October 2013 - Freeradius-Users - lists.freeradius.org

FR3 passchange module
by Davide Garofalo 30 Oct '13

30 Oct '13

Hi all, the passchange module doesn't work if in widows 7 is activated the "single sign on". If i disable the single sign on , the passchange works fine.... why? -- *Davide Garofalo*

2 1

Re: Freeradius-Users Digest, Vol 102, Issue 89
by Игорь Авдошкин 30 Oct '13

30 Oct '13

There are suggestions that blocks the entry into the database via mysql. Can you advise why the blocks? http://pastebin.com/XWBp6uFw 2013/10/25 <freeradius-users-request(a)lists.freeradius.org> > Send Freeradius-Users mailing list submissions to > freeradius-users(a)lists.freeradius.org > > To subscribe or unsubscribe via the World Wide Web, visit > http://lists.freeradius.org/mailman/listinfo/freeradius-users > or, via email, send a message with subject or body 'help' to > freeradius-users-request(a)lists.freeradius.org > > You can reach the person managing the list at > freeradius-users-owner(a)lists.freeradius.org > > When replying, please edit your Subject line so it is more specific > than "Re: Contents of Freeradius-Users digest..." > > > Today's Topics: > > 1. Problem building 2.2.1 without OpenSSL (Caines, Max) > 2. Re: Problem building 2.2.1 without OpenSSL (Arran Cudbard-Bell) > 3. Re: Flow Chat For FR (Jefferson Davis) > 4. dhcp (????? ????????) > 5. Re: dhcp (Alan DeKok) > > > ---------------------------------------------------------------------- > > Message: 1 > Date: Thu, 24 Oct 2013 15:21:41 +0000 > From: "Caines, Max" <Max.Caines(a)wlv.ac.uk> > To: "freeradius-users(a)lists.freeradius.org" > <freeradius-users(a)lists.freeradius.org> > Subject: Problem building 2.2.1 without OpenSSL > Message-ID: > <51243266EE272F42B6B7C6B2464196F327F772(a)EXCHMBX10X01.unv.wlv.ac.uk > > > Content-Type: text/plain; charset="us-ascii" > > HI > > I recently built FR using: > > ./configure --with-openssl=no --without-rlm_eap_peap --without-rlm_eap_tls > --without-rlm_eap_ttls --without-rlm_otp --without-rlm_sql_postgres > --without-snmp > > I still got an unsatisfied reference from src/main/radius.c line 258, > which calls "ssl_check_version", which of course needs the OpenSSL library. > It was easy to fix, but I thought I should let you know > > Regards > > Max > > Max Caines | Network Design Consultant | IT Services | University of > Wolverhampton | 01902 322245 | 07976 841874 | Max.Caines(a)wlv.ac.uk > <mailto:Max.Caines@wlv.ac.uk> > > For contact details and general information on IT Services please visit > http://www.wlv.ac.uk/its This email, together with any attachment, is for > the exclusive and confidential use of the addressee(s) and may contain > legally privileged information. If you receive this email in error, please > visit http://www.wlv.ac.uk/ITS-disclaimer . Please consider the > environment before printing this e-mail. > > > -- > Scanned by iCritical. > >

1 1

Voucher Top-Up
by Russell Mike 29 Oct '13

29 Oct '13

Hi Good People Can any one give advice how voucher top up can achieve ? any suggestion are welcome. i am ready for any kind of work around. Thanks / Regards

1 0

Re: Freeradius-Users Digest, Vol 102, Issue 104
by Rui Ribeiro 29 Oct '13

29 Oct '13

> ------------------------------ > > Message: 2 > Date: Tue, 29 Oct 2013 19:44:13 +0800 > From: "ST Wong (ITSC)" <ST(a)itsc.cuhk.edu.hk> > To: <freeradius-users(a)lists.freeradius.org> > Subject: Segmentation fault with LDAP authentication and rate control? > Message-ID: > < > 445F29A6610A1848A42F287F7821731C01EB8055(a)EXCH1-ITSC.itsc.cuhk.edu.hk> > Content-Type: text/plain; charset="iso-8859-1" > > Hi all, > > ... > > > Besides, as we must use LDAP for authentication backend which maybe a > bottleneck, is it feasible to have kind of QoS/rate control for incoming > authentication requests, and/or some LDAP authentication result caching? > Sorry for the na?ve questions. Thanks again. > > > > Best Regards, > > /ST Wong > > As for LDAP authentication, I would to add, that is quite important to have filters in place to filter out improperly configured devices, and that I have timed LDAP/AD authentication inside a PEAP-MSCHAPv2 tunnel, and the whole process takes between 10ms and 20ms. Regards

1 0

802.1x New user on domain computer
by Davide Garofalo 29 Oct '13

29 Oct '13

good morning at all, i have a 802.1x infrastructure with dynamic vlan assignment for user authentication. When a PC is turned on, if the PC is computer group members of AD, then the computer is placed in a particular vlan (for example tag 137). When the user make login is moved to the correct vlan (for example 103). The problem is when user make logout. The computer remake authentication and it's moved on its vlan (137) but windows doesn't remake an ip renew. If a new user (never logged in this computer) tries to login, he can't finisch successfully the login because the computer hasn't an ip address to reach the Active Directory. Someone knows how to solve this problem??? Regards PS: I'm using freeradius 3 and passchange module works very fine. -- *Davide Garofalo*

3 2

Re: Freeradius-Users Digest, Vol 102, Issue 101
by Rui Ribeiro 29 Oct '13

29 Oct '13

On 28 October 2013 21:28, <freeradius-users-request(a)lists.freeradius.org>wrote: > > > Message: 4 > Date: Mon, 28 Oct 2013 16:14:10 -0400 > From: Alan DeKok <aland(a)deployingradius.com> > To: FreeRadius users mailing list > <freeradius-users(a)lists.freeradius.org> > Subject: Re: Freeradus service goes down > Message-ID: <526EC592.1070708(a)deployingradius.com> > Content-Type: text/plain; charset=ISO-8859-1 > > Roberto Carna wrote: > > Dear, I have a Freeradius server running OK, authenticating against an > > AD. The Debian package is 2.1.12+dfsg-1.2 version. > > > > The problem is that the service goes down 2 o 3 times a week, and I > > can't know tha cause. I see the /var/log/freeradius/radisu.log but > > there is nothing important I think. > > Upgrade. We'll be releasing version 2.2.2 tomorrow. > > Alan DeKok. > > Alan, all due respect, but we are talking about the stock Debian package. I won't upgrade unless I *really* need to, since I have security upgrades and the rest of the team is not so experienced. Most of people will not feel as comfortable as to compile it. However I will soon have a test domain/server with 2.2.2. Regards

4 3

EAP-SIM Fast Re-Authentication
by pramod ganigi 29 Oct '13

29 Oct '13

Dear Free Radius Team, How to check whether Fast Re-Authentication is enabled for my Free Radius Software. If not enabled, then how to enable Fast Re-Authentication for EAP-SIM? Is there any specific procedure to verify whether Fast Re-Auth is working fine? Thank You Pramod Ganigi

2 1

freeradius3 ldap module
by ferdinando 29 Oct '13

29 Oct '13

hi all im trying to make fr3 running with ldap support against samba4 but something goes wrong... i only need to check the ldap group membership of wifi user, defined in users file. this is the log: .... # Instantiating module "ldap" from file /usr/local/app/freeradius-3.1.0/etc/raddb/mods-enabled/ldap ldap { server = "dc01.bunkertor.local" port = 389 password = "Polo1976." identity = "CN=auth_radius,OU=services,OU=lan,DC=bunkertor,DC=local" user { filter = "(sAMAccountName=%{%{Stripped-User-Name}:-%{User-Name}})" scope = "sub" base_dn = "dc=bunkertor,dc=local" access_positive = yes } group { filter = "(objectClass=posixGroup)" scope = "sub" base_dn = "dc=bunkertor,dc=local" name_attribute = "cn" membership_attribute = "memberOf" membership_filter = "(|(member=%{control:Ldap-UserDn})(memberUid=%{%{Stripped-User-Name}:-%{User-Name}}))" cacheable_name = no cacheable_dn = no } client { filter = "(objectClass=frClient)" scope = "sub" base_dn = "dc=bunkertor,dc=local" attribute { identifier = "radiusClientIdentifier" shortname = "cn" secret = "radiusClientSecret" } } profile { filter = "(&)" } options { ldap_debug = 40 chase_referrals = yes rebind = yes net_timeout = 1 res_timeout = 20 srv_timelimit = 20 idle = 60 probes = 3 interval = 3 } tls { start_tls = no } } accounting { reference = "%{tolower:type.%{Acct-Status-Type}}" } post-auth { reference = "." } rlm_ldap (ldap): Initialising connection pool pool { start = 5 min = 4 max = 10 spare = 3 uses = 0 lifetime = 0 cleanup_delay = 5 idle_timeout = 60 spread = no } rlm_ldap (ldap): Opening additional connection (0) rlm_ldap (ldap): Opening connection failed (0) rlm_ldap (ldap): Removing connection pool /usr/local/app/freeradius-3.1.0/etc/raddb/mods-enabled/ldap[8]: Instantiation failed for module "ldap" .... checking samba4 log i cannot see any connection attemps. thats wierd, becouse: root@radius:/usr/local/app/freeradius-3.1.0/sbin# ldapsearch -LLL -H ldap://dc01 -x -D 'CN=auth_radius,OU=services,OU=lan,DC=bunkertor,DC=local' -w Polo1976. -b 'dc=bunkertor,dc=local' samaccountname=wifi_user dn: CN=wifi_user,OU=users,OU=lan,DC=bunkertor,DC=local objectClass: top objectClass: person objectClass: organizationalPerson objectClass: user cn: wifi_user givenName: wifi_user instanceType: 4 whenCreated: 20131011091034.0Z displayName: wifi_user uSNCreated: 4348 name: wifi_user objectGUID:: 84lCIUpEDEK7C4g5/Zj9xA== badPwdCount: 0 codePage: 0 countryCode: 0 badPasswordTime: 0 lastLogoff: 0 lastLogon: 0 primaryGroupID: 513 objectSid:: AQUAAAAAAAUVAAAAbnIRzvzJQRP8xGLfawQAAA== accountExpires: 9223372036854775807 logonCount: 0 sAMAccountName: wifi_user sAMAccountType: 805306368 userPrincipalName: wifi_user(a)bunkertor.local objectCategory: CN=Person,CN=Schema,CN=Configuration,DC=bunkertor,DC=local pwdLastSet: 130259562340000000 userAccountControl: 66048 memberOf: CN=grp_wifi,OU=service-groups,OU=groups,OU=lan,DC=bunkertor,DC=local msSFU30NisDomain: bunkertor uidNumber: 10010 loginShell: /bin/sh unixHomeDirectory: /home/wifi_user gidNumber: 3000022 msSFU30Name: wifi_user uid: wifi_user whenChanged: 20131011091113.0Z uSNChanged: 4355 distinguishedName: CN=wifi_user,OU=users,OU=lan,DC=bunkertor,DC=local # refldap://bunkertor.local/CN=Configuration,DC=bunkertor,DC=local # refldap://bunkertor.local/DC=DomainDnsZones,DC=bunkertor,DC=local # refldap://bunkertor.local/DC=ForestDnsZones,DC=bunkertor,DC=local .... i cannot understand where is the mistake.... =( thanks in advance for help. bye.

2 2

LDAP Module stops working after HUP (sometimes)
by Rudolph Bott 28 Oct '13

28 Oct '13

Hi List, recently we upgraded our FR installation to 2.1.12 (Debian Wheezy paket). We are using rlm_ldap in connection with EAP for wireless network authentication. However, every morning the logrotate script sends a HUP to freeradius after it rotated its log files. Since that update, every once in a while the LDAP module fails after that reload. It rejects all users with a line like the following: Auth: Login incorrect ( [ldap] User not found): [username-xyz] Since it only happens every couple of days (e.g. once a week), we are hesitating to enable the debug mode for several days as it spills the user passwords all over the log (yes I know, that has been discussed on this list more than enough and I do not want to open that discussion again). I already checked the changelog from 2.1.12 up to the latest 2.x Version and also the Bugtracker on github (and some more recent mails regarding LDAP on this list) but could not find much. Has anyone ever experienced this problem as well? As there is no newer package in Debian Jessie to backport, our next step would probably be to try to build the latest version ourself. However, since we can not reproduce the problem yet, testing the latest version in a production is certainly not the wistest thing to do. Any hints would be apreciated, thanks! for reference, this is our current rlm_ldap config: ldap { server = "ldap://server1/ ldap://server2/ ldap://server3/ ldap://server4/" basedn = "ou=poeple,dc=domain,dc=de" filter = "(uid=%{Stripped-User-Name:-%{mschap:User-Name}})" base_filter = "(objectclass=radiusprofile)" ldap_connections_number = 5 timeout = 4 timelimit = 3 net_timeout = 1 tls { start_tls = yes cacertfile = /path/to/CA.pem } access_attr = "dialupAccess" dictionary_mapping = ${confdir}/ldap.attrmap password_attribute = userPassword edir_account_policy_check = no groupname_attribute = cn groupmembership_filter = "(objectClass=posixGroup)(memberUid=%{Stripped-User-Name:-%{mschap:User-Name}})" groupmembership_attribute = radiusGroupName access_attr_used_for_allow = yes set_auth_type = yes keepalive { idle = 60 probes = 3 interval = 3 } } -- Mit freundlichen Grüßen / With kind regards Rudolph Bott

2 1

Re: Freeradius-Users Digest, Vol 102, Issue 100
by Rui Ribeiro 28 Oct '13

28 Oct '13

On 28 October 2013 18:40, <freeradius-users-request(a)lists.freeradius.org>wrote: > > Message: 2 > Date: Mon, 28 Oct 2013 12:02:32 -0200 > From: Roberto Carna <robertocarna36(a)gmail.com> > To: FreeRadius users mailing list > <freeradius-users(a)lists.freeradius.org> > Subject: Freeradus service goes down > Message-ID: > < > CAG2Qp6vudJAJEQxQ9WQhWnh30jasATAPoFjm1D+P-kBNOoMGrQ(a)mail.gmail.com> > Content-Type: text/plain; charset=ISO-8859-1 > > Dear, I have a Freeradius server running OK, authenticating against an > AD. The Debian package is 2.1.12+dfsg-1.2 version. > > The problem is that the service goes down 2 o 3 times a week, and I > can't know tha cause. I see the /var/log/freeradius/radisu.log but > there is nothing important I think. > > When I start the service in this way "service freeradius start", today > the service didn't start, and I have started it with "freeradius -X" > and it runs OK now. > > How can I find the origin of the problem the service goes up frequently??? > > Do you recommend to me start the service with "service freeradius > start" or "freeradius -X"??? > > Thanks in advance. > > Roberto > > > ------------------------------ > Hi Roberto, We also are authenticating against an AD, and once in a month we have your problem. At the moment we haven't found the cause, nor any logs. Furthermore, what I can tell you is that local authentications starting failing, but users in roaming continue to authenticate, which in itself suggests is some problem in the LDAP part. The start should not work because in reality in our case the service does not go down, only stops authenticating. So what I do here is to run a script authenticating a local AD user with PEAP-MSCHAP-v2, and once that fails, I stop and start the service (no restart either, as the debian scripts have a peculiarity that if freeradius is down, restart gives an error and does nothing). Regards

1 0