- Freeradius-Devel - lists.freeradius.org

RE: Not verifying username in EAP-TLS
by Verma Anurag-VNF673 30 Jan '12

30 Jan '12

Looks like the link below may provide what I need. I will try this out. http://www.dartmouth.edu/~pkilab/pages/EAP-TLSwFreeRadius.html From: Verma Anurag-VNF673 Sent: Friday, January 27, 2012 5:50 PM To: 'freeradius-devel(a)lists.freeradius.org' Subject: Not verifying username in EAP-TLS Hi, I want to bypass user verification when using EAP-TLS - i.e. freeRADIUS should only verify the certificate validity without verifying that the user name, contained in CN part of the Subject field in the certificate, is present in the user database. Is it possible to do this? If so, what should the configuration look like? Thanks, Anurag

1 0

Not verifying username in EAP-TLS
by Verma Anurag-VNF673 27 Jan '12

27 Jan '12

Hi, I want to bypass user verification when using EAP-TLS - i.e. freeRADIUS should only verify the certificate validity without verifying that the user name, contained in CN part of the Subject field in the certificate, is present in the user database. Is it possible to do this? If so, what should the configuration look like? Thanks, Anurag

3 2

New build system in "master" branch
by Alan DeKok 27 Jan '12

27 Jan '12

After 10+ years of fighting recursive make, I've committed a new system. It's only used if you want, by editing Make.inc, and adding a line: BOILER=yes When you do that, the build should be MUCH faster. Everything goes into a "build" directory, so don't look for libs/binaries in their usual places. On my system, the build is rather a lot faster. Anyone doing even occasional development should look into using it. Let me know what you think. Alan DeKok.

4 18

DHCP + sqlpippol test, v2.1.x
by Fajar A. Nugraha 25 Jan '12

25 Jan '12

Hi, I'm testing some modifications to make DHCP able to allocate dynamic IP address using sqlippool. It's only tested with one client, but it should be able to assign dynamic IP address (smallest ip address first, due to sorting). The modification is purely config files addition/modification, no source code change. Current version is here: https://github.com/fajarnugraha/freeradius-server/commit/8af7142 Static IP allocation SHOULD also be possible by having expiration time far in the future (e.g. 2100-01-01 00:00:00) on radippool table, and modifying the query to NOT overwrite the expiration time on that scenario. This hasn't been implemented though. Any thoughts on these changes? Perhaps there a simpler way to implement it. -- Fajar

3 11

Why using username instead of user id?
by Morteza Milani 24 Jan '12

24 Jan '12

In freeradius sql modules, queries are based on username instead of user id. Is it anything related to performance or it went in this way without any decision? Using username has two problems: * updating a username, or deleting one needs querying at least three tables. * Comparing strings needs more time than comparing integers when fetching data. Regards, Morteza Milani

5 8

ocsp timeout and server failure
by Matthew Newton 23 Jan '12

23 Jan '12

Hi, If freeradius tries to talk to an OCSP responder, and the server is not available for some reason, the ocsp check gets stuck for a while, then bombs out with (as expected) a verification failure. The two problems are that it takes quite a while for the client to be told it can't connect, and clients with good certificates can't connect. The obvious solution is to make the ocsp server more resilient, but that's not always going to be possible. The easy solution to the problem of the server temporarily going away seems to be to add a "soft-fail" option, whereby the server will accept the certificate if it can't talk to the OCSP responder. This obviously has some security implications so can't be done unless it's been thought through properly. However, even adding this feature doesn't solve the problem, as the whole client access request fails because the OCSP takes so long to timeout (depending on failure mode). I'm guessing a reasonable solution, apart from high availability OCSP, is to have a short timeout on the ocsp query, then enable success if the server fails to respond (e.g. the certificate can't be checked), and to also use CRLs that are updated frequently. OCSP can then be used as an 'immediate' solution, whereas the CRL is the more permanent in case OCSP isn't available. I've written two smallish patches against v2.1.x - the first adds a 'timeout' option to the ocsp section. This gives up checking after the set number of seconds. I've tested this code through several different scenarios and it seems to all behave as expected (setting timeout=0, the default, has the same behaviour as before): https://github.com/mcnewton/freeradius-server/commit/56d6093828839ece191dad… The second option adds the option 'softfail', which by default is "no" (the safer option). In the case it's set to yes, a failure to query the server (or get a response) is treated as a success in terms of validation. There are warnings in the eap.conf file that this is not entirely secure, so needs to be assessed according to the risk. It's a simpler patch from the above, and applies on top: https://github.com/mcnewton/freeradius-server/commit/119ac969d8c658934d86de… Comments? Cheers, Matthew -- Matthew Newton, Ph.D. <mcn4(a)le.ac.uk> Systems Architect (UNIX and Networks), Network Services, I.T. Services, University of Leicester, Leicester LE1 7RH, United Kingdom For IT help contact helpdesk extn. 2253, <ithelp(a)le.ac.uk>

2 2

Re: Why using username instead of user id?
by Morteza Milani 23 Jan '12

23 Jan '12

I couldn't get my answer! > On one of my systems, we use ids. It's somewhat complicated though: > - use stored procedures, as I need to use several statements to > achieve the same functionality. It's better than joins (which is very > expensive in mysql cluster) >- lookup user id based on username (on an additional table, obviously) >- lookup other properties (e.g. radcheck, radreply, etc.) based on the id The only extra step required is to lookup user id from another table. Then we can use it instead of username in all queries. To achieve this, we can set User-Name to that id. Maybe I'm missing something. I really want that "live" and "historical" tables implemented. I have 35000 users and I need fetching data from radacct for statistical analysis. It's a heavy table! Morteza Milani

3 2

RADIUS & Billing MVTS Pro
by Mohamed Daif 20 Jan '12

20 Jan '12

Hello, I have installed two servers with MVTS PRO installed on both servers , supports 600 concurrent calls. and i installed one server with FreeRADIUS to manage both servers and billing "with daloRADIUS". and i have some needs must to be in the FreeRADIUS to manage the calls . all calls must be checked firstly from two tables then go to Specific Gateways like below : 1 - BlackList : to block calls to numbers from the BlackList table , 2 - WhiteList : to send calls to numbers from the WhiteList table to White Gateways 3 - Other calls not stored in both tables must be send to Checking Gateways . 4 - if calls have a good CDR must be storing in WhiteList . 5 - other calls have a bad CDR must be storing in BlackList . I want to have free choice for activate checking from both tables or one of both tables or don't check any tables for each client individually. how can i add both tables to FreeRADIUS and make configuration to check before sending calls to MVTS Servers. -- *Best Regards Mohamed Daif*

1 0

mods-available and mods-enabled for v2.1.x
by Fajar A. Nugraha 19 Jan '12

19 Jan '12

Hi Alan, I've ported mods-available and mods-enabled to v2.1.x, but with a different approach that what was implemented in master. It's currently a patch to the debian directory which will only affect debian package. Full commit: https://github.com/fajarnugraha/freeradius-server/commit/a4e2942 The idea is: - exisisting debian/ubuntu with freeradius package installed can upgrade to latest version and (if they choose to keep old radiusd.conf) have everything continue to work just as it was before (modules are loaded from modules/ directory) - new users (or those chose to replace radiusd.conf with the one in the package) will get 3.x behavior (modules loaded from mods-enabled/) - mods-availabe is just a symlink to modules - everything that's in mods-available (or to be accurate, everything listed in DEFAULT_MODULES) is symlinked to mods-enabled If you're interested in applying the change upstream (not just for debian build), the alternate commit is here: https://github.com/fajarnugraha/freeradius-server/commit/284198c -- Fajar

2 2

RADIUS & Billing for MVTS
by Mohamed Daif 16 Jan '12

16 Jan '12

Hello, I have installed two servers with MVTS PRO installed on both servers , supports 600 concurrent calls. and i need install one server with FreeRADIUS to manage both servers and billing . and i have some needs must to be in the FreeRADIUS to manage the calls . all calls must be checked firstly from two tables then go to Specific Gateways like below : 1 - BlackList : to block calls to numbers from the BlackList table , 2 - WhiteList : to send calls to numbers from the WhiteList table to White Gateways 3 - Other calls not stored in both tables must be send to Checking Gateways . 4 - if calls have a good CDR must be storing in WhiteList . 5 - other calls have a bad CDR must be storing in BlackList . I want to have free choice for activate checking from both tables or one of both tables or don't check any tables for each client individually. -- *Best Regards Mohamed Daif*

1 0