- Freeradius-Users - lists.freeradius.org

set up the linelog mod to create a CSV log
by Nash.Paz 22 Jul '15

22 Jul '15

Hi, Running 3.0.4 on Centos 7.1, I've been trying to set up the linelog mod to create a CSV log. Based on what I read here: http://marc.info/?l=freeradius-users&m=133167783813402 http://lists.freeradius.org/pipermail/freeradius-users/2012-March/059283.ht… I added a header, and a stop/start accounting for Acct-Status-Type to the linelog file (attached). Restarted radiusd, but no linelog files are created. Radius is working, the detail file gets updated. The module seems to load when running radiusd -X : # Instantiating module "linelog" from file /etc/raddb/mods-enabled/linelog linelog { filename = "/var/log/radius/linelog" permissions = 384 format = "This is a log message for %{User-Name}" reference = "messages.%{%{Packet-Type}:-default}" } # Instantiating module "log_accounting" from file /etc/raddb/mods-enabled/linelog linelog log_accounting { filename = "/var/log/radius/linelog-accounting" permissions = 384 format = "" reference = "Accounting-Request.%{%{Acct-Status-Type}:-unknown}" } What am I doing wrong? -- -נחשון פז-

2 2

IPv6 coa isn't working having IPv6 NAS IP
by Samir Patel 21 Jul '15

21 Jul '15

Hi Experts, I need your help and expertise with pushing ipv6 coa on the 802.1x sessions. UUT (Switch) and Freeradius are directly connected and can ping each other. Freeradius installed: [root@ott-freerad-7a raddb]# radiusd -X radiusd: FreeRADIUS Version 2.2.8, for host x86_64-unknown-linux-gnu, built on Jul 15 2015 at 13:42:04 Copyright (C) 1999-2015 The FreeRADIUS server project and contributors. Issue: [root@ott-freerad-7a raddb]# /usr/local/bin/radclient -x -t 20 -c 1 -p 20 -f /usr/local/etc/raddb/coa 2020::11:1700 coa cisco radclient: Failed to find IP address for host 2020::11:1700: Success COA push works for IPv4 NAS IP but shows above for IPv6 case. Really appreciate your help with the issue. I am not sure if IPv6 coa push is supported yet with 2.2.8 freeradius version. [root@ott-freerad-7a raddb]# more coa Calling-Station-Id="c414.3c52.900e" Acct-Session-Id="0x0000000b" Cisco-Command-Code=" TEMP_IAF100" [root@ott-freerad-7a raddb]# [root@ott-freerad-7a raddb]# [root@ott-freerad-7a raddb]# [root@ott-freerad-7a raddb]# [root@ott-freerad-7a raddb]# /usr/local/bin/radclient -x -t 20 -c 1 -p 20 -f /usr/local/etc/raddb/coa 2020::11:1700 coa cisco [root@ott-freerad-7a raddb]# ifconfig eth0 Link encap:Ethernet HWaddr 00:50:56:8E:78:33 inet addr:172.16.7.11 Bcast:172.16.255.255 Mask:255.255.0.0 inet6 addr: fe80::250:56ff:fe8e:7833/64 Scope:Link UP BROADCAST RUNNING MULTICAST MTU:1500 Metric:1 RX packets:80804 errors:0 dropped:0 overruns:0 frame:0 TX packets:20649 errors:0 dropped:0 overruns:0 carrier:0 collisions:0 txqueuelen:1000 RX bytes:14539074 (13.8 MiB) TX bytes:3061296 (2.9 MiB) eth1 Link encap:Ethernet HWaddr 00:50:56:8E:5F:BB inet addr:99.0.7.12 Bcast:99.0.7.255 Mask:255.255.255.0 inet6 addr: 2020::250:56ff:fe8e:5fbb/64 Scope:Global inet6 addr: fe80::250:56ff:fe8e:5fbb/64 Scope:Link UP BROADCAST RUNNING MULTICAST MTU:1500 Metric:1 RX packets:47806 errors:0 dropped:0 overruns:0 frame:0 TX packets:138 errors:0 dropped:0 overruns:0 carrier:0 collisions:0 txqueuelen:1000 RX bytes:3463175 (3.3 MiB) TX bytes:17024 (16.6 KiB) lo Link encap:Local Loopback inet addr:127.0.0.1 Mask:255.0.0.0 inet6 addr: ::1/128 Scope:Host UP LOOPBACK RUNNING MTU:16436 Metric:1 RX packets:936 errors:0 dropped:0 overruns:0 frame:0 TX packets:936 errors:0 dropped:0 overruns:0 carrier:0 collisions:0 txqueuelen:0 RX bytes:66843 (65.2 KiB) TX bytes:66843 (65.2 KiB) [root@ott-freerad-7a raddb]# [root@ott-freerad-7a raddb]# ping6 2020::11 PING 2020::11(2020::11) 56 data bytes 64 bytes from 2020::11: icmp_seq=0 ttl=64 time=11.4 ms 64 bytes from 2020::11: icmp_seq=1 ttl=64 time=1.52 ms --- 2020::11 ping statistics --- 2 packets transmitted, 2 received, 0% packet loss, time 999ms rtt min/avg/max/mdev = 1.521/6.463/11.405/4.942 ms, pipe 2 [root@ott-freerad-7a raddb]# [root@ott-freerad-7a raddb]# uname -a Linux ott-freerad-7a 2.6.18-194.8.1.el5 #1 SMP Wed Jun 23 10:52:51 EDT 2010 x86_64 x86_64 x86_64 GNU/Linux [root@ott-freerad-7a raddb]# On UUT: Router#show run int gig2/0/15 Building configuration... Current configuration : 108 bytes ! interface GigabitEthernet2/0/15 no switchport no ip address ipv6 address 2020::11/64 ipv6 enable end Router# Router# Router# Router# Router# Router# Router# Router#show access-sess Interface MAC Address Method Domain Status Fg Session ID -------------------------------------------------------------------------------------------- GigabitEthernet2/0/14 c414.3c52.900e dot1x DATA Auth 000000000000001706794990 Session count = 1 Key to Session Events Blocked Status Flags: A - Applying Policy (multi-line status for details) D - Awaiting Deletion F - Final Removal in progress I - Awaiting IIF ID allocation P - Pushed Session R - Removing User Profile (multi-line status for details) U - Applying User Profile (multi-line status for details) X - Unknown Blocker Router# Router#show access-sess poli Router#show access-sess inter Router#show access-sess interface gig2/0/14 polic Router#show access-sess interface gig2/0/14 policy Interface : GigabitEthernet2/0/14 MAC Address : c414.3c52.900e IPv6 Addres : Unknown IPv4 Addres : Unknown User-Name : client1 Status : Authorized Domain : DATA Oper host mode : multi-host Oper control dir : both Session timeout : N/A Timeout action : Reauthenticate Idle timeout : N/A Common Session ID : 000000000000001706794990 Acct Session ID : 0x0000000b Handle : 0x3c00000d Current Policy : DUAL Blocked On : Method status list: Method State dot1x Authc Success Device Classification Status: ------------------------------------------------------------------------------- Profile Device-Name Device-Class ------------------------------------------------------------------------------- Un Classified Un-Classified Un-Classified

3 7

Auth-Type := ldap
by ST Wong (ITSC) 21 Jul '15

21 Jul '15

Hi all, We're using freeradius 3.0.4-6.el7 on RHEL 7, using LDAP authentication. The server is setup and running without problem. However, I got error when running radwho: -------------- cut here -------------------- ]# radwho Tue Jul 21 18:58:16 2015 : Error: /etc/raddb/sites-enabled/default[384]: Parse error in condition Tue Jul 21 18:58:16 2015 : Error: if ((ok || updated) && User-Password) { Tue Jul 21 18:58:16 2015 : Error: ^ Expected a module return code radwho: Error reading or parsing radiusd.conf -------------- cut here -------------------- I modified /etc/raddb/sites-enabled/default as following as mods-available/ldap mentioned: -------------- mods-available/ldap -------------------- # Note: set_auth_type was removed in v3.x.x # Equivalent functionality can be achieved by adding the following # stanza to the authorize {} section of your virtual server. # # ldap # if ((ok || updated) && User-Password) { # update { # control:Auth-Type := ldap # } # } -------------- cut here -------------------- -------------- /etc/raddb/sites-enabled/default -------------------- # # The ldap module reads passwords from the LDAP database. # -ldap ldap if ((ok || updated) && User-Password) { update { control:Auth-Type := ldap } } -------------- cut here -------------------- Did I miss anything? Besides, I'm new to freeradius 3.x and can't find doc about the meaning of the minus sign before module (e.g. "-ldap"). Would anyone please help? Thanks a lot. Regards, /ST Wong

1 0

Re: udp sockets and proxy servers
by Sergey Komarov 21 Jul '15

21 Jul '15

Hello! > Hmmm, well that's problematic. Could you open a GitHub issue. > > -Arran > Hello Arran. Well, I'm not a developer actually I will try to post it to GitHub in case my credentials is ok for that... > Date: Mon, 20 Jul 2015 19:48:25 +0200 > From: Alan DeKok <aland(a)deployingradius.com> > To: FreeRadius users mailing list > <freeradius-users(a)lists.freeradius.org> > Subject: Re: udp sockets and proxy servers > Message-ID: <56E2A5E4-DFAD-4B47-816E-28CDFF51DACF(a)deployingradius.com> > Content-Type: text/plain; charset=us-ascii > > On Jul 20, 2015, at 7:15 PM, Sergey Komarov <sergey.komaroff(a)gmail.com> > wrote: > > I'm tring to run 3.0.9 configuration with about ~1500 clients and home > > servers (as I have about 1500 WLCs in the network and I try to proxy CoA > > packet to WLCs via radius). > > > > Radius server tries to open as many sockets as possible doing like that: > > > > Info: ... adding new socket proxy address * port 46527 > > Info: ... adding new socket proxy address * port 38003 > > > > It happens slowly or fast and it depends of load as I see it... And then > > after about 256 sockets server quits from running with error: > > Is that with TLS? Or TCP? We didn't predict that people would use 256 > or more clients with CoA and TCP. > > But it *should* work for UDP. There's no reason for it to open many > proxy sockets. It just needs one or two. > > Alan DeKok. > Hello Alan! The case is that I'm using UDP only, no any TLS now, just common pap/sql and Acc Req/Accept/CoA Proxy... SQL sockets is ok and no overflow there (it even close some connections to DB when don't need it). But it looks like FR tries to create as many sockets as home servers and it happen slowly - depends on load. When I limit to 200 home servers - it stopped to create sockets at number about 153... In case it overcome 256 it drops soon with that error... Best Regards, Serge Komaroff

1 0

RLM_Rest and Dynamic Clients
by Nick Cappelletti 20 Jul '15

20 Jul '15

FreeRADIUS version: 3.0.9 I was curious if there was a way to include dynamic-clients via the rest api module in FreeRADIUS. I currently have it setup using LDAP, but we’re looking to use a dedicated server cluster to manage our NAS’s and I’m having a hard time wrapping my head around a way of configuring such an implementation. Any links or previous threads would be extremely helpful. Thanks!

3 8

udp sockets and proxy servers
by Sergey Komarov 20 Jul '15

20 Jul '15

Hello, I'm tring to run 3.0.9 configuration with about ~1500 clients and home servers (as I have about 1500 WLCs in the network and I try to proxy CoA packet to WLCs via radius). Radius server tries to open as many sockets as possible doing like that: Info: ... adding new socket proxy address * port 46527 Info: ... adding new socket proxy address * port 38003 It happens slowly or fast and it depends of load as I see it... And then after about 256 sockets server quits from running with error: "Error: Failed adding event handler for socket: Too many readers ". Server stops after that. I checked under CentOS 6 and under FreeBSD. Its same effect and OS doesn't matter. Does this means I need number of sockets equal to number of home servers and it is impossible to run FR with more than 256 home servers now or I missed something and FR able to reuse/limit udp sockets somehow? In case someone could show me correct idea and how to solve my problem I will be glad to follow. Thank you in advance for your help! Best Regards, Serge Komaroff

3 2

FreeRADIUS & security
by Paul Gunman 20 Jul '15

20 Jul '15

Hello, I would like to know whether FreeRADIUS user SNMPv3 and allow IP filtering for access through SSH. Moreover, is there anything related to PCI compliance? Thanks, P.

3 2

real world radsec example
by Alex Sharaz 20 Jul '15

20 Jul '15

Hi, Has anyone got a real world RADSEC example between two FR 3.0.[89] servers they would be prepared to share ? Having a bit of trouble getting this to work. I've successfully got FR 2.2.7 -> radsecproxy 1.6.x -> FR 3.0.9 working ( tested using radtest -> FR 2.2.7 ) but am having a bit of a problem either going from FR 3.x-> radsec proxy or FR 3.x <--> 3.X On the server I'm running radtest on I get Mon Jul 20 14:03:14 2015 : Debug: (0) proxy: Trying to open a new listener to the home server Mon Jul 20 14:03:14 2015 : Debug: Opening new proxy socket 'proxy (0.0.0.0, 0) -> home_server (199.30.91.51, 2083)' Mon Jul 20 14:03:14 2015 : Debug: Trying SSL to port 2083 Mon Jul 20 14:03:14 2015 : Debug: Requiring Server certificate Mon Jul 20 14:03:14 2015 : Debug: (0) (other): before/connect initialization Mon Jul 20 14:03:14 2015 : Debug: (0) TLS_connect: before/connect initialization Mon Jul 20 14:03:14 2015 : Debug: (0) >>> TLS 1.2 [length 011e] Mon Jul 20 14:03:14 2015 : Debug: (0) TLS_connect: unknown state Mon Jul 20 14:03:15 2015 : Debug: (0) <<< TLS 1.0 Handshake [length 0031], ServerHello Mon Jul 20 14:03:15 2015 : Debug: (0) TLS_connect: SSLv3 read server hello A Mon Jul 20 14:03:15 2015 : Debug: (0) <<< TLS 1.0 Handshake [length 11ed], Certificate Mon Jul 20 14:03:15 2015 : Debug: (0) TLS Verify creating certificate attributes Mon Jul 20 14:03:15 2015 : ERROR: (0) SSL says error 19 : self signed certificate in certificate chain Mon Jul 20 14:03:15 2015 : Debug: (0) >>> TLS 1.0 Alert [length 0002], fatal unknown_ca Mon Jul 20 14:03:15 2015 : ERROR: (0) TLS Alert write:fatal:unknown CA Mon Jul 20 14:03:15 2015 : Error: tls: TLS_connect: Error in SSLv3 read server certificate B Mon Jul 20 14:03:15 2015 : Error: tls: TLS_connect: Error in SSLv3 read server certificate B Mon Jul 20 14:03:15 2015 : Error: tls: error:14090086:SSL routines:SSL3_GET_SERVER_CERTIFICATE:certificate verify failed Mon Jul 20 14:03:15 2015 : Error: Failed starting SSL to 'proxy (0.0.0.0, 0) -> home_server (199.30.91.51, 2083)' and I really can't see why I'm getting the unknown CA error. Certainly shouldn't be a self signed cert anywhere. A

2 3

Should this be here?
by Alex Sharaz 20 Jul '15

20 Jul '15

Hi, I've just built and installed 3.0.9 In debug mode, when it fires up I get ..... Mon Jul 20 13:35:39 2015 : Debug: } Mon Jul 20 13:35:39 2015 : Debug: } Mon Jul 20 13:35:39 2015 : Debug: Loading library using absolute path "/usr/local/lib/proto_acct.so " Mon Jul 20 13:35:39 2015 : Debug: Failed with error: /usr/local/lib/proto_acct.so: cannot open shar ed object file: No such file or directory Mon Jul 20 13:35:39 2015 : Debug: Library file not found Mon Jul 20 13:35:39 2015 : Debug: Loading library using linker search path(s) Mon Jul 20 13:35:39 2015 : Debug: Defaults : /lib:/usr/lib Mon Jul 20 13:35:39 2015 : Debug: Failed with error: proto_acct.so: cannot open shared object file: No such file or directory Mon Jul 20 13:35:39 2015 : Debug: listen { ........ and .... Mon Jul 20 13:35:39 2015 : Debug: Loading library using linker search path(s) Mon Jul 20 13:35:39 2015 : Debug: Defaults : /lib:/usr/lib Mon Jul 20 13:35:39 2015 : Debug: Failed with error: proto_auth.so: cannot open shared object file: No such file or directory Mon Jul 20 13:35:39 2015 : Debug: listen { Mon Jul 20 13:35:39 2015 : Debug: type = "auth" Mon Jul 20 13:35:39 2015 : Debug: ipv6addr = :: Mon Jul 20 13:35:39 2015 : Debug: port = 0 Mon Jul 20 13:35:39 2015 : Debug: limit { Mon Jul 20 13:35:39 2015 : Debug: max_connections = 16 Mon Jul 20 13:35:39 2015 : Debug: lifetime = 0 Mon Jul 20 13:35:39 2015 : Debug: idle_timeout = 30 Mon Jul 20 13:35:39 2015 : Debug: } Mon Jul 20 13:35:39 2015 : Debug: } ..... proto_auth.so and proto_acct.so certainly don't exist. Should they? A

4 11

Simultaneous-Use x Inactive sessions
by Renato Sousa 20 Jul '15

20 Jul '15

Hello everyone, I am implementing a FR 3.0.8 using control simultaneous sessions (Simultaneous-Use: = 2). Some sessions are accumulating without the Acct-Status-Type Stop and are being counted as active session. How to periodically remove the BD these inactive sessions? Best Regards, Renato

2 3