- Freeradius-Users - lists.freeradius.org

Version 3.0.4 and Interim-Update
by Heiko O 26 Nov '14

26 Nov '14

Hi all, i'm trying out freeradius 3.0.4 and have problems with Interim-Accounts. I get (8) # Executing section accounting from file /etc/raddb/sites-enabled/default (8) accounting { (8) detail : EXPAND /var/log/radius/radacct/%{%{Packet-Src-IP-Address}:-%{Packet-Src-IPv6-Address}}/detail-%Y%m%d (8) detail : --> /var/log/radius/radacct/172.16.252.9/detail-20141126 (8) detail : /var/log/radius/radacct/%{%{Packet-Src-IP-Address}:-%{Packet-Src-IPv6-Address}}/detail-%Y%m%d expands to /var/log/radius/radacct/172.16.252.9/detail-20141126 (8) detail : EXPAND %t (8) detail : --> Wed Nov 26 12:56:50 2014 (8) [detail] = ok (8) sql : EXPAND %{tolower:type.%{%{Acct-Status-Type}:-none}.query} (8) sql : --> type.interim-update.query No such configuration item .type.interim-update.query (8) [sql] = fail (8) } # accounting = fail (8) Not sending reply (8) Finished request My question is: how and where can i find / activate or place this interim-update.query? I read the README, that the config could be patched - but i'd like to migrate as suggested. So, how do i configure Interim-Updates properly? Thanks, Heiko

2 1

How to enable/disable log 'Error: Ignoring request to authentication address...'
by Christian Springer 25 Nov '14

25 Nov '14

Hello, I'm receiving radius requests from a client not in the clients.conf, but the log message is not appearing. Is there a way to enable/disable that message ? It seems I've disabled the log output somehow... Thank you, regards Chris

3 2

rlm_cache updates for v3.0.x
by Arran Cudbard-Bell 25 Nov '14

25 Nov '14

The rlm_cache module will act as described in the notes in raddb/cache in v3.0.x. The main change between 3.0.5 rlm_cache and 3.0.6 rlm_cache are that it will return different rcodes for different cache states. In <= v3.0.5 ------------ The module returns "ok" if it found a cache entry. The module returns "updated" if it added a new cache entry. The module returns "noop" if it did nothing. In >= v3.0.6 ------------ The module returns "ok" if it found or created a cache entry. The module returns "updated" if it merged a cached entry. The module returns "noop" if it did nothing. The module returns "fail" on error. The full list of return code for the various runtime options are documented here: https://github.com/FreeRADIUS/freeradius-server/blob/v3.0.x/raddb/mods-avai… The second change is that the cache module will now default to *not* merging the cached attributes back into the current request when creating a cache entry. You can still force the server to do this by setting control:Cache-Merge := yes. The original reason for merging the Cache-Entry into the current request was so that the results of xlat expansions performed by the cache module would be available. Almost no one used the rlm_cache module to cache the results of xlat expansions however, and the behaviour had some odd side effects when working with attribute references, so it seems more sensible to leave it disabled by default. If anyone has any objections to the above behaviour changes, feel free to post them to the list. We also decided that the multivalued conditions were pretty useful and should be pulled into v3.0.x as well. The test coverage of the condition parser/evaluator is good, we don't expect any issues with it. Testing of current v3.0.x branch would be appreciated. -Arran Arran Cudbard-Bell <a.cudbardb(a)freeradius.org> FreeRADIUS development team FD31 3077 42EC 7FCD 32FE 5EE2 56CF 27F9 30A8 CAA2

2 2

Question about SQL fail open in post-auth and keyed-balance use in load balancing configuration
by John Douglass 24 Nov '14

24 Nov '14

Question 1: I thought I once read how to add this "fail open" in regards to using an SQL module. I have a table that gets updated after an auth, but if the DB is slow or there is a network issue, I want it to go on. It's not vital to auth the user, just using it as a "location update" of sorts. Is this the correct configuration for this behavior? post-auth { redundant { sql_location handled } } Question 2: I am experimenting with load balancing. I read the comments about keyed-balance: # keyed-balance - the home server is chosen by hashing (FNV) the contents of the Load-Balance-Key attribute from the control items. The request is then sent to home server # chosen by taking: # server = (hash % num_servers_in_pool). # # If there is no Load-Balance-Key in the control items, the load balancing method is identical to "load-balance". # # For most non-EAP authentication methods, The User-Name attribute provides a good key. An "unlang" policy can be used to copy the User-Name to the Load-Balance-Key # attribute. This method may not work for EAP sessions, as the User-Name outside of the TLS tunnel is often static, e.g. "anonymous@realm". If the username is a bad choice, I figured that the Calling-Station-Id (which in my case is the client MAC) would be a way to consistently have the same Load-Balance-Key. I am adding this to my server {} section: pre-proxy { update control { Load-Balance-Key := "%{Calling-Station-Id}" } updated } But I am only seeing use of one of the defined proxy servers as defined in my "home_server_pool {}" section when I force auth's to this server. Would not expect every MAC address to hash to the same radius back end given the variation of MAC addresses: home_server = vm1 home_server = vm2 Is the above pre-proxy{} segment doing what I think it should do? Update the Load-Balance-Key to the control before it hits the proxy segment? Just want some confirmation that I am on the right track or I am going about this wrong (or if what I'm trying is not a good idea/possible). Thanks! - John Douglass, Sr. Systems IT/Architect, Georgia Institute of Technology

2 1

Segmentaton fault in 3.0.5
by nicolas.clo＠ricoh-industrie.fr 24 Nov '14

24 Nov '14

Hi list, Since 3.0.5 ( FreeRADIUS Version 3.0.5 (git #8bc2d13), for host i486-pc-linux-gnu,) Program received signal SIGSEGV, Segmentation fault. 0xb7a45287 in eappeap_process () from /usr/lib/freeradius/rlm_eap_peap.so (gdb) bt #0 0xb7a45287 in eappeap_process () from /usr/lib/freeradius/rlm_eap_peap.so #1 0xb7a433f9 in ?? () from /usr/lib/freeradius/rlm_eap_peap.so #2 0xb7a57ea6 in ?? () from /usr/lib/freeradius/rlm_eap.so #3 0xb7a58268 in eap_method_select () from /usr/lib/freeradius/rlm_eap.so #4 0xb7a57100 in ?? () from /usr/lib/freeradius/rlm_eap.so #5 0x0806af04 in ?? () #6 0x0806a2c0 in ?? () #7 0x0806a534 in ?? () #8 0x0806b55a in modcall () #9 0x08066467 in indexed_modcall () #10 0x080672eb in process_authenticate () #11 0x08055d3d in rad_authenticate () #12 0x08079eb7 in ?? () #13 0x0807597d in ?? () #14 0x08077d87 in request_receive () #15 0x08060bfd in ?? () #16 0x080743af in ?? () #17 0xb7fa6799 in fr_event_loop () from /usr/lib/freeradius/libfreeradius-radius.so #18 0x0807add3 in radius_event_process () #19 0x08054859 in main () Nicolas CLO

3 4

RADIUS Server Authorization and Accounting - MY SQL Configuration - Please Help
by anusha mule 24 Nov '14

24 Nov '14

Hi, We have the following understanding RADIUS Authentication and Accounting flow :- 1. When the Access-request from the NAS, Server will search in the radcheck table to check the attributes for the user. 2. If check attributes are found and its matches to the user, then the server will pull the reply items (Attributes like Bandwidth, Volume, Timeout, etc) from the radreply table for this user and add it in the Access-Accept packet. 3. On receiving Access-Accept packet, session will get established for the user and Accounting-Start message will get transmitted to the Server. 4. The server will update the radacct table with Accounting start message. 5. When the station get disconnected, Session should get deleted and Accounting-Stop message should sent to the Server including user statistics (like Session-time, input-octets, output-octets, etc)in it. 6. Server will update the radacct table with all the attributed present in the STOP message. With let us consider the following simple scenario :- RADIUS Server having User details as User Name = Joe Password = Joe123 Timeout = 30000 Secs Step 1: During the initial connect - User should be authenticated and Access-Accept should contains the attribute value as 30000 Secs, mentioning the max duration that the user session is allowed. Once the session is established, RADIUS Accounting Start message is send to RADIUS server. Next let us say, User has been disconnected after 20000 Secs. Again, the RADIUS Accounting Stop message with the consumed duration of 20000 Secs shall be send to the RADIUS Server. Step 2: Now, when the same user tries to authenticate, he should be authenticated and the Access-Accept provide the Timeout attribute as 10000 Secs ( i.e. 30000 Secs – 20000 Secs) Here, let us assume the user used the full session duration and get time out. Again, the RADIUS Accounting Stop message with the consumed duration of 10000 Secs shall be send to the RADIUS Server. Step 3: Now, when the same user tries to authenticate, he should be rejected. How can the above be achieved using radius server configurations. Kindly help us in this. Thanks in advance. Thank you & Regards, Anusha M

4 8

patch where?: WARNING: Child is hung for request XXXX in component <core> module (2.2.5)
by Jonathan 23 Nov '14

23 Nov '14

Where can i find the patch as the 2.x.x checkout doesnt contain it yet On Friday, November 21, 2014, Alan DeKok <aland(a)deployingradius.com> wrote: > Jonathan wrote: > > The problem we are having is that whenever a radius proxy server > > (outside of our control: eduroam national home server) doesn't respond > > in time, we get the following messages blocking freeradius: > > > > Fri Nov 21 17:02:07 2014 : Error: Internal sanity check failed for > > child state <= NEW MESSAGE since 2.2.6 > > That means the following has happened: > > - the server proxied a request to a home server > - eventually, the server gives up, and uses Post-Proxy-Type Fail > - while it's running that, the home server replies. > > > Fri Nov 21 17:02:07 2014 : Error: Reply from home server A.B.C.D port > > 1812 - ID: 84 arrived too late for request 11986. Try increasing > > 'retry_delay' or 'max_request_time' > > Fri Nov 21 17:02:18 2014 : Error: WARNING: Unresponsive thread 11986 > > for request 0, in component <core> module > > Fri Nov 21 17:02:19 2014 : Info: WARNING: Child is hung for request > > 11986 in component <core> module . > > That's wrong... it means that the request isn't being processed > through a module, BUT the server core thinks that a thread is still > processing it. > > Hmm... please try the v2.x.x branch: > > https://github.com/FreeRADIUS/freeradius-server/archive/v2.x.x.zip > > I've found one thing which makes me go "Huh?" > > Hopefully that should fix it. > > Alan DeKok. > - > List info/subscribe/unsubscribe? See > http://www.freeradius.org/list/users.html >

2 6

rlm_ippool: Deallocated entry for ip/port
by Akira Yata 22 Nov '14

22 Nov '14

Hi all! I have a problem with freeradius1.1 or NAS. " Deallocated entry for ip/port " messages were shown in some users. IP address that were shown as deallocated entry ip addresses were allocated as framed-ip-address for differenet user, but some were not allocated as framed-ip-address. I'm searching cause of this problem for few days. I'm sorry with my terrible English and silly query. if you need more information plese let me know. Any advice will help me,Thanks in advance. debug log is below Sending Accounting-Response of id 140 to 192.168.11.1 port 50016 rad_recv: Accounting-Request packet from host 192.168.11.1:50016, id=141, length=247 Acct-Status-Type = Stop User-Name = "aaa@.or.jp" Event-Timestamp = "Nov 22 2014 12:00:54 JST" Acct-Delay-Time = 3 NAS-Identifier = "cisco" Acct-Session-Id = "erx FastEthernet 1/6.3:0:0029047976" NAS-IP-Address = 192.168.11.1 Service-Type = Framed-User Calling-Station-Id = "#cisco#E16#0" Acct-Input-Gigawords = 0 Acct-Input-Octets = 0 Acct-Output-Gigawords = 0 Acct-Output-Octets = 0 ERX-Input-Gigapkts = 0 Acct-Input-Packets = 0 ERX-Output-Gigapkts = 0 Acct-Output-Packets = 0 NAS-Port-Type = Ethernet NAS-Port = 369098752 NAS-Port-Id = "FastEthernet 1/6.3:0" Acct-Session-Time = 0 Acct-Terminate-Cause = User-Error rlm_radutmp: Logout for NAS 192.168.11.1 port 369098752, but no Login record rlm_ippool: Searching for an entry for nas/port: 192.168.11.1/369098752 rlm_ippool: Deallocated entry for ip/port: 10.10.10.1/369098752 Sending Accounting-Response of id 142 to 192.168.11.1 port 50016 rad_recv: Accounting-Request packet from host 192.168.11.1:50016, id=143, length=242 Acct-Status-Type = Stop User-Name = "bbb@.or.jp" Event-Timestamp = "Nov 22 2014 12:00:54 JST" Acct-Delay-Time = 3 NAS-Identifier = "cisco" Acct-Session-Id = "erx FastEthernet 1/6.3:0:0029047977" NAS-IP-Address = 192.168.11.1 Service-Type = Framed-User Calling-Station-Id = "#cisco#E16#0" Acct-Input-Gigawords = 0 Acct-Input-Octets = 0 Acct-Output-Gigawords = 0 Acct-Output-Octets = 0 ERX-Input-Gigapkts = 0 Acct-Input-Packets = 0 ERX-Output-Gigapkts = 0 Acct-Output-Packets = 0 NAS-Port-Type = Ethernet NAS-Port = 369098752 NAS-Port-Id = "FastEthernet 1/6.3:0" Acct-Session-Time = 0 Acct-Terminate-Cause = User-Error rlm_radutmp: Logout for NAS 192.168.11.1 port 369098752, but no Login record rlm_ippool: Searching for an entry for nas/port: 192.168.11.1/369098752 rlm_ippool: Deallocated entry for ip/port: 10.10.10.1/369098752 Sending Accounting-Response of id 143 to 192.168.11.1 port 50016 rad_recv: Accounting-Request packet from host 192.168.11.1:50016, id=144, length=240 Acct-Status-Type = Stop User-Name = "ccc@.or.jp" Event-Timestamp = "Nov 22 2014 12:00:54 JST" Acct-Delay-Time = 3 NAS-Identifier = "cisco" Acct-Session-Id = "erx FastEthernet 1/5:0029047978" NAS-IP-Address = 192.168.11.1 Service-Type = Framed-User Calling-Station-Id = "#cisco#E15#0" Acct-Input-Gigawords = 0 Acct-Input-Octets = 0 Acct-Output-Gigawords = 0 Acct-Output-Octets = 0 ERX-Input-Gigapkts = 0 Acct-Input-Packets = 0 ERX-Output-Gigapkts = 0 Acct-Output-Packets = 0 NAS-Port-Type = Ethernet NAS-Port = 352321536 NAS-Port-Id = "FastEthernet 1/5" Acct-Session-Time = 0 Acct-Terminate-Cause = User-Error rlm_radutmp: Logout for NAS 192.168.11.1 port 352321536, but no Login record rlm_ippool: Searching for an entry for nas/port: 192.168.11.1/352321536 rlm_ippool: Deallocated entry for ip/port: 10.10.10.2/352321536 Sending Accounting-Response of id 144 to 192.168.11.1 port 50016 rad_recv: Accounting-Request packet from host 192.168.11.1:50016, id=145, length=249 Acct-Status-Type = Stop User-Name = "ddd@.or.jp" Event-Timestamp = "Nov 22 2014 12:00:54 JST" Acct-Delay-Time = 3 NAS-Identifier = "cisco" Acct-Session-Id = "erx FastEthernet 1/6.2:102:0029047979" NAS-IP-Address = 192.168.11.1 Service-Type = Framed-User Calling-Station-Id = "#cisco#E16#102" Acct-Input-Gigawords = 0 Acct-Input-Octets = 0 Acct-Output-Gigawords = 0 Acct-Output-Octets = 0 ERX-Input-Gigapkts = 0 Acct-Input-Packets = 0 ERX-Output-Gigapkts = 0 Acct-Output-Packets = 0 NAS-Port-Type = Ethernet NAS-Port = 369098854 NAS-Port-Id = "FastEthernet 1/6.2:102" Acct-Session-Time = 0 Acct-Terminate-Cause = User-Error rlm_radutmp: Logout for NAS 192.168.11.1 port 369098854, but no Login record rlm_ippool: Searching for an entry for nas/port: 192.168.11.1/369098854 rlm_ippool: Deallocated entry for ip/port: 210.229.182.164/369098854

2 1

info: WARNING: Child is hung for request XXXX in component <core> module (2.2.5)
by Jonathan 22 Nov '14

22 Nov '14

Hi we regulary get these messages since we upgraded from 2.2.3 to 2.2.5 I have attached the GDB log as i'm no developper expert to find out what's going on... Hopefully someone can help us out with this <SOME INFO> We are running Debian 7.7 x64 Linux 3.2.0-4-amd64 (radius1) 10/22/2014 _x86_64_ (8 CPU) avg-cpu: %user %nice %system %iowait %steal %idle 0.24 0.00 0.11 0.10 0.00 99.56 Device: tps kB_read/s kB_wrtn/s kB_read kB_wrtn cciss/c0d0 163.25 9.31 1491.34 3263611 522909360 <RADIUS LOGS> Wed Oct 22 16:35:35 2014 : Error: Discarding duplicate request from client telenet-81.82.0.0/15 port 3072 - ID: 226 due to unfinished request 2664227 Wed Oct 22 16:35:37 2014 : Error: WARNING: Unresponsive thread 2664227 for request 0, in component <core> module Wed Oct 22 16:35:38 2014 : Info: WARNING: Child is hung for request 2664227 in component <core> module . Attached a debug with command, "echo 'thread apply all bt full' > /tmp/gdb_cmd; gdb --pid `cat /var/run/freeradius/freeradius.pid` -batch -x /tmp/gdb_cmd > gdb_bt; gzip gdb_bt" Hopefully this brings something useful, as previous debug to devel list didnt show the reason.

4 11

UserDN escape problem and Group membership checking in 3.0.3
by Winders, Timothy A 21 Nov '14

21 Nov '14

I have FreeRadius 3.0.3 installed on Ubuntu 14.0.4 (free radius 3.0.3-ppa1~trustry package) I have everything setup with Active Directory for user authentication. This is working correctly, but I am having a problem with Active Directory group membership checking. It appears the problem is with the way FreeRadius escapes the UserDN when doing the query. I have tried various ldap configuration options, none of which quite work. If I remove all the filter settings from the group checking and only use the membership_attribute = "memberOf", I get the following Invalid DN syntax error: rlm_ldap (ldap): Bind successful (11) User object found at DN "CN=Winders\, Tim (0552),OU=Students,OU=SPC,DC=southplainscollege,DC=edu" (11) Checking user object membership (memberOf) attributes (11) Waiting for bind result... (11) Bind successful (11) Performing unfiltered search in 'CN=Winders, Tim (0552),OU=Students,OU=SPC,DC=southplainscollege,DC=edu', scope 'base' (11) Waiting for search result... (11) ERROR: Failed performing search: Invalid DN syntax (11) ERROR: Server said: 0000208F: NameErr: DSID-031001F7, problem 2006 (BAD_NAME), data 8350, best match of: 'CN=Winders, Tim (0552),OU=Students,OU=SPC,DC=southplainscollege,DC=edu' . Notice the first User object found has the correct DN, with the comma in the CN= attribute escaped. This is the way the DN is stored in Active Directory. However, when doing the unfiltered search, the comma is no longer escaped resulting in the Invalid DN syntax. If I remove the membership_attribute and do the member checking in the group, I don¹t get the invalid DN (as the DN is no longer being searched), but the UserDn attribute is escaped differently rlm_ldap (ldap): Bind successful (11) User object found at DN "CN=Winders\, Tim (0552),OU=Students,OU=SPC,DC=southplainscollege,DC=edu" (11) Checking for user in group objects (11) EXPAND (&(objectClass=group)(member=%{control:Ldap-UserDn})) (11) --> (&(objectClass=group)(member=CN\3dWinders\2c Tim \280552\29\2cOU\3dStudents\2cOU\3dSPC\2cDC\3dsouthplainscollege\2cDC\3dedu) ) (11) Waiting for bind result... (11) Bind successful (11) Performing search in 'CN=Students Security Group,OU=Standard Groups,OU=Groups,OU=SPC,DC=southplainscollege,DC=edu' with filter '(&(objectClass=group)(member=CN\3dWinders\2c Tim \280552\29\2cOU\3dStudents\2cOU\3dSPC\2cDC\3dsouthplainscollege\2cDC\3dedu) )', scope 'sub' (11) Waiting for search result... (11) Search returned no results (11) Search returned not found Again, notice the successful user object found with the correct DN, but when doing the expansion of control:Ldap-UserDn the resulting DN is badly mangled. I found lots of information in the archives about UserDn escaping, but nothing current and no helpful information on how to fix this. Suggestions? -- Tim Winders Associate Dean of Information Technology South Plains College (806) 716-2369

6 18