- Freeradius-Users - lists.freeradius.org

Change Attribute type in dictioanry
by Muhammad Usman 05 May '14

05 May '14

Hi, I have an attribute defined as Integer in dictionary, I want to increase the limit of variable, how can I change the variable type to float or big Int in dictionary. Thanks

3 2

Re: sim use reply message
by Sanity Computers 05 May '14

05 May '14

Ok thanks Alan, I shall use php to change that string result. Regards Jim

1 0

2.2.5 Compilation error
by Mohd Alkhaldi 04 May '14

04 May '14

I tried to compile FR 2.2.5 on Solaris 10 with oracle support, when I run make I get the following error: gcc -I/oracle/software/adsl/freeradius-server-2.2.5 -I/oracle/software/adsl/freeradius-server-2.2.5/src -m64 -Wall -D_GNU_SOURCE -D_REENTRANT -D_POSIX_PTHREAD_SEMANTICS -DNDEBUG -I/oracle/software/adsl/freeradius-server-2.2.5/libltdl -D_LIBRADIUS -I/oracle/software/adsl/freeradius-server-2.2.5/src -c base64.c -o base64.o >/dev/null 2>&1 /oracle/software/adsl/freeradius-server-2.2.5/libtool --mode=link --tag=CC gcc -release \ -m64 -export-dynamic -o libfreeradius-radius.la -rpath /oracle/software/adsl/local/lib debug.lo dict.lo filters.lo hash.lo hmac.lo hmacsha1.lo isaac.lo log.lo misc.lo missing.lo md4.lo md5.lo print.lo radius.lo rbtree.lo sha1.lo snprintf.lo strlcat.lo strlcpy.lo token.lo udpfromto.lo valuepair.lo fifo.lo packet.lo event.lo getaddrinfo.lo vqp.lo heap.lo dhcp.lo base64.lo gcc -shared -Wl,-h -Wl,libfreeradius-radius--m64.so -o .libs/libfreeradius-radius--m64.so .libs/debug.o .libs/dict.o .libs/filters.o .libs/hash.o .libs/hmac.o .libs/hmacsha1.o .libs/isaac.o .libs/log.o .libs/misc.o .libs/missing.o .libs/md4.o .libs/md5.o .libs/print.o .libs/radius.o .libs/rbtree.o .libs/sha1.o .libs/snprintf.o .libs/strlcat.o .libs/strlcpy.o .libs/token.o .libs/udpfromto.o .libs/valuepair.o .libs/fifo.o .libs/packet.o .libs/event.o .libs/getaddrinfo.o .libs/vqp.o .libs/heap.o .libs/dhcp.o .libs/base64.o -lc ld: fatal: file .libs/debug.o: wrong ELF class: ELFCLASS64 ld: fatal: File processing errors. No output written to .libs/libfreeradius-radius--m64.so collect2: ld returned 1 exit status It seems that it is looking for 64bit library, But which library it is looking for? Thanks; Alwaad Alhaq

1 0

sim use reply message
by Sanity Computers 03 May '14

03 May '14

There's quite a few posts on making a custom reply message - changing the default reply in the post auth section. One shows that this works: if (reply:Reply-Message == "\r\nYou are already logged in - access denied\r\n\n"){ update reply { Reply-Message := "new sim use reply message" } } It does not matter what format I use, the default message "\r\nYou are already logged in - access denied\r\n\n" is all I ever get. This is on a freeradius 2 (on Ubuntu 8) install with default settings, any idea if this format is actually correct or what else needs to be done to change a reply message? Thanks all. Regards Jim

3 2

How to define Pool-Name with radcheck table
by yata 01 May '14

01 May '14

Hi all! I'm using freeradius2 as a radius-server and dhcp-server. When I connect to freeradius by defined user in /etc/raddb/users , it is successful. But I wanna define users in mysql's radcheck table. I inserted userID and password in radcheck table then following messages were displaied and connection failed. it seems to be failed to find pool-name How should I define pool-name in radcheck table or somewhere? Listening on proxy address * port 1814 Ready to process requests. rad_recv: Access-Request packet from host 10.0.5.200 port 50000, id=10, length=207 User-Password = "test123" User-Name = "test123(a)test.or.jp" Acct-Session-Id = "erx FastEthernet 1/6:0014680074" Service-Type = Framed-User Framed-Protocol = PPP ERX-Pppoe-Description = "pppoe 00:1d:72:c6:7b:d5" Calling-Station-Id = "#ERX-40-b0-7a#E16#0" NAS-Port-Type = Ethernet NAS-Port = 369098752 NAS-Port-Id = "FastEthernet 1/6" NAS-IP-Address = 10.0.5.200 NAS-Identifier = "ERX-40-b0-7a" # Executing section authorize from file /etc/raddb/sites-enabled/default +- entering group authorize {...} ++[preprocess] returns ok ++[chap] returns noop ++[mschap] returns noop ++[digest] returns noop [suffix] Looking up realm "test.or.jp" for User-Name = "test123(a)test.or.jp" [suffix] No such realm "test.or.jp" ++[suffix] returns noop [eap] No EAP-Message, not doing EAP ++[eap] returns noop [sql] expand: %{User-Name} -> test123(a)test.or.jp [sql] sql_set_user escaped user --> 'test123(a)test.or.jp' rlm_sql (sql): Reserving sql socket id: 13 [sql] expand: SELECT id, username, attribute, value, op FROM radcheck WHERE username = '%{SQL-User-Name}' ORDER BY id -> SELECT id, username, attribute, value, op FROM radcheck WHERE username = 'test123(a)test.or.jp' ORDER BY id WARNING: Found User-Password == "...". WARNING: Are you sure you don't mean Cleartext-Password? WARNING: See "man rlm_pap" for more information. [sql] User found in radcheck table [sql] expand: SELECT id, username, attribute, value, op FROM radreply WHERE username = '%{SQL-User-Name}' ORDER BY id -> SELECT id, username, attribute, value, op FROM radreply WHERE username = 'test123(a)test.or.jp' ORDER BY id [sql] expand: SELECT groupname FROM radusergroup WHERE username = '%{SQL-User-Name}' ORDER BY priority -> SELECT groupname FROM radusergroup WHERE username = 'test123(a)test.or.jp' ORDER BY priority rlm_sql (sql): Released sql socket id: 13 ++[sql] returns ok ++[expiration] returns noop ++[logintime] returns noop ++[pap] returns updated Found Auth-Type = PAP !!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!! !!! Replacing User-Password in config items with Cleartext-Password. !!! !!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!! !!! Please update your configuration so that the "known good" !!! !!! clear text password is in Cleartext-Password, and not in User-Password. !!! !!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!! # Executing group from file /etc/raddb/sites-enabled/default +- entering group PAP {...} [pap] login attempt with password "test123" [pap] Using clear text password "test123" [pap] User authenticated successfully ++[pap] returns ok Login OK: [test123(a)test.or.jp] (from client GGSN1 port 369098752 cli #ERX-40-b0-7a#E16#0) # Executing section post-auth from file /etc/raddb/sites-enabled/default +- entering group post-auth {...} [sqlippool] No Pool-Name defined. [sqlippool] expand: No Pool-Name defined (did %{Called-Station-Id} cli %{Calling-Station-Id} port %{NAS-Port} user %{User-Name}) -> No Pool-Name defined (did cli #ERX-40-b0-7a#E16#0 port 369098752 user test123(a)test.or.jp) No Pool-Name defined (did cli #ERX-40-b0-7a#E16#0 port 369098752 user test123(a)test.or.jp) ++[sqlippool] returns noop ++[exec] returns noop Sending Access-Accept of id 10 to 10.0.5.200 port 50000 Finished request 0. Going to the next request Waking up in 4.9 seconds. rad_recv: Accounting-Request packet from host 10.0.5.200 port 50016, id=108, length=248 Acct-Status-Type = Stop User-Name = "test123(a)test.or.jp" Event-Timestamp = "Apr 29 2014 14:20:16 PDT" Acct-Delay-Time = 0 NAS-Identifier = "ERX-40-b0-7a" Acct-Session-Id = "erx FastEthernet 1/6:0014680074" NAS-IP-Address = 10.0.5.200 Service-Type = Framed-User Calling-Station-Id = "#ERX-40-b0-7a#E16#0" Acct-Input-Gigawords = 0 Acct-Input-Octets = 0 Acct-Output-Gigawords = 0 Acct-Output-Octets = 0 ERX-Input-Gigapkts = 0 Acct-Input-Packets = 0 ERX-Output-Gigapkts = 0 Acct-Output-Packets = 0 NAS-Port-Type = Ethernet NAS-Port = 369098752 NAS-Port-Id = "FastEthernet 1/6" Acct-Authentic = RADIUS Acct-Session-Time = 0 Acct-Terminate-Cause = NAS-Request # Executing section preacct from file /etc/raddb/sites-enabled/default +- entering group preacct {...} ++[preprocess] returns ok [acct_unique] Hashing 'NAS-Port = 369098752,Client-IP-Address = 10.0.5.200,NAS-IP-Address = 10.0.5.200,Acct-Session-Id = "erx FastEthernet 1/6:0014680074",User-Name = "test123(a)test.or.jp"' [acct_unique] Acct-Unique-Session-ID = "4abb92629c9787a0". ++[acct_unique] returns ok [suffix] Looking up realm "test.or.jp" for User-Name = "test123(a)test.or.jp" [suffix] No such realm "test.or.jp" ++[suffix] returns noop ++[files] returns noop # Executing section accounting from file /etc/raddb/sites-enabled/default +- entering group accounting {...} rlm_sql (sql): Reserving sql socket id: 12 [sqlippool] expand: %{User-Name} -> test123(a)test.or.jp [sqlippool] sql_set_user escaped user --> 'test123(a)test.or.jp' [sqlippool] expand: START TRANSACTION -> START TRANSACTION [sqlippool] expand: UPDATE radippool SET nasipaddress = '', pool_key = 0, callingstationid = '', username = '', expiry_time = NULL WHERE nasipaddress = '%{Nas-IP-Address}' AND pool_key = '%{NAS-Port}' AND username = '%{User-Name}' AND callingstationid = '%{Calling-Station-Id}' AND framedipaddress = '%{Framed-IP-Address}' -> UPDATE radippool SET nasipaddress = '', pool_key = 0, callingstationid = '', username = '', expiry_time = NULL WHERE nasipaddress = '10.0.5.200' AND pool_key = '369098752' AND username = 'test123(a)test.or.jp' AND callingstationid = '=23ERX-40-b0-7a=23E16=230' AND framedipaddress = '' [sqlippool] expand: COMMIT -> COMMIT [sqlippool] expand: Released IP %{Framed-IP-Address} (did %{Called-Station-Id} cli %{Calling-Station-Id} user %{User-Name}) -> Released IP (did cli #ERX-40-b0-7a#E16#0 user test123(a)test.or.jp) Released IP (did cli #ERX-40-b0-7a#E16#0 user test123(a)test.or.jp) rlm_sql (sql): Released sql socket id: 12 ++[sqlippool] returns ok [sql] expand: %{User-Name} -> test123(a)test.or.jp [sql] sql_set_user escaped user --> 'test123(a)test.or.jp' [sql] expand: %{Acct-Input-Gigawords} -> 0 [sql] expand: %{Acct-Input-Octets} -> 0 [sql] expand: %{Acct-Output-Gigawords} -> 0 [sql] expand: %{Acct-Output-Octets} -> 0 [sql] expand: %{Acct-Delay-Time} -> 0 [sql] expand: UPDATE radacct SET acctstoptime = '%S', acctsessiontime = '%{Acct-Session-Time}', acctinputoctets = '%{%{Acct-Input-Gigawords}:-0}' << 32 | '%{%{Acct-Input-Octets}:-0}', acctoutputoctets = '%{%{Acct-Output-Gigawords}:-0}' << 32 | '%{%{Acct-Output-Octets}:-0}', acctterminatecause = '%{Acct-Terminate-Cause}', acctstopdelay = '%{%{Acct-Delay-Time}:-0}', connectinfo_stop = '%{Connect-Info}' WHERE acctsessionid = '%{Acct-Session-Id}' AND username = '%{SQL-User-Name}' AND nasipaddress = '%{NAS-IP-Address}' -> UPDATE radacct SET acctstoptime = '2014-04-29 22:49:42', acctsessiontime = '0', acctinputoctets = '0' << 32 | '0', acctoutputoctets = '0' << 32 | rlm_sql (sql): Reserving sql socket id: 11 [sql] expand: stop packet with zero session length. [user '%{User-Name}', nas '%{NAS-IP-Address}'] -> stop packet with zero session length. [user 'test123(a)test.or.jp', nas '10.0.5.200'] [sql] stop packet with zero session length. [user 'test123(a)test.or.jp', nas '10.0.5.200'] rlm_sql (sql): Released sql socket id: 11 ++[sql] returns noop ++[exec] returns noop [attr_filter.accounting_response] expand: %{User-Name} -> test123(a)test.or.jp attr_filter: Matched entry DEFAULT at line 12 ++[attr_filter.accounting_response] returns updated Sending Accounting-Response of id 108 to 10.0.5.200 port 50016 Finished request 1. Cleaning up request 1 ID 108 with timestamp +7 Going to the next request Waking up in 4.9 seconds. Cleaning up request 0 ID 10 with timestamp +7 Ready to process requests. If you need more information, please let me know. Thanks.

3 3

freeradius 1.1.8 help
by Stacy Trippe 30 Apr '14

30 Apr '14

I've been trying (unsuccessfully) to upgrade an old 0.8.1 server running on FreeBSD 4.7 to something in the current decade... any help appreciated... Getting a segmentation fault running 1.1.8 on CentOS 6.5 (32-bit - i686) Ran check-radius-config -- and get through to modules loading -- and it crashes: Ignoring deprecated command-line option -pStarting - reading configuration files ... reread_config: reading radiusd.conf Config: including file: /usr/local/etc/raddb/proxy.conf Config: including file: /usr/local/etc/raddb/clients.conf Config: including file: /usr/local/etc/raddb/sql.conf main: prefix = "/usr/local" main: localstatedir = "/usr/local/var" main: logdir = "/usr/local/var/log/radius" main: libdir = "/usr/local/lib:/usr/lib/freeradius" main: radacctdir = "/usr/local/var/log/radius/radacct" main: hostname_lookups = no main: max_request_time = 30 main: cleanup_delay = 2 main: max_requests = 2560 main: delete_blocked_requests = 0 main: port = 0 main: allow_core_dumps = no main: log_stripped_names = no main: log_file = "/usr/local/var/log/radius/radius.log" main: log_auth = yes main: log_auth_badpass = yes main: log_auth_goodpass = no main: pidfile = "/usr/local/var/run/radiusd/radiusd.pid" main: user = "(null)" main: group = "(null)" main: usercollide = no main: lower_user = "no" main: lower_pass = "no" main: nospace_user = "no" main: nospace_pass = "no" main: checkrad = "/usr/local/sbin/checkrad" main: proxy_requests = yes proxy: retry_delay = 5 proxy: retry_count = 3 proxy: synchronous = no proxy: default_fallback = no proxy: dead_time = 120 proxy: post_proxy_authorize = yes proxy: wake_all_if_all_dead = no security: max_attributes = 200 security: reject_delay = 0 security: status_server = no main: debug_level = 0 read_config_files: reading dictionary read_config_files: reading naslist Using deprecated naslist file. Support for this will go away soon. read_config_files: reading clients read_config_files: reading realms radiusd: entering modules setup I followed doc/bugs and created a gdb-radiusd.log which is below: * 1 Thread 0xb77f4730 (LWP 5815) 0x00b637d7 in __strcmp_sse4_2 () from /lib/i686/nosegneg/libc.so.6 Thread 1 (Thread 0xb77f4730 (LWP 5815)): #0 0x00b637d7 in __strcmp_sse4_2 () from /lib/i686/nosegneg/libc.so.6 No symbol table info available. #1 0x006fbb95 in lt_dlpreload_open () from /usr/lib/libltdl.so.7 No symbol table info available. #2 0x006ffb2b in lt_dlinit () from /usr/lib/libltdl.so.7 No symbol table info available. #3 0x002d1b54 in setup_modules () at modules.c:710 comp = <value optimized out> cs = <value optimized out> filename = 0x2dd7d1 "radiusd.conf" #4 0x002d4e58 in main (argc=2, argv=0xbfddc874) at radiusd.c:965 request = 0x2e3ea0 packet = <value optimized out> secret = <value optimized out> buffer = '\000' <repeats 16 times>"\340, \267<U+077F>", '\000' <repeats 12 times>, "\004<\027\000\001\000\000\000\000\320G\000\220|\177\267\000@\027\000<\266<U+077F>\000\000\000\000=\331F\000\274&\241\000\340\237\177\267\304\317G\000x\235\177\267\274&\241\000(\271<U+077F>\204eF\000\274&\241\000i\212J\000\003\000\000\000\260|\177\267\004<\027\000\004\354\001\000\000\375\000\000i\212J\000\000\000\000\000\203\001\020\000\355\201\000\000\001", '\000' <repeats 23 times>, "\001\000\000\000\000\320G\000\340x\177\267\360\000\000\000\000\000\000\000*\035CS<Ù¶#=\331F\000\254\243\024\000\340\237\177\267\304\317G\000x\235\177\267\254\243\024\000\250\271<U+077F>\204eF\000\254\243\024\000i\212J\000\304\317G\000\021\306\177\267\221\243\024\000Ä¹<U+077F>\261fF\000i\212J\000x|\177\267(v\177\267\001\000\000\000\000\000\000\000\254\271<U+077F>\000\000\000\000\003\000\000\000\307yG\000\260\271<U+077F>\001\000\000\000\000\320G\000(v\177\267"... readfds = {fds_bits = {-1075984572, 21, 4708600, 0, 0, 1, 2200, -1216388896, -1216373384, 2908937, 10743672, 2902908, 1, 4706244, -1075984352, 4709040, -1075984396, 4620570, -1075984412, 2902908, -1075984424, 4708948, 0, -1216388896, 1, 0, 1, 4708600, 3870384, -1075984488, 4664624, 2}} argval = <value optimized out> pid = <value optimized out> max_fd = <value optimized out> status = <value optimized out> tv = 0x0 act = {__sigaction_handler = {sa_handler = 0, sa_sigaction = 0}, sa_mask = {__val = {0 <repeats 32 times>}}, sa_flags = 0, sa_restorer = 0} listener = <value optimized out> Thanks, Stacy

5 4

FreeRADIUS & MAC authentication
by Russell Mike 30 Apr '14

30 Apr '14

Greetings FreeRADIUS List i have a special requirement, i need your help to understand FreeRADIUS virtual server(s) a little bit. i want to use FreeRADIUS for MAC authentication and i need the following results. if not found then accept the access if found look for accept & reject value in the database table to send reply. My question is not that how to do it, but to know if do able. i shall read more documentation if possible to achieve. i would VERY grateful also, if someone can kindly send me the documentation link, which explain this kind of topic. Thanks / Regards RM --

2 5

accounting_onoff_query with empty acctterminatecause
by Lorenzo Milesi 30 Apr '14

30 Apr '14

Hi. I was investigating my DB for some session being marked as terminated while still active and I believe I found the culprit in the accounting_onoff_query query. While this issue is probably related to NAS (Coova) configuration being incompatible with the query itself (NAS-IP-Address is almost always the same), the sessions terminated by this query all have a blank terminate cause. Is this expected? Thanks P.S. The query is the default one: accounting_onoff_query = "\ UPDATE ${acct_table1} \ SET \ acctstoptime = '%S', \ acctsessiontime = unix_timestamp('%S') - \ unix_timestamp(acctstarttime), \ acctterminatecause = '%{Acct-Terminate-Cause}', \ acctstopdelay = %{%{Acct-Delay-Time}:-0} \ WHERE acctstoptime IS NULL \ AND nasipaddress = '%{NAS-IP-Address}' \ AND acctstarttime <= '%S'" -- Lorenzo Milesi - lorenzo.milesi(a)yetopen.it YetOpen S.r.l. - http://www.yetopen.it/

2 1

Which attribute-name is needed for group-filtering?
by Stefan Kuegler 30 Apr '14

30 Apr '14

Hello all. I have a short question. I want to use multiotp as an authentication-module in freeradius on a debian-wheezy system. multiotp itself works properly. The authentication works as expected. But now the question: I want to filter the different users to groups using the "users"-file of freeradius, for example: DEFAULT Auth-type = multiotp, Group-Name := "allowed-users" Reply-Message = "Your multiotp-account has been enabled." DEFAULT Auth-type = multiotp, Group-Name := "forbidden-users" Reply-Message = "Your multiotp-account has been disabled." We are very free for setting an attribute-name in multiotp - but I don't know, which attribute-name do I have to set. I tested with different attribute names (like "Group-Name" in the example above). But nothing works. I only get the reply-message "Your multiotp-account has been enabled", everytime - even if the user is member of the group "allowed-users" or "forbidden-users". These are the last lines of debug-output. The user is member of the group "forbidden-users": [...] rad_recv: Access-Request packet from host 127.0.0.1 port 46615, id=111, length=77 User-Name = "testuser" User-Password = "1234740472" NAS-IP-Address = 127.0.1.1 NAS-Port = 0 Message-Authenticator = 0xdff73ff20f7d54045b999eae4cc891be # Executing section authorize from file /etc/freeradius/sites-enabled/default +- entering group authorize {...} ++[preprocess] returns ok ++[mschap] returns noop ++[digest] returns noop [suffix] No '@' in User-Name = "testuser", looking up realm NULL [suffix] No such realm "NULL" ++[suffix] returns noop [eap] No EAP-Message, not doing EAP ++[eap] returns noop [files] users: Matched entry DEFAULT at line 58 ++[files] returns ok ++[expiration] returns noop ++[logintime] returns noop ++- entering policy multiotp.authorize {...} +++? if (!control:Auth-Type) ? Evaluating !(control:Auth-Type) -> FALSE +++? if (!control:Auth-Type) -> FALSE ++- policy multiotp.authorize returns noop [pap] WARNING! No "known good" password found for the user. Authentication may fail because of this. ++[pap] returns noop Found Auth-Type = multiotp # Executing group from file /etc/freeradius/sites-enabled/default +- entering group multiotp {...} [multiotp] expand: %{User-Name} -> testuser [multiotp] expand: %{User-Password} -> 1234740472 [multiotp] expand: -src=%{Packet-Src-IP-Address} -> -src=127.0.0.1 [multiotp] expand: -chap-challenge=%{CHAP-Challenge} -> -chap-challenge= [multiotp] expand: -chap-password=%{CHAP-Password} -> -chap-password= [multiotp] expand: -ms-chap-challenge=%{MS-CHAP-Challenge} -> -ms-chap-challenge= [multiotp] expand: -ms-chap-response=%{MS-CHAP-Response} -> -ms-chap-response= [multiotp] expand: -ms-chap2-response=%{MS-CHAP2-Response} -> -ms-chap2-response= Exec-Program output: Group-Name = "forbidden-users" Exec-Program-Wait: value-pairs: Group-Name = "forbidden-users" Exec-Program: returned: 0 ++[multiotp] returns ok Login OK: [testuser] (from client localhost port 0) # Executing section post-auth from file /etc/freeradius/sites-enabled/default +- entering group post-auth {...} ++[exec] returns noop Sending Access-Accept of id 111 to 127.0.0.1 port 46615 Class = 0x656e61626c6564 Reply-Message = "Your multiotp-account has been enabled." Finished request 0. Going to the next request Waking up in 4.9 seconds. So, I think I am using the wrong attribute-keyword. Can anybody tell me, which keyword do I have to use? Regards, Stefan

2 2

Re: Is LDAP + EAP Possible For Me?
by Ethan Chrisawn 30 Apr '14

30 Apr '14

>Will your LDAP server give FreeRADIUS the cleartext password, or >the NTLM password? I'm using eDirectory, and I do not think my passwords are clear text. Surprisingly, when I put in a ticket asking Novell about it, the engineer seemed to know nothing about configuring eDir for clear text. It looks like my best bet is probably TTLS/PAP. Is there a good guide that you would recommend for getting that set up, or should I just start googling. I really appreciate the pointers, by the way. Ethan Chrisawn Systems Administrator www.ecrs.com echrisawn(a)ecrs.com Phone: 828.265.2907 ext:5018

4 11