- Freeradius-Users - lists.freeradius.org

radtest (0) Error parsing "stdin": Failed to get value
by Victor Beliaiev 17 Jun '15

17 Jun '15

Dear Mr. Herwin Weststrate I just have followed your instructions and radiusd and radclient with -x options done everything fine! If need I could send the logs but they look as typical without any warnings or errors. Just both work fine. :-) I hope I can to go forward with freeradius 3.0.8 and freebsd and tune them with mysql. I will try radtest once again... May be something wrong with FreeBSD 10.... Thank you a lot for the fast feedback best wishes with radius and linux Victor ps Sorry for the repetition Среда, 17 июня 2015, 17:03 +02:00 от Herwin Weststrate <herwin(a)quarantainenet.nl>: >On 17-06-15 16:52, Victor Beliaiev wrote: >> 2/ Concole #2 >> radtest -x -4 bob hello 127.0.0.1 0 testing123 >> (0) Error parsing "stdin": Failed to get value > >radtest is a wrapper for radclient. There are two possibilities here: >either the output of radtest is invalid, or there is something wrong >with radclient. > >Could you put the following text in a file and feed that to radclient > > User-Name = 'bob' > User-Password = 'hello' > NAS-IP-Address = 127.0.1.1 > NAS-Port = 0 > Message-Authenticator = 0x00 > Cleartext-Password = 'hello' > >To feed it to radclient: > > radclient -4 -x 127.0.0.1 auth testing123 < $filename > >All my 3.0.8 installs here work fine, but they're all on linux. > >-- >Herwin Weststrate -- Victor Beliaiev +38 050 412-2003 belve(a)mail.ru ---------------------------------------------------------------------- -- Victor Beliaiev +38 050 412-2003 belve(a)mail.ru

1 0

radtest (0) Error parsing "stdin": Failed to get value
by Victor Beliaiev 17 Jun '15

17 Jun '15

Hi guys, FreeRadius3-3.0.8 has been installed 14/06/2015 FreeBSD 10.1-RELEASE #0 r274401 1/ Console #1 $su - #radiusd -X Listening on auth address * port 1812 bound to server default Listening on auth address * port 1813 bound to server default Listening on auth address :: port 1812 bound to server default Listening on auth address :: port 1813 bound to server default Listening on auth address 127.0.0.1 port 18120 bound to server inner-tunnel Opening new proxy socket 'proxy address * port 0' Listening on proxy address * port 34557 Ready to process request 2/ Concole #2 radtest -x -4 bob hello 127.0.0.1 0 testing123 (0) Error parsing "stdin": Failed to get value 3/ raddb/users file checked and seems is everything ok no any other outputs in Console#1 and Console#2 windows 4/ /var/log/radius.log has no outputs 5/ ping 127.0.0.1 - is ok 6/ stdin stdout - checked ok 7/ freeradius mail archive is passed please, could you advise smth ? Thank you in advance Victor Beliaiev belve(a)mail.ru

3 2

Fwd: radtest (0) Error parsing "stdin": Failed to get value
by Victor Beliaiev 17 Jun '15

17 Jun '15

Dear Mr. Herwin Weststrate I just have followed your instructions and radiusd and radclient with -x options done everything fine! If need I could send the logs but they look as typical without any warnings or errors. Just both work fine. :-) I hope I can to go forward with freeradius 3.0.8 and freebsd and tune them with mysql. I will try radtest once again... May be something wrong with FreeBSD 10.... Thank you a lot for the fast feedback best wishes with radius and linux Victor Среда, 17 июня 2015, 17:03 +02:00 от Herwin Weststrate <herwin(a)quarantainenet.nl>: >On 17-06-15 16:52, Victor Beliaiev wrote: >> 2/ Concole #2 >> radtest -x -4 bob hello 127.0.0.1 0 testing123 >> (0) Error parsing "stdin": Failed to get value > >radtest is a wrapper for radclient. There are two possibilities here: >either the output of radtest is invalid, or there is something wrong >with radclient. > >Could you put the following text in a file and feed that to radclient > > User-Name = 'bob' > User-Password = 'hello' > NAS-IP-Address = 127.0.1.1 > NAS-Port = 0 > Message-Authenticator = 0x00 > Cleartext-Password = 'hello' > >To feed it to radclient: > > radclient -4 -x 127.0.0.1 auth testing123 < $filename > >All my 3.0.8 installs here work fine, but they're all on linux. > >-- >Herwin Weststrate -- Victor Beliaiev +38 050 412-2003 belve(a)mail.ru ---------------------------------------------------------------------- -- Victor Beliaiev +38 050 412-2003 belve(a)mail.ru

1 0

rlm_passwd
by Peter Balsianok 17 Jun '15

17 Jun '15

Hi, I want to use rlm_passwd this way: passwd msisdn2ip { filename = ${modconfdir}/${.:instance}/msisdn2ip.dat format = "*Calling-Station-Id:=Framed-IP-Address" delimiter = "," } Exmaple of msisdn2ip: 421905000000,10.10.10.1 I want to use msisdn2ip ( instance of rlm_passwd) in the post-proxy section, therefore I have added MOD_POST_PROXY into the source core of rlm_passwd .... .methods = { [MOD_AUTHORIZE] = mod_passwd_map, [MOD_ACCOUNTING] = mod_passwd_map, [MOD_POST_AUTH] = mod_passwd_map, [MOD_POST_PROXY] = mod_passwd_map #ifdef WITH_COA [MOD_RECV_COA] = mod_passwd_map, [MOD_SEND_COA] = mod_passwd_map #endif }, ... After compilation everything works fine. Maybe i haven't realised something. Is it correct approach? Thx.

2 1

Re: Trouble setting up vmps with 3.0.8 (3 series)
by Manny 17 Jun '15

17 Jun '15

Sorry Alan, I did not intend to be impolite or offend. I included the config files just in case anyone noticed anything 'odd'. and will refrain. i've redone everything, and have finally gotten vmps responses. to test, i have used the check_vmps package from nagios and it appears to work at least from what I am seeing in the freeradius respones. Has anybody noticed any odd behavior with freeradius when a mac address have letters in it? It is like freeradius does not parse these macs correctly to assign it to the correct vlan. Example: mac2vlan file: 00:01:02:03:04:05,VLAN1 03:04:05:06:07:08,VLAN2 03:04:05:06:07:18,VLAN3 03:04:05:06:A7:18,VLAN4 03:04:05:06:B7:18,VLAN4 03:04:05:06:A8:18,VLAN4 03:04:05:06:A9:18,VLAN5 unix# ./check_vmps -s 192.168.2.25 -m 00:01:02:03:04:05 VMPS OK - Vlan: VLAN1, MAC Address: 000102030405, Status: ALLOW unix# unix# ./check_vmps -s 192.168.2.25 -m 03:04:05:06:07:08 VMPS OK - Vlan: VLAN2, MAC Address: 030405060708, Status: ALLOW unix# unix# ./check_vmps -s 192.168.2.25 -m 03:04:05:06:07:18 VMPS OK - Vlan: VLAN3, MAC Address: 030405060718, Status: ALLOW unix# unix# ./check_vmps -s 192.168.2.25 -m 03:04:05:06:A7:18 VMPS OK - Vlan: please_use_real_vlan_here, MAC Address: 03040506a718, Status: ALLOW unix# unix# ./check_vmps -s 192.168.2.25 -m 03:04:05:06:A9:18 VMPS OK - Vlan: please_use_real_vlan_here, MAC Address: 03040506a918, Status: ALLOW unix# unix# ./check_vmps -s 192.168.2.25 -m 03:04:05:06:A8:18 VMPS OK - Vlan: please_use_real_vlan_here, MAC Address: 03040506a818, Status: ALLOW unix# unix# ./check_vmps -s 192.168.2.25 -m 03:04:05:06:07:18 VMPS OK - Vlan: VLAN3, MAC Address: 030405060718, Status: ALLOW unix# unix# ./check_vmps -s 192.168.2.25 -m 00:01:02:03:04:05 VMPS OK - Vlan: VLAN1, MAC Address: 000102030405, Status: ALLOW unix# debug information: Ready to process requests VMPS-Packet-Type = VMPS-Join-Request VMPS-Error-Code = VMPS-No-Error VMPS-Sequence-Number = 4660 VMPS-Client-IP-Address = 127.0.0.1 VMPS-Port-Name = 'Fa0/1' VMPS-VLAN-Name = '' VMPS-Domain-Name = '' VMPS-Unknown = 0x00 VMPS-MAC = 03:04:05:06:07:18 (2) Received Access-Request Id 4660 from 192.168.2.5:50874 to 192.168.2.25:1589 length 60 (2) VMPS-Packet-Type = VMPS-Join-Request (2) VMPS-Error-Code = VMPS-No-Error (2) VMPS-Sequence-Number = 4660 (2) VMPS-Client-IP-Address = 127.0.0.1 (2) VMPS-Port-Name = 'Fa0/1' (2) VMPS-VLAN-Name = '' (2) VMPS-Domain-Name = '' (2) VMPS-Unknown = 0x00 (2) VMPS-MAC = 03:04:05:06:07:18 Doing VMPS (2) vmps { (2) if (!&VMPS-Mac) { (2) if (!&VMPS-Mac) -> FALSE (2) mac2vlan: Added VMPS-VLAN-Name: 'VLAN3' to reply_items (2) [mac2vlan] = ok (2) update reply { (2) &VMPS-Packet-Type = VMPS-Join-Response (2) &VMPS-Cookie = &VMPS-MAC -> 03:04:05:06:07:18 (2) &VMPS-VLAN-Name = "please_use_real_vlan_here" (2) } # update reply = noop (2) if (&VMPS-Packet-Type == VMPS-Reconfirm-Request){ (2) if (&VMPS-Packet-Type == VMPS-Reconfirm-Request) -> FALSE (2) } # vmps = ok Done VMPS (2) vmps { (2) if (!&VMPS-Mac) { (2) if (!&VMPS-Mac) -> FALSE (2) mac2vlan: Added VMPS-VLAN-Name: 'VLAN3' to reply_items (2) [mac2vlan] = ok (2) update reply { (2) &VMPS-Packet-Type = VMPS-Join-Response (2) &VMPS-Cookie = &VMPS-MAC -> 03:04:05:06:07:18 (2) &VMPS-VLAN-Name = "please_use_real_vlan_here" (2) } # update reply = noop (2) if (&VMPS-Packet-Type == VMPS-Reconfirm-Request){ (2) if (&VMPS-Packet-Type == VMPS-Reconfirm-Request) -> FALSE (2) } # vmps = ok (2) Sent Access-Accept Id 4660 from 192.168.2.25:1589 to 192.168.2.5:50874 length 0 VMPS-VLAN-Name = 'VLAN3' VMPS-Cookie = 03:04:05:06:07:18 (2) Finished request Waking up in 4.9 seconds. (2) <done>: Cleaning up request packet ID 4660 with timestamp +40 Ready to process requests VMPS-Packet-Type = VMPS-Join-Request VMPS-Error-Code = VMPS-No-Error VMPS-Sequence-Number = 4660 VMPS-Client-IP-Address = 127.0.0.1 VMPS-Port-Name = 'Fa0/1' VMPS-VLAN-Name = '' VMPS-Domain-Name = '' VMPS-Unknown = 0x00 VMPS-MAC = 00:01:02:03:04:05 (3) Received Access-Request Id 4660 from 192.168.2.5:50875 to 192.168.2.25:1589 length 60 (3) VMPS-Packet-Type = VMPS-Join-Request (3) VMPS-Error-Code = VMPS-No-Error (3) VMPS-Sequence-Number = 4660 (3) VMPS-Client-IP-Address = 127.0.0.1 (3) VMPS-Port-Name = 'Fa0/1' (3) VMPS-VLAN-Name = '' (3) VMPS-Domain-Name = '' (3) VMPS-Unknown = 0x00 (3) VMPS-MAC = 00:01:02:03:04:05 Doing VMPS (3) vmps { (3) if (!&VMPS-Mac) { (3) if (!&VMPS-Mac) -> FALSE (3) mac2vlan: Added VMPS-VLAN-Name: 'VLAN1' to reply_items (3) [mac2vlan] = ok (3) update reply { (3) &VMPS-Packet-Type = VMPS-Join-Response (3) &VMPS-Cookie = &VMPS-MAC -> 00:01:02:03:04:05 (3) &VMPS-VLAN-Name = "please_use_real_vlan_here" (3) } # update reply = noop (3) if (&VMPS-Packet-Type == VMPS-Reconfirm-Request){ (3) if (&VMPS-Packet-Type == VMPS-Reconfirm-Request) -> FALSE (3) } # vmps = ok Done VMPS (3) vmps { (3) if (!&VMPS-Mac) { (3) if (!&VMPS-Mac) -> FALSE (3) mac2vlan: Added VMPS-VLAN-Name: 'VLAN1' to reply_items (3) [mac2vlan] = ok (3) update reply { (3) &VMPS-Packet-Type = VMPS-Join-Response (3) &VMPS-Cookie = &VMPS-MAC -> 00:01:02:03:04:05 (3) &VMPS-VLAN-Name = "please_use_real_vlan_here" (3) } # update reply = noop (3) if (&VMPS-Packet-Type == VMPS-Reconfirm-Request){ (3) if (&VMPS-Packet-Type == VMPS-Reconfirm-Request) -> FALSE (3) } # vmps = ok (3) Sent Access-Accept Id 4660 from 192.168.2.25:1589 to 192.168.2.5:50875 length 0 VMPS-VLAN-Name = 'VLAN1' VMPS-Cookie = 00:01:02:03:04:05 (3) Finished request Waking up in 4.9 seconds. (3) <done>: Cleaning up request packet ID 4660 with timestamp +221 Ready to process requests thanks again, -- Manuel

2 2

Re: update reply: "Juniper-Primary-Dns"
by Amir Tal 17 Jun '15

17 Jun '15

Thanks for the replies. Replacing Juniper-* attributes with ERX-* did resolve the issue. Amir. [IMG]<http://www.ccc.co.il> Amir Tal [IMG] System Administrator +972 39201471 [IMG] Cloud Systems Support +972 39201442 [IMG]

1 0

MAC Auth Question
by J Kephart 16 Jun '15

16 Jun '15

Good day! We use FR to handle AAA services at a number of client sites, though we've not done anything "fancy" with it as yet. However, we've recently started using MAC authentication, but one thing we don't want to have happen is for a user to sign up for service in one location and then move to another and be able to use the network without signing in (both sites would be configured for MAC auth). To that end, we're thinking we might do something like the following: 1. Combine the NAS-Identifier with the User-Name (e.g., "1234-samjones"). 2. Do an sql lookup in radgroupreply (all users are assigned to groups based on NAS-ID and username) to determine if the group exists. 3. If it does, permit MAC auth to succeed; otherwise, reject. My first question is, does this seem a good way to prevent users from automatic roaming between sites, given that our clients are different? Does the method seem sound? Can we generate our own variable names within the raddb files for later use in the sql lookup? And, most importantly, where and in what file would be the best place to do this? Also, for accounting purposes, we'd like to prepend the same nas-id to the username. Any recommendations on how best to approach that? We're stepping off the edge of the world here, well outside our comfort zone, so we want to be sure we do this correctly. I appreciate any and all pointers, especially to docs that might describe how to do this. Cheers, Jim

2 2

Trouble setting up vmps with 3.0.8 (3 series)
by Manny 16 Jun '15

16 Jun '15

Hello gents, I love the the spirit of the freeradius software and am really hoping to use it for some testing in my home environment. Alas, I am having some definate trouble setting it up. When I use the magical google, all examples are for 2.0 and the documentation for setting up vmps with the 3 series appears a bit... lacking at least for my taste. What I have done so far. radiusd.conf [root@vmps01 raddb]# grep -v '^$' radiusd.conf|grep -v '#' prefix = /usr/local/freeradius exec_prefix = ${prefix} sysconfdir = ${prefix}/etc localstatedir = ${prefix}/var sbindir = ${exec_prefix}/sbin logdir = ${localstatedir}/log/radius raddbdir = ${sysconfdir}/raddb radacctdir = ${logdir}/radacct name = radiusd confdir = ${raddbdir} modconfdir = ${confdir}/mods-config certdir = ${confdir}/certs cadir = ${confdir}/certs run_dir = ${localstatedir}/run/${name} db_dir = ${raddbdir} libdir = ${exec_prefix}/lib pidfile = ${run_dir}/${name}.pid correct_escapes = true max_request_time = 30 cleanup_delay = 5 max_requests = 1024 hostname_lookups = no log { destination = files colourise = yes file = ${logdir}/radius.log syslog_facility = daemon stripped_names = no auth = no auth_badpass = no auth_goodpass = no msg_denied = "You are already logged in - access denied" } checkrad = ${sbindir}/checkrad security { allow_core_dumps = no max_attributes = 200 reject_delay = 1 status_server = yes allow_vulnerable_openssl = yes } proxy_requests = yes $INCLUDE proxy.conf $INCLUDE clients.conf thread pool { start_servers = 5 max_servers = 32 min_spare_servers = 3 max_spare_servers = 10 max_requests_per_server = 0 auto_limit_acct = no } modules { $INCLUDE mods-enabled/ } instantiate { } policy { $INCLUDE policy.d/ } $INCLUDE sites-enabled/ [root@vmps01 raddb]# [root@vmps01 raddb]# grep -v '^$' mods-enabled/mac2vlan|grep -v '#' passwd mac2vlan { filename = ${modconfdir}/${.:name}/${.:instance} format = "*VMPS-Mac:=VMPS-VLAN-Name" delimiter = "," } [root@vmps01 raddb]# [root@vmps01 raddb]# grep -v '^$' mods-config/passwd/mac2vlan|grep -v '#' 00:1C:B3:09:85:15,Server 00:1C:B3:09:85:16,VLAN1 00:1C:B3:09:85:17,VLAN2 [root@vmps01 raddb]# [root@vmps01 raddb]# grep -v '^$' clients.conf|grep -v '#' client localhost { ipaddr = 127.0.0.1 proto = * secret = testing123 require_message_authenticator = no limit { max_connections = 16 lifetime = 0 idle_timeout = 30 } } client localhost_ipv6 { ipv6addr = ::1 secret = testing123 } client lex { ipaddr = 192.168.1.0/24 secret = testing123456 } [root@vmps01 raddb]# My switches are on 192.168.1.10 & 192.168.1.11 Neither config on the switches accepts a secret (as defined in the clients.conf file) but I tried running the config without it, and the service would not start. Default installation enabled a bunch of other modules, but really I only want vmps (mac2vlan), but documentation doesn't really detail what I can remove to have vmps only service. Please help, thank you in advance, -- Manny

2 1

update reply: "Juniper-Primary-Dns"
by Amir Tal 16 Jun '15

16 Jun '15

Hi, Trying to implement setting custom values for DNS servers based on some condition. Following attributes are needed in radius reply: Juniper-Primary-Dns Juniper-Secondary-Dns Following snip was added to '/etc/raddb/sites-enabled/default' : ... if ( User-Name =~ /test2/i ) { if ( NAS-Port-Id =~ /147.235.4./i ) { update reply { Juniper-Primary-Dns := "109.226.x.x" Juniper-Secondary-Dns := "109.226.x.x" } } } ... When testing this, values are added to reply, this was confirmed by enabling "reply_log" in freeradius. Example: Tue Jun 16 18:54:07 2015 Packet-Type = Access-Accept Juniper-Primary-Dns = 109.226.x.x Juniper-Secondary-Dns = 109.226.x.x Framed-Protocol = PPP Framed-Compression = Van-Jacobson-TCP-IP ERX-Egress-Statistics := enable ERX-Ingress-Statistics := enable ERX-Egress-Policy-Name := "100MB" ERX-Ingress-Policy-Name := "4mb" Framed-MTU = 1512 Framed-Pool := "fast" But, this is not passed to the client, NAS still overrides this with default values. User authentication uses LDAP to store user profiles, if we add these two attributes to the user via his LDAP profile, then the change is accepted. Condition was tested on "authorize" and on "post-auth" sections, same result in both cases. Assistance would be appreciated, thanks. Amir. [IMG]<http://www.ccc.co.il> Amir Tal [IMG] System Administrator +972 39201471 [IMG] Cloud Systems Support +972 39201442 [IMG]

3 2

Radsec with freeradius 3.0.8
by Ashish Sinha 16 Jun '15

16 Jun '15

Hi Anyone know about client which can be used to test radsec(radius over tcp with TLS) I tried radtest but it doesn't support TLS and eapol_test supports TLS but doesn't support radius over TCP Thanks Ashish

3 3