- Freeradius-Users - lists.freeradius.org

should be inside of a 'server { ... }' block! after 3.0.7 upgrade
by Nick Rogers 20 Feb '15

20 Feb '15

After upgrading from 3.0.6 to 3.0.7, I now see the following errors when loading my config that were not present before. radiusd: #### Loading Virtual Servers #### server { # from file /usr/local/etc/raddb/radiusd.conf /usr/local/etc/raddb/radiusd.conf[210]: The authenticate section should be inside of a 'server { ... }' block! # Loading authenticate {...} /usr/local/etc/raddb/radiusd.conf[204]: The authorize section should be inside of a 'server { ... }' block! # Loading authorize {...} /usr/local/etc/raddb/radiusd.conf[217]: The preacct section should be inside of a 'server { ... }' block! # Loading preacct {...} /usr/local/etc/raddb/radiusd.conf[222]: The accounting section should be inside of a 'server { ... }' block! # Loading accounting {...} /usr/local/etc/raddb/radiusd.conf[226]: The post-proxy section should be inside of a 'server { ... }' block! } # server radiusd: #### Opening IP addresses and Ports #### This has me rather perplexed, as clearly the sections are within a server { } block. The server still behaves and responds to requests correctly. Is there something obvious that I am overlooking? Below is full debug output and my conf: fbsd101-vm# radiusd -X Copyright (C) 1999-2015 The FreeRADIUS server project and contributors There is NO warranty; not even for MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE You may redistribute copies of FreeRADIUS under the terms of the GNU General Public License For more information about these matters, see the file named COPYRIGHT Starting - reading configuration files ... including dictionary file /usr/local/share/freeradius/dictionary including dictionary file /usr/local/share/freeradius/dictionary.dhcp including dictionary file /usr/local/share/freeradius/dictionary.vqp including dictionary file /usr/local/etc/raddb/dictionary including configuration file /usr/local/etc/raddb/radiusd.conf main { security { user = "freeradius" group = "freeradius" allow_core_dumps = no } } main { name = "radiusd" prefix = "/usr/local" localstatedir = "/var" sbindir = "/usr/local/sbin" logdir = "/var/log/radius" run_dir = "/var/run/radiusd" libdir = "/usr/local/lib" radacctdir = "/var/log/radius/radacct" hostname_lookups = no max_request_time = 30 cleanup_delay = 5 max_requests = 10 pidfile = "/var/run/radiusd/radiusd.pid" checkrad = "/usr/local/sbin/checkrad" debug_level = 0 proxy_requests = no log { stripped_names = no auth = yes auth_badpass = no auth_goodpass = no msg_denied = "You are already logged in - access denied" } resources { } security { max_attributes = 200 reject_delay = 1.000000 status_server = yes allow_vulnerable_openssl = "no" } } radiusd: #### Loading Realms and Home Servers #### radiusd: #### Loading Clients #### client 192.168.92.0/24 { ipaddr = 192.168.92.0/24 require_message_authenticator = no secret = <<< secret >>> limit { max_connections = 16 lifetime = 0 idle_timeout = 30 } } Debugger not attached # Creating Auth-Type = PERL radiusd: #### Instantiating modules #### # Loaded module rlm_perl # Instantiating module "perl" from file /usr/local/etc/raddb/radiusd.conf perl { filename = "/space/rxg/rxgd/bin/freeradius_hook" func_authorize = "authorize" func_authenticate = "authenticate" func_post_auth = "post_auth" func_accounting = "accounting" func_preacct = "preacct" func_checksimul = "checksimul" func_detach = "detach" func_xlat = "xlat" func_pre_proxy = "pre_proxy" func_post_proxy = "post_proxy" func_recv_coa = "recv_coa" func_send_coa = "send_coa" } # Loaded module rlm_detail # Instantiating module "detail" from file /usr/local/etc/raddb/radiusd.conf detail { filename = "/var/log/radius/radacct/%{Client-IP-Address}/detail-%Y%m%d" header = "%t" permissions = 420 locking = no escape_filenames = no log_packet_header = no } # Loaded module rlm_expr # Instantiating module "expr" from file /usr/local/etc/raddb/radiusd.conf expr { safe_characters = "@abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ0123456789.-_: /äéöüàâæçèéêëîïôœùûüaÿÄÉÖÜßÀÂÆÇÈÉÊËÎÏÔŒÙÛÜŸ" } # Loaded module rlm_eap # Instantiating module "eap" from file /usr/local/etc/raddb/radiusd.conf eap { default_eap_type = "peap" timer_expire = 60 ignore_unknown_eap_types = no mod_accounting_username_bug = no max_sessions = 2048 } # Linked to sub-module rlm_eap_gtc gtc { challenge = "Password: " auth_type = "perl" } # Linked to sub-module rlm_eap_tls tls { tls = "tls-common" } tls-config tls-common { rsa_key_exchange = no dh_key_exchange = yes rsa_key_length = 512 dh_key_length = 512 verify_depth = 0 pem_file_type = yes private_key_file = "/etc/ssl/server.key" certificate_file = "/etc/ssl/server.crt" ca_file = "/etc/ssl/server.crt" dh_file = "/usr/local/etc/raddb/dhparam" random_file = "/space/rxg/rxgd/bin/random" fragment_size = 1024 include_length = yes check_crl = no ecdh_curve = "prime256v1" cache { enable = no lifetime = 24 max_entries = 255 } verify { } ocsp { enable = no override_cert_url = no use_nonce = yes timeout = 0 softfail = no } } # Linked to sub-module rlm_eap_ttls ttls { tls = "tls-common" default_eap_type = "gtc" copy_request_to_tunnel = yes use_tunneled_reply = yes include_length = yes require_client_cert = no } Using cached TLS configuration from previous invocation # Linked to sub-module rlm_eap_peap peap { tls = "tls-common" default_method = "gtc" copy_request_to_tunnel = yes use_tunneled_reply = yes proxy_tunneled_request_as_eap = yes soh = no require_client_cert = no } Using cached TLS configuration from previous invocation # Loaded module rlm_radutmp # Instantiating module "radutmp" from file /usr/local/etc/raddb/radiusd.conf radutmp { filename = "/var/log/radius/radutmp" username = "%{User-Name}" case_sensitive = yes check_with_nas = yes permissions = 420 caller_id = yes } # Instantiating module "sradutmp" from file /usr/local/etc/raddb/radiusd.conf radutmp sradutmp { filename = "/var/log/radius/sradutmp" username = "%{User-Name}" case_sensitive = yes check_with_nas = yes permissions = 420 caller_id = no } # Loaded module rlm_attr_filter # Instantiating module "attr_filter" from file /usr/local/etc/raddb/radiusd.conf attr_filter { filename = "/usr/local/etc/raddb/attrs" key = "%{Realm}" relaxed = no } reading pairlist file /usr/local/etc/raddb/attrs # Loaded module rlm_preprocess # Instantiating module "preprocess" from file /usr/local/etc/raddb/radiusd.conf preprocess { huntgroups = "/usr/local/etc/raddb/huntgroups" hints = "/usr/local/etc/raddb/hints" with_ascend_hack = no ascend_channels_per_line = 23 with_ntdomain_hack = no with_specialix_jetstream_hack = no with_cisco_vsa_hack = no with_alvarion_vsa_hack = no } reading pairlist file /usr/local/etc/raddb/huntgroups reading pairlist file /usr/local/etc/raddb/hints radiusd: #### Loading Virtual Servers #### server { # from file /usr/local/etc/raddb/radiusd.conf /usr/local/etc/raddb/radiusd.conf[210]: The authenticate section should be inside of a 'server { ... }' block! # Loading authenticate {...} /usr/local/etc/raddb/radiusd.conf[204]: The authorize section should be inside of a 'server { ... }' block! # Loading authorize {...} /usr/local/etc/raddb/radiusd.conf[217]: The preacct section should be inside of a 'server { ... }' block! # Loading preacct {...} /usr/local/etc/raddb/radiusd.conf[222]: The accounting section should be inside of a 'server { ... }' block! # Loading accounting {...} /usr/local/etc/raddb/radiusd.conf[226]: The post-proxy section should be inside of a 'server { ... }' block! } # server radiusd: #### Opening IP addresses and Ports #### listen { type = "auth" ipaddr = * port = 1812 } listen { type = "acct" ipaddr = * port = 1813 } Listening on auth address * port 1812 Listening on acct address * port 1813 Ready to process requests cat /usr/local/etc/raddb/radiusd.conf client 192.168.92.0/24 { ipaddr = 192.168.92.0/24 secret = d0ee524f6cb9966ce134d251a3e820c7 } prefix = /usr/local exec_prefix = ${prefix} sysconfdir = ${prefix}/etc localstatedir = /var sbindir = ${exec_prefix}/sbin logdir = /var/log/radius raddbdir = ${sysconfdir}/raddb radacctdir = ${logdir}/radacct name = radiusd confdir = ${raddbdir} modconfdir = ${confdir}/mods-config certdir = ${confdir}/certs cadir = ${confdir}/certs run_dir = ${localstatedir}/run/${name} db_dir = ${raddbdir} pidfile = /var/run/radiusd/radiusd.pid checkrad = ${sbindir}/checkrad listen { ipaddr = * port = 1812 type = auth } listen { ipaddr = * port = 1813 type = acct } log { #destination = files #colourise = yes #file = ${logdir}/radius.log #syslog_facility = daemon stripped_names = no auth = yes auth_badpass = no auth_goodpass = no } security { user = freeradius group = freeradius allow_core_dumps = no max_attributes = 200 reject_delay = 1 status_server = yes } thread pool { start_servers = 1 max_servers = 4 min_spare_servers = 1 max_spare_servers = 2 max_requests_per_server = 0 } max_request_time = 30 cleanup_delay = 5 max_requests = 10 hostname_lookups = no delete_blocked_requests = no regular_expressions = yes extended_expressions = yes usercollide = no lower_user = no lower_pass = no nospace_user = no nospace_pass = no snmp = no proxy_requests = no modules { perl { filename = /space/rxg/rxgd/bin/freeradius_hook } detail { filename = ${radacctdir}/%{Client-IP-Address}/detail-%Y%m%d permissions = 0644 } expr { safe_characters = "@abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ0123456789.-_: /äéöüàâæçèéêëîïôœùûüaÿÄÉÖÜßÀÂÆÇÈÉÊËÎÏÔŒÙÛÜŸ" } eap { default_eap_type = peap timer_expire = 60 ignore_unknown_eap_types = no gtc { challenge = "Password: " auth_type = perl } tls-config tls-common { private_key_password = private_key_file = /etc/ssl/server.key certificate_file = /etc/ssl/server.crt ca_file = /etc/ssl/server.crt dh_file = /usr/local/etc/raddb/dhparam random_file = /space/rxg/rxgd/bin/random } tls { tls = tls-common } ttls { tls = tls-common default_eap_type = gtc copy_request_to_tunnel = yes use_tunneled_reply = yes } peap { tls = tls-common default_eap_type = gtc default_method = gtc copy_request_to_tunnel = yes use_tunneled_reply = yes } } radutmp { filename = ${logdir}/radutmp username = %{User-Name} case_sensitive = yes check_with_nas = yes caller_id = "yes" } radutmp sradutmp { filename = ${logdir}/sradutmp permissions = 0644 caller_id = "no" } attr_filter { filename = ${confdir}/attrs } preprocess { huntgroups = ${confdir}/huntgroups hints = ${confdir}/hints with_ascend_hack = no ascend_channels_per_line = 23 with_ntdomain_hack = no with_specialix_jetstream_hack = no with_cisco_vsa_hack = no } } policy { class_value_prefix = 'ai:' acct_unique { if ("%{string:Class}" =~ /${policy.class_value_prefix}([0-9a-f]{32})/i) { update request { &Acct-Unique-Session-Id := "%{md5:%{1},%{Acct-Session-ID}}" } } else { update request { &Acct-Unique-Session-Id := "%{md5:%{User-Name},%{Acct-Session-ID},%{%{NAS-IPv6-Address}:-%{NAS-IP-Address}},%{NAS-Identifier},%{NAS-Port-ID},%{NAS-Port}}" } } } insert_acct_class { update reply { &Class = "${policy.class_value_prefix}%{md5:%t,%I,%{Packet-Src-Port},%{Packet-Src-IP-Address},%{NAS-IP-Address},%{Calling-Station-ID},%{User-Name}}" } } acct_counters64.preacct { update request { &Acct-Input-Octets64 = "%{expr:(&Acct-Input-Gigawords << 32) | &Acct-Input-Octets}" &Acct-Output-Octets64 = "%{expr:(&Acct-Output-Gigawords << 32) | &Acct-Output-Octets}" } } } server { authorize { preprocess eap perl } authenticate { Auth-Type PERL { perl } eap } preacct { preprocess acct_unique } accounting { perl } post-proxy { eap perl } }

2 5

ldap responses in freeradius 3.0.4
by Mark Williams 19 Feb '15

19 Feb '15

I use some custom linelogs in my own config which then go to syslog. I noticed that the radius.log actually has statements detailing the ldap responses to an auth attempt (invalid user, incorrect login, etc). I'd like to be able to use some similar messaging in my custom linelog. I browsed the rad_auth file and, while I'm not well versed in C, I was able to determine how the messages are being generated. I'd rather not have to code my own module to accomplish this however. Suggestions? Have I missed an attribute or run-time variable with the return code of an ldap request?

2 1

Ldap-UserDn
by Stefan Paetow 19 Feb '15

19 Feb '15

Hi, Is there any way to check for the existence of Ldap-UserDn for a bind-as-user option? We're trying to document how to use the users file together with LDAP bind-as-user. Any suggestions will be most helpful :-) Stefan Paetow Moonshot Industry & Research Liaison Coordinator t: +44 (0)1235 822 125 gpg: 0x3FCE5142 xmpp: stefanp(a)jabber.dev.ja.net skype: stefan.paetow.janet Lumen House, Library Avenue, Harwell Oxford, Didcot, OX11 0SG jisc.ac.uk Jisc is a registered charity (number 1149740) and a company limited by guarantee which is registered in England under Company No. 5747339, VAT No. GB 197 0632 86. Jisc’s registered office is: One Castlepark, Tower Hill, Bristol, BS2 0JA. T 0203 697 5800. Jisc Collections and Janet Ltd. is a wholly owned Jisc subsidiary and a company limited by guarantee which is registered in England under Company No. number 2881024, VAT No. GB 197 0632 86. The registered office is: Lumen House, Library Avenue, Harwell, Didcot, Oxfordshire, OX11 0SG. T 01235 822200.

2 1

rlm_graphite?
by Arran Cudbard-Bell 19 Feb '15

19 Feb '15

Just looking at graphite and wondering if anyone thinks a native rlm_graphite module to update counters using accounting data would be useful. One big advantage graphite has advantages over other systems in that it can be used to graph very large numbers of metrics. It could be used to produce traffic graphs for every user on a network for example. The module would implement the pickle protocol, and use a connection pool for TCP Connection caching. -Arran Arran Cudbard-Bell <a.cudbardb(a)freeradius.org> FreeRADIUS development team FD31 3077 42EC 7FCD 32FE 5EE2 56CF 27F9 30A8 CAA2

5 10

SQL based IP pool
by Fabrizio Fiore Donati 19 Feb '15

19 Feb '15

Hi, we need to user sql ip pool to assign the ip to the customer. About 10000 ip address. I see that i can use two module, Rlm_sqlhpwippool or Rlm_sqlippool which one do you suggest ? any special requirements ? -- Fabrizio Fiore Donati Mobile: +39 3289872420 E-mail: fabrizio.fioredonati(a)2bite.net 2bite s.r.l. Via Saragat snc 67100 L'Aquila (AQ) - Italy Tel.: +39 0862441583

3 6

Freeradius 3.0.4 authentication to FreeIPA 4.1.2
by Charles Jennings 18 Feb '15

18 Feb '15

Environment: Fedora release 21 (Twenty One) {Linux ipa.socnet.demonet.net 3.18.5-201.fc21.x86_64 #1 SMP Mon Feb 2 21:00:58 UTC 2015 x86_64 x86_64 x86_64 GNU/Linux} radiusd: FreeRADIUS Version 3.0.4, for host x86_64-redhat-linux-gnu, built on Jan 19 2015 at 19:42:17 ipa: VERSION: 4.1.2, API_VERSION: 2.109 I am a freeradius noob. I figure if I can get to the point where I can do a test with radtest locally, I can get from there. I cannot find any documentation on the internet that is coherent for me to give me a step-by-step configuration for authenticating radius against FreeIPA. I would prefer (I think) to use the Kerberos portion of FreeIPA as opposed to the OpenLDAP portion - however, I can go either way. I just need a nudge in the configuration of freeradius to freeipa. Any help would be very much appreciated. As a side note, I am authenticating successfully against my IPA infrastructure - I just can't seem to find the information I need to tie freeradius to freeipa. Thanks.

3 4

Re: radwho gives an empty output
by Mert Uzun 18 Feb '15

18 Feb '15

>> To mention my work detailly, on GNS3, I have one c7200 cisco router as >> NAS(for administration access to router only, not to provide an >> internet connection) and a freeradius server on ubuntu server 14.04. I >> configured my NAS to send accounting update per one minute. In >> /var/log/freeradius/radacct/(ip of the nas)/detail-(date), I can read a >> txt file where some accounting infos are written but when I issue >> "radwho" command, I can not see anything but the titles for non-written >> accounting details. > > Read the debug output, and look for the “radutmp” module. What does it > say when the server receives an Accounting-Request? Unfortunately I saw no output by radutmp module. I only saw auth_log outputs that prompting outputs into a txt file (I tried some configurations on detail.log). I think that I may have not noticed a useful information but I have no idea about what it is. However, because I configured my NAS to request accounting logouts, my server send accounting reply when any user log off on the NAS. > >> I also issued freeradius -X command and got "ready to process request", >> my server can properly process authentication requests also. > > The point is to read the output *after* it says “Ready to process > requests”. That tells you what it’s doing when it processes requests. > I read each row after receiving a request. I couldn't see any radutmp module output as I said above. At least I know what I need to focus on now. >> However, I'm not completely unsuccessful to get any output from radwho. >> I had done some configurations on freeradius and managed to get proper >> outputs with radwho on the same topology and system. Unfortunately, my >> server got disfunctioned when I had tried to configure it for active >> directory authentication. I could only recovered it by re-installing >> then I lost and forgot what I did to use radwho. > > You should use “git” for revision control on the raddb directory. It > helps a lot. I should have learned this function before. Due to malfunctions on my computer, I lost whole topology and virtual machines but I will remember this advice in future thank you a lot. > >> I can't remember what I did to get radwho output before I lost whole >> configuration and what I can't notice now. > > If you send Accounting packets which have useful session data in them, > radwho will “just work”. > After reading this, I read my accounting configuration on the NAS. I suspected of a forgotten accounting command. Then I issued some accounting commands to apply "trial&error". Unfortunately, radwho didn't work again. I will continue to search for any missing accounting commands. In general, those details were all caused from the previous topology which I lost completely recently. I will build it up again in a few days. After a short process of adding clients and users, I will read debug details as you recommend and share results. Thanks for your help. -- Mert Uzun Elektrik Mühendisliği Bölümü-2. Sınıf Öğrencisi

1 0

Users file formatting
by Jonathan Gazeley 18 Feb '15

18 Feb '15

Hi list, This is hopefully a simple question. I've been using a simple users file to authenticate a handful of users that don't exist in AD with entries like this, which works: test-account1 Cleartext-Password := "password", MS-CHAP-Use-NTLM-Auth := no I also want to have a couple of test accounts that are restricted to MAC addresses. test-account2 Cleartext-Password := 'password', Calling-Station-Id == "00:11:22:33:44:55", MS-CHAP-Use-NTLM-Auth := no However radius -XC bombs out with "Unexpected trailing comma in check item list for entry test-account2" According to the manpage for the users file, I've formatted it correctly with commas between each check-item. I wondered if MS-CHAP-Use-NTLM-Auth was a reply-item so I tried to move it onto its own line with a tab, but this throws "Parse error (reply) for entry test-account2 (unknown error)" Can anyone advise on how to format users entries like this, and even if it is possible to require specific mac addresses in this way? Thanks, Jonathan

2 3

Weird message from RADIUS running at debug level
by Clement Ogedengbe 18 Feb '15

18 Feb '15

I am running RADIUS ( has embedded ntlm_auth to authenticate to Windows AD) at debug level. The message below gets occasionally displayed on the screen. The serer continues to authenticate users anyway, but wonder if anyone has any idea of what is going on here. Usage: [OPTION...] --helper-protocol=helper protocol to use operate as a stdio-based helper --username=STRING username --domain=STRING domain name --workstation=STRING workstation --challenge=STRING challenge (HEX encoded) --lm-response=STRING LM Response to the challenge (HEX encoded) --nt-response=STRING NT or NTLMv2 Response to the challenge (HEX encoded) --password=STRING User's plaintext password --request-lm-key Retrieve LM session key --request-nt-key Retrieve User (NT) session key --use-cached-creds Use cached credentials if no password is given --diagnostics Perform diagnostics on the authentictaion chain --require-membership-of=STRING Require that a user be a member of this group (either name or SID) for authentication to succeed --pam-winbind-conf=STRING Require that request must set WBFLAG_PAM_CONTACT_TRUSTDOM when krb5 auth is required Help options: -?, --help Show this help message --usage Display brief usage message Common samba config: --configfile=CONFIGFILE Use alternate configuration file Common samba options: -V, --version Print version

3 2

Git issue
by David Peterson 18 Feb '15

18 Feb '15

When I try to checkout branch 2.x I get this: root@freeradius:/usr/src# git clone git@github.com:FreeRADIUS/freeradius-server.git Cloning into 'freeradius-server'... Warning: Permanently added the RSA host key for IP address '192.30.252.128' to the list of known hosts. Permission denied (publickey). fatal: Could not read from remote repository. Please make sure you have the correct access rights and the repository exists. David

2 2