A talk given at the pre-Networkshop46 eduroam FreeRADIUS4 seminar, University of Liverpool, 26 March 2018. Topics covered: - eduroam logging requirements (specifically in the UK) - Suggestions on FreeRADIUS config - Latency measurements - Logging topologies - FreeRADIUS configuration for logging to Elasticsearch, including via logstash, redis, and direct from FreeRADIUS. Full talk at https://youtu.be/mER_HUMB7l0

1. FreeRADIUS and eduroam logging
Matthew Ntewton

2. We need all the logs.

3. Do we need all the logs?

4. Just keep authentiaton logs, right?

5. Keep fewer logs.
– where possible

6. v2: Matih EAP Identty

7. authorize {
if (EAP-Message =~ /^0x02 . . . . . . 01/) {
linelog
}
...
}

8. v4: &session-state:

9. recv Access-Request {
if (!&session-state:) {
linelog
}
...
}

10. recv Access-Request {
if (!&session-state:) {
update session-state {
Tmp-Integer64-1 := "%{expr:(%c*1000) + (%C/1000)}"
}
linelog
}
...
}

11. server inner-tunnel {
send Access-Accept {
update outer.session-state {
User-Name := &User-Name
}
}
}

12. send Access-Accept {
update {
control:Tmp-String-1 := “accept”
session-state:Tmp-Integer64-2 := "%{expr:(%c*1000) + (%C/1000)}"
}
update control {
Tmp-Integer64-1 := "%{expr:&session-state:Tmp-Integer64-2 -
&session-state:Tmp-Integer64-1}"
}
linelog
}

13. default server
recv Access-Request → check session-state, log request
send Access-Accept → log accept
send Access-Reject → log reject
inner-tunnel
send Access-Accept → update session-state
send Access-Reject → update session-state

14. %T → tme in ISO8601 date format
control:Tmp-String-1 → “request”, “accept” or “reject”
session-state:Module-Failure-Message → inner reject reason
request:User-Name → outer User-Name
request:Calling-Staton-Id → Calling-Staton-Id
request:Operator-Name → operator name
session-state:User-Name → inner User-Name
control:Tmp-Integer64-1 → total auth tme in ms

19. input {
file {
path => "/path/to/radius/detail/file"
start_positon => "beginning"
type => radiusdetail
codec => multline {
pattern => "^t"
negate => false
what => "previous"
}
}
}

21. if ("%{redis:LPUSH radius:event '{"tmestamp":"%T",
"type":"%{control:Tmp-String-1}",
"Outer-User-Name":"%{jsonquote:%{User-Name}}",
"User-Name":"%{jsonquote:%{session-state:User-Name}}",
"Calling-Staton-Id":"%{jsonquote:%{Calling-Staton-Id}}",
"latency":"%{control:Tmp-Integer64-1}" %}'}") {
noop
}

22. input {
redis {
host => "localhost"
port => "6379"
data_type => "list"
key => "radius:event"
threads => 2
codec => "json"
type => "radius"
}
}

24. authorize {
uri = "${..connect_uri}/radius/_doc/"
method = 'post'
body = 'json'
force_to = 'plain'
data = '{"tmestamp":"%T",
"type":"%{control:Tmp-String-1}",
"Outer-User-Name":"%{jsonquote:%{User-Name}}",
"Calling-Staton-Id":"%{jsonquote:%{Calling-Staton-Id}}",
"Called-Staton-Id":"%{jsonquote:%{Called-Staton-Id}}"}',
"latency":"%{control:Tmp-Integer64-1}"
}

25. { "_index" : "radius",
"_type" : "_doc",
"_id" : "Dcr4XWIBag7SnI-grLNi",
"_version" : 1,
"result" : "created",
"_shards": { "total":2,
"successful":1,
"failed":0 },
"_seq_no" : 4578,
"_primary_term" : 3 }

26. rest
map json &REST-HTTP-Body {
&Tmp-String-2 := "$.result"
&Tmp-Integer-1 := "$._shards.total"
&Tmp-Integer-2 := "$._shards.successful"
&Tmp-Integer-3 := "$._shards.failed"
}
if (&control:Tmp-String-2 != "created" ) {
...
}

28. https://wiki.freeradius.org/guide/eduroam