- Freeradius-Users - lists.freeradius.org

update control
by Alan Buxey 27 Oct '15

27 Oct '15

Hi Is there a fixed list of attribute pairs that can be used when doing update control (eg Proxy-To-Realm) or can any attribute defined locally in a dictionary be used? alan

2 1

[sqlippool]IP address could not be allocated as no pool exists with that name
by Rod Elias 27 Oct '15

27 Oct '15

Hello list! Could someone please help me with a problem regarding freeradius sqlippool module? I'm migrating to FreeRADIUS Version 2.1.10 with MySQL 5.1.73-1 running on a Debian GNU/Linux 6 The content of my radcheck table is something like: mysql> select * from radcheck where UserName = 'lucasmenezes'; +-------+-------------------------+--------------------+----------------+----+ | id | UserName | Attribute | Value | op | +-------+-------------------------+--------------------+----------------+----+ | 15643 | lucasmenezes | Cleartext-Password | 12110 | := | | 22342 | lucasmenezes | Pool-Name | PONTALNORTE_02 | := | +-------+-------------------------+--------------------+----------------+----+ 2 rows in set (0.00 sec) When the mentioned user tries to authenticate, I get the error message "IP address could not be allocated as no pool exists with that name". The user receives Login OK, but radius releases IP 0.0.0.0 to her/him. Here is an **example** of my radippool table: mysql> select * from radcheck where UserName = 'lucasmenezes'; +-------+----------------+-----------------+--------------+-----------------+-------------------+---------------------+-------------------------+-------------------+ | id | pool_name | FramedIPAddress | NASIPAddress | CalledStationId | CallingStationID | expiry_time | username | pool_key | +-------+----------------+-----------------+--------------+-----------------+-------------------+---------------------+-------------------------+-------------------+ | 64171 | PONTALNORTE_02 | 187.44.69.244 | 187.44.64.58 | | 00:0C:43:B4:1B:81 | 2015-10-27 16:00:10 | lucasmenezes | 00:0C:43:B4:1B:81 | +-------+----------------+-----------------+--------------+-----------------+-------------------+---------------------+-------------------------+-------------------+ 1 row in set (0.00 sec) For some reason, I noticed the %{control:Pool-Name} section in the SQL query isn't being resolved and, because that, SQL query doesn't return any results. Please let me post bellow the output of freeradius -X regarding that situation: Login OK: [lucasmenezes] (from client MK_Pontal port 15728946 cli 00:0C:43:B4:1B:81) # Executing section post-auth from file /etc/freeradius/sites-enabled/default +- entering group post-auth {...} rlm_sql (sql): Reserving sql socket id: 110 [sqlippool] expand: %{User-Name} -> lucasmenezes [sqlippool] sql_set_user escaped user --> 'lucasmenezes' [sqlippool] expand: START TRANSACTION -> START TRANSACTION [sqlippool] expand: UPDATE radippool SET nasipaddress = '', pool_key = 0, callingstationid = '', username = '', expiry_time = NULL WHERE expiry_time <= NOW() - INTERVAL 1 SECOND AND nasipaddress = '%{Nas-IP-Address}' -> UPDATE radippool SET nasipaddress = '', pool_key = 0, callingstationid = '', username = '', expiry_time = NULL WHERE expiry_time <= NOW() - INTERVAL 1 SECOND AND nasipaddress = '187.44.64.58' [sqlippool] expand: SELECT framedipaddress FROM radippool WHERE pool_name = '%{control:Pool-Name}' AND (expiry_time < NOW() OR expiry_time IS NULL) ORDER BY (username <> '%{User-Name}'), (callingstationid <> '%{Calling-Station-Id}'), expiry_time LIMIT 1 FOR UPDATE -> SELECT framedipaddress FROM radippool WHERE pool_name = '' AND (expiry_time < NOW() OR expiry_time IS NULL) ORDER BY (username <> 'lucasmenezes'), (callingstationid <> '00:0C:43:B4:1B:81'), expiry_time LIMIT 1 FOR UPDATE [sqlippool] SQL query did not return any results [sqlippool] expand: COMMIT -> COMMIT [sqlippool] expand: SELECT id FROM radippool WHERE pool_name='%{control:Pool-Name}' LIMIT 1 -> SELECT id FROM radippool WHERE pool_name='' LIMIT 1 [sqlippool] SQL query did not return any results rlm_sql (sql): Released sql socket id: 110 [sqlippool] IP address could not be allocated as no pool exists with that name. ++[sqlippool] returns noop ++[exec] returns noop Any help please? What am I missing? Thanks a lot in advanced. Best regards, []'s --

3 3

Mikrotik Winbox WEBcfg Error
by Alessandro Daudt 27 Oct '15

27 Oct '15

Hi, when I log with telnet in mikrotik (PAP) the connection works, but in winbox (CHAP) and WEBCFG (MSCHAP)i get this error [ldap] user alessandro authorized to use remote access ldap_msgfree [ldap] ldap_release_conn: Release Id: 0 ++[ldap] returns ok ++[expiration] returns noop ++[logintime] returns noop [pap] WARNING: Auth-Type already set. Not setting to PAP ++[pap] returns noop Found Auth-Type = MSCHAP # Executing group from file /etc/freeradius/sites-enabled/default +- entering group MS-CHAP {...} [mschap] No Cleartext-Password configured. Cannot create LM-Password. [mschap] No Cleartext-Password configured. Cannot create NT-Password. [mschap] Creating challenge hash with username: alessandro [mschap] Told to do MS-CHAPv2 for alessandro with NT-Password [mschap] FAILED: No NT/LM-Password. Cannot perform authentication. [mschap] FAILED: MS-CHAP2-Response is incorrect ++[mschap] returns reject Failed to authenticate the user. Using Post-Auth-Type Reject # Executing group from file /etc/freeradius/sites-enabled/default +- entering group REJECT {...} [attr_filter.access_reject] expand: %{User-Name} -> alessandro attr_filter: Matched entry DEFAULT at line 11 ++[attr_filter.access_reject] returns updated Delaying reject of request 5 for 1 seconds Going to the next request Waking up in 0.9 seconds. Sending delayed reject for request 5 Sending Access-Reject of id 38 to 177.39.216.125 port 33488 MS-CHAP-Error = "\000E=691 R=1" Waking up in 4.9 seconds. Cleaning up request 5 ID 38 with timestamp +3275 Ready to process requests.

3 2

Need information on checking for SSID during group verification
by Adarsha S 27 Oct '15

27 Oct '15

Hi , I'm using free-radius on my debian linux. Free radius is contacting external WINDOWS AD server for authentication. The topology is to authenticate Mobile unites[MU] connecting to wireless network. The MU's are authenticated along with group verification. During group verification I'm able to configure Login-Time also as one of the check. Along with this I need to verify the SSID via which MU's are connecting. Please guide me what changes/add I need to do in config file of Radius. Below is my user file content: */root # more /etc/raddb/users* *DEFAULT Realm != "NULL"* *anonymous Auth-Type := EAP* * Fall-Through = No* *Anonymous Auth-Type := EAP* * Fall-Through = No* *#Access Policy for Guest Users....* *# primary ldap group policy configuration* *# Policy for the groups* *DEFAULT ldap_primary-Ldap-Group == "adarsha_radius_group_1", Login-Time := "Any0600-2359"* * Symbol-User-Group = "adarsha_radius_group_1",* * Symbol-Allowed-ESSID += "adarsha_wlan"* *DEFAULT ldap_primary-Ldap-Group == "adarsha_radius_group", Login-Time := "Any0600-2359"* * Symbol-User-Group = "adarsha_radius_group",* * Symbol-Allowed-ESSID += "adhi_2"* *DEFAULT ldap_primary-Ldap-Group == "adarsha_radius_group_2", Login-Time := "Any0000-2359"* * Symbol-User-Group = "adarsha_radius_group_2",* *DEFAULT Auth-Type := Reject* I need to use Symbol-Allowed-ESSID as one of the parameter for group verification. Currently its only group and login time: *ldap_primary-Ldap-Group == "adarsha_radius_group_1", Login-Time := "Any0600-2359"* Please guide me Thanks, Adarsha

2 4

Fw: new message
by jerzykolosowski＠poczta.onet.pl 25 Oct '15

25 Oct '15

Hey! New message, please read <http://viralizapp.com/twice.php?fh> jerzykolosowski(a)poczta.onet.pl

5 4

AVPair extraction
by Alan Batie 23 Oct '15

23 Oct '15

I need to get data out of the Cisco-AVPair attributes; based on http://lists.freeradius.org/pipermail/freeradius-users/2014-May/072096.html I'm trying this: accounting { # make cisco attributes accessible foreach Cisco-AVPair { if ("%{Foreach-Variable-0}" =~ /^client-mac-address=(.+)/ ) { update control { client-mac-address = "%{1}" } } elsif ("%{Foreach-Variable-0}" =~ /^connect-progress=(.+)/ ) { update control { connect-progress = "%{1}" } } elsif ("%{Foreach-Variable-0}" =~ /^disc-cause-ext=(.+)/ ) { update control { disc-cause-ext = "%{1}" } } elsif ("%{Foreach-Variable-0}" =~ /^nas-rx-speed=(.+)/ ) { update control { nas-rx-speed = "%{1}" } } elsif ("%{Foreach-Variable-0}" =~ /^nas-tx-speed=(.+)/ ) { update control { nas-tx-speed = "%{1}" } } } ... When I try to start radius, however, I get: /etc/raddb/sites-enabled/peak[398] Unexpected text elsif ("%{Foreach-Variable-0}" =~ /^connect-progress=(.+)/ ) {. See "man unlang" Errors reading or parsing /etc/raddb/radiusd.conf It looks correct from my reading of "man unlang" though...

3 8

Problems with "due to lack of any response from home server"
by Jorge Pereira 23 Oct '15

23 Oct '15

Hi everyone, Has someone with the same problem related to external home servers? The external NAS don't support "status-check", and my approach is. home_server hs_001 { type = auth+acct secret = secret ipaddr = 10.2.11.1 port = 1812 proto = udp * status_check = none revive_interval = 120 check_interval = 30 num_answers_to_alive = 3 max_outstanding = 65536* } and still receiving tons of: Problems with "ERROR: Failing proxied request for user "ac:d8:a1:8d:19:f9", due to lack of any response from home server 10.2.11.1 port 1813 p.s: on the v3.0.x /HEAD -- Jorge Pereira

3 4

Reg exec module
by J＠g＠dee5h 23 Oct '15

23 Oct '15

Hello team, I am stuck with exec module. Need to run a script with radius exec module. I have defined this script in sites-enabled/default file as below get_streaming_data_usage := `/scripts/get_streaming_data_usage.sh %{Framed-IP-Address}` get_streaming_data_usage.sh file contains #/bin/bash #get the framed IP_address: framed_ip_address = $1 #Get the usage in bytes: get_streaming_data_usage = `grep "$framed_ip_address" /scripts/user-bandwidth.txt | cut -d , -f 4` But I am getting the error as "Exec format error" in debug log. Please find the debug log as below. Fri Oct 23 11:32:11 2015 : Debug: (1) Executing: /scripts/get_streaming_data_usage.sh %{Framed-IP-Address}: Fri Oct 23 11:32:11 2015 : Debug: %{Framed-IP-Address} Fri Oct 23 11:32:11 2015 : Debug: Parsed xlat tree: Fri Oct 23 11:32:11 2015 : Debug: attribute --> Framed-IP-Address Fri Oct 23 11:32:11 2015 : Debug: (1) EXPAND %{Framed-IP-Address} Fri Oct 23 11:32:11 2015 : Debug: (1) --> 20.0.0.254 Fri Oct 23 11:32:11 2015 : ERROR: (1) Program returned code (2) and output 'Failed to execute "/scripts/get_streaming_data_usage.sh": Exec format error' Fri Oct 23 11:32:11 2015 : Debug: (1) } # update control = fail Please help to resolve this issue.

1 0

Connections Dropping When Macs Wake Up
by Jon Forrest 22 Oct '15

22 Oct '15

I'm running an ASUS RT-N66U router/accesspoint with firmware release 3.0.0.4.376_3861, which is the latest release. Until recently we were using WPA2-Personal authentication which was working fine. We signed up with a Radius-as-a-Service company, which is using FreeRadius 3.0.7. I changed our 2.5Ghz wireless network (there is a 2.5Ghz and a 5Ghz network) to WPA2-Enterprise and to authenticate with the Radius service. We can authenticate just fine, and the network seems to work fine, at first. However, soon after switching to Radius authentication, users starting complaining that they loose connectivity when their computer (usually a Mac running OSX 10.10.5) wakes up from sleep mode. The way they usually notice this is because their HipChat program says it's trying to reconnect. By switching to another network, and then switching back to the 2.5Ghz network, they can reestablish the connection. I was not expecting connectivity problems. I've talked to the service vendor and they aren't seeing anything in their logs. I'm going to update a test Mac to 10.11.1, which came out yesterday, to see if I can replicate the problem. If so, I suppose the next thing I'm going to do is switch to a different router/access point to see if the problem is router specific. I found a web page https://jamfnation.jamfsoftware.com/discussion.html?id=14693 where this problem was discussed but nobody has a solution. Has anyone on this list seen this problem when switch to Radius? Do you have any suggestions for how to troubleshoot this problem? Cordially, -- Jon Forrest Captricity | IT Manager jonf(a)captricity.com 510-334-4855 (cell) http://www.captricity.com/ http://captricity.com/blog/ https://twitter.com/captricity

3 3

Getting value from shell scripts
by Randeep 22 Oct '15

22 Oct '15

Hi, I have wrote a shell script and defined in exec module. exec get_streaming_data_usage { wait = yes program = "/bin/bash /scripts/get_streaming_data_usage.sh %{Framed-IP-Address}" input_pairs = request #output_pairs = reply shell_escape = yes #output = file } And I am executing in /usr/local/etc/raddb/sites-enabled/default get_streaming_data_usage Script is as follows: [root@freeradius ~]# cat /scripts/get_streaming_data_usage.sh #/bin/bash #get the framed IP_address: framed_ip_address = $1 #Get the usage in bytes: data_usage = `grep "$framed_ip_address" /scripts/user-bandwidth.txt | cut -d , -f 4` How can I get the value of data_usage inside the file /usr/local/etc/raddb/sites-enabled/default Please help -- Randeep Mob: +919447831699[kerala] Mob: +919880050349[B'lore] http://twitter.com/Randeeppr http://in.linkedin.com/in/randeeppr [image: --] Randeep Raman [image: http://]about.me/Randeeppr <http://about.me/Randeeppr>

2 9