- Freeradius-Users - lists.freeradius.org

Strange behavior of files module in post-auth
by Stabla, Daniel 27 Feb '15

27 Feb '15

Hi, we try to send VLAN-Attributes after a sucessfull authentication to our clients. A file "rad-vlan" contains the MAC-Address, as search key, and various other attributes which we want to assign. "rad-vlan" is processed through the module files in the section post-auth and does nothing. Only if we execute it with rad-vlan.authorize, it is successfully processed. Without ".authorize": Configuration ############################ server eap_server { listen { ipaddr = * port = 1645 type = auth limit { } } authorize { eap { ok = return } files expiration logintime } authenticate { Auth-Type PAP { } Auth-Type CHAP { } Auth-Type MS-CHAP { } eap Auth-Type eap { eap { handled = 1 } if (handled && (Response-Packet-Type == Access-Challenge)) { } } } preacct { preprocess acct_unique files } accounting { detail exec } session { } post-auth { if ("%{request:User-Name}" =~ /^(.*)\\\\(.*)/) { update request { Stripped-User-Name := "%{2}" Realm := "%{1}" } } update reply { Tunnel-Type := "13" Tunnel-Medium-Type := "6" } rad-vlan <---------------------------------------------------- update reply { Tunnel-Private-Group-Id="%{control:Tunnel-Private-Group-Id}" } Post-Auth-Type REJECT { eap } } pre-proxy { } post-proxy { eap } } Debugoutput #################################################### (14) } # authenticate = ok (14) Login OK: [materna\\ldapsearch/<via Auth-Type = EAP>] (from client sles11 port 0 cli 12-34-56-78-90-AB) (14) # Executing section post-auth from file /etc/radiusd/sites-enabled/default (14) post-auth { (14) if ("%{request:User-Name}" =~ /^(.*)\\\\(.*)/) (14) EXPAND %{request:User-Name} (14) --> materna\\ldapsearch (14) if ("%{request:User-Name}" =~ /^(.*)\\\\(.*)/) -> TRUE (14) if ("%{request:User-Name}" =~ /^(.*)\\\\(.*)/) { (14) update request { (14) EXPAND %{2} (14) --> ldapsearch (14) Stripped-User-Name := "ldapsearch" (14) EXPAND %{1} (14) --> materna\ (14) Realm := "materna\\" (14) } # update request = noop (14) } # if ("%{request:User-Name}" =~ /^(.*)\\\\(.*)/) = noop (14) update reply { (14) Tunnel-Type := VLAN (14) Tunnel-Medium-Type := IEEE-802 (14) } # update reply = noop (14) rad-vlan : EXPAND %{Calling-Station-Id} <---------------------------------------------------- (14) rad-vlan : --> 12-34-56-78-90-AB <---------------------------------------------------- (14) [rad-vlan] = noop (14) update reply { (14) EXPAND %{control:Tunnel-Private-Group-Id} (14) --> (14) Tunnel-Private-Group-Id = "" (14) } # update reply = noop (14) } # post-auth = noop With ".authorize": Configuration ############################################################################# server eap_server { listen { ipaddr = * port = 1645 type = auth limit { } } authorize { eap { ok = return } files expiration logintime } authenticate { Auth-Type PAP { } Auth-Type CHAP { } Auth-Type MS-CHAP { } eap Auth-Type eap { eap { handled = 1 } if (handled && (Response-Packet-Type == Access-Challenge)) { } } } preacct { preprocess acct_unique files } accounting { detail exec } session { } post-auth { if ("%{request:User-Name}" =~ /^(.*)\\\\(.*)/) { update request { Stripped-User-Name := "%{2}" Realm := "%{1}" } } update reply { Tunnel-Type := "13" Tunnel-Medium-Type := "6" } rad-vlan.authorize <---------------------------------------------------- update reply { Tunnel-Private-Group-Id="%{control:Tunnel-Private-Group-Id}" } Post-Auth-Type REJECT { eap } } pre-proxy { } post-proxy { eap } } Debugoutput ################################################################# (14) } # authenticate = ok (14) Login OK: [materna\\ldapsearch/<via Auth-Type = EAP>] (from client sles11 port 0 cli 12-34-56-78-90-AB) (14) # Executing section post-auth from file /etc/radiusd/sites-enabled/default (14) post-auth { (14) if ("%{request:User-Name}" =~ /^(.*)\\\\(.*)/) (14) EXPAND %{request:User-Name} (14) --> materna\\ldapsearch (14) if ("%{request:User-Name}" =~ /^(.*)\\\\(.*)/) -> TRUE (14) if ("%{request:User-Name}" =~ /^(.*)\\\\(.*)/) { (14) update request { (14) EXPAND %{2} (14) --> ldapsearch (14) Stripped-User-Name := "ldapsearch" (14) EXPAND %{1} (14) --> materna\ (14) Realm := "materna\\" (14) } # update request = noop (14) } # if ("%{request:User-Name}" =~ /^(.*)\\\\(.*)/) = noop (14) update reply { (14) Tunnel-Type := VLAN (14) Tunnel-Medium-Type := IEEE-802 (14) } # update reply = noop (14) rad-vlan : EXPAND %{Calling-Station-Id} (14) rad-vlan : --> 12-34-56-78-90-AB (14) rad-vlan : users: Matched entry 12-34-56-78-90-AB at line 1 (14) [rad-vlan.authorize] = ok (14) update reply { (14) EXPAND %{control:Tunnel-Private-Group-Id} (14) --> 200 (14) Tunnel-Private-Group-Id = "200" (14) } # update reply = noop (14) } # post-auth = ok

2 1

Re: Problem with config sql 3.0.7
by Kostas 26 Feb '15

26 Feb '15

Thanks for your immediate help, Alan! --- This email has been checked for viruses by Avast antivirus software. http://www.avast.com

1 0

Re: Problem with config sql 3.0.7
by Haviaras Kostas 26 Feb '15

26 Feb '15

I add in the instatiation section in the radiusd.conf like you said: sql sqlcounter And I am getting the same error!

2 1

dhcp INFORM flooding
by amindomao 26 Feb '15

26 Feb '15

Goog day again :) According to draft-ietf-dhc-dhcpinform-clarify-06 the reply to the DHCP Inform request should be ACK to the ciaddr if it present, even if there is a giaddr or other addr's. FR 3.0.7 is repliing to giaddr whatever I'm doing... (27) Received code 1032 Id -1241645939 from 10.133.242.246:68 to 10.133.200.150:67 length 320 (27) DHCP-Opcode = Client-Message (27) DHCP-Hardware-Type = Ethernet (27) DHCP-Hardware-Address-Length = 6 (27) DHCP-Hop-Count = 1 (27) DHCP-Transaction-Id = 3053321357 (27) DHCP-Number-of-Seconds = 768 (27) DHCP-Flags = 0 (27) DHCP-Client-IP-Address = 10.133.44.151 (27) DHCP-Your-IP-Address = 0.0.0.0 (27) DHCP-Server-IP-Address = 0.0.0.0 (27) DHCP-Gateway-IP-Address = 10.133.242.246 (27) DHCP-Client-Hardware-Address = 98:4b:e1:b5:b1:b4 (27) DHCP-Message-Type += DHCP-Inform (27) DHCP-Client-Identifier += 0x01984be1b5b1b4 (27) DHCP-Hostname += '\213\245\340\240-\217\212' (27) DHCP-Vendor-Class-Identifier += 0x4d53465420352e30 (27) DHCP-Parameter-Request-List += DHCP-Subnet-Mask (27) DHCP-Parameter-Request-List += DHCP-Domain-Name (27) DHCP-Parameter-Request-List += DHCP-Router-Address (27) DHCP-Parameter-Request-List += DHCP-Domain-Name-Server (27) DHCP-Parameter-Request-List += DHCP-NETBIOS-Name-Servers (27) DHCP-Parameter-Request-List += DHCP-NETBIOS-Node-Type (27) DHCP-Parameter-Request-List += DHCP-NETBIOS (27) DHCP-Parameter-Request-List += DHCP-Perform-Router-Discovery (27) DHCP-Parameter-Request-List += DHCP-Static-Routes (27) DHCP-Parameter-Request-List += DHCP-Classless-Static-Route (27) DHCP-Parameter-Request-List += DHCP-Site-specific-25 (27) DHCP-Parameter-Request-List += DHCP-Vendor (27) DHCP-Parameter-Request-List += DHCP-Site-specific-28 (27) DHCP-Relay-Agent-Information += 0x010600040066010b020800067072cf1c79e7 Trying sub-section dhcp DHCP-Inform {...} (27) dhcp DHCP-Inform { (27) update reply { (27) Packet-Dst-Port = 67 (27) DHCP-Message-Type = DHCP-Ack (27) EXPAND %{Packet-Dst-IP-Address} (27) --> 10.133.200.150 (27) DHCP-DHCP-Server-Identifier = 10.133.200.150 (27) DHCP-Site-specific-28 = 0x0a (27) } # update reply = noop (27) [ok] = ok (27) } # dhcp DHCP-Inform = ok (27) DHCP: Reply will be unicast to giaddr from original packet DHCP-Opcode = Server-Message DHCP-Hardware-Type = Ethernet DHCP-Hardware-Address-Length = 6 DHCP-Hop-Count = 1 DHCP-Transaction-Id = 3053321357 DHCP-Number-of-Seconds = 0 DHCP-Flags = 0 DHCP-Client-IP-Address = 10.133.44.151 DHCP-Your-IP-Address = 0.0.0.0 DHCP-Server-IP-Address = 0.0.0.0 DHCP-Gateway-IP-Address = 10.133.242.246 DHCP-Client-Hardware-Address = 98:4b:e1:b5:b1:b4 DHCP-Server-Host-Name = '' DHCP-Boot-Filename = '' DHCP-DHCP-Server-Identifier = 10.133.200.150 DHCP-Site-specific-28 = 0x0a Sending DHCP-Ack Id b5fdfc8d from 10.133.200.150:67 to 10.133.242.246:68 (27) Sent code 1029 Id -1241645939 from 10.133.200.150:67 to 10.133.242.246:68 length 300 (27) DHCP-Message-Type = DHCP-Ack (27) DHCP-DHCP-Server-Identifier = 10.133.200.150 (27) DHCP-Site-specific-28 = 0x0a (27) DHCP-Opcode = Server-Message (27) DHCP-Hardware-Type = Ethernet (27) DHCP-Hardware-Address-Length = 6 (27) DHCP-Hop-Count = 1 (27) DHCP-Transaction-Id = 3053321357 (27) DHCP-Flags = 0 (27) DHCP-Client-IP-Address = 10.133.44.151 (27) DHCP-Gateway-IP-Address = 10.133.242.246 (27) DHCP-Client-Hardware-Address = 98:4b:e1:b5:b1:b4 (27) DHCP-Relay-IP-Address = 10.133.242.246 (27) Finished request

4 7

FR 3.0.7, wrong dhcp relay reply port again
by amindomao 26 Feb '15

26 Feb '15

Good day! I've just updateted my FR from 2.1.5 to the latest version and this happened again :( (19) Received code 1027 Id 797242177 from 10.133.71.1:68 to 10.133.200.150:67 length 359 (19) DHCP-Opcode = Client-Message (19) DHCP-Hardware-Type = Ethernet (19) DHCP-Hardware-Address-Length = 6 (19) DHCP-Hop-Count = 1 (19) DHCP-Transaction-Id = 797242177 (19) DHCP-Number-of-Seconds = 0 (19) DHCP-Flags = 0 (19) DHCP-Client-IP-Address = 0.0.0.0 (19) DHCP-Your-IP-Address = 0.0.0.0 (19) DHCP-Server-IP-Address = 0.0.0.0 (19) DHCP-Gateway-IP-Address = 10.133.71.1 (19) DHCP-Client-Hardware-Address = 00:e0:4c:03:d4:c0 (19) DHCP-Message-Type += DHCP-Request (19) DHCP-Client-Identifier += 0x0100e04c03d4c0 (19) DHCP-Requested-IP-Address += 10.133.196.26 (19) DHCP-DHCP-Server-Identifier += 10.133.252.253 (19) DHCP-Hostname += 'microsof-2ac3da' (19) DHCP-Client-FQDN += '\000\000\000microsof-2ac3da.' (19) DHCP-Vendor-Class-Identifier += 0x4d53465420352e30 (19) DHCP-Parameter-Request-List += DHCP-Subnet-Mask (19) DHCP-Parameter-Request-List += DHCP-Domain-Name (19) DHCP-Parameter-Request-List += DHCP-Router-Address (19) DHCP-Parameter-Request-List += DHCP-Domain-Name-Server (19) DHCP-Parameter-Request-List += DHCP-NETBIOS-Name-Servers (19) DHCP-Parameter-Request-List += DHCP-NETBIOS-Node-Type (19) DHCP-Parameter-Request-List += DHCP-NETBIOS (19) DHCP-Parameter-Request-List += DHCP-Perform-Router-Discovery (19) DHCP-Parameter-Request-List += DHCP-Static-Routes (19) DHCP-Parameter-Request-List += DHCP-Site-specific-25 (19) DHCP-Parameter-Request-List += DHCP-Vendor (19) DHCP-Vendor += 0xdc0100 (19) DHCP-Relay-Agent-Information += 0x01060004008d001202080006fcfaf74445a3090600044d64616e Trying sub-section dhcp DHCP-Request {...} (19) dhcp DHCP-Request { (19) perl: $RAD_REQUEST{'DHCP-Opcode'} = &request:DHCP-Opcode -> 'Client-Message' (19) perl: $RAD_REQUEST{'DHCP-Hardware-Type'} = &request:DHCP-Hardware-Type -> 'Ethernet' (19) perl: $RAD_REQUEST{'DHCP-Hardware-Address-Length'} = &request:DHCP-Hardware-Address-Length -> '6' (19) perl: $RAD_REQUEST{'DHCP-Hop-Count'} = &request:DHCP-Hop-Count -> '1' (19) perl: $RAD_REQUEST{'DHCP-Transaction-Id'} = &request:DHCP-Transaction-Id -> '797242177' (19) perl: $RAD_REQUEST{'DHCP-Number-of-Seconds'} = &request:DHCP-Number-of-Seconds -> '0' (19) perl: $RAD_REQUEST{'DHCP-Flags'} = &request:DHCP-Flags -> '0' (19) perl: $RAD_REQUEST{'DHCP-Client-IP-Address'} = &request:DHCP-Client-IP-Address -> '0.0.0.0' (19) perl: $RAD_REQUEST{'DHCP-Your-IP-Address'} = &request:DHCP-Your-IP-Address -> '0.0.0.0' (19) perl: $RAD_REQUEST{'DHCP-Server-IP-Address'} = &request:DHCP-Server-IP-Address -> '0.0.0.0' (19) perl: $RAD_REQUEST{'DHCP-Gateway-IP-Address'} = &request:DHCP-Gateway-IP-Address -> '10.133.71.1' (19) perl: $RAD_REQUEST{'DHCP-Client-Hardware-Address'} = &request:DHCP-Client-Hardware-Address -> '00:e0:4c:03:d4:c0' (19) perl: $RAD_REQUEST{'DHCP-Hostname'} = &request:DHCP-Hostname -> 'microsof-2ac3da' (19) perl: $RAD_REQUEST{'DHCP-Vendor'} = &request:DHCP-Vendor -> '0xdc0100' (19) perl: $RAD_REQUEST{'DHCP-Requested-IP-Address'} = &request:DHCP-Requested-IP-Address -> '10.133.196.26' (19) perl: $RAD_REQUEST{'DHCP-Message-Type'} = &request:DHCP-Message-Type -> 'DHCP-Request' (19) perl: $RAD_REQUEST{'DHCP-DHCP-Server-Identifier'} = &request:DHCP-DHCP-Server-Identifier -> '10.133.252.253' (19) perl: $RAD_REQUEST{'DHCP-Parameter-Request-List'}[0] = &request:DHCP-Parameter-Request-List -> 'DHCP-Subnet-Mask' (19) perl: $RAD_REQUEST{'DHCP-Parameter-Request-List'}[1] = &request:DHCP-Parameter-Request-List -> 'DHCP-Domain-Name' (19) perl: $RAD_REQUEST{'DHCP-Parameter-Request-List'}[2] = &request:DHCP-Parameter-Request-List -> 'DHCP-Router-Address' (19) perl: $RAD_REQUEST{'DHCP-Parameter-Request-List'}[3] = &request:DHCP-Parameter-Request-List -> 'DHCP-Domain-Name-Server' (19) perl: $RAD_REQUEST{'DHCP-Parameter-Request-List'}[4] = &request:DHCP-Parameter-Request-List -> 'DHCP-NETBIOS-Name-Servers' (19) perl: $RAD_REQUEST{'DHCP-Parameter-Request-List'}[5] = &request:DHCP-Parameter-Request-List -> 'DHCP-NETBIOS-Node-Type' (19) perl: $RAD_REQUEST{'DHCP-Parameter-Request-List'}[6] = &request:DHCP-Parameter-Request-List -> 'DHCP-NETBIOS' (19) perl: $RAD_REQUEST{'DHCP-Parameter-Request-List'}[7] = &request:DHCP-Parameter-Request-List -> 'DHCP-Perform-Router-Discovery' (19) perl: $RAD_REQUEST{'DHCP-Parameter-Request-List'}[8] = &request:DHCP-Parameter-Request-List -> 'DHCP-Static-Routes' (19) perl: $RAD_REQUEST{'DHCP-Parameter-Request-List'}[9] = &request:DHCP-Parameter-Request-List -> 'DHCP-Site-specific-25' (19) perl: $RAD_REQUEST{'DHCP-Parameter-Request-List'}[10] = &request:DHCP-Parameter-Request-List -> 'DHCP-Vendor' (19) perl: $RAD_REQUEST{'DHCP-Vendor-Class-Identifier'} = &request:DHCP-Vendor-Class-Identifier -> '0x4d53465420352e30' (19) perl: $RAD_REQUEST{'DHCP-Client-Identifier'} = &request:DHCP-Client-Identifier -> '0x0100e04c03d4c0' (19) perl: $RAD_REQUEST{'DHCP-Client-FQDN'} = &request:DHCP-Client-FQDN -> '' (19) perl: $RAD_REQUEST{'DHCP-Relay-Agent-Information'} = &request:DHCP-Relay-Agent-Information -> '0x01060004008d001202080006fcfaf74445a3090600044d64616e' (19) perl: $RAD_REPLY{'DHCP-Relay-IP-Address'} = &reply:DHCP-Relay-IP-Address -> '10.133.71.1' (19) perl: &request:DHCP-Message-Type = $RAD_REQUEST{'DHCP-Message-Type'} -> 'DHCP-Request' (19) perl: &request:DHCP-Vendor-Class-Identifier = $RAD_REQUEST{'DHCP-Vendor-Class-Identifier'} -> '0x4d53465420352e30' (19) perl: &request:DHCP-Client-Hardware-Address = $RAD_REQUEST{'DHCP-Client-Hardware-Address'} -> '00:e0:4c:03:d4:c0' (19) perl: &request:DHCP-DHCP-Server-Identifier = $RAD_REQUEST{'DHCP-DHCP-Server-Identifier'} -> '10.133.252.253' (19) perl: &request:DHCP-Flags = $RAD_REQUEST{'DHCP-Flags'} -> '0' (19) perl: &request:DHCP-Hardware-Address-Length = $RAD_REQUEST{'DHCP-Hardware-Address-Length'} -> '6' (19) perl: &request:DHCP-Hop-Count = $RAD_REQUEST{'DHCP-Hop-Count'} -> '1' (19) perl: &request:DHCP-Client-IP-Address = $RAD_REQUEST{'DHCP-Client-IP-Address'} -> '0.0.0.0' (19) perl: &request:DHCP-Vendor = $RAD_REQUEST{'DHCP-Vendor'} -> '0xdc0100' (19) perl: &request:DHCP-Gateway-IP-Address = $RAD_REQUEST{'DHCP-Gateway-IP-Address'} -> '10.133.71.1' (19) perl: &request:DHCP-Opcode = $RAD_REQUEST{'DHCP-Opcode'} -> 'Client-Message' (19) perl: &request:DHCP-Your-IP-Address = $RAD_REQUEST{'DHCP-Your-IP-Address'} -> '0.0.0.0' (19) perl: &request:DHCP-Requested-IP-Address = $RAD_REQUEST{'DHCP-Requested-IP-Address'} -> '10.133.196.26' (19) perl: &request:DHCP-Hardware-Type = $RAD_REQUEST{'DHCP-Hardware-Type'} -> 'Ethernet' (19) perl: &request:NAS-IP-Address = $RAD_REQUEST{'NAS-IP-Address'} -> '10.133.71.1' (19) perl: &request:DHCP-Relay-Agent-Information = $RAD_REQUEST{'DHCP-Relay-Agent-Information'} -> '0x01060004008d001202080006fcfaf74445a3090600044d64616e' (19) perl: &request:DHCP-Client-FQDN = $RAD_REQUEST{'DHCP-Client-FQDN'} -> '' (19) perl: &request:DHCP-Transaction-Id = $RAD_REQUEST{'DHCP-Transaction-Id'} -> '797242177' (19) perl: &request:DHCP-Parameter-Request-List += $RAD_REQUEST{'DHCP-Parameter-Request-List'} -> 'DHCP-Subnet-Mask' (19) perl: &request:DHCP-Parameter-Request-List += $RAD_REQUEST{'DHCP-Parameter-Request-List'} -> 'DHCP-Domain-Name' (19) perl: &request:DHCP-Parameter-Request-List += $RAD_REQUEST{'DHCP-Parameter-Request-List'} -> 'DHCP-Router-Address' (19) perl: &request:DHCP-Parameter-Request-List += $RAD_REQUEST{'DHCP-Parameter-Request-List'} -> 'DHCP-Domain-Name-Server' (19) perl: &request:DHCP-Parameter-Request-List += $RAD_REQUEST{'DHCP-Parameter-Request-List'} -> 'DHCP-NETBIOS-Name-Servers' (19) perl: &request:DHCP-Parameter-Request-List += $RAD_REQUEST{'DHCP-Parameter-Request-List'} -> 'DHCP-NETBIOS-Node-Type' (19) perl: &request:DHCP-Parameter-Request-List += $RAD_REQUEST{'DHCP-Parameter-Request-List'} -> 'DHCP-NETBIOS' (19) perl: &request:DHCP-Parameter-Request-List += $RAD_REQUEST{'DHCP-Parameter-Request-List'} -> 'DHCP-Perform-Router-Discovery' (19) perl: &request:DHCP-Parameter-Request-List += $RAD_REQUEST{'DHCP-Parameter-Request-List'} -> 'DHCP-Static-Routes' (19) perl: &request:DHCP-Parameter-Request-List += $RAD_REQUEST{'DHCP-Parameter-Request-List'} -> 'DHCP-Site-specific-25' (19) perl: &request:DHCP-Parameter-Request-List += $RAD_REQUEST{'DHCP-Parameter-Request-List'} -> 'DHCP-Vendor' (19) perl: &request:DHCP-Number-of-Seconds = $RAD_REQUEST{'DHCP-Number-of-Seconds'} -> '0' (19) perl: &request:DHCP-Hostname = $RAD_REQUEST{'DHCP-Hostname'} -> 'microsof-2ac3da' (19) perl: &request:DHCP-Client-Identifier = $RAD_REQUEST{'DHCP-Client-Identifier'} -> '0x0100e04c03d4c0' (19) perl: &request:DHCP-Server-IP-Address = $RAD_REQUEST{'DHCP-Server-IP-Address'} -> '0.0.0.0' (19) perl: &reply:DHCP-Domain-Name = $RAD_REPLY{'DHCP-Domain-Name'} -> '' (19) perl: &reply:DHCP-NTP-Servers = $RAD_REPLY{'DHCP-NTP-Servers'} -> '10.133.252.253' (19) perl: &reply:DHCP-Relay-IP-Address = $RAD_REPLY{'DHCP-Relay-IP-Address'} -> '10.133.71.1' (19) perl: &reply:DHCP-Domain-Name-Server = $RAD_REPLY{'DHCP-Domain-Name-Server'} -> '10.133.200.150' (19) perl: &reply:Framed-IP-Address = $RAD_REPLY{'Framed-IP-Address'} -> '10.133.196.26' (19) perl: &reply:User-Name = $RAD_REPLY{'User-Name'} -> 'md_133' (19) perl: &reply:DHCP-Router-Address = $RAD_REPLY{'DHCP-Router-Address'} -> '10.133.196.1' (19) perl: &reply:DHCP-IP-Address-Lease-Time = $RAD_REPLY{'DHCP-IP-Address-Lease-Time'} -> '172800' (19) perl: &reply:DHCP-Subnet-Mask = $RAD_REPLY{'DHCP-Subnet-Mask'} -> '255.255.255.0' (19) perl: &reply:DHCP-Server-IP-Address = $RAD_REPLY{'DHCP-Server-IP-Address'} -> '10.133.200.150' (19) perl: &reply:DHCP-Your-IP-Address = $RAD_REPLY{'DHCP-Your-IP-Address'} -> '10.133.196.26' (19) [perl] = ok (19) if (ok) { (19) if (ok) -> TRUE (19) if (ok) { (19) update reply { (19) Packet-Dst-Port = 67 (19) DHCP-Message-Type = DHCP-Ack (19) EXPAND %{Packet-Dst-IP-Address} (19) --> 10.133.200.150 (19) DHCP-DHCP-Server-Identifier = 10.133.200.150 (19) } # update reply = noop (19) } # if (ok) = noop (19) ... skipping elsif for request 19: Preceding "if" was taken (19) ... skipping else for request 19: Preceding "if" was taken (19) [ok] = ok (19) } # dhcp DHCP-Request = ok (19) DHCP: Reply will be unicast to giaddr from original packet DHCP-Opcode = Server-Message DHCP-Hardware-Type = Ethernet DHCP-Hardware-Address-Length = 6 DHCP-Hop-Count = 1 DHCP-Transaction-Id = 797242177 DHCP-Number-of-Seconds = 0 DHCP-Flags = 0 DHCP-Client-IP-Address = 0.0.0.0 DHCP-Your-IP-Address = 10.133.196.26 DHCP-Server-IP-Address = 10.133.200.150 DHCP-Gateway-IP-Address = 10.133.71.1 DHCP-Client-Hardware-Address = 00:e0:4c:03:d4:c0 DHCP-Server-Host-Name = '' DHCP-Boot-Filename = '' DHCP-Subnet-Mask = 255.255.255.0 DHCP-Router-Address = 10.133.196.1 DHCP-Domain-Name-Server = 10.133.200.150 DHCP-Domain-Name = '' DHCP-NTP-Servers = 10.133.252.253 DHCP-IP-Address-Lease-Time = 172800 DHCP-DHCP-Server-Identifier = 10.133.200.150 Sending DHCP-Ack Id 2f84f341 from 10.133.200.150:67 to 10.133.71.1:68 (19) Sent code 1029 Id 797242177 from 10.133.200.150:67 to 10.133.71.1:68 length 300 (19) User-Name = 'md_133' (19) DHCP-Subnet-Mask = 255.255.255.0 (19) DHCP-Router-Address = 10.133.196.1 (19) DHCP-Domain-Name-Server = 10.133.200.150 (19) Framed-IP-Address = 10.133.196.26 (19) DHCP-Domain-Name = '' (19) DHCP-NTP-Servers = 10.133.252.253 (19) DHCP-IP-Address-Lease-Time = 172800 (19) DHCP-Message-Type = DHCP-Ack (19) DHCP-DHCP-Server-Identifier = 10.133.200.150 (19) DHCP-Opcode = Server-Message (19) DHCP-Hardware-Type = Ethernet (19) DHCP-Hardware-Address-Length = 6 (19) DHCP-Hop-Count = 1 (19) DHCP-Transaction-Id = 797242177 (19) DHCP-Flags = 0 (19) DHCP-Client-IP-Address = 0.0.0.0 (19) DHCP-Your-IP-Address = 10.133.196.26 (19) DHCP-Server-IP-Address = 10.133.200.150 (19) DHCP-Gateway-IP-Address = 10.133.71.1 (19) DHCP-Client-Hardware-Address = 00:e0:4c:03:d4:c0 (19) DHCP-Relay-IP-Address = 10.133.71.1 (19) Finished request

2 5

rediswho module config
by Ispas Paul 26 Feb '15

26 Feb '15

Hello list , I am trying to test the rediswho module , freeradius 3.0.7, default configuration and have some issues. Can anyone tell me what i am doing wrong ? radiusd -X output : Copyright (C) 1999-2015 The FreeRADIUS server project and contributors There is NO warranty; not even for MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE You may redistribute copies of FreeRADIUS under the terms of the GNU General Public License For more information about these matters, see the file named COPYRIGHT Starting - reading configuration files ... including dictionary file /usr/share/freeradius/dictionary including dictionary file /usr/share/freeradius/dictionary.dhcp including dictionary file /usr/share/freeradius/dictionary.vqp including dictionary file /etc/raddb/dictionary including configuration file /etc/raddb/radiusd.conf including configuration file /etc/raddb/proxy.conf including configuration file /etc/raddb/clients.conf including files in directory /etc/raddb/mods-enabled/ including configuration file /etc/raddb/mods-enabled/rediswho including configuration file /etc/raddb/mods-enabled/chap including configuration file /etc/raddb/mods-enabled/linelog including configuration file /etc/raddb/mods-enabled/mschap including configuration file /etc/raddb/mods-enabled/sradutmp including configuration file /etc/raddb/mods-enabled/detail including configuration file /etc/raddb/mods-enabled/attr_filter including configuration file /etc/raddb/mods-enabled/pap including configuration file /etc/raddb/mods-enabled/passwd including configuration file /etc/raddb/mods-enabled/files including configuration file /etc/raddb/mods-enabled/expr including configuration file /etc/raddb/mods-enabled/dynamic_clients including configuration file /etc/raddb/mods-enabled/preprocess including configuration file /etc/raddb/mods-enabled/always including configuration file /etc/raddb/mods-enabled/date including configuration file /etc/raddb/mods-enabled/cache_eap including configuration file /etc/raddb/mods-enabled/echo including configuration file /etc/raddb/mods-enabled/realm including configuration file /etc/raddb/mods-enabled/utf8 including configuration file /etc/raddb/mods-enabled/eap including configuration file /etc/raddb/mods-enabled/digest including configuration file /etc/raddb/mods-enabled/replicate including configuration file /etc/raddb/mods-enabled/redis including configuration file /etc/raddb/mods-enabled/expiration including configuration file /etc/raddb/mods-enabled/dhcp including configuration file /etc/raddb/mods-enabled/exec including configuration file /etc/raddb/mods-enabled/soh including configuration file /etc/raddb/mods-enabled/unix including configuration file /etc/raddb/mods-enabled/logintime including configuration file /etc/raddb/mods-enabled/unpack including configuration file /etc/raddb/mods-enabled/radutmp including configuration file /etc/raddb/mods-enabled/ntlm_auth including configuration file /etc/raddb/mods-enabled/detail.log including configuration file /etc/raddb/mods-enabled/cache including files in directory /etc/raddb/policy.d/ including configuration file /etc/raddb/policy.d/canonicalization including configuration file /etc/raddb/policy.d/control including configuration file /etc/raddb/policy.d/accounting including configuration file /etc/raddb/policy.d/eap including configuration file /etc/raddb/policy.d/filter including configuration file /etc/raddb/policy.d/cui including configuration file /etc/raddb/policy.d/operator-name including configuration file /etc/raddb/policy.d/dhcp including configuration file /etc/raddb/policy.d/abfab-tr including configuration file /etc/raddb/policy.d/debug including files in directory /etc/raddb/sites-enabled/ including configuration file /etc/raddb/sites-enabled/inner-tunnel including configuration file /etc/raddb/sites-enabled/default main { security { user = "radiusd" group = "radiusd" allow_core_dumps = no } } main { name = "radiusd" prefix = "/usr" localstatedir = "/var" sbindir = "/usr/sbin" logdir = "/var/log/radius" run_dir = "/var/run/radiusd" libdir = "/usr/lib64/freeradius" radacctdir = "/var/log/radius/radacct" hostname_lookups = no max_request_time = 30 cleanup_delay = 5 max_requests = 1024 pidfile = "/var/run/radiusd/radiusd.pid" checkrad = "/usr/sbin/checkrad" debug_level = 0 proxy_requests = yes log { stripped_names = no auth = no auth_badpass = no auth_goodpass = no colourise = yes msg_denied = "You are already logged in - access denied" } resources { } security { max_attributes = 200 reject_delay = 1.000000 status_server = yes allow_vulnerable_openssl = "yes" } } radiusd: #### Loading Realms and Home Servers #### proxy server { retry_delay = 5 retry_count = 3 default_fallback = no dead_time = 120 wake_all_if_all_dead = no } home_server localhost { ipaddr = 127.0.0.1 port = 1812 type = "auth" secret = <<< secret >>> response_window = 20.000000 response_timeouts = 1 max_outstanding = 65536 zombie_period = 40 status_check = "status-server" ping_interval = 30 check_interval = 30 check_timeout = 4 num_answers_to_alive = 3 revive_interval = 120 limit { max_connections = 16 max_requests = 0 lifetime = 0 idle_timeout = 0 } coa { irt = 2 mrt = 16 mrc = 5 mrd = 30 } } home_server_pool my_auth_failover { type = fail-over home_server = localhost } realm example.com { auth_pool = my_auth_failover } realm LOCAL { } radiusd: #### Loading Clients #### client localhost { ipaddr = 127.0.0.1 require_message_authenticator = no secret = <<< secret >>> nas_type = "other" proto = "*" limit { max_connections = 16 lifetime = 0 idle_timeout = 30 } } client localhost_ipv6 { ipv6addr = ::1 require_message_authenticator = no secret = <<< secret >>> limit { max_connections = 16 lifetime = 0 idle_timeout = 30 } } Debugger not attached # Creating Auth-Type = digest radiusd: #### Instantiating modules #### instantiate { } modules { # Loaded module rlm_rediswho # Instantiating module "rediswho" from file /etc/raddb/mods-enabled/rediswho rediswho { redis_module_instance = "redis" trim_count = 5 /etc/raddb/mods-enabled/rediswho[10]: Configuration item 'insert' must have a value } /etc/raddb/mods-enabled/rediswho[10]: Invalid configuration for module "rediswho"

2 3

Problem with special character '%' inside in User-Password attribute [ freeradius 3.0.1 ]
by joaocdc＠gmail.com 26 Feb '15

26 Feb '15

Please, someone can help with the special character '%' inside in User-Password attribute? the radius generates a exception in authorize phase, and the authentication fails. This occurs when PAP is selected. Is possible escape special characters in User-Password attribute? how i do it? please show me an example. I'm using freeradius 3.0.1, with CentOS 7. In the past I was using freeradius 2.1 with Debian 6, this problem never occurred. At below debug is possible see the problem. rad_recv: Access-Request packet from host 172.25.89.1 port 32768, id=250, length=157 User-Name = '0006882' User-Password = '#mypass123%' Service-Type = Login-User NAS-IP-Address = 172.25.89.1 NAS-Port = 4 NAS-Identifier = 'WLC-PTI' NAS-Port-Type = Wireless-802.11 Airespace-Wlan-Id = 8 Calling-Station-Id = '00-db-df-27-2a-45' Called-Station-Id = 'dc-a5-f4-1d-1b-60:PTI-WIFI' Message-Authenticator = 0xe6054dc6d0e931d8210d4851a1c68e34 (24) # Executing section authorize from file /etc/raddb/sites-enabled/default (24) authorize { (24) ? if (User-Name !~ /@/) (24) ? if (User-Name !~ /@/) -> TRUE (24) if (User-Name !~ /@/) { (24) update request { (24) Realm := "pti" (24) } # update request = noop (24) } # if (User-Name !~ /@/) = noop (24) [preprocess] = ok (24) [chap] = noop (24) [mschap] = noop (24) [digest] = noop (24) suffix : Request already has destination realm set. Ignoring. (24) [suffix] = ok (24) update control { (24) Proxy-To-Realm := 'LOCAL' (24) } # update control = noop (24) eap : No EAP-Message, not doing EAP (24) [eap] = noop (24) [files] = noop (24) ? if ( Service-Type == "Login-User") (24) expand: "Login-User" -> 'Login-User' (24) ? if ( Service-Type == "Login-User") -> TRUE (24) if ( Service-Type == "Login-User") { (24) ? if ( Realm == "pti") (24) expand: "pti" -> 'pti' (24) ? if ( Realm == "pti") -> TRUE (24) if ( Realm == "pti") { rlm_ldap (ldap_pti): Reserved connection (4) (24) ldap_pti : expand: "(&(uid=%{%{Stripped-User-Name}:-%{User-Name}})(habitantActive=TRUE)(habitantLoginActive=TRUE)(habitantWirelessActive=TRUE))" -> '(&(uid=0006882)(habitantActive=TRUE)(habitantLoginActive=TRUE)(habitantWirelessActive=TRUE))' (24) ldap_pti : expand: "ou=instituicoes,dc=parque" -> 'ou=instituicoes,dc=parque' (24) ldap_pti : Performing search in 'ou=instituicoes,dc=parque' with filter '(&(uid=0006882)(habitantActive=TRUE)(habitantLoginActive=TRUE)(habitantWirelessActive=TRUE))' (24) ldap_pti : Waiting for search result... (24) ldap_pti : User object found at DN "uid=0006882,cn=0040574,ou=instituicoes,dc=parque" (24) ldap_pti : Processing user attributes (24) ldap_pti : control:Password-With-Header += '{SSHA}395fMQk8eSN+V+vDRKuc4JuAPTh7eV4c' (24) ldap_pti : control:NT-Password := 0x4335413336304144323434343343453142413437383138464642383638323046 rlm_ldap (ldap_pti): Released connection (4) (24) [ldap_pti] = ok (24) } # if ( Realm == "pti") = ok (24) ? if ( Realm == "vst") (24) expand: "vst" -> 'vst' (24) ? if ( Realm == "vst") -> FALSE (24) } # if ( Service-Type == "Login-User") = ok (24) [expiration] = noop (24) [logintime] = noop (24) pap : Normalizing NT-Password from hex encoding, 32 bytes -> 16 bytes (24) pap : Normalizing SSHA1-Password from base64 encoding, 32 bytes -> 24 bytes (24) [pap] = updated (24) } # authorize = updated (24) Found Auth-Type = PAP (24) # Executing group from file /etc/raddb/sites-enabled/default (24) Auth-Type PAP { (24) pap : login attempt with password "#mypass123%" (24) pap : Using NT encryption. (24) ERROR: pap : #mypass123% (24) ERROR: pap : ^ Invalid variable expansion (24) pap : expand: "%{mschap:NT-Hash %{User-Password}}" -> '' (24) ERROR: pap : NT password check failed (24) pap : Passwords don't match (24) [pap] = reject (24) } # Auth-Type PAP = reject (24) Failed to authenticate the user. (24) Login incorrect (pap: #mypass123%): [0006882] (from client controladora-wlan-1 port 4 cli 00-db-df-27-2a-45) (24) Using Post-Auth-Type Reject (24) # Executing group from file /etc/raddb/sites-enabled/default (24) Post-Auth-Type REJECT { (24) attr_filter.access_reject : expand: "%{User-Name}" -> '0006882' (24) attr_filter.access_reject : Matched entry DEFAULT at line 11 (24) [attr_filter.access_reject] = updated (24) eap : Request didn't contain an EAP-Message, not inserting EAP-Failure (24) [eap] = noop (24) remove_reply_message_if_eap remove_reply_message_if_eap { (24) ? if (reply:EAP-Message && reply:Reply-Message) (24) ? if (reply:EAP-Message && reply:Reply-Message) -> FALSE (24) else else { (24) [noop] = noop (24) } # else else = noop (24) } # remove_reply_message_if_eap remove_reply_message_if_eap = noop (24) } # Post-Auth-Type REJECT = updated (24) Finished request 24. Waking up in 0.3 seconds. Waking up in 0.6 seconds. (24) Sending delayed reject Sending Access-Reject of id 250 from 186.233.12.25 port 1812 to 172.25.89.1 port 32768 Waking up in 2.2 seconds. -- João Paulo de Lima Barbosa "Para chegar aonde a maioria não chega, você precisa fazer o que a maioria não faz."

2 1

Assign Static IP address on Freeradius with SQL
by Tevfik Ceydeliler 26 Feb '15

26 Feb '15

Hi, I can assign IP address to user from sql ip pool But Cant assign static IP address to user mysql> select * from radcheck where username like 'kivanccepel1' ; +-----+--------------+--------------------+----+---------+ | id | username | attribute | op | value | +-----+--------------+--------------------+----+---------+ | 211 | kivanccepel1 | Cleartext-Password | := | test | | 212 | kivanccepel1 | Proxy-to-Realm | := | secovid | +-----+--------------+--------------------+----+---------+ and mysql> select *from radreply; +----+--------------+-------------------+----+--------------+ | id | username | attribute | op | value | +----+--------------+-------------------+----+--------------+ | 1 | kivanccepel1 | Framed-IP-Address | := | 172.30.80.50 | | 2 | kivanccepel1 | Service-Type | := | Framed-User | +----+--------------+-------------------+----+--------------+ and log is like that: [sql] expand: SELECT id, username, attribute, value, op FROM radreply WHERE username = '%{SQL-User-Name}' ORDER BY id -> SELECT id, username, attribute, value, op FROM radreply WHERE username = 'kivanccepel1' ORDER BY id [sql] expand: SELECT groupname FROM radusergroup WHERE username = '%{SQL-User-Name}' ORDER BY priority -> SELECT groupname FROM radusergroup WHERE username = 'kivanccepel1' ORDER BY priority rlm_sql (sql): Released sql socket id: 2 ++[sql] returns ok ++[expiration] returns noop ++[logintime] returns noop ++[pap] returns noop WARNING: Empty pre-proxy section. Using default return values. Sending Access-Request of id 184 to 10.1.1.51 port 1812 User-Name = "kivanccepel1" User-Password = "475210071074" NAS-IP-Address = 10.65.8.117 Proxy-State = 0x30 Proxying request 2 to home server 10.1.1.51 port 1812 Sending Access-Request of id 184 to 10.1.1.51 port 1812 User-Name = "kivanccepel1" User-Password = "475210071074" NAS-IP-Address = 10.65.8.117 Proxy-State = 0x30 Going to the next request Waking up in 0.9 seconds. rad_recv: Access-Accept packet from host 10.1.1.51 port 1812, id=184, length=23 Proxy-State = 0x30 # Executing section post-proxy from file /etc/freeradius/sites-enabled/default +- entering group post-proxy {...} [eap] No pre-existing handler found ++[eap] returns noop Found Auth-Type = Accept Auth-Type = Accept, accepting the user # Executing section post-auth from file /etc/freeradius/sites-enabled/default +- entering group post-auth {...} [sqlippool] No Pool-Name defined. [sqlippool] expand: No Pool-Name defined (did %{Called-Station-Id} cli %{Calling-Station-Id} port %{NAS-Port} user %{User-Name}) -> No Pool-Name defined (did cli port user kivanccepel1) No Pool-Name defined (did cli port user kivanccepel1) ++[sqlippool] returns noop ++[exec] returns noop Sending Access-Accept of id 0 to 10.65.8.117 port 54732 Finished request 2. Going to the next request Waking up in 4.9 seconds. Cleaning up request 2 ID 0 with timestamp +230 Ready to process requests. What is missing? Regards... <br> <img src="http://www.yasar.com.tr/banner/yhbanner.jpg"> </img> <br><br> Bu elektronik postada bulunan tum fikir ve gorusler ve ekindeki dosyalar sadece adres sahip/sahiplerine ait olup, Yasar Toplulugu Sirketleri bu mesajin icerigi ile ilgili olarak hic bir hukuksal sorumlulugu kabul etmez. Eger gonderilmesi dusunulen kisi veya kurulus degilseniz, lutfen gonderen kisiyi derhal haberdar ediniz ve mesaji sisteminizden siliniz.The information contained in this e-mail and any files transmitted with it are intended solely for the use of the individual or entity to whom they are addressed and Yasar Group Companies do not accept legal responsibility for the contents. If you are not the intended recipient, please immediately notify the sender and delete it from your system.

2 1

Problem with config sql 3.0.7
by Haviaras Kostas 26 Feb '15

26 Feb '15

Hello, I just install the freeradius 3.0.7 on the debian 7.8, I run the command chmod o+xr /etc/freeradius after the installation. I run the freeradius -X is alright! But when I copy /etc/freeradius/mods-available/sql /etc/freeradius/mods-available/sqlcounter to /etc/freeradius/mods-enabled Start server again and I am getting this: Copyright (C) 1999-2015 The FreeRADIUS server project and contributors There is NO warranty; not even for MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE You may redistribute copies of FreeRADIUS under the terms of the GNU General Public License For more information about these matters, see the file named COPYRIGHT Starting - reading configuration files ... including dictionary file /usr/share/freeradius/dictionary including dictionary file /usr/share/freeradius/dictionary.dhcp including dictionary file /usr/share/freeradius/dictionary.vqp including dictionary file /etc/freeradius/dictionary including configuration file /etc/freeradius/radiusd.conf including configuration file /etc/freeradius/proxy.conf including configuration file /etc/freeradius/clients.conf including files in directory /etc/freeradius/mods-enabled/ including configuration file /etc/freeradius/mods-enabled/detail.log including configuration file /etc/freeradius/mods-enabled/sqlcounter No such configuration item modules.sql.dialect /etc/freeradius/mods-enabled/sqlcounter[43]: Reference "${modules.sql.dialect}" not found Errors reading or parsing /etc/freeradius/radiusd.conf What I am doing wrong? Thanks PS: I moving from 3.0.4 and fresh install to 3.0.7

3 2

Re: Problem with config sql 3.0.7
by Haviaras Kostas 26 Feb '15

26 Feb '15

Sorry to duplicate the thread! I was in a hurry.

1 0