- Freeradius-Users - lists.freeradius.org

Parsing opt82 attributes
by Anton 09 Jul '15

09 Jul '15

Good day. I'm using freeradius-2.2.5 as customized dhcp-server (2.2.5 because debian backports has no newer version and I don't like to build deb by hands). There is problem of logging remote-id and circuit-id. I have modified default loggin and it looks like this: sqlippool_log_success = "DHCP: Allocated IP: %{reply:Framed-IP-Address} from %{control:Pool-Name} \ (did %{Called-Station-Id} \ cli %{Calling-Station-Id} \ port %{NAS-Port} user %{User-Name} \ remote-id %{request:DHCP-Relay-Remote-Id} \ circuit-id %{request:DHCP-Relay-Circuit-Id}" It produces log entries like this: Thu Jul 9 15:27:50 2015 : Info: DHCP: Allocated IP: 172.31.251.244 from <Pool name here> (did cli 00:1f:c6:e9:0c:92 port user DHCP-00:1f:c6:e9:0c:92 remote-id 0x00060012cfa7f180 circuit-id 0x000407d00105 0012cfa7f180 - this is mac-address of the switch, 07d0 - hex vlan number (2000 in dec), 05 - is a hex port nubmer. I would like to log this entries in more human readable form: - mac-addres should be "0012.cfa7.f180" in cisco style or "00:12:cf:a7:f1:80" - vlan number should be "2000" - port number should also be decimal number "05" (wrong example with 5 :-)) How can I modify logging configuration to get human values in log file ?

2 3

Version 2.2.8 has been released
by Alan DeKok 09 Jul '15

09 Jul '15

We're happy to announce the release of version 2.2.8. Release notes are available here: http://freeradius.org/press/index.html#2.2.8 I suspect that this will be the last release of the server in the version 2 release cycle. Everyone should look into upgrading to version 3. Alan DeKok.

1 0

Upgrade OpenSSL.... again
by Alan DeKok 09 Jul '15

09 Jul '15

http://openssl.org/news/secadv_20150709.txt Severity: High During certificate verification, OpenSSL (starting from version 1.0.1n and 1.0.2b) will attempt to find an alternative certificate chain if the first attempt to build such a chain fails. An error in the implementation of this logic can mean that an attacker could cause certain checks on untrusted certificates to be bypassed, such as the CA flag, enabling them to use a valid leaf certificate to act as a CA and "issue" an invalid certificate. This issue will impact any application that verifies certificates including SSL/TLS/DTLS clients and SSL/TLS/DTLS servers using client authentication.

1 0

Version 3.0.9 has been released
by Alan DeKok 09 Jul '15

09 Jul '15

We're happy to announce the release of version 3.0.9. A list of updates && fixes is available at: http://freeradius.org/press/index.html#3.0.9 Alan DeKok.

3 8

Free Radius Proxy implementation Assumptions
by srithar jeevadurai 09 Jul '15

09 Jul '15

Dear Friends, We would like to know following detail for freeRadius proxy implementation. *Arch of Proxy implementation :* on Host1: 1 Proxy server will be running and takes request from NAS server. Behind the proxy server, we are planning to have pool of home servers (4) on same host (i.e. Host1). *Our Assumptions:* 1) Proxy server will not store any request that is coming from NAS server (i.e. storing request in processing queue). 2) Proxy server will do asynchronous request-response processing. 3) Multiple home servers (Radius stack) can be running on same host (by changing server port for each home server). 4) The synchronous request-response processing will happen only at home server level. Kindly request you to let us know whether our above assumptions are correct. *Proxy implementation approach: * - Load-balancing. Requests are split evenly among all home servers in the pool. Do we have any document to implement above proxy-home server set up ? -- Regards, Srithar Durairaj Alternate Mail I.D: srijeevadurai1(a)yahoo.co.in Mobile: +919886251852

3 3

Re: "[eap] = reject" after "Calling eap_md5 to process EAP data"
by Kris Armstrong 09 Jul '15

09 Jul '15

here is what I am seeing since uncommenting the "nostrip" (168) # Executing section authorize from file /etc/raddb/sites-enabled/default (168) authorize { (168) filter_username filter_username { (168) if (!&User-Name) (168) if (!&User-Name) -> FALSE (168) if (&User-Name =~ / /) (168) if (&User-Name =~ / /) -> FALSE (168) if (&User-Name =~ /@.*@/ ) (168) if (&User-Name =~ /@.*@/ ) -> FALSE (168) if (&User-Name =~ /\\.\\./ ) (168) if (&User-Name =~ /\\.\\./ ) -> FALSE (168) if ((&User-Name =~ /@/) && (&User-Name !~ /(a)(.+)\\.(.+)$/)) (168) if ((&User-Name =~ /@/) && (&User-Name !~ /(a)(.+)\\.(.+)$/)) -> FALSE (168) if (&User-Name =~ /\\.$/) (168) if (&User-Name =~ /\\.$/) -> FALSE (168) if (&User-Name =~ /(a)\\./) (168) if (&User-Name =~ /(a)\\./) -> FALSE (168) } # filter_username filter_username = notfound (168) WARNING: preprocess : There are more than 10 Proxy-State attributes in the request (168) WARNING: preprocess : You have likely configured an infinite proxy loop (168) [preprocess] = ok (168) [chap] = noop (168) [mschap] = noop (168) [digest] = noop (168) suffix : Checking for suffix after "@" (168) suffix : Looking up realm "example.com" for User-Name = "user(a)example.com" (168) suffix : Found realm "example.com" (168) suffix : Adding Realm = "example.com" (168) suffix : Proxying request from user user(a)example.com to realm example.com (168) suffix : Preparing to proxy authentication request to realm "example.com" (168) [suffix] = updated (168) eap : Request is supposed to be proxied to Realm example.com. Not doing EAP. (168) [eap] = noop (168) [files] = noop (168) sql : EXPAND %{User-Name} (168) sql : --> user(a)example.com (168) sql : SQL-User-Name set to 'user(a)example.com' rlm_sql (sql): Reserved connection (4) (168) sql : EXPAND SELECT id, username, attribute, value, op FROM radcheck WHERE username = '%{SQL-User-Name}' ORDER BY id (168) sql : --> SELECT id, username, attribute, value, op FROM radcheck WHERE username = 'user(a)example.com' ORDER BY id rlm_sql (sql): Executing query: 'SELECT id, username, attribute, value, op FROM radcheck WHERE username = 'user(a)example.com' ORDER BY id' (168) sql : EXPAND SELECT groupname FROM radusergroup WHERE username = '%{SQL-User-Name}' ORDER BY priority (168) sql : --> SELECT groupname FROM radusergroup WHERE username = 'user(a)example.com' ORDER BY priority rlm_sql (sql): Executing query: 'SELECT groupname FROM radusergroup WHERE username = 'user(a)example.com' ORDER BY priority' (168) sql : User not found in any groups rlm_sql (sql): Released connection (4) (168) [sql] = notfound (168) [expiration] = noop (168) [logintime] = noop (168) [pap] = noop (168) } # authorize = updated (168) Proxying request to home server 127.0.0.1 port 1812 timeout 20.000000 (168) Sending Access-Request packet to host 127.0.0.1 port 1812, id=152, length=0 (168) User-Name = 'user(a)example.com' (168) NAS-IP-Address = 10.250.8.180 (168) Called-Station-Id = 'c8d71992a9d7' (168) Calling-Station-Id = '00c01732012e' (168) NAS-Identifier = 'c8d71992a9d7' (168) NAS-Port = 29 (168) Framed-MTU = 1400 (168) NAS-Port-Type = Wireless-802.11 (168) EAP-Message = 0x020000150175736572406578616d706c652e636f6d (168) Message-Authenticator = 0xbeb9ebda3594a94e4cef4cb918c81000 (168) Event-Timestamp = 'Jul 8 2015 14:48:00 MDT' (168) Proxy-State = 0x30 On Jul 08, 2015, at 02:40 AM, A.L.M.Buxey(a)lboro.ac.uk wrote: Hi, I tried uncommenting the line nostrip from the proxy.con. that didn’t work. ....and...... (what does the debug NOW look like? ) if you dont help us, by providing that output, we cannot help you. alan - List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html

4 4

openssl gendh during make install
by Michael Ströder 08 Jul '15

08 Jul '15

HI! I have to admit that I find the openssl gendh during make install not ideal. The reason is that most .spec files use make install to create files in a build root during package build. And therefore at least it wastes a lot of CPU cycles during the build process for generating a file which the admin should re-generate *after* installing the package anyway. Any possible solution for this? E.g. I'd prefer start scripts to invoke openssl gendh if the file does not exist yet. Ciao, Michael.

3 2

SQL error - Incorrect datetime value
by Renato Sousa 08 Jul '15

08 Jul '15

Hello everyone, I'm setting up a freeradius server 3.0.8 on FreeBSD 10. I am getting an error in sql: (29) sql: Executing query: INSERT INTO radacct (acctsessionid, acctuniqueid, username, realm, nasipaddress, nasportid, nasporttype, acctstarttime, acctupdatetime, acctstoptime, acctsessiontime, acctauthentic, connectinfo_start, connectinfo_stop, acctinputoctets, acctoutputoctets, calledstationid, callingstationid, acctterminatecause, servicetype, framedprotocol, framedipaddress) VALUES ('00001A59-00000028', '8698639b48376aea32f23dc9a7989089', 'myuser', 'DEFAULT', '172.19.13.15', '0', 'Wireless-802.11', 1436344658, 1436344658, NULL, '0', 'RADIUS', 'CONNECT 0Mbps 802.11b', '', '0', '0', '2A-A4-3C-B2-FB-AD:mySSID', '34-BB-26-C2-1D-60', '', '', '', '') (29) sql: ERROR: rlm_sql_mysql: ERROR 1292 (Incorrect datetime value: '1436344658' for column 'acctstarttime' at row 1): 22007 I created the database using the mysql (version 5.6.24) schema.sql file provided on freeradius. The problem is in mysql or freeradius? Regards, Renato

3 7

how to account different table sql by time decision
by johan firdianto 08 Jul '15

08 Jul '15

hi guys i want to store accounting packet to different table sql with if time condition. like if (time > 1 am) and (time < 9 am) { store to acct2} else { store to acct1} i think the solution is using unlang language and put in radius conf. im not familiar with unlang language. i would appreciate if anybody here could help me. johan

3 3

Checking values of attributes
by Pshem Kowalczyk 08 Jul '15

08 Jul '15

Hi, I've recently upgraded our servers from 3.0.4 to 3.0.8. We have two radius servers that replicate received accounting packets to each other (so the local DBs remain in sync). In order to prevent loops before the packet is sent a local attribute is added (defined in the dictionary) to indicate that it should only be processed locally (and not replicated again). In 3.0.4 we used the following syntax: preacct { ... if ( request:SV-Handled != True ){ update { request:SV-Handled := True } replicate } ... } with the attribute defined like this: ATTRIBUTE SV-Handled 2 integer VALUE SV-Handled False 0 VALUE SV-Handled True 1 and that condition worked well - only packets from the NAS (that didn't have the attribute at all) were matched. Now, with 3.0.8 the behaviour has changed: if the packet has the attribute: (0) Received Accounting-Request Id 147 from 10.100.34.17:34759 to 10.100.34.18:1813 length 1213 ... (0) SV-Handled = True (0) # Executing section preacct from file /etc/raddb/sites-enabled/frontend (0) preacct { (0) frontend_files: acct_users: Matched entry DEFAULT at line 1 (0) [frontend_files] = ok (0) if ( request:SV-Handled != True ){ (0) if ( request:SV-Handled != True ) -> FALSE and if the packed doesn't have it: (4) # Executing section preacct from file /etc/raddb/sites-enabled/frontend (4) preacct { (4) frontend_files: acct_users: Matched entry DEFAULT at line 1 (4) [frontend_files] = ok (4) if ( request:SV-Handled != True ){ (4) ERROR: Failed retrieving values required to evaluate condition So, I've changed the condition to read: if ( %{%{request:SV-Handled}:-False} != True ){ But that doesn't seem to work as expected: When the attribute is there (and set to True) it evaluates: (0) Received Accounting-Request Id 239 from 10.100.34.17:52319 to 10.100.34.18:1813 length 1120 ... (0) SV-Handled = True (0) # Executing section preacct from file /etc/raddb/sites-enabled/frontend (0) preacct { (0) frontend_files: acct_users: Matched entry DEFAULT at line 2 (0) [frontend_files] = ok (0) if ( %{%{request:SV-Handled}:-False} != True ){ (0) if ( %{%{request:SV-Handled}:-False} != True ) -> TRUE So, not so good. I've tried a different setup as well: if ( %{%{integer:request:SV-Handled}:-0} != 1 ){ but that suffers from the same problem: (6) SV-Handled = True (6) # Executing section preacct from file /etc/raddb/sites-enabled/frontend (6) preacct { (6) frontend_files: acct_users: Matched entry DEFAULT at line 1 (6) [frontend_files] = ok (6) if ( %{%{integer:request:SV-Handled}:-0} != 1 ){ (6) if ( %{%{integer:request:SV-Handled}:-0} != 1 ) -> TRUE What's the correct syntax here? kind regards Pshem

2 5