- Freeradius-Users - lists.freeradius.org

1. Cant read radius.log (Adam Schappell)
by Rui Ribeiro 06 Apr '15

06 Apr '15

Hi Adam, You have already been told Daloradius may not be the most appropriate or up to date interface to use. Permissions may not be fine, and they are not certainly fine in my debian for 3rd party tools to access that file. PHP/CGI processes are run under the www-data user in Debian, not freerad. Regards > Message: 1 > Date: Fri, 3 Apr 2015 12:25:04 -0400 > From: Adam Schappell <aschappell(a)clearedgeit.com> > To: FreeRadius users mailing list > <freeradius-users(a)lists.freeradius.org> > Subject: Cant read radius.log > Message-ID: > < > CAHoRX4Kj9u29QAUeL3_dxUmO_P6JVgunA+ybWcZd8KGUZrq_kQ(a)mail.gmail.com> > Content-Type: text/plain; charset=UTF-8 > > Hello, > > In dalo radius I get the error: error reading log file: > > looked for log file in '/var/log/freeradius/radius.log, > /usr/local/var/log/radius/radius.log, /var/log/radius/radius.log' but > couldn't find it. > if you know where your freeradius log file is located, set it's location in > /daloradius/rep-logs-radius.php > > I go through the file system and can find it at /var/log/radius/radius.log. > Weird thing is that if I just keep pressing tab it wont pick it up. I have > to stop at the radius/ and type ll and it will come up. Permissions seem > fine. Cant really figure out why. And in the > /daloradius/rep-logs-radius.php, there is no where to set a path. > > Thanks. > > > > -- Regards, -- Rui Ribeiro Senior Sysadm ISCTE-IUL https://www.linkedin.com/pub/rui-ribeiro/16/ab8/434

4 4

Cant read radius.log
by Adam Schappell 03 Apr '15

03 Apr '15

Hello, In dalo radius I get the error: error reading log file: looked for log file in '/var/log/freeradius/radius.log, /usr/local/var/log/radius/radius.log, /var/log/radius/radius.log' but couldn't find it. if you know where your freeradius log file is located, set it's location in /daloradius/rep-logs-radius.php I go through the file system and can find it at /var/log/radius/radius.log. Weird thing is that if I just keep pressing tab it wont pick it up. I have to stop at the radius/ and type ll and it will come up. Permissions seem fine. Cant really figure out why. And in the /daloradius/rep-logs-radius.php, there is no where to set a path. Thanks.

1 0

Proxying between RADIUS servers using TLS
by Stefan Paetow 01 Apr '15

01 Apr '15

Hi, Since FR now supports TLS, how should I configure proxy.conf to specify that I want a specific realm to be handled over TLS (instead of the default UDP)? I can't find anything in the online docs (am happy to submit patches to improve this in 3.0.8 and later once I've tested that here). Alan(x2)? Arran? Any ideas? Stefan Paetow Moonshot Industry & Research Liaison Coordinator t: +44 (0)1235 822 125 gpg: 0x3FCE5142 xmpp: stefanp(a)jabber.dev.ja.net skype: stefan.paetow.janet jisc.ac.uk Jisc is a registered charity (number 1149740) and a company limited by guarantee which is registered in England under Company No. 5747339, VAT No. GB 197 0632 86. Jisc¹s registered office is: One Castlepark, Tower Hill, Bristol, BS2 0JA. T 0203 697 5800. Jisc Collections and Janet Ltd. is a wholly owned Jisc subsidiary and a company limited by guarantee which is registered in England under Company No. number 2881024, VAT No. GB 197 0632 86. The registered office is: Lumen House, Library Avenue, Harwell, Didcot, Oxfordshire, OX11 0SG. T 01235 822200.

4 15

which attribute identifies the client?
by Stefano Zanmarchi 01 Apr '15

01 Apr '15

Hallo, I can see in the logs the "client" calling my radius, e.g: Wed Apr 1 13:28:06 2015 : Auth: Login OK: [jsmith(a)unipd.it] (from client radius_garr_1 port 0 cli e4-d5-3d-b2-29-ca) Wed Apr 1 13:28:07 2015 : Auth: Login OK: [anonymous(a)rug.nl] (from client economia.unipd.it port 3 cli 94-eb-cd-6d-e0-ad) which is the attribute containing the "client" (radius_garr_1, economia.unipd.it,...)? I'd like to use it in the %{...} form to perform some filtering in the authorize section of inner-tunnel file. Thanks a lot, Stefano

2 1

FR 3.0.8 sql
by Marcin 01 Apr '15

01 Apr '15

Hi, #v+ if (Framed-Protocol == "PPP") { linelog sql_last_online if (fail){ ok } } #v- #v+ (2) # Executing section accounting from file /etc/freeradius/sites-enabled/default (2) accounting { (2) detail: EXPAND /var/log/freeradius/radacct/%{%{Packet-Src-IP-Address}:-%{Packet-Src-IPv6-Address}}/detail-%Y%m%d (2) detail: --> /var/log/freeradius/radacct/172.21.7.176/detail-20150401 (2) detail: /var/log/freeradius/radacct/%{%{Packet-Src-IP-Address}:-%{Packet-Src-IPv6-Address}}/detail-%Y%m%d expands to /var/log/freeradius/radacct/172.21.7.176/detail-20150401 (2) detail: EXPAND %t (2) detail: --> Wed Apr 1 10:07:35 2015 (2) [detail] = ok (2) [unix] = ok (2) radutmp: EXPAND /var/log/freeradius/radutmp (2) radutmp: --> /var/log/freeradius/radutmp (2) radutmp: EXPAND %{User-Name} (2) radutmp: --> bobpppoe (2) [radutmp] = ok (2) if (Framed-Protocol == "PPP") { (2) if (Framed-Protocol == "PPP") -> TRUE (2) if (Framed-Protocol == "PPP") { (2) linelog: EXPAND Accounting-Request.%{%{Acct-Status-Type}:-unknown} (2) linelog: --> Accounting-Request.Start (2) linelog: EXPAND /var/log/freeradius/linelog (2) linelog: --> /var/log/freeradius/linelog (2) linelog: EXPAND %T|C|%{Acct-Unique-Session-ID}|%{Framed-IP-Address}|%{Calling-Station-Id}|%{NAS-IP-Address}|%{NAS-Identifier} (2) linelog: --> 2015-04-01-10.07.35.000000|C|2df2a8590df82d3c84648b7a1b17d357|10.5.4.3|08:00:27:D6:04:2D|172.21.7.176|TestowyMT (2) [linelog] = ok (2) sql_last_online: EXPAND %{tolower:type.%{Acct-Status-Type}.query} (2) sql_last_online: --> type.start.query (2) sql_last_online: Using query template 'query' rlm_sql (sql_last_online): 0 of 0 connections in use. You may need to increase "spare" rlm_sql (sql_last_online): Opening additional connection (0), 1 of 10 pending slots used rlm_sql_mysql: Starting connect to MySQL server rlm_sql_mysql: Couldn't connect to MySQL server myDB@127.0.0.1:myDB rlm_sql_mysql: MySQL error: Can't connect to MySQL server on '127.0.0.1' (111) rlm_sql_mysql: Socket destructor called, closing socket rlm_sql (sql_last_online): Opening connection failed (0) (2) [sql_last_online] = fail (2) } # if (Framed-Protocol == "PPP") = fail (2) } # accounting = fail (2) Not sending reply to client. (2) Finished request #v- and another reqest is sending by nas. How to configure, that if sql_last_olnie module can't connect to database, then still is 'ok' and generally accounting section reply ok?

1 1

Dynamic vlan with ldap group fail
by Sautron Nick 01 Apr '15

01 Apr '15

Hello everyone, I have a problem concerning the dynamic assignment of VLAN according to ldap groups. Here is my shemas ldap: dc = company, dc = com ou = eduroam ou = groups cn = service cn = personal cn = student cn = users my users files : DEFAULT Ldap-Group == "service" Service-Type = Framed-User, Tunnel-Type = VLAN, Tunnel-Medium-Type = IEEE-802, Tunnel-Private-Group-ID = 5 DEFAULT Ldap-Group == "personnal" Service-Type = Framed-User, Tunnel-Type = VLAN, Tunnel-Medium-Type = IEEE-802, Tunnel-Private-Group-ID = 6 DEFAULT Ldap-Group == "student" Service-Type = Framed-User, Tunnel-Type = VLAN, Tunnel-Medium-Type = IEEE-802, Tunnel-Private-Group-ID = 7 DEFAULT Ldap-Group == "users" Service-Type = Framed-User, Tunnel-Type = VLAN, Tunnel-Medium-Type = IEEE-802, Tunnel-Private-Group-ID = 8 modules/ldap files : ldap { # # Note that this needs to match the name in the LDAP # server certificate, if you're using ldaps. server = "********" identity = "cn=admin,ou=eduroam,dc=company,dc=fr" password = ****** basedn = "ou=People,dc=company,dc=fr" filter = "(&(Login=%{%{Stripped-User-Name}:-%{User-Name}})(dialupAccess=true))" base_filter = "(objectclass=radiusprofile)" # How many connections to keep open to the LDAP server. # This saves time over opening a new LDAP socket for # every authentication request. ldap_connections_number = 5 # seconds to wait for LDAP query to finish. default: 20 timeout = 4 # seconds LDAP server has to process the query (server-side # time limit). default: 20 ............ # # Group membership checking. Disabled by default. # groupname_attribute = cn groupmembership_filter = "(&(Login=%{%{Stripped-User-Name}:-%{User-Name}})(isMemberOf=ou=groups,ou=eduroam,dc=company,dc=fr))" #groupmembership_attribute = radiusGroupName freeradius -X extract ..... [ldap] Entering ldap_groupcmp() [files] expand: ou=People,dc=****,dc=fr -> ou=People,dc=*****,dc=fr [files] expand: %{Stripped-User-Name} -> [files] ... expanding second conditional [files] expand: %{User-Name} -> ***** [files] expand: (&(Login=%{%{Stripped-User-Name}:-%{User-Name}})(dialupAccess=true)) -> (&(Login=******)(dialupAccess=true)) [ldap] ldap_get_conn: Checking Id: 0 [ldap] ldap_get_conn: Got Id: 0 [ldap] performing search in ou=People,dc=*******,dc=fr, with filter (&(Login=*****)(dialupAccess=true)) [ldap] ldap_release_conn: Release Id: 0 [files] expand: %{Stripped-User-Name} -> [files] ... expanding second conditional [files] expand: %{User-Name} -> ****** [files] expand: (&(Login=%{%{Stripped-User-Name}:-%{User-Name}})(isMemberOf=ou=groups,ou=eduroam,dc=*****,dc=fr)) -> (&(Login=******)(isMemberOf=ou=groups,ou=eduroam,dc=******,dc=fr)) [ldap] ldap_get_conn: Checking Id: 0 [ldap] ldap_get_conn: Got Id: 0 [ldap] performing search in ou=People,dc=*****,dc=fr, with filter (&(cn=service)(&(Login=*****)(isMemberOf=ou=groups,ou=eduroam,dc=*****,dc=fr))) [ldap] object not found [ldap] ldap_release_conn: Release Id: 0 rlm_ldap::ldap_groupcmp: Group service not found or user is not a member. [ldap] Entering ldap_groupcmp() [files] expand: ou=People,dc=******,dc=fr -> ou=People,dc=****,dc=fr [files] expand: %{Stripped-User-Name} -> [files] ... expanding second conditional [files] expand: %{User-Name} -> ***** [files] expand: (&(Login=%{%{Stripped-User-Name}:-%{User-Name}})(isMemberOf=ou=groups,ou=eduroam,dc=*******,dc=fr)) -> (&(Login=*******)(isMemberOf=ou=groups,ou=eduroam,dc=*****,dc=fr)) [ldap] ldap_get_conn: Checking Id: 0 [ldap] ldap_get_conn: Got Id: 0 [ldap] performing search in ou=People,dc=*****,dc=fr, with filter (&(cn=personnal)(&(Login=*******)(isMemberOf=ou=groups,ou=eduroam,dc=******,dc=fr))) [ldap] object not found [ldap] ldap_release_conn: Release Id: 0 rlm_ldap::ldap_groupcmp: Group personnal not found or user is not a member. [ldap] Entering ldap_groupcmp() [files] expand: ou=People,dc=******,dc=fr -> ou=People,dc=*****,dc=fr [files] expand: %{Stripped-User-Name} -> [files] ... expanding second conditional [files] expand: %{User-Name} -> ***** [files] expand: (&(Login=%{%{Stripped-User-Name}:-%{User-Name}})(isMemberOf=ou=groups,ou=eduroam,dc=*******,dc=fr)) -> (&(Login=*****)(isMemberOf=ou=groups,ou=eduroam,dc=*******,dc=fr)) [ldap] ldap_get_conn: Checking Id: 0 [ldap] ldap_get_conn: Got Id: 0 [ldap] performing search in ou=People,dc=****,dc=fr, with filter (&(cn=student)(&(Login=*****)(isMemberOf=ou=groups,ou=eduroam,dc=****,dc=fr))) [ldap] object not found [ldap] ldap_release_conn: Release Id: 0 rlm_ldap::ldap_groupcmp: Group student not found or user is not a member. [ldap] Entering ldap_groupcmp() [files] expand: ou=People,dc=******,dc=fr -> ou=People,dc=****,dc=fr [files] expand: %{Stripped-User-Name} -> [files] ... expanding second conditional [files] expand: %{User-Name} -> ******* [files] expand: (&(Login=%{%{Stripped-User-Name}:-%{User-Name}})(isMemberOf=ou=groups,ou=eduroam,dc=*****,dc=fr)) -> (&(Login=****)(isMemberOf=ou=groups,ou=eduroam,dc=*****,dc=fr)) [ldap] ldap_get_conn: Checking Id: 0 [ldap] ldap_get_conn: Got Id: 0 [ldap] performing search in ou=People,dc=*******,dc=fr, with filter (&(cn=users)(&(Login=******)(isMemberOf=ou=groups,ou=eduroam,dc=*****,dc=fr))) [ldap] object not found [ldap] ldap_release_conn: Release Id: 0 rlm_ldap::ldap_groupcmp: Group users not found or user is not a member. ++[files] returns noop [ldap] performing user authorization for ******* [ldap] expand: %{Stripped-User-Name} -> [ldap] ... expanding second conditional [ldap] expand: %{User-Name} -> ***** [ldap] expand: (&(Login=%{%{Stripped-User-Name}:-%{User-Name}})(dialupAccess=true)) -> (&(Login=****)(dialupAccess=true)) [ldap] expand: ou=People,dc=******,dc=fr -> ou=People,dc=****,dc=fr [ldap] ldap_get_conn: Checking Id: 0 [ldap] ldap_get_conn: Got Id: 0 [ldap] performing search in ou=People,dc=******,dc=fr, with filter (&(Login=*****)(dialupAccess=true)) .......... Someone can explain to me, why the freeradius server can not find the groups? Is this the right configuration? Best regards

2 3

Re: Freeradius-Users Digest, Vol 120, Issue 1
by Rui Ribeiro 01 Apr '15

01 Apr '15

Hi Adam, Daloradius is not maintained since 2012, and only supports FR 2.x. Configure MySQL, accounting in FR, and also your APs/controller to send accounting data. I have written some basic python scripts, and tested elastic search. Our federation has done a fantastic job with elastic search too. Regards > Message: 1 > Date: Tue, 31 Mar 2015 15:24:55 -0400 > From: Adam Schappell <aschappell(a)clearedgeit.com> > To: FreeRadius users mailing list > <freeradius-users(a)lists.freeradius.org> > Subject: integrating daloradius > Message-ID: > <CAHoRX4K1rKAoTTvs5upkmON24RwJxVaO5LXt8ej-qL= > zys7N3g(a)mail.gmail.com> > Content-Type: text/plain; charset=UTF-8 > > Hello, > > Has anyone been successful with integrating freeradius with daloradius? I > have freeradius running and can get to the web interface for daloradius but > do not know how to get the users that are on the wifi to show up? Also is > there any way to import users from AD (since im using MS AD for > authentication). Thanks! > > > -- Regards, -- Rui Ribeiro Senior Sysadm ISCTE-IUL https://www.linkedin.com/pub/rui-ribeiro/16/ab8/434

1 0

Re: Help PLease
by Matthew Newton 31 Mar '15

31 Mar '15

Hi, Please keep replies on-list. On Thu, Mar 26, 2015 at 03:38:51PM +0000, aschappell(a)clearedgeit.com wrote: > What do I test the authentication with besides the local host? I > am new to this radius thing. When I go to login to wifi I do not > see anything in the debug output that is showing someone is > logging in. OK, so you need to make sure that your access point / wireless controllers are configured correctly and have access to your RADIUS server. You have a number of clients added in clients.conf - have you added the actual client (AP) that you are testing from? Is there a firewall in the way or iptables on the server? Start by running tcpdump on the server to make sure that the packets are actually reaching the RADIUS server. If they aren't, and there are no firewalls, then make sure your AP/wireless system is configured correctly. Matthew -- Matthew Newton, Ph.D. <mcn4(a)le.ac.uk> Systems Specialist, Infrastructure Services, I.T. Services, University of Leicester, Leicester LE1 7RH, United Kingdom For IT help contact helpdesk extn. 2253, <ithelp(a)le.ac.uk>

7 52

Ready for 2.2.7?
by Alan DeKok 31 Mar '15

31 Mar '15

Any objections? I think we're pretty much OK. I also think that after 2.2.7, we will EOL the version 2 series. This means that security fixes will be added, but we will no longer be having regular releases. Now that 3.0 is available, we recommend that new deployments use that, instead of version 2. Alan DeKok.

6 25

integrating daloradius
by Adam Schappell 31 Mar '15

31 Mar '15

Hello, Has anyone been successful with integrating freeradius with daloradius? I have freeradius running and can get to the web interface for daloradius but do not know how to get the users that are on the wifi to show up? Also is there any way to import users from AD (since im using MS AD for authentication). Thanks!

2 1