- Freeradius-Users - lists.freeradius.org

3.0.7 -> run "make install" twice
by tom greisch 10 Apr '15

10 Apr '15

Hello, today i compiled Freeradius Version 3.0.7./configure -> okmake -> okmake install -> Error Message====================================== INSTALL doc/deployment/MACOSX INSTALL doc/deployment/supervise-radiusd.rst INSTALL doc/deployment/OS2 INSTALL doc/deployment/CYGWIN.rst INSTALL raddb/ mkdir: cannot create directory ‘/usr/local/etc/raddb/’: File exists raddb/all.mk:69: recipe for target '/usr/local/etc/raddb/' failed make: *** [/usr/local/etc/raddb/] Error 1 ====================================== If i type "make install" again -> It works

6 9

Wired 802.1x certificate warning
by sander timmermans 10 Apr '15

10 Apr '15

Hey folks, I'm having some difficulty with setting up a test environment for wired 802.1x authentication with FreeRADIUS. For starters, let me just throw the freeradius -X output here: rad_recv: Access-Request packet from host 81.82.213.157 port 2000, id=11, length=104 User-Name = "test" EAP-Message = 0x020100090174657374 NAS-IP-Address = 192.168.2.199 NAS-Port = 1 Service-Type = Framed-User Framed-MTU = 1400 Calling-Station-Id = "78-AC-C0-5C-C2-0D" NAS-Port-Type = Ethernet Message-Authenticator = 0x8869e4d26b2aad94456e66246fd97702 # Executing section authorize from file /etc/freeradius/sites-enabled/default +- entering group authorize {...} ++[preprocess] returns ok ++[chap] returns noop ++[mschap] returns noop ++[digest] returns noop [suffix] No '@' in User-Name = "test", looking up realm NULL [suffix] No such realm "NULL" ++[suffix] returns noop [eap] EAP packet type response id 1 length 9 [eap] No EAP Start, assuming it's an on-going EAP conversation ++[eap] returns updated [sql] expand: %{User-Name} -> test [sql] sql_set_user escaped user --> 'test' rlm_sql (sql): Reserving sql socket id: 0 [sql] expand: SELECT id, username, attribute, value, op FROM radcheck WHERE username = '%{SQL-User-Name}' ORDER BY id -> SELECT id, username, attribute, value, op FROM radcheck WHERE username = 'test' ORDER BY id [sql] User found in radcheck table [sql] expand: SELECT id, username, attribute, value, op FROM radreply WHERE username = '%{SQL-User-Name}' ORDER BY id -> SELECT id, username, attribute, value, op FROM radreply WHERE username = 'test' ORDER BY id [sql] expand: SELECT groupname FROM radusergroup WHERE username = '%{SQL-User-Name}' ORDER BY priority -> SELECT groupname FROM radusergroup WHERE username = 'test' ORDER BY priority rlm_sql (sql): Released sql socket id: 0 ++[sql] returns ok ++[expiration] returns noop ++[logintime] returns noop [pap] WARNING: Auth-Type already set. Not setting to PAP ++[pap] returns noop Found Auth-Type = EAP # Executing group from file /etc/freeradius/sites-enabled/default +- entering group authenticate {...} [eap] EAP Identity [eap] processing type tls [tls] Initiate [tls] Start returned 1 ++[eap] returns handled Sending Access-Challenge of id 11 to 81.82.213.157 port 2000 EAP-Message = 0x010200061920 Message-Authenticator = 0x00000000000000000000000000000000 State = 0xb43a5b16b438421b8325e3b40d9ef210 Finished request 4. Going to the next request Waking up in 4.9 seconds. Cleaning up request 4 ID 11 with timestamp +1293 WARNING: !!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!! WARNING: !! EAP session for state 0xb43a5b16b438421b did not finish! WARNING: !! Please read http://wiki.freeradius.org/Certificate_Compatibility WARNING: !!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!! Ready to process requests. So after doing some research I have deduced that this error implies the supplicant (which is a Windows machine) doesn't like the certificate the FreeRADIUS server is hurling its way and stops communicating. Now comes the odd part. I haven't even touched the certificates when installing FreeRADIUS on the server, and connecting wirelessly through a UniFi AP with the very same protocol on the very same supplicant machine works flawlessly. I have very likely made a misconfiguration on the Windows machine, I just haven't figured out where. I followed this guide for setting up the Ethernet connection: https://kb.meraki.com/knowledge_base/configuring-8021x-wired-authentication… In the Protected EAP Properties window, I unticked "Validate server certificate", like I did with the wireless connection. I will admit I knew little about RADIUS before starting this project, so it is very possible I've made some obvious mistakes. -- I find trial and error to be one of the best learning methods for me personally. :) Is there at all a way to get around this issue without messing with the certs? Please also do let me know what other output or logs you might need. Best regards, Sander Timmermans Compoint BVBA

2 1

Auto Authenticate
by Darren Ward (darrward) 10 Apr '15

10 Apr '15

Hey Guys I'm looking to do some automatic authentication so I can trigger the Authen status on some WiFi MAC-TAL services... I was wondering if I did something like: authenticate { if (User-Name =~ /^192.168.200.+/) { Whether it would be possible to send a access-accept back and how to configure? In this scenario the WiFi Gateway sends a Authen request to the RADIUS server with the DHCP assigned IP address as the user-name I just want to automatically say authenticated and return a couple of quote attributes for any client matching the subnet Darren

3 2

Freeradius + CoA + Mikrotik
by Leandro Melo - Netsul Telecom 10 Apr '15

10 Apr '15

Dear, Used as a form of client authentication in PPPoE, already use hotspot, but we are finalizing the hotspot migration to pppoe, so need to use the CoA feature to apply changes in the connections of my clients without disconnecting them from the equipment, and must do this using Freeradius + CoA. in places I could find something commenting on this situation, I was informed that PPPoE is not supported for this type of integration (CoA) and would like to confirm with you this news. Change the queues of active connections through the Radius using the CoA, you can not? I thank you and I'm waiting. Att,

2 1

sql - best practices
by Marcin 09 Apr '15

09 Apr '15

Hi, finally I've decided to use sql instead of flat files. there is in config "delete_stale_sessions = yes" from where radius know that is stale sessions? some other programs do I have to run? There is in documentation that to keep online sessions users in one table and history seesions in other table. How to achieve it from freeradius? -- Pozdrawiam Marcin / nicraM

7 16

freeradius disconnect user using accounting
by Leandro Melo - Netsul Telecom 08 Apr '15

08 Apr '15

dear, use FreeRADIUS Version 2.1.12 and mikrotik as hub, set up the interim update for 10 seconds (for testing) so that the radius can drop the connection when the time is reached. set up the / etc / raddb / sites-avaliable / default to accounting { detail unix radutmp sqlippool sql1 exec if ("% {Acct-Session-Time}"> 30) { reject } attr_filter.accounting_response } but the log returned by radius if he enters, but drops the connection, what command to derrumar the connection and return a "reply-message" to the hub? follows the log: ... [sql1] expand: UPDATE radacct SET FramedIPAddress = NULLIF('%{Framed-IP-Address}', '')::inet, AcctSessionTime = '%{Acct-Session-Time}', AcctInputOctets = (('%{%{Acct-Input-Gigawords}:-0}'::bigint << 32) + '%{%{Acct-Input-Octets}:-0}'::bigint), AcctOutputOctets = (('%{%{Acct-Output-Gigawords}:-0}'::bigint << 32) + '%{%{Acct-Output-Octets}:-0}'::bigint) WHERE AcctSessionId = '%{Acct-Session-Id}' AND UserName = '%{SQL-User-Name}' AND NASIPAddress= '%{NAS-IP-Address}' AND AcctStopTime IS NULL -> UPDATE radacct SET FramedIPAddress = NULLIF('192.168.95.101', '')::inet, AcctSessionTime = '1101', AcctInputOctets = (('0'::bigint << 32) + '211907'::bigint), AcctOutputOctets = (('0'::bigint << 32) + '407325'::bigint) WHERE AcctSessionId = '81c00012' AND UserName = 'teste1' AND NASIPAddress= '192.168.1.41' AND AcctStopTime IS NULL rlm_sql (sql1): Reserving sql socket id: 0 rlm_sql_postgresql: Status: PGRES_COMMAND_OK rlm_sql_postgresql: query affected rows = 1 rlm_sql (sql1): Released sql socket id: 0 ++[sql1] returns ok ++[exec] returns noop ++? if ("%{Acct-Session-Time}" > 30) expand: %{Acct-Session-Time} -> 1101 ? Evaluating ("%{Acct-Session-Time}" > 30) -> TRUE ++? if ("%{Acct-Session-Time}" > 30) -> TRUE ++- entering if ("%{Acct-Session-Time}" > 30) {...} +++- if ("%{Acct-Session-Time}" > 30) returns noop ++- group accounting returns noop [attr_filter.accounting_response] expand: %{User-Name} -> teste1 attr_filter: Matched entry DEFAULT at line 12 ++[attr_filter.accounting_response] returns updated Sending Accounting-Response of id 232 to 10.0.2.2 port 37115 Finished request 21. ... Att,

4 7

Custom Reject Replies in case customer doesn't have available balance
by Muhammad Usman 08 Apr '15

08 Apr '15

Hi, I want to send custom reply messages in case of Access reject, I have gone through the below link and updated the default file, by using sql{ notfound = 1 reject = 2 } if(notfound){ update reply { Reply-Message := "Login Failed. Please check your Username and Password" } ok = reject } if(reject){ update reply { Reply-Message := "Login Failed. Please check your Username and Password" } ok = reject } However, I didn't understand how these notfound and reject values are received and how can I add an extra here. My requirement is that in case if user doesn't have available resources in their account, FR should send reply-message informing customer to recharge account. Currently I am using SQL to authenticate user and SQL query only authenticates user if they have resources available in their account. *Case 1:* User: Usman Volume: 100MB Request: User-name = usman *FR Response: Access Accept* *Case 2:* User: Usman Volume: 100MB Request: User-name = random *FR Response: Access Reject * *Reply-Message: "you have entered incorrect credentials"* *Case 3:* User: Usman Volume: 0MB Request: User-name = usman *FR Response: Access Reject * *Reply-Message: "you donot have resources available"* http://grasehotspot.org/documentation/freeradius/meaningful-reply-message-f…

2 2

Conflicting Packet
by battossai 08 Apr '15

08 Apr '15

Hi All, I've seen a lot from the archive that this error : *Wed Apr 8 10:39:43 2015 : Error: Discarding duplicate request from client ZIGY port 52824 - ID: 197 due to unfinished request 1182* *Wed Apr 8 10:39:43 2015 : Error: Discarding conflicting packet from client ZIGY port 40402 - ID: 199 due to recent request 1184.* *Wed Apr 8 10:39:43 2015 : Error: Discarding conflicting packet from client ZIGY port 48586 - ID: 201 due to recent request 1186.* *Wed Apr 8 10:41:43 2015 : Error: Received conflicting packet from client ZIGY port 49888 - ID: 239 due to unfinished request 1226. Giving up on old request.* was cause by an slow database or slow machine. Can i have a clue how to trace it out, because i don't know which table shoud be lood regagrading ID or request number. Is it posibble what should i do about slow database, how we measure it. Thank you. Regards, Franky Yu

3 2

MAC Auth Bypass and LDAP
by Brendan Kearney 08 Apr '15

08 Apr '15

i have RADIUS authN and authZ using kerberos and ldap working in my environment. from here i want to add MAC Auth Bypass and finally full .1x when i get a CA up and running. i plan to have MAC Auth Bypass as an interim solution, and will leave it in place when full .1x is running as a fallback method. i would like to get dynamic vlan assignment configured too. with that said, i am not sure of a few things. i am running v3.0.3 on Fedora 20. i have found the wiki article for MAC Auth, but that is for v2.x and a lot has changed from v2 to v3. because i am looking to leverage ldap lookups for MAC Auth Bypass, the info in the wiki does not seem applicable. where do i start looking for info around MAC Auth Bypass and ldap? the ldap module does not have anything that i am able to see as appropriate. i would like to avoid using the files module, as the mac address info, etc is in my ldap already. once i get MAB working, i want to begin assigning the VLAN based on MAC class or address. is the MAC the right data point to make that determination? i see the desire to have full .1x use dynamic VLAN assignment, too, so i want to make sure the decisions are not counter to each other. i am ultimately looking to have full .1x, with MAC Auth Bypass as a fallback, and in either case (or both, if that could/should be) have the VLAN assigned based on the outcome of the auth (or auth bypass). my logic would be: if the device passes .1x, the device is assigned to VLAN_X. if the device fails .1x, the device is assigned to VLAN_Z. if the device cannot do .1x, and passes MAC Auth Bypass (i.e. the MAC is known and is in ldap), the device is assigned to VLAN_Y. if the device cannot do .1x and fails MAC Auth Bypass, the device is assigned to VLAN_Z. since full .1x is not going to be turned up right now, the last two pieces of the logic are what i am looking to pursue at this point. any pointers on where to start would be appreciated.

3 4

Re: 1. Cant read radius.log (Adam Schappell)
by Rui Ribeiro 06 Apr '15

06 Apr '15

Hi all, Adding the user freerad to www-data group won't probably help. Adding the user www-data to freerad group, which is probably what you wanted to suggest is also a terrible ideia from the security point of view. You would better play with the permissions of the directory, or add the user www-data to the adm group (also not the best of the ideas). Pick your devil. A better solution would probably be configure syslog to log also to another less secure directory and configure daloradius accordingly. Regards > Message: 1 > Date: Mon, 6 Apr 2015 00:34:14 +0530 > From: Vijay S <vijay.hcr(a)gmail.com> > To: FreeRadius users mailing list > <freeradius-users(a)lists.freeradius.org> > Subject: Re: 1. Cant read radius.log (Adam Schappell) > Message-ID: > < > CAPTJ3-dCKGJcCu5EDB-DrRDUJ3CCBXiMJMa59Xvwg1tvkj2LXw(a)mail.gmail.com> > Content-Type: text/plain; charset=UTF-8 > > Hi > Following command will help you add users in other group so that web server > service owner user can read radius logs. > > Usermod -a -G www-data freerad > > Above should work on debian based distro. Else you can find the user owner > of both web server and radius services and replace them in above command. > On Apr 4, 2015 6:11 PM, "Rui Ribeiro" <ruyrybeyro(a)gmail.com> wrote: > > > Hi Adam, > > > > You have already been told Daloradius may not be the most appropriate or > up > > to date interface to use. > > > > Permissions may not be fine, and they are not certainly fine in my debian > > for 3rd party tools to access that file. PHP/CGI processes are run under > > the www-data user in Debian, not freerad. > > > > Regards > > > > > > > > > Message: 1 > > > Date: Fri, 3 Apr 2015 12:25:04 -0400 > > > From: Adam Schappell <aschappell(a)clearedgeit.com> > > > To: FreeRadius users mailing list > > > <freeradius-users(a)lists.freeradius.org> > > > Subject: Cant read radius.log > > > Message-ID: > > > < > > > CAHoRX4Kj9u29QAUeL3_dxUmO_P6JVgunA+ybWcZd8KGUZrq_kQ(a)mail.gmail.com> > > > Content-Type: text/plain; charset=UTF-8 > > > > > > Hello, > > > > > > In dalo radius I get the error: error reading log file: > > > > > > looked for log file in '/var/log/freeradius/radius.log, > > > /usr/local/var/log/radius/radius.log, /var/log/radius/radius.log' but > > > couldn't find it. > > > if you know where your freeradius log file is located, set it's > location > > in > > > /daloradius/rep-logs-radius.php > > > > > > I go through the file system and can find it at > > /var/log/radius/radius.log. > > > Weird thing is that if I just keep pressing tab it wont pick it up. I > > have > > > to stop at the radius/ and type ll and it will come up. Permissions > seem > > > fine. Cant really figure out why. And in the > > > /daloradius/rep-logs-radius.php, there is no where to set a path. > > > > > > Thanks. > > > > > > > > > > > > > > > > -- > > Regards, > > > > -- > > Rui Ribeiro > > Senior Sysadm > > ISCTE-IUL > > https://www.linkedin.com/pub/rui-ribeiro/16/ab8/434 > > - > > List info/subscribe/unsubscribe? See > > http://www.freeradius.org/list/users.html > > -- Regards, -- Rui Ribeiro Senior Sysadm ISCTE-IUL https://www.linkedin.com/pub/rui-ribeiro/16/ab8/434

1 0