- Freeradius-Users - lists.freeradius.org

autostarting fr on osx
by Alex Sharaz 29 Mar '13

29 Mar '13

Hi, I'm running FR2.2 on my osX server at home. At the moment I'm just invoking it from the command line. Given that osx comes with FR 2.1.10 preinstalled ( supplied version disabled), what's the best way of auto starting the git built 2.2 version on os x? Replace /usr/sbin/radiusd with a symbolic link to /usr/local/sbin/radiusd or build a different launch daemon config for the new release. Rgds Alex

2 1

rlm_detail alternatives?
by Konstantin Chekushin 29 Mar '13

29 Mar '13

3 2

Trying to do proxy using realm and 2 VS
by Vincent, Fabien 28 Mar '13

28 Mar '13

Hi all, I'm currently working on a fresh FreeRadius 2.x install, in order to separate Radius auth for Administrators (Firewall, Routeurs & Switchs administration) and Customers access (VPN SSL / IPSec). My first try was to rewrite all the config into virtual servers (previously, all was written into radiusd.conf :(). So what I did : [root@server /etc/raddb]$ ll sites-enabled/ total 0 lrwxrwxrwx. 1 root root 33 Mar 19 12:01 administrator -> /etc/raddb/sites-available/administrator lrwxrwxrwx. 1 root root 43 Mar 26 18:16 customer -> /etc/raddb/sites-available/coreye_customers This is my two VS : server administrator { # Authenticate / Authorize listener listen { ipaddr = * port = 1600 type = auth } # Accounting listener listen { ipaddr = * port = 1601 type = acct } [...] server customer { # Authenticate / Authorize listener listen { ipaddr = * port = 1602 type = auth } # Accounting listener listen { ipaddr = * port = 1603 type = acct } [...] And in order to proxy, I want to forward using proxy depending realm (proxy.conf) realm ".*customer$" { virtual_server = customer } realm ".*admin$" { virtual_server = administrator } realm NULL { virtual_server = administrator } But when logging into Radius, it works for VS Administrator (login admin or user@admin), but if I try using login@customer, it's never proxy to virtual server customer. I tried different methods always shown in the mailing list, but no way, it's never working ... Proxy to realm into authorize section : if (Realm == customer) { update control { Proxy-To-Realm := customer } } Not working ... The request is always managed by administrator vs. Always played using dynamic clients example and FreeRADIUS-Client-Virtual-Server = "customer", but not working again. I suspect the problem located in my NAS MySQL table, where "server" column is forced to virtual server "administrator" Is anything I missed to do ? What's the best solution to do this kind of configuration when nas are stored in MySQL DB, and some of the nas clients could be used by different virtual servers ? What the is the best way to have a single radius IP server, and two different virtual servers with two different set of rules ? Thanks in advance for your help ! Fabien VINCENT http://www.coreye.fr<http://www.coreye.fr/>

1 0

New/updated dictionary files for Meru and Trapeze
by John Carter 28 Mar '13

28 Mar '13

Hi, Please find attached a brand-new Meru dictionary file and an updated Trapeze dictionary file (updated based on 2.2.0). Do you want diffs? Regards, John.

2 3

Re : Re: Re : Re: Mode debug
by Billot 28 Mar '13

28 Mar '13

When using raddebug or -x option in startup, i can't see logs like User-Name = "nagios(a)ac-orleans-tours.fr" NAS-IP-Address = 172.21.175.132 NAS-Identifier = "hello" NAS-Port = 0 Called-Station-Id = "2C-B0-5D-A4-52-00:WIFI-ACAD" Calling-Station-Id = "8C-77-12-53-62-0E" Framed-MTU = 1400 NAS-Port-Type = Wireless-802.11 Connect-Info = "CONNECT 0Mbps 802.11g" which can be found with -X I tried radiusd -xxxxl /var/log/debug.log, file exists but is as detailled as with debug_level = 2 in radiusd.conf I tried radmin, debug level 4, debug file debug.log and same way. Any idea ? Le 28/03/13, Olivier Beytrison <olivier(a)heliosnet.org> a écrit : > On 28.03.2013 10:31, Billot wrote: > > Ok thanks but is it possible to have it permanently with a config item like > > > > raddbdir = ${sysconfdir}/raddb > > radacctdir = ${logdir}/radacct > > debug_level = 4 > > > > edit your startup script and add -xl /path/to/my/debugfile > add more x for more debugging > Be aware that this file will grow quickly depending on the amount of > request your server handle. > > Olivier > -- > > Olivier Beytrison > Network & Security Engineer, HES-SO Fribourg > Mail: olivier(a)heliosnet.org > - > List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html > > -- Emmanuel BILLOT CATEL - Dpt. Système et Réseaux Rectorat - Académie d'Orléans-Tours 10, rue Molière - 45000 Orléans Tél : 02 38 79 45 57

2 2

compile error
by Igor Smitran 28 Mar '13

28 Mar '13

I am not able to compile from git. It ends with error: version.c:71: warning: no previous prototype for 'ssl_version_check' version.c: In function 'ssl_version': version.c:78: error: expected ';' before '}' token gmake[4]: *** [version.lo] Error 1 gmake[4]: Leaving directory `/usr/src/freeradius-git-2.x.x/freeradius-server/src/main' gmake[3]: *** [main] Error 2 gmake[3]: Leaving directory `/usr/src/freeradius-git-2.x.x/freeradius-server/src' gmake[2]: *** [all] Error 2 gmake[2]: Leaving directory `/usr/src/freeradius-git-2.x.x/freeradius-server/src' gmake[1]: *** [src] Error 2 gmake[1]: Leaving directory `/usr/src/freeradius-git-2.x.x/freeradius-server' make: *** [all] Error 2

2 2

Mode debug
by Billot 28 Mar '13

28 Mar '13

Hi, When debugging freeradius config, we use radiusd -X which can offer a lot of useful datas like rad_recv: Access-Request packet from host 172.21.175.132 port 32769, id=166, length=332 User-Name = "nagios(a)ac-orleans-tours.fr" NAS-IP-Address = 172.21.175.132 NAS-Identifier = "hello" NAS-Port = 0 Called-Station-Id = "2C-B0-5D-A4-52-00:WIFI-ACAD" Calling-Station-Id = "8C-77-12-53-62-0E" Framed-MTU = 1400 NAS-Port-Type = Wireless-802.11 Connect-Info = "CONNECT 0Mbps 802.11g" but in standard running mode (service radius start), even with debug = 2 set, there is no such detailed log. How can we have such detail logs in running mode ? -- Emmanuel BILLOT CATEL - Dpt. Système et Réseaux Rectorat - Académie d'Orléans-Tours 10, rue Molière - 45000 Orléans Tél : 02 38 79 45 57

2 3

Auth-Type krb5 not recognized by v2.1.12
by Jaap Winius 27 Mar '13

27 Mar '13

Hi folks, Recently my server received an in-place upgrade from Debian squeeze to wheezy (still testing). Along with that, freeradius was upgraded from version 2.1.10 to 2.1.12, but as a result it no longer works. The problem is that I use "DEFAULT Auth-Type = krb5" in /etc/freeradius/ users, and this now leads to an error in the radius.log that prevents freeradius from starting up: Error: /etc/freeradius/users[207]: Parse error (check) for \ entry DEFAULT: Unknown value krb5 for attribute Auth-Type Interestingly, if I use "kerberos" instead of "krb5" for the default auth- type, there is no such error in the radius.log, but I still can't authenticate. Downgrading to 2.1.10 quickly fixes the problem. Is this new behavior intentional, or is it simply a bug? In either case, is there a workaround or a code fix for this, or should I continue to use 2.1.10? Thanks, Jaap

4 7

Update reply to DHCP-Ack
by Leo Combes 27 Mar '13

27 Mar '13

I have a small problem that I do not know how to solve. Freeradius works correctly as DHCP server delivering static IPs, but I need to write a log in the PostAuth database if the transaction finalizes with a DHCP-Ack. Currently when transaction ends with a DHCP-Ack, this configuration log a "DHCP-Request" instead of "DHCP-Ack". This is my setup: server dhcp { listen { type = dhcp ipaddr = 255.255.255.255 port = 67 interface = eth1.2 broadcast = yes } dhcp DHCP-Discover { update reply { DHCP-Message-Type = DHCP-Offer } update reply { DHCP-Domain-Name-Server = 0.0.0.0 DHCP-IP-Address-Lease-Time = 7200 DHCP-DHCP-Server-Identifier = 172.31.1.1 } deselabs_dhcp_cpes.authorize ok } dhcp DHCP-Request { update reply { # Is not the type supposed to be changed here? DHCP-Message-Type = DHCP-Ack } update reply { DHCP-Domain-Name-Server = 0.0.0.0 DHCP-IP-Address-Lease-Time = 7200 DHCP-DHCP-Server-Identifier = 172.31.1.1 Reply-Message = "Framed protocol is" } deselabs_dhcp_cpes.authorize deselabs_dhcp_cpes.post-auth ok } dhcp { # send a DHCP NAK. reject } } This is the debug output: Received DHCP-Discover of id 7ca9d708 from 0.0.0.0:68 to 255.255.255.255:67 DHCP-Opcode = Client-Message DHCP-Hardware-Type = Ethernet DHCP-Hardware-Address-Length = 6 DHCP-Hop-Count = 0 DHCP-Transaction-Id = 2091505416 DHCP-Number-of-Seconds = 0 DHCP-Flags = Broadcast DHCP-Client-IP-Address = 0.0.0.0 DHCP-Your-IP-Address = 0.0.0.0 DHCP-Server-IP-Address = 0.0.0.0 DHCP-Gateway-IP-Address = 0.0.0.0 DHCP-Client-Hardware-Address = 00:50:c2:31:24:4f DHCP-Message-Type = DHCP-Discover DHCP-Client-Identifier = 0x010050c231244f00 DHCP-IP-Address-Lease-Time = 4294967040 DHCP-IP-Address-Lease-Time = 4294967295 DHCP-Parameter-Request-List = DHCP-Subnet-Mask DHCP-Parameter-Request-List = DHCP-Router-Address DHCP-Parameter-Request-List = DHCP-Domain-Name-Server DHCP-Parameter-Request-List = DHCP-Domain-Name DHCP-Parameter-Request-List = DHCP-Bootp-Extensions-Path DHCP-Parameter-Request-List = DHCP-TFTP-Server-Name DHCP-Parameter-Request-List = DHCP-SIP-Servers-DHCP-Option DHCP-Parameter-Request-List = DHCP-HTTP-Proxy DHCP-Parameter-Request-List = 213 DHCP-Parameter-Request-List = 214 DHCP-Parameter-Request-List = 215 server dhcp { Trying sub-section dhcp DHCP-Discover {...} +- entering group DHCP-Discover {...} ++[reply] returns noop ++[reply] returns noop [deselabs_dhcp_cpes] expand: %{DHCP-Client-Hardware-Address} -> 00:50:c2:31:24:4f [deselabs_dhcp_cpes] sql_set_user escaped user --> '00:50:c2:31:24:4f' rlm_sql (deselabs_dhcp_cpes): Reserving sql socket id: 4 [deselabs_dhcp_cpes] expand: SELECT '1', mac_address, 'Cleartext-Password', REPLACE('%{SQL-User-Name}', ':', ''), ':=' FROM cpes WHERE mac_address = REPLACE('%{SQL-User-Name}', ':', '') UNION SELECT '2', mac_address, 'Auth-Type', 'Accept', ':=' FROM cpes WHERE mac_address = REPLACE('%{SQL-User-Name}', ':', '') -> SELECT '1', mac_address, 'Cleartext-Password', REPLACE('00:50:c2:31:24:4f', ':', ''), ':=' FROM cpes WHERE mac_address = REPLACE('00:50:c2:31:24:4f', ':', '') UNION SELECT '2', mac_address, 'Auth-Type', 'Accept', ':=' FROM cpes WHERE mac_address = REPLACE('00:50:c2:31:24:4f', ':', '') [deselabs_dhcp_cpes] User found in radcheck table [deselabs_dhcp_cpes] expand: SELECT '1', mac_address as username, 'DHCP-Your-IP-Address' AS attribute, CONCAT_WS('.', nets.net_prefix, cpes.ip_host) AS value, '=' AS op FROM cpes LEFT OUTER JOIN nets ON cpes.net=nets.net_id WHERE cpes.mac_address = REPLACE('%{SQL-User-Name}', ':', '') UNION SELECT '2' as id, mac_address, 'DHCP-Subnet-Mask' AS attribute, nets.netmask AS value, '=' AS op FROM cpes LEFT OUTER JOIN nets ON cpes.net=nets.net_id WHERE cpes.mac_address = REPLACE('%{SQL-User-Name}', ':', '') UNION SELECT '3' as id, mac_address, 'DHCP-Router-Address' AS attribute, nets.gateway AS value, '=' AS op FROM cpes LEFT OUTER JOIN nets ON cpes.net=nets.net_id WHERE cpes.mac_address = REPLACE('%{SQL-User-Name}', ':', '') UNION SELECT '4' as id, mac_address, 'DHCP-Bootp-Extensions-Path' AS attribute, cpes_profiles.acf_name AS value, '=' AS op FROM cpes LEFT OUTER JOIN cpes_profiles ON cpes.profile=cpes_profiles.profile_id WHERE cpes.mac_address = REPLACE('%{SQL-User-Name}', ':', ' rlm_sql (deselabs_dhcp_cpes): Released sql socket id: 4 ++[deselabs_dhcp_cpes.authorize] returns ok ++[ok] returns ok } # server dhcp DHCP-Subnet-Mask = 255.255.255.0 DHCP-Router-Address = 172.31.1.1 DHCP-Domain-Name-Server = 0.0.0.0 DHCP-Bootp-Extensions-Path = "slave_clear.acf" DHCP-IP-Address-Lease-Time = 7200 DHCP-DHCP-Server-Identifier = 172.31.1.1 DHCP-TFTP-Server-Name = "172.31.1.1" Sending DHCP-Offer of id 7ca9d708 to 255.255.255.255:68 Finished request 0. Cleaning up request 0 ID 2091505416 with timestamp +6 Going to the next request Ready to process requests. Received DHCP-Request of id 7da9d708 from 0.0.0.0:68 to 255.255.255.255:67 DHCP-Opcode = Client-Message DHCP-Hardware-Type = Ethernet DHCP-Hardware-Address-Length = 6 DHCP-Hop-Count = 0 DHCP-Transaction-Id = 2108282632 DHCP-Number-of-Seconds = 0 DHCP-Flags = Broadcast DHCP-Client-IP-Address = 0.0.0.0 DHCP-Your-IP-Address = 0.0.0.0 DHCP-Server-IP-Address = 0.0.0.0 DHCP-Gateway-IP-Address = 0.0.0.0 DHCP-Client-Hardware-Address = 00:50:c2:31:24:4f DHCP-Message-Type = DHCP-Request DHCP-Client-Identifier = 0x010050c231244f00 DHCP-IP-Address-Lease-Time = 4294967040 DHCP-Requested-IP-Address = 172.31.1.12 DHCP-DHCP-Server-Identifier = 172.31.1.1 DHCP-IP-Address-Lease-Time = 4294967295 DHCP-Parameter-Request-List = DHCP-Subnet-Mask DHCP-Parameter-Request-List = DHCP-Router-Address DHCP-Parameter-Request-List = DHCP-Domain-Name-Server DHCP-Parameter-Request-List = DHCP-Domain-Name DHCP-Parameter-Request-List = DHCP-Bootp-Extensions-Path DHCP-Parameter-Request-List = DHCP-TFTP-Server-Name DHCP-Parameter-Request-List = DHCP-SIP-Servers-DHCP-Option DHCP-Parameter-Request-List = DHCP-HTTP-Proxy DHCP-Parameter-Request-List = 213 DHCP-Parameter-Request-List = 214 DHCP-Parameter-Request-List = 215 server dhcp { Trying sub-section dhcp DHCP-Request {...} +- entering group DHCP-Request {...} ++[reply] returns noop ++[reply] returns noop [deselabs_dhcp_cpes] expand: %{DHCP-Client-Hardware-Address} -> 00:50:c2:31:24:4f [deselabs_dhcp_cpes] sql_set_user escaped user --> '00:50:c2:31:24:4f' rlm_sql (deselabs_dhcp_cpes): Reserving sql socket id: 3 [deselabs_dhcp_cpes] expand: SELECT '1', mac_address, 'Cleartext-Password', REPLACE('%{SQL-User-Name}', ':', ''), ':=' FROM cpes WHERE mac_address = REPLACE('%{SQL-User-Name}', ':', '') UNION SELECT '2', mac_address, 'Auth-Type', 'Accept', ':=' FROM cpes WHERE mac_address = REPLACE('%{SQL-User-Name}', ':', '') -> SELECT '1', mac_address, 'Cleartext-Password', REPLACE('00:50:c2:31:24:4f', ':', ''), ':=' FROM cpes WHERE mac_address = REPLACE('00:50:c2:31:24:4f', ':', '') UNION SELECT '2', mac_address, 'Auth-Type', 'Accept', ':=' FROM cpes WHERE mac_address = REPLACE('00:50:c2:31:24:4f', ':', '') [deselabs_dhcp_cpes] User found in radcheck table [deselabs_dhcp_cpes] expand: SELECT '1', mac_address as username, 'DHCP-Your-IP-Address' AS attribute, CONCAT_WS('.', nets.net_prefix, cpes.ip_host) AS value, '=' AS op FROM cpes LEFT OUTER JOIN nets ON cpes.net=nets.net_id WHERE cpes.mac_address = REPLACE('%{SQL-User-Name}', ':', '') UNION SELECT '2' as id, mac_address, 'DHCP-Subnet-Mask' AS attribute, nets.netmask AS value, '=' AS op FROM cpes LEFT OUTER JOIN nets ON cpes.net=nets.net_id WHERE cpes.mac_address = REPLACE('%{SQL-User-Name}', ':', '') UNION SELECT '3' as id, mac_address, 'DHCP-Router-Address' AS attribute, nets.gateway AS value, '=' AS op FROM cpes LEFT OUTER JOIN nets ON cpes.net=nets.net_id WHERE cpes.mac_address = REPLACE('%{SQL-User-Name}', ':', '') UNION SELECT '4' as id, mac_address, 'DHCP-Bootp-Extensions-Path' AS attribute, cpes_profiles.acf_name AS value, '=' AS op FROM cpes LEFT OUTER JOIN cpes_profiles ON cpes.profile=cpes_profiles.profile_id WHERE cpes.mac_address = REPLACE('%{SQL-User-Name}', ':', ' rlm_sql (deselabs_dhcp_cpes): Released sql socket id: 3 ++[deselabs_dhcp_cpes.authorize] returns ok [deselabs_dhcp_cpes] expand: %{DHCP-Client-Hardware-Address} -> 00:50:c2:31:24:4f [deselabs_dhcp_cpes] sql_set_user escaped user --> '00:50:c2:31:24:4f' [deselabs_dhcp_cpes] expand: %{User-Password} -> [deselabs_dhcp_cpes] ... expanding second conditional [deselabs_dhcp_cpes] expand: %{Chap-Password} -> [deselabs_dhcp_cpes] expand: INSERT INTO radius_postauth (username, password, reply, authdate) VALUES (UPPER(REPLACE('%{SQL-User-Name}', ':', '')), '%{%{User-Password}:-%{Chap-Password}}', '%{DHCP-Message-Type}', '%S') -> INSERT INTO radius_postauth (username, password, reply, authdate) VALUES (UPPER(REPLACE('00:50:c2:31:24:4f', ':', '')), '', 'DHCP-Request', '2013-03-25 12:53:15') rlm_sql (deselabs_dhcp_cpes) in sql_postauth: query is INSERT INTO radius_postauth (username, password, reply, authdate) VALUES (UPPER(REPLACE('00:50:c2:31:24:4f', ':', '')), '', 'DHCP-Request', '2013-03-25 12:53:15') rlm_sql (deselabs_dhcp_cpes): Reserving sql socket id: 2 rlm_sql (deselabs_dhcp_cpes): Released sql socket id: 2 ++[deselabs_dhcp_cpes.post-auth] returns ok ++[ok] returns ok } # server dhcp DHCP-Subnet-Mask = 255.255.255.0 DHCP-Router-Address = 172.31.1.1 DHCP-Domain-Name-Server = 0.0.0.0 DHCP-Bootp-Extensions-Path = "slave_clear.acf" DHCP-IP-Address-Lease-Time = 7200 DHCP-DHCP-Server-Identifier = 172.31.1.1 DHCP-TFTP-Server-Name = "172.31.1.1" Sending DHCP-Ack of id 7da9d708 to 255.255.255.255:68 Finished request 1. Cleaning up request 1 ID 2108282632 with timestamp +7 Going to the next request Ready to process requests. What should I change in my config if I want to change the DHCP-Message-Type to "DHCP-Ack" in order to get the correct log information? I tried using the ":=" operator with no luck.

1 1

Re: Auth-Type krb5 not recognized by v2.1.12
by Alan Buxey 27 Mar '13

27 Mar '13

What you are doing is actually okay (its one of those exceptions where auth-type needs to be present as the server has no idea to use krb5). I wonder if your server has been built with kerberos support? alan -- This smartphone uses free WiFi around the world with eduroam, now that's what I call smart.

3 2