 'a2ccf69a14f3eb13105c3a5df8dcb81f' for key 'acctuniqueid'' Tue Oct 27 22:40:14 2015 : Error: rlm_sql (sql): Duplicate entry 'b92b5f282a678d6edfec278fc07a057a' for key 'acctuniqueid' Tue Oct 27 22:40:14 2015 : Error: rlm_sql_mysql: Cannot store result Tue Oct 27 22:40:14 2015 : Error: rlm_sql_mysql: MySQL error 'Duplicate entry 'b92b5f282a678d6edfec278fc07a057a' for key 'acctuniqueid'' Tue Oct 27 22:40:16 2015 : Error: rlm_sql (sql): Duplicate entry '4b8983776731b1f5da36b35a1a53d9fa' for key 'acctuniqueid' Tue Oct 27 22:40:16 2015 : Error: rlm_sql_mysql: Cannot store result Tue Oct 27 22:40:16 2015 : Error: rlm_sql_mysql: MySQL error 'Duplicate entry '4b8983776731b1f5da36b35a1a53d9fa' for key 'acctuniqueid'' Tue Oct 27 22:40:17 2015 : Error: rlm_sql (sql): Duplicate entry '61cb092a85b6a15acf5d79cfb60855d6' for key 'acctuniqueid' Tue Oct 27 22:40:17 2015 : Error: rlm_sql_mysql: Cannot store result Tue Oct 27 22:40:17 2015 : Error: rlm_sql_mysql: MySQL error 'Duplicate entry '61cb092a85b6a15acf5d79cfb60855d6' for key 'acctuniqueid'' Tue Oct 27 22:40:17 2015 : Error: rlm_sql (sql): Duplicate entry '39df97f43a022814b698ebfa18065f02' for key 'acctuniqueid' Tue Oct 27 22:40:17 2015 : Error: rlm_sql_mysql: Cannot store result Tue Oct 27 22:40:17 2015 : Error: rlm_sql_mysql: MySQL error 'Duplicate entry '39df97f43a022814b698ebfa18065f02' for key 'acctuniqueid'' Tue Oct 27 22:40:17 2015 : Error: rlm_sql (sql): Duplicate entry '370a69125a04214aae019cecdccac86d' for key 'acctuniqueid' Tue Oct 27 22:40:17 2015 : Error: rlm_sql_mysql: Cannot store result Tue Oct 27 22:40:17 2015 : Error: rlm_sql_mysql: MySQL error 'Duplicate entry '370a69125a04214aae019cecdccac86d' for key 'acctuniqueid'' Tue Oct 27 22:40:17 2015 : Error: rlm_sql (sql): Duplicate entry '78108b526c3d18d0fbb5c330fae5b770' for key 'acctuniqueid' Tue Oct 27 22:40:17 2015 : Error: rlm_sql_mysql: Cannot store result Tue Oct 27 22:40:17 2015 : Error: rlm_sql_mysql: MySQL error 'Duplicate entry '78108b526c3d18d0fbb5c330fae5b770' for key 'acctuniqueid'' Tue Oct 27 22:40:17 2015 : Error: rlm_sql (sql): Duplicate entry '337e085c9a8d7cde42499a130cb2d6fb' for key 'acctuniqueid' Tue Oct 27 22:40:17 2015 : Error: rlm_sql_mysql: Cannot store result 7) Tue Oct 27 22:38:36 2015 : Error: Unresponsive child for request 11202, in component <core> module Tue Oct 27 22:38:36 2015 : Error: Unresponsive child for request 11201, in component <core> module Tue Oct 27 22:38:36 2015 : Error: Unresponsive child for request 11199, in component <core> module Tue Oct 27 22:38:36 2015 : Error: Unresponsive child for request 11206, in component <core> module Tue Oct 27 22:38:36 2015 : Error: Unresponsive child for request 11205, in component <core> module Tue Oct 27 22:38:36 2015 : Error: Unresponsive child for request 11212, in component <core> module Thanks.

2 1