- Freeradius-Users - lists.freeradius.org

Re: Re: Multiple attributes on radgroupreply! (Suman Dash)
by Haviaras Kostas 02 Dec '14

02 Dec '14

Thanks for your answer Suman Dash, it is good tip! But I still have the same problem. On Tue, Dec 2, 2014 at 11:52 AM, < freeradius-users-request(a)lists.freeradius.org> wrote: Message: 3 Date: Tue, 2 Dec 2014 10:42:59 +0200 From: Haviaras Kostas <koshalirod(a)gmail.com> To: freeradius-users(a)lists.freeradius.org Subject: Multiple attributes on radgroupreply! Message-ID: <CAMALVUPB597EAUOfEwi-ctFb7AC1QetcsH9DYV8Oavn4q_1eJg(a)mail.gmail.com> Content-Type: text/plain; charset="utf-8" Hello, I have the following problem, I would like to set download and upload limit on Mitrotik, from my freeradius and only 1 attribute from the radgroupreply is sended to Mitrotik. I am using MySQL. I insert on the radcheck this: id username attribute op value 31 kostas3 Cleartext-Password := 1234 On the radusergroup: id username groupname priority 44 kostas3 d16M 8 45 kostas3 u2M 8 On the radgroupreply: id groupname attribute op value 8 u2M WISPr-Bandwidth-Max-Up := 2097152 17 d16M WISPr-Bandwidth-Max-Down := 16777216 And here is my log from the freeradius: http://pastebin.com/Lifi6jdL I have any syntax wrong? Thanks for your attention and time!

1 0

Multiple attributes on radgroupreply!
by Haviaras Kostas 02 Dec '14

02 Dec '14

Hello, I have the following problem, I would like to set download and upload limit on Mitrotik, from my freeradius and only 1 attribute from the radgroupreply is sended to Mitrotik. I am using MySQL. I insert on the radcheck this: id username attribute op value 31 kostas3 Cleartext-Password := 1234 On the radusergroup: id username groupname priority 44 kostas3 d16M 8 45 kostas3 u2M 8 On the radgroupreply: id groupname attribute op value 8 u2M WISPr-Bandwidth-Max-Up := 2097152 17 d16M WISPr-Bandwidth-Max-Down := 16777216 And here is my log from the freeradius: http://pastebin.com/Lifi6jdL I have any syntax wrong? Thanks for your attention and time!

2 1

Re: 4. Freeradius version 2.1.12 with TTLS support (Prasad Jadhav)
by Rui Ribeiro 01 Dec '14

01 Dec '14

Hi Prasad, Do not use 2.1.12, it is old and has known bugs. Install 2.2.6. You are not telling us what protocol you are using to authenticate. For TTLS, you do not need certificates installed on the client side, only for EAP-TLS. However, I what you probably want is really EAP-TTLS; decide what backend are you using to authenticate and elaborate better your next question please. Regards, -- Rui Ribeiro Senior Sysadm ISCTE-IUL https://www.linkedin.com/pub/rui-ribeiro/16/ab8/434 > ------------------------------ > > Message: 4 > Date: Thu, 20 Nov 2014 04:37:33 +0000 > From: Prasad Jadhav <Prasad.Jadhav(a)alepo.com> > To: "freeradius-users(a)lists.freeradius.org" > <freeradius-users(a)lists.freeradius.org> > Subject: Freeradius version 2.1.12 with TTLS support > Message-ID: > < > b223a7693f66454f8160761343be73be(a)BY1PR0801MB0983.namprd08.prod.outlook.com > > > > Content-Type: text/plain; charset="us-ascii" > > Hi, > > I configured the freeradius version 2.1.12 with TTLS support. > > Note: for testing purpose using self signed certificate > > having following question > > 1. do I need to create certificate for per client machine base or per > client username base. > > 2. Which certificates need to install on client side (OS: Windows 8) for > TTLS > > > Regards, > Prasad Jadhav > >

2 2

Version 3.0.4 sql groups handling issue
by Philippe MARASSE 28 Nov '14

28 Nov '14

Hello, I'm upgrading from FR 3.0.0 to 3.0.4, during the tests, I've ran into an issue : - My NAS are sorted into 2 different huntgroups - My users are members of 2 SQL groups - Each SQL group is attached to one huntgroup Under v3.0.4 group processing stops when the first group get processed whether huntgroup matches or not. I think I've found the culprit line 621 in rlm_sql.c, the continue instruction skips lines 659 & 660 : pairdelete(&request->packet->vps, PW_SQL_GROUP, 0, TAG_ANY); entry = entry->next; As far as Fall-Through's default value has changed from 1 in v3.0.0 to FALL_THROUGH_DEFAULT (0), my second group never get processed. Another test : I've added Fall-Through = Yes into my radreply table : bang, infinite loop on the first group ! From my log : rlm_sql (sql): Executing query: 'SELECT id, groupname, attribute, Value, op FROM radgroupcheck WHERE groupname = 'pcs-sites' ORDER BY id' (1) sql : EXPAND SELECT id, groupname, attribute, Value, op FROM radgroupcheck WHERE groupname = '%{Sql-Group}' ORDER BY id (1) sql : --> SELECT id, groupname, attribute, Value, op FROM radgroupcheck WHERE groupname = 'pcs-sites' ORDER BY id rlm_sql (sql): Executing query: 'SELECT id, groupname, attribute, Value, op FROM radgroupcheck WHERE groupname = 'pcs-sites' ORDER BY id' (1) sql : EXPAND SELECT id, groupname, attribute, Value, op FROM radgroupcheck WHERE groupname = '%{Sql-Group}' ORDER BY id (1) sql : --> SELECT id, groupname, attribute, Value, op FROM radgroupcheck WHERE groupname = 'pcs-sites' ORDER BY id rlm_sql (sql): Executing query: 'SELECT id, groupname, attribute, Value, op FROM radgroupcheck WHERE groupname = 'pcs-sites' ORDER BY id' (1) sql : EXPAND SELECT id, groupname, attribute, Value, op FROM radgroupcheck WHERE groupname = '%{Sql-Group}' ORDER BY id (1) sql : --> SELECT id, groupname, attribute, Value, op FROM radgroupcheck WHERE groupname = 'pcs-sites' ORDER BY id rlm_sql (sql): Executing query: 'SELECT id, groupname, attribute, Value, op FROM radgroupcheck WHERE groupname = 'pcs-sites' ORDER BY id' (1) sql : EXPAND SELECT id, groupname, attribute, Value, op FROM radgroupcheck WHERE groupname = '%{Sql-Group}' ORDER BY id (1) sql : --> SELECT id, groupname, attribute, Value, op FROM radgroupcheck WHERE groupname = 'pcs-sites' ORDER BY id rlm_sql (sql): Executing query: 'SELECT id, groupname, attribute, Value, op FROM radgroupcheck WHERE groupname = 'pcs-sites' ORDER BY id' (1) sql : EXPAND SELECT id, groupname, attribute, Value, op FROM radgroupcheck WHERE groupname = '%{Sql-Group}' ORDER BY id (1) sql : --> SELECT id, groupname, attribute, Value, op FROM radgroupcheck WHERE groupname = 'pcs-sites' ORDER BY id I can post the entire log if needed. BTW, I've got a look on github, branch 3.0.x, rlm_sql.c seems to have the same issue (continue on line 720, skipped lines 769 & 770). Regards. -- Philippe MARASSE Responsable pôle Infrastructures - DSIO Centre Hospitalier Henri Laborit CS 10587 - 370 avenue Jacques Coeur 86021 Poitiers Cedex Tel : 05.49.44.57.19

3 9

re:NAP
by Zulzig 27 Nov '14

27 Nov '14

Hello, sorry Alan, I give you the informations that you want. i created one table in my radius database. if the reply on radpostauth is like Access-Accept. the table store the username and the authdate. I added a trigger which it run each time, when a username tries to log on. the trigger makes a diff between the authdate.rapostauth and the authdate.newtable of the user. if the date is up to 20 days, the trigger add/modify the groupname.radusergroup of the user. at he result the radgroupreply should be different. but in my case, it's different, the add/update works very well, but this are the last parameters before the modification of the radusergroup table which are sent radgroupreply table, | id | groupname | attribute | op | value | | 1 | safe | Tunnel-type | = | 13 | | 2 |safe | Tunnel-Medium-Type | = | 6 | | 3 | safe | Tunnel-Private-Group-ID | = | 7 | | 5 | no-safe | Tunnel-type | = | 13 | | 6 | no-safe | Tunnel-Medium-Type | = | 6 | | 7 | no-safe | Tunnel-Private-Group-ID | = | 8 before radusergroup; username :toto | groupname: safe | priority: 1 last Access-Accept > 20 days radusergroup; username :toto | groupname: no-safe | priority: 1 radgroupreply safe instead of no-safe. i hope that i answer at yours last questions

1 0

Authenticate WPA enterprise from custom service
by Adnan Miljkovic 27 Nov '14

27 Nov '14

Hello, I am trying to authenticate wifi users by using WPA enterprise. So far I have a script in the module folder: exec checkuser { wait = yes input_pairs = request output_pairs = reply program = "/etc/raddb/check-user.php -log -debug '%{User-Name}' '%{User-Password}' '%{NAS-IP-Address}' '%{Called-Station-Id}' '%{Calling-Station-Id}' '%{Chap-Password}'" shell_escape = yes } Where I pass the username and password. The script does the rest. It works properly. In my site-enables/default in the authorize section as the last check I have this: update control { Auth-Type := CheckUser } When I test it by using: # radtest adnan myPassword localhost 0 testing123 I clearly get in my log: Found Auth-Type = CheckUser # Executing group from file /etc/raddb/sites-enabled/default +- entering group CheckUser {...} [checkuser] expand: '%{User-Name}' -> 'adnan' [checkuser] expand: '%{User-Password}' -> 'myPassword ' [checkuser] expand: '%{NAS-IP-Address}' -> '172.20.4.1' [checkuser] expand: '%{Called-Station-Id}' -> '' [checkuser] expand: '%{Calling-Station-Id}' -> '' [checkuser] expand: '%{Chap-Password}' -> '' And the value for password is shown in the %{User-Password} variable. So it is passed to my PHP script for further checks. But when I try to login from my Android device I do not get the password, it is empty. I am using the following settings on my Android device, MSCHAPV2, and adding the identity (my username) and password. Is it possible to get the password in plain text from the remote device? I am missing some concept here, is there another way of authentication for WPA enterprise? All help is much appreciated. Regards, Adnan

2 1

Freeradius mysql ippool duplicate IP's
by Wesley 26 Nov '14

26 Nov '14

Hi there, We are using FreeRADIUS Version 2.1.12 on CentOS 6 The problem we are getting is that we are getting duplicate IP address issues on our network when assigning IP's via the mysql ippool setup. Have looked through many forums & help boards but still no joy Please advise what information you require for you to assist me. Regards

4 13

Version 3.0.4 and Interim-Update
by Heiko O 26 Nov '14

26 Nov '14

Hi all, i'm trying out freeradius 3.0.4 and have problems with Interim-Accounts. I get (8) # Executing section accounting from file /etc/raddb/sites-enabled/default (8) accounting { (8) detail : EXPAND /var/log/radius/radacct/%{%{Packet-Src-IP-Address}:-%{Packet-Src-IPv6-Address}}/detail-%Y%m%d (8) detail : --> /var/log/radius/radacct/172.16.252.9/detail-20141126 (8) detail : /var/log/radius/radacct/%{%{Packet-Src-IP-Address}:-%{Packet-Src-IPv6-Address}}/detail-%Y%m%d expands to /var/log/radius/radacct/172.16.252.9/detail-20141126 (8) detail : EXPAND %t (8) detail : --> Wed Nov 26 12:56:50 2014 (8) [detail] = ok (8) sql : EXPAND %{tolower:type.%{%{Acct-Status-Type}:-none}.query} (8) sql : --> type.interim-update.query No such configuration item .type.interim-update.query (8) [sql] = fail (8) } # accounting = fail (8) Not sending reply (8) Finished request My question is: how and where can i find / activate or place this interim-update.query? I read the README, that the config could be patched - but i'd like to migrate as suggested. So, how do i configure Interim-Updates properly? Thanks, Heiko

2 1

How to enable/disable log 'Error: Ignoring request to authentication address...'
by Christian Springer 25 Nov '14

25 Nov '14

Hello, I'm receiving radius requests from a client not in the clients.conf, but the log message is not appearing. Is there a way to enable/disable that message ? It seems I've disabled the log output somehow... Thank you, regards Chris

3 2

rlm_cache updates for v3.0.x
by Arran Cudbard-Bell 25 Nov '14

25 Nov '14

The rlm_cache module will act as described in the notes in raddb/cache in v3.0.x. The main change between 3.0.5 rlm_cache and 3.0.6 rlm_cache are that it will return different rcodes for different cache states. In <= v3.0.5 ------------ The module returns "ok" if it found a cache entry. The module returns "updated" if it added a new cache entry. The module returns "noop" if it did nothing. In >= v3.0.6 ------------ The module returns "ok" if it found or created a cache entry. The module returns "updated" if it merged a cached entry. The module returns "noop" if it did nothing. The module returns "fail" on error. The full list of return code for the various runtime options are documented here: https://github.com/FreeRADIUS/freeradius-server/blob/v3.0.x/raddb/mods-avai… The second change is that the cache module will now default to *not* merging the cached attributes back into the current request when creating a cache entry. You can still force the server to do this by setting control:Cache-Merge := yes. The original reason for merging the Cache-Entry into the current request was so that the results of xlat expansions performed by the cache module would be available. Almost no one used the rlm_cache module to cache the results of xlat expansions however, and the behaviour had some odd side effects when working with attribute references, so it seems more sensible to leave it disabled by default. If anyone has any objections to the above behaviour changes, feel free to post them to the list. We also decided that the multivalued conditions were pretty useful and should be pulled into v3.0.x as well. The test coverage of the condition parser/evaluator is good, we don't expect any issues with it. Testing of current v3.0.x branch would be appreciated. -Arran Arran Cudbard-Bell <a.cudbardb(a)freeradius.org> FreeRADIUS development team FD31 3077 42EC 7FCD 32FE 5EE2 56CF 27F9 30A8 CAA2

2 2