- Freeradius-Users - lists.freeradius.org

Re: Freeradius 2.2.0 - binaries not being installed ???
by Alan Buxey 06 Sep '13

06 Sep '13

But if you'd installed the debian/Ubuntu package version then it is 'freeradius' ;) alan

2 1

Re: FreeRADIUS Accounting Logging to Two Separate Locations Simultaneously
by Chris Decker 06 Sep '13

06 Sep '13

Arran, Thank you for taking the time to so clearly lay things out - it seems like rlm_replicate will do exactly what we want! I'm going to look into using redis, as it is supported by logstash out-of-the-box and I'm guessing I'll get the benefit of 'guaranteed delivery'. What would happen to the FreeRADIUS processes should my client be unable to connect back to the redis 'server' (for whatever reason) for an extended period of time? Also, should I be nervous about using the redis module in production given the 'Experimental' redis module description in the 2.1.1 changelog? Thanks, Chris P.s. My apologies for replying via the digest - you replied before I had time to switch off of digests. > Date: Thu, 5 Sep 2013 19:11:35 +0100 > From: Arran Cudbard-Bell <a.cudbardb(a)freeradius.org> > To: FreeRadius users mailing list > <freeradius-users(a)lists.freeradius.org> > Subject: Re: FreeRADIUS Accounting Logging to Two Separate Locations > Simultaneously > Message-ID: <E1C61C30-B39E-4D42-9532-1B113DBC29DB(a)freeradius.org> > Content-Type: text/plain; charset=us-ascii > > > On 5 Sep 2013, at 18:29, Chris Decker <csd126(a)psu.edu> wrote: > >> All, >> >> I could use some help in understanding my options for the following scenario: >> In our environment, FreeRADIUS currently writes its Accounting logs to the local drive - one file per authorized client. In addition to the local logging, the Security group wants the Accounting logs sent to their logging cluster (in real-time) so they can put them in their elasticsearch database and respond to incidents. > > Well you don't want the main log file from the daemon which makes it easier. That can only go to one place. > > There are four types modules you could use for this: > - linelog > - detail > - replicate > - the db modules (ldap, sql, redis) > > Linelog can log to files or syslog, you construct the format lines using static text and attributes. > Detail can only log to files, it just dumps the contents of an attribute list to a file. > Replicate fires and forgets a copy of the Accounting-Request to a remote server. > The DB modules just log to a table. > > You can list any combination of those modules in the accounting section of the server to write to multiple destinations. > > It's generally sensible to log one copy of the accounting packets to disk on the box it was received, most people use the detail module for this. > > For the other consumers, if they want off-box logging and don't want syslog, forward them a copy of the packet using rlm_replicate. This copies the incoming packet to another destination. It doesn't block, and doesn't wait for a response, meaning it will be affected by packet loss. But that shouldn't be an issue on a campus network if you set the QoS priorities correctly, and hey, at least no congestive failure. > > For consuming those packets at the other end, you can use another instance of FreeRADIUS (and configure it to not responsd), or radsniff can be used to pick them off the wire with libpcap, and output them in something very similar to detail format. > > I've adopted radsniff as a bit of a pet project until FreeRADIUS 3.0.0 is released (were currently in feature freeze, so I needed something to hack on). So if you want additional features like outputting packet 'signatures' to syslog, and are willing to test the code then I'd be happy to add it in. > >> My question: What is the best way to make both the Ops and Security groups happy given the below limitations: >> - The Security group does not want to pull the logs from MySQL, as they want to use logstash/elasticsearch and this would just complicate things. > > Yeah and who wants to manage SQL tables with millions of rows, eww. > >> - The Ops group wants to avoid syslog because they fear syslog could block, causing their production FreeRADIUS servers to eventually stop responding to requests. > > > Ok. > >> The options we are exploring, in order of preference: >> 1. "Robust Accounting" - the Ops team believes there is a way to have the logs written to two locations simultaneously - locally and remotely, and if the remote connection is lost it does not impact operations. Is this possible? Does anyone have a sample config they could share? > > Um, that's a pretty basic feature of the server, just list multiple modules in the accounting section. > >> 2. Re-configure FreeRADIUS to write to one giant log-file, rotated hourly. A script would then essentially 'tail -f' the log file and stream the logs to the Security group (and would handle the hourly filename changes obviously). > > Sure. Unlike core logging, modules will re-open the file handle each time they write an entry, this is nice because you can just move the files out of the way at rotate time, and not so nice, because it's slow. Depends on load as to whether this is ok. > >> 3. Re-configure FreeRADIUS to log to syslog, and have syslog write to a local file AND send remotely to the Security group. The Ops group wants to avoid syslog if at all possible. > > Ok. > >> 4. Re-configure FreeRADIUS to also log to MySQL. The Security group would then have to figure out a way to pull the data out in near-real time and insert it into their own database, which they would like to avoid. >> > > Nah... > > Replicate the packet stream, let them do whatever they want with it. That's usually the easiest way to solve these sorts of issues. > > -Arran > > Arran Cudbard-Bell <a.cudbardb(a)freeradius.org> > FreeRADIUS Development Team

1 1

Get errors with radtest on ip address
by Patricia Julien 05 Sep '13

05 Sep '13

I've done the following to install and test freeradius on Scientific Linux el6_4. The server is one I use for testing and also has Splunk installed on it. No issues with Splunk and the ip address have been found as I've gotten logs from other test equipment into Splunk - I installed the freeradius-2.1.12-4.el6_3.x86_64 and then the utilities freeradius-utils-2.1.12-4.el6_3.x86_64.rpm to get the client (radtest). - I made a change to the users file to add the testing Cleartext-Password := "password". My hosts file indicates both lo and the ip address for the server. I can ping the server without issues. - After I added the line to the users file, I started radiusd -X >debug.txt I then opened another terminal window on the same server and performed the - radtest testing password 127.0.0.1 0 testing123. - I received an error indicating failed to find ip address for linux-mail.amber.net followed by nothing to do. - I looked at clients.conf and change the ip address from 127.0.0.1 to my ip address and added hostname. The results remained the same so I've reverted to original config for this. Each time I made any changes I restarted radiusd by killing the process and restarting. I could not service radiusd stop or radiusd stop to stop the application. I tried pasting the debug txt into the debug form on the other site and received a 405Forbidden when I accepted the policy. I've put my debug from testing with just the change to the users file below. Would appreciate any insight into what could be wrong. PJ ##### Debug text ########## FreeRADIUS Version 2.1.12, for host x86_64-redhat-linux-gnu, built on Oct 2 2012 at 23:16:43 Copyright (C) 1999-2009 The FreeRADIUS server project and contributors. There is NO warranty; not even for MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. You may redistribute copies of FreeRADIUS under the terms of the GNU General Public License v2. Starting - reading configuration files ... including configuration file /etc/raddb/radiusd.conf including configuration file /etc/raddb/proxy.conf including configuration file /etc/raddb/clients.conf including files in directory /etc/raddb/modules/ including configuration file /etc/raddb/modules/counter including configuration file /etc/raddb/modules/checkval including configuration file /etc/raddb/modules/expr including configuration file /etc/raddb/modules/logintime including configuration file /etc/raddb/modules/redis including configuration file /etc/raddb/modules/mschap including configuration file /etc/raddb/modules/wimax including configuration file /etc/raddb/modules/attr_rewrite including configuration file /etc/raddb/modules/replicate including configuration file /etc/raddb/modules/sql_log including configuration file /etc/raddb/modules/etc_group including configuration file /etc/raddb/modules/smbpasswd including configuration file /etc/raddb/modules/detail.log including configuration file /etc/raddb/modules/exec including configuration file /etc/raddb/modules/sradutmp including configuration file /etc/raddb/modules/pap including configuration file /etc/raddb/modules/expiration including configuration file /etc/raddb/modules/always including configuration file /etc/raddb/modules/preprocess including configuration file /etc/raddb/modules/echo including configuration file /etc/raddb/modules/policy including configuration file /etc/raddb/modules/opendirectory including configuration file /etc/raddb/modules/perl including configuration file /etc/raddb/modules/pam including configuration file /etc/raddb/modules/attr_filter including configuration file /etc/raddb/modules/chap including configuration file /etc/raddb/modules/detail including configuration file /etc/raddb/modules/radutmp including configuration file /etc/raddb/modules/ntlm_auth including configuration file /etc/raddb/modules/inner-eap including configuration file /etc/raddb/modules/soh including configuration file /etc/raddb/modules/passwd including configuration file /etc/raddb/modules/acct_unique including configuration file /etc/raddb/modules/dynamic_clients including configuration file /etc/raddb/modules/ippool including configuration file /etc/raddb/modules/digest including configuration file /etc/raddb/modules/rediswho including configuration file /etc/raddb/modules/mac2ip including configuration file /etc/raddb/modules/otp including configuration file /etc/raddb/modules/cui including configuration file /etc/raddb/modules/sqlcounter_expire_on_login including configuration file /etc/raddb/modules/smsotp including configuration file /etc/raddb/modules/unix including configuration file /etc/raddb/modules/mac2vlan including configuration file /etc/raddb/modules/files including configuration file /etc/raddb/modules/detail.example.com including configuration file /etc/raddb/modules/realm including configuration file /etc/raddb/modules/linelog including configuration file /etc/raddb/eap.conf including configuration file /etc/raddb/policy.conf including files in directory /etc/raddb/sites-enabled/ including configuration file /etc/raddb/sites-enabled/control-socket including configuration file /etc/raddb/sites-enabled/inner-tunnel including configuration file /etc/raddb/sites-enabled/default main { user = "radiusd" group = "radiusd" allow_core_dumps = no } including dictionary file /etc/raddb/dictionary main { name = "radiusd" prefix = "/usr" localstatedir = "/var" sbindir = "/usr/sbin" logdir = "/var/log/radius" run_dir = "/var/run/radiusd" libdir = "/usr/lib64/freeradius" radacctdir = "/var/log/radius/radacct" hostname_lookups = no max_request_time = 30 cleanup_delay = 5 max_requests = 1024 pidfile = "/var/run/radiusd/radiusd.pid" checkrad = "/usr/sbin/checkrad" debug_level = 0 proxy_requests = yes log { stripped_names = no auth = no auth_badpass = no auth_goodpass = no } security { max_attributes = 200 reject_delay = 1 status_server = yes } } radiusd: #### Loading Realms and Home Servers #### proxy server { retry_delay = 5 retry_count = 3 default_fallback = no dead_time = 120 wake_all_if_all_dead = no } home_server localhost { ipaddr = 127.0.0.1 port = 1812 type = "auth" secret = "testing123" response_window = 20 max_outstanding = 65536 require_message_authenticator = yes zombie_period = 40 status_check = "status-server" ping_interval = 30 check_interval = 30 num_answers_to_alive = 3 num_pings_to_alive = 3 revive_interval = 120 status_check_timeout = 4 coa { irt = 2 mrt = 16 mrc = 5 mrd = 30 } } home_server_pool my_auth_failover { type = fail-over home_server = localhost } realm example.com { auth_pool = my_auth_failover } realm LOCAL { } radiusd: #### Loading Clients #### client localhost { ipaddr = 127.0.0.1 require_message_authenticator = no secret = "testing123" nastype = "other" } radiusd: #### Instantiating modules #### instantiate { Module: Linked to module rlm_exec Module: Instantiating module "exec" from file /etc/raddb/modules/exec exec { wait = no input_pairs = "request" shell_escape = yes } Module: Linked to module rlm_expr Module: Instantiating module "expr" from file /etc/raddb/modules/expr Module: Linked to module rlm_expiration Module: Instantiating module "expiration" from file /etc/raddb/modules/expiration expiration { reply-message = "Password Has Expired " } Module: Linked to module rlm_logintime Module: Instantiating module "logintime" from file /etc/raddb/modules/logintime logintime { reply-message = "You are calling outside your allowed timespan " minimum-timeout = 60 } } radiusd: #### Loading Virtual Servers #### server { # from file /etc/raddb/radiusd.conf modules { Module: Creating Auth-Type = digest Module: Creating Post-Auth-Type = REJECT Module: Checking authenticate {...} for more modules to load Module: Linked to module rlm_pap Module: Instantiating module "pap" from file /etc/raddb/modules/pap pap { encryption_scheme = "auto" auto_header = no } Module: Linked to module rlm_chap Module: Instantiating module "chap" from file /etc/raddb/modules/chap Module: Linked to module rlm_mschap Module: Instantiating module "mschap" from file /etc/raddb/modules/mschap mschap { use_mppe = yes require_encryption = no require_strong = no with_ntdomain_hack = no allow_retry = yes } Module: Linked to module rlm_digest Module: Instantiating module "digest" from file /etc/raddb/modules/digest Module: Linked to module rlm_unix Module: Instantiating module "unix" from file /etc/raddb/modules/unix unix { radwtmp = "/var/log/radius/radwtmp" } Module: Linked to module rlm_eap Module: Instantiating module "eap" from file /etc/raddb/eap.conf eap { default_eap_type = "md5" timer_expire = 60 ignore_unknown_eap_types = no cisco_accounting_username_bug = no max_sessions = 4096 } Module: Linked to sub-module rlm_eap_md5 Module: Instantiating eap-md5 Module: Linked to sub-module rlm_eap_leap Module: Instantiating eap-leap Module: Linked to sub-module rlm_eap_gtc Module: Instantiating eap-gtc gtc { challenge = "Password: " auth_type = "PAP" } Module: Linked to sub-module rlm_eap_tls Module: Instantiating eap-tls tls { rsa_key_exchange = no dh_key_exchange = yes rsa_key_length = 512 dh_key_length = 512 verify_depth = 0 CA_path = "/etc/raddb/certs" pem_file_type = yes private_key_file = "/etc/raddb/certs/server.pem" certificate_file = "/etc/raddb/certs/server.pem" CA_file = "/etc/raddb/certs/ca.pem" private_key_password = "whatever" dh_file = "/etc/raddb/certs/dh" random_file = "/etc/raddb/certs/random" fragment_size = 1024 include_length = yes check_crl = no cipher_list = "DEFAULT" cache { enable = no lifetime = 24 max_entries = 255 } verify { } ocsp { enable = no override_cert_url = yes url = "http://127.0.0.1/ocsp/" } } Module: Linked to sub-module rlm_eap_ttls Module: Instantiating eap-ttls ttls { default_eap_type = "md5" copy_request_to_tunnel = no use_tunneled_reply = no virtual_server = "inner-tunnel" include_length = yes } Module: Linked to sub-module rlm_eap_peap Module: Instantiating eap-peap peap { default_eap_type = "mschapv2" copy_request_to_tunnel = no use_tunneled_reply = no proxy_tunneled_request_as_eap = yes virtual_server = "inner-tunnel" soh = no } Module: Linked to sub-module rlm_eap_mschapv2 Module: Instantiating eap-mschapv2 mschapv2 { with_ntdomain_hack = no send_error = no } Module: Checking authorize {...} for more modules to load Module: Linked to module rlm_preprocess Module: Instantiating module "preprocess" from file /etc/raddb/modules/preprocess preprocess { huntgroups = "/etc/raddb/huntgroups" hints = "/etc/raddb/hints" with_ascend_hack = no ascend_channels_per_line = 23 with_ntdomain_hack = no with_specialix_jetstream_hack = no with_cisco_vsa_hack = no with_alvarion_vsa_hack = no } Module: Linked to module rlm_realm Module: Instantiating module "suffix" from file /etc/raddb/modules/realm realm suffix { format = "suffix" delimiter = "@" ignore_default = no ignore_null = no } Module: Linked to module rlm_files Module: Instantiating module "files" from file /etc/raddb/modules/files files { usersfile = "/etc/raddb/users" acctusersfile = "/etc/raddb/acct_users" preproxy_usersfile = "/etc/raddb/preproxy_users" compat = "no" } Module: Checking preacct {...} for more modules to load Module: Linked to module rlm_acct_unique Module: Instantiating module "acct_unique" from file /etc/raddb/modules/acct_unique acct_unique { key = "User-Name, Acct-Session-Id, NAS-IP-Address, Client-IP-Address, NAS-Port" } Module: Checking accounting {...} for more modules to load Module: Linked to module rlm_detail Module: Instantiating module "detail" from file /etc/raddb/modules/detail detail { detailfile = "/var/log/radius/radacct/%{%{Packet-Src-IP-Address}:-%{Packet-Src-IPv6-Address}}/detail-%Y%m%d" header = "%t" detailperm = 384 dirperm = 493 locking = no log_packet_header = no } Module: Linked to module rlm_radutmp Module: Instantiating module "radutmp" from file /etc/raddb/modules/radutmp radutmp { filename = "/var/log/radius/radutmp" username = "%{User-Name}" case_sensitive = yes check_with_nas = yes perm = 384 callerid = yes } Module: Linked to module rlm_attr_filter Module: Instantiating module "attr_filter.accounting_response" from file /etc/raddb/modules/attr_filter attr_filter attr_filter.accounting_response { attrsfile = "/etc/raddb/attrs.accounting_response" key = "%{User-Name}" relaxed = no } Module: Checking session {...} for more modules to load Module: Checking post-proxy {...} for more modules to load Module: Checking post-auth {...} for more modules to load Module: Instantiating module "attr_filter.access_reject" from file /etc/raddb/modules/attr_filter attr_filter attr_filter.access_reject { attrsfile = "/etc/raddb/attrs.access_reject" key = "%{User-Name}" relaxed = no } } # modules } # server server inner-tunnel { # from file /etc/raddb/sites-enabled/inner-tunnel modules { Module: Checking authenticate {...} for more modules to load Module: Checking authorize {...} for more modules to load Module: Checking session {...} for more modules to load Module: Checking post-proxy {...} for more modules to load Module: Checking post-auth {...} for more modules to load } # modules } # server radiusd: #### Opening IP addresses and Ports #### listen { type = "auth" ipaddr = * port = 0 } listen { type = "acct" ipaddr = * port = 0 } listen { type = "control" listen { socket = "/var/run/radiusd/radiusd.sock" } } listen { type = "auth" ipaddr = 127.0.0.1 port = 18120 } ... adding new socket proxy address * port 35647 Listening on authentication address * port 1812 Listening on accounting address * port 1813 Listening on command file /var/run/radiusd/radiusd.sock Listening on authentication address 127.0.0.1 port 18120 as server inner-tunnel Listening on proxy address * port 1814 Ready to process requests. Ready to process requests. Signalled to terminate Exiting normally.

2 1

Re: FreeRADIUS Accounting Logging to Two Separate Locations Simultaneously
by Alan Buxey 05 Sep '13

05 Sep '13

The default install comes with a few accounting virtual servers that you can use. I'd strongly advise one of the or of band asynchronous ones. If you use UDP syslog is not blocking. .. it is fire and forget. .. so if you might lose packets if you have congested links or a disruption between source and destination. For security throw a VPN tunnel between the hosts. At the end is whatever floats your boat and is maintainable. . you had a big list some of which seem prone to issues and overworked. And why not think of it the other way around? Let security have all the logs and then give ops access to the data via their system. ..ops then no longer need to worry about data retention, the legal issues, disk space etc. ..they just run a radius daemon ;) alan

2 1

Freeradius 2.2.0 - binaries not being installed ???
by Ben 05 Sep '13

05 Sep '13

Hi, Am I being stupid or what ? 3.5.0-26-generic #42~precise1-Ubuntu Downloaded ftp://ftp.freeradius.org/pub/freeradius/freeradius-server-2.2.0.tar.gz Ran "./configure --sysconfdir=/etc --localstatedir=/var --prefix=/usr --exec-prefix=/usr --mandir=/usr/share/man --libdir=/usr/lib/freeradius --datadir=/usr/share" Then make && make install But "# find / -name "freeradius" -print" gives..... /var/lib/update-rc.d/freeradius /var/log/freeradius /usr/local/include/freeradius /usr/local/share/doc/freeradius /usr/local/share/freeradius /usr/include/freeradius /usr/sbin/freeradius /usr/lib/freeradius /usr/share/doc/freeradius /usr/share/freeradius /run/freeradius

3 4

FreeRADIUS Accounting Logging to Two Separate Locations Simultaneously
by Chris Decker 05 Sep '13

05 Sep '13

All, I could use some help in understanding my options for the following scenario: In our environment, FreeRADIUS currently writes its Accounting logs to the local drive - one file per authorized client. In addition to the local logging, the Security group wants the Accounting logs sent to their logging cluster (in real-time) so they can put them in their elasticsearch database and respond to incidents. My question: What is the best way to make both the Ops and Security groups happy given the below limitations: - The Security group does not want to pull the logs from MySQL, as they want to use logstash/elasticsearch and this would just complicate things. - The Ops group wants to avoid syslog because they fear syslog could block, causing their production FreeRADIUS servers to eventually stop responding to requests. ------ The options we are exploring, in order of preference: 1. "Robust Accounting" - the Ops team believes there is a way to have the logs written to two locations simultaneously - locally and remotely, and if the remote connection is lost it does not impact operations. Is this possible? Does anyone have a sample config they could share? 2. Re-configure FreeRADIUS to write to one giant log-file, rotated hourly. A script would then essentially 'tail -f' the log file and stream the logs to the Security group (and would handle the hourly filename changes obviously). 3. Re-configure FreeRADIUS to log to syslog, and have syslog write to a local file AND send remotely to the Security group. The Ops group wants to avoid syslog if at all possible. 4. Re-configure FreeRADIUS to also log to MySQL. The Security group would then have to figure out a way to pull the data out in near-real time and insert it into their own database, which they would like to avoid. Any comments or suggestions are welcome. Thanks, Chris

2 1

ldap xlat, limiting number of returned items to 1
by Martin Kraus 05 Sep '13

05 Sep '13

Hi. I'm assigning profiles from ldap to User-Profile and I have a corner case where a user can actually have multiple profiles which returns more then one record and nothing gets assigned to User-Profile. Is there a way to specify sizelimit for a ldap lookup to 1? thanks Martin

1 0

differentiate authoriztion/ authentication in separate ldap modules
by Hachmer, Tobias 04 Sep '13

04 Sep '13

Hello list, first of all a bit background about my environment: - CentOS 6.4 - FreeRADIUS Version 2.1.12, for host x86_64-redhat-linux-gnu, built on Oct 3 2012 at 01:22:51 - OpenLDAP: slapd 2.4.23 (Apr 29 2013 07:47:08) Here we use Microsoft Active Directory (not in our responsibility) for User Authentication. I have set up an OpenLDAP Master/ Slave construct (syncrepl) for RADIUS authorization and (fallback) authentication, like: LDAP Master | -------------------------------------------------------------------------------- | | RADIUS Primary RADIUS Secondary local LDAP copy local LDAP copy All RADIUS authorization information are stored in the OpenLDAP DIT using RADIUS profiles. The usernames in OpenLDAP DIT and in Active Directory are the same. The normal scenario should be: - retrieve authorization from openldap dit (module ldap_openldap) - authenticate the user (password verification) against active directory (module ldap_ad) o if active directory server isn't reachable check password against module ldap_openldap Problem: After the module ldap_openldap has found the DN for the requesting user freeradius uses the same DN to bind against module ldap_ad. I know this can't work. Is there a possible solution for this using ldap? - Configure module ldap_ad to determine the DN of user again? - Rewrite DN? If not, would this work using ntlm_auth? Any help appreciated. Kind regards, Tobias Hachmer

4 6

Re: CLASS value in SQL xlat
by Okis Chuang 04 Sep '13

04 Sep '13

Dear Arran, Much thanks! It works! Okis

1 0

CLASS value in SQL xlat
by Okis Chuang 04 Sep '13

04 Sep '13

Hi all, I'm using FR 2.2.0 with Oracle 11g. Now I'm collecting Accounting records into Oracle DB with sql xlat which call a function in PL/SQL. For example in debug mode it expands like below: "%{sql:select wifi_acct.onlineStart(..., '%{Class[*]}',..) from dual}" "TestCL: v=1234;TestCL2: w=5678" => "TestCL: v=3D123456=3BTestCL2: w=3D5678" Here comes the problem, through xlat content of '%{Class[*]}' in SQL string was turned into something like URL encoded string(but not exactly the same) while executing my PL/SQL function. Anyone knows what encode format it is? Any advice would be appreciated! Okis

2 1