- Freeradius-Users - lists.freeradius.org

Logging of socket command file
by John Horne 03 Sep '12

03 Sep '12

Hello, Using FreeRadius 2.1.10, I am seeing a lot of logged 'Info' messages about the socket command file. A snippet shows: ============================================ Mon Sep 3 11:12:41 2012 : Info: ... adding new socket command file /var/run/radiusd/radiusd.sock Mon Sep 3 11:12:41 2012 : Info: ... closing socket command file /var/run/radiusd/radiusd.sock Mon Sep 3 11:12:42 2012 : Info: ... adding new socket command file /var/run/radiusd/radiusd.sock Mon Sep 3 11:12:42 2012 : Info: ... closing socket command file /var/run/radiusd/radiusd.sock Mon Sep 3 11:12:43 2012 : Info: ... adding new socket command file /var/run/radiusd/radiusd.sock Mon Sep 3 11:12:43 2012 : Info: ... closing socket command file /var/run/radiusd/radiusd.sock Mon Sep 3 11:17:41 2012 : Info: ... adding new socket command file /var/run/radiusd/radiusd.sock Mon Sep 3 11:17:41 2012 : Info: ... closing socket command file /var/run/radiusd/radiusd.sock Mon Sep 3 11:17:42 2012 : Info: ... adding new socket command file /var/run/radiusd/radiusd.sock Mon Sep 3 11:17:42 2012 : Info: ... closing socket command file /var/run/radiusd/radiusd.sock ============================================ As can be seen this occurs for a few seconds, stops, then starts again five minutes later. I am at a bit of a loss as to what is causing this. My question is, is this something to be concerned about or is it normal for these messages to appear so often? Thanks, John. -- John Horne Tel: +44 (0)1752 587287 Plymouth University, UK Fax: +44 (0)1752 587001

2 2

Wiki Links
by Arran Cudbard-Bell 03 Sep '12

03 Sep '12

Hi All, The gollum maintainers found a serious security issue, and informed us that we should upgrade the wikis ASAP. I've now done the upgrade work, but one of the features added (hierachical pages) has broken all the links across the site. I've fixed all the links on the home page, but there are many more. If you wouldn't mind helping out on the pages that get most traffic, it'd be very much appreciated. Many thanks, Arran

4 6

Printing currnt time with file
by QASIM RAO 03 Sep '12

03 Sep '12

hi,i want to create log file for every hour i use radius. now it islog_file = ${logdir}/radius.logi want like thislog_file = ${logdir}/radius-%Y%m%d:%H.log if i change file name like above one radius create file ' radius-%Y%m%d:%H.log ' i want to create it like 'radius-20120903:08.log' pleae help me in this Regards Qasim

3 2

Unable to reply to thread
by Mudasir Mirza 03 Sep '12

03 Sep '12

Hi, I am unable to reply to thread from email or from list. I get below message when I reply to email. "Delivery Status Notification (Failure)" http://freeradius.1045715.n5.nabble.com/checkrad-not-working-td5715083.html -- Kind Regards Mudasir Mirza

3 2

Re: Wiki Links
by Alan Buxey 03 Sep '12

03 Sep '12

Ooh. Github can be used to maintain Wiki? How did I miss this change? As per Doug, hers best resource to start from? alan

2 1

Apple clients suddenly can't authenticate to EAP-MSCHAPV2
by Casartello, Thomas 02 Sep '12

02 Sep '12

Having a bizarre problem that started due to someone in my department deleting the samba computer account for my freeradius machine. I recreated it and for a time everything went back to normal, but later that afternoon all of my apple clients can simply not connect to our 802.1x enabled wireless network. We are using Cisco wireless controllers. Radiusd -X doesn't seem to be giving me enough debug output. Is there any suggestion as to drill down further to see what is going on here. I am having no issues with my Windows 7 clients and Windows mobile devices. Simply not getting enough information. Everything has been working fine for months and I don't understand why all of the sudden this is going on and why its only affecting Apple IOS devices and iMacs so far. Here's an example output. This simply loops over and over again: rad_recv: Access-Request packet from host 172.20.9.253 port 32769, id=63, length=228 User-Name = "oclarke" Calling-Station-Id = "10-40-f3-27-b9-83" Called-Station-Id = "00-1f-c9-ff-8a-d0:s-wsc" NAS-Port = 29 Cisco-AVPair = "audit-session-id=ac1409fd000000085042b3cc" NAS-IP-Address = 172.20.9.253 NAS-Identifier = "diller-wism-b" Airespace-Wlan-Id = 4 Service-Type = Framed-User Framed-MTU = 1300 NAS-Port-Type = Wireless-802.11 Tunnel-Type:0 = VLAN Tunnel-Medium-Type:0 = IEEE-802 Tunnel-Private-Group-Id:0 = "891" EAP-Message = 0x0207000c016f636c61726b65 Message-Authenticator = 0x6015385c05fd07141cd27b2bd7d4452a # Executing section authorize from file /usr/local/etc/raddb/sites-enabled/default +- entering group authorize {...} ++[preprocess] returns ok ++[chap] returns noop ++[mschap] returns noop ++[digest] returns noop [IPASS] No '/' in User-Name = "oclarke", looking up realm NULL [IPASS] No such realm "NULL" ++[IPASS] returns noop [suffix] No '@' in User-Name = "oclarke", looking up realm NULL [suffix] No such realm "NULL" ++[suffix] returns noop [ntdomain] No '\' in User-Name = "oclarke", looking up realm NULL [ntdomain] No such realm "NULL" ++[ntdomain] returns noop [eap] EAP packet type response id 7 length 12 [eap] No EAP Start, assuming it's an on-going EAP conversation ++[eap] returns updated [files] users: Matched entry DEFAULT at line 216 ++[files] returns ok ++[expiration] returns noop ++[logintime] returns noop [pap] WARNING! No "known good" password found for the user. Authentication may fail because of this. ++[pap] returns noop Found Auth-Type = EAP # Executing group from file /usr/local/etc/raddb/sites-enabled/default +- entering group authenticate {...} [eap] EAP Identity [eap] processing type tls [tls] Initiate [tls] Start returned 1 ++[eap] returns handled Sending Access-Challenge of id 63 to 172.20.9.253 port 32769 EAP-Message = 0x010800061920 Message-Authenticator = 0x00000000000000000000000000000000 State = 0x0ca5d3010cadca632a899d669d6fd38b Finished request 218. Going to the next request

2 4

Re: rlm_perl and dynamic_clients
by Steven Eksteen 01 Sep '12

01 Sep '12

Sorry. I wasn't paying attention and resent the initial question mail by accident instead of the following: I followed your instructions and the Packet-Src-IP-Address came through into the Perl script, thank you. I did however use Packet-Src-IP-Address-0 instead of Tmp-IP-Address-0 for ease of understanding, for anyone else looking at the script. I hope this is not what's affecting the operation. I hope the output below is enough information your you to see how I am adding to RAD_REPLY. I am returning RLM_MODULE_OK at the end of the script. I did try to use RLM_MODULE_UPDATED but that returned a result as if I was returning RLM_MODULE_FAIL, module failure. I also did try to use "directory = ${confdir}/dynamic-clients/" in the virtual server in case the failure might have been coming from somewhere not shown in the output, like the SQL module maybe --- client dynamic { ipaddr = 0.0.0.0 netmask = 0 dynamic_clients = dynamic_client_server lifetime = 3600 } server dynamic_client_server { authorize { update request { Packet-Src-IP-Address-0 := "%{Packet-Src-IP-Address}" } dynamic-clients-pl } } --- rad_recv: Access-Request packet from host 192.168.0.200 port 58738, id=36, length=212 server dynamic_client_server { rlm_perl: RAD_REQUEST: Packet-Src-IP-Address-0 = 192.168.0.200 rlm_perl: RAD_REPLY: FreeRADIUS-Client-Shortname = Internal rlm_perl: RAD_REPLY: FreeRADIUS-Client-Secret = 123456 rlm_perl: RAD_REPLY: FreeRADIUS-Client-NAS-Type = other rlm_perl: RAD_REPLY: FreeRADIUS-Client-IP-Address = 192.168.0.200 rlm_perl: Added pair Packet-Src-IP-Address-0 = 192.168.0.200 rlm_perl: Added pair FreeRADIUS-Client-Shortname = Internal rlm_perl: Added pair FreeRADIUS-Client-Secret = 123456 rlm_perl: Added pair FreeRADIUS-Client-NAS-Type = other rlm_perl: Added pair FreeRADIUS-Client-IP-Address = 192.168.0.200 } # server dynamic_client_server - Cannot add client 192.168.0.200: Required attribute "FreeRADIUS-Client-Secret" is missing. Ignoring request to authentication address * port 1812 as server r9 from unknown client 192.168.0.200 port 58738 On Fri, Aug 31, 2012 at 8:52 AM, Steven Eksteen <steven(a)rad9.net> wrote: > > I am pretty sure I might be missing something here, or having a giant blonde > moment. I followed your instructions and the Packet-Src-IP-Address came > through into the Perl script, thank you. I did however use > Packet-Src-IP-Address-0 instead of Tmp-IP-Address-0 for ease of > understanding. I hope this is not what's affecting the operation. > > I hope the output below is enough information your you to see how I am > adding to RAD_REPLY. I am returning RLM_MODULE_OK at the end of the script. > I did try to use RLM_MODULE_UPDATED but that returned a result as if I was > returning RLM_MODULE_FAIL, module failure. > > I also did try to use "directory = ${confdir}/dynamic-clients/" in the > virtual server in case the failure might have been coming from somewhere not > shown in the output, like the SQL module > > --- > > client dynamic { > ipaddr = 0.0.0.0 > netmask = 0 > dynamic_clients = dynamic_client_server > lifetime = 3600 > } > > server dynamic_client_server { > authorize { > update request { > Packet-Src-IP-Address-0 := > "%{Packet-Src-IP-Address}" > } > dynamic-clients-pl > } > } > > --- > > rad_recv: Access-Request packet from host 192.168.0.200 port 58738, id=36, > length=212 > server dynamic_client_server { > rlm_perl: RAD_REQUEST: Packet-Src-IP-Address-0 = 192.168.0.200 > rlm_perl: RAD_REPLY: FreeRADIUS-Client-Shortname = Internal > rlm_perl: RAD_REPLY: FreeRADIUS-Client-Secret = 123456 > rlm_perl: RAD_REPLY: FreeRADIUS-Client-NAS-Type = other > rlm_perl: RAD_REPLY: FreeRADIUS-Client-IP-Address = 192.168.0.200 > rlm_perl: Added pair Packet-Src-IP-Address-0 = 192.168.0.200 > rlm_perl: Added pair FreeRADIUS-Client-Shortname = Internal > rlm_perl: Added pair FreeRADIUS-Client-Secret = 123456 > rlm_perl: Added pair FreeRADIUS-Client-NAS-Type = other > rlm_perl: Added pair FreeRADIUS-Client-IP-Address = 192.168.0.200 > } # server dynamic_client_server > - Cannot add client 192.168.0.200: Required attribute > "FreeRADIUS-Client-Secret" is missing. > Ignoring request to authentication address * port 1812 as server r9 from > unknown client 192.168.0.200 port 58738 > Ready to process requests. > > --- > > > On Tue, Aug 28, 2012 at 4:21 PM, Steven Eksteen <steve(a)saoirse.co.za> wrote: >> >> Thank you. Much appreciated >> >> >> On Tue, Aug 28, 2012 at 4:14 PM, Alan DeKok <aland(a)deployingradius.com> >> wrote: >> > Steven Eksteen wrote: >> >> I was wondering how would I use "Packet-Src-IP-Address" using Perl for >> >> Dynamic Clients. I thought it might be part of the RAD_REQUEST hash. >> > >> > It's not, but you can do: >> > >> > server dynamic_client_server { >> > authorize { >> > update request { >> > Tmp-IP-Address-0 := "%{Packet-Src-IP-Address}" >> > } >> > >> > dynamic-clients-pl >> > } >> > } >> > >> > >> > And then use the Tmp-IP-Address-0 in the Perl code. >> > >> >> If some direction could be made as to setting >> >> "FreeRADIUS-Client-Shortname", "FreeRADIUS-Client-Secret", etc. too I >> >> would be very grateful. >> > >> > You just set them in the RAD_REPLY hash. >> > >> >> I already have Perl working for the normal AAA >> >> functions. This just doesn't appear to work the same way. I am not a >> >> Perl developer in the slightest so apologies in advance if this is a >> >> monumentally stupid question. >> > >> > Nope. It's a complicated system. >> > >> > Alan DeKok. >> > - >> > List info/subscribe/unsubscribe? See >> > http://www.freeradius.org/list/users.html > >

2 1

Question setting up Virtual Servers with unique clients / users files.
by Zach Simpson 31 Aug '12

31 Aug '12

Hi, I'm relatively new to FreeRADIUS, and I'm working on moving the administrative logins of our network devices (switches, routers, etc) to it. I was planning on using AD as my data source and creating groups (ex. Switches, Routers) so people could easily be assigned permissions for the various devices. I believe I have the AD/Ldap Group retrieval parts working. What I'm having issues with is creating user file rules for each group of devices. I have a few rules in the users file that look like this: DEFAULT Ldap-Group == "Switch Admins" Reply-Message = "Welcome Switch Admin!" DEFAULT Ldap-Group == "Router Admins" Reply-Message = "Welcome Router Admin!" But the issue is that if a user is a member of both groups, it stops at the first match. Is there a way to specify a specific "users" file for each entry in the "Clients" file? I'm thinking that to do this I will need to setup a virtual server for each client group, but I'm not finding much in the ways of sample configurations that let me specify the "users" file as well. Thanks, Zach

3 3

Log rotation
by Antonio Modesto 31 Aug '12

31 Aug '12

Hi, Today I'm rotating my log files with a script that runs every night, the problem is that it must stop the radiusd process, rename the file, create a new one then start radiusd again. Is there a way to do that transparently? Via syslog or something else? Regards.

4 5

RE: Integration with CISCO Router for PEAP requests
by Andras Ionut 31 Aug '12

31 Aug '12

Hi Phil, Sorry if this looks dump for you. I've read your post the reason I've explicitely asked how to do this in PEAP is because in the post it says: "This only works for PAP, and does NOT work for EAP-TLS, CHAP, *MSCHAP*, or WIMAX authentication." Now, I especially need to send Access-Accept for PEAP with inner EAP-MSCHAPv2, and I also I don't use MyQL to select the users. I've also tried to set Access-Accept as any other AVP from my Freeradius module, but doesn't work. (extract from log attached) Can you please help? Thanks in advance. Andras On 30/08/12 15:11, Andras Ionut wrote: > Hi Phil, > > Thanks a lot for the quick response. > > I need this for PEAP with EAP protocol inside the tunnel, like EAP-MSCHAPv2. > > Again, The device MUST reject the connection as EAP is not completed, > but the ROUTER needs that Access-Accept, > in order to be able to redirect user to portal. > > Can this be done? The technique to do this is described in the FAQ entry I linked. Did you read it?

3 3