- Freeradius-Users - lists.freeradius.org

synchronize accounting
by Marcin 27 Mar '15

27 Mar '15

Hi, I'm testing freeradius 2.1 from debian stable. I'd like to set two independent serwer with the same configuration but the problem is with synchronize active sessions radutmp. I use simultaneous-use = 1. So if first server is broken client won't be able to authorise :/ How can I achieve synchronized two servers with active sessions? I don't want to using sql database to avoind problems with other servers, daemons. -- Pozdrawiam Marcin / nicraM

4 12

How to use rewrite.called_station_id IN dynamic clients authorize section
by James Wood 26 Mar '15

26 Mar '15

Hi, We use dynamic clients + sql for our authentication of NAS devices. We also use rlm_raw because we cannot auth on the IP Address (because of not knowing all the dynamic IP's clients are coming from), so we auth on the Called-Station-Id value. In normal circumstances this works beautifully, but when we have a NAS that sends the Called-Station-Id value as AABBCCDDEEFF with no colon or hyphen, auth fails, because in our SQL database we store the MAC like AA-BB-CC-DD-EE-FF. I already use SQL to replace colon with hyphen, but I am struggling with if it has no delimiter at all. For this particular NAS client, there is no way to change the format of the Called-Station-Id value it is sending so I need something on the FreeRadius side. I tried using the rewrite.called_station_id module from policy.conf and whilst it does not error it doesn't rewrite the incoming Called-Station-Id to the format I require. Here is my dynamic clients file: client dymamic { ... } server dynamic_client_server { authorize { #Test to see if our required raw attribute exists if("%{raw:Called-Station-Id}"){ rewrite.called_station_id #Test to see if it is in the DB if ("%{sql: select count(*) from nas where community=REPLACE(SUBSTRING(\"%{Called-Station-Id}\",1,17),\":\",\"-\")}" == 1) { update control { ... } ok } } } } I suspect it's a problem because we are using raw:Called-Station-Id because before auth Called-Station-Id itself is not accessible. Is it possible to just have a rewrite block in the authorize section of dynamic clients so it can rewrite the raw value there? Thank you, James

7 20

Help PLease
by Adam Schappell 26 Mar '15

26 Mar '15

I need some help getting my freeradius server up and running. For some reason all the tests pass but when I login to wifi I get invalid credentials. Im stuck! Thanks, Adam Schappell System Administrator II Clearedge IT Solutions, LLC 10620 Guilford Road Jessup, MD 20794 Office:443-212-4712 Fax:443-212-4809 www.ClearEdgeIT.com <http://www.clearedgeit.com/>

5 17

Performance Problems ntlm_auth <-> Active Directory under heavy load
by tom greisch 26 Mar '15

26 Mar '15

Hi together, Yesterday i have compiled Freeradius 2.2.6 and configured for ntlm_auth against an Active Directory. Everything seems ok. After testing i have redirected our WLAN Controller (with thousands of Clients) to the new Radius Server and the Server was overloaded immediately. (By the way our old Microsoft NPS Server had no Problem with the Load!). So i activated the Logging for Samba an i got this: ---------------------------------------------------- [2015/03/18 16:59:50.848834, 0] ../source3/lib/util.c:896(log_stack_trace) BACKTRACE: 21 stack frames: #0 /usr/lib/x86_64-linux-gnu/libsmbconf.so.0(log_stack_trace+0x1a) [0x7f60a79bb2ca] #1 /usr/lib/x86_64-linux-gnu/libsmbconf.so.0(smb_panic_s3+0x20) [0x7f60a79bb3b0] #2 /usr/lib/x86_64-linux-gnu/libsamba-util.so.0(smb_panic+0x2f) [0x7f60abce5caf] #3 /usr/lib/x86_64-linux-gnu/libsamba-util.so.0(+0x1cecf) [0x7f60abce5ecf] #4 /lib/x86_64-linux-gnu/libpthread.so.0(+0xf8d0) [0x7f60ac1158d0] #5 /usr/lib/x86_64-linux-gnu/samba/liblibcli_netlogon3.so.0(rpccli_netlogon_sam_network_logon+0x154) [0x7f60a99c52a4] #6 /usr/sbin/winbindd(+0x48fd3) [0x7f60ac58efd3] #7 /usr/sbin/winbindd(winbindd_dual_pam_auth_crap+0x2d8) [0x7f60ac592938] #8 /usr/sbin/winbindd(+0x5fd5c) [0x7f60ac5a5d5c] #9 /usr/lib/x86_64-linux-gnu/libtevent.so.0(+0x92cb) [0x7f60a5a162cb] #10 /usr/lib/x86_64-linux-gnu/libtevent.so.0(+0x7797) [0x7f60a5a14797] #11 /usr/lib/x86_64-linux-gnu/libtevent.so.0(_tevent_loop_once+0x8d) [0x7f60a5a10f9d] #12 /usr/sbin/winbindd(+0x620d8) [0x7f60ac5a80d8] #13 /usr/sbin/winbindd(+0x627d5) [0x7f60ac5a87d5] #14 /usr/lib/x86_64-linux-gnu/libtevent.so.0(tevent_common_loop_immediate+0xd4) [0x7f60a5a117c4] #15 /usr/lib/x86_64-linux-gnu/libtevent.so.0(+0x908e) [0x7f60a5a1608e] #16 /usr/lib/x86_64-linux-gnu/libtevent.so.0(+0x7797) [0x7f60a5a14797] #17 /usr/lib/x86_64-linux-gnu/libtevent.so.0(_tevent_loop_once+0x8d) [0x7f60a5a10f9d] #18 /usr/sbin/winbindd(main+0xad4) [0x7f60ac56b024] #19 /lib/x86_64-linux-gnu/libc.so.6(__libc_start_main+0xf5) [0x7f60a5685b45] #20 /usr/sbin/winbindd(+0x25699) [0x7f60ac56b699] [2015/03/18 16:59:50.853758, 0] ../source3/lib/util.c:797(smb_panic_s3) smb_panic(): calling panic action [/usr/share/samba/panic-action 4754] [2015/03/18 16:59:50.859870, 0] ../source3/lib/util.c:805(smb_panic_s3) smb_panic(): action returned status 0 [2015/03/18 16:59:50.860457, 0] ../source3/lib/dumpcore.c:317(dump_core) dumping core in /var/log/samba/cores/winbindd--------------------------------------------------------------------------------- At this Point its clear, that it is not a Freeradius Problem. Its a Samba Problem! I am lucky because i found a BUG Report at the Samba Site released onyl few Days ago (2015-03-10). The Problem persists for more than one Year. The BUG is: https://bugzilla.samba.org/show_bug.cgi?id=11149 The Bug Report says that you have to start Freeradius with the "-t" Option to disable Threads because Samba 4.1.X is not able to handle threads. So we have to hope that samba 4.2 will fix the Problem. Until that, i decided to clone the Radius Server twice , start with "-t" Flag and set a "Freeradius Loadbalancer" bevor the "Worker Radius Server". Now i can handle the Load ! I think more people will have the same Problem as me... So i decided to write here... System Info: ----------------------------- Debian 8 (Jessie) Samba version 4.1.17-Debian Freeradius Version 2.2.6 -----------------------------

6 9

Any precedence in proxy.conf?
by Stefan Paetow 26 Mar '15

26 Mar '15

Hi Alan et al, Just a quick question: Is there a precedence in realm lookups between dynamic and static realms? I'm happy to experiment, just thought I'd ask. Stefan Paetow Moonshot Industry & Research Liaison Coordinator t: +44 (0)1235 822 125 gpg: 0x3FCE5142 xmpp: stefanp(a)jabber.dev.ja.net skype: stefan.paetow.janet jisc.ac.uk Jisc is a registered charity (number 1149740) and a company limited by guarantee which is registered in England under Company No. 5747339, VAT No. GB 197 0632 86. Jisc¹s registered office is: One Castlepark, Tower Hill, Bristol, BS2 0JA. T 0203 697 5800. Jisc Collections and Janet Ltd. is a wholly owned Jisc subsidiary and a company limited by guarantee which is registered in England under Company No. number 2881024, VAT No. GB 197 0632 86. The registered office is: Lumen House, Library Avenue, Harwell, Didcot, Oxfordshire, OX11 0SG. T 01235 822200.

4 6

How to use reference instead of printing attribute
by Castel, Nicolas 26 Mar '15

26 Mar '15

Hi, We currently use 3.0.x version of freeRADIUS. I try to follow recommendations found in unlang man concerning use of attribute references. Extract from man: "We recommend using attribute references instead of printing attributes to a string, e.g. (User-Name == "%{Filter-Id}"). Attribute references will be faster and more efficient." It seems not to work correctly with my configuration. An example of debug which works with printing of attribute: (2) } # if ("%{proxy-reply:Packet-Type}" == "Access-Accept") = ok (2) if ("%{proxy-reply:Packet-Type}" == "Access-Challenge") { (2) EXPAND %{proxy-reply:Packet-Type} (2) --> Access-Accept (2) if ("%{proxy-reply:Packet-Type}" == "Access-Challenge") -> FALSE (2) } # post-proxy = ok Corresponding configuration: if ("%{proxy-reply:Packet-Type}" == "Access-Challenge") { The same example using reference which do not work: (2) } # if ("%{proxy-reply:Packet-Type}" == "Access-Accept") = ok (2) if (&proxy-reply:Packet-Type == "Access-Challenge") { (2) ERROR: Failed retrieving values required to evaluate condition (2) } # post-proxy = ok Corresponding configuration: if (&proxy-reply:Packet-Type == "Access-Challenge") { Another test using directly integer value (2) } # if ("%{proxy-reply:Packet-Type}" == "Access-Accept") = ok (2) if (&proxy-reply:Packet-Type == 11) { (2) ERROR: Failed retrieving values required to evaluate condition (2) } # post-proxy = ok Corresponding configuration: if (&proxy-reply:Packet-Type == 11) { Same thing using following configuration: (2) if (&proxy-reply:Packet-Type == Access-Challenge) { (2) ERROR: Failed retrieving values required to evaluate condition Is there some limitations using references ? Weird thing is that reference works with Auth-Type attribute used in another place in my configuration: (6) if (&control:Auth-Type == WIFI-GW-Auth) { (6) if (&control:Auth-Type == WIFI-GW-Auth) -> TRUE Corresponding configuration: if (&control:Auth-Type == WIFI-GW-Auth) { Thanks for help. Nicolas Castel This message contains information that may be privileged or confidential and is the property of the Capgemini Group. It is intended only for the person to whom it is addressed. If you are not the intended recipient, you are not authorized to read, print, retain, copy, disseminate, distribute, or use this message or any part thereof. If you receive this message in error, please notify the sender immediately and delete all copies of this message.

3 3

testing tools
by Marcin 25 Mar '15

25 Mar '15

Hi, what are the possibilities to test radius without proper equipment (switch)? I'd like to use freeradius for Dell switches to authorise (802.1x) clients with their mac. radtest can't send eap messages. Is there any programs to test it? -- Pozdrawiam Marcin / nicraM

5 9

rlm_python and threading
by Andrew Parisio 25 Mar '15

25 Mar '15

I'm working with rlm_python in FreeRadius 2.2.6 and with 20 simultaneous eapol_test threads running I was only getting 5-6 requests/second. This got me wondering how FreeRadius and rlm_python handle threading. So to make sure it wasn't related to my database calls or anything else I wrote a simple radiusd_module.py with no external dependencies/calls that instantly returned OK and it was handling 275 requests/second. Now I'm doubting my requests are being processed in parallel so I modified my radiusd_module.py to have a 1 second sleep between starting to process a request and returning OK. The module looks something like this: import radiusd import time def instantiate(p): # do something return 0 def array_to_dict(array): my_dict = {} for t in array: # strip any quotes off of the beginning & end my_dict[t[0]] = t[1].lstrip('"').rstrip('"') return my_dict def post_auth(p): my_dict = array_to_dict(p) print "***** Start %s" % my_dict['NAS-Port-Id'] time.sleep(1) print "***** End %s" % my_dict['NAS-Port-Id'] return radiusd.RLM_MODULE_OK Then I set two copies of eapol_test in an infinite loop sending NAS-Port-Id's of 1 and 2 so I could see what radius.log looked like. The hypothesis being if it's properly threaded I should get this: ***** Start 1 ***** Start 2 ==== Pause 1 second ***** End 1 ***** End 2 ... repeat I ran the the two eapol_test threads against radius and the output looks like this: tail radius.log -f | grep "\*\*\*\*\*" ***** Start 1 ==== Pause 1 second <-- not output, just a literal 1 second wait from time.sleep() ***** End 1 ***** Start 2 ==== Pause 1 second <-- not output, just a literal 1 second wait from time.sleep() ***** End 2 .... and so on, >From this I can see that requests handled by rlm_python are being served by a single thread rather than multiple/parallel threads. Does anybody have any experience with rlm_python.py and/or know what I might be doing wrong? Thanks! Andrew P.S. Latency from my development machine at my desk to Dynamodb in AWS is ~80ms, **which won't be the case for prod**, which is why I was only getting 5-6 requests/second. but I'd still like to be able to handle hundreds of requests/s per production host (obviously the hosts will need to be sized appropriately).

3 2

freeradius clients are only pingable
by mohammed farouk 25 Mar '15

25 Mar '15

Dear all, I am using freeradius on the server and i installed also a zoneminder, the cam's are getting auth by MAC and that works fine. no i am trying to let zm control the cams but it seems that it can't because some routing issue. i tried then to log to the server and http another ubuntu laptop and can't still open the page. what is the missing with me ? *Best regards,* *Mohammed Farouk*

1 0

Ldap check attribute
by Khapare Joshi 25 Mar '15

25 Mar '15

I have a ldapserver which has a objectClass = eduPerson in eduPersonPrimaryAffiliation we have staff and student I did the ldapsearch from the radius server command line as: ldapsearch -h ldapserver "dc=EXAMPLE,dc=COM" -x -s sub uid=tom eduPersonPrimaryAffiliation # extended LDIF # # LDAPv3 # base <dc=EXAMPLE,dc=COM> with scope subtree # filter: uid=tom # requesting: eduPersonPrimaryAffiliation # # tom, People, example.com dn: uid=tom,ou=People,dc=example,dc=com eduPersonPrimaryAffiliation: staff # search result search: 2 result: 0 Success # numResponses: 2 # numEntries: 1 [tom@radiusserver ~]# What I am trying to do is : if person (user)'s eduPersonPrimaryAffiliation=staff he/she can have 5 simultaneous connection else 1 simultaneous connection. I have configured ldap in /etc/raddb/modules/ldap so ldap bind is okay [ldap] performing user authorization for tom [ldap] expand: %{Stripped-User-Name} -> tom [ldap] expand: (uid=%{%{Stripped-User-Name}:-%{User-Name}}) -> (uid=tom) [ldap] expand: dc=EXAMPLE,dc=CIN -> dc=EXAMPLE,dc=COM [ldap] ldap_get_conn: Checking Id: 0 [ldap] ldap_get_conn: Got Id: 0 [ldap] attempting LDAP reconnection [ldap] (re)connect to ldapserver:389, authentication 0 [ldap] bind as cn=tom,ou=People,dc=EXAMPLE,dc=COM/KEYBOARD to ldapserver:389 [ldap] waiting for bind result ... [ldap] Bind was successful [ldap] performing search in dc=EXAMPLE,dc=COM, with filter (uid=tom) [ldap] looking for check items in directory... [ldap] looking for reply items in directory... WARNING: No "known good" password was found in LDAP. Are you sure that the user is configured correctly? [ldap] ldap_release_conn: Release Id: 0 ++[ldap] = ok Where do I add the ldapchcek for eduPersonPrimaryAffiliation: staff/student or the right way of doing ? K

1 1