- Freeradius-Users - lists.freeradius.org

Freeipa and Freeradius integration
by KL Forwarder 28 Apr '15

28 Apr '15

All, I can use your help. I am trying to set up freeradius on my RHEL IDM/freeipa server. A mail [0] from the freeipa list indicated that this would be easy, but I think I am missing one step. So far, freeradius can find the user in ldap ("User object found at DN "uid=username,cn=users,cn=compat,dc=companyname,dc=local"). It just does not seem to be able to verify if the pass word is correct. What steps do I need to take? I am just trying to figure this out, I don't have a guide or anything. I have uploaded my radiusd.conf [ http://pastebin.com/GijucMps ], my mods-available/ldap [ http://pastebin.com/YJTi8srS ] and sites-available/ldap [ http://pastebin.com/MMGzU8Sj ]. All help is welcome. Is is probably something easy. This is the log I get: ============================================================ (0) # Executing section authorize from file /etc/raddb/sites-enabled/default (0) authorize { (0) filter_username filter_username { (0) ? if (User-Name != "%{tolower:%{User-Name}}") (0) expand: "%{tolower:%{User-Name}}" -> 'klu' (0) ? if (User-Name != "%{tolower:%{User-Name}}") -> FALSE (0) ? if (User-Name =~ / /) (0) ? if (User-Name =~ / /) -> FALSE (0) ? if (User-Name =~ /@.*@/ ) (0) ? if (User-Name =~ /@.*@/ ) -> FALSE (0) ? if (User-Name =~ /\\.\\./ ) (0) ? if (User-Name =~ /\\.\\./ ) -> FALSE (0) ? if ((User-Name =~ /@/) && (User-Name !~ /(a)(.+)\\.(.+)$/)) (0) ? if ((User-Name =~ /@/) && (User-Name !~ /(a)(.+)\\.(.+)$/)) -> FALSE (0) ? if (User-Name =~ /\\.$/) (0) ? if (User-Name =~ /\\.$/) -> FALSE (0) ? if (User-Name =~ /(a)\\./) (0) ? if (User-Name =~ /(a)\\./) -> FALSE (0) } # filter_username filter_username = notfound (0) [preprocess] = ok (0) [chap] = noop (0) [mschap] = noop (0) [digest] = noop (0) suffix : No '@' in User-Name = "klu", looking up realm NULL (0) suffix : No such realm "NULL" (0) [suffix] = noop (0) eap : No EAP-Message, not doing EAP (0) [eap] = noop (0) [files] = noop rlm_ldap (ldap): Reserved connection (4) (0) ldap : expand: "(uid=%{%{Stripped-User-Name}:-%{User-Name}})" -> '(uid=klu)' (0) ldap : expand: "dc=kahuna,dc=local" -> 'dc=kahuna,dc=local' (0) ldap : Performing search in 'dc=kahuna,dc=local' with filter '(uid=klu)' (0) ldap : Waiting for search result... (0) ldap : User object found at DN "uid=klu,cn=users,cn=compat,dc=kahuna,dc=local" (0) ldap : Processing user attributes (0) WARNING: ldap : No "reference" password added. Ensure the admin user has permission to read the password attribute (0) WARNING: ldap : PAP authentication will *NOT* work with Active Directory (if that is what you were trying to configure) rlm_ldap (ldap): Released connection (4) (0) [ldap] = ok (0) [expiration] = noop (0) [logintime] = noop (0) WARNING: pap : No "known good" password found for the user. Not setting Auth-Type. (0) WARNING: pap : Authentication will fail unless a "known good" password is available. (0) [pap] = noop (0) } # authorize = ok (0) ERROR: No Auth-Type found: rejecting the user via Post-Auth-Type = Reject (0) Failed to authenticate the user. (0) Using Post-Auth-Type Reject (0) # Executing group from file /etc/raddb/sites-enabled/default (0) Post-Auth-Type REJECT { (0) attr_filter.access_reject : expand: "%{User-Name}" -> 'klu' (0) attr_filter.access_reject : Matched entry DEFAULT at line 11 (0) [attr_filter.access_reject] = updated (0) eap : Request didn't contain an EAP-Message, not inserting EAP-Failure (0) [eap] = noop (0) remove_reply_message_if_eap remove_reply_message_if_eap { (0) ? if (reply:EAP-Message && reply:Reply-Message) (0) ? if (reply:EAP-Message && reply:Reply-Message) -> FALSE (0) else else { (0) [noop] = noop (0) } # else else = noop (0) } # remove_reply_message_if_eap remove_reply_message_if_eap = noop (0) } # Post-Auth-Type REJECT = updated (0) Finished request 0. ============================================================ [0] https://www.redhat.com/archives/freeipa-users/2008-October/msg00036.html Thanks!

2 11

Freeradius 3.0.8 Can't create UNIX socket and Too many open files
by Aleš Rygl 28 Apr '15

28 Apr '15

Hello, I am playing with 3.0.8 version processing just Accounting Requests.The goal is get over more than 1.600 req/s. Up to 1000/req it is fine. MySQL DB has max_connections = 2048. It can run for half of a day and then it crashes accidentally: Tue Apr 28 12:52:06 2015 : Info: rlm_sql (sql_instance_mobile_direct): 665 of 696 connections in use. Need more spares Tue Apr 28 12:52:06 2015 : Info: rlm_sql (sql_instance_mobile_direct): Opening additional connection (1645), 192 of 304 pending slots used Tue Apr 28 12:52:06 2015 : Error: rlm_sql_mysql: Couldn't connect to MySQL server radius@localhost:gprscalls Tue Apr 28 12:52:06 2015 : Error: rlm_sql_mysql: MySQL error: Can't create UNIX socket (24) Tue Apr 28 12:52:06 2015 : Error: rlm_sql (sql_instance_mobile_direct): Opening connection failed (1624) Tue Apr 28 12:52:06 2015 : Error: rlm_sql_mysql: Couldn't connect to MySQL server radius@localhost:gprscalls Tue Apr 28 12:52:06 2015 : Error: rlm_sql_mysql: MySQL error: Can't create UNIX socket (24) and later on in the log: Tue Apr 28 12:52:06 2015 : ERROR: (1086382) detail.mobile: ERROR: Couldn't open file /var/log/freeradius/radacct/detail.mobile/queue-11/detail-2015042812: Failed calling dup(): Too many open files Tue Apr 28 12:52:06 2015 : ERROR: (1086380) detail.mobile: ERROR: Couldn't open file /var/log/freeradius/radacct/detail.mobile/queue-9/detail-2015042812: Failed calling dup(): Too many open files Tue Apr 28 12:52:06 2015 : ERROR: (1086383) detail.mobile: ERROR: Couldn't open file /var/log/freeradius/radacct/detail.mobile/queue-9/detail-2015042812: Failed to open file /var/log/freeradius/radacct/detail.mobile/queue-9/detail-2015042812: Too many open files Config: listen { ipaddr = * port = 1813 type = acct limit { } } preacct { preprocess acct_unique_mobile } accounting { redundant { sql_instance_mobile_direct group { linelog detail.mobile } } if (noop) { ok } } } sql sql_instance_mobile_direct { query_timeout = 1 driver = "rlm_sql_mysql" dialect = "mysql" server = "localhost" port = 3306 login = "radius" password = "xxxxxxxxxxx" radius_db = "gprscalls" acct_table1 = "radacct" acct_table2 = "radacct" postauth_table = "radpostauth" authcheck_table = "radcheck" groupcheck_table = "radgroupcheck" authreply_table = "radreply" groupreply_table = "radgroupreply" usergroup_table = "radusergroup" delete_stale_sessions = yes logfile = ${logdir}/sqllog_dslres.sql pool { start = 200 min = 20 max = ${thread[pool].max_servers} spare = 80 uses = 0 lifetime = 0 idle_timeout = 120 } client_table = "nas" $INCLUDE ${modconfdir}/${.:name}/main/${dialect}/queries_mobile.conf } It is a test system so far. I can provide all debugs if needed. Thanks Ales

2 3

Locking in rlm_detail
by Nathan Ward 28 Apr '15

28 Apr '15

Hi all, I’m a long time FR user but first time on this list. I’ve got a 3.0.4 system running, though I think that this applies to everything since d9b39f43f620aede773d41a930353926b52e3e68, which first saw release in 3.0.3. This seems to apply to v3.1.x also. The docs, and config parser, support an option in rlm_detail called “locking”. It was my hope that this would lock the file until it was closed, rather than locking the file only while I write was taking place, but I understand now that that’s not how the feature was intended. This is really by the by. However, in investigating this, I found that the “locking” option doesn’t seem to have any effect in 3.0.3+. The last code that I could find that looks at the state of the option is removed in the commit I mention above. It appears (from some quick, non-exhaustive code reading) that the new(ish) logfile API locks for all writes, so this option is no longer, well, optional? I understand that this isn’t relevant to my particular hope for the “locking” option, but, I wanted to try and understand it nonetheless. If the “locking” option and documentation need to be removed, I’m happy to submit PRs for this (against both v3.0.x and v3.1.x of course), but wanted to check first. -- Nathan Ward

2 3

How to Pass multiple Attribute Value Pair of Same Name.
by Amit Butere 28 Apr '15

28 Apr '15

Hi Guys, i am using FreeRADIUS Version 3.0.3 and using perl module when i pass single Attribute to perl script like ie. ( $RAD_CHECK{' Account-Info'} ) .i can get all the values of this variable available in the perl for processing. but when i am trying to pass multiple variable of same name i am not getting those values pass to perl script. in the DB i have following entries Account-Info = "AInternet-Sevice" Account-Info = "NBoD-2Meg" i gone through doc but i am missing something i guess kindly guide me what i am missing . also in previous version of radius 2.2.x . when using perl module i can simply print any variable with print command and variable name. how can i achieve same in this new version of radius. Regards Amit B.

3 4

rlm_perl and checksimul
by d tbsky 28 Apr '15

28 Apr '15

hi: I am using freeradius 3.0.4 comes with rhel 7.1. I want to write a checksimul perl script. but it seems won't be called. I create a rlm_perl instance "check_login", and put it under "default" site: session { check_login } and at perl script I write my code at finction below: sub checksimul { &radiusd::radlog(L_INFO, "check_login: I am here"); return RLM_MODULE_OK; } but "radiusd -X" show my code is not be called after user authentication. the code works fine if I put it at "authroize" or "post-auth" section. I don't know if I miss some steps or I met a bug..

2 3

Mikrotik DHCP and "auth-type := accept"
by Osvaldo T Crispim Filho 27 Apr '15

27 Apr '15

I use Freeradius and Mikrotik. Freeradius 2.1.10+dfsg-3ubuntu0.12.04.2 I want to use DHCP Server of Mikrotik with rlm_sqlippool. DHCP Server on Mikrotik do not send password. I want to use "auth-type := Accept" withou password I receve this on log: Info: ERROR: No authenticate method (Auth-Type) found for the request: Rejecting the user How can i do that? Thankyou. -- - Osvaldo T Crispim Filho -

2 5

External script
by Amit Butere 27 Apr '15

27 Apr '15

Hi guys I am trying to write external Php script and return module codes and match those module codes using unlang . My script is being called and I can see that in debug. The error I get here is . Failed parsing output from script.php attributes : expecting operator I am returning values as 1 for success and 0 for fail Ultimately radius says module fail. I would be checking what operators to return value from Php script. Thanks in advance guys Regards Amit B

2 3

rlm_perl CLONE under freeradius 3.x
by d tbsky 26 Apr '15

26 Apr '15

hi: I am writing rlm_perl script under freeradius 3.0.4 which comes with RHEL 7.1. and I am confused about how thread working with rlm_perl. according to the old message at email list, if I want every radius thread to have their own unique variable, I should put the variable at "CLONE" function like below: our ($var); CLONE { $var = ''; } but after testing, I found even if the variable is not put at the CLONE function, they are still unique to each thread. may I ask what is the correct method to make global thread shared variable and thread unique variable under rlm_perl ? Regards, tbskyd

3 3

Printing as Integers in linelog
by Peter Balsianok 25 Apr '15

25 Apr '15

Hi, I want to use "Printing as Integers" %{Attribute-Name#}. Using %{Event-Timestamp#} will return the event timestamp as an unsigned 32-bit decimal number. May i use it in linelog ? Debug output: (0) log_acct_bras: EXPAND Accounting-Request.%{%{Acct-Status-Type}:-unknown} (0) log_acct_bras: --> Accounting-Request.Start (0) log_acct_bras: EXPAND /app_log/radius/acct/loaders/bdsl-%D.log (0) log_acct_bras: --> /app_log/radius/acct/loaders/bdsl-20150425.log (0) log_acct_bras: ERROR: %l|%{Acct-Status-Type}|%{Acct-Session-Id}|%{Acct-Unique-Session-Id}|%{User-Name}|%{NAS-IP-Address}|%{Event-Timestamp#}|%{Acct-Session-Time}|%{Connect-Info}|%{Acct-Input-Octets64}|%{Acct-Output-Octets64}|%{Called-Station-Id}|%{Calling-Station-Id}|%{Acct-Terminate-Cause}|%{%{Framed-IP-Address}:-%{Delegated-IPv6-Prefix}:-Unknown}|%{Acct-Delay-Time}|%{Session-Error-Msg}|%{Session-Error-Code} (0) log_acct_bras: ERROR: ^ No matching closing brace Thx

2 1

unlang question
by Peter Balsianok 25 Apr '15

25 Apr '15

Hi, In documentation (3.0.8) is module if (reject) { ... } But in case of rlm_perl i need to use (this works) perl { reject = 1 } if (reject) { ... } Thx.

2 3