- Freeradius-Users - lists.freeradius.org

Is EAP-AKA supported in FreeRADIUS 3.0.9
by Paul Gunman 15 Jul '15

15 Jul '15

Hello, I would like to know if EAP-AKA is supported in FreeRADIUS 3.0.9. According to the wiki, it is: wiki.freeradius.org/protocol/EAP However, several person told me that it was supported 'as a beta version'. Could someone confirm this? Regards, Pascal

4 4

Acct-Unique-Session-Id
by ICHIBA Sara 15 Jul '15

15 Jul '15

hey there, I keep having an error coming from my database which claims that the account unique id can't be empty and when I check the logs I can't see its value anywhere. here is the list of AVP i can find AVP : Acct-Input-Octets, Valeur : 41516757 AVP : NAS-Port-Type, Valeur : Wireless-802.11 AVP : Acct-Session-Id, Valeur : 55A63A3C-143CF000 AVP : Proxy-State, Valeur : 74 AVP : Called-Station-Id, Valeur : D4-68-4D-14-3C-F8:CASSANDRA AVP : Ruckus-SCG-CBlade-IP, Valeur : 3232236075 AVP : Acct-Link-Count, Valeur : 1 AVP : Acct-Authentic, Valeur : RADIUS AVP : Acct-Status-Type, Valeur : Interim-Update AVP : Connect-Info, Valeur : CONNECT 802.11b/g/n AVP : Acct-Output-Packets, Valeur : 19275 AVP : NAS-IP-Address, Valeur : 192.168.2.7 AVP : Attr-26.25053.9, Valeur : AVP : Acct-Output-Octets, Valeur : 1107617 AVP : Ruckus-SSID, Valeur : CASSANDRA AVP : Ruckus-Sta-RSSI, Valeur : 26 AVP : Acct-Session-Time, Valeur : 660 AVP : Calling-Station-Id, Valeur : F4-09-D8-04-6F-24 AVP : User-Name, Valeur : test AVP : Event-Timestamp, Valeur : juil. 15 2015 12:58:26 CEST AVP : NAS-Identifier, Valeur : D4-68-4D-14-3C-F8 AVP : Acct-Multi-Session-Id, Valeur : d4684d143cf8f409d8046f2455a63a3c002b AVP : Framed-IP-Address, Valeur : 192.168.2.9 AVP : Acct-Input-Packets, Valeur : 28735 AVP : NAS-Port, Valeur : 1 Vérification de attributs du message d'ACCOUNTING: AVP : Acct-Status-Type, Valeur : Interim-Update AVP : Acct-Session-ID, Valeur : 55A63A3C-143CF000 AVP : Acct-Session-ID, Valeur : 660 AVP : User-Name, Valeur : test AVP : Framed-IP-Address, Valeur : 192.168.2.9 AVP : NAS-IP-Address, Valeur : 192.168.2.7 Attention: pas d'attribut NAS-Port-Id! AVP : NAS-Port-Type, Valeur : Wireless-802.11 AVP : Called-Station-Id, Valeur : D4-68-4D-14-3C-F8:CASSANDRA AVP : Calling-Station-Id, Valeur : F4-09-D8-04-6F-24 Attention: pas d'attribut Alc-Subsc-ID-Str! Attention: pas d'attribut Alc-Subsc-Prof-Str! Attention: pas d'attribut Alc-SLA-Prof-Str! Attention: pas d'attribut Alc-Client-Hardware-Addr! Attention: pas d'attribut ADSL-Agent-Circuit-Id! Attention: pas d'attribut ADSL-Agent-Remote-Id! AVP : Acct-Input-Octets, Valeur : 41516757 AVP : Acct-Output-Octets, Valeur : 1107617 Pas d'attribut avp_class ! VSA : Ruckus-SSID, Valeur : CASSANDRA Can you please tell me how can I make my freeradius server generate a Account unique session id. here is the query that fails. You can see that the acctuniqueid is empty Wed Jul 15 13:01:32 2015 : Debug: (23) sql: Executing query: BEGIN BATCH INSERT INTO radacct ( acctuniqueid, acctsessionid, username, realm, nasipaddress, nasportid, nasporttype, acctupdatetime, acctstoptime, acctauthentic, connectinfo_start, acctinputoctets, acctoutputoctets, calledstationid, callingstationid, servicetype, framedprotocol, groupname, connectinfo_stop, framedipaddress ) VALUES ( '', '55A63A3C-143CF000', 'test', '', '192.168.2.7', '1', 'Wireless-802.11', 1436958086000, null, 'RADIUS', 'CONNECT 802.11b/g/n', 53864193, 1437431, 'D4-68-4D-14-3C-F8:CASSANDRA', 'F4-09-D8-04-6F-24', '', '', '', 'CONNECT 802.11b/g/n', '192.168.2.9' ); UPDATE radacct SET acctstarttime = 1436957246000 WHERE acctuniqueid = '' APPLY BATCH; Wed Jul 15 13:01:32 2015 : ERROR: (23) sql: rlm_sql_cassandra: Key may not be empty Thank you for your response, cheers, Sara

2 1

rlm_files: Collided users not always sorted
by Dylan Jones 14 Jul '15

14 Jul '15

I believe I have found a bug in that when I have a lot of users with similar enough naming that results in hash collisions, the collided users in the linked list are not always properly sorted. This results in a noop from the rlm_files module and authentication failure. I have tested 2.1.7 and a 3.1 pull from git. Since I'm unable to paste such a large users file, hopefully this TCL snippet, which you can redirect to a file, will suffice to generate the users file. #! /usr/bin/env tclsh set users [list] set pw "thisisatest" for {set i 8} {$i < 16} {incr i} { for {set j 0} {$j < 32768} {incr j} { lappend users "[format %016d [expr {$j + 1}]](a)aaaaa${i}.com\tCleartext-Password := \"$pw\"" } } puts [join $users "\n"] In this file, there will be 6 users that cannot be authenticated and it always seems to happen in pairs. Mon Jul 13 12:17:40 2015 : Auth: (0) Login incorrect (No Auth-Type found: rejecting the user via Post-Auth-Type = Reject): [ 0000000000026311(a)aaaaa10.com/thisisatest] (from client name port 0) Mon Jul 13 12:17:49 2015 : Auth: (1) Login incorrect (No Auth-Type found: rejecting the user via Post-Auth-Type = Reject): [ 0000000000026311(a)aaaaa11.com/thisisatest] (from client name port 0) Mon Jul 13 12:17:53 2015 : Auth: (2) Login incorrect (No Auth-Type found: rejecting the user via Post-Auth-Type = Reject): [ 0000000000028649(a)aaaaa12.com/thisisatest] (from client name port 0) Mon Jul 13 12:17:57 2015 : Auth: (3) Login incorrect (No Auth-Type found: rejecting the user via Post-Auth-Type = Reject): [ 0000000000028649(a)aaaaa13.com/thisisatest] (from client name port 0) Mon Jul 13 12:18:00 2015 : Auth: (4) Login incorrect (No Auth-Type found: rejecting the user via Post-Auth-Type = Reject): [ 0000000000028471(a)aaaaa14.com/thisisatest] (from client name port 0) Mon Jul 13 12:18:05 2015 : Auth: (5) Login incorrect (No Auth-Type found: rejecting the user via Post-Auth-Type = Reject): [ 0000000000028471(a)aaaaa15.com/thisisatest] (from client name port 0) I have debugged this to the point where if I relax the 'if (cmp > 0) break;' in list_find to 'if (cmp > 0) continue;', forcing a further walk of the list, my users will be authenticated. At this point though, the reverse split-ordered list is a bit beyond me and I'm looking for some help. Any ideas? Is this enough for a defect? Thanks, Dylan

2 2

Copy-acct-to-home-server Issue
by Ricardo Larrañaga 14 Jul '15

14 Jul '15

Hello Guys, i was wondering if you could give me some pointers on how to troubleshoot an issue. I am running freeradius 3.0.4 on Centos 7, and i am using copy-acct-to-home-server in order to replicate the accounting database between the 3 servers. Right now, all my NAS are only pointing to one server (Lets call it server1). So server2 and server3 do not receive authentication requests, they just receive accounting packets from server1. Now, with some NAS i also see issues where i miss accounting stop packets, and i end up with stale sessions. I am working on solving that, but in the mean time i run a script on all three servers that queries all NAS for active sessions and marks the stale sessions as Terminated. My script logs the stale sessions, so i can compare them between servers. My problem is that the stale sessions between the servers are different. Usually, server 2 and 3 have more stale sessions than server 1. This would tell me that there are accounting packets not processed or missing between server 1 and server 2 and 3. First thing i did was looking at the networking side of things. All interfaces between the servers run clean, they are all connected to the same switch. So i am trying to troubleshoot what is happeing with these packets. The questions i have are: 1) My copy acct-to-home-server for each server configuration is as follows: - log all the incoming packets to a detail file. -copy-acct-to-home-server server reads the detail file and updates the proxy-to-realm control attribute so the packet gets proxied to the other server. Acct always returns ok. If i understand this correctly, in this configuration the packets are "Sent and forgotten". So if a packet fails to be received or processed by server2 or server3, it wont be retried. The fact that all the detail files are empty makes me think that this is the way the server is working right now. Any ideas on how could i implement a simple "retry 3 times" policy? My issue is that since i proxy the packet, and and always return ok on accounting, i am not sure where to put the "IF packet failed to ACK, return fail". From what i see, it cannot be done in the proxy section, unless i do something like: realm SERVER1 { } 2) I dont see anything in the logs that would indicate there is a problem with packets being sent to the other to servers. How can i catch these issues from the logs or debug perspective? the only thing i can think of is to turn debug on for all the packets with packet-source-destination equals "server 2" and server 3" in server one, and go from there, but any suggestions would be appreciated, as that would basically be my whole radius acct traffic. I am copying here the contents of copy-acct-to-home-server, for reference (They are identical for all servers): server copy-acct-to-SERVER2 { listen { type = detail filename = /buffer_disk/SERVER2/detail_SERVER2 load_factor = 10 } preacct { update control { Proxy-To-Realm := "SERVER2" } } accounting { ok } pre-proxy { } post-proxy { } } My proxy.conf section only contains a realm section from it server, in the old configuration fashion (I probably should change it to the new one): realm "SERVER1" { nostrip authhost = 192.168.1.1:1812 accthost = 192.168.1.1:1813 secret=itssecret } As always, thank you very much for your help!. Regards

2 7

Manual insert of credentials into radcheck row disappears after five mins ( MySQL )
by Sophie Loewenthal 14 Jul '15

14 Jul '15

Dear everybody, I was asked to manaully add a user into our Radius db for some thrird party monitoring. Sometimes when I insert the row it's there, but after 5 mins or less the row is removed, as shown below. Does some Radius process remove rows? * First attempt * mysql> INSERT INTO radcheck (id, username, attribute, op, value) VALUES (DEFAULT,'xmonitor1','User-Password',':=','xxxxxxx'); Query OK, 1 row affected (0.01 sec) mysql> select * from radcheck where username = 'xmonitor1'; Empty set (0.01 sec) (Disappeared immediately!) * Try again * mysql> INSERT INTO radcheck (id, username, attribute, op, value) VALUES (DEFAULT,'xmonitor1','User-Password',':=','xxxxxxx'); Query OK, 1 row affected (0.00 sec) mysql> select * from radcheck where username = 'xmonitor1'; +-------+-----------+---------------+----+---------+ | id | username | attribute | op | value | +-------+-----------+---------------+----+---------+ | 65745 | xmonitor1 | User-Password | := | xxxxxxx | +-------+-----------+---------------+----+---------+ 1 row in set (0.00 sec) ( Now it's there) ( Let's wait 5 mins and try this query again ) mysql> select * from radcheck where username = 'xmonitor1'; Empty set (0.00 sec) ( Opps. now it's gone ) ( Let's see if some other entry took this id ) mysql> select * from radcheck where id = '65745'; Empty set (0.00 sec) mysql> select * from radcheck where id = 65745; Empty set (0.00 sec) ( Nope ). Operating System: CentOS 6.2 RADIUS Server: freeradius-mysql-2.1.12-1.el6.x86_64 freeradius-utils-2.1.12-1.el6.x86_64 freeradius-2.1.12-1.el6.x86_64 MYSQL server: percona-xtrabackup-2.2.9-5067.el6.x86_64 Percona-Server-shared-56-5.6.21-rel69.0.el6.x86_64 Percona-Server-server-56-5.6.21-rel69.0.el6.x86_64 Percona-Server-shared-compat-5.5.30-rel30.2.508.rhel6.x86_64 percona-toolkit-2.2.3-1.noarch Percona-Server-client-56-5.6.21-rel69.0.el6.x86_64 I'd be very grateful if somebody could let me know how I could diagnose this, or perhaps tell me the right way to insert a username+password into Radius. Kind regards. Sophie

4 5

double Login OK in logs
by stefan nowak 14 Jul '15

14 Jul '15

Hi, After successful authentication in file radius.log I see two "Login OK" in the same second . the different is that first have sentence "via TLS tunnel" and second no. logs looks like below: Tue Jul 14 09:46:10 2015 : Auth: (22) Login OK: [newuser/<via Auth-Type = EAP>] (from client 192.168.0.30 port 0 cli D0-51-62-34-B2-96 via TLS tunnel) newuser 04-18-D6-22-F7-37:1111 Wireless-802.11 Tue Jul 14 09:46:10 2015 : Auth: (23) Login OK: [newuser/<via Auth-Type = EAP>] (from client 192.168.0.30 port 0 cli D0-51-62-34-B2-96) newuser 04-18-D6-22-F7-37:1111 Wireless-802.11 Is this normal behave of freeradius? or maybe is some problem with my freeradius connfiguration?

2 1

value replacement
by Jorge Pereira 14 Jul '15

14 Jul '15

Hi, I have the variable. ADSL-Agent-Circuit-Id = 0x35303a33393a35353a30643a31613a6134*00* 4a4f5247452d53534944*00*ok And I am looking for some way to replace the '00' for ';' and transform in a String. Currently, I am doing: Mon Jul 13 19:06:23 2015 : Debug: (5) if (!&Called-Station-Id || &Called-Station-Id == "" || &Called-Station-Id == "00:00:00:00:00:00") { Mon Jul 13 19:06:23 2015 : Debug: (5) if (&ADSL-Agent-Circuit-Id) { Mon Jul 13 19:06:23 2015 : Debug: (5) if (&ADSL-Agent-Circuit-Id) -> TRUE Mon Jul 13 19:06:23 2015 : Debug: (5) if (&ADSL-Agent-Circuit-Id) { Mon Jul 13 19:06:23 2015 : Debug: (5) update { Mon Jul 13 19:06:23 2015 : Debug: (5) EXPAND %{string:&ADSL-Agent-Circuit-Id} Mon Jul 13 19:06:23 2015 : Debug: (5) --> ca:fe:ca:fe:00:01\000JORGE-SSID\000ok Mon Jul 13 19:06:23 2015 : Debug: (5) *&request:Called-Station-Id := ca:fe:ca:fe:00:01* Mon Jul 13 19:06:23 2015 : Debug: (5) } # update = noop Mon Jul 13 19:06:23 2015 : Debug: (5) } # if (&ADSL-Agent-Circuit-Id) = noop Any suggestion will be great. -- Jorge Pereira

2 1

Simultaneous-Use in proxy
by Renato Sousa 13 Jul '15

13 Jul '15

Hello everyone, I need to restrict simultaneous logins but the freeradius server which receives the authentication does not implement this restriction. This server receives the authentication different departments and this restriction should only be applied in my department. It is possible to create a proxy that forwards authentication for global freeradius server and controls the simultaneous logins? How to return the parameter Simultaneous-Use via proxy? Any help will appriciate. Best Regards, Renato L. Sousa

2 22

Guidelines for contributing
by Arran Cudbard-Bell 13 Jul '15

13 Jul '15

As displayed on the GitHub issue tracker when posting issues, and as included in server source as the CONTRIBUTING text file. https://github.com/FreeRADIUS/freeradius-server/blob/v3.1.x/CONTRIBUTING Repeated here to save clickety-clicketys. 0.INTRODUCTION The FreeRADIUS project wouldn't exist without contributions from a significant number of developers. We greatly value all comments, defect reports, patches/pull-requests, but must balance individual contributor's desires and practices against what's required for the project to operate efficiently. This document describes best practices when interacting with members of the FreeRADIUS project team via GitHub. If you follow these guidelines, it is very likely that your question, bug report or pull request will be acted on, and in a timely manor. If you choose to ignore these guidelines our response will be a link to this document. 1.GITHUB ISSUE TRACKER The GitHub issue tracker is for non-security related defect reports, feature requests, and pull-requests ONLY. It is not for support requests or questions regarding configuration/operation of the server, they belong on the users mailing list: http://freeradius.org/list/users.html Raising support requests or questions as issues will result in them being closed and locked. If you continue to raise these questions as issues you will be banned from the FreeRADIUS project's GitHub repositories. Security issues should be reported to security(a)freeradius.org, especially if they can be remotely exploited. This ensures that patches can be developed before the exploit is made public. 2.BEFORE REPORTING A DEFECT Verify it's still present in the Git HEAD. Checkout the appropriate branch for the version of the server you're working with as listed here (http://doc.freeradius.org) build the server, and attempt to reproduce your issue. The ChangeLog (https://github.com/FreeRADIUS/freeradius-server/blob/v3.0.x/doc/ChangeLog) for the current stable branch may also be used to determine if your issue has already been addressed. The ChangeLog is updated as fixes are made to the server code, and usually reflects the state of the Git HEAD. Do not report non-security defects for EOL branches (as listed on doc.freeradius.org) they will be closed and locked. 3.CONTENTS OF A DEFECT REPORT See doc/bugs (https://github.com/FreeRADIUS/freeradius-server/blob/master/doc/bugs) for information on what to include, and how to obtain it. When logging bug reports using the GitHub issue tracker, pay attention to formatting. You should ensure any log output is surrounded by two sets of tripple backticks (```). If you don't do this Github will automatically link your issue to other pre-existing issues when it encounters a #<num> string. 4.PULL REQUESTS AND CODING STANDARDS If you're developing a new feature, module, or writing large amounts of code to fix a defect, contact a member of the FreeRADIUS development team first. For simpler one or two line fixes, go ahead and open a pull-request immediately. The dev team can be contacted via the devel mailing list (http://freeradius.org/list/devel.html) or via GitHub by using the GitHub issue tracker. Contacting the dev team gives us the opportunity to offer feedback. We may have a solution to your problem that doesn't require additional code, or may have ideas as to how your problem can be solved in a way that will better fit with the longterm vision for the server. Once you've got the go ahead, read through the coding standards document: http://wiki.freeradius.org/contributing/coding-standards ...and start writing code. You may also wish to utilise the doxygen site: http://doc.freeradius.org The doxygen site contains the complete reference of all API functions with doxygen headers, as well as structs, and callback declarations. doc.freeradius.org is updated within one minute of each commit to the master branch of the main freeradius-server repo. This document was written to be displayed automatically on the GitHub issue tracker, so Git/GitHub knowledge is assumed. If you're wondering what the heck a pull-request is, this document may be of some use: http://wiki.freeradius.org/contributing/GitHub 5.CONTINUOUS INTEGRATION TESTS If possible include test cases in your pull-requests. There are currently three test frameworks for different elements of the server: Unit tests - src/tests/unit/*.txt - Tests for conditions and protocol encoders/decoders. Module tests - src/tests/modules/<module name> - Tests for module functionality. Unlang tests - src/tests/unlang/<test series> - Tests for unlang keywords and functions. See README.* docs in the directories above for basic information on writing test cases. The easiest way to write new tests is to use the existing tests as examples. Tests are run via Travis for each pull-request, and on every commit by a developer with repository access.

1 0

Re: Re: logging user mac
by stefan nowak 13 Jul '15

13 Jul '15

understand, in this case I have one last question. Is it possible to customize logs? for example: Logging ok/failed , User-Name, Calling-Station-Id(username mac), NAS-IP-Address, NAS-Port-Type if possible then what part of file I have to change?

3 2