- Freeradius-Users - lists.freeradius.org

Proxy request check problem
by Peter Balsianok 21 Sep '15

21 Sep '15

Hi, I have following proxy configuration require_message_authenticator = yes type = auth port = 1812 secret = "pT65w44WzAqYOraNgE" #response_window = 20 # Not necessary defined in home_server default section #zombie_period = 40 # Without status check #status_check = none #revive_interval = 120 # Status check via existing user status_check = request check_interval = 6 num_answers_to_alive = 3 username = "orange-system" password = "incorrect" # We dont need Access-Accept, enougth is Access-Reject 15:34:29.016422 IP (tos 0x0, ttl 64, id 8072, offset 0, flags [none], proto: UDP (17), length: 118) tdrad1.vas.orange.sk.59157 > 10.14.135.19.radius: [udp sum ok] RADIUS, length: 90 Accounting Request (4), id: 0xea, Authenticator: 50365561fa7ae6cca5a956834b05dea8 Username Attribute (1), length: 15, Value: orange-system 0x0000: 6f72 616e 6765 2d73 7973 7465 6d Accounting Status Attribute (40), length: 6, Value: Stop 0x0000: 0000 0002 Accounting Session ID Attribute (44), length: 10, Value: 00000000 0x0000: 3030 3030 3030 3030 Event Timestamp Attribute (55), length: 6, Value: Mon Sep 21 15:34:29 2015 0x0000: 5600 0765 NAS ID Attribute (32), length: 33, Value: Status Check 64. Are you alive? 0x0000: 5374 6174 7573 2043 6865 636b 2036 342e 0x0010: 2041 7265 2079 6f75 2061 6c69 7665 3f 15:34:36.918919 IP (tos 0x0, ttl 64, id 8074, offset 0, flags [none], proto: UDP (17), length: 118) tdrad1.vas.orange.sk.59157 > 10.14.135.19.radius: [udp sum ok] RADIUS, length: 90 Accounting Request (4), id: 0xe9, Authenticator: 2f14cead04b5c267c9c85514235e5d48 Username Attribute (1), length: 15, Value: orange-system 0x0000: 6f72 616e 6765 2d73 7973 7465 6d Accounting Status Attribute (40), length: 6, Value: Stop 0x0000: 0000 0002 Accounting Session ID Attribute (44), length: 10, Value: 00000000 0x0000: 3030 3030 3030 3030 Event Timestamp Attribute (55), length: 6, Value: Mon Sep 21 15:34:36 2015 0x0000: 5600 076c NAS ID Attribute (32), length: 33, Value: Status Check 65. Are you alive? 0x0000: 5374 6174 7573 2043 6865 636b 2036 352e 0x0010: 2041 7265 2079 6f75 2061 6c69 7665 3f

1 0

Freeradius DHCP and radius accounting
by Alain Cocconi 21 Sep '15

21 Sep '15

Hi, I've a working configuration with Freeradius doing radius AAA for PPPoE subscribers on a Cisco ASR1006 BRAS and proxiing accounting packets to a Subscriber Management Policer (SMP) server. Each time a subscriber is authenticated, a radius Class attribute is send into the replied packet, then the BRAS put it in each radius accounting packets. Those accounting packets are proxied to the SMP server by the Freeradius server. These configuration is working fine since many many years now. But because of FTTH is coming in my region now, I've to switch from PPPoE to a IPoE and using DHCP. So I've done a lab with a working Freeradius DHCP server (Freeradius DHCP is working great!), but after checking again and again docs, wiki and web, I can't find a solution to do a radius accounting packet instead of a DHCP accounting packet or asking my cisco to do radius accounting and not DHCP accounting. If someone has an idea it would be nice to share it with me. Regards --

2 1

Freeradius - Client not authenticated
by Federico Olivieri 21 Sep '15

21 Sep '15

Hi All, That's my first e-mail and freeradius installation. Sorry if I didn't give you all info required or if my e-mail is wrong. I just finished to set up freeradius with MySQL and daloRADIUS on my Raspi. Exciting!!! (I followed this link - http://www.binaryheartbeat.net/2013/12/raspberry-pi-based-freeradius-server… ) I added a user via daloRADIUS, I can see the entry in MySQL but I m not able to authenticate my wifi device. I enabled the debug mode with freeradius-XXX command and I got as following: rad_recv: Access-Request packet from host 192.168.0.5 port 48785, id=0, length=121 User-Name = "wiko" NAS-IP-Address = 192.168.0.5 Called-Station-Id = "54a0505814c4" Calling-Station-Id = "00738da980df" NAS-Identifier = "54a0505814c4" NAS-Port = 54 Framed-MTU = 1400 NAS-Port-Type = Wireless-802.11 EAP-Message = 0x020000090177696b6f Message-Authenticator = 0x3fea51568bbe9b1d3e4803bed98db11b Fri Sep 18 21:57:15 2015 : Info: # Executing section authorize from file /etc/freeradius/sites-enabled/default Fri Sep 18 21:57:15 2015 : Info: +- entering group authorize {...} Fri Sep 18 21:57:15 2015 : Info: ++[preprocess] returns ok Fri Sep 18 21:57:15 2015 : Info: ++[chap] returns noop Fri Sep 18 21:57:15 2015 : Info: ++[mschap] returns noop Fri Sep 18 21:57:15 2015 : Info: ++[digest] returns noop Fri Sep 18 21:57:15 2015 : Info: [suffix] No '@' in User-Name = "wiko", looking up realm NULL Fri Sep 18 21:57:15 2015 : Info: [suffix] No such realm "NULL" Fri Sep 18 21:57:15 2015 : Info: ++[suffix] returns noop Fri Sep 18 21:57:15 2015 : Info: [eap] EAP packet type response id 0 length 9 Fri Sep 18 21:57:15 2015 : Info: [eap] No EAP Start, assuming it's an on-going EAP conversation Fri Sep 18 21:57:15 2015 : Info: ++[eap] returns updated Fri Sep 18 21:57:15 2015 : Info: ++[files] returns noop Fri Sep 18 21:57:15 2015 : Info: [sql] expand: %{User-Name} -> wiko Fri Sep 18 21:57:15 2015 : Info: [sql] sql_set_user escaped user --> 'wiko' Fri Sep 18 21:57:15 2015 : Debug: rlm_sql (sql): Reserving sql socket id: 2 Fri Sep 18 21:57:15 2015 : Info: [sql] expand: SELECT id, username, attribute, value, op FROM radcheck WHERE username = '%{SQL-User-Name}' ORDER BY id -> SELECT id, username, attribute, value, op FROM radcheck WHERE username = 'wiko' ORDER BY id Fri Sep 18 21:57:15 2015 : Info: [sql] User found in radcheck table Fri Sep 18 21:57:15 2015 : Info: [sql] expand: SELECT id, username, attribute, value, op FROM radreply WHERE username = '%{SQL-User-Name}' ORDER BY id -> SELECT id, username, attribute, value, op FROM radreply WHERE username = 'wiko' ORDER BY id Fri Sep 18 21:57:15 2015 : Info: [sql] expand: SELECT groupname FROM radusergroup WHERE username = '%{SQL-User-Name}' ORDER BY priority -> SELECT groupname FROM radusergroup WHERE username = 'wiko' ORDER BY priority Fri Sep 18 21:57:15 2015 : Info: [sql] expand: SELECT id, groupname, attribute, Value, op FROM radgroupcheck WHERE groupname = '%{Sql-Group}' ORDER BY id -> SELECT id, groupname, attribute, Value, op FROM radgroupcheck WHERE groupname = 'WiFi_Users' ORDER BY id Fri Sep 18 21:57:15 2015 : Info: [sql] User found in group WiFi_Users Fri Sep 18 21:57:15 2015 : Info: [sql] expand: SELECT id, groupname, attribute, value, op FROM radgroupreply WHERE groupname = '%{Sql-Group}' ORDER BY id -> SELECT id, groupname, attribute, value, op FROM radgroupreply WHERE groupname = 'WiFi_Users' ORDER BY id Fri Sep 18 21:57:15 2015 : Debug: rlm_sql (sql): Released sql socket id: 2 Fri Sep 18 21:57:15 2015 : Info: ++[sql] returns ok Fri Sep 18 21:57:15 2015 : Info: ++[expiration] returns noop Fri Sep 18 21:57:15 2015 : Info: ++[logintime] returns noop Fri Sep 18 21:57:15 2015 : Info: [pap] WARNING: Auth-Type already set. Not setting to PAP Fri Sep 18 21:57:15 2015 : Info: ++[pap] returns noop Fri Sep 18 21:57:15 2015 : Info: Found Auth-Type = Accept Fri Sep 18 21:57:15 2015 : Info: Auth-Type = Accept, accepting the user Fri Sep 18 21:57:15 2015 : Info: # Executing section post-auth from file /etc/freeradius/sites-enabled/default Fri Sep 18 21:57:15 2015 : Info: +- entering group post-auth {...} Fri Sep 18 21:57:15 2015 : Info: [sql] expand: %{User-Name} -> wiko Fri Sep 18 21:57:15 2015 : Info: [sql] sql_set_user escaped user --> 'wiko' Fri Sep 18 21:57:15 2015 : Info: [sql] expand: %{User-Password} -> Fri Sep 18 21:57:15 2015 : Info: [sql] ... expanding second conditional Fri Sep 18 21:57:15 2015 : Info: [sql] expand: %{Chap-Password} -> Fri Sep 18 21:57:15 2015 : Info: [sql] expand: INSERT INTO radpostauth (username, pass, reply, authdate) VALUES ( '%{User-Name}', '%{%{User-Password}:-%{Chap-Password}}', '%{reply:Packet-Type}', '%S') -> INSERT INTO radpostauth (username, pass, reply, authdate) VALUES ( 'wiko', '', 'Access-Accept', '2015-09-18 21:57:15') Fri Sep 18 21:57:15 2015 : Debug: rlm_sql (sql) in sql_postauth: query is INSERT INTO radpostauth (username, pass, reply, authdate) VALUES ( 'wiko', '', 'Access-Accept', '2015-09-18 21:57:15') Fri Sep 18 21:57:15 2015 : Debug: rlm_sql (sql): Reserving sql socket id: 1 Fri Sep 18 21:57:15 2015 : Debug: rlm_sql (sql): Released sql socket id: 1 Fri Sep 18 21:57:15 2015 : Info: ++[sql] returns ok Fri Sep 18 21:57:15 2015 : Info: ++[exec] returns noop Sending Access-Accept of id 0 to 192.168.0.5 port 48785 Fri Sep 18 21:57:15 2015 : Info: Finished request 1. Fri Sep 18 21:57:15 2015 : Debug: Going to the next request Fri Sep 18 21:57:15 2015 : Debug: Waking up in 4.9 seconds. Fri Sep 18 21:57:20 2015 : Info: Cleaning up request 1 ID 0 with timestamp +95 Fri Sep 18 21:57:20 2015 : Info: Ready to process requests. I don't understand the majority of those messages. Can someone help me to understand where is the error? Thanks Federico

2 1

filtering accounting
by Randeep 21 Sep '15

21 Sep '15

Hi, We are using FreeRadius 3.0.8. and Mikrotik NAS. We have a MPLS vpn where our clients are connected. We are providing IPTV in our LAN and also internet through the same connection. The problem is, We want to account only internet traffic. Not IPTV traffic. How we can filter it. In the interim update, we are not getting any ip information. Else we could have omitted the traffic where our streaming server ips are included. Please suggest some solution. Regards, Randeep

1 0

EAP-FAST Support
by Wegener, Norbert 21 Sep '15

21 Sep '15

EAP-FAST seems not being widely used. The latest thread on this topic that I found is: http://lists.freeradius.org/pipermail/freeradius-users/2014-September/07358… There it is mentioned, that: rlm_eap2 was removed from v3.0.x so if you're building 3.0.0 the module won't be available. As EAP-FAST could be used with the experimental rlm_eap2 : Does this mean, Freeradius 3.x does not support EAP FAST? Norbert Wegener

6 9

custom message for ldap authentication
by Daniele Mantovani 19 Sep '15

19 Sep '15

Hi, I've started using freeradius (current version 2.2.5) on a debian machine to authenticate user on a wifi hotspot. I'm currently using it without any problem, and it work greats! At the moment I'm using ldap (on a windows server 2008 active directory), pop and exec module to authenticate different realm. I only need to improve a little bit the replay message when an authentication fail. Currently I've a generic replay message on the end of the users file, but I want to make some specific message for the ldap user: I'm checking if a user is part of an ldap group to give them access. Here's a little bit of configuration users file DEFAULT Realm == NULL, osdbLDAP-Ldap-Group =="InternetAccess",Autz-Type := osdbLDAP, Auth-Type := osdbLDAP DEFAULT Auth-Type := Reject Reply-Message = "You are not authorized" radiusd.conf ldap osdbLDAP{ dictionary_mapping = ${raddbdir}/ldap.attrmap server = "*****" basedn = "cn=Users,dc=osdbsesto,dc=local" filter = "(sAMAccountName=%{Stripped-User-Name})" identity = "cn=ldap-proxy,cn=Users,dc=osdbsesto,dc=local" password = "****" #groupmembership_filter = "(&(objectClass=group)(member=%{Ldap-UserDn}))" groupmembership_filter = "(&(objectcategory=group)(member:1.2.840.113556.1.4.1941:=%{control:Ldap-UserDn}))" groupmembership_attribute = "memberOf" chase_referrals = yes rebind =yes } My goal is to have an error message for not valid user credential, and one message for user not in group. I've red the documentation about the ldap module, and I've seen 2 possible way of get this: -using the post-auth in the virtual server, and checking the group: I've seen in the ldap module documentation that I can check the group in the post-auth of my virtual server, but it's not documented well, so I've many questions: --to do that, I simply need to remove the 'osdbLDAP-Ldap-Group == "InternetAccess"' part in users file, and add something like this in post-auth block? if (osdbLDAP-Ldap-Group == "InternetAccess") { noop } else { reject } -- can I user the unlang in this block? for example, can I do this? else { Reply-Message = "You aren't in the right group" reject } -- does this check work with the recursive group filter? (I'm checking if user is in the group, or in a sub group) (groupmembership_filter = "(&(objectcategory=group)(member:1.2.840.113556.1.4.1941:=%{control:Ldap-UserDn}))") -- can I catch somewhere the "not authenticate" state? (where I can set a custom message) - the other way I've found to do this is add a second line in the users file, after the line that authenticate if user is valid and in the group, and to the same check as before, but without the group. In that case, I can set a custom replay message (the user is valid but not in the group) and, stopping the fall trough, I think I can reject the user. This should work, but, if I'm not wrong, this will do another call to the ldap server Any suggestion, tip, link or documentation I can read? Thanks to all Best Regards Mix

2 1

problem solved: "Couldn't connect socket to PostgreSQL server"
by Kurt Weiß 19 Sep '15

19 Sep '15

Hi Community. I spent about two hours to figure out following problem: although my configuration was correct, freeradius didn't connect with my postgres database. following error was logged: Info: rlm_sql (sql): Attempting to connect to radius@127.0.0.1:5432/radius Info: rlm_sql (sql): Attempting to connect rlm_sql_postgresql #0 Error: rlm_sql_postgresql: Couldn't connect socket to PostgreSQL server radius@127.0.0.1:radius Error: rlm_sql (sql): Failed to connect DB handle #0 after searching for (not existent) configuration failures i looked into the postgres log. (wow, what for an idea!) There was an entry: CEST LOG: could not accept SSL connection: EOF detected Postgres was configured to work over SSL. Freeradius does not seem to support Postgres over SSL. I deactivated SSL in Postgres and the freeradius server connected. Because no such info seems to exist in Internet, i decided to write it into this list. greetings...

4 3

Hourly qouta problem
by kasra kazempour 19 Sep '15

19 Sep '15

Hi everyone, I am using freeradius 3.0.8 and i configured sql and sqlcounter with sqlite. I have counters for max_daily_session and max_session and working probably. I have a scenario to qouta work with hours. For example: i want to qouta only work from 8:00 to 16:00 or or qouta disable after 16:00! Is it possible to do this?! Please help me to solve this issue. Thanks. -- -- *Kasra Kazempour * Technical Manager/CTO Of OANC Co. *Tel:*+98(21) 88970926-7 *Cell:*+98(912) 276 5330 *www.oanc.ir* <http://www.oanc.ir/> *www.mitautm.ir <http://www.mitautm.ir>* -------------------------------------------------------------------------------------------------- This e-mail contains material that is confidential for the sole use of the intended recipient. Any review, reliance or distribution by others or forwarding without express permission is strictly prohibited. If you are not the intended recipient, please contact the sender and delete all copies. Please consider the environment before printing this email

3 3

radiusd segfault (3.0.8/RHEL7)
by Mohamed Lrhazi 18 Sep '15

18 Sep '15

Hello, I have FreeRADIUS 3.0.8 running on three servers for a couple of months now... today one of them crashed with this single error in the log... Sep 18 15:25:29 radius-prod-3 kernel: radiusd[13672]: segfault at 130 ip 000000000043a29d sp 00007fde65139c30 error 4 in radiusd[400000+5f000] I imagine that not much log to work with, but have to ask anyways :) Any similar known issues? [root@radius-prod-3 ~]# radiusd -v radiusd: FreeRADIUS Version 3.0.8, for host x86_64-redhat-linux-gnu, built on Jul 25 2015 at 00:56:22 Thanks, Mohamed.

2 1

Dropping NAS-Port AVP from Acct-Unique-Session-Id by default
by Nick Lowe 18 Sep '15

18 Sep '15

I noticed looking through the commits in FreeRADIUS 3.1 that the Acct-Unique-Session-Id is now using the Acct-Multi-Session-Id in its construction. Awesome! :) I wondered while looking at the commit if there has been consideration about dropping the NAS-Port in the construction so that FreeRADIUS interoperates, in its default configuration, with wireless controllers that keep the same Acct-Session-Id when a roam occurs from one BSS/AP to another BSS/AP? In that scenario, it is, of course, the controller that is the NAS, not the APs. Some controllers set the value of the NAS-Port attribute on per AP or BSS basis and this therefore changes where a roam occurs. In my opinion, vendors should be sending a Stop and a Start when a roam occurs with a constant Acct-Multi-Session-Id being used to allow sessions to be correlated, but this not the case today. This has been written about by others too: http://daniele.albrizio.it/how-to_/freeradiusacct-unique-session-idfix I was looking in to this area of FreeRADIUS more closely as I have been engaging with Aerohive on their Acct-Session-Ids. The upcoming HiveOS releases will have Acct-Session-Ids that have the properties of a GUID/UUID. At the moment, they're just incremented and are therefore not guaranteed to be unique across reboots. Cheers, Nick Lowe

3 17