January 2014 - Freeradius-Users - lists.freeradius.org

FreeRadius3 - TLS 1.2 & Eapol_Test
by O'Connell, Ryan 23 Jan '14

23 Jan '14

Is there a way to use eapol_test to force TLS 1.2? I have downloaded and compiled the latest wpa_supplicant with OpenSSL 1.0.1e-fips 11 Feb 2013. I can't seem to find the configuration switch to enable TLS 1.2. On the server side I have tried configuring the eap module with: cipher_list = "DEFAULT" cipher_list = "ALL:!MEDIUM:!LOW" cipher_list = "AES256-SHA" cipher_list = "AES256-SHA256" cipher_list = "AES256-SHA256:AES128-SHA256" cipher_list = "AES256-SHA256:AES128:SHA" The command string I am currently using is: ./eapol_test -c eapol_test.conf.tls -a10.115.10.32 -p1812 -stesting123 -r1 The contents of the eapol_test.conf.tls are: eapol_version=2 network={ eap=TLS eapol_flags=3 proto=WPA #key_mgmt=IEEE8021X key_mgmt=WPA-EAP identity="00A0BC2FF8C0@test" ca_cert="testca.pem" client_cert="Client_Cert.pem" private_key="Client_privKey.pem" } My FreeRadius3 server server details: [root@aaa ~]# /usr/sbin/radiusd -Xv Wed Jan 22 13:00:52 2014 : Info: radiusd: FreeRADIUS Version 3.0.1, for host x86_64-redhat-linux-gnu, built on Jan 20 2014 at 01:36:32 Wed Jan 22 13:00:52 2014 : Debug: Server was built with: Wed Jan 22 13:00:52 2014 : Debug: accounting Wed Jan 22 13:00:52 2014 : Debug: authentication Wed Jan 22 13:00:52 2014 : Debug: ascend binary attributes Wed Jan 22 13:00:52 2014 : Debug: coa Wed Jan 22 13:00:52 2014 : Debug: control-socket Wed Jan 22 13:00:52 2014 : Debug: detail Wed Jan 22 13:00:52 2014 : Debug: dhcp Wed Jan 22 13:00:52 2014 : Debug: dynamic clients Wed Jan 22 13:00:52 2014 : Debug: proxy Wed Jan 22 13:00:52 2014 : Debug: regex-pcre Wed Jan 22 13:00:52 2014 : Debug: session-management Wed Jan 22 13:00:52 2014 : Debug: stats Wed Jan 22 13:00:52 2014 : Debug: tcp Wed Jan 22 13:00:52 2014 : Debug: threads Wed Jan 22 13:00:52 2014 : Debug: tls Wed Jan 22 13:00:52 2014 : Debug: unlang Wed Jan 22 13:00:52 2014 : Debug: vmps Wed Jan 22 13:00:52 2014 : Debug: Server core libs: Wed Jan 22 13:00:52 2014 : Debug: talloc : 2.0.* Wed Jan 22 13:00:52 2014 : Debug: ssl : OpenSSL 1.0.1e-fips 11 Feb 2013 Wed Jan 22 13:00:52 2014 : Info: Copyright (C) 1999-2014 The FreeRADIUS server project and contributors Wed Jan 22 13:00:52 2014 : Info: There is NO warranty; not even for MERCHANTABILITY or FITNESS FOR A Wed Jan 22 13:00:52 2014 : Info: PARTICULAR PURPOSE Wed Jan 22 13:00:52 2014 : Info: You may redistribute copies of FreeRADIUS under the terms of the Wed Jan 22 13:00:52 2014 : Info: GNU General Public License Wed Jan 22 13:00:52 2014 : Info: For more information about these matters, see the file named COPYRIGHT Thanks, Ryan

4 6

Removing log entries
by René Olskjær Nielsen 23 Jan '14

23 Jan '14

Hello I am running a couple of freeradius 2.2.3 servere behind an ACE HLB. The HLB is probing the servers frequently and I want to remove these logins from the log, as the logs is used intensively by supporters to help users with login issues. Is this possible? And if how? Best rgds.

5 5

ERX vs Unisphere ATTRIBUTES (Juniper MX)
by r00tk1d＠km.pl.ua 23 Jan '14

23 Jan '14

Hi! Got a problem with Juniper MX80, because ALL attributes suddenly changed. Old: ERX-Dhcp-Mac-Addr, Now: Unisphere-Dhcp-Mac-Addr, but my perl plugin uses ERX attributes. Do i need to rewrite my plugin or it will be fixed?

2 1

freeradius3 dhcp.dictionary error
by Darrel 22 Jan '14

22 Jan '14

"Errors reading dictionary: dict_init: /usr/local/share/freeradius/dictionary.dhcp[208]: Type "tlv" can only be for "format=1,1". Can I dereference dhcp.dictionary somehow? This error is on FreeBSD10. I did not enable dhcp, the dictionary is there by default. Darrel

5 8

Fwd: Issues with rlm_perl
by Ryan De Kock 22 Jan '14

22 Jan '14

Hi, No sure if this has been seen before but there is an issue with 3.0.1 where the correct pairs or not sent to the rlm_perl module. Version: radiusd: FreeRADIUS Version 3.0.1, for host x86_64-unknown-linux-gnu, built on Jan 20 2014 at 12:27:00 Copyright (C) 1999-2014 The FreeRADIUS server project and contributors There is NO warranty; not even for MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE You may redistribute copies of FreeRADIUS under the terms of the GNU General Public License For more information about these matters, see the file named COPYRIGHT Debug: ....... Ready to process requests. rad_recv: Accounting-Request packet from host 105.236.242.204 port 43909, id=61, length=196 Acct-Status-Type = Stop Acct-Terminate-Cause = User-Request NAS-Port-Type = Wireless-802.11 Calling-Station-Id = 'FC:C7:34:BA:7A:39' Called-Station-Id = 'hotspot1' NAS-Port-Id = 'Hotspot-Bridge' User-Name = 'supertest123' NAS-Port = 2163212315 Acct-Session-Id = '80f0001b' Framed-IP-Address = 10.20.30.3 Mikrotik-Host-IP = 10.20.30.3 Event-Timestamp = 'Jan 22 2014 09:45:49 SAST' Acct-Input-Octets = 104 Acct-Output-Octets = 52 Acct-Input-Gigawords = 0 Acct-Output-Gigawords = 0 Acct-Input-Packets = 2 Acct-Output-Packets = 1 Acct-Session-Time = 8 NAS-Identifier = 'Dev' Acct-Delay-Time = 0 NAS-IP-Address = 105.236.242.204 ........ rlm_perl: *DEBUG* Stop != Acct-Start so not doing mail. rlm_perl: *DEBUG* Checking Valid username/location rlm_perl: Added pair Acct-Input-Octets = 104 rlm_perl: Added pair NAS-Port-Type = Wireless-802.11 rlm_perl: Added pair Acct-Session-Id = 80f0 rlm_perl: Added pair Acct-Output-Gigawords = 0 rlm_perl: Added pair Acct-Unique-Session-Id = c165 rlm_perl: Added pair Called-Station-Id = hots rlm_perl: Added pair Tmp-IP-Address-0 = 105.236.242.204 rlm_perl: Added pair Acct-Status-Type = Stop rlm_perl: Added pair Acct-Output-Packets = 1 rlm_perl: Added pair Mikrotik-Host-IP = 10.20.30.3 rlm_perl: Added pair NAS-IP-Address = 105.236.242.204 rlm_perl: Added pair NAS-Port-Id = Hots rlm_perl: Added pair Acct-Output-Octets = 52 rlm_perl: Added pair Acct-Terminate-Cause = User-Request rlm_perl: Added pair Acct-Session-Time = 8 rlm_perl: Added pair Calling-Station-Id = FC:C rlm_perl: Added pair User-Name = supe rlm_perl: Added pair NAS-Identifier = Dev rlm_perl: Added pair Event-Timestamp = Jan 22 2014 09:45:49 SAST rlm_perl: Added pair Acct-Input-Gigawords = 0 rlm_perl: Added pair Acct-Input-Packets = 2 rlm_perl: Added pair Framed-IP-Address = 10.20.30.3 rlm_perl: Added pair NAS-Port = 2163212315 rlm_perl: Added pair Acct-Delay-Time = 0 rlm_perl: Added pair Tmp-Integer-0 = 100 .......... Called-Station-Id, Acct-Session-Id, Calling-Station-Id, User-Name,NAS-Identifier are all incorrect (maybe others as well?) Is there a potential fix? This was the latest version on the freeradius site

2 1

what is version 8014870 of threads.c?
by Maciej Uhlig 22 Jan '14

22 Jan '14

Excuse me for the most probably stupid question: what is version 8014870 of threads.c and where can it be downloaded from? I'm running freeradius 2.2.1 and get many / Error: WARNING: Unresponsive child for request *, in component <core> module <thread> / log entries. I've found Alan's mail http://lists.cistron.nl/pipermail/freeradius-devel/2013-September/008702.ht… and I could try his advice if I only knew where is the mentioned file. Or maybe 2.2.3 is the way to go? Please advice. Best regards, MU

7 9

undefined reference to 'pthread_'
by Marco Marino 21 Jan '14

21 Jan '14

Hi, I'm trying to compile freeradius 2.2.3 on ubuntu 13.10 (64 bit) with ./configure make but i have: gcc -o .libs/rlm_dbm_parser .libs/rlm_dbm_parser.o /home/ntt/freeradius-server-2.2.3/src/lib/.libs/libfreeradius-radius.so -lgdbm_compat -lssl -lcrypto -lnsl -lresolv -lpthread /home/ntt/freeradius-server-2.2.3/src/lib/.libs/libfreeradius-radius.so: undefined reference to `pthread_getspecific' /home/ntt/freeradius-server-2.2.3/src/lib/.libs/libfreeradius-radius.so: undefined reference to `pthread_key_create' /home/ntt/freeradius-server-2.2.3/src/lib/.libs/libfreeradius-radius.so: undefined reference to `pthread_once' /home/ntt/freeradius-server-2.2.3/src/lib/.libs/libfreeradius-radius.so: undefined reference to `pthread_setspecific' I'm using apt-get build-dep freeradius, so i think there are all deps. Why this happens? Thanks

3 9

The 'reset' parameter problem
by SORROW 21 Jan '14

21 Jan '14

hello friends .. i have some problem with reset parameter .. i use this setting for data limit and traffic limitation .. If reset parameter is one of this value : " weekly, monthly ,never " counter work fine and user disconnect in exact usage of limitatin ... but like in this setting reset = daily or hourly user not disconnect in exact usage !!! how can in solve this problem ? sqlcounter monthlytrafficcounter { counter-name = Monthly-Traffic check-name = Max-Monthly-Traffic reply-name = Mikrotik-Xmit-Limit sqlmod-inst = sql key = User-Name reset = daily query = "SELECT SUM(acctinputoctets + acctoutputoctets) FROM radacct WHERE UserName='%{%k}' AND UNIX_TIMESTAMP(AcctStartTime) > '%b'" } ==== regards

2 1

Attribute MS-CHAP-Error
by nicolas.clo＠ricoh-industrie.fr 21 Jan '14

21 Jan '14

Hi all, Before Freeradius 3, I could sucessfully log the attribute Module-Failure-Message to catch many errors of ntlm_auth. In Freeradius 3 , if a user must change his password, the Module-Failure-Message return nothing (it doesn't yet exist ) Maybe it's with the new support of Change password in module mschap ??! My question is, how I can catch this error ? I try with the attribute MS-CHAP-Error but it the same result In log below, attribute doesn't yet exist when I try to catch him (16) log_mschap_error log_mschap_error { (16) ? if (MS-CHAP-Error =~ /.*Password expired.*/i) (16) ERROR: Failed retrieving values required to evaluate condition (16) } # log_mschap_error log_mschap_error = updated (16) } # Post-Auth-Type REJECT = updated } # server inner-tunnel (16) eap_peap : Got tunneled reply code 3 MS-CHAP-Error = '\tE=648 R=0 C=6833f9aa49b2f6bcc7dd53241f906cc7 V=3 M=Password Expired' EAP-Message = 0x04090004 Message-Authenticator = 0x00000000000000000000000000000000 (16) eap_peap : Got tunneled reply RADIUS code 3 MS-CHAP-Error = '\tE=648 R=0 C=6833f9aa49b2f6bcc7dd53241f906cc7 V=3 M=Password Expired' EAP-Message = 0x04090004 Message-Authenticator = 0x00000000000000000000000000000000 Thanks.

3 2

RadPerf testing tool not avaliable
by Álex Llorens Piqueras 21 Jan '14

21 Jan '14

Good morning everyone, Is there any possibility to get RadPerf program so we can test it against our new freeradius server? I've looked in the official page, but the current form to get this tool its not working. It would be really good if we can get access to it, so we won't need to create a new one from scratch using radclient. And another question, for the ones that have used it. Is the tool compatible with the new 3.x branch or only with the 2.x.x and below? Thanks for your time, Alex

2 1