September 2008 - Freeradius-Users - lists.freeradius.org

Removing tunnel attributes only for specific NAS
by Ignacio Siles 19 May '09

19 May '09

Hello, I am trying to implement a Nomadix AG-5000 public NAS in a in a network with an existing FreeRADIUS server. The environment is as follows: - The customer wants nomadix to make public authentication (with captive portal and PAP) for guest users, and employees who cant use the protected wireless network working with WPA-Enterprise authentication. - The employees´ user names and passwords are stored in a LDAP structure. - There is a freeRADIUS v 1.0.5 server which asks that LDAP structure for authentication. So the Nomadix is configured as RADIUS client, connected to the FreeRADIUS server. I have tested the connection with test users stored in freeRADIUS´ users file, and everything worked fine. The problem starts with the Access-Accept RADIUS message. This message includes some tunnel attributes stored in the LDAP, which are necessary for the other networks to work properly. But the Nomadix does not understand those attributes and drops the Access-Accept messages, resulting in a failed authentication. The solution Im thinking about is to remove this tunnel atributes of the Access-Accept message should they be sent to the Nomadix. Ive read about rlm_attr_filter, but I dont know how to configure it to remove tunnel attribures should the Nomadix be acting as the NAS. File /etc/raddb/attrs: DEFAULT Packet-type =* ANY, EAP-Message =* ANY, User-Name =* ANY, Message-Authenticator =* ANY, State =* ANY, Tunnel-Type := VLAN, Tunnel-Medium-Type := IEEE-802 Tunnel-Private-Group-Id := 55 Thank you in advance, Ignacio Siles Ingeniero de Telecomunicaciones Libera Networks Avda. Juan López Peñalver, 21. PTA 29590 Campanillas (MÁLAGA) T: +34 951010529 - F: +34 951010542 <mailto:ignacio.siles@libera.net> ignacio.siles(a)libera.net www.libera.net <blocked::http://www.libera.net/>

2 1

debug log and syslog
by Jehan PROCACCIA 03 Apr '09

03 Apr '09

hello I can run debug log by starting radiusd -X , but for production, I want logs to go to a file and not stdout . When I start radiusd without -X I only get very few logs, how can I have equivalent to -X log with syslog or a log file ? or a least get more log the the very few ones I get with that config: /etc/raddb/radiusd.conf log_destination = syslog log { syslog_facility = daemon file = ${logdir}/radiusd.log } It's a freeradius-2.0.3-3.el5 on a centos 5 for now with that config I only get 2 lines in radiusd.log when I log in 802.X EAP-ttls , telling: Sep 5 10:42:30 radiustux radiusd[14619]: Login OK: [procacci] (from client APS_Cisco port 29 cli 00-1F-3C-59-5E-52) Sep 5 10:42:30 radiustux radiusd[14619]: Login OK: [anonymous] (from client APS_Cisco port 29 cli 00-1F-3C-59-5E-52) with radius -X I get a lot more, can I have at least more than these 2 lines ? thanks .

5 8

Reloading CRL for EAP-TLS
by Jan Tomasek 13 Mar '09

13 Mar '09

Hi, I'm trying implement freeRadius for users using EAP-TLS. My eap.conf: > eap { > ... > > tls { > private_key_file = /etc/ssl/private/radius.etest.cesnet.cz.key.pem > certificate_file = /etc/ssl/certs/radius.etest.cesnet.cz.crt.pem > > CA_path = /etc/ssl/certs/ > > fragment_size = 1024 > > include_length = yes > > check_crl = yes > } > When CRL is changed on disk during freeRadius is running it never notices changed version and still uses older cached. This behavior come from OpenSSL I guess. For my implementation is this serious problem. Complete restart of freeRadius will break ongoing EAP sessions and introduce random problems with service for users I found mailing list post: http://www.mail-archive.com/freeradius-users@lists.freeradius.org/msg31354.… When I try send HUP signal to running freeRadius it crashes with return code 1 in case it didn't process any request. Log output is in file crash1.log When I send HUP signal to running freeRadius which processed several requests it survive and crash with segfault after receiving first request after the HUP signal. Log output is in crash2.log I was testing with freeRadius version 1.1.4 and 1.1.7 both with same result. Is there chance to get this fixed? Best regards -- ----------------------- Jan Tomasek aka Semik http://www.tomasek.cz/

4 6

sql insert via unlang
by Flamur Rogova 28 Jan '09

28 Jan '09

Hi, I have a couple of modules in this order, and I need to log only rejects(from each module) to sql, - check_password, "a1 User-Password := "a1" - check_maxoctets, "a1 Max-All-Octets := 100000" in my authorize section, I have this, ... check_password if(notfound) { # log notfound to sql, the line below gives error... "%{sql: INSERT INTO test.logs SET test.logs.user='%{User-Name}', test.description='user not found' }" } check_maxoctets if(reject) { # log to sql... } ... When I start radiusd, it gives: ... rlm_fastusers: Loaded 3 users and 1 defaults /home/radius205/etc/raddb/sites-enabled/default[99]: Failed to find module "%{sql: INSERT INTO test.logs SET test.logs.user='%{User-Name}', test.description='user not found' }". /home/radius205/etc/raddb/sites-enabled/default[99]: Failed to parse "%{sql: INSERT INTO test.logs SET test.logs.user='%{User-Name}', test.description='user not found' }" entry. /home/radius205/etc/raddb/sites-enabled/default[62]: Errors parsing authorize section. } } Errors initializing modules ... man unlang says it is possible to obtain results from db, but I need to execute only sql INSERT, is my syntax wrong ? Thanks, Flamur

7 10

Problem with freeradius.org website
by Karl Auer 21 Jan '09

21 Jan '09

Is anyone else experiencing problems with the freeradius.org website? I'm new to freeradius, so maybe this is normal for the site, but I'm getting massive waits (minutes) generally ending in timeouts. Both the addresses are pingable. The Wiki is OK, it's just the website at freeradius.org. Regards, K. -- ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ Karl Auer (kauer(a)biplane.com.au) +61-2-64957160 (h) http://www.biplane.com.au/~kauer/ +61-428-957160 (mob) GPG fingerprint: DD23 0DF3 2260 3060 7FEC 5CA8 1AF6 D9E3 CFEE 6B28

9 26

Your Industry profile
by VOIP Expert 23 Dec '08

23 Dec '08

3 3

None
by Ray Stell 15 Dec '08

15 Dec '08

unsubscribe

4 4

freeradius password expiry
by yangcuilin 06 Dec '08

06 Dec '08

My requirement: 1. At FreeRADIUS (java) client side, judge the current user whether is password expiry in advance. If user password is expiry, prompt user to change password. My question: FreeRADIUS have an attribute of "Expiration" to judge whether the password is expiry, but can I get value of "Expiration" in advance? 2. User can send request (which is the FreeRADIUS attribute of "Expiration") to FreeRADIUS Server. My question: How do I change the value of FreeRADIUS attribute of "Expiration"? Two questions. Thanks in advance.

6 14

Freeradius error: "Discarding conflicting packet"
by jelle-e 27 Nov '08

27 Nov '08

Hi, I've enabled extensive logging and radiusd runs as daemon process (# /usr/local/sbin/radiusd). I have a medium sized network with about 25 Access Points (AP's) now (Linksys WAP54G). It runs with following encryption options: WPA-Enterprise, AES, PEAP, mschapv2, without using certificates. Everything seems to run smoothly but before every login attempt the logs say (something like): "Error: Discarding conflicting packet from client NAS-NAME port 3072 - ID: 3 due to recent request 28." After that the user logs in correctly. I have no idea where to start searching for the answer. Since this error appears to occur on every AP, I don't think they're all 'broken'. Does anybody have an idea? Thanks in advance! In the freeradius source I found the following regarding the error: gettimeofday(&when, NULL); when.tv_sec -= 1; /* * If the cached request was received * within the last second, then we * discard the NEW request instead of the * old one. This will happen ONLY when * the client is severely broken, and is * sending conflicting packets very * quickly. */ if (timercmp(&when, &request->received, <)) { radlog(L_ERR, "Discarding conflicting packet from " "client %s port %d - ID: %d due to recent request %d.", client->shortname, packet->src_port, packet->id, request->number); return 0; } -- View this message in context: http://www.nabble.com/Freeradius-error%3A-%22Discarding-conflicting-packet%… Sent from the FreeRadius - User mailing list archive at Nabble.com.

10 21

unlang?
by Dean, Barry 19 Nov '08

19 Nov '08

I am testing my current 1.1.7 config with version 2.0.0. I have 2 bits of config that are not quite right on 2.0.0 1) I have the line: filter = "(cn=%{Stripped-User-Name:-%{User-Name}})" I am not sure why, I inherited this setup and I am still trying to understand it. The LDAP server is eDirectory (FreeRADIUS compiled with -with-edir) The "-X" output says: WARNING: Deprecated conditional expansion ":-". See "man unlang" for details expand: (cn=%{Stripped-User-Name:-%{User-Name}}) -> (cn=user) expand: o=uol -> o=uol What is the replacement for ":-" given I don't know what it did in the first place for "man unlang" to be any help! 2) Rejecting a user I have a specific user account (call it "special") it was barred using: special Auth-Type := Reject Reply-Message = "Cannot use this user account" in the users file. Variants like " special", "Special" and "SPECIAL" etc get by this check, and out LDAP server allows them!, so I added: lower_user = before lower_pass = no nospace_user = before nospace_pass = no to radius.conf. These no longer seem to work. How do you achieve this with version 2.0.0? --------------- Barry Dean Networks Team Computing Services Department Tel: 0151 794 5641 (x45641)

6 8