- Freeradius-Users - lists.freeradius.org

Hourly qouta problem
by kasra kazempour 19 Sep '15

19 Sep '15

Hi everyone, I am using freeradius 3.0.8 and i configured sql and sqlcounter with sqlite. I have counters for max_daily_session and max_session and working probably. I have a scenario to qouta work with hours. For example: i want to qouta only work from 8:00 to 16:00 or or qouta disable after 16:00! Is it possible to do this?! Please help me to solve this issue. Thanks. -- -- *Kasra Kazempour * Technical Manager/CTO Of OANC Co. *Tel:*+98(21) 88970926-7 *Cell:*+98(912) 276 5330 *www.oanc.ir* <http://www.oanc.ir/> *www.mitautm.ir <http://www.mitautm.ir>* -------------------------------------------------------------------------------------------------- This e-mail contains material that is confidential for the sole use of the intended recipient. Any review, reliance or distribution by others or forwarding without express permission is strictly prohibited. If you are not the intended recipient, please contact the sender and delete all copies. Please consider the environment before printing this email

3 3

radiusd segfault (3.0.8/RHEL7)
by Mohamed Lrhazi 18 Sep '15

18 Sep '15

Hello, I have FreeRADIUS 3.0.8 running on three servers for a couple of months now... today one of them crashed with this single error in the log... Sep 18 15:25:29 radius-prod-3 kernel: radiusd[13672]: segfault at 130 ip 000000000043a29d sp 00007fde65139c30 error 4 in radiusd[400000+5f000] I imagine that not much log to work with, but have to ask anyways :) Any similar known issues? [root@radius-prod-3 ~]# radiusd -v radiusd: FreeRADIUS Version 3.0.8, for host x86_64-redhat-linux-gnu, built on Jul 25 2015 at 00:56:22 Thanks, Mohamed.

2 1

Dropping NAS-Port AVP from Acct-Unique-Session-Id by default
by Nick Lowe 18 Sep '15

18 Sep '15

I noticed looking through the commits in FreeRADIUS 3.1 that the Acct-Unique-Session-Id is now using the Acct-Multi-Session-Id in its construction. Awesome! :) I wondered while looking at the commit if there has been consideration about dropping the NAS-Port in the construction so that FreeRADIUS interoperates, in its default configuration, with wireless controllers that keep the same Acct-Session-Id when a roam occurs from one BSS/AP to another BSS/AP? In that scenario, it is, of course, the controller that is the NAS, not the APs. Some controllers set the value of the NAS-Port attribute on per AP or BSS basis and this therefore changes where a roam occurs. In my opinion, vendors should be sending a Stop and a Start when a roam occurs with a constant Acct-Multi-Session-Id being used to allow sessions to be correlated, but this not the case today. This has been written about by others too: http://daniele.albrizio.it/how-to_/freeradiusacct-unique-session-idfix I was looking in to this area of FreeRADIUS more closely as I have been engaging with Aerohive on their Acct-Session-Ids. The upcoming HiveOS releases will have Acct-Session-Ids that have the properties of a GUID/UUID. At the moment, they're just incremented and are therefore not guaranteed to be unique across reboots. Cheers, Nick Lowe

3 17

AW: FR 3.0.9 RADSEC with TLS 1.2
by Stabla, Daniel 18 Sep '15

18 Sep '15

Hi, I installed openssl 1.0.1p, but the error still exists. Another user mentioned to try FR 3.0.10 from github, what I did, but the error appears with this version too. Any other ideas? Kind regards. D. Stabla On Sep 17, 2015, at 6:11 AM, Stabla, Daniel <dstabla(a)materna.de <mailto:dstabla@materna.de>> wrote: > we are testing FR 3.0.9 with radsec, but it seems not to work > if our access point uses TLS 1.2. > > Environment: > FR 3.0.9 on SLES 12 > OpenSSL 1.0.1j (selfcompiled, configured with --prefix=/opt/openssl1.0.1j -fPIC shared linux-x86_64) > LANCOM L-1302acn / Firmware 9.10 I'd say upgrade OpenSSL. Alan DeKok. - List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html

2 1

Freeradius with CISCO Port Security
by Victor Sokphak 17 Sep '15

17 Sep '15

Dear All, I'm not sure if cisco port security support with radius authentication base on MAC address or not. If anyone used to do that, please give me some clue. Thanks, Sokphak

3 3

Info: No Pool-Name defined. Trying to add new APN
by Sophie Loewenthal 17 Sep '15

17 Sep '15

Hi guys, I have been trying to work out why our new APN cannot have any IP addresses allocated. The IP addresses should come from an existing pool already in use by other APNs. I've inherited this from since departed colleagues. I did post this a earlier but thought I should start a fresh thread with debug infomation. FreeRadius package is : freeradius-2.1.12-1.el6.x86_64 / Centos 6 The user name is 0TESTUSER1 The new APN is m2m.vod.trim.com In the users file I added , DEFAULT NAS-IP-Address == 195.123.123.0, Pool-Name := vodafone DEFAULT NAS-IP-Address == 195.123.123.50, Pool-Name := vodafone DEFAULT NAS-IP-Address == 195.123.123.51, Pool-Name := vodafone DEFAULT NAS-IP-Address == 195.123.123.52, Pool-Name := vodafone DEFAULT NAS-IP-Address == 195.123.123.53, Pool-Name := vodafone DEFAULT NAS-IP-Address == 195.123.123.54, Pool-Name := vodafone The first line already worked with another APN with IP addresses assigned. When I tried to authenticate with our new SIM and APN log in worked but no pool was defined. Tue Sep 15 09:42:25 2015 : Auth: Login OK: [0TESTUSER1] (from client vodafone-nas-m2m-51 port 511026 cli 882393728079768) Tue Sep 15 09:42:25 2015 : Info: No Pool-Name defined (did m2m.vod.trim.com cli 882393728079768 port 511026 user 0TESTUSER1) Debug: I ran in debug to see if I could get any more info and you'll find thus below. I'd be grateful if somebody would let me know how I mend this, or point me the right direction? Thanks and kind regards, Sophie [sql] expand: UPDATE radacct SET acctstoptime = '%S', acctsessiontime = '%{Acct-Session-Time}', acctinputoctets = '%{%{Acct-Input-Gigawords}:-0}' << 32 | '%{%{Acct-Input-Octets}:-0}', acctoutputoctets = '%{%{Acct-Output-Gigawords}:-0}' << 32 | '%{%{Acct-Output-Octets}:-0}', acctterminatecause = '%{Acct-Terminate-Cause}', acctstopdelay = '%{%{Acct-Delay-Time}:-0}', connectinfo_stop = '%{Connect-Info}' WHERE acctsessionid = '%{Acct-Session-Id}' AND username = '%{SQL-User-Name}' AND nasipaddress = '%{NAS-IP-Address}' -> UPDATE radacct SET acctstoptime = '2015-09-15 09:46:13', acctsessiontime = '510', acctinputoctets = '0' << 32 | '2643', acctoutputoctets = '0' << 32 | rlm_sql (sql): Reserving sql socket id: 0 rlm_sql (sql): Released sql socket id: 0 ++[sql] returns ok ++[exec] returns noop [attr_filter.accounting_response] expand: %{User-Name} -> 000005a8a attr_filter: Matched entry DEFAULT at line 12 ++[attr_filter.accounting_response] returns updated Finished request 128. Going to the next request Thread 4 waiting to be assigned a request Waking up in 0.6 seconds. Thread 5 got semaphore Thread 5 handling request 129, (17 handled so far) [<thread>] # Executing section authorize from file /etc/raddb/sites-enabled/default [<thread>] +- entering group authorize {...} ++[preprocess] returns ok ++[chap] returns noop ++[digest] returns noop [eap] No EAP-Message, not doing EAP ++[eap] returns noop [files] users: Matched entry DEFAULT at line 228 ++[files] returns ok [sql] expand: %{User-Name} -> 0TESTUSER1 [sql] sql_set_user escaped user --> '0TESTUSER1' rlm_sql (sql): Reserving sql socket id: 23 [sql] expand: SELECT id, username, attribute, value, op FROM radcheck WHERE username = '%{SQL-User-Name}' ORDER BY id -> SELECT id, username, attribute, value, op FROM radcheck WHERE username = '0TESTUSER1' ORDER BY id [sql] User found in radcheck table [sql] expand: SELECT id, username, attribute, value, op FROM radreply WHERE username = '%{SQL-User-Name}' ORDER BY id -> SELECT id, username, attribute, value, op FROM radreply WHERE username = '0TESTUSER1' ORDER BY id [sql] expand: SELECT groupname FROM radusergroup WHERE username = '%{SQL-User-Name}' ORDER BY priority -> SELECT groupname FROM radusergroup WHERE username = '0TESTUSER1' ORDER BY priority [sql] expand: SELECT id, groupname, attribute, Value, op FROM radgroupcheck WHERE groupname = '%{Sql-Group}' ORDER BY id -> SELECT id, groupname, attribute, Value, op FROM radgroupcheck WHERE groupname = 'm2m.vod.trim.com' ORDER BY id [sql] User found in group m2m.vod.trim.com [sql] expand: SELECT id, groupname, attribute, value, op FROM radgroupreply WHERE groupname = '%{Sql-Group}' ORDER BY id -> SELECT id, groupname, attribute, value, op FROM radgroupreply WHERE groupname = 'm2m.vod.trim.com' ORDER BY id rlm_sql (sql): Released sql socket id: 23 ++[sql] returns ok ++[expiration] returns noop ++[logintime] returns noop ++[pap] returns updated Found Auth-Type = PAP # Executing group from file /etc/raddb/sites-enabled/default +- entering group PAP {...} [pap] login attempt with password "F8BB45FCDC59995EE2C12A96E10B1091" [pap] Using clear text password "F8BB45FCDC59995EE2C12A96E10B1091" [pap] User authenticated successfully ++[pap] returns ok Login OK: [0TESTUSER1] (from client vodafone-nas-m2m-51 port 443593 cli 882393728079768) # Executing section post-auth from file /etc/raddb/sites-enabled/default +- entering group post-auth {...} [sqlippool] No Pool-Name defined. [sqlippool] expand: No Pool-Name defined (did %{Called-Station-Id} cli %{Calling-Station-Id} port %{NAS-Port} user %{User-Name}) -> No Pool-Name defined (did m2m.vod.trim.com cli 882393728079768 port 443593 user 0TESTUSER1) No Pool-Name defined (did m2m.vod.trim.com cli 882393728079768 port 443593 user 0TESTUSER1) ++[sqlippool] returns noop [sql] expand: %{User-Name} -> 0TESTUSER1 [sql] sql_set_user escaped user --> '0TESTUSER1' [sql] expand: %{User-Password} -> F8BB45FCDC59995EE2C12A96E10B1091 [sql] expand: INSERT INTO radpostauth (username, pass, reply, authdate) VALUES ( '%{User-Name}', '%{%{User-Password}:-%{Chap-Password}}', '%{reply:Packet-Type}', '%S') -> INSERT INTO radpostauth (username, pass, reply, authdate) VALUES ( '0TESTUSER1', 'F8BB45FCDC59995EE2C12A96E10B1091', 'Access-Accept', '2015-09-15 09:46:13') rlm_sql (sql) in sql_postauth: query is INSERT INTO radpostauth (username, pass, reply, authdate) VALUES ( '0TESTUSER1', 'F8BB45FCDC59995EE2C12A96E10B1091', 'Access-Accept', '2015-09-15 09:46:13') rlm_sql (sql): Reserving sql socket id: 22 rlm_sql (sql): Released sql socket id: 22 ++[sql] returns ok ++[exec] returns noop Finished request 129. Going to the next request Thread 5 waiting to be assigned a request Waking up in 0.5 seconds. Thread 6 got semaphore Thread 6 handling request 130, (17 handled so far) [<thread>] # Executing section authorize from file /etc/raddb/sites-enabled/default [<thread>] +- entering group authorize {...} ++[preprocess] returns ok ++[chap] returns noop ++[digest] returns noop [eap] No EAP-Message, not doing EAP ++[eap] returns noop [files] users: Matched entry DEFAULT at line 207 ++[files] returns ok [sql] expand: %{User-Name} -> 357541001195173 [sql] sql_set_user escaped user --> '357541001195173' rlm_sql (sql): Reserving sql socket id: 21 ------------------------------------- END OF EMAIL ---------------------------------------------------

3 12

Transferring policy to v3.0.10
by David Aldwinckle 17 Sep '15

17 Sep '15

Hi All, In version 2.1.12 I had some unlang in /etc/raddb/policy.conf which I referenced in a number of virtual servers. In version 3.0.10, I notice that there is no more policy.conf. I found policy.d/filter but I was unsure if this was the correct place to put the config, and if I need to link it to mods-enabled. Any advice on where to put legacy policy.conf things, like the one I've included below? remote_netid_reject { if ((Realm == "netid.uwaterloo.ca") && \ (("%{Client-Shortname}" == "prod1-west.eduroam.ca") || \ ("%{Client-Shortname}" == "prod2-west.eduroam.ca") || \ ("%{Client-Shortname}" == "prod1-east.eduroam.ca") || \ ("%{Client-Shortname}" == "prod2-east.eduroam.ca") || \ ("%{Client-Shortname}" == "moose.bc.net") || \ ("%{Client-Shortname}" == "grizzly.bc.net"))) { reject } } Thanks, Dave

2 2

FR 3.0.9 RADSEC with TLS 1.2
by Stabla, Daniel 17 Sep '15

17 Sep '15

Hello, we are testing FR 3.0.9 with radsec, but it seems not to work if our access point uses TLS 1.2. Environment: FR 3.0.9 on SLES 12 OpenSSL 1.0.1j (selfcompiled, configured with --prefix=/opt/openssl1.0.1j -fPIC shared linux-x86_64) LANCOM L-1302acn / Firmware 9.10 If we use RADSEC with TLS 1.0/1.1 it works, but with TLS 1.2 we get this FR output: (0) Initiating new EAP-TLS session (0) Setting verify mode to require certificate from client (0) (other): before/accept initialization (0) TLS_accept: before/accept initialization (0) <<< TLS 1.2 [length 007e] (0) TLS_accept: SSLv3 read client hello A (0) >>> TLS 1.2 [length 0059] (0) TLS_accept: SSLv3 write server hello A (0) >>> TLS 1.2 [length 18c4] (0) TLS_accept: SSLv3 write certificate A (0) >>> TLS 1.2 [length 024d] (0) TLS_accept: SSLv3 write key exchange A (0) >>> TLS 1.2 [length 0096] (0) TLS_accept: SSLv3 write certificate request A (0) TLS_accept: SSLv3 flush data (0) TLS_accept: Need to read more data: SSLv3 read client certificate A (0) TLS_accept: Need to read more data: SSLv3 read client certificate A (0) In SSL Handshake Phase (0) In SSL Accept mode Waking up in 0.5 seconds. (0) <<< TLS 1.2 [length 0002] (0) ERROR: TLS Alert read:fatal:handshake failure (0) ERROR: TLS_accept: Failed in SSLv3 read client certificate A (0) ERROR: SSL says: error:14094410:SSL routines:SSL3_READ_BYTES:sslv3 alert handshake failure (0) ERROR: SSL_read failed inside of TLS (-1), TLS session failed (0) FAILED in TLS handshake receive Closing TLS socket from client port 11906 Client has closed connection ... shutting down socket auth from client (10.0.0.2, 11906) -> (*, 2083, virtual-server=radsec-guests) A debug output from our access point shows us this: *[RADSEC] 2015/09/17 11:36:29,316 Devicetime: 2015/09/17 11:37:26,575* *Beginning to establish RADSEC connection to 10.0.0.1:2083[INTRANET]* *->establishment begins, local port is 11163* ** *[TLS] 2015/09/17 11:36:29,332 Devicetime: 2015/09/17 11:37:26,577* *Creating connection 890 with peer 10.0.0.1:2083 for requester 'RB':* ** *[TLS] 2015/09/17 11:36:29,332 Devicetime: 2015/09/17 11:37:26,577* *Sending Client Hello on connection 890:* *-> adding renegotiation_info extension to client hello* *-> all fine, receive Server Hello* ** *[TLS] 2015/09/17 11:36:29,332 Devicetime: 2015/09/17 11:37:26,604* *Receiving Server Hello on connection 890:* *-> protocol version is TLSv1.2* *-> server refuses session resumption* *-> selected cipher suite is TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384* *-> parsing TLS extensions* *-> selected elliptic curve point format is uncompressed* *-> all fine, receive Certificate(s)* ** *[TLS] 2015/09/17 11:36:29,332 Devicetime: 2015/09/17 11:37:26,605* *Receiving Certificate(s) on connection 890:* *-> read certificate of CN=radius.materna.de (2182 bytes)* *-> read certificate of DC=com, DC=materna, CN=MATERNA Information & Communications (Root) (1887 bytes)* *-> read certificate of DC=com, DC=materna, CN=MATERNA-INFRASTRUCTURE-CA (2255 bytes)* *-> verification succeeded* *-> all fine, receiving Server Hello Done* ** *[TLS] 2015/09/17 11:36:29,332 Devicetime: 2015/09/17 11:37:26,614* *Receiving Server Key Exchange on connection 890:* *-> selected elliptic curve is secp256r1* *-> selected signature method is (sha256,rsa)* *-> signature match* ** *[TLS] 2015/09/17 11:36:29,332 Devicetime: 2015/09/17 11:37:26,618* *Receiving Certificate Request on connection 890:* *-> my own certificate's issuer is DC=com, DC=materna, CN=MATERNA-INFRASTRUCTURE-CA* *-> truncated CA name, exiting* ** *[TLS] 2015/09/17 11:36:29,332 Devicetime: 2015/09/17 11:37:26,618* *Preparing records to send on connection 890:* *-> not in application state, bailing out* ** *[TLS] 2015/09/17 11:36:29,332 Devicetime: 2015/09/17 11:37:26,618* *Closing connection 890 (broken packet received):* *--> application state not reached (ClientRcvServerHelloDone)* *--> sending failure to requester* ** *[RADSEC] 2015/09/17 11:36:29,332 Devicetime: 2015/09/17 11:37:26,619* *RADSEC connection to 10.0.0.1:2083[INTRANET] failed: Handshake failure* *->marking connection as dead* So is this a error created through FR or does the access point something wrong? Kind regards. D. Stabla

2 1

Radius, from 2 to 3 - radtest does not agree with its command line
by Cosme Faria Corrêa 17 Sep '15

17 Sep '15

Hi, I have an old server and this is the normal behavior: radtest johndoe 'jdsecret' 127.0.0.1 0 testing123 Sending Access-Request of id 52 to 127.0.0.1 port 1812 User-Name = "johndoe" User-Password = "jdsecret" NAS-IP-Address = 127.0.0.1 NAS-Port = 0 Message-Authenticator = 0x00000000000000000000000000000000 rad_recv: Access-Accept packet from host 127.0.0.1 port 1812, id=52, length=20 I am doing a new server and it is different now: radtest johndoe 'jdsecret' 127.0.0.1 0 testing123 Sending Access-Request Id 250 from 0.0.0.0:43561 to 127.0.0.1:1812 User-Name = "johndoe" User-Password = "jdsecret" NAS-IP-Address = 10.0.0.3 NAS-Port = 0 Message-Authenticator = 0x00 (0) No reply from server for ID 250 socket 3 ... Why is NAS-IP-Address = 10.0.0.3? It makes no sense to me. There is no 10.0.0.3 in my interfaces. There is nothing in log, of course. TIA -- Cosme Corrêa +55 21 4042-6606

3 3

Re: best way to split by "," and interate?
by Jorge Pereira 16 Sep '15

16 Sep '15

Ah! perfect, but i can't use Tmp-String with explode? Wed Sep 16 17:13:27 2015 : Debug: rlm_redis (redis_conf): Released connection (1) Wed Sep 16 17:13:27 2015 : Debug: (0) EXPAND %{redis_conf:HGET "radius-configurations" Develop_MacAddress} Wed Sep 16 17:13:27 2015 : Debug: (0) --> ca:de:ca:fe:00:01,aa:bb:cc:dd:ee:ff *Wed Sep 16 17:13:27 2015 : Debug: (0) &control:Tmp-String-1 := ca:de:ca:fe:00:01,aa:bb:cc:dd:ee:ff* Wed Sep 16 17:13:27 2015 : Debug: (0) } # update = noop Wed Sep 16 17:13:27 2015 : Debug: (0) if (&control:Tmp-String-0 && &control:Tmp-String-1) { Wed Sep 16 17:13:27 2015 : Debug: (0) if (&control:Tmp-String-0 && &control:Tmp-String-1) -> TRUE Wed Sep 16 17:13:27 2015 : Debug: (0) if (&control:Tmp-String-0 && &control:Tmp-String-1) { *Wed Sep 16 17:13:27 2015 : Debug: %{explode: &control:Tmp-String-1 ,}* Wed Sep 16 17:13:27 2015 : Debug: Parsed xlat tree: Wed Sep 16 17:13:27 2015 : Debug: xlat --> explode Wed Sep 16 17:13:27 2015 : Debug: { Wed Sep 16 17:13:27 2015 : Debug: literal --> &control:Tmp-String-1 , Wed Sep 16 17:13:27 2015 : Debug: } *Wed Sep 16 17:13:27 2015 : ERROR: (0) Invalid attribute name* Wed Sep 16 17:13:27 2015 : Debug: (0) EXPAND %{explode: &control:Tmp-String-1 ,} Wed Sep 16 17:13:27 2015 : Debug: (0) --> Wed Sep 16 17:13:27 2015 : Debug: (0) foreach &control:Tmp-String-1 Wed Sep 16 17:13:27 2015 : Debug: (0) if (&My-Mac-Address == "%{Foreach-Variable-0}") { Wed Sep 16 17:13:27 2015 : Debug: (0) EXPAND TMPL XLAT STRUCT Wed Sep 16 17:13:27 2015 : Debug: (0) EXPAND Foreach-Variable-0 Wed Sep 16 17:13:27 2015 : Debug: (0) --> ca:de:ca:fe:00:01,aa:bb:cc:dd:ee:ff Wed Sep 16 17:13:27 2015 : Debug: (0) EXPAND %{Foreach-Variable-0} Wed Sep 16 17:13:27 2015 : Debug: (0) --> ca:de:ca:fe:00:01,aa:bb:cc:dd:ee:ff Wed Sep 16 17:13:27 2015 : Debug: (0) if (&My-Mac-Address == "%{Foreach-Variable-0}") -> FALSE Wed Sep 16 17:13:27 2015 : Debug: (0) } # foreach &control:Tmp-String-1 = noop Wed Sep 16 17:13:27 2015 : Debug: (0) } # if (&control:Tmp-String-0 && &control:Tmp-String-1) = noop -- Jorge Pereira On Wed, Sep 16, 2015 at 1:54 PM, Arran Cudbard-Bell < a.cudbardb(a)freeradius.org> wrote: > > > On 16 Sep 2015, at 17:39, Jorge Pereira <jpereiran(a)gmail.com> wrote: > > > > Hi, > > > > I have a list > > > > update control { > > &Tmp-String-0 = > "aa:bb:cc:dd:ee:ff,00:11:22:33:44:55,ff:ee:dd:cc:bb:aa" > > } > > > > And I would like to know about the best approach to split by "," and > check > > if match with my ${Called-Station-Id} > > someone have a idea? > > "%{explode:&Called-Station-ID ,}" > > foreach &Called-Station-ID { > if ("%{Foreach-Variable-0}" =~ /expr/) { > <stuff> > } > } > > Arran Cudbard-Bell <a.cudbardb(a)freeradius.org> > FreeRADIUS development team > > FD31 3077 42EC 7FCD 32FE 5EE2 56CF 27F9 30A8 CAA2 > > > - > List info/subscribe/unsubscribe? See > http://www.freeradius.org/list/users.html >

1 3