November 2012 - Freeradius-Users - lists.freeradius.org

forwarding radius request
by laurent.feron＠free.fr 29 Nov '12

29 Nov '12

Hello, I was able to forward a radius request with 'suffix' in the authorize section. But now, the use case has changed, when arriving in the authenticate section, a perl authenticate function is started, and tries authentications (Web API request) against 3 OTP Servers. If one of the 3 OTP Servers return ok, the authenticate perl function return RLM_MODULE_OK. But if all authentications against OTP Servers fail, we would like to forward the request to another radius server. Is it possible? Regards, Laurent

2 1

Problem with MAC valitation + MySQL
by Andres Gomez Ruiz 29 Nov '12

29 Nov '12

Hi everybody!! I'm using Freeradius since 6 months ago, and It works great. I'm Using freeradus + MySQL to store my users data in a database and authenticate it with an user and a password. Now I Have to attach to each user, 3 MAC-Address, so I'm editting my database (radcheck table) id username attribute op value 1 user1 User-Password := password1 2 user1 Calling-Station-Id = 00:11:22:33:44:55 It works great. Only user1 with password1 can access from the device with MAC-Addr 00:11:22:33:44:55, but I need to attach 3 MAC to each user, so I edit my databe: id username attribute op value 1 user1 User-Password := password1 2 user1 Calling-Station-Id = 00:11:22:33:44:55 3 user1 Calling-Station-Id = 33:44:55:66:77:88 And, in that moment user1 can't logging never. The user1 can't logging from a device with MAC-Addr 00:11:22:33:44:55 or MAC-Addr 33:44:55:66:77:88, or anyone. How can I do this? Thanks a lot!! Andres

1 0

Packet Type in modules
by Alexandre J. Correa - Onda Internet 29 Nov '12

29 Nov '12

Hello, I have some scripts that do some sync tasks when freeradius start accouting: Like this: created module, named 'sysnotify' with this: exec sysnotify { wait = no program = "/ondasys/system/sysnotify %{User-Name:-Nenhum} %{Framed-IP-Address:-Nenhum} %{Acct-Status-Type:-ERR} %{Acct-Session-Id:-ERR} %{NAS-IP-Address}" packet_type = Accounting-Request } and, instanciated at preacct block: preacct { acct_unique sysnotify } it´s working fine, but i need to optimize this, because this scripts are running in Accouting-Start, Accouting-Stop and Interim-Update .. How i can catch ONLY Start and Stop events ? Regards ! -- Sds. Alexandre Jeronimo Correa Sócio-Administrador Onda Internet www.onda.net.br IPV6 Ready !

2 1

Policy.conf - multiple @
by John Horne 29 Nov '12

29 Nov '12

Hello, Just taking a look at the FreeRadius 2.2 policy.conf file, and noticed this section: ===================================== # # reject Multiple @'s # e.g. "user@site.com@site.com" # if(User-Name =~ /@(.+)?@/i ) { ===================================== Would this not be simpler just by using '/@.*@/' ? John. -- John Horne Tel: +44 (0)1752 587287 Plymouth University, UK Fax: +44 (0)1752 587001

6 7

Freeradius several segfaults at heavy load and startup ?
by Alexander Silveröhrt 29 Nov '12

29 Nov '12

Hello, Wondered if anyone have any idea about below. If started with flag -X everything starts up ok but without -X then it crashes with these messages in the log.(atleast most of the time if one is persistent then it may well start up properly sometimes without the -X flag) As soon as it starts ok then there seems to be no problem whatsoever. It runs perfectly with the same config and perl hooks at a lab machine where there are no traffic. Searching through the web doesn't give much info? Any ideas would be appreciated. Thank you. Alex root@itop0-db0:/scripts# LD_PRELOAD=/usr/lib/libperl.so.5.10 /usr/sbin/freeradius root@itop0-db0:/scripts# ps -ef | grep freeradius root 30086 29914 0 08:10 pts/1 00:00:00 grep freeradius root@itop0-db0:/scripts#dmesg . .. ... [2233283.445884] freeradius[617]: segfault at 212 ip 00000000f72238d4 sp 00000000ffb85050 error 4 in rlm_perl-2.1.10.so[f7221000+5000] [2233430.045210] freeradius[2673]: segfault at 212 ip 00000000f72328d4 sp 00000000ffff4e50 error 4 in rlm_perl-2.1.10.so[f7230000+5000] [2233671.048040] freeradius[2730]: segfault at 212 ip 00000000f72928d4 sp 00000000fffe4370 error 4 in rlm_perl-2.1.10.so[f7290000+5000] [2233840.528299] freeradius[2776]: segfault at 212 ip 00000000f72248d4 sp 00000000ffb06020 error 4 in rlm_perl-2.1.10.so[f7222000+5000] [5223187.548213] freeradius[2380]: segfault at 1002 ip 00000000f71e88d4 sp 00000000ffe0dfc0 error 4 in rlm_perl-2.1.10.so[f71e6000+5000] [5887868.065533] freeradius[31931]: segfault at 1002 ip 00000000f71bb8d4 sp 00000000ffb46d50 error 4 in rlm_perl-2.1.10.so[f71b9000+5000] [5946015.698283] freeradius[1746]: segfault at 88 ip 00000000f6ed29d1 sp 00000000e2df5810 error 4 in libmysqlclient_r.so.16.0.0[f6e53000+1af000] [5951643.541290] freeradius[11237]: segfault at 15 ip 00000000f76aac1a sp 00000000f56287a0 error 4 in libperl.so.5.10.1[f7610000+14a000] [5951657.770507] freeradius[11386]: segfault at c ip 00000000f76d3a17 sp 00000000f66a98d0 error 4 in libperl.so.5.10.1[f768f000+14a000] [6026380.012188] freeradius[11693]: segfault at 4 ip 00000000f6f1252e sp 00000000f0ff77d0 error 6 in libmysqlclient_r.so.16.0.0[f6e94000+1af000] [6026442.934483] freeradius[5466]: segfault at 8 ip 00000000f767a611 sp 00000000f5e4c930 error 4 in libperl.so.5.10.1[f7633000+14a000] [6026462.851031] freeradius[5547]: segfault at 8 ip 00000000f75ec611 sp 00000000f5dbe930 error 4 in libperl.so.5.10.1[f75a5000+14a000] [6544711.773094] freeradius[29963]: segfault at 8 ip 00000000f7616611 sp 00000000f6e0e930 error 4 in libperl.so.5.10.1[f75cf000+14a000] [6544722.667507] freeradius[29984]: segfault at 8 ip 00000000f75e1611 sp 00000000f4db1930 error 4 in libperl.so.5.10.1[f759a000+14a000] [6544822.799431] freeradius[30080]: segfault at 8d160fc ip 00000000f76a81b1 sp 00000000f32fc540 error 4 in libperl.so.5.10.1[f75e6000+14a000] [6544885.122348] freeradius[30118]: segfault at 8 ip 00000000f75f7611 sp 00000000f5dc9930 error 4 in libperl.so.5.10.1[f75b0000+14a000] [6544895.128894] freeradius[30137]: segfault at 8 ip 00000000f76bc611 sp 00000000f6eb4930 error 4 in libperl.so.5.10.1[f7675000+14a000] [6544905.352401] freeradius[30152]: segfault at 8 ip 00000000f766d611 sp 00000000f6640930 error 4 in libperl.so.5.10.1[f7626000+14a000] [6544946.136776] freeradius[30196]: segfault at 8 ip 00000000f76a5611 sp 00000000f4e75930 error 4 in libperl.so.5.10.1[f765e000+14a000] [6544966.088368] freeradius[30212]: segfault at c ip 00000000f764aa17 sp 00000000f66208d0 error 4 in libperl.so.5.10.1[f7606000+14a000] ********* DISCLAIMER ********* This message and any attachment are confidential and may be privileged or otherwise protected from disclosure and may include proprietary information. If you are not the intended recipient, please telephone or email the sender and delete this message and any attachment from your system. If you are not the intended recipient you must not copy this message or attachment or disclose the contents to any other person

6 8

Re: Freeradius several segfaults at heavy load and startup ?
by Alan Buxey 29 Nov '12

29 Nov '12

-X runs as a single thread Is your perl multi-threaded? Does your PERL code deal with threads? alan -- This smartphone uses free WiFi around the world with eduroam, now that's what I call smart.

3 3

Re: External HTTPS authentication
by Alan Buxey 28 Nov '12

28 Nov '12

Why not just using EAP-TLS as the auth as-is, since you control the horizontal and vertical if the certs and CA (CA can sign your RADIUS server cert). Then just use some post-auth to pass request to your backend to work out what VLAN to return? alan

1 0

External HTTPS authentication
by Thiago A. V. Lima 28 Nov '12

28 Nov '12

Hello mailing list. What I'm actually trying to accomplish is this: I already have a modified version of an OpenID server, that doesn't require any user/password. The whole authentication is based on EAP-TLS between the browser and the Apache server, using the certificate email to identify the current user. (I control the whole CA chain, so I can trust the certificate embedded emails). I'd like to make FreeRADIUS "forward" the user certificate (client side, WPA2-Enterprise scheme certificate, I mean) to my OpenID (Apache server with EAP-TLS) and, if the connection is correctly established, authenticate the user and move him to the correct VLAN. This way, I could have an integrated network and services (single sign-on) authentication process, "completely" transparent to the end-user (except for the network So, if there was any already available module that could, for example, authenticate the RADIUS user using a "foreign" webservice or something like that, I think I could modify/adapt it to my EAP-TLS scenario. Any suggestions? Thanks in advance and congratulations for the nice community, -- Thiago Lima

2 1

Detail file
by BALSIANOK, Peter 28 Nov '12

28 Nov '12

Hi, I want to store accounting packet(s) for future processing. [radiusd@tdrad1 freeradius-server-2.2.0]$ cat /app_log/radius/ggsn-acct/radacct/127.0.0.1/pre-proxy-detail-20121127 Tue Nov 27 15:03:35 2012 Packet-Type = Accounting-Request NAS-Port-Type = Virtual X-Ascend-Dial-Number = "<U+0557>\331\025" Acct-Session-Id = "d597d91572f51ab3" Is there any way to change / simulate functionality of the detail module like this ? Timestamp=" Tue Nov 27 15:03:35 2012"[delimiter]Packet-Type = Accounting-Request[delimiter]NAS-Port-Type = Virtual[delimiter] NAS-Port-Type = Virtual[delimiter] .... [end of line] Thx Peter Balšianok

4 7

Regarding Proxy sockets
by ramakrishna 28 Nov '12

28 Nov '12

Hi, I have been using freeradius 2.2 for a while now. When i start the radius server in debug mode, I observed server creating proxy sockets. please find the log below. * ... adding new socket proxy address * port 61412 ... adding new socket proxy address * port 61413 ... adding new socket proxy address * port 61414 *Listening on authentication address * port 1812 Listening on accounting address * port 1813 What i observed is every time i restart the server, i see the port numbers increasing instead of same port numbers being used. My question is does that mean that the previously used port numbers(61409, 61410, 61411) are not freed properly? Please lemme know if any other information is required. -- Best Regards, M.Rama Krishna Prasad,

2 2