July 2013 - Freeradius-Users - lists.freeradius.org

Free radius version 3.0.0 rco
by manjunath uthappa ponnachana 23 Jul '13

23 Jul '13

Hi, I want to download free radius version 3.0.0 rco. Please let me know the downlaod link. Also wanted to know whether free radius version 3.0.0 rco is officially released or not. If not when it will be ready for official release. Thanks & Regards Manjunath  

3 3

2.x.x and radtest: no IPv6?
by Stefan Winter 23 Jul '13

23 Jul '13

Hi, while using radtest, I got some strange results: # ./radtest swinter testpwd [::1] 123 testing123 radclient: Failed to find IP address for host ::1: Success # ./radtest swinter testpwd ipv6-localhost 123 testing123 radclient: Failed to find IP address for host ipv6-localhost: Success ipv6-localhost is in my /etc/hosts. I'd expect both of these to work... no brackets also doesn't work, but that was just my last straw and doesn't have to work anyway. Does radtest not support IPv6? I could have sworn it did IPv6 earlier, but not totally sure. Greetings, Stefan Winter -- Stefan WINTER Ingenieur de Recherche Fondation RESTENA - Réseau Téléinformatique de l'Education Nationale et de la Recherche 6, rue Richard Coudenhove-Kalergi L-1359 Luxembourg Tel: +352 424409 1 Fax: +352 422473

5 11

User-Name containing a $
by Tena Gore 23 Jul '13

23 Jul '13

Is there a way to tell radius to not do something based on the User-Name containing a "$" ? I am doing dynamic VLAN assignment and I'd like to skip that for computer logins. I looked at unlang and I didn't see a way to check for a character in a username. Tena Gore Senior Network Administrator Technology Support Services Fairfield-Suisun Unified School District tenag(a)fsusd.org 707-399-1200

3 4

authentication by hostname
by Stefan Sticht 23 Jul '13

23 Jul '13

Hi, sorry, I am completely new to Radius … I want to change a FreeRadius server to authenticate a few hosts by their hostnames. The hostnames would be stored in a config file. How could I do this? This is the authentication request: rad_recv: Access-Request packet from host 10.10.10.21 port 54285, id=145, length=347 Framed-MTU = 1480 NAS-IP-Address = 10.10.10.21 NAS-Identifier = "HP-2520-24-PoE" User-Name = "host/MYHOSTNAME" Service-Type = Framed-User Framed-Protocol = PPP NAS-Port = 1 NAS-Port-Type = Ethernet NAS-Port-Id = "1" Called-Station-Id = "84-34-97-de-df-80" Calling-Station-Id = "00-1f-29-98-8d-41" Connect-Info = "CONNECT Ethernet 100Mbps Full duplex" Tunnel-Type:0 = VLAN Tunnel-Medium-Type:0 = IEEE-802 Tunnel-Private-Group-Id:0 = "201" EAP-Message = 0x0201001401686f73742f544344452d3030303131 Message-Authenticator = 0xe06791a76c819a3dc0f89c8baf2df141 MS-RAS-Vendor = 11 Thanks for any help! Take care, Stefan

3 2

RE: coa
by Okis Chuang 23 Jul '13

23 Jul '13

I think you should read documentation about CoA offered by your NAS. Then see what can likely be about *Missing Attribute* at least. You better know about all of Error-Cause it may occur. In my experience, it might be lack of key on identifying unique host. In other words, could it be your Acct-Session-Id or User-Name cannot be primary key to identify one host on the NAS? Okis. From: Muhammad Nadeem [mailto:mnadeem8327@gmail.com] Sent: Tuesday, July 23, 2013 2:00 PM To: okischuang(a)outlook.com Subject: Re: coa thanks all,,, i am using huawei NAS. here is the complete log echo "Acct-Session-Id=1B1E97C3,User-Name=002682615F4E(a)test_cpe.com,NAS-IP-Address =2.2.2.2" | radclient -x 2.2.2.2:3799 disconnect huaweiaaa Sending Disconnect-Request of id 0 to 2.2.2.2 port 3799 Acct-Session-Id = "1B1E97C3" User-Name = "002682615F4E(a)test_cpe.com" NAS-IP-Address = 2.2.2.2 rad_recv: Disconnect-NAK packet from host 2.2.2.2 port 3799, id=0, length=26 Error-Cause = Missing-Attribute whats wrong??? On Tue, Jul 23, 2013 at 10:58 AM, <okischuang(a)outlook.com> wrote: <quote author='Nadeem'> hi everybody,, I wanna implement COA (Change Of Authorization) in freeradius. I have a live session of a device, I wanna disconnect this device forcefully. I isssued following command echo "Acct-Session-Id=1B1E97C3,User-Name=002682615F4E(a)test_cpe.com,NAS-IP-Address =2.2.2.2" | radclient -x 2.2.2.2:3799 disconnect 'huaweiaaa' but it give the error of "missing attribute". Can anybody tell me what is the issue. Thanks -- What kind of CoA server you are using? In my experiences, coa highly depends on the type of NAS. In my case that I has a WiFi GW as CoA server, it usually gets "Missing Attributes" if I missed some *keys* of identifying unique user. Such as "NAS-IP-Address + NAS-Port-Id" or "Some-VSA-Can-Be-A-Key" or "Acct-Session-Id" and usually with priority. Besides, maybe you can post some more detailed output of your testing so that we can do more help. Okis. _____________________________________ Sent from http://freeradius.1045715.n5.nabble.com -- Best Regards Muhammad Nadeem Muhammad Ali Jinnah University

1 0

coa
by Muhammad Nadeem 23 Jul '13

23 Jul '13

hi everybody,, I wanna implement COA (Change Of Authorization) in freeradius. I have a live session of a device, I wanna disconnect this device forcefully. I isssued following command echo "Acct-Session-Id=1B1E97C3,User-Name=002682615F4E(a)test_cpe.com,NAS-IP-Address=2.2.2.2" | radclient -x 2.2.2.2:3799 disconnect 'huaweiaaa' but it give the error of "missing attribute". Can anybody tell me what is the issue. Thanks -- Best Regards Muhammad Nadeem Muhammad Ali Jinnah University

3 4

Re: LDAP authentication filter based on source SSID
by Gustavo Vieira Oliveira 22 Jul '13

22 Jul '13

Yes it does. We found the solution by creating a rule that maps all the BSSID related to some SSID and then we do a specific filter to LDAP, so we did it for every SSID. Thanks for the help! Atenciosamente, Gustavo Vieira Oliveira GETIC - Gerência de Tecnologia da Informação SUSERV - Superintendência de Serviços Compartilhados Sistema FIESC Rod. Admar Gonzaga, 2765 - Itacorubi - 88034-001 - Florianópolis - SC Fone (48) 32314699 - Ramal 44699 http://www.sistemafiesc.com.br Em 12/07/2013 12:57, Alan Buxey escreveu: > Does it use a different called station id mac for each ssid? > > alan >

1 0

Ignoring request to authentication IPv6address
by Murali Krishnan 22 Jul '13

22 Jul '13

Hi, I want to make all the IPv6 address in a network to access the radius without specifying the individual ips in client.conf, because I am using DHCP server assigned IPs for clients. Whenever I add individual ip’s it’s working fine. But not, with below configuration in clients.conf. Client fd00:1:1:1::/63{ secret=mykey } But it throws the below error when I ran the radius in debug mode Ignoring request to authentication address :: port 1812 from unknown client fd00:1:1:1:191a:ddba:1784:e7c6 port 45297 my radius version is FreeRADIUS Version 2.1.7 Thanks if anyone give solution to this. Regards, MK

1 0

Ubuntu FreeRadius does not recoginize some perl.so symbols and does not compile from source and is also outdated (Why is there no new version in SID? Is the package still maintained?)
by Thomas Glanzmann 22 Jul '13

22 Jul '13

Hello, I wanted to use the FreeRadius package included in Ubuntu 12.04.2 LTS (GNU/Linux 3.2.0-49-generic x86_64) to do SMS OTP password. In order to do that I need to load perl code into FreeRadius which fails with the following error on a fresh installed system: (1) FreeRadius does not recognize symbol from perl module sudo apt-get install freeradius libauthen-krb5-simple-perl sudo cat > /etc/freeradius/sites-enabled/perl <<EOF authenticate { perl } authorize { update control { Auth-Type := perl } preprocess } preacct { preprocess acct_unique suffix } accounting { detail radutmp attr_filter.accounting_response } session { radutmp } EOF sudo cat > /etc/freeradius/example.pl <<EOF use Authen::Krb5::Simple; EOF root@ubuntu64:~# sudo /etc/init.d/freeradius restart * Stopping FreeRADIUS daemon freeradius * /var/run/freeradius/freeradius.pid not found... ...done. * Starting FreeRADIUS daemon freeradius Can't load '/usr/lib/perl5/auto/Authen/Krb5/Simple/Simple.so' for module Authen::Krb5::Simple: /usr/lib/perl5/auto/Authen/Krb5/Simple/Simple.so: undefined symbol: PL_thr_key at /usr/lib/perl/5.14/DynaLoader.pm line 184. at /etc/freeradius/example.pl line 1 Compilation failed in require at /etc/freeradius/example.pl line 1. BEGIN failed--compilation aborted at /etc/freeradius/example.pl line 1. ...fail! In order to resolve that issue the FreeRadius version need to be upgradred. However I tried to rebuild from source because I saw a similar bug before which got resolved by rebuilding the package after a perl security update: (2) Freeradius does not build from source. sudo su - apt-get build-dep freeradius apt-get source freeradius cd freeradius-2.1.10+dfsg/ debian/rules binary And it fails: radeapclient.c:975:6: warning: variable 'count' set but not used [-Wunused-but-set-variable] libtool: compile: gcc -g -O2 -D_REENTRANT -D_POSIX_PTHREAD_SEMANTICS -Wall -D_GNU_SOURCE -g -Wshadow -Wpointer-arith -Wcast-qual -Wcast-align -Wwrite-strings -Wstrict-prototypes -Wmissing-prototypes -Wmissing-declarations -Wnested-externs -W -Wredundant-decls -Wundef -I/tmp/freeradius-2.1.10+dfsg/src -Ilibeap -c radeapclient.c -o radeapclient.o >/dev/null 2>&1 /usr/bin/libtool --mode=link gcc -o radeapclient radeapclient.lo libeap/libfreeradius-eap.la -lnsl -lresolv -lpthread -lcrypto -lssl -lcrypto libtool: link: gcc -o .libs/radeapclient .libs/radeapclient.o libeap/.libs/libfreeradius-eap.so -lnsl -lresolv -lpthread -lssl -lcrypto -Wl,-rpath -Wl,/usr/lib/freeradius /usr/bin/ld: .libs/radeapclient.o: undefined reference to symbol 'fr_perror' /usr/bin/ld: note: 'fr_perror' is defined in DSO /usr/lib/freeradius/libfreeradius-radius-2.1.10.so so try adding it to the linker command line /usr/lib/freeradius/libfreeradius-radius-2.1.10.so: could not read symbols: Invalid operation collect2: ld returned 1 exit status make[7]: *** [radeapclient] Error 1 Full log is at: http://pbot.rmdir.de/6QWM6SrvmhzLYUQzjpQ3Dg For the second issue I saw that there was a bug report which was closed because it was not reproducible. For me it is, I reproduced it on a system setup from scratch. I installed your ssh key on the system so that you can troubleshoot the problem. ssh -l yolanda -p 4001 infra.gmvl.de You can get root by issueing 'sudo su -'. I disabled the password prompt. You can also set you a password by 'sudo passwd yolanda' if necessary. The system has full internet access. Please let me know if I should file a bugreport for (1) and/or reopen the bugreport for (2). Howto reproduce the build bug: - Install a fresh Ubuntu in the packet selection only select ssh server - Execute the commands mentioned above. References: http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=623928 https://bugs.launchpad.net/ubuntu/+source/freeradius/+bug/1090365 As Alan has mention on the bug 1090365 in launchpad, is is easily fixed by applying the following patch: -- commit c86003daabfd7db7249c7259db48a5cc1aa2fb01 Author: Alan T. DeKok <aland(a)freeradius.org> Date: Thu Jan 20 16:01:17 2011 +0100 Add $(LIBRADIUS) to allow it to link diff --git a/src/modules/rlm_eap/Makefile.in b/src/modules/rlm_eap/Makefile.in index 1e20588..5576294 100644 --- a/src/modules/rlm_eap/Makefile.in +++ b/src/modules/rlm_eap/Makefile.in @@ -6,7 +6,7 @@ TARGET = @targetname@ SRCS = rlm_eap.c eap.c mem.c HEADERS = eap.h rlm_eap.h RLM_CFLAGS = $(INCLTDL) -Ilibeap -CLIENTLIBS = libeap/$(LIBPREFIX)freeradius-eap.la +CLIENTLIBS = libeap/$(LIBPREFIX)freeradius-eap.la $(LIBRADIUS) RLM_LIBS = libeap/$(LIBPREFIX)freeradius-eap.la $(LIBLTDL) RLM_INSTALL = install-subdirs RLM_SUBDIRS = libeap @eaptypes@ -- So I wonder why the build problem was not fixed? I really would like to see that both issues get fixed. That way the out of the box FreeRadius packet gets usuable and someone does not need to recompile the package. Also I do not understand why Debian and Ubuntu does not have the current version of the 2.2.x branch. It looks like the package is no longer maintained. I also do not see a current version in SID (for Debian and Ubuntu that is). So I wonder what is going on here? So for now I'm stuck with compiling FreeRadius by myself for Debian/Ubuntu. Has someone updated Debian packages somewhere? Cheers, Thomas -- Thomas Glanzmann <thomas(a)glanzmann.de> Landline +49 9131 6 14 720 Diplom-Informatiker Univ. Facsimile +49 9131 6 14 721 Rathsbergerstrasse 28 D-91054 Erlangen - Burgberg, Germany http://thomas.glanzmann.de/

4 14

Re: Ubuntu FreeRadius does not recoginize some perl.so symbols and does not compile from source and is also outdated (Why is there no new version in SID? Is the package still maintained?)
by Alan Buxey 21 Jul '13

21 Jul '13

Freeradius does not build from source. Yes. It does. But you are compiling some random external flavour. Download the source from freeradius.org and report what happens alan

3 4