- Freeradius-Users - lists.freeradius.org

Sqlcounter fail over
by Emanuele Fia 29 Sep '14

29 Sep '14

Dear Freeradius Users, I need some help in my freeradius configuration. radusergroup +---------------------+---------------------+----------+ | username | groupname | priority | +---------------------+---------------------+----------+ | 1aaaaaaaaa1228721nx | offertaA_unlimited | 1 | | 1aaaaaaaaa1228721nx | offertaA_limited | 2 | +---------------------+---------------------+----------+ radgroupcheck +----+---------------------+-----------------------+----+---------+ | id | groupname | attribute | op | value | +----+---------------------+-----------------------+----+---------+ | 35 | offertaA_unlimited | Max-Monthly-TrafficIN | := | 5000000 | +----+---------------------+-----------------------+----+---------+ radgroupreply +-----+---------------------+---------------------+----+------------+ | id | groupname | attribute | op | value | +-----+---------------------+---------------------+----+------------+ | 207 | offertaA_unlimited | Fall-Through | = | yes | | 205 | offertaA_unlimited | Rate-Limit | = | 2048k/512k | | 211 | offertaA_limited | Fall-Through | = | yes | | 209 | offertaA_limited | Rate-Limit | = | 100k/100k | +-----+---------------------+---------------------+----+------------+ My goal is that user '1aaaaaaaaa1228721nx' use the group 'offertaA_unlimited' until the attribute 'Max-Monthly-TrafficIN' ( sqlcounter ) reach the value and after this radius reply with settings of the group 'offertaA_limited' Now happen that when sqlcounter 'Max-Monthly-TrafficIN' reach the value set in radgroupreply return auth reject. Probably there is something to do in policy.conf, i have done some test without results =( Thank you for help, Emanuele

3 8

FreeRADIUS using Active Directory integration broken without any traces
by Vinícius Ferrão 29 Sep '14

29 Sep '14

Hello guys, I've a FreeBSD 10.0 server running FreeRADIUS 3 and things got broken without any apparent reason. I'm using Winbind from Samba4 to authenticate with ntlm_auth. I've done some debug to solve the problem, but I was unable to find where is the problem. ntlm_auth is working: # ntlm_auth --username=ferrao --request-nt-key # Password: # NT_STATUS_OK: Success (0x0) But RADIUS fails when doing EAP-PEAP authentication, and running FreeRADIUS in debug mode this is the error message: # (9) mschap : Executing: /usr/local/bin/ntlm_auth --request-nt-key --username=%{%{Stripped-User-Name}:-%{%{User-Name}:-None}} --challenge=%{%{mschap:Challenge}:-00} --nt-response=%{%#{mschap:NT-Response}:-00} # (9) mschap : EXPAND --username=%{%{Stripped-User-Name}:-%{%{User-Name}:-None}} # (9) mschap : --> --username=ferrao # (9) mschap : Creating challenge hash with username: ferrao # (9) mschap : EXPAND --challenge=%{%{mschap:Challenge}:-00} # (9) mschap : --> --challenge=082e8ba7b848aaae # (9) mschap : EXPAND --nt-response=%{%{mschap:NT-Response}:-00} # (9) mschap : --> --nt-response=27b40a6d1dba1b4acfd33aff5c710a43e70d050269087bf1 # (9) ERROR: mschap : Program returned code (1) and output 'Reading winbind reply failed! (0xc0000001)' # (9) mschap : External script failed. # (9) ERROR: mschap : External script says: Reading winbind reply failed! (0xc0000001) # (9) ERROR: mschap : MS-CHAP2-Response is incorrect # (9) [mschap] = reject # (9) } # Auth-Type MS-CHAP = reject # (9) eap : Freeing handler # (9) [eap] = reject # (9) } # authenticate = reject # (9) Failed to authenticate the user. # (9) Login incorrect (mschap: Program returned code (1) and output 'Reading winbind reply failed! (0xc0000001)'): [ferrao/<via Auth-Type = EAP>] (from client 192.168.0.0/26 port 0 via TLS tunnel) So something is wrong with Winbind and FreeRADIUS, and I don't know what. Thanks in advance,

5 4

redundant sql question
by Alex Sharaz 29 Sep '14

29 Sep '14

Hi, I'm calling a number of mysql stored procedures with something like update control { Tmp-String-3 := "%{sql_master:CALL get_manufacturer('%{NAS-IP-Address}')}" } and stuff works just fine. I then put the following in the instantiate section of radiusd.conf after my definitions of sql_master and sql_slave redundant redundant_sql { load-balance { redundant { sql_master sql_slave } redundant { sql_slave sql_master } } } and changed the 1st statement to be update control { Tmp-String-3 := "%{redundant_sql:CALL get_manufacturer('%{NAS-IP-Address}')}" } I'm now seeing a lot of ..... on Sep 29 11:30:59 2014 : Info: WARNING: Unknown module "redundant_sql" in string expansion "%" appearing in radius.log. I'm running Vsn 2.2.5 What do I have to get rid of the unknown module warnings? Rgds Alex ========== Time for another Macmillan Cancer Support event. This time its the Indian Himalaya's Cycle Challenge 2014 Please sponsor me at http://www.justgiving.com/Alex-Sharaz

2 3

response time monitoring
by Rando Nakarmi 29 Sep '14

29 Sep '14

Hi, Is there a tool to monitor the server response time for freeradius server ? I want to monitor the how fast server response to the client, any suggestion ?

2 1

Re: freeradius sql groups not working
by James w 29 Sep '14

29 Sep '14

Does anybody have any suggestions, could this be a bug ? Shall i try another version, its running on RHEL 7 Free radius version 3.0.1 > From: freeradius-users-request(a)lists.freeradius.org > Subject: Freeradius-Users Digest, Vol 113, Issue 128 > To: freeradius-users(a)lists.freeradius.org > Date: Mon, 29 Sep 2014 04:06:31 +0200 > > Send Freeradius-Users mailing list submissions to > freeradius-users(a)lists.freeradius.org > > To subscribe or unsubscribe via the World Wide Web, visit > http://lists.freeradius.org/mailman/listinfo/freeradius-users > or, via email, send a message with subject or body 'help' to > freeradius-users-request(a)lists.freeradius.org > > You can reach the person managing the list at > freeradius-users-owner(a)lists.freeradius.org > > When replying, please edit your Subject line so it is more specific > than "Re: Contents of Freeradius-Users digest..." > > > Today's Topics: > > 1. Re: How to send disconnect message to the NAS? (Alan DeKok) > 2. Re: EAP and rlm_perl. Is it possible to build custom logic > for VPN peers? (Oleksandr Yermolenko) > 3. Re: EAP and rlm_perl. Is it possible to build custom logic > for VPN peers? (Oleksandr Yermolenko) > 4. version 2.2.5 repo (Rando Nakarmi) > 5. Re: version 2.2.5 repo (Alan DeKok) > 6. Re: EAP and rlm_perl. Is it possible to build custom logic > for VPN peers? (Alan DeKok) > 7. Re: Problem in Module Statistics in freeradius (Himanshu Pandey) > > > ---------------------------------------------------------------------- > > Message: 1 > Date: Sun, 28 Sep 2014 11:08:16 -0400 > From: Alan DeKok <aland(a)deployingradius.com> > To: FreeRadius users mailing list > <freeradius-users(a)lists.freeradius.org> > Subject: Re: How to send disconnect message to the NAS? > Message-ID: <54282460.1090603(a)deployingradius.com> > Content-Type: text/plain; charset=ISO-8859-1 > > Xin wrote: > > Thanks a lot for your reply, I have understood I can use update control > > section to control send or not. And one more question, what is the virtual > > server in home_server_pool section. Just find the server > > originate-coa.example.com section? > > The behavior is documented in that file. > > > If this is right, can you tell me the > > usage of pre-proxy section? I have already understand the purpose of the > > post-proxy is to handle the COA/DM response. > > Read the file. This is documented. > > Alan DeKok. > > > ------------------------------ > > Message: 2 > Date: Sun, 28 Sep 2014 18:52:59 +0300 > From: Oleksandr Yermolenko <aae(a)sumix.com> > To: Alan DeKok <aland(a)deployingradius.com> > Subject: Re: EAP and rlm_perl. Is it possible to build custom logic > for VPN peers? > Message-ID: <54282EDB.20904(a)sumix.com> > Content-Type: text/plain; charset=utf-8; format=flowed > > > >> Is it possible to use any of EAP methods (I mean EAP-PEAP, EAP-TTLS or > >> EAP-TLS ...) with rlm_perl. > > What does that mean? > can I use authenticate, authorize, accounting hooks (or post_auth)? > I looked at example.pl. > > Just put "perl" in somewhere eap.conf file? > > > > > You can run the perl module when the server receives a packet. It > > doesn't matter whether the packet contains PAP, CHAP, MS-CHAP, or any > > EAP type. > > > > What do you want to *do* in rlm_perl? Knowing that probably more > > useful, and will get you a better answer. > authenticate a lot of VPN clients (currently I can choose EAP method), > keeping them in mysql or ldap. According their properties give a > personal access to > different local resources. Accounting: updating start/stop/alive > messages. POD if it's possible > for strongswan. > > > > Alan DeKok. > > > > ------------------------------ > > Message: 3 > Date: Sun, 28 Sep 2014 18:52:59 +0300 > From: Oleksandr Yermolenko <aae(a)sumix.com> > To: Alan DeKok <aland(a)deployingradius.com> > Subject: Re: EAP and rlm_perl. Is it possible to build custom logic > for VPN peers? > Message-ID: <54282EDB.20904(a)sumix.com> > Content-Type: text/plain; charset=utf-8; format=flowed > > > >> Is it possible to use any of EAP methods (I mean EAP-PEAP, EAP-TTLS or > >> EAP-TLS ...) with rlm_perl. > > What does that mean? > can I use authenticate, authorize, accounting hooks (or post_auth)? > I looked at example.pl. > > Just put "perl" in somewhere eap.conf file? > > > > > You can run the perl module when the server receives a packet. It > > doesn't matter whether the packet contains PAP, CHAP, MS-CHAP, or any > > EAP type. > > > > What do you want to *do* in rlm_perl? Knowing that probably more > > useful, and will get you a better answer. > authenticate a lot of VPN clients (currently I can choose EAP method), > keeping them in mysql or ldap. According their properties give a > personal access to > different local resources. Accounting: updating start/stop/alive > messages. POD if it's possible > for strongswan. > > > > Alan DeKok. > > > > ------------------------------ > > Message: 4 > Date: Sun, 28 Sep 2014 19:14:18 +0000 > From: Rando Nakarmi <randonakarmi(a)gmail.com> > To: FreeRadius users mailing list > <freeradius-users(a)lists.freeradius.org> > Subject: version 2.2.5 repo > Message-ID: > <CAG+85v_XJ_v8cJGu-tMqi+eWNSsnME=7mZcv5yqAhB6d9K+_KA(a)mail.gmail.com> > Content-Type: text/plain; charset="utf-8" > > HI, > > I see both in RHEL and epel , the freeradius version 2.1.12-4 is available > but not the 2.2.5 which is the newest version on 2.x.x series. > > I am used to do yum, where can I get version 2.2.5 in yum repo for RHEL > base linux. > > R >

3 2

RE: freeradius sql groups not working
by James w 29 Sep '14

29 Sep '14

OK so i installed a CentOS 6.5 machine and used the RPM's from here : http://packages.networkradius.com/centos/6.5/This has worked ! My groups are being read without any issues :) I started a fresh server using CentOS 7, installed the RPM's from the standard CentOS 7 repo's and this does not read the groups, so it looks like an issue with the supplied RPM's from CentOS or some other issue with the OS.I see from the FAQ here that Redhat / CentOS need bugs submitted directly : http://wiki.freeradius.org/guide/Red-Hat-FAQThanks > From: freeradius-users-request(a)lists.freeradius.org > Subject: Freeradius-Users Digest, Vol 113, Issue 132 > To: freeradius-users(a)lists.freeradius.org > Date: Mon, 29 Sep 2014 12:09:52 +0200 > > Send Freeradius-Users mailing list submissions to > freeradius-users(a)lists.freeradius.org > > To subscribe or unsubscribe via the World Wide Web, visit > http://lists.freeradius.org/mailman/listinfo/freeradius-users > or, via email, send a message with subject or body 'help' to > freeradius-users-request(a)lists.freeradius.org > > You can reach the person managing the list at > freeradius-users-owner(a)lists.freeradius.org > > When replying, please edit your Subject line so it is more specific > than "Re: Contents of Freeradius-Users digest..." > > > Today's Topics: > > 1. Re: Regarding Radmin (Himanshu Pandey) > 2. Re: version 2.2.5 repo (Rando Nakarmi) > 3. Re: freeradius sql groups not working (James w) > > > ---------------------------------------------------------------------- > > Message: 1 > Date: 29 Sep 2014 10:07:33 -0000 > From: "Himanshu Pandey" <pandey_himanshu80(a)rediffmail.com> > To: "freeradius-users(a)lists.freeradius.org" > <freeradius-users(a)lists.freeradius.org>, "list(a)fajar.net" > <list(a)fajar.net> > Subject: Re: Regarding Radmin > Message-ID: > <1411983406.S.16821.21090.F.H.WUZhamFyIEEuTnVncmFoYQBSZTogUmVnYXJkaW5nIFJhZG1pbg__.RU.rfs310, > rfs310, 647, > 785.f4-235-195.old.1411985253.13516(a)webmail.rediffmail.com> > Content-Type: text/plain; charset="utf-8" > > UNDERSTOOD! > THANKS! > > From: "Fajar A. Nugraha" <list(a)fajar.net> > Sent: Mon, 29 Sep 2014 15:06:46 > To: FreeRadius users mailing list <freeradius-users(a)lists.freeradius.org> > Subject: Re: Regarding Radmin > On Mon, Sep 29, 2014 at 4:07 PM, Himanshu Pandey <pandey_himanshu80(a)rediffmail.com> wrote: > Hi, > > I was using radmin to view the server statistics. But I am not getting and finding examples of the usage of these few radmin commands. For e.g., > > 1. set module <command> --- What is command overhere? > > 2. show <command> ----  What is command overhere? > > 3. stats <command> ----  What is command overhere? > > 4. add <command> ---- What is command overhere? > > 5. set <command> ---- What is command overhere? > > Please give me examples so that I can understand them. > > > > Did you try typing "help"? > radmin> helpadd <command> - do sub-command of adddebug <command> - debugging commandsdel <command> - do sub-command of delhup [module] - sends a HUP signal to the server, or optionally to one moduleinject <command> - commands to inject packets into a running serverreconnect - reconnect to a running serverterminate - terminates the server, and cause it to exitset <command> - do sub-command of setshow <command> - do sub-command of showstats <command> - do sub-command of statsradmin> help add  add <command> - do sub-command of adddebug <command> - debugging commandsdel <command> - do sub-command of delhup [module] - sends a HUP signal to the server, or optionally to one moduleinject <command> - commands to inject packets into a running serverreconnect - reconnect to a running serverterminate - terminates the server, and cause it to exitset <command> - do sub-command of setshow <command> - d! > o sub-command of showstats <command> - do sub-command of stats > radmin> add helpadd client <command> - Add client configuration commands > radmin> add client helpadd client file <filename> - Add new client definition from <filename> > radmin> debug help > debug condition [condition] - Enable debugging for requests matching [condition]debug level <number> - Set debug level to <number>.  Higher is more debugging.debug file [filename] - Send all debugging output to [filename] > -- Fajar > - > > List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html >

1 0

Re: Regarding Radmin
by Himanshu Pandey 29 Sep '14

29 Sep '14

THANKS! I understood it very well. From: A.L.M.Buxey(a)lboro.ac.uk Sent: Mon, 29 Sep 2014 16:23:37 To: FreeRadius users mailing list <freeradius-users(a)lists.freeradius.org> Subject: Re: Regarding Radmin Hi, >    2. show <command> ----  What is command overhere? show show client <command> - do sub-command of client show debug <command> - show debug properties show home_server <command> - do sub-command of home_server show module <command> - do sub-command of module show uptime - shows time at which server started show version - Prints version of the running server show xml <reference> - Prints out configuration as XML show home_server show home_server config <ipaddr> <port> - show configuration for given home server show home_server list - shows list of home servers show home_server state <ipaddr> <port> - shows state of given home server - the radmin tool does give you lots of help and 'man radmin' gives you information too alan - List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html

1 0

Re: Regarding Radmin
by A.L.M.Buxey＠lboro.ac.uk 29 Sep '14

29 Sep '14

Hi, > 2. show <command> ---- What is command overhere? show show client <command> - do sub-command of client show debug <command> - show debug properties show home_server <command> - do sub-command of home_server show module <command> - do sub-command of module show uptime - shows time at which server started show version - Prints version of the running server show xml <reference> - Prints out configuration as XML show home_server show home_server config <ipaddr> <port> - show configuration for given home server show home_server list - shows list of home servers show home_server state <ipaddr> <port> - shows state of given home server - the radmin tool does give you lots of help and 'man radmin' gives you information too alan

1 0

Re: freeradius sql groups not working
by James w 29 Sep '14

29 Sep '14

Thank you Alan and Fajar I used yum to install the packages, the current packages with Centos 7 are 3.0.1 I will remove this version and try some other ones like you have suggested Thanks > From: freeradius-users-request(a)lists.freeradius.org > Subject: Freeradius-Users Digest, Vol 113, Issue 131 > To: freeradius-users(a)lists.freeradius.org > Date: Mon, 29 Sep 2014 12:00:08 +0200 > > Send Freeradius-Users mailing list submissions to > freeradius-users(a)lists.freeradius.org > > To subscribe or unsubscribe via the World Wide Web, visit > http://lists.freeradius.org/mailman/listinfo/freeradius-users > or, via email, send a message with subject or body 'help' to > freeradius-users-request(a)lists.freeradius.org > > You can reach the person managing the list at > freeradius-users-owner(a)lists.freeradius.org > > When replying, please edit your Subject line so it is more specific > than "Re: Contents of Freeradius-Users digest..." > > > Today's Topics: > > 1. Re: version 2.2.5 repo (Fajar A. Nugraha) > 2. Re: Beginner need help (unrecognized clients) > (A.L.M.Buxey(a)lboro.ac.uk) > 3. Re: freeradius sql groups not working (A.L.M.Buxey(a)lboro.ac.uk) > 4. Regarding Radmin (Himanshu Pandey) > 5. Re: Regarding Radmin (Fajar A. Nugraha) > > > ---------------------------------------------------------------------- > > Message: 1 > Date: Mon, 29 Sep 2014 15:30:43 +0700 > From: "Fajar A. Nugraha" <list(a)fajar.net> > To: FreeRadius users mailing list > <freeradius-users(a)lists.freeradius.org> > Subject: Re: version 2.2.5 repo > Message-ID: > <CAG1y0sePhaX1c-pD0DHuYg_yhYAFid-WqYFbd=aR-mTkPAkqkg(a)mail.gmail.com> > Content-Type: text/plain; charset=UTF-8 > > On Mon, Sep 29, 2014 at 2:14 AM, Rando Nakarmi <randonakarmi(a)gmail.com> wrote: > > HI, > > > > I see both in RHEL and epel , the freeradius version 2.1.12-4 is available > > but not the 2.2.5 which is the newest version on 2.x.x series. > > > > I am used to do yum, where can I get version 2.2.5 in yum repo for RHEL > > base linux. > > If you want RH's official packages, then as Alan wrote, ask RH. > > There's an official repo from http://packages.networkradius.com/ for > version 3.0.4 on centos 6 (which should also work for RHEL), so if > you're willing to upgrade to 3.0.x you might be able to use that. > > If you want to stick with 2.x.x, 2.2.6 should be released sometime > soon, so you may want to wait for that. > > In the mean time, if you want packages for 2.2.5, I've updated > http://wiki.freeradius.org/building/Packages with a list of unofficial > packages that I created. See the link for Centos and v2.x.x from > there. Note that it is NOT an official package (neither from FR or > RH), and it might have some packaging differences compared to RH's > official packages. However it DOES work, and should be installable > using yum. > > -- > Fajar > > > ------------------------------ > > Message: 2 > Date: Mon, 29 Sep 2014 09:01:58 +0000 > From: A.L.M.Buxey(a)lboro.ac.uk > To: FreeRadius users mailing list > <freeradius-users(a)lists.freeradius.org> > Subject: Re: Beginner need help (unrecognized clients) > Message-ID: <20140929090158.GB19364(a)lboro.ac.uk> > Content-Type: text/plain; charset=us-ascii > > Hi, > > > To the clients.conf. > > which file did you edit? the same clients.conf that the server reads in (check its path in radiusd -X output_ > > alan > > > ------------------------------ > > Message: 3 > Date: Mon, 29 Sep 2014 09:05:59 +0000 > From: A.L.M.Buxey(a)lboro.ac.uk > To: FreeRadius users mailing list > <freeradius-users(a)lists.freeradius.org> > Subject: Re: freeradius sql groups not working > Message-ID: <20140929090559.GC19364(a)lboro.ac.uk> > Content-Type: text/plain; charset=us-ascii > > Hi, > > > Does anybody have any suggestions, could this be a bug ? Shall i try > > another version, its running on RHEL 7 Free radius version 3.0.1 > > 3.0.1 ? upgrade - many bugs fixed since then - so if it is a bug it may have been fixed > already. (you can look through the 3.0.2, 3.0.3 and 3.0.4 release notes or read the code > diffs if you like so see what got caught/fixed) > > alan > > > ------------------------------ > > Message: 4 > Date: 29 Sep 2014 09:07:12 -0000 > From: "Himanshu Pandey" <pandey_himanshu80(a)rediffmail.com> > To: "freeradius-users(a)lists.freeradius.org" > <freeradius-users(a)lists.freeradius.org> > Subject: Regarding Radmin > Message-ID: > <1411912518.S.6312.16903.F.H.TkFsYW4gRGVLb2sAUmU6IFByb2JsZW0gaW4gTW9kdWxlIFN0YXRpc3RpY3MgaW4gZnJlZXJhZGl1cw__.RU.rfs310, > rfs310, 76, > 303.f4-235-76.old.replied.1411981632.588(a)webmail.rediffmail.com> > Content-Type: text/plain; charset="utf-8" > > Hi, > > I was using radmin to view the server statistics. But I am not getting and finding examples of the usage of these few radmin commands. For e.g., > > 1. set module <command> --- What is command overhere? > > 2. show <command> ----  What is command overhere? > > 3. stats <command> ----  What is command overhere? > > 4. add <command> ---- What is command overhere? > > 5. set <command> ---- What is command overhere? > > Please give me examples so that I can understand them. > > Regards, > Sonu > > From: Alan DeKok <aland(a)deployingradius.com> > Sent: Sun, 28 Sep 2014 19:25:18 > To: FreeRadius users mailing list <freeradius-users(a)lists.freeradius.org> > Subject: Re: Problem in Module Statistics in freeradius > Himanshu Pandey wrote: > > > I added the following code in modcall.c under the function > > > modcall_recurse(): > > > >  This list is for *using* FreeRADIUS.  It's not for learning how to > > program. > > > >  You're making beginners errors in the code.  Don't do that. > > > >  Alan DeKok. > > - > > List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html > >

1 0

version 2.2.5 repo
by Rando Nakarmi 29 Sep '14

29 Sep '14

HI, I see both in RHEL and epel , the freeradius version 2.1.12-4 is available but not the 2.2.5 which is the newest version on 2.x.x series. I am used to do yum, where can I get version 2.2.5 in yum repo for RHEL base linux. R

3 3