July 2013 - Freeradius-Users - lists.freeradius.org

Substring using Unlang?
by Peter Lambrechtsen 12 Jul '13

12 Jul '13

I've been looking at the options and it looks like the easiest will be to use perl or similar external module as it can't be done easily in FR 2.2.x For our subscriber authentication we use in certain situations the ADSL Remote ID as the Subscriber ID on the NAS. The issue with this is the Subscriber ID is limited on our NAS to 32 chars, any longer than that and the subscriber doesn't come up. With certain providers we connect up to they pass a ADSL Remote ID value longer than 32 chars. I was hoping there would be a way to trim / substring from the left the string and return that. In pseudo code it would be something like: if (length(ADSL-Agent-Remote-Id) > 31) { update reply { strncat(SubscriberID, ADSL-Agent-Remote-Id + (strlen(ADSL-Agent-Remote-Id) - 31), 31) } } else { update reply { SubscriberID := ADSL-Agent-Remote-Id } } Where in effect if the string is longer than 31 chars take the right most 31 chars and only return that. It's pretty simple in perl. And I suspect that is the only way to do it. This can't be done in Unlang or similar interpreted language within freeradius itself? Cheers Peter

3 5

Logging Cisco config changes with FreeRadius
by kyle woock 12 Jul '13

12 Jul '13

Freradius Users,I have installed FreeRadius on CentOS 6.4 in VMWare environment and I am pretty new to using something like FreeRadius. However I have it on my virtual machine and it is running I am able to authenticate against my Cisco 3550 Switch that is on my desk and connected to the network. Anyways the reason I have this is what I want this to do is once someone is logged into a switch with the FreeRadius credentials I want the session to be logged as to what they are changing. I know Cisco has a built in logging system but it is pretty vague I was just curious if there is away to actually show what the person is changing. And if I need another product to go a long with FreeRadius if you guys could point me in the right direction. Any help would be greatly appreciated. Thanks, Kyle W.

2 1

Re: LDAP authentication filter based on source SSID
by Alan Buxey 12 Jul '13

12 Jul '13

Look at the requests coming from your AP in debug mode. You should see information there that can be used eg called station id with SSID appended or a VSA with the SSID name or number in it. Use that with your policy alan

3 2

GitHub flow available entirely within browser
by Arran Cudbard-Bell 12 Jul '13

12 Jul '13

If you were put off from contributing by learning git, this might work well for you. https://github.com/blog/1557-github-flow-in-the-browser Arran Cudbard-Bell <a.cudbardb(a)freeradius.org> FreeRADIUS Development Team

1 0

LDAP authentication filter based on source SSID
by Gustavo Vieira Oliveira 12 Jul '13

12 Jul '13

Hello! I need some help with RADIUS regarding Wireless authentication with RADIUS + LDAP. I need to check if the user has permission to connect to a specific SSID, so we check a LDAP attribute for that. By that, we need to know from which SSID the authentication is being requested so we use a specific LDAP Filter to search the base and grant or deny the permission. We tried to use two instances of RADIUS, one per SSID, but the Wireless Controller doesn't seem to support it (supports only one AAA per AP). That's why i'm asking for help in case you people have some alternatives or ideas to solve it. The setup is based on Cisco Wireless Controller 5508. Thanks in advance!

2 3

3.0 regex realm syntax
by Brian Julin 12 Jul '13

12 Jul '13

It seems to be last call for refactoring some of the user-visible config items that are easier to change when bumping a major rev number. The syntax for regexp-based realms has always struck me as a bit hinky: realm "~regexp\\.edu" { } Would it require too much tokenization witchdoctoring to make: realm /regexp\.edu/ { } ...work? Also I find a note in my config file comments about some regexp availability in the "hints" file being in-transition and so not to use it, but cannot remember what that was about, it has been so long, and there seems to be no example in the stock configs. I'm looking forward to finally bumping to 3.0 on our non-RadSec servers as soon as things look to test out right and we can tell the boss that the package is supported on our distro. We'll be getting rid of a LOT of cruft in config files during the process due to the many new ease-of-use features. Things are sure looking up :-) -- Brian S. Julin Network Administrator Clark University

2 1

Loading fails without reporting an error
by Lovaas,Steven 12 Jul '13

12 Jul '13

Hello again, I've successfully gotten to the point where local authentication is working well for all modes, using multiple SSIDs through two virtual servers, so I felt confident jumping into the less familiar world of proxying. Not that the concept is hard to understand, it's just always seemed like there were many moving parts (realms and such). With the simpler realm configuration (all in proxy.conf) offered by 2.x, it seems logically laid out and should just work. But now when I load freerad in debug mode, it simply stops loading with no error, after one of my two home_server_pool stanzas. At that point, it has successfully loaded the basic proxy server, all three home_server stanzas, and the first home_server_pool. It just seems to stall. Should I be looking for an error in the last stanza that successfully displayed, or the first one that fails to load? Or would this happen with a missing dependency? Thanks, Steve Entire debug here: root@freerad13:/etc/freeradius# /usr/sbin/freeradius -X FreeRADIUS Version 2.2.0, for host x86_64-pc-linux-gnu, built on Sep 21 2012 at 05:38:16 Copyright (C) 1999-2012 The FreeRADIUS server project and contributors. There is NO warranty; not even for MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. You may redistribute copies of FreeRADIUS under the terms of the GNU General Public License v2. Starting - reading configuration files ... including configuration file /etc/freeradius/radiusd.conf including configuration file /etc/freeradius/proxy.conf including configuration file /etc/freeradius/clients.conf including files in directory /etc/freeradius/mods-enabled/ including configuration file /etc/freeradius/mods-enabled/echo including configuration file /etc/freeradius/mods-enabled/perl including configuration file /etc/freeradius/mods-enabled/chap including configuration file /etc/freeradius/mods-enabled/smbpasswd including configuration file /etc/freeradius/mods-enabled/soh including configuration file /etc/freeradius/mods-enabled/passwd including configuration file /etc/freeradius/mods-enabled/smsotp including configuration file /etc/freeradius/mods-enabled/krb5 including configuration file /etc/freeradius/mods-enabled/always including configuration file /etc/freeradius/mods-enabled/ntlm_auth including configuration file /etc/freeradius/mods-enabled/ldap including configuration file /etc/freeradius/mods-enabled/dynamic_clients including configuration file /etc/freeradius/mods-enabled/detail.log including configuration file /etc/freeradius/mods-enabled/rediswho including configuration file /etc/freeradius/mods-enabled/checkval including configuration file /etc/freeradius/mods-enabled/mschap including configuration file /etc/freeradius/mods-enabled/otp including configuration file /etc/freeradius/mods-enabled/realm including configuration file /etc/freeradius/mods-enabled/cui including configuration file /etc/freeradius/mods-enabled/unix including configuration file /etc/freeradius/mods-enabled/linelog including configuration file /etc/freeradius/mods-enabled/exec including configuration file /etc/freeradius/mods-enabled/detail.example.com including configuration file /etc/freeradius/mods-enabled/digest including configuration file /etc/freeradius/mods-enabled/etc_group including configuration file /etc/freeradius/mods-enabled/redis including configuration file /etc/freeradius/mods-enabled/policy including configuration file /etc/freeradius/mods-enabled/acct_unique including configuration file /etc/freeradius/mods-enabled/pap including configuration file /etc/freeradius/mods-enabled/opendirectory including configuration file /etc/freeradius/mods-enabled/dhcp_sqlippool including configuration file /etc/freeradius/mods-enabled/sql_log including configuration file /etc/freeradius/mods-enabled/mac2ip including configuration file /etc/freeradius/mods-enabled/pam including configuration file /etc/freeradius/mods-enabled/preprocess including configuration file /etc/freeradius/mods-enabled/sqlcounter_expire_on_login including configuration file /etc/freeradius/mods-enabled/files including configuration file /etc/freeradius/mods-enabled/radutmp including configuration file /etc/freeradius/mods-enabled/inner-eap including configuration file /etc/freeradius/mods-enabled/expiration including configuration file /etc/freeradius/mods-enabled/counter including configuration file /etc/freeradius/mods-enabled/sradutmp including configuration file /etc/freeradius/mods-enabled/detail including configuration file /etc/freeradius/mods-enabled/radrelay including configuration file /etc/freeradius/mods-enabled/attr_filter including configuration file /etc/freeradius/mods-enabled/logintime including configuration file /etc/freeradius/mods-enabled/cache including configuration file /etc/freeradius/mods-enabled/expr including configuration file /etc/freeradius/mods-enabled/attr_rewrite including configuration file /etc/freeradius/mods-enabled/mac2vlan including configuration file /etc/freeradius/mods-enabled/ippool including configuration file /etc/freeradius/mods-enabled/replicate including configuration file /etc/freeradius/mods-enabled/wimax including configuration file /etc/freeradius/eap.conf including configuration file /etc/freeradius/policy.conf including files in directory /etc/freeradius/sites-enabled/ including configuration file /etc/freeradius/sites-enabled/eduroam-proxy including configuration file /etc/freeradius/sites-enabled/inner-tunnel including configuration file /etc/freeradius/sites-enabled/eid-dot11i including configuration file /etc/freeradius/sites-enabled/default main { user = "freerad" group = "freerad" allow_core_dumps = no } including dictionary file /etc/freeradius/dictionary main { name = "freeradius" prefix = "/usr" localstatedir = "/var" sbindir = "/usr/sbin" logdir = "/var/log/freeradius" run_dir = "/var/run/freeradius" libdir = "/usr/lib/freeradius" radacctdir = "/var/log/freeradius/radacct" hostname_lookups = no max_request_time = 30 cleanup_delay = 5 max_requests = 4096 pidfile = "/var/run/freeradius/freeradius.pid" checkrad = "/usr/sbin/checkrad" debug_level = 0 proxy_requests = yes log { stripped_names = no auth = yes auth_badpass = no auth_goodpass = no } security { max_attributes = 200 reject_delay = 1 status_server = yes } } radiusd: #### Loading Realms and Home Servers #### proxy server { retry_delay = 5 retry_count = 3 default_fallback = no dead_time = 120 wake_all_if_all_dead = no } home_server localhost { ipaddr = 127.0.0.1 port = 1812 type = "auth" secret = "<snip>" response_window = 20 max_outstanding = 65536 require_message_authenticator = yes zombie_period = 40 status_check = "status-server" ping_interval = 30 check_interval = 30 num_answers_to_alive = 3 num_pings_to_alive = 3 revive_interval = 120 status_check_timeout = 4 } home_server tlrs1-eduroam-us { ipaddr = 64.57.22.74 port = 1812 type = "auth+acct" secret = "<snip>" response_window = 20 max_outstanding = 65536 require_message_authenticator = yes zombie_period = 40 status_check = "none" ping_interval = 30 check_interval = 30 num_answers_to_alive = 3 num_pings_to_alive = 3 revive_interval = 300 status_check_timeout = 4 } home_server tlrs2-eduroam-us { ipaddr = 64.57.22.78 port = 1812 type = "auth+acct" secret = "<snip>" response_window = 20 max_outstanding = 65536 require_message_authenticator = yes zombie_period = 40 status_check = "none" ping_interval = 30 check_interval = 30 num_answers_to_alive = 3 num_pings_to_alive = 3 revive_interval = 300 status_check_timeout = 4 } home_server_pool csu-auth { type = fail-over home_server = localhost } root@freerad13:/etc/freeradius#

4 7

Re: 2.2.0 & dhcp: regression
by Eugene Grosbein 12 Jul '13

12 Jul '13

On 12.07.2013 19:57, Alan DeKok wrote: > Eugene Grosbein wrote: >> The problem is always reproducible and have obvious "hard limit" >> correlating or consisting with number of open files. > > I'm not sure what changes from 2.1.12 to 2.2.0 would cause that. > >> I understand. With one exception - we have not performance problem, >> we have full lockup of all threads and after that not one request is served. > > All I can suggest is to see doc/bugs. Use gdb to find out where the > Perl threads are locking. Thanks, I'll try next week. >> That's another topic. I'd like not to turn to deep discussion of our load. >> In short, there may be bursts of thousands of DHCP requests per second >> lasting several minutes and we have enough horsepower to process them in parallel >> if we have at least one thousand of threads in the pool. > > Even 1000's of packets/s shouldn't require 1000's of threads. > FreeRADIUS can do ~60K packet/s single threaded. The main thing is to > ensure that the per-packet latency is low. > > You may want to convert the Perl logic into a stored procedure in the > database. That is usually MUCH faster. I've done that for some > deployments, and managed to get 1000's of DHCP packets/s with only a > small number of threads. That have already been done. My perl code uses persistent connections to MS SQL database and runs stored procedure there. Eugene Grosbein

1 0

How to best configure Radius for my domain ?
by Analyser Great 12 Jul '13

12 Jul '13

I am not sure what I am doing wrong but I am just banging my head on a simple problem. I am trying to upgrade from radius 1 to radius 2 and will be using an entire set of new configuration. Currently, I am checking an Ldap attribute "dialupaccess" to allow users to get access to vpn / network devices. Unfortunately everyone has access to everything in this scenario (Don't ask, I didn't set this up !!) I am trying to setup a configuration where network admins have access to all devices and users have only access to cisco vpn. I don't wanna use local user database since I already have Ldap to authorize and Kerberos to authenticate. How do you do this in your domain currently with version 2 ? Much appreciated John.

2 1

mod_auth_radius w/Apache 2.4.4 ??
by laurence.schuler 12 Jul '13

12 Jul '13

I'm trying to use mod_auth_radius(-2.0) with apache 2.4.4 and it does not appear to be working properly. It complains: [:warn] [pid 14690] AuthRadiusActive set, but no RADIUS server IP - missing AddRadiusAuth in this context?) When I have AuthRadiusAuth set, and I can confirm it by changing the hostname to garbage, the server will then fail to start. So, it seems the module needs to be updated for apache 2.4.4. Is this activity planned? anyone have patches? Thanks, --Larry

2 1