October 2013 - Freeradius-Users - lists.freeradius.org

Version 3.0.0 has been released
by Alan DeKok 09 Oct '13

09 Oct '13

After many years of development, the FreeRADIUS team is happy to announce Version 3 of the world's most popular server. The release was delayed from June in order to track down and solve a number of last-minute issues. We'd like to thank all of the beta testers for helping with that process. The release announcement is available on the web site: http://freeradius.org/press/index.html#3.0.0 In short, it's simpler, easier to use, and better organized. Upgrading instructions are available here: https://github.com/FreeRADIUS/freeradius-server/blob/release_branch_3.0.0/r… As this is a major version, you CANNOT just use your 2.x configuration files. Sorry, but many of the new features require changes which aren't compatible with 2.x. See the LDAP and SQL modules for new connection pools, for example. The debug output is colorized, with yellow WARNINGS and red ERRORS. This should help people understand which messages are important and need attention. RADIUS over TLS (RadSec) is supported. This means RADIUS has actual security, instead of the 20 year-old MD5 weirdness. Many configuration errors are caught at startup, rather than run time. Helpful messages are printed, including a pointer to which character caused the error. The raddb/ directory has been re-organized. The files should now be easier to find, as they use a consistent layout. DHCP and VMPS are still supported, but their code has been moved to plug-in modules. We expect to continue this process for the 3.1 release. The goal is to move RADIUS to a plug-in module. The server will then be capable of handling many more protocols. We have a number of new protocols in development, and will be announcing them later this year. SNMP traps are now supported. You can trigger a trap when a home server goes down, and when it comes back up again! While supporting many new features, the code is almost 10% smaller than version 2.2. In addition, it has daily builds on multiple platforms, including automatic static source code analysis. This means that the code is smaller, more secure, and easier to maintain. We'd like to add a special thanks to the Samba project, for the talloc library. Many of the new features we made possible by talloc. We expect more features in the future. Alan DeKok. FreeRADIUS Project Leader

6 10

Case statement error
by Franks Andy (RLZ) IT Systems Engineer 09 Oct '13

09 Oct '13

Hi All. I have some code in an "sql" policy: sql_check_user_present { update control { Tmp-String-0 := "%{sql_pwifi:SELECT COUNT(*) from voucher v left join state s on v.id=s.voucher_id where v.id=s.voucher_id and v.code='%{User-Name}' and (s.state='Inactive' or s.state='Active')}" } switch "%{control:Tmp-String-0}" { case "0" { update control { User-RejectInformation := "Sorry, that voucher code is invalid or has expired." Debug-RejectInformation := "Voucher code not present in database table, or voucher expired" } reject } case "1" { noop } case { # voucher has multiple table entries, oooh errr. update control { User-RejectInformation := "Sorry, there has been an error. Please contact IT." Debug-RejectInformation := "Multiple voucher codes the same, or database error - SQL count not = 0 or 1. This should never happen due to primary key constraint!" } reject } } } This works fine in 3.0, git version #f66d411, but I have a problem with a regex related thing causing a segfault in that version and wouldn't mind trying the latest version to see if it's fixed. Trying version #d166290 results in /usr/local/etc/raddb/policy.d/sql[6]: "case" statements may only appear within a "switch" section /usr/local/etc/raddb/policy.d/sql[6]: Failed to parse "case" subsection. /usr/local/etc/raddb/policy.d/sql[5]: Failed to parse "switch" subsection. /usr/local/etc/raddb/sites-enabled/default[220]: Errors parsing authorize section. Do I need to change how the switch statement works? The unlang page doesn't seem to have changed as far as I can tell. Thanks Andy

2 1

Freeradius 3 and DHCP
by Rok Kosir 09 Oct '13

09 Oct '13

Hello, i had running version of freeradius 2.1.10 (from ubuntu ppa) with workable EAP-TTLS configuration. Today when i noticed that version 3 is out i decided to upgrade to it and also test the built-in dhcp server. All was goin well until i enabled dhcp (EAP-TTLS was working and authentication to mysql), when i run freeradius -X, i get Segmentation Fault when it reaches dhcp listner. It is the same if i use default dhcp site (one provided with source) or if i follow guide on freeRadius wiki ( http://wiki.freeradius.org/guide/dhcp-for-static-ip-allocation) I built package from source as described in instruction for debian. Here is return of my freeradius -xv: Tue Oct 8 15:07:55 2013 : Info: freeradius: FreeRADIUS Version 3.0.0, for host x86_64-pc-linux-gnu, built on Oct 8 2013 at 10:44:53 Tue Oct 8 15:07:55 2013 : Debug: Server was built with: Tue Oct 8 15:07:55 2013 : Debug: accounting Tue Oct 8 15:07:55 2013 : Debug: authentication Tue Oct 8 15:07:55 2013 : Debug: ascend binary attributes Tue Oct 8 15:07:55 2013 : Debug: coa Tue Oct 8 15:07:55 2013 : Debug: control-socket Tue Oct 8 15:07:55 2013 : Debug: detail Tue Oct 8 15:07:55 2013 : Debug: dhcp Tue Oct 8 15:07:55 2013 : Debug: dynamic clients Tue Oct 8 15:07:55 2013 : Debug: proxy Tue Oct 8 15:07:55 2013 : Debug: regex-posix Tue Oct 8 15:07:55 2013 : Debug: session-management Tue Oct 8 15:07:55 2013 : Debug: stats Tue Oct 8 15:07:55 2013 : Debug: tcp Tue Oct 8 15:07:55 2013 : Debug: threads Tue Oct 8 15:07:55 2013 : Debug: tls Tue Oct 8 15:07:55 2013 : Debug: unlang Tue Oct 8 15:07:55 2013 : Debug: vmps Tue Oct 8 15:07:55 2013 : Debug: Server core libs: Tue Oct 8 15:07:55 2013 : Debug: talloc : 2.0.* Tue Oct 8 15:07:55 2013 : Debug: ssl : OpenSSL 1.0.1 14 Mar 2012 I have pasted debug from freeradius -X on pastebin so it doesn't clutter too much here: http://pastebin.com/raw.php?i=u9mM3avv Any help is appreciated. Regards, Rok

3 4

Usage of Session-Timeout
by Volker Lieder 09 Oct '13

09 Oct '13

Hi, we upgraded a freeradius setup from 1.x to 2.1.10+dfsg-2+squeeze1 on Debian Squeeze. Within the old version, we used a database config for groups with an attribute "Session-Timeout" and the value `%{expr:06:00}` With new version freeradius send an error while looking in debug mode like: Tue Oct 1 16:15:23 2013 : Info: [sql] expand: 06:00 -> 06:00 Tue Oct 1 16:15:23 2013 : Info: [sql] Not a number at ":00" Tue Oct 1 16:15:23 2013 : Info: [sql] expand: %{expr:06:00} -> Can you explain why this value isnt working with new version or what we have to change to set the Session-Timeout that user get disconnected e.g. at 06:00 am? Regards, Volker Lieder

2 1

load balancing radius with F5 devices
by Alex Sharaz 09 Oct '13

09 Oct '13

Hi, Is anyone out there load balancing RADIUS with an F5 load balancer? We're doing it here, but I can't help thinking that the actual load balancing algorithm need some tweaking. As far as I'm aware ( systems section support the F5 boxes) 1). We're using round robin to spread the load over 2 back end radius servers. 2). There is some "general" sticky persistence so that once a RAS device starts talking to a particular back end server it continues to talk to that server for a predetermined length of time ( might be an hour, not sure). This ensures that an eap dialogue will always talk to the same back end server for the duration of the "stuck" time. Not sure what happens when you get to the end of the time interval though. According to the F5 statistics, overall radius traffic seems to be shared evenly over the 2 back end servers. However, our most heavily loaded RAS client is our wireless network. While we have 900 switches doing mac and 802.1x based auth, we can have 6000+ users on our wireless network all authenticating to RADIUS via 3 RAS clients. Looking at the back end server log files, it does look as if, in general, all wireless RADIUS auths head for the same back end server. I was wondering if there's a way off having a bit more granularity in terms of how the f5 load balances incoming RADIUS requests. Rgds Alex

5 7

unlang - delete attribute - !*
by Hachmer, Tobias 09 Oct '13

09 Oct '13

Hello list, I want to delete one reply attribute from the reply list if the access-request is originating not from a special NAS-IP-Address. Currently I have solved this by adding this unlang code in authorize section: if(!NAS-IP-Address == x.x.x.x) { update reply { Aruba-Admin-Role := "" } } The man page of unlang says: !* Delete all occurances of the named attribute, no matter what the value. I think this is the better way than just to clear the attribute value. But how can I use this, what's the correct syntax? I have tested the following without success: Aruba-Admin-Role !* "" Aruba-Admin-Role !* !* Aruba-Admin-Role Thanks in advance, Tobias Hachmer

2 2

Re: Changing User Profile after depletion of set Volume
by Mulindwa 08 Oct '13

08 Oct '13

Dear pple, I have looked for this and failed to get it, i have users with set volume limits and they get knocked off once they hit the limit, however ; i want to have this taken to the next level, i.e once the limit is hit, the user's profile be changed and they can only get to certain website /URL/IPs . How can i achieve this? Eric M

2 2

2.2.2 release date
by Wang, Yu 08 Oct '13

08 Oct '13

I remember Alan mentioned that 2.2.2 may be released today. I checked git for 2.x.x and it says 2.2.1. I am wondering if it'll be released soon. Thanks, Yu Wang

2 2

What does FR 2.2.2 fix?
by Alex Sharaz 07 Oct '13

07 Oct '13

Hi, Yesterday caught an email about the release of FR 2.2.2 on Monday to "fix a proxy problem". As I've just migrated 2 of my servers from 2.2.0 to 2.2.1 the sudden release of 2.2.2 sounds important. What does 2.2.2 fix? Rgds Ale x

9 19

Re: Problem with Cisco WLC probes in FR 2.2.1
by Bruce Nunn 07 Oct '13

07 Oct '13

Thanks for the heads-up. I will look for this this coming weekend when I get 2.2.2 in production. Jonathan Gazeley <Jonathan.Gazeley(a)bristol.ac.uk> wrote: >We've recently upgraded our radius servers from 2.1.12 (CentOS 6 >packaged default) to 2.2.1 (latest stable from FR, built by hand). > >A config that used to work under 2.1.12 no longer appears to work the >same way under 2.2.1. Our Cisco WLCs send periodic probes in the form of >a test authentication. There is a snippet of config that intercepts >these authentication requests: > ># /etc/raddb/conf.d/wism-checks.conf >if (Service-Type == "NAS-Prompt-User") { > if (NAS-IP-Address =~ /^172\.17\.107\./) { > if (User-Name =~ /^wisms\-testing/) { > update control { > Auth-Type := Accept > } > updated > } > else { > reject > } > } >updated = return >} > > >This config is included in every virtual server's outer config: > ># /etc/raddb/sites-enabled/eduroamlocal >authorize { > $INCLUDE conf.d/wism-checks.conf >} > > >Looking at the output from radiusd -XC the wism-checks.conf file is >being included in multiple places, yet when the server is running there >is no record of these test probe packets being processed. This means the >WLCs think the radius server is dead, and stop using it. I've had to >roll back to 2.1.12 to restore stable wireless service for our users. > >I can only assume this code block is being skipped over for some reason. >At present I'm unable to drop production radius servers into debug mode >since they can't handle the load while debugging, and while I do have >some development radius servers, our WLCs won't sent it these probe >packets unless it is an active production radius server. > >Does anyone have any tips for debugging this in a minimally disruptive >way? At the moment we don't have any development WLCs but we might have >to get some so we can have a separate environment for testing. In the >meantime I'm trying to get this code block to work so we can use the >newer version of FR. > >Thanks, and happy Friday >Jonathan >- >List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html

6 9