- Freeradius-Users - lists.freeradius.org

The users session was previously rejected
by Pretlove, Tim 01 Nov '15

01 Nov '15

Hi, I fairly new at Freeradius and I have been upgrading our version 2 servers to version 3.0.10 and I have what I believe is a configuration issue. The user is correctly rejected by eap/MSCHAP but it continues into eap/PEAP where I get the error Sat Oct 31 09:08:24 2015 : Info: (11) eap_peap: The users session was previously rejected: returning reject (again.) Sat Oct 31 09:08:24 2015 : Info: (11) eap_peap: This means you need to read the PREVIOUS messages in the debug output Sat Oct 31 09:08:24 2015 : Info: (11) eap_peap: to find out the reason why the user was rejected Sat Oct 31 09:08:24 2015 : Info: (11) eap_peap: Look for "reject" or "fail". Those earlier messages will tell you Sat Oct 31 09:08:24 2015 : Info: (11) eap_peap: what went wrong, and how to fix the problem How do I avoid dropping into the peap section if the user is rejected further up the chain? I've attached the portion of the debug log that shows this error. Many thanks Tim

5 7

Huntgroup-Name vs client:group
by Óscar Remírez de Ganuza Satrústegui 30 Oct '15

30 Oct '15

Good afternoon, We are migrating previous radius (2.1.9) authentication to a new instance of freeradius (3.0.10). We are moving two different configurations to a single radius. As we are supporting AAA from diferent services, we are using Huntgroup-Name attribute to separate the authorization. if ( Huntgroup-Name == 'Wireless' ) { if ( Ldap-Group == "unav.wireless.1" ) { update reply { ... } } ... } elsif ( Huntgroup-Name == 'Wired' ) { if ( Ldap-Group == "unav.wired.1" ) { ... } .... } We are doing it even on the inner-tunnel; using copy_request_to_tunnel, and with module preprocess on the inner-tunnel. It is working ok. But I have just found a previous suggestion on this list [1] in which it is suggested to check "client:group" instead of huntgroup-name: *"do policy checking via %{client:group} instead of Huntgroup-Name. It will do the same thing, and will be *enormously* faster."* In our particular setting, we have around 7 huntgroups for a total of 20 NAS-Clients. And we receive 20 different Access Requests per second on top moments. In our case, do you think that we are also going to experience a much better performance using client:group instead of huntgroup-name? I had been looking for information on client:group, but I could not find a lot of it. [2] Thank you very much for your help. Regards, [1] http://lists.freeradius.org/pipermail/freeradius-users/2014-February/070431… [2] https://github.com/FreeRADIUS/freeradius-server/blob/master/raddb/clients.c… *Oscar Remírez de Ganuza Satrústegui* IT Services Universidad de Navarra Tel. +34 948425600 x803130 http://www.unav.edu/web/it/

2 1

question regarding PEAP/MSCHAPv2 (ERROR: FAILED: No NT/LM-Password. Cannot perform authentication)
by Thomas Stather 30 Oct '15

30 Oct '15

Hello I am still failing with my RADIUS setup (eduroam -> PEAP/MSCHAPv2 and authentication against our LDAP server) on 3.0.10 After having sorted out lots of mistakes by myself in the RADIUS config (thanks for you help on the previous post), the server now starts. But when i try to connect with my mobile device to the test SSID, i get: ---------------------------------------------------------------------- ... (6) ldap1: User object found at DN "uid=tstather,ou=people,dc=mpimf-heidelberg,dc=mpg,dc=de" rlm_ldap (ldap1): Released connection (0) (6) [ldap1] = ok (6) } # redundant redundant_ldap = ok (6) [pap] = noop (6) } # authorize = updated (6) Found Auth-Type = EAP (6) # Executing group from file /etc/raddb/sites-enabled/mpimf_inner-tunnel (6) authenticate { (6) eap: Expiring EAP session with state 0x8d973f168d3225fd (6) eap: Finished EAP session with state 0x8d973f168d3225fd (6) eap: Previous EAP request found for state 0x8d973f168d3225fd, released from the list (6) eap: Peer sent packet with method EAP MSCHAPv2 (26) (6) eap: Calling submodule eap_mschapv2 to process data (6) eap_mschapv2: # Executing group from file /etc/raddb/sites-enabled/mpimf_inner-tunnel (6) eap_mschapv2: Auth-Type MS-CHAP { (6) mschap: WARNING: No Cleartext-Password configured. Cannot create NT-Password (6) mschap: WARNING: No Cleartext-Password configured. Cannot create LM-Password (6) mschap: Creating challenge hash with username: tstather(a)mpimf-heidelberg.mpg.de (6) mschap: Client is using MS-CHAPv2 (6) mschap: ERROR: FAILED: No NT/LM-Password. Cannot perform authentication (6) mschap: ERROR: MS-CHAP2-Response is incorrect (6) [mschap] = reject (6) } # Auth-Type MS-CHAP = reject (6) eap: Sending EAP Failure (code 4) ID 165 length 4 (6) eap: Freeing handler (6) [eap] = reject (6) } # authenticate = reject (6) Failed to authenticate the user (6) Using Post-Auth-Type Reject (6) # Executing group from file /etc/raddb/sites-enabled/mpimf_inner-tunnel (6) Post-Auth-Type REJECT { (6) attr_filter.access_reject: EXPAND %{User-Name} (6) attr_filter.access_reject: --> tstather(a)mpimf-heidelberg.mpg.de (6) attr_filter.access_reject: Matched entry DEFAULT at line 11 (6) [attr_filter.access_reject] = updated (6) } # Post-Auth-Type REJECT = updated (6) } # server mpimf_inner-tunnel (6) Virtual server sending reply (6) MS-CHAP-Error = "\245E=691 R=1 C=d3892ab1fa88824c1ae8daf07fc80483 V=3 M=Authentication failed" (6) EAP-Message = 0x04a50004 (6) Message-Authenticator = 0x00000000000000000000000000000000 ... ---------------------------------------------------------------------- Our LDAP server has the attributes "sambaLMPassword" and "sambaNTPassword" (there is also a samba server linked to it). I read some documentation but now im confused. Am i right in the assumption that the error occurs because our LDAP server has no "clear-text password" entries for the users? Is the only option to get it to work use the "ntlm_auth" module? I wanted to implement this setup independently of our samba server, or is this simply not possible? Best, Thomas -- Thomas Stather IT Services Tel: +49 6221-486 628 Fax: +49 6221-486 561 ------------------------------------------------------------------------ Max Planck Institute for Medical Research (MPImF) Jahnstrasse 29, 69120 Heidelberg Germany

5 7

Problem with config (if- statement) on 3.0.10
by Thomas Stather 30 Oct '15

30 Oct '15

Hello Now i have my up to date radius installation but i am struggeling with my configuration (i need to implement an eduroam config using PEAP-MSCHAPv2 and EAP-TTLS-MSCHAPv2 in combination with our LDAP servers). The server won't start, attached is the output: ----------------------------------- radius1:/etc/raddb # radiusd -X Copyright (C) 1999-2015 The FreeRADIUS server project and contributors There is NO warranty; not even for MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE You may redistribute copies of FreeRADIUS under the terms of the GNU General Public License For more information about these matters, see the file named COPYRIGHT Starting - reading configuration files ... including dictionary file /usr/share/freeradius/dictionary including dictionary file /usr/share/freeradius/dictionary.dhcp including dictionary file /usr/share/freeradius/dictionary.vqp including configuration file /etc/raddb/radiusd.conf including configuration file /etc/raddb/proxy.conf including configuration file /etc/raddb/clients.conf including files in directory /etc/raddb/mods-enabled/ including configuration file /etc/raddb/mods-enabled/detail including configuration file /etc/raddb/mods-enabled/always including configuration file /etc/raddb/mods-enabled/echo including configuration file /etc/raddb/mods-enabled/chap including configuration file /etc/raddb/mods-enabled/expiration including configuration file /etc/raddb/mods-enabled/files including configuration file /etc/raddb/mods-enabled/digest including configuration file /etc/raddb/mods-enabled/sradutmp including configuration file /etc/raddb/mods-enabled/cache_eap including configuration file /etc/raddb/mods-enabled/unix including configuration file /etc/raddb/mods-enabled/replicate including configuration file /etc/raddb/mods-enabled/dynamic_clients including configuration file /etc/raddb/mods-enabled/passwd including configuration file /etc/raddb/mods-enabled/ldap including configuration file /etc/raddb/mods-enabled/detail.log including configuration file /etc/raddb/mods-enabled/inner-eap including configuration file /etc/raddb/mods-enabled/mschap including configuration file /etc/raddb/mods-enabled/exec including configuration file /etc/raddb/mods-enabled/expr including configuration file /etc/raddb/mods-enabled/utf8 including configuration file /etc/raddb/mods-enabled/eap including configuration file /etc/raddb/mods-enabled/unpack including configuration file /etc/raddb/mods-enabled/realm including configuration file /etc/raddb/mods-enabled/soh including configuration file /etc/raddb/mods-enabled/attr_filter including configuration file /etc/raddb/mods-enabled/dhcp including configuration file /etc/raddb/mods-enabled/logintime including configuration file /etc/raddb/mods-enabled/ntlm_auth including configuration file /etc/raddb/mods-enabled/radutmp including configuration file /etc/raddb/mods-enabled/preprocess including configuration file /etc/raddb/mods-enabled/linelog including configuration file /etc/raddb/mods-enabled/pap including files in directory /etc/raddb/policy.d/ including configuration file /etc/raddb/policy.d/canonicalization including configuration file /etc/raddb/policy.d/debug including configuration file /etc/raddb/policy.d/filter including configuration file /etc/raddb/policy.d/accounting including configuration file /etc/raddb/policy.d/operator-name including configuration file /etc/raddb/policy.d/abfab-tr including configuration file /etc/raddb/policy.d/eap including configuration file /etc/raddb/policy.d/cui including configuration file /etc/raddb/policy.d/control including configuration file /etc/raddb/policy.d/dhcp including files in directory /etc/raddb/sites-enabled/ including configuration file /etc/raddb/sites-enabled/eduroam /etc/raddb/sites-enabled/mpimf_eduroam[65]: Invalid location for 'if' Errors reading or parsing /etc/raddb/radiusd.conf ----------------------------------- the /sites-enabled/eduroam looks like this: ----------------------------------- authorize { preprocess auth_log mschap suffix eap { ok = return } files redundant_ldap } authenticate { Auth-Type MS-CHAP { mschap } Auth-Type eap { eap update control { Tmp-String-0 = "%{debug:2}" } update control { Tmp-String-0 = "%{debug:0}" } } } preacct { preprocess acct_unique suffix } accounting { detail unix radutmp exec attr_filter.accounting_response } session { radutmp } post-auth { reply_log redundant_ldap exec Post-Auth-Type REJECT { attr_filter.access_reject } ### enable debug logging from here on update control { Tmp-String-0 = "%{debug:2}" } if (Realm == my-realm.de || Realm == NULL) { update reply { Filter-Id = "my-realm-Secure.in" } } else { update reply { Filter-Id = "gast.in" } } ### disable debug logging again update control { Tmp-String-0 = "%{debug:0}" } } pre-proxy { pre_proxy_log } post-proxy { post_proxy_log eap } ----------------------------------- What am i doing wrong? Best, Thomas -- Thomas Stather IT Services Tel: +49 6221-486 628 Fax: +49 6221-486 561 ------------------------------------------------------------------------ Max Planck Institute for Medical Research (MPImF) Jahnstrasse 29, 69120 Heidelberg Germany

2 4

My Freeradius server throws errors ,please guide
by Yusuf Siddiqui 29 Oct '15

29 Oct '15

Hi I have tried to change the mod of the file to +r mode still i see this error,what could be reason behind it,please guide. ÃÃÃÃÃÃÃÃÃÃÃÃÃÃÃÅÃÃÅ¸" Thu Oct 29 20:56:03 2015 : Debug: } Thu Oct 29 20:56:03 2015 : Debug: instantiate { Thu Oct 29 20:56:03 2015 : Debug: } Thu Oct 29 20:56:03 2015 : Debug: modules { Thu Oct 29 20:56:03 2015 : Debug: # Instantiating module "etc_passwd" from file /usr/local/etc/raddb/mods-enabled/passwd Thu Oct 29 20:56:03 2015 : Debug: rlm_passwd: nfields: 3 keyfield 0(User-Name) listable: no Thu Oct 29 20:56:03 2015 : Debug: # Instantiating module "preprocess" from file /usr/local/etc/raddb/mods-enabled/preprocess Thu Oct 29 20:56:03 2015 : Debug: reading pairlist file /usr/local/etc/raddb/mods-config/preprocess/huntgroups Thu Oct 29 20:56:03 2015 : Debug: reading pairlist file /usr/local/etc/raddb/mods-config/preprocess/hints Thu Oct 29 20:56:03 2015 : Debug: # Instantiating module "detail" from file /usr/local/etc/raddb/mods-enabled/detail Thu Oct 29 20:56:03 2015 : Debug: # Instantiating module "auth_log" from file /usr/local/etc/raddb/mods-enabled/detail.log Thu Oct 29 20:56:03 2015 : Debug: rlm_detail (auth_log): 'User-Password' suppressed, will not appear in detail output Thu Oct 29 20:56:03 2015 : Debug: # Instantiating module "reply_log" from file /usr/local/etc/raddb/mods-enabled/detail.log Thu Oct 29 20:56:03 2015 : Debug: # Instantiating module "pre_proxy_log" from file /usr/local/etc/raddb/mods-enabled/detail.log Thu Oct 29 20:56:03 2015 : Debug: # Instantiating module "post_proxy_log" from file /usr/local/etc/raddb/mods-enabled/detail.log Thu Oct 29 20:56:03 2015 : Debug: # Instantiating module "attr_filter.post-proxy" from file /usr/local/etc/raddb/mods-enabled/attr_filter Thu Oct 29 20:56:03 2015 : Debug: reading pairlist file /usr/local/etc/raddb/mods-config/attr_filter/post-proxy Thu Oct 29 20:56:03 2015 : Error: Couldn't open /usr/local/etc/raddb/mods-config/attr_filter/post-proxy for reading: Permission denied Thu Oct 29 20:56:03 2015 : Error: Errors reading /usr/local/etc/raddb/mods-config/attr_filter/post-proxy Thu Oct 29 20:56:03 2015 : Error: /usr/local/etc/raddb/mods-enabled/attr_filter[12]: Instantiation failed for module "attr_filter.post-proxy" Regards Yusuf Siddiqui *__________________________________________________________________________________________________________________________________________________________________* This communication & accompanying documents ("this e-mail") contains confidential and/or privileged information for exclusive use of the individual to whom it is addressed. If you are not the intended recipient, please immediately notify the company & delete this e-mail. Any unauthorized use or disclosure of this e-mail is strictly prohibited. Representations in this e-mail are subject to contract. As an e-mail user please be cautious of the technical & other vulnerabilities of the internet which may result in malicious and/or unauthorized access to / use / alteration of e-mails/e-mail IDs. Thank you. *_______________________________________________________________________________________________________________________________________________________________*

2 1

Understanding debugging logs
by David Hartburn 29 Oct '15

29 Oct '15

Hi, Is there any advised technique or tools out there to help understanding FreeRADIUS debugging output generated by radmin/raddebug? A lot of information is generated, but a method of cutting out repeated information or quickly highlighting issues in a debug session would be handy. If not, is the best method working backwards, checking for errors in each packet log? I am already filtering by MAC or User-Name to make sure I just have output from the session I want. This is not a complaint. We are currently moving from NPS so having useful debugging is brilliant and a whole new world where problems seem solvable! I'm always interested in anything that will make life easier though :) Dave Hartburn

6 7

Freeradius and VMPS MAC problem
by Daniel Pogac 29 Oct '15

29 Oct '15

Hi, I'm trying to FreeRADIUS 3.0.4 with MySQL backend and VMPS on CentOS 7.1 64bit. Everything seems to work, except one thing. When i testing VMPS with vqpcli.pl, FreeRADIUS shows in debug other MAC than i send by vqpcli.pl. This is request what i send by vqpcli.pl: [root@centos7 tmp]# ./vqpcli.pl -s localhost -v ISEPP -w 10.0.0.1 -i 2/4 -m 0010.a49f.30e3 ============================== MESSAGE SENT: 0000000 0101 0600 0000 3412 0000 010c 0400 000a 0000010 0100 0000 020c 0300 2f32 0034 0c00 0003 0000020 0000 0c00 0004 4905 4553 5050 0000 070c 0000030 0100 0000 0c00 0006 0006 a410 309f 00e3 000003f ============================== MESSAGE RECV: 0000000 0201 0200 0000 3412 0000 030c 1900 6c70 0000010 6165 6573 755f 6573 725f 6165 5f6c 6c76 0000020 6e61 685f 7265 0065 0c00 0008 0006 a410 0000030 309f 00e3 0000033 ============================== Vlan: please_use_real_vlan_here MAC Address: 0010a49f30e3 Status: ALLOW and this is from debug of FrreeRADIUS: VMPS-Packet-Type = VMPS-Join-Request VMPS-Error-Code = VMPS-No-Error VMPS-Sequence-Number = 4660 VMPS-Client-IP-Address = 10.0.0.1 VMPS-Port-Name = '2/4' VMPS-VLAN-Name = '' VMPS-Domain-Name = 'ISEPP' VMPS-Unknown = 0x00 VMPS-MAC = f0:a6:c0:15:55:7f (0) Received Access-Request packet from host 127.0.0.1 port 34832, id=4660, length=63 (0) VMPS-Packet-Type = VMPS-Join-Request (0) VMPS-Error-Code = VMPS-No-Error (0) VMPS-Sequence-Number = 4660 (0) VMPS-Client-IP-Address = 10.0.0.1 (0) VMPS-Port-Name = '2/4' (0) VMPS-VLAN-Name = '' (0) VMPS-Domain-Name = 'ISEPP' (0) VMPS-Unknown = 0x00 (0) VMPS-MAC = f0:a6:c0:15:55:7f Doing VMPS (0) vmps { (0) [mac2vlan] = ok (0) update reply { (0) VMPS-Packet-Type = VMPS-Join-Response (0) EXPAND %{VMPS-Mac} (0) --> f0:a6:c0:15:55:7f (0) VMPS-Cookie = f0:a6:c0:15:55:7f (0) VMPS-VLAN-Name = 'please_use_real_vlan_here' (0) } # update reply = noop (0) if (VMPS-Packet-Type == VMPS-Reconfirm-Request) (0) if (VMPS-Packet-Type == VMPS-Reconfirm-Request) -> FALSE (0) } # vmps = ok Done VMPS (0) vmps { (0) [mac2vlan] = ok (0) update reply { (0) VMPS-Packet-Type = VMPS-Join-Response (0) EXPAND %{VMPS-Mac} (0) --> f0:a6:c0:15:55:7f (0) VMPS-Cookie = f0:a6:c0:15:55:7f (0) VMPS-VLAN-Name = 'please_use_real_vlan_here' (0) } # update reply = noop (0) if (VMPS-Packet-Type == VMPS-Reconfirm-Request) (0) if (VMPS-Packet-Type == VMPS-Reconfirm-Request) -> FALSE (0) } # vmps = ok (0) Sending Access-Accept packet to host 127.0.0.1 port 34832, id=4660, length=0 (0) VMPS-Packet-Type = VMPS-Join-Response (0) VMPS-Cookie = f0:a6:c0:15:55:7f (0) VMPS-VLAN-Name = 'please_use_real_vlan_here' VMPS-VLAN-Name = 'please_use_real_vlan_here' VMPS-Cookie = f0:a6:c0:15:55:7f (0) Finished request Waking up in 0.3 seconds. Waking up in 4.6 seconds. (0) Cleaning up request packet ID 4660 with timestamp +312 As you can see I'm sending MAC:00:10:a4:9f:30:e3 but in debug log is MAC: f0:a6:c0:15:55:7f. If i ran vqpcli.pl three times the MAC address in debug change to another. Can some explain to me what am I doing wrong ? Daniel

2 2

VMPS with MySQL default VLAN
by Daniel Pogac 29 Oct '15

29 Oct '15

Good afternoon. I've got problem with configuring VMPS with MySQL and default VLAN. This is relevant part of vmps config which i use: update reply { &VMPS-Packet-Type = VMPS-Join-Response &VMPS-Cookie = &VMPS-Mac &VMPS-VLAN-Name = "Public_INET" # If you have VLAN's in a database, you can select # the VLAN name based on the MAC address. # &VMPS-VLAN-Name = "%{sql:select vlan from mac2vlan where mac='%{VMPS-Mac}'}" } In this configuration, VMPS always return VLAN value as Public_INET. Even if i use MAC address which is in MySQL database. In debug output i can see that VLAN is successfully returned from MySQL, but return from FreeRADIUS is Public_INET. Debug output is as follows : VMPS-Packet-Type = VMPS-Join-Request VMPS-Error-Code = VMPS-No-Error VMPS-Sequence-Number = 4660 VMPS-Client-IP-Address = 127.0.0.1 VMPS-Port-Name = "Fa0/1" VMPS-VLAN-Name = "" VMPS-Domain-Name = "" VMPS-Unknown = 0x00 VMPS-MAC = 68:f7:28:e7:d8:ec (1) Received Access-Request Id 4660 from 127.0.0.1:59323 to 127.0.0.1:1589 length 60 (1) VMPS-Packet-Type = VMPS-Join-Request (1) VMPS-Error-Code = VMPS-No-Error (1) VMPS-Sequence-Number = 4660 (1) VMPS-Client-IP-Address = 127.0.0.1 (1) VMPS-Port-Name = "Fa0/1" (1) VMPS-VLAN-Name = "" (1) VMPS-Domain-Name = "" (1) VMPS-Unknown = 0x00 (1) VMPS-MAC = 68:f7:28:e7:d8:ec Doing VMPS (1) vmps { (1) if (!&VMPS-Mac) { (1) if (!&VMPS-Mac) -> FALSE (1) [mac2vlan] = ok (1) update reply { (1) &VMPS-Packet-Type = VMPS-Join-Response (1) &VMPS-Cookie = &VMPS-Mac -> 68:f7:28:e7:d8:ec (1) &VMPS-VLAN-Name = "Public_INET" (1) EXPAND %{User-Name} (1) --> (1) SQL-User-Name set to '' rlm_sql (sql): Reserved connection (2) (1) Executing select query: select vlan from mac2vlan where mac='68:f7:28:e7:d8:ec' rlm_sql (sql): Released connection (2) rlm_sql (sql): Need 4 more connections to reach 10 spares rlm_sql (sql): Opening additional connection (6), 1 of 26 pending slots used rlm_sql_mysql: Starting connect to MySQL server rlm_sql_mysql: Connected to database 'radius' on Localhost via UNIX socket, server version 5.1.73, protocol version 10 (1) EXPAND %{sql:select vlan from mac2vlan where mac='%{VMPS-Mac}'} (1) --> OFFICE (1) VMPS-VLAN-Name = OFFICE (1) } # update reply = noop (1) if (&VMPS-Packet-Type == VMPS-Reconfirm-Request){ (1) if (&VMPS-Packet-Type == VMPS-Reconfirm-Request) -> FALSE (1) } # vmps = ok Done VMPS (1) vmps { (1) if (!&VMPS-Mac) { (1) if (!&VMPS-Mac) -> FALSE (1) [mac2vlan] = ok (1) update reply { (1) &VMPS-Packet-Type = VMPS-Join-Response (1) &VMPS-Cookie = &VMPS-Mac -> 68:f7:28:e7:d8:ec (1) &VMPS-VLAN-Name = "Public_INET" (1) EXPAND %{User-Name} (1) --> (1) SQL-User-Name set to '' rlm_sql (sql): Reserved connection (3) (1) Executing select query: select vlan from mac2vlan where mac='68:f7:28:e7:d8:ec' rlm_sql (sql): Released connection (3) (1) EXPAND %{sql:select vlan from mac2vlan where mac='%{VMPS-Mac}'} (1) --> OFFICE (1) VMPS-VLAN-Name = OFFICE (1) } # update reply = noop (1) if (&VMPS-Packet-Type == VMPS-Reconfirm-Request){ (1) if (&VMPS-Packet-Type == VMPS-Reconfirm-Request) -> FALSE (1) } # vmps = ok (1) Sent Access-Accept Id 4660 from 127.0.0.1:1589 to 127.0.0.1:59323 length 0 VMPS-VLAN-Name = "Public_INET" VMPS-Cookie = 68:f7:28:e7:d8:ec (1) Finished request (1) Cleaning up request packet ID 4660 with timestamp +24 Ready to process requests When i place first mysql request and then i set default VLAN, than returned VLAN from VMPS is correct when i use MAC address which is in DB, but when i use other MAC returned VLAN is empty. Config as follows: update reply { &VMPS-Packet-Type = VMPS-Join-Response &VMPS-Cookie = &VMPS-Mac # If you have VLAN's in a database, you can select # the VLAN name based on the MAC address. # &VMPS-VLAN-Name = "%{sql:select vlan from mac2vlan where mac='%{VMPS-Mac}'}" &VMPS-VLAN-Name = "Public_INET" } Debug output with MAC from DB: VMPS-Packet-Type = VMPS-Join-Request VMPS-Error-Code = VMPS-No-Error VMPS-Sequence-Number = 4660 VMPS-Client-IP-Address = 127.0.0.1 VMPS-Port-Name = "Fa0/1" VMPS-VLAN-Name = "" VMPS-Domain-Name = "" VMPS-Unknown = 0x00 VMPS-MAC = 68:f7:28:e7:d8:ec (0) Received Access-Request Id 4660 from 127.0.0.1:60360 to 127.0.0.1:1589 length 60 (0) VMPS-Packet-Type = VMPS-Join-Request (0) VMPS-Error-Code = VMPS-No-Error (0) VMPS-Sequence-Number = 4660 (0) VMPS-Client-IP-Address = 127.0.0.1 (0) VMPS-Port-Name = "Fa0/1" (0) VMPS-VLAN-Name = "" (0) VMPS-Domain-Name = "" (0) VMPS-Unknown = 0x00 (0) VMPS-MAC = 68:f7:28:e7:d8:ec Doing VMPS (0) vmps { (0) if (!&VMPS-Mac) { (0) if (!&VMPS-Mac) -> FALSE (0) [mac2vlan] = ok (0) update reply { (0) &VMPS-Packet-Type = VMPS-Join-Response (0) &VMPS-Cookie = &VMPS-Mac -> 68:f7:28:e7:d8:ec (0) EXPAND %{User-Name} (0) --> (0) SQL-User-Name set to '' rlm_sql (sql): Reserved connection (0) (0) Executing select query: select vlan from mac2vlan where mac='68:f7:28:e7:d8:ec' rlm_sql (sql): Released connection (0) rlm_sql (sql): Need 5 more connections to reach 10 spares rlm_sql (sql): Opening additional connection (5), 1 of 27 pending slots used rlm_sql_mysql: Starting connect to MySQL server rlm_sql_mysql: Connected to database 'radius' on Localhost via UNIX socket, server version 5.1.73, protocol version 10 (0) EXPAND %{sql:select vlan from mac2vlan where mac='%{VMPS-Mac}'} (0) --> OFFICE (0) VMPS-VLAN-Name = OFFICE (0) &VMPS-VLAN-Name = "Public_INET" (0) } # update reply = noop (0) if (&VMPS-Packet-Type == VMPS-Reconfirm-Request){ (0) if (&VMPS-Packet-Type == VMPS-Reconfirm-Request) -> FALSE (0) } # vmps = ok Done VMPS (0) vmps { (0) if (!&VMPS-Mac) { (0) if (!&VMPS-Mac) -> FALSE (0) [mac2vlan] = ok (0) update reply { (0) &VMPS-Packet-Type = VMPS-Join-Response (0) &VMPS-Cookie = &VMPS-Mac -> 68:f7:28:e7:d8:ec (0) EXPAND %{User-Name} (0) --> (0) SQL-User-Name set to '' rlm_sql (sql): Reserved connection (1) (0) Executing select query: select vlan from mac2vlan where mac='68:f7:28:e7:d8:ec' rlm_sql (sql): Released connection (1) (0) EXPAND %{sql:select vlan from mac2vlan where mac='%{VMPS-Mac}'} (0) --> OFFICE (0) VMPS-VLAN-Name = OFFICE (0) &VMPS-VLAN-Name = "Public_INET" (0) } # update reply = noop (0) if (&VMPS-Packet-Type == VMPS-Reconfirm-Request){ (0) if (&VMPS-Packet-Type == VMPS-Reconfirm-Request) -> FALSE (0) } # vmps = ok (0) Sent Access-Accept Id 4660 from 127.0.0.1:1589 to 127.0.0.1:60360 length 0 VMPS-VLAN-Name = "OFFICE" VMPS-Cookie = 68:f7:28:e7:d8:ec (0) Finished request (0) Cleaning up request packet ID 4660 with timestamp +5 Ready to process requests This is debug output with MAC not present in DB: VMPS-Packet-Type = VMPS-Join-Request VMPS-Error-Code = VMPS-No-Error VMPS-Sequence-Number = 4660 VMPS-Client-IP-Address = 127.0.0.1 VMPS-Port-Name = "Fa0/1" VMPS-VLAN-Name = "" VMPS-Domain-Name = "" VMPS-Unknown = 0x00 VMPS-MAC = 68:f7:28:e7:d8:ea (1) Received Access-Request Id 4660 from 127.0.0.1:58809 to 127.0.0.1:1589 length 60 (1) VMPS-Packet-Type = VMPS-Join-Request (1) VMPS-Error-Code = VMPS-No-Error (1) VMPS-Sequence-Number = 4660 (1) VMPS-Client-IP-Address = 127.0.0.1 (1) VMPS-Port-Name = "Fa0/1" (1) VMPS-VLAN-Name = "" (1) VMPS-Domain-Name = "" (1) VMPS-Unknown = 0x00 (1) VMPS-MAC = 68:f7:28:e7:d8:ea Doing VMPS (1) vmps { (1) if (!&VMPS-Mac) { (1) if (!&VMPS-Mac) -> FALSE (1) [mac2vlan] = ok (1) update reply { (1) &VMPS-Packet-Type = VMPS-Join-Response (1) &VMPS-Cookie = &VMPS-Mac -> 68:f7:28:e7:d8:ea (1) EXPAND %{User-Name} (1) --> (1) SQL-User-Name set to '' rlm_sql (sql): Reserved connection (2) (1) Executing select query: select vlan from mac2vlan where mac='68:f7:28:e7:d8:ea' (1) SQL query returned no results rlm_sql (sql): Released connection (2) rlm_sql (sql): Need 4 more connections to reach 10 spares rlm_sql (sql): Opening additional connection (6), 1 of 26 pending slots used rlm_sql_mysql: Starting connect to MySQL server rlm_sql_mysql: Connected to database 'radius' on Localhost via UNIX socket, server version 5.1.73, protocol version 10 (1) EXPAND %{sql:select vlan from mac2vlan where mac='%{VMPS-Mac}'} (1) --> (1) VMPS-VLAN-Name = (1) &VMPS-VLAN-Name = "Public_INET" (1) } # update reply = noop (1) if (&VMPS-Packet-Type == VMPS-Reconfirm-Request){ (1) if (&VMPS-Packet-Type == VMPS-Reconfirm-Request) -> FALSE (1) } # vmps = ok Done VMPS (1) vmps { (1) if (!&VMPS-Mac) { (1) if (!&VMPS-Mac) -> FALSE (1) [mac2vlan] = ok (1) update reply { (1) &VMPS-Packet-Type = VMPS-Join-Response (1) &VMPS-Cookie = &VMPS-Mac -> 68:f7:28:e7:d8:ea (1) EXPAND %{User-Name} (1) --> (1) SQL-User-Name set to '' rlm_sql (sql): Reserved connection (3) (1) Executing select query: select vlan from mac2vlan where mac='68:f7:28:e7:d8:ea' (1) SQL query returned no results rlm_sql (sql): Released connection (3) (1) EXPAND %{sql:select vlan from mac2vlan where mac='%{VMPS-Mac}'} (1) --> (1) VMPS-VLAN-Name = (1) &VMPS-VLAN-Name = "Public_INET" (1) } # update reply = noop (1) if (&VMPS-Packet-Type == VMPS-Reconfirm-Request){ (1) if (&VMPS-Packet-Type == VMPS-Reconfirm-Request) -> FALSE (1) } # vmps = ok (1) Sent Access-Accept Id 4660 from 127.0.0.1:1589 to 127.0.0.1:58809 length 0 VMPS-VLAN-Name = "" VMPS-Cookie = 68:f7:28:e7:d8:ea (1) Finished request (1) Cleaning up request packet ID 4660 with timestamp +44 Ready to process requests It looks like first value set to attribute &VMPS-VLAN-Name is mandatory and it cant be overwrited. Is there any possibility to read VLANs from DB but if MAC is not in DB table to set some default VLAN? Thank You Daniel

1 0

rlm_digest failing after upgrade from 2.1.12 to 2.2.5
by Daniel Pocock 29 Oct '15

29 Oct '15

Hi, We just updated a Debian server from wheezy to jessie The freeradius server package updated from 2.1.12+dfsg-1.2 to 2.2.5+dfsg-0.2 This particular server is used for SIP users (for debian.org itself) The users are in a text file and it is loaded like this in radiusd.conf: modules { $INCLUDE modules/attr_filter $INCLUDE modules/digest passwd rtc_users { filename = /var/local/rtc-passwords.freerad format = "*User-Name:Digest-HA1:" hashsize = 1000 ignorenislike = no allowmultiplekeys = no } } Since the upgrade, the server is complaining: Auth: [digest] Cleartext-Password or Digest-HA1 is required for authentication. When the server is started or given HUP, it doesn't give any hints that anything is wrong: Wed Oct 21 07:51:05 2015 : Info: Received HUP signal. Wed Oct 21 07:51:05 2015 : Info: HUP - Re-reading configuration files Wed Oct 21 07:51:05 2015 : Info: HUP - loading modules Wed Oct 21 07:51:05 2015 : Info: Module: Reloaded module "attr_filter.access_reject" Wed Oct 21 07:51:05 2015 : Info: Module: Reloaded module "rtc_users" Wed Oct 21 07:51:05 2015 : Info: Loaded virtual server <default> Wed Oct 21 07:51:05 2015 : Info: Loaded virtual server rtc.debian.org I looked at the changelog, it only mentions passwd in one place and digest is not mentioned anywhere: FreeRADIUS 2.2.0 Mon 10 Sep 2012 12:00:00 CEST, urgency=medium Feature improvements * 100% configuration file compatible with 2.1.x. The only fix needed is to disallow "hashsize=0" for rlm_passwd The freeradius-client library is being used, it is the same version before and after the upgrade, 1.1.6. Can anybody give any feedback on this or suggest the best way to troubleshoot the issue? Regards, Daniel

3 8

Setting up a Proxy Server as a load balancer to bypass winbind/samba bottleneck
by Walter Reynolds 29 Oct '15

29 Oct '15

We are running to the same problems with winbind/samba bottlenecks as many other universities. While one of our servers does quite well we are starting to get hung modules at peak hitting as many as 150 authentications per second while averaging over 70/sec for several minutes. Since wireless controllers are getting bigger and with Cisco we are limited to sending radius auth request to one server at a time we need another way to balance things out. I thought setting up a freeradius proxy that pointed to two separate servers might be a way to go about this. Problem is I thought I read somewhere in the freeradius lists that that would create other problems, but now I can not find that. I also am not sure I followed this right, but in looking at proxy home_server_pool it looks like my options for load balancing will still send all auth request from my one large controller to a single server as the source IP will all be the same under client-balance. Thanks. ------------------------ Walter Reynolds Principal Systems Security Development Engineer Information and Technology Services University of Michigan (734) 615-9438

7 6