- Freeradius-Users - lists.freeradius.org

Re: udp sockets and proxy servers
by Sergey Komarov 30 Jul '15

30 Jul '15

Hello, I've tested 3.0.10 with patch issued by Alan. Thanks for attention for the case, but it still have some problems: 1. In case you put Dst-IP-Address, than FR ignores port settings in coa sections of clients (coa server derived from clients.conf). Doesn't matter if I put port 1700 in clients.conf it use 3799. Then I add Dst-IP-Port 1700 and after that it works normally. But... Next point still impact. 2. After 3.0.10 installed udp sockets finishing very quickly and then it dies. Best Regards, Serge Komaroff > Date: Tue, 21 Jul 2015 10:23:43 +0300 > From: Sergey Komarov <sergey.komaroff(a)gmail.com> > To: FreeRadius users mailing list > <freeradius-users(a)lists.freeradius.org> > Subject: Re: udp sockets and proxy servers > Message-ID: > <CAAZqZfDuvfpQM6iERUOfA31X-pwgU=0ZBPxJ7st0K1= > Zkis2qA(a)mail.gmail.com> > Content-Type: text/plain; charset=UTF-8 > > Hello! > > > > > Hmmm, well that's problematic. Could you open a GitHub issue. > > > > -Arran > > > > Hello Arran. Well, I'm not a developer actually I will try to post it to > GitHub in case my credentials is ok for that... > > > > Date: Mon, 20 Jul 2015 19:48:25 +0200 > > From: Alan DeKok <aland(a)deployingradius.com> > > To: FreeRadius users mailing list > > <freeradius-users(a)lists.freeradius.org> > > Subject: Re: udp sockets and proxy servers > > Message-ID: <56E2A5E4-DFAD-4B47-816E-28CDFF51DACF(a)deployingradius.com> > > Content-Type: text/plain; charset=us-ascii > > > > On Jul 20, 2015, at 7:15 PM, Sergey Komarov <sergey.komaroff(a)gmail.com> > > wrote: > > > I'm tring to run 3.0.9 configuration with about ~1500 clients and home > > > servers (as I have about 1500 WLCs in the network and I try to proxy > CoA > > > packet to WLCs via radius). > > > > > > Radius server tries to open as many sockets as possible doing like > that: > > > > > > Info: ... adding new socket proxy address * port 46527 > > > Info: ... adding new socket proxy address * port 38003 > > > > > > It happens slowly or fast and it depends of load as I see it... And > then > > > after about 256 sockets server quits from running with error: > > > > Is that with TLS? Or TCP? We didn't predict that people would use 256 > > or more clients with CoA and TCP. > > > > But it *should* work for UDP. There's no reason for it to open many > > proxy sockets. It just needs one or two. > > > > Alan DeKok. > > > > Hello Alan! The case is that I'm using UDP only, no any TLS now, just > common pap/sql and Acc Req/Accept/CoA Proxy... SQL sockets is ok and no > overflow there (it even close some connections to DB when don't need it). > But it looks like FR tries to create as many sockets as home servers and it > happen slowly - depends on load. When I limit to 200 home servers - it > stopped to create sockets at number about 153... In case it overcome 256 it > drops soon with that error... > > > Best Regards, Serge Komaroff > > > ------------------------------ > > Subject: Digest Footer > > - > List info/subscribe/unsubscribe? See > http://www.freeradius.org/list/users.html > > ------------------------------ > > End of Freeradius-Users Digest, Vol 123, Issue 76 > ************************************************* >

2 1

is it dangerous to change sql safe_characters ?
by d tbsky 30 Jul '15

30 Jul '15

hi: we are using freeradius 3.0.9. and we want to make the sql accounting data easier to read/process. currently the characters below we may use are escaped by default '\' => for windows account like "domain\user". "+","=" => for base64 encoding these two characters are used is it safe the add these characters to query.conf "safe_characters"? PS: by default the method to escap the "\" character seems not correct. when user use "domain\user" to login, if I check with "radiusd -X", the name sometimes present as 'domain\user', and sometimes present as "domain\\user". but finally when it write to sql, it becomes "domain=5C=5Cuser". I think the correct escaped string should be "domain=5Cuser" ? thanks a lot for help!! Regards, tbskyd

4 7

Fwd: unixODBC Error
by Harvii Dent 30 Jul '15

30 Jul '15

Hello, I've installed FreeRADIUS (3.0.4-6.el7) on CentOS 7 from the repositories with the plan to use unixODBC and FreeTDS to authenticate against a MSSQL database; however, running radiusd -X results in this (similar error when using freeradius-3.0.8-3.fc23): rlm_sql (sql): Driver rlm_sql_unixodbc (module rlm_sql_unixodbc) loaded and linked rlm_sql (sql): Attempting to connect to database "FreeRADIUS" rlm_sql (sql): Initialising connection pool pool { start = 5 min = 4 max = 32 spare = 3 uses = 0 lifetime = 0 cleanup_interval = 30 idle_timeout = 60 retry_delay = 1 spread = no } rlm_sql (sql): Opening additional connection (0) rlm_sql_unixodbc: 01000 [unixODBC][Driver Manager]Can't open lib '/usr/lib64/libtdsodbc.so.0.0.0' : ?w????: undefined symbol: get_vtable rlm_sql_unixodbc: SQL down 08003 [unixODBC][Driver Manager]Connnection does not exist rlm_sql_unixodbc: Can't allocate the statement rlm_sql_unixodbc: Socket destructor called, closing socket rlm_sql (sql): Opening connection failed (0) rlm_sql (sql): Removing connection pool /etc/raddb/mods-enabled/sql[20]: Instantiation failed for module "sql" Other users faced this 'get_vtable' issue but it doesn't seem that anyone found a solution, any help is appreciated. Thanks

4 5

Proxy CoA
by Cassiano Peixoto 29 Jul '15

29 Jul '15

Hi, I've been running a freeradius proxy with mpd in the same machine. My mpd is configured to use my localhost freeradius proxy/ And i have a central freeradius server where my freeradius proxy is consulting the users. Everything is working fine. So my env is: Server1: Server2 mpd ----------->>> freeradius server freeradius proxy I have a doubt how i could do if something has changed on my freeradius on server2 like a value in a table. I'd like my server1 check server2 some time and if something has changed send a COA packet to mpd to make the change. To let it more clear: I have in my server2 the attribute Mikrotik-Rate-Limit. If this attribute change for any reason my server1 should know. But unfortunately i don't have access to server2 to change any freeradius configuration. My server1 should check server2 and compare the last attribute with the new one. If it has changed send a CoA to mpd. I thought something like this in my post-auth section on my freeradius proxy on server1, but didn't work: update control { Tmp-String-0 = "%{request:Mikrotik-Rate-Limit}" Tmp-String-1 = "%{Mikrotik-Rate-Limit}" } if ("%{Tmp-String-0}" != "%{Tmp-String-1}") { update coa { User-Name = "%{User-Name}" Acct-Session-Id = "%{Acct-Session-Id}" NAS-IP-Address = "%{NAS-IP-Address}" Framed-IP-Address = "%{Framed-IP-Address}" Mikrotik-Rate-Limit += "%{request:Mikrotik-Rate-Limit}" } } Anyone could help me please? Thanks

1 0

Handling multiple customers with one radius instance
by Manfred Wolf 29 Jul '15

29 Jul '15

Hello everyone, we want to install one central freeradius that handles requests from multiple customers. Nearly all the handling for those customers is the same. Even the database should be the same. Just the namespace for each customer's users should be different, so that for example customer1 and customer2 can both have a joe user. We're currently using the default sql user database, but this one doesn't seem to support this directly. On the other hand, we want radiusclient1.customer1 and radiusclient2.customer1 to be handled identically. Is there a special module that could help us achieving this or what would be the best way to solve this kind of problem? We have searched around and come across a few possible ways tho we are not sure if they are good or would work at all. Anyway, those are: 1. Somehow check for the client IP using sql queries. Tho this way it might be hard if not impossible to that vpnserver1.customer1 and vpnserver2.customer2 both belong to customer1 2. Something with using realms. If it is possible with virtual servers to force customers in realms and then later check in the database for those realms to determine the customers. 3. A custom unlang or similar script that would filter the clients by our needs Kind regards, Manfred -- CosmoKey GmbH & Co. KG, Amtsgericht Bielefeld HRA 16201, vertreten durch ihre Geschäftsführerin die CosmoKey Beteiligungs GmbH, Amtsgericht Bielefeld HRB 41522, diese vertreten durch ihren Geschäftsführer Herrn Dominic Adenuga Walther-Rathenau-Str. 39 33602 Bielefeld Germany Telefon: 0151-43144121 Telefax: 0521-69983 Email: info(a)cosmokey.de CosmoKey GmbH & Co. KG USt-ID: DE296278210 CosmoKey GmbH USt-ID: DE296278201

2 4

how to set allowed Called-Station-SSID for user in his LDAP configuration?
by Zeus Panchenko 28 Jul '15

28 Jul '15

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 hi, how is it correct to set allowed Called-Station-SSID (the only SSID user allowed to connect to) for user who is configured via LDAP (without SSID issue, users are configured and authenticated/authorized successfully, my question relates *only* to SSID related configuration)? I hoped I can use attribute radiusCheckItem like this radiusCheckItem: Called-Station-SSID == AllowedSsidName but I have no evicence in debug, it is checked :( as well as anything configured via radiusCheckedItem is ignored, perhaps I need to say to FR to do that but I do not understand how to yet? is it in mods-enabled/ldap update section (like control:...)? in FR v.2.x in file users I used this configuration: - ---[ quotation start ]------------------------------------------- DEFAULT Ldap-Group == "wifi-AllowedSsidName", Called-Station-SSID == "AllowedSsidName", Simultaneous-Use := '1', User-Profile := "cn=wifi-AllowedSsidName,ou=rad-profiles,dc=xyz" Reply-Message := "%{User-Name}, SSID: %{Called-Station-SSID} access was permited to you.", Fall-Through = no - ---[ quotation end ]------------------------------------------- but how to get it confiured for v.3.x? for v.3.x have I to use users file too? if not, then how is it correct to get that logic configured in LDAP? - -- Zeus V. Panchenko jid:zeus@im.ibs.dn.ua IT Dpt., I.B.S. LLC GMT+2 (EET) -----BEGIN PGP SIGNATURE----- Version: GnuPG v1 iEYEARECAAYFAlW3dxoACgkQr3jpPg/3oyqvUACgl/c6blTfwpn+3fRIzhspAKyO YIkAn0sXia4m84vzIDiVKNE6PIxqV/UG =S2nH -----END PGP SIGNATURE-----

2 3

unavailable database makes freeradius 3.0.9 server unresponsive
by Michal Tomaszewski 28 Jul '15

28 Jul '15

Hello, We found a problem in freeradius 3.0.9 when database (mysql as well as redis) is not working for a while. Server: Ubuntu 14.04, fresh install of freeradius 3.0.9 compiled from sources using default settings. When database is going down server hangs on first processed request and stops processing any further requests. There is no connection timeout nor any other timeout to database request. In freeradius 2.x when database was not available server responded with Reject until database was on. In freeradius 3.0.9 server stops responding to any requests, even when database comes up. Below there is an example with redis module. The same problem we have when mysql server goes down. After redis is stopped: Fri Jul 24 17:44:34 2015 : Debug: (1) policy usercache.authorize { Fri Jul 24 17:44:34 2015 : Debug: (1) update request { Fri Jul 24 17:44:34 2015 : Debug: rlm_redis (redis): Reserved connection (3) Fri Jul 24 17:44:34 2015 : Debug: rlm_redis (redis): executing the query: "exists map/usercache/id/" Fri Jul 24 17:44:34 2015 : ERROR: (1) Server closed the connection Fri Jul 24 17:44:34 2015 : Debug: rlm_redis (redis): Reconnecting (3) Fri Jul 24 17:44:34 2015 : Error: rlm_redis (redis): Problems with redisConnect('10.113.13.245', 6379), Connection refused There are no other messages on screen when in radius -XXX mode. There is no timeout for such operation thus server stops processing any requests. When redis goes up few seconds later it does not enable processing requests. When radiusd works as a service in the log we have: Fri Jul 24 17:50:00 2015 : Info: Ready to process requests ****** First radiusclient requests Fri Jul 24 17:50:21 2015 : Info: rlm_redis (redis): 0 of 5 connections in use. Need more spares Fri Jul 24 17:50:21 2015 : Info: rlm_redis (redis): Opening additional connection (5), 1 of 27 pending slots used Fri Jul 24 17:50:21 2015 : Info: rlm_sql (sql): 0 of 5 connections in use. Need more spares Fri Jul 24 17:50:21 2015 : Info: rlm_sql (sql): Opening additional connection (5), 1 of 27 pending slots used Fri Jul 24 17:50:21 2015 : Auth: (0) Login incorrect (No Auth-Type found: rejecting the user via Post-Auth-Type = Reject): [test8/test] (from client stage-client port 0) Fri Jul 24 17:50:33 2015 : Info: rlm_redis (redis): Closing connection (3): Hit idle_timeout, was idle for 34 seconds Fri Jul 24 17:50:33 2015 : Info: rlm_redis (redis): Closing connection (4): Hit idle_timeout, was idle for 33 seconds ****** REDIS STOP + 2 radiusclient requests Fri Jul 24 17:50:33 2015 : ERROR: (1) ERROR: Server closed the connection Fri Jul 24 17:50:33 2015 : Error: rlm_redis (redis): Problems with redisConnect('10.113.13.245', 6379), Connection refused Fri Jul 24 17:50:38 2015 : Error: (1) Ignoring duplicate packet from client stage-client port 57494 - ID: 197 due to unfinished request in component authorize module Fri Jul 24 17:50:43 2015 : Error: (1) Ignoring duplicate packet from client stage-client port 57494 - ID: 197 due to unfinished request in component authorize module Fri Jul 24 17:50:57 2015 : Error: (2) Ignoring duplicate packet from client stage-client port 42331 - ID: 188 due to unfinished request in component authorize module Fri Jul 24 17:51:02 2015 : Error: (2) Ignoring duplicate packet from client stage-client port 42331 - ID: 188 due to unfinished request in component authorize module Fri Jul 24 17:51:11 2015 : Error: Unresponsive child for request 1, in component authorize module Fri Jul 24 17:51:30 2015 : Error: Unresponsive child for request 2, in component authorize module ****** REDIS START + 1 radiusclient request Fri Jul 24 17:52:24 2015 : Error: (3) Ignoring duplicate packet from client stage-client port 51752 - ID: 89 due to unfinished request in component authorize module Fri Jul 24 17:52:29 2015 : Error: (3) Ignoring duplicate packet from client stage-client port 51752 - ID: 89 due to unfinished request in component authorize module Fri Jul 24 17:52:57 2015 : Error: Unresponsive child for request 3, in component authorize module How to reproduce the issue: 1. Make a request to the freeradius server using radiusclient. 2. Stop the database server. 3. Make another connection to the freeradius server using radiusclient. (the client request will time-out...) 4. Start the database server. 5. All following radiusclient requests will time out. Can anybody suggest what shall be reconfigured in order to keep freeradius responding and properly get Access-reject response when database is unavailable? Mike ________________________________________ Uwaga: Tre?? niniejszej wiadomo?ci mo?e by? poufna i obj?ta zakazem jej ujawniania. Je?li czytelnik tej wiadomo?ci nie jest jej zamierzonym adresatem, pracownikiem lub po?rednikiem upowa?nionym do jej przekazania adresatowi, informujemy ?e wszelkie rozprowadzanie, rozpowszechnianie lub powielanie niniejszej wiadomo?ci jest zabronione. Je?li otrzyma?e? t? wiadomo?? omy?kowo, prosz? bezzw?ocznie odes?a? j? nadawcy, a sam? wiadomo?? usun?? z komputera. Dzi?kujemy. ________________________________ Note: The information contained in this message may be privileged and confidential and protected from disclosure. If the reader of this message is not the intended recipient, or an employee or agent responsible for delivering this message to the intended recipient, you are hereby notified that any dissemination, distribution or copying of this communication is strictly prohibited.If you have received this communication in error, please notify the sender immediately by replying to the message and deleting it from your computer. Thank you. ________________________________

4 8

3.0.9: eap: Failed continuing EAP MD5 (4) session. EAP sub-module failed
by Mohamed Lrhazi 27 Jul '15

27 Jul '15

Hello, Any idea why 3.0.9 would reject an ldap user with the above error, while 3.0.8 would successfully authenticate them? The two servers have the same config files. I looked at the debug output and could not see a difference.. just an error: for the same user, hence same password hash fetched from same LDAP server: 3.0.9 Sat Jul 25 12:47:51 2015 : Debug: (1088) eap: Expiring EAP session with state 0x776c1e12716407f0 Sat Jul 25 12:47:51 2015 : Debug: (1088) eap: Finished EAP session with state 0xb5c7569eb4cb5280 Sat Jul 25 12:47:51 2015 : Debug: (1088) eap: Previous EAP request found for state 0xb5c7569eb4cb5280, released from the list Sat Jul 25 12:47:51 2015 : Debug: (1088) eap: Peer sent packet with method EAP MD5 (4) Sat Jul 25 12:47:51 2015 : Debug: (1088) eap: Calling submodule eap_md5 to process data Sat Jul 25 12:47:51 2015 : Debug: (1088) eap_md5: Cleartext-Password is required for EAP-MD5 authentication Sat Jul 25 12:47:51 2015 : ERROR: (1088) eap: Failed continuing EAP MD5 (4) session. EAP sub-module failed Sat Jul 25 12:47:51 2015 : Debug: (1088) eap: Sending EAP Failure (code 4) ID 12 length 4 Sat Jul 25 12:47:51 2015 : Debug: (1088) eap: Failed in EAP select Sat Jul 25 12:47:51 2015 : Debug: (1088) modsingle[authenticate]: returned from eap (rlm_eap) for request 1088 Sat Jul 25 12:47:51 2015 : Debug: (1088) [eap] = invalid Sat Jul 25 12:47:51 2015 : Debug: (1088) } # authenticate = invalid Sat Jul 25 12:47:51 2015 : Debug: (1088) Failed to authenticate the user 3.0.8: Sat Jul 25 12:52:12 2015 : Debug: (2534) eap: Expiring EAP session with state 0x6843779268417367 Sat Jul 25 12:52:12 2015 : Debug: (2534) eap: Finished EAP session with state 0xa5b14de2a4bd57e0 Sat Jul 25 12:52:12 2015 : Debug: (2534) eap: Previous EAP request found for state 0xa5b14de2a4bd57e0, released from the list Sat Jul 25 12:52:12 2015 : Debug: (2534) eap: Peer sent method MSCHAPv2 (26) Sat Jul 25 12:52:12 2015 : Debug: (2534) eap: EAP MSCHAPv2 (26) Sat Jul 25 12:52:12 2015 : Debug: (2534) eap: Calling eap_mschapv2 to process EAP data Sat Jul 25 12:52:12 2015 : Debug: (2534) eap: Freeing handler Sat Jul 25 12:52:12 2015 : Debug: (2534) modsingle[authenticate]: returned from eap (rlm_eap) for request 2534 Sat Jul 25 12:52:12 2015 : Debug: (2534) [eap] = ok Sat Jul 25 12:52:12 2015 : Debug: (2534) } # authenticate = ok Thanks, Mohamed.

5 17

"rlm_sql_mysql"
by Randeep 27 Jul '15

27 Jul '15

Hi, We are installing freeradius version 3.0.8 from the source. But we are getting the following error. I can see that the particular so file is not there in the system. Should I install it using yum? But yum list the package for 2.11!! can I install the library when configuring/compiling by giving some options? Mon Jul 27 19:49:43 2015 : Debug: Loading library using absolute path "rlm_sql_mysql" Mon Jul 27 19:49:43 2015 : Debug: Library file not found Mon Jul 27 19:49:43 2015 : Debug: Falling back to linker search path(s) Mon Jul 27 19:49:43 2015 : Debug: Defaults : /lib:/usr/lib Mon Jul 27 19:49:43 2015 : Error: Could not link driver rlm_sql_mysql: rlm_sql_mysql.so: cannot open shared object file: No such file or directory Mon Jul 27 19:49:43 2015 : Error: Make sure it (and all its dependent libraries!) are in the search path of your system's ld Mon Jul 27 19:49:43 2015 : Error: /usr/local/etc/raddb/mods-enabled/sql[20]: Instantiation failed for module "sql" Regards, Randeep

2 2

Re: How to differentiate between vpn user and appliance user?
by D C 27 Jul '15

27 Jul '15

On Fri, Jul 24, 2015 at 8:02 AM, D C <dc12078(a)gmail.com> wrote: > I recently configured a radius server with openldap backend to handle > central auth for all my network equipment. The ldap module is using > "radiusGroupName" as my groupmembership_attribute. > > I've configured post-auth and the users file in such a way that I can log > into devices with my ldap credentials ONLY if I am a member of one of 2 > groups. My reply-item attributes are stored in ldap within the group, and > all that is working great. Valid users who are not members of these > defined groups get rejected. perfect. > > Now the tricky part. I have a third ldap group that i want to use in > order to assign vpn access to people. so some users may be members of only > the vpn group, and some maybe members of the superadmin group as well as > the vpn group. This causes two problems. > > 1) If I add allow the vpn group, then vpn users will be able to login to > network equipment which is definitely not desired. > > 2) I don't currently have any way to determine within radius if a user is > trying to login to the vpn, or if they are trying to ssh to my firewall. > > > I'm not really sure what I should do to work around this. My only idea > I've come up with (which I don't like), is to have my firewall set a > different NAS-ip for the vpn users. If that is different, then I imagine I > can probably write some login in post-auth to handle it. Is there a better > way to do this. > > > The radius configuration on my firewall will let me set the nas-ip, > auth-type, which source ip to communicate with, and which destination port > the radius server is listening on. I've not yet looked into how the > virtual servers work in radius, so maybe I can setup a different port and > config for my vpn users to auth against.. > > > Using FreeRadius 2.1.12. > Sorry for re posting, I just realized I never set a subject...

3 11