- Freeradius-Users - lists.freeradius.org

"Accounting-On" and "Accouting-Off"
by Frank Wei 03 Dec '14

03 Dec '14

Hi all, I am new to RADIUS. I understand "Accounting-off" can be sent before the NAS shutting down to inform the server that all the currently opened session to be closed. "Accounting -on" is to mark the start of the accounting upon booting. There are also per "session-id" based "Accounting-start" and "Accounting-stop". It seems to me if we can apply all the session IDs to "Accounting-start" and "Accounting-stop" then we do not need to use "Accounting-off" and "Accounting-on". Please somebody to explain to me when we have to use "Accounting-off" and "Accounting-on"? Regards, 4RF Limited The information in this email communication (inclusive of attachments) is confidential to 4RF Limited and the intended recipient(s). If you are not the intended recipient(s), please note that any use, disclosure, distribution or copying of this information or any part thereof is strictly prohibited and that the author accepts no liability for the consequences of any action taken on the basis of the information provided. If you have received this email in error, please notify the sender immediately by return email and then delete all instances of this email from your system. 4RF Limited will not accept responsibility for any consequences associated with the use of this email (including, but not limited to, damages sustained as a result of any viruses and/or any action or lack of action taken in reliance on it).

3 2

FR 3.0.4: MS-CHAP2-Response is incorrect
by Heiko O 02 Dec '14

02 Dec '14

Hello all, i have two question on realms: Authenication works fine when Users only enter "username",but i want the users to login with something like "username(a)thedomain.net". But when doing this i get (0) preprocess : --> testuser (0) [preprocess] = ok (0) [chap] = noop (0) mschap : Found MS-CHAP attributes. Setting 'Auth-Type = mschap' (0) [mschap] = ok (0) [digest] = noop (0) suffix : Checking for suffix after "@" (0) suffix : No '@' in User-Name = "testuser", looking up realm NULL (0) suffix : No such realm "NULL" (0) [suffix] = noop (0) eap : No EAP-Message, not doing EAP (0) [eap] = noop (0) sql : EXPAND %{User-Name} (0) sql : --> testuser (0) sql : SQL-User-Name set to 'testuser' rlm_sql (sql): Reserved connection (4) (0) sql : EXPAND SELECT id, UserName, Attribute, Value, Op FROM radcheck WHERE Username = '%{SQL-User-Name}' ORDER BY id (0) sql : --> SELECT id, UserName, Attribute, Value, Op FROM radcheck WHERE Username = 'testuser' ORDER BY id rlm_sql (sql): Executing query: 'SELECT id, UserName, Attribute, Value, Op FROM radcheck WHERE Username = 'testuser' ORDER BY id' rlm_sql_postgresql: Status: PGRES_TUPLES_OK rlm_sql_postgresql: query affected rows = 1 , fields = 5 (0) sql : User found in radcheck table (0) sql : Check items matched (0) sql : EXPAND SELECT id, UserName, Attribute, Value, Op FROM radreply WHERE Username = '%{SQL-User-Name}' ORDER BY id (0) sql : --> SELECT id, UserName, Attribute, Value, Op FROM radreply WHERE Username = 'testuser' ORDER BY id rlm_sql (sql): Executing query: 'SELECT id, UserName, Attribute, Value, Op FROM radreply WHERE Username = 'testuser' ORDER BY id' rlm_sql_postgresql: Status: PGRES_TUPLES_OK rlm_sql_postgresql: query affected rows = 2 , fields = 5 (0) sql : User found in radreply table (0) sql : EXPAND SELECT GroupName FROM radusergroup WHERE UserName='%{SQL-User-Name}' ORDER BY priority (0) sql : --> SELECT GroupName FROM radusergroup WHERE UserName='testuser' ORDER BY priority rlm_sql (sql): Executing query: 'SELECT GroupName FROM radusergroup WHERE UserName='testuser' ORDER BY priority' rlm_sql_postgresql: Status: PGRES_TUPLES_OK rlm_sql_postgresql: query affected rows = 0 , fields = 1 (0) sql : User not found in any groups rlm_sql (sql): Released connection (4) (0) [sql] = ok (0) [expiration] = noop (0) [logintime] = noop (0) } # authorize = ok (0) Found Auth-Type = MSCHAP (0) # Executing group from file /etc/raddb/sites-enabled/default (0) Auth-Type MS-CHAP { (0) mschap : Found Cleartext-Password, hashing to create LM-Password (0) mschap : Found Cleartext-Password, hashing to create NT-Password (0) mschap : Creating challenge hash with username: testuser (0) mschap : Client is using MS-CHAPv2 (0) ERROR: mschap : MS-CHAP2-Response is incorrect (0) [mschap] = reject (0) } # Auth-Type MS-CHAP = reject (0) Failed to authenticate the user I did a lot of try-and-error with suffix ans Strip and configuring, but i can't get mschap to work. How can I teach mschap to work with "user(a)thedomain.net"? BTW: The radcheck-table contains simply "username" with no realms, and that cannot be changed. The second question is about proxying. Since the is only one RADIUS-Server, proxying is not needed. I wonder if i really have to add a realm and proxy the request to localhost. Is there a way to say "Hey, just answer all queries with @thedomain.org and don't proxy it to yourself"? Thanks for your help and suggestions. Heiko

4 3

Re: Re: Multiple attributes on radgroupreply! (Suman Dash)
by Haviaras Kostas 02 Dec '14

02 Dec '14

Thanks for your answer Suman Dash, it is good tip! But I still have the same problem. On Tue, Dec 2, 2014 at 11:52 AM, < freeradius-users-request(a)lists.freeradius.org> wrote: Message: 3 Date: Tue, 2 Dec 2014 10:42:59 +0200 From: Haviaras Kostas <koshalirod(a)gmail.com> To: freeradius-users(a)lists.freeradius.org Subject: Multiple attributes on radgroupreply! Message-ID: <CAMALVUPB597EAUOfEwi-ctFb7AC1QetcsH9DYV8Oavn4q_1eJg(a)mail.gmail.com> Content-Type: text/plain; charset="utf-8" Hello, I have the following problem, I would like to set download and upload limit on Mitrotik, from my freeradius and only 1 attribute from the radgroupreply is sended to Mitrotik. I am using MySQL. I insert on the radcheck this: id username attribute op value 31 kostas3 Cleartext-Password := 1234 On the radusergroup: id username groupname priority 44 kostas3 d16M 8 45 kostas3 u2M 8 On the radgroupreply: id groupname attribute op value 8 u2M WISPr-Bandwidth-Max-Up := 2097152 17 d16M WISPr-Bandwidth-Max-Down := 16777216 And here is my log from the freeradius: http://pastebin.com/Lifi6jdL I have any syntax wrong? Thanks for your attention and time!

1 0

Multiple attributes on radgroupreply!
by Haviaras Kostas 02 Dec '14

02 Dec '14

Hello, I have the following problem, I would like to set download and upload limit on Mitrotik, from my freeradius and only 1 attribute from the radgroupreply is sended to Mitrotik. I am using MySQL. I insert on the radcheck this: id username attribute op value 31 kostas3 Cleartext-Password := 1234 On the radusergroup: id username groupname priority 44 kostas3 d16M 8 45 kostas3 u2M 8 On the radgroupreply: id groupname attribute op value 8 u2M WISPr-Bandwidth-Max-Up := 2097152 17 d16M WISPr-Bandwidth-Max-Down := 16777216 And here is my log from the freeradius: http://pastebin.com/Lifi6jdL I have any syntax wrong? Thanks for your attention and time!

2 1

Re: 4. Freeradius version 2.1.12 with TTLS support (Prasad Jadhav)
by Rui Ribeiro 01 Dec '14

01 Dec '14

Hi Prasad, Do not use 2.1.12, it is old and has known bugs. Install 2.2.6. You are not telling us what protocol you are using to authenticate. For TTLS, you do not need certificates installed on the client side, only for EAP-TLS. However, I what you probably want is really EAP-TTLS; decide what backend are you using to authenticate and elaborate better your next question please. Regards, -- Rui Ribeiro Senior Sysadm ISCTE-IUL https://www.linkedin.com/pub/rui-ribeiro/16/ab8/434 > ------------------------------ > > Message: 4 > Date: Thu, 20 Nov 2014 04:37:33 +0000 > From: Prasad Jadhav <Prasad.Jadhav(a)alepo.com> > To: "freeradius-users(a)lists.freeradius.org" > <freeradius-users(a)lists.freeradius.org> > Subject: Freeradius version 2.1.12 with TTLS support > Message-ID: > < > b223a7693f66454f8160761343be73be(a)BY1PR0801MB0983.namprd08.prod.outlook.com > > > > Content-Type: text/plain; charset="us-ascii" > > Hi, > > I configured the freeradius version 2.1.12 with TTLS support. > > Note: for testing purpose using self signed certificate > > having following question > > 1. do I need to create certificate for per client machine base or per > client username base. > > 2. Which certificates need to install on client side (OS: Windows 8) for > TTLS > > > Regards, > Prasad Jadhav > >

2 2

Version 3.0.4 sql groups handling issue
by Philippe MARASSE 28 Nov '14

28 Nov '14

Hello, I'm upgrading from FR 3.0.0 to 3.0.4, during the tests, I've ran into an issue : - My NAS are sorted into 2 different huntgroups - My users are members of 2 SQL groups - Each SQL group is attached to one huntgroup Under v3.0.4 group processing stops when the first group get processed whether huntgroup matches or not. I think I've found the culprit line 621 in rlm_sql.c, the continue instruction skips lines 659 & 660 : pairdelete(&request->packet->vps, PW_SQL_GROUP, 0, TAG_ANY); entry = entry->next; As far as Fall-Through's default value has changed from 1 in v3.0.0 to FALL_THROUGH_DEFAULT (0), my second group never get processed. Another test : I've added Fall-Through = Yes into my radreply table : bang, infinite loop on the first group ! From my log : rlm_sql (sql): Executing query: 'SELECT id, groupname, attribute, Value, op FROM radgroupcheck WHERE groupname = 'pcs-sites' ORDER BY id' (1) sql : EXPAND SELECT id, groupname, attribute, Value, op FROM radgroupcheck WHERE groupname = '%{Sql-Group}' ORDER BY id (1) sql : --> SELECT id, groupname, attribute, Value, op FROM radgroupcheck WHERE groupname = 'pcs-sites' ORDER BY id rlm_sql (sql): Executing query: 'SELECT id, groupname, attribute, Value, op FROM radgroupcheck WHERE groupname = 'pcs-sites' ORDER BY id' (1) sql : EXPAND SELECT id, groupname, attribute, Value, op FROM radgroupcheck WHERE groupname = '%{Sql-Group}' ORDER BY id (1) sql : --> SELECT id, groupname, attribute, Value, op FROM radgroupcheck WHERE groupname = 'pcs-sites' ORDER BY id rlm_sql (sql): Executing query: 'SELECT id, groupname, attribute, Value, op FROM radgroupcheck WHERE groupname = 'pcs-sites' ORDER BY id' (1) sql : EXPAND SELECT id, groupname, attribute, Value, op FROM radgroupcheck WHERE groupname = '%{Sql-Group}' ORDER BY id (1) sql : --> SELECT id, groupname, attribute, Value, op FROM radgroupcheck WHERE groupname = 'pcs-sites' ORDER BY id rlm_sql (sql): Executing query: 'SELECT id, groupname, attribute, Value, op FROM radgroupcheck WHERE groupname = 'pcs-sites' ORDER BY id' (1) sql : EXPAND SELECT id, groupname, attribute, Value, op FROM radgroupcheck WHERE groupname = '%{Sql-Group}' ORDER BY id (1) sql : --> SELECT id, groupname, attribute, Value, op FROM radgroupcheck WHERE groupname = 'pcs-sites' ORDER BY id rlm_sql (sql): Executing query: 'SELECT id, groupname, attribute, Value, op FROM radgroupcheck WHERE groupname = 'pcs-sites' ORDER BY id' (1) sql : EXPAND SELECT id, groupname, attribute, Value, op FROM radgroupcheck WHERE groupname = '%{Sql-Group}' ORDER BY id (1) sql : --> SELECT id, groupname, attribute, Value, op FROM radgroupcheck WHERE groupname = 'pcs-sites' ORDER BY id I can post the entire log if needed. BTW, I've got a look on github, branch 3.0.x, rlm_sql.c seems to have the same issue (continue on line 720, skipped lines 769 & 770). Regards. -- Philippe MARASSE Responsable pôle Infrastructures - DSIO Centre Hospitalier Henri Laborit CS 10587 - 370 avenue Jacques Coeur 86021 Poitiers Cedex Tel : 05.49.44.57.19

3 9

re:NAP
by Zulzig 27 Nov '14

27 Nov '14

Hello, sorry Alan, I give you the informations that you want. i created one table in my radius database. if the reply on radpostauth is like Access-Accept. the table store the username and the authdate. I added a trigger which it run each time, when a username tries to log on. the trigger makes a diff between the authdate.rapostauth and the authdate.newtable of the user. if the date is up to 20 days, the trigger add/modify the groupname.radusergroup of the user. at he result the radgroupreply should be different. but in my case, it's different, the add/update works very well, but this are the last parameters before the modification of the radusergroup table which are sent radgroupreply table, | id | groupname | attribute | op | value | | 1 | safe | Tunnel-type | = | 13 | | 2 |safe | Tunnel-Medium-Type | = | 6 | | 3 | safe | Tunnel-Private-Group-ID | = | 7 | | 5 | no-safe | Tunnel-type | = | 13 | | 6 | no-safe | Tunnel-Medium-Type | = | 6 | | 7 | no-safe | Tunnel-Private-Group-ID | = | 8 before radusergroup; username :toto | groupname: safe | priority: 1 last Access-Accept > 20 days radusergroup; username :toto | groupname: no-safe | priority: 1 radgroupreply safe instead of no-safe. i hope that i answer at yours last questions

1 0

Authenticate WPA enterprise from custom service
by Adnan Miljkovic 27 Nov '14

27 Nov '14

Hello, I am trying to authenticate wifi users by using WPA enterprise. So far I have a script in the module folder: exec checkuser { wait = yes input_pairs = request output_pairs = reply program = "/etc/raddb/check-user.php -log -debug '%{User-Name}' '%{User-Password}' '%{NAS-IP-Address}' '%{Called-Station-Id}' '%{Calling-Station-Id}' '%{Chap-Password}'" shell_escape = yes } Where I pass the username and password. The script does the rest. It works properly. In my site-enables/default in the authorize section as the last check I have this: update control { Auth-Type := CheckUser } When I test it by using: # radtest adnan myPassword localhost 0 testing123 I clearly get in my log: Found Auth-Type = CheckUser # Executing group from file /etc/raddb/sites-enabled/default +- entering group CheckUser {...} [checkuser] expand: '%{User-Name}' -> 'adnan' [checkuser] expand: '%{User-Password}' -> 'myPassword ' [checkuser] expand: '%{NAS-IP-Address}' -> '172.20.4.1' [checkuser] expand: '%{Called-Station-Id}' -> '' [checkuser] expand: '%{Calling-Station-Id}' -> '' [checkuser] expand: '%{Chap-Password}' -> '' And the value for password is shown in the %{User-Password} variable. So it is passed to my PHP script for further checks. But when I try to login from my Android device I do not get the password, it is empty. I am using the following settings on my Android device, MSCHAPV2, and adding the identity (my username) and password. Is it possible to get the password in plain text from the remote device? I am missing some concept here, is there another way of authentication for WPA enterprise? All help is much appreciated. Regards, Adnan

2 1

Freeradius mysql ippool duplicate IP's
by Wesley 26 Nov '14

26 Nov '14

Hi there, We are using FreeRADIUS Version 2.1.12 on CentOS 6 The problem we are getting is that we are getting duplicate IP address issues on our network when assigning IP's via the mysql ippool setup. Have looked through many forums & help boards but still no joy Please advise what information you require for you to assist me. Regards

4 13

Version 3.0.4 and Interim-Update
by Heiko O 26 Nov '14

26 Nov '14

Hi all, i'm trying out freeradius 3.0.4 and have problems with Interim-Accounts. I get (8) # Executing section accounting from file /etc/raddb/sites-enabled/default (8) accounting { (8) detail : EXPAND /var/log/radius/radacct/%{%{Packet-Src-IP-Address}:-%{Packet-Src-IPv6-Address}}/detail-%Y%m%d (8) detail : --> /var/log/radius/radacct/172.16.252.9/detail-20141126 (8) detail : /var/log/radius/radacct/%{%{Packet-Src-IP-Address}:-%{Packet-Src-IPv6-Address}}/detail-%Y%m%d expands to /var/log/radius/radacct/172.16.252.9/detail-20141126 (8) detail : EXPAND %t (8) detail : --> Wed Nov 26 12:56:50 2014 (8) [detail] = ok (8) sql : EXPAND %{tolower:type.%{%{Acct-Status-Type}:-none}.query} (8) sql : --> type.interim-update.query No such configuration item .type.interim-update.query (8) [sql] = fail (8) } # accounting = fail (8) Not sending reply (8) Finished request My question is: how and where can i find / activate or place this interim-update.query? I read the README, that the config could be patched - but i'd like to migrate as suggested. So, how do i configure Interim-Updates properly? Thanks, Heiko

2 1