- Freeradius-Users - lists.freeradius.org

Re: Radius copy accounting
by Alan Buxey 08 Aug '12

08 Aug '12

Cool. alan

1 0

Re: sql returns fail for some stop requests
by Amir Tal 08 Aug '12

08 Aug '12

After moving MYSQL to a clustered environment, and moving all backup and not related tasks to slave hosts, It seems the issue is resolved, radius has been running for several days without any errors and/or sessions not being stopped. Thanks for all your help and suggestions, Amir.

1 0

Re: Radius copy accounting
by BELLIERE Eric 08 Aug '12

08 Aug '12

Many thanks I have then create a new dictionary with IANA number of my entreprise and add a new attribute Now I can see it in the proxyed packet. > Yes Thanks But I tried to force in preacct with update reply { Realm > += "%{Realm}" } but still no attribute realm in the packet proxied to > other radius? ..and you were already told that 'Realm' is an internal attribute - you need to define your own attribute...or borrow another that isnt of concern - and then assign that eg All info here :-) http://www.lmgtfy.com/?q=FreeRadius+radrelay+proxying+the+Realm+attribut e+to+the+home_server&l=1 Eric B. *********************** *****DISCLAIMER***** This electronic transmission (and any attached document) is intended exclusively for the person or entity to whom it is addressed and may contain confidential and/or privileged material. Any disclosure, copying, distribution or other action based upon the information by persons or entities other than the intended recipient is prohibited. If you receive this message in error, please contact the sender and delete the material from any and all computers. Mobistar does not warrant a proper and complete transmission of this information, nor does it accept liability for any delays. *****END OF DISCLAIMER*****

1 0

Problem with EAP Authentication working not every time
by stefan novak 08 Aug '12

08 Aug '12

Hello! we are using freeradius2 version 2.1.10 on a centos/rhel 5 Server. We authenticate several ubnt clients on ubnt AP's via EAP-PEAP/MSCHAPV2. This works very well, but sometimes the clients got an Access-Reject and i don't know why ;( I set the radius Server to debug mode and get those output: Waking up in 0.7 seconds. Waking up in 2.2 seconds. Waking up in 1.9 seconds. WARNING: !!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!! WARNING: !! EAP session for state 0x69522edb6a233743 did not finish! WARNING: !! Please read http://wiki.freeradius.org/Certificate_Compatibility WARNING: !!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!! Waking up in 0.3 seconds. Ready to process requests. Waking up in 0.9 seconds. [<thread>] # Executing section authorize from file /etc/raddb/sites-enabled/default rlm_sql (sql): Reserving sql socket id: 1 rlm_sql (sql): Released sql socket id: 1 # Executing group from file /etc/raddb/sites-enabled/default Waking up in 0.9 seconds. [<thread>] # Executing section authorize from file /etc/raddb/sites-enabled/default rlm_sql (sql): Reserving sql socket id: 0 rlm_sql (sql): Released sql socket id: 0 # Executing group from file /etc/raddb/sites-enabled/default Waking up in 0.9 seconds. [<thread>] # Executing section authorize from file /etc/raddb/sites-enabled/default # Executing group from file /etc/raddb/sites-enabled/default Waking up in 3.9 seconds. Waking up in 1.9 seconds. Waking up in 0.9 seconds. [<thread>] # Executing section authorize from file /etc/raddb/sites-enabled/default # Executing group from file /etc/raddb/sites-enabled/default rlm_eap: No EAP session matching the State variable. [eap] Either EAP-request timed out OR EAP-response to an unknown EAP-request Login incorrect: [m1588a00@EAP/<via Auth-Type = EAP>] (from client 10.55.0.0/16 port 0 cli 00-27-22-D2-CD-83) # Executing group from file /etc/raddb/sites-enabled/default rlm_sql (sql): Reserving sql socket id: 4 rlm_sql (sql): Released sql socket id: 4 Waking up in 0.9 seconds. The wiki talks about windows clients and decreasing the tunnel MTU. I'm not sure what they mean. How can i get a more detailed debug msg on what is actually wrong. thx for your help Stefan __________________ www.epb.at

5 11

RE: Radius copy accounting
by BELLIERE Eric 08 Aug '12

08 Aug '12

Yes Thanks But I tried to force in preacct with update reply { Realm += "%{Realm}" } but still no attribute realm in the packet proxied to other radius? Eric B. Send Freeradius-Users mailing list submissions to freeradius-users(a)lists.freeradius.org To subscribe or unsubscribe via the World Wide Web, visit http://lists.freeradius.org/mailman/listinfo/freeradius-users or, via email, send a message with subject or body 'help' to freeradius-users-request(a)lists.freeradius.org You can reach the person managing the list at freeradius-users-owner(a)lists.freeradius.org When replying, please edit your Subject line so it is more specific than "Re: Contents of Freeradius-Users digest..." Today's Topics: 1. RE: Radius copy accounting (BELLIERE Eric) 2. Re: Radius copy accounting (Fajar A. Nugraha) 3. Re: Problem with EAP Authentication working not every time (stefan novak) ---------------------------------------------------------------------- *****DISCLAIMER***** This electronic transmission (and any attached document) is intended exclusively for the person or entity to whom it is addressed and may contain confidential and/or privileged material. Any disclosure, copying, distribution or other action based upon the information by persons or entities other than the intended recipient is prohibited. If you receive this message in error, please contact the sender and delete the material from any and all computers. Mobistar does not warrant a proper and complete transmission of this information, nor does it accept liability for any delays. *****END OF DISCLAIMER*****

3 2

RE: Radius copy accounting
by BELLIERE Eric 08 Aug '12

08 Aug '12

Thanks but with sql I can send the attribute to Oracle DB without any problem? So can you please help me with this unlang command to add? And where? In preacct section of my virtual sites? Eric B. -----Original Message----- From: freeradius-users-bounces+eric.belliere=mail.mobistar.be(a)lists.freeradius .org [mailto:freeradius-users-bounces+eric.belliere=mail.mobistar.be@lists.fr eeradius.org] On Behalf Of freeradius-users-request(a)lists.freeradius.org Sent: Monday 6 August 2012 15:34 To: freeradius-users(a)lists.freeradius.org Subject: Freeradius-Users Digest, Vol 88, Issue 24 Send Freeradius-Users mailing list submissions to freeradius-users(a)lists.freeradius.org To subscribe or unsubscribe via the World Wide Web, visit http://lists.freeradius.org/mailman/listinfo/freeradius-users or, via email, send a message with subject or body 'help' to freeradius-users-request(a)lists.freeradius.org You can reach the person managing the list at freeradius-users-owner(a)lists.freeradius.org When replying, please edit your Subject line so it is more specific than "Re: Contents of Freeradius-Users digest..." Today's Topics: 1. Re: Radius copy accounting (Matthew Newton) 2. Re: Radius copy accounting (alan buxey) 3. Re: RES: FR 3 Event-Timestamp wrong format and Mysql FROM_UNIXTIME error (Alan DeKok) 4. Duplicate Radius Accounting (Christopher Manigan) 5. Re: Duplicate Radius Accounting (Alan DeKok) 6. Freeradius Accounting (Robert Souter) ---------------------------------------------------------------------- Message: 1 Date: Mon, 6 Aug 2012 13:39:06 +0100 From: Matthew Newton <mcn4(a)leicester.ac.uk> To: FreeRadius users mailing list <freeradius-users(a)lists.freeradius.org> Subject: Re: Radius copy accounting Message-ID: <20120806123906.GB15604(a)rootmail.cc.le.ac.uk> Content-Type: text/plain; charset=us-ascii On Mon, Aug 06, 2012 at 02:30:14PM +0200, BELLIERE Eric wrote: > As you can see this schema is working well except that the attribute REALM is not include in the packet? > > We can see it in the detail file but when FR proxy the packet this attribute is missing? Realm is an internal attribute (see dictionary.freeradius.internal) and as such doesn't appear in any packets in transit. Matthew -- Matthew Newton, Ph.D. <mcn4(a)le.ac.uk> Systems Architect (UNIX and Networks), Network Services, I.T. Services, University of Leicester, Leicester LE1 7RH, United Kingdom For IT help contact helpdesk extn. 2253, <ithelp(a)le.ac.uk> ------------------------------ Message: 2 Date: Mon, 6 Aug 2012 13:49:08 +0100 From: alan buxey <A.L.M.Buxey(a)lboro.ac.uk> To: FreeRadius users mailing list <freeradius-users(a)lists.freeradius.org> Subject: Re: Radius copy accounting Message-ID: <20120806124908.GA15665(a)lboro.ac.uk> Content-Type: text/plain; charset=us-ascii Hi, > As you can see this schema is working well except that the attribute REALM > is not include in the packet? as already said this is an internal engine attribute. if you want this to be exposed in other systems, you will need to use eg 'unlang' to populate a suitable attribute with this value alan ------------------------------ Message: 3 Date: Mon, 06 Aug 2012 14:59:34 +0200 From: Alan DeKok <aland(a)deployingradius.com> To: FreeRadius users mailing list <freeradius-users(a)lists.freeradius.org> Subject: Re: RES: FR 3 Event-Timestamp wrong format and Mysql FROM_UNIXTIME error Message-ID: <501FBFB6.7080409(a)deployingradius.com> Content-Type: text/plain; charset=ISO-8859-1 lscrlstld wrote: > '%{NAS-Port-Type}', FROM_UNIXTIME(%{Event-Timestamp}), Well, that's wrong. That was fixed ~2 weeks ago. I also said it should be %{integer:Event-Timestamp} Please grab an updated copy of the dialup.conf file. Alan DeKok. ------------------------------ Message: 4 Date: Mon, 6 Aug 2012 13:13:44 +0000 From: Christopher Manigan <cmanigan(a)towerstream.com> To: "freeradius-users(a)lists.freeradius.org" <freeradius-users(a)lists.freeradius.org> Subject: Duplicate Radius Accounting Message-ID: <72D41B40EE32E749AE3AE3B7190AA7CE1E142B97(a)MAIL01.corp.towerstream.com> Content-Type: text/plain; charset="us-ascii" In my logs I see many entries like the following: Info: WARNING: Child is hung for request 51651 in component <core> module <queue>.3 Error: Dropping request (2049 is too many): from client myhost.mysite port 32869 - ID: 239 In the last ~10 hours, the status server reports the following for accounting: Responses 0 Duplicate 954442 Malformed 115045 Invalid 564029 Dropped 0 Unknown 0 Radius will hang and start to time out and eventually die. It looks like the duplicate count gets extremely high very quickly. Could it be the NAS that are pointing to it? Or could it be my radius configs somehow causing this? I am not really sure how to prove it out or troubleshoot. I can increase the max requests but I don't think that is the right solution. Chris ------------------------------ Message: 5 Date: Mon, 06 Aug 2012 15:19:52 +0200 From: Alan DeKok <aland(a)deployingradius.com> To: FreeRadius users mailing list <freeradius-users(a)lists.freeradius.org> Subject: Re: Duplicate Radius Accounting Message-ID: <501FC478.1000604(a)deployingradius.com> Content-Type: text/plain; charset=ISO-8859-1 Christopher Manigan wrote: > In my logs I see many entries like the following: > > Info: WARNING: Child is hung for request 51651 in component <core> > module <queue>.3 > Error: Dropping request (2049 is too many): from client myhost.mysite > port 32869 - ID: 239 Something is blocking the server. This is usually a slow database. > In the last ~10 hours, the status server reports the following for accounting: > > Responses 0 > Duplicate 954442 > Malformed 115045 > Invalid 564029 That is *terrible*. Zero responses? It indicates a catastrophic failure in the system. And *malformed* packets? Something is sending NON RADIUS packets to the RADIUS port. Go fix that. And "invalid" packets? Something is sending non-accounting packets to the accounting port. > Dropped 0 > Unknown 0 > > Radius will hang and start to time out and eventually die. It looks like the duplicate count gets extremely high very quickly. Could it be the NAS that are pointing to it? Or could it be my radius configs somehow causing this? I am not really sure how to prove it out or troubleshoot. I can increase the max requests but I don't think that is the right solution. Your RADIUS system is horribly slow, and isn't finishing any requests. Go fix that. The default configuration *works*. And your NAS is broken. Something is very, very, wrong in your network. Find out what it is. Ensure that only RADIUS accounting packets go to the RADIUS accounting port. Alan DeKok. ------------------------------ Message: 6 Date: Mon, 6 Aug 2012 13:35:17 +0000 From: Robert Souter <robertsouter(a)highnet.com> To: "freeradius-users(a)lists.freeradius.org" <freeradius-users(a)lists.freeradius.org> Subject: Freeradius Accounting Message-ID: <35997DFB4CC3444CB74F176D4FBEAFBCCF92FC(a)HIGHNETDC2.Highnet.local> Content-Type: text/plain; charset="us-ascii" Afternoon All I apologies if I am sending detail the wrong way or the wrong format. But a newbie to this and also new to working with freeradius so I do apologies in advance if I have done something wrong. My issue with freeradius is Accounting The issue been I took over looking after the freeradius server when someone left, and he dealt with it himself up to then. What I am trying to figure out is that up to the day he left the server was doing accounting in the following directory Var/log/radius/radacct then below that was a folder for each server that was allowed to authenticate in the /clients.conf/ file I have checked the radius server and it is still using ports 1646 and 1645 have also check our cisco NAS router and it is pointing to our radius server with the secret password, which I have checked and are the same along with the same ports 1646 and 1645. If you can help it would be much appreciated. I am sorry if I have not put in the correct data but if you let me know I will try and put it right and adhere to your rules. Thanks very much for your assistance. Kind Regards Robert Robert Souter Network Engineer Office: 0345 450 4502 Fax: 0345 450 4503 [Description: C:\Users\roberts\AppData\Roaming\Microsoft\Signatures\signature logo.jpg] www.highnet.com<http://www.highnet.com> | connecting your business [Description: C:\Users\roberts\AppData\Roaming\Microsoft\Signatures\Twitter Icon.jpg]<http://twitter.com/HighNetTelecoms> [Description: C:\Users\roberts\AppData\Roaming\Microsoft\Signatures\LinkedIn Icon.jpg] <http://www.linkedin.com/company/highnet> [Description: C:\Users\roberts\AppData\Roaming\Microsoft\Signatures\Facebook Icon.jpg] <http://www.facebook.com/pages/HighNet-Telecoms/151941874838133> Please consider the environment before printing this e-mail. Why not further your environmental commitments with HighNet's Green Telecoms? Disclaimer: Any opinions expressed in this e-mail are those of the individual and not necessarily the Company. This e-mail and any files transmitted with it, including replies and forwarded copies (which may contain alterations) subsequently transmitted from the Company, are confidential and solely for the use of the intended recipient. If you are not the intended recipient of this transmission, please be advised that you have received it in error and that any use is strictly prohibited. If you have received this e-mail in error please notify the sender.

2 1

Radius Timeout instead of Access-Reject
by Antonio Modesto 08 Aug '12

08 Aug '12

Hi, I work at an ISP in Brazil, our main radius server is running freeradius 1.X. I'm configuring a new server with freeradius 2.X and doing some tests to see if I find any problem before putting it on production. So far I've found a little problem that doesn't disable me to put it in production, but can confuse in case of a radius failure. When an authentication failure happens, on the nas it appears that the radius server is not responding, it shows a "Radius timeout" message, here is the output of the radius debug: rad_recv: Access-Request packet from host 192.168.2.100 port 35710, id=86, length=145 Service-Type = Framed-User Framed-Protocol = PPP NAS-Port = 124 NAS-Port-Type = Ethernet User-Name = "modesto" Calling-Station-Id = "BC:AE:C5:9C:87:C5" Called-Station-Id = "isimples" NAS-Port-Id = "LAN" CHAP-Challenge = 0x246ed4d8e9cffc10c7c5120963c5d990 CHAP-Password = 0x0134931ed7c1c7fda0493d9663d658e789 NAS-Identifier = "REDE_ISIMPLES" NAS-IP-Address = 192.168.2.100 # Executing section authorize from file /usr/local/etc/raddb/sites-enabled/default +- entering group authorize {...} ++[preprocess] returns ok [chap] Setting 'Auth-Type := CHAP' ++[chap] returns ok ++[mschap] returns noop ++[digest] returns noop [suffix] No '@' in User-Name = "modesto", looking up realm NULL [suffix] No such realm "NULL" ++[suffix] returns noop [eap] No EAP-Message, not doing EAP ++[eap] returns noop [files] users: Matched entry DEFAULT at line 172 ++[files] returns ok [sql] expand: %{User-Name} -> modesto [sql] sql_set_user escaped user --> 'modesto' rlm_sql (sql): Reserving sql socket id: 0 [sql] expand: SELECT id, UserName, Attribute, Value, op FROM radcheck WHERE Username = '%{SQL-User-Name}' AND ativo='S' ORDER BY id -> SELECT id, UserName, Attribute, Value, op FROM radcheck WHERE Username = 'modesto' AND ativo='S' ORDER BY id [sql] expand: SELECT GroupName FROM usergroup WHERE UserName='%{SQL-User-Name}' -> SELECT GroupName FROM usergroup WHERE UserName='modesto' rlm_sql (sql): Released sql socket id: 0 [sql] User modesto not found ++[sql] returns notfound sql_xlat expand: %{User-Name} -> modesto sql_set_user escaped user --> 'modesto' expand: SELECT nas_pool_name FROM naspool WHERE nas_ip=INET_ATON('%{NAS-IP-Address}') -> SELECT nas_pool_name FROM naspool WHERE nas_ip=INET_ATON('192.168.2.100') rlm_sql (sql): Reserving sql socket id: 4 SQL query did not return any results rlm_sql (sql): Released sql socket id: 4 expand: %{sql: SELECT nas_pool_name FROM naspool WHERE nas_ip=INET_ATON('%{NAS-IP-Address}')} -> ++[control] returns notfound ++[expiration] returns noop ++[logintime] returns noop [pap] WARNING! No "known good" password found for the user. Authentication may fail because of this. ++[pap] returns noop Found Auth-Type = CHAP # Executing group from file /usr/local/etc/raddb/sites-enabled/default +- entering group CHAP {...} [chap] login attempt by "modesto" with CHAP password [chap] Cleartext-Password is required for authentication ++[chap] returns invalid Failed to authenticate the user. Login incorrect (rlm_chap: Clear text password not available): [modesto/<CHAP-Password>] (from client teste port 124 cli BC:AE:C5:9C:87:C5) Using Post-Auth-Type Reject # Executing group from file /usr/local/etc/raddb/sites-enabled/default +- entering group REJECT {...} [attr_filter.access_reject] expand: %{User-Name} -> modesto attr_filter: Matched entry DEFAULT at line 11 ++[attr_filter.access_reject] returns updated Delaying reject of request 4 for 1 seconds Going to the next request Waking up in 0.9 seconds. rad_recv: Access-Request packet from host 192.168.2.100 port 35710, id=86, length=145 Waiting to send Access-Reject to client teste port 35710 - ID: 86 Waking up in 0.6 seconds. rad_recv: Access-Request packet from host 192.168.2.100 port 35710, id=86, length=145 Waiting to send Access-Reject to client teste port 35710 - ID: 86 Waking up in 0.3 seconds. Sending delayed reject for request 4 Sending Access-Reject of id 86 to 192.168.2.100 port 35710 Waking up in 4.9 seconds. Cleaning up request 4 ID 86 with timestamp +41 Ready to process requests. ** The freeradius server is running on a FreeBSD 9-STABLE Jail, there is no firewall rules in the middle that could prevent the packet from being sent. Regards.

3 3

Failed to authenticate the user
by George Innocent 07 Aug '12

07 Aug '12

Hi; I am getting the attached logs on debug. What could be the problem? -- Regards: George Innocent.

6 28

Behavior of redundant/load-balance
by Sébastien Barbereau 07 Aug '12

07 Aug '12

Hi I hope someone will be able to clarify for me the behavior of the redundant/loadbalance grouping. In particular, when using the module redundant features (aka failover) what is the exact way freeradius will proceed? Let me clarify my question. If I have the following configuration (from the documentation): modules { sql sql1 { # configuration to connect to SQL database one } sql sql2 { # configuration to connect to SQL database two } always handled { rcode = handled } } # Handle accounting packets accounting { # always log to detail, stopping if it fails detail redundant { # try module sql1 sql1 # if that's down, try module sql2 sql2 # otherwise drop the request as # it's been "handled" by the "always" # module (see doc/rlm_always) handled } } If sql1 is down, freeradius will move to process the request with sql2, but what does the documentation mean with 'is down' : no connectivity to DB, slow request, ... ? Also once it detects that sql1is down, does it "mark" it as down and afterwards does not query anymore for X minutes? is there a charitable soul to clarify this ? Thanks, Seb.

2 1

user(name) and EAP-TLS
by Klaus Klein 07 Aug '12

07 Aug '12

Hi Folks, I'm working on securing the access to a WLAN network with WPA2-Enterprise, EAP-TLS and a FreeRADIUS server. Everything seemed to work as expected until realized that a client will be authenticated (by eap) even if the user(name), provided with the mandatory "identifier" entry in wpa_supplicant.conf, doesn't exist in the users file. To verify this I used the unedited 'default' users file provided with the FreeRADIUS package and the user/name 'FooBar'. Is that meant to be like this or do I miss something? Cheers, Klaus

4 17