February 2009 - Freeradius-Users - lists.freeradius.org

feature request
by Hans-Peter Fuchs 02 Feb '09

02 Feb '09

Hello Alan, today I upgraded from freeradius-2.1.1 to 2.1.3 and stumbled because freeradius does not erase the socket file in /var/run/radiusd. -- Mit freundlichen Grüßen Hans-Peter Fuchs Hans-Peter Fuchs - RRZK Zimmer 20 Zentrum für angewandte Informatik - Universitätsweiter Service RRZK Universität zu Köln - Tel: 0221-470-6972

2 3

tag support in Free Radius
by Marlon Duksa 02 Feb '09

02 Feb '09

Hi - does anyone know how send taged attributes from FreeRadius. I'm including the tag number with a colon after the attribute but not sure if this is correct (the last two attributes): DEFAULT User-Name =~ "([a-z]+):([0-9]+)[^a-z]+([a-z]+):([0-9]+)$", Auth-Type := Local, User-Password == "usrpass" Framed-Pool := "4", ERX-Ingress-Policy-Name := "ingressFilter", ERX-Egress-Policy-Name := "egressFilter", ERX-CoS-Parameter-Type:1 = "basic_sch", ERX-CoS-Parameter-Type:2 += "8m" And this is how the attribute is defined in dictionary: ATTRIBUTE ERX-CoS-Parameter-Type 108 string has_tag But Juniper is complaining about wrong Tag-characters. Feb 1 07:41:38 Vendor-Id: 4874 Attribute Type:ERX-CoS-Parameter-Type(108) Value:string-type Length:10 Feb 1 07:41:38 authd_radius_parse_message:juniper-BRAS type:108 Feb 1 07:41:38 parse_tag_based_vsa: Tag based VSA contains the wrong Tag-character Feb 1 07:41:38 Tag-based VSA parsing failed vendor-id: 4874 type: 108 Feb 1 07:41:38 Vendor-Id: 4874 Attribute Type:ERX-CoS-Parameter-Type(108) Value:string-type Length:3 Feb 1 07:41:38 authd_radius_parse_message:juniper-BRAS type:108 Feb 1 07:41:38 parse_tag_based_vsa: Tag based VSA contains the wrong Tag-character Feb 1 07:41:38 Tag-based VSA parsing failed vendor-id: 4874 type: 108 Feb 1 07:41:38 authd_radius_parse_message: Error parsing ERX avps Feb 1 07:41:38 Framework - module(radius) return: ADMIN CANCELLED Is this above the correct way to send tagged attributes in FreeRadius? Thanks, Marlon

2 1

Freeradius integration
by Nick Owen 01 Feb '09

01 Feb '09

On Thu, Jan 29, 2009 at 2:26 AM, Alan DeKok <aland(a)deployingradius.com> wrote: > Amy Hawke wrote: >> We would like to get two factor authentication working using the >> username/password from our current LDAP directories and then >> username/RSA token code. > > That will likely *not* work. The NAS has to support this behavior, > and usually doesn't. > >> The RSA product is unable to connect to our >> current directories, so if possible we would like to perform the first >> step using FreeRADIUS and then proxy the second part of the request >> through to the RSA Authentication manager. > > We're currently working to get FreeRADIUS integrated with the RSA > token libraries. There are licensing restrictions, so the resulting > code will likely not be part of the "official" release. But it should > be available. We're interested in getting libraries integrated with Freeradius and there would be no licensing issues - we can do a complete opensource offering. What's the best way to get this started? What are the programming requirements? One concern is that while we have support for java, python, C#, PHP and Ruby, we do not have any C libraries. Is it of interest? -- Nick Owen WiKID Systems, Inc. 404.962.8983 http://www.wikidsystems.com Commercial/Open Source Two-Factor Authentication

2 2

Problem with udpfromto in version 2.1.1 - please help
by Will D. Spann 01 Feb '09

01 Feb '09

Hello all, I'm running FreeRADIUS 2.1.1 on openSUSE 11.1 (x64), and although the server runs without errors in debug mode, I'm getting an error when I run radtest w/ the recommended first test settings: "radtest test test localhost 0 testing123". My RADIUS secret is set to "testing123" currently. The error it gives me is as follows. radclient: socket: cannot initialize udpfromto: Function not implemented I should note that in my radiusd.conf file, I'm not including "eap.conf" nor "sites-enabled/", but other than that I have all default settings. Any help resolving this issue would be greatly appreciated. Thanks. Regards, Will My "radiusd -X" ouput is as follows, if it helps. FreeRADIUS Version 2.1.1, for host x86_64-suse-linux-gnu, built on Dec 3 2008 at 13:57:16 Copyright (C) 1999-2008 The FreeRADIUS server project and contributors. There is NO warranty; not even for MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. You may redistribute copies of FreeRADIUS under the terms of the GNU General Public License v2. Starting - reading configuration files ... including configuration file /etc/raddb/radiusd.conf including configuration file /etc/raddb/proxy.conf including configuration file /etc/raddb/clients.conf including files in directory /etc/raddb/modules/ including configuration file /etc/raddb/modules/pam including configuration file /etc/raddb/modules/pap including configuration file /etc/raddb/modules/chap including configuration file /etc/raddb/modules/echo including configuration file /etc/raddb/modules/exec including configuration file /etc/raddb/modules/expr including configuration file /etc/raddb/modules/ldap including configuration file /etc/raddb/modules/krb5 including configuration file /etc/raddb/modules/unix including configuration file /etc/raddb/modules/inner-eap including configuration file /etc/raddb/modules/radutmp including configuration file /etc/raddb/modules/counter including configuration file /etc/raddb/modules/acct_unique including configuration file /etc/raddb/modules/files including configuration file /etc/raddb/modules/realm including configuration file /etc/raddb/modules/wimax including configuration file /etc/raddb/modules/mac2vlan including configuration file /etc/raddb/modules/linelog including configuration file /etc/raddb/modules/detail.example.com including configuration file /etc/raddb/modules/checkval including configuration file /etc/raddb/modules/logintime including configuration file /etc/raddb/modules/sql_log including configuration file /etc/raddb/modules/sradutmp including configuration file /etc/raddb/modules/always including configuration file /etc/raddb/modules/attr_rewrite including configuration file /etc/raddb/modules/detail including configuration file /etc/raddb/modules/digest including configuration file /etc/raddb/modules/ippool including configuration file /etc/raddb/modules/mac2ip including configuration file /etc/raddb/modules/mschap including configuration file /etc/raddb/modules/smbpasswd including configuration file /etc/raddb/modules/passwd including configuration file /etc/raddb/modules/policy including configuration file /etc/raddb/modules/etc_group including configuration file /etc/raddb/modules/preprocess including configuration file /etc/raddb/modules/attr_filter including configuration file /etc/raddb/modules/detail.log including configuration file /etc/raddb/modules/expiration including configuration file /etc/raddb/sql.conf including configuration file /etc/raddb/sql/mysql/dialup.conf including configuration file /etc/raddb/sql/mysql/counter.conf including configuration file /etc/raddb/policy.conf group = radiusd user = radiusd including dictionary file /etc/raddb/dictionary main { prefix = "/usr" localstatedir = "/var" logdir = "/var/log/radius" libdir = "/usr/lib64/freeradius" radacctdir = "/var/log/radius/radacct" hostname_lookups = no max_request_time = 30 cleanup_delay = 5 max_requests = 1024 allow_core_dumps = no pidfile = "/var/run/radiusd/radiusd.pid" checkrad = "/usr/sbin/checkrad" debug_level = 0 proxy_requests = yes log { stripped_names = no auth = no auth_badpass = no auth_goodpass = no } security { max_attributes = 200 reject_delay = 1 status_server = yes } } client localhost { ipaddr = 127.0.0.1 require_message_authenticator = no secret = "testing123" nastype = "other" } radiusd: #### Loading Realms and Home Servers #### proxy server { retry_delay = 5 retry_count = 3 default_fallback = no dead_time = 120 wake_all_if_all_dead = no } home_server localhost { ipaddr = 127.0.0.1 port = 1812 type = "auth" secret = "testing123" response_window = 20 max_outstanding = 65536 zombie_period = 40 status_check = "status-server" ping_interval = 30 check_interval = 30 num_answers_to_alive = 3 num_pings_to_alive = 3 revive_interval = 120 status_check_timeout = 4 } home_server_pool my_auth_failover { type = fail-over home_server = localhost } realm example.com { auth_pool = my_auth_failover } realm LOCAL { } radiusd: #### Instantiating modules #### instantiate { Module: Linked to module rlm_exec Module: Instantiating exec exec { wait = no input_pairs = "request" shell_escape = yes } Module: Linked to module rlm_expr Module: Instantiating expr Module: Linked to module rlm_expiration Module: Instantiating expiration expiration { reply-message = "Password Has Expired " } Module: Linked to module rlm_logintime Module: Instantiating logintime logintime { reply-message = "You are calling outside your allowed timespan " minimum-timeout = 60 } } radiusd: #### Loading Virtual Servers #### modules { } radiusd: #### Opening IP addresses and Ports #### listen { type = "auth" ipaddr = * port = 0 } listen { type = "acct" ipaddr = * port = 0 } Listening on authentication address * port 1812 Listening on accounting address * port 1813 Listening on proxy address * port 1814 Ready to process requests.

2 1