- Freeradius-Users - lists.freeradius.org

poptop dns query
by Edwardo Garcia 02 Sep '15

02 Sep '15

Howdy, The poptop mailing list seem defunct? So I ask here, since also relevant. Trying to get DNS assignments from radius, I have verified that freeradius is sending it along with all other goodies verify by running with -X, so satisfy not a freeradius server problem. I have the required follow guide from wiki and many google site, the dictionary.microsoft and .merit in radiusclient from freeradius-client 1.1.7 too, and pptpd v1.4 and ppp 2.4.7, if I use in pppd it assigns OK, but for our new network project we need radius to assign, which it sends but the poptop client ignore, so not sure how to get ppptd/pppd to accept this value and send it to connections, has anyone got this setup and got this work? Willy

2 3

stale session
by Sergio Diaz 02 Sep '15

02 Sep '15

Hello Guys, I am simulating the problem on what if the AP goes down (due to various reasons). I observed that user is not properly disconnected and result is stale session. When the AP is up and when the previous user tries to log in he/she gets login failed message because "Simultaneous-Use" is in effect while previous session is still ticking. How can prevent and fix this? Saludos Cordiales, Sergio Diaz Infraestructura TI 01(55) 5265.0145 (044) 55.28.99.95.71 sdiazf(a)logitel.com.mx www.logitel.com.mx

3 10

authorize file not being reread on HUP
by Jay Rouman 02 Sep '15

02 Sep '15

I am sure I am doing something wrong. We have all our user data in "authorize" and a HUP doesn't reread the file in 3.0.9. That version added the feature of ignoring a HUP unless a file had changed. It seems to recognize that a file has changed but it doesn't actually reload. After a HUP in 3.0.8: server inner-tunnel { # from file /usr/local/freeradius/etc/raddb/sites-enabled/inner-tunnel # Loading authenticate {...} # Loading authorize {...} # Loading session {...} # Loading post-proxy {...} # Loading post-auth {...} } # server inner-tunnel Ready to process requests 3.0.9: Listening on proxy address * port 53399 Ready to process requests Ready to process requests Received HUP signal HUP - No files changed. Ignoring <-- "authorize" changed here Ready to process requests Ready to process requests Received HUP signal HUP - Files loaded by a module have changed. Ready to process requests <-- no indication of an actual reload At this point radiusd doesn't answer queries with the new information in "authorize." -- Jay Rouman (jsr(a)dexter.mi.org jsr(a)edzone.net) Gratiot/Isabella RESD, Ithaca, Michigan

2 1

3rd-party certificates in FR3
by Иван Стрельников 02 Sep '15

02 Sep '15

Hello everyone! I'm using freeradius 3.0.9. And i want to realize next scheme: cisco wlc wi-fi -> freeradius -> mysql db. It's all ok with db, i just want to clear out the messages to end user about radius certificate. So, i want use a certificate, which root ca will be in apple\android's certificate stores. Maybe geotrust, maybe other. I didn't find how it should to install and i need help here. Thank you. tl;dr I need a cookbook how to setup chained certificate from other trusted root CA. -- BW, Ivan.

3 3

Basic problem about radius client secret
by Timmy 02 Sep '15

02 Sep '15

Dear all Users, I want to understand more about this. When we talk about freeradius client, it will include a string of characters called secret. Is this sting an encryption key string or a password for the connection? What should be the appropriate length of this sting? Thanks for your response. Yours Faithfully, Timmy

2 1

Accounting mysql
by nicolas.clo＠ricoh-industrie.fr 02 Sep '15

02 Sep '15

Hi List, I have a problem to log accounting informations to mysql, rlm_sql_mysql: ERROR 1582 (Incorrect parameter count in the call to native function 'FROM_UNIXTIME'): 42000 It seems to be that Freeradius can't retrieve "integer:Event-Timestamp" value. FreeRADIUS Version 3.0.10 (git #f7065a7), for host i486-pc-linux-gnu, built on Sep 1 2015 at 15:39:31 on Debian 7.8 Mysql 5.5.35 Wed Sep 2 08:38:21 2015 : Debug: INSERT INTO radacct (acctsessionid, acctuniqueid, username, realm, nasipaddress, nasportid, nasporttype, acctstarttime, acctupdatetime, acctstoptime, acctsessiontime, acctauthentic, connectinfo_start, connectinfo_stop, acctinputoctets, acctoutputoctets, calledstationid, callingstationid, acctterminatecause, servicetype, framedprotocol, framedipaddress) VALUES ('%{Acct-Session-Id}', '%{Acct-Unique-Session-Id}', '%{SQL-User-Name}', '%{Realm}', '%{NAS-IP-Address}', '%{%{NAS-Port-ID}:-%{NAS-Port}}', '%{NAS-Port-Type}', FROM_UNIXTIME(%{integer:Event-Timestamp}), FROM_UNIXTIME (%{integer:Event-Timestamp}), NULL, '0', '%{Acct-Authentic}', '%{Connect-Info}', '', '0', '0', '%{Called-Station-Id}', '%{Calling-Station-Id}', '', '%{Service-Type}', '%{Framed-Protocol}', '%{Framed-IP-Address}') Wed Sep 2 08:38:21 2015 : Debug: Parsed xlat tree: Wed Sep 2 08:38:21 2015 : Debug: literal --> INSERT INTO radacct (acctsessionid, acctuniqueid, username, realm, nasipaddress, nasportid, nasporttype,acctstarttime, acctupdatetime, acctstoptime, acctsessiontime, acctauthentic, connectinfo_start, connectinfo_stop, acctinputoctets, acctoutputoctets, calledstationid, callingstationid, acctterminatecause, servicetype, framedprotocol, framedipaddress) VALUES (' Wed Sep 2 08:38:21 2015 : Debug: attribute --> Acct-Session-Id Wed Sep 2 08:38:21 2015 : Debug: literal --> ', ' Wed Sep 2 08:38:21 2015 : Debug: attribute --> Acct-Unique-Session-Id Wed Sep 2 08:38:21 2015 : Debug: literal --> ', ' Wed Sep 2 08:38:21 2015 : Debug: attribute --> SQL-User-Name Wed Sep 2 08:38:21 2015 : Debug: literal --> ', ' Wed Sep 2 08:38:21 2015 : Debug: attribute --> Realm Wed Sep 2 08:38:21 2015 : Debug: literal --> ', ' Wed Sep 2 08:38:21 2015 : Debug: attribute --> NAS-IP-Address Wed Sep 2 08:38:21 2015 : Debug: literal --> ', ' Wed Sep 2 08:38:21 2015 : Debug: if { Wed Sep 2 08:38:21 2015 : Debug: attribute --> NAS-Port-Id Wed Sep 2 08:38:21 2015 : Debug: } Wed Sep 2 08:38:21 2015 : Debug: else { Wed Sep 2 08:38:21 2015 : Debug: attribute --> NAS-Port Wed Sep 2 08:38:21 2015 : Debug: } Wed Sep 2 08:38:21 2015 : Debug: literal --> ', ' Wed Sep 2 08:38:21 2015 : Debug: attribute --> NAS-Port-Type Wed Sep 2 08:38:21 2015 : Debug: literal --> ', FROM_UNIXTIME( Wed Sep 2 08:38:21 2015 : Debug: xlat --> integer Wed Sep 2 08:38:21 2015 : Debug: { Wed Sep 2 08:38:21 2015 : Debug: literal --> Event-Timestamp Wed Sep 2 08:38:21 2015 : Debug: } Wed Sep 2 08:38:21 2015 : Debug: literal --> ), FROM_UNIXTIME( Wed Sep 2 08:38:21 2015 : Debug: xlat --> integer Wed Sep 2 08:38:21 2015 : Debug: { Wed Sep 2 08:38:21 2015 : Debug: literal --> Event-Timestamp Wed Sep 2 08:38:21 2015 : Debug: } Wed Sep 2 08:38:21 2015 : Debug: literal --> ), NULL, '0', ' Wed Sep 2 08:38:21 2015 : Debug: attribute --> Acct-Authentic Wed Sep 2 08:38:21 2015 : Debug: literal --> ', ' Wed Sep 2 08:38:21 2015 : Debug: attribute --> Connect-Info Wed Sep 2 08:38:21 2015 : Debug: literal --> ', '', '0', '0', ' Wed Sep 2 08:38:21 2015 : Debug: attribute --> Called-Station-Id Wed Sep 2 08:38:21 2015 : Debug: literal --> ', ' Wed Sep 2 08:38:21 2015 : Debug: attribute --> Calling-Station-Id Wed Sep 2 08:38:21 2015 : Debug: literal --> ', '', ' Wed Sep 2 08:38:21 2015 : Debug: attribute --> Service-Type Wed Sep 2 08:38:21 2015 : Debug: literal --> ', ' Wed Sep 2 08:38:21 2015 : Debug: attribute --> Framed-Protocol Wed Sep 2 08:38:21 2015 : Debug: literal --> ', ' Wed Sep 2 08:38:21 2015 : Debug: attribute --> Framed-IP-Address Wed Sep 2 08:38:21 2015 : Debug: literal --> ') Wed Sep 2 08:38:21 2015 : Debug: (10) sql: EXPAND INSERT INTO radacct (acctsessionid, acctuniqueid, username, realm, nasipaddress, nasportid, nasporttype,acctstarttime, acctupdatetime, acctstoptime, acctsessiontime, acctauthentic, connectinfo_start, connectinfo_stop, acctinputoctets, acctoutputoctets, calledstationid, callingstationid, acctterminatecause, servicetype, framedprotocol, framedipaddress) VALUES ('%{Acct-Session-Id}', '%{Acct-Unique-Session-Id}', '%{SQL-User-Name}', '%{Realm}', '%{NAS-IP-Address}', '%{%{NAS-Port-ID}:-%{NAS-Port}}', '%{NAS-Port-Type}', FROM_UNIXTIME(%{integer:Event-Timestamp}), FROM_UNIXTIME (%{integer:Event-Timestamp}), NULL, '0', '%{Acct-Authentic}', '%{Connect-Info}', '', '0', '0', '%{Called-Station-Id}', '%{Calling-Station-Id}', '', '%{Service-Type}', '%{Framed-Protocol}', '%{Framed-IP-Address}') Wed Sep 2 08:38:21 2015 : Debug: (10) sql: --> INSERT INTO radacct (acctsessionid, acctuniqueid, username, realm, nasipaddress, nasportid, nasporttype,acctstarttime, acctupdatetime, acctstoptime, acctsessiontime, acctauthentic, connectinfo_start, connectinfo_stop, acctinputoctets, acctoutputoctets, calledstationid, callingstationid, acctterminatecause, servicetype, framedprotocol, framedipaddress) VALUES ('00000028', '', 'Administrateur', '', '172.29.x.x', '284', 'Wireless-802.11', FROM_UNIXTIME(), FROM_UNIXTIME(), NULL, '0', 'RADIUS', '', '', '0', '0', '00xxxxxxxx', 'xxxxxxxxxxx', '', 'Framed-User', '', '') Wed Sep 2 08:38:21 2015 : Debug: (10) sql: Executing query: INSERT INTO radacct (acctsessionid, acctuniqueid, username, realm, nasipaddress, nasportid, nasporttype, acctstarttime, acctupdatetime, acctstoptime, acctsessiontime, acctauthentic, connectinfo_start, connectinfo_stop, acctinputoctets, acctoutputoctets, calledstationid, callingstationid, acctterminatecause, servicetype, framedprotocol, framedipaddress) VALUES ('00000028', '', 'Administrateur', '', '172.29.x.x', '284', 'Wireless-802.11', FROM_UNIXTIME(), FROM_UNIXTIME(), NULL, '0', 'RADIUS', '', '', '0', '0', 'xxxxxxxxxxxxx', 'xxxxxxxxxxxxxx', '', 'Framed-User', '', '') Wed Sep 2 08:38:21 2015 : Debug: rlm_sql_mysql: No additional diagnostic info on server Wed Sep 2 08:38:21 2015 : ERROR: (10) sql: rlm_sql_mysql: ERROR 1582 (Incorrect parameter count in the call to native function 'FROM_UNIXTIME'): 42000 Wed Sep 2 08:38:21 2015 : Debug: (10) sql: SQL query returned: server error Wed Sep 2 08:38:21 2015 : Debug: rlm_sql (sql): Released connection (6) Wed Sep 2 08:38:21 2015 : Debug: (10) modsingle[accounting]: returned from sql (rlm_sql) for request 10 Wed Sep 2 08:38:21 2015 : Debug: (10) [sql] = fail Wed Sep 2 08:38:21 2015 : Debug: (10) } # accounting = fail Wed Sep 2 08:38:21 2015 : Debug: (10) Not sending reply to client. Wed Sep 2 08:38:21 2015 : Debug: (10) Finished request Any ideas ? Thanks. Nicolas.

3 3

Fwd: PAM Radius COA
by Emma Benny 01 Sep '15

01 Sep '15

Hi, I'm new to Radius so I apologize if this is a stupid question. I could not find it answered in the archive after searching quite a bit. Does the pam_radius client support RFC 5176 ? Does it have support to get pushed DM or CoA messages from a freeRadius server and disconnect or force re-authentication of the user ? Thanks in advance, Emma

2 2

Re: Rest API for authentication
by Murat BEŞER 01 Sep '15

01 Sep '15

You could write proxy which provides a restfull api. Murat BEŞER Black-Solutionshttp://www.black-solutions.com ------ Original message------From: Herwin WeststrateDate: Tue, Sep 1, 2015 13:26To: FreeRadius users mailing list;Subject:Re: Rest API for authentication On 31-08-15 09:15, Randeep wrote:> Hi Alan,> > We have two types of IPTV boxes. One has pppoe support and other one> doesn't have pppoe support.> > We are using FreeRadius 3.0.8 for authentication.> > I remember you mentioning that authentication can be done via a rest api> also. So we can use this api for authentication for the device which> doesn't have the pppoe support.I think you've got a few things mixed up here. The rest module is just amodule that can run in different sections by calling an externalprocess/server via a RESTful API to do something. The added demo.pl addsa Cleartext-Password := testing123 to the control map, this could beused in the authorize section of a server, where for example the papmodule could compare the passwords in authenticate section. A bitcomparable to a lookup in a database to find the plaintext password.I've really got no idea how this would be related to iptv boxes thatdon't use pppoe. To me this sounds a bit like you heard about a conceptand now try to retrofit that concept to some completely unrelated problem.-- Herwin Weststrate-List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html

1 0

Windows 10 Random Mac Address
by Danner, Mearl 01 Sep '15

01 Sep '15

FYI. Haven't seen it mentioned here. Will create many headaches for folks using MAC authorization. https://www.ietf.org/proceedings/93/slides/slides-93-intarea-5.pdf Apple IOS 8 also. Mearl

5 7

regexp in authorize-File with FR3
by Anja Ruckdaeschel 01 Sep '15

01 Sep '15

Hi there, I use a lot of regex in the users - File in FR2. With FR3 it seems the regex in the authorize-File is compared as simple string. .... Tue Sep 1 14:56:10 2015 : Debug: ^(\.*)([a-zA-Z]{3}[0-9]{5}) Tue Sep 1 14:56:10 2015 : Debug: Parsed xlat tree: Tue Sep 1 14:56:10 2015 : Debug: literal --> ^(\.*)([a-zA-Z]{3}[0-9]{5}) Tue Sep 1 14:56:10 2015 : Debug: (0) files: EXPAND ^(\.*)([a-zA-Z]{3}[0-9]{5}) Tue Sep 1 14:56:10 2015 : Debug: (0) files: --> ^(\.*)([a-zA-Z]{3}[0-9]{5}) .... ... and it never matches. This post says, that is was removed "on non string attributes" in v3.0.x: http://lists.freeradius.org/pipermail/freeradius-users/2015-April/076848.ht… I'd like to use them on the User-Name-Attribute: User-Name =~ "^(\.*)([a-zA-Z]{3}[0-9]{5})" But User-Name is a string, isn't it? dictionary.rfc2865:ATTRIBUTE User-Name 1 string So the question is: Did you remove regex completely from the files module and I need to do it with unlang or is there another notation for this one? Thank you for your time, Ciao Anja

1 0