November 2014 - Freeradius-Users - lists.freeradius.org

Update 3.0.4 to 3.0.x syntax surprises / bugs?
by Stefan Winter 17 Nov '14

17 Nov '14

Hi, some things to note: 1) one of my client definitions has an opening parenthesis in its secret (no closing), which is not a problem for 3.0.4, but in current 3.0.x I get: /usr/local/freeradius/config/raddb/clients.conf[655]: Parse error after "sdfsre": unexpected token "(" Errors reading or parsing /usr/local/freeradius/config/raddb/radiusd.conf sdfsre are the characters of the secret preceding the ( . Should such a secret now be surrounded by quotes, or is that more like a bug? 2) When running, I see that SQL queries are getting executed correctly (I see the retrieved AVPs), but the section still bails out with Query Error (and the exact same config works fine in 3.0.4). Here's a sample: rlm_sql (sql-commonauth): Reserved connection (4) (35) sql-commonauth: EXPAND (SELECT id, username, attribute, value, op FROM %{control:RESTENA-SQL-Table} WHERE username='%{SQL-User-Name}') (35) sql-commonauth: --> (SELECT id, username, attribute, value, op FROM check_imap_ssha1 WHERE username='xxxcensoredxxx') rlm_sql (sql-commonauth): Executing query: '(SELECT id, username, attribute, value, op FROM check_imap_ssha1 WHERE username='xxxcensoredxxx')' (35) sql-commonauth: User found in radcheck table (35) sql-commonauth: Conditional check items matched, merging assignment check items (35) sql-commonauth: RESTENA-SSHA1-Password := 'XXXV4iX9qSO8BcMxDJ6P0FNINVALIDQ1MGo1ZmNuZXJoVzWXXX==' (35) sql-commonauth: ERROR: SQL query error rlm_sql (sql-commonauth): Released connection (4) (I changed username and retrieved hash in the mail) I couldn't continue testing 3.0.x with that situation, so I'm back to 3.0.4 for now. Greetings, Stefan Winter -- Stefan WINTER Ingenieur de Recherche Fondation RESTENA - Réseau Téléinformatique de l'Education Nationale et de la Recherche 6, rue Richard Coudenhove-Kalergi L-1359 Luxembourg Tel: +352 424409 1 Fax: +352 422473 PGP key updated to 4096 Bit RSA - I will encrypt all mails if the recipient's key is known to me http://pgp.mit.edu:11371/pks/lookup?op=get&search=0xC0DE6A358A39DC66

3 4

Freeradius v2 Style Auth Log for V3 How to
by Akash 17 Nov '14

17 Nov '14

I'm using Freeradius-3.0.4, and see lots of following messages in 'radius.log' file whenever user connects/disconnects. Info: rlm_sql (sql): Closing connection (18): Hit idle_timeout, was idle for 300 second Warning: rlm_sql (sql): You probably need to lower "min" Info: rlm_sql (sql): 0 of 2 connections in use. Need more spares Info: rlm_sql (sql): Opening additional connection (21) Is there way to disable such messages, and only output Login OK, Login Failure messages, same like in version 2. Thanks

2 1

3.0.5 segmentation fault
by Lai Fu Keung 17 Nov '14

17 Nov '14

Hi, I would like to report a segmentation fault in using v3.0.5. My server syslog has the following message: Nov 14 18:18:33 machine-a kernel: radiusd[7198]: segfault at 108 ip 00007f63a5a3c023 sp 00007f639e4a9c80 error 4 in libfreeradius-server.so[7f63a5a2e000+23000] The daemon has been running for 5 days before segmentation fault and was running fine. There was no error message on radius.log except a "login OK" message right at Nov 14 18:18:33 segmentation fault time. The authentication fell back to secondary server. Hope the information is enough to trace the source of the problem. Thanks in advance. Lai

2 1

Configuring ssl-admin to include windows OIDs in the server cert
by Jasvinder S. Bahra 17 Nov '14

17 Nov '14

Hi, I've used the ssl-admin tool to generate a certificate authority certificate, a server certificate and multiple client certificates - all used to setup a FreeRadius EAP-TLS WPA2 Enterprise secured wireless network. Android devices connect to the network without any problems, but windows devices connections requests never even get passed to the freeradius daemon. After looking around on the internet as well as asking some questions on this list, I understand I have to embed the XP Extensions OIDs into the server certificate (something I have to do when actually creating the server certificate). I've found information on how to do this using the openssl command, but as i'm using the ssl-admin tool to handle certificate creation, I need to make it do the same. Has anyone had any experience in doing this? Regards, Jazz

2 1

Freeradius Active Directory Authentication using ntlm_auth
by Shyju Kanaprath 16 Nov '14

16 Nov '14

Hi All, I'm trying to configure Freeradius Active Directory Authentication using ntlm_auth.When I run from the shell I could get the positive response. ntlm_auth --username shyju --passwordPassword:NT_STATUS_OK: Success (0x0) But when I test with the radtest authentication does not work. Please Find below the logs. Client - Sideradtest shyju password localhost 0 testing123 Sending Access-Request of id 125 to 127.0.0.1 port 1812 User-Name = "shyju" User-Password = "password" NAS-IP-Address = 127.0.1.1 NAS-Port = 0 Message-Authenticator = 0x00000000000000000000000000000000rad_recv: Access-Reject packet from host 127.0.0.1 port 1812, id=125, length=20 Server-Side rad_recv: Access-Request packet from host 127.0.0.1 port 60581, id=253, length=131 User-Name = "shyju" NAS-IP-Address = 127.0.1.1 NAS-Port = 0 Message-Authenticator = 0x0156cd3b06a063bf8c9dee41dca40c37 MS-CHAP-Challenge = 0x3b41e041947f5126 MS-CHAP-Response = 0x00010000000000000000000000000000000000000000000000003d43a50a42ac1c73b4beeab62bfba628013e7764d8651047# Executing section authorize from file /etc/freeradius/sites-enabled/default+- entering group authorize {...}++[preprocess] returns ok++[chap] returns noop[mschap] Found MS-CHAP attributes. Setting 'Auth-Type = mschap'++[mschap] returns ok++[digest] returns noop[suffix] No '@' in User-Name = "shyju", looking up realm NULL[suffix] No such realm "NULL"++[suffix] returns noop[eap] No EAP-Message, not doing EAP++[eap] returns noop++[files] returns noop++[expiration] returns noop++[logintime] returns noop[pap] WARNING! No "known good" password found for the user. Authentication may fail because of this.++[pap] returns noopFound Auth-Type = MSCHAP# Executing group from file /etc/freeradius/sites-enabled/default+- entering group MS-CHAP {...}[mschap] Told to do MS-CHAPv1 with NT-Password[mschap] expand: %{Stripped-User-Name} ->[mschap] ... expanding second conditional[mschap] expand: %{User-Name} -> shyju[mschap] expand: %{%{User-Name}:-None} -> shyju[mschap] expand: --username=%{%{Stripped-User-Name}:-%{%{User-Name}:-None}} -> --username=shyju[mschap] No NT-Domain was found in the User-Name.[mschap] expand: %{mschap:NT-Domain} ->[mschap] ... expanding second conditional[mschap] expand: --domain=%{%{mschap:NT-Domain}:-DOMAIN.LOCAL} -> --domain=DOMAIN.LOCAL[mschap] mschap1: 3b[mschap] expand: %{mschap:Challenge} -> 3b41e041947f5126[mschap] expand: --challenge=%{%{mschap:Challenge}:-00} -> --challenge=3b41e041947f5126[mschap] expand: %{mschap:NT-Response} -> 3d43a50a42ac1c73b4beeab62bfba628013e7764d8651047[mschap] expand: --nt-response=%{%{mschap:NT-Response}:-00} -> --nt-response=3d43a50a42ac1c73b4beeab62bfba628013e7764d8651047Exec-Program output: Reading winbind reply failed! (0xc0000001)Exec-Program-Wait: plaintext: Reading winbind reply failed! (0xc0000001)Exec-Program: returned: 1[mschap] External script failed.[mschap] MS-CHAP-Response is incorrect.++[mschap] returns rejectFailed to authenticate the user.Using Post-Auth-Type Reject# Executing group from file /etc/freeradius/sites-enabled/default+- entering group REJECT {...}[attr_filter.access_reject] expand: %{User-Name} -> shyjuattr_filter: Matched entry DEFAULT at line 11++[attr_filter.access_reject] returns updatedDelaying reject of request 2 for 1 secondsGoing to the next requestWaking up in 0.8 seconds.Sending delayed reject for request 2Sending Access-Reject of id 253 to 127.0.0.1 port 60581 MS-CHAP-Error = "\000E=691 R=1"Waking up in 4.9 seconds.Cleaning up request 2 ID 253 with timestamp +73Ready to process requests. _______ Regards, Shyju

4 7

Redundant expansions?
by Alan DeKok 15 Nov '14

15 Nov '14

So.. should redundant expansions go into 3.0.5? They would work like this: instantiate { ... redundant-load-balance my_sql { sql1 sql2 sql3 } } You can already use "my_sql" in the "authorize" section, which is nice. This feature would allow you to use "my_sql" in expansions: update reply { Filter-Id := "%{my_sql:SELECT ...}" } The server core will automatically find *one* of the listed modules (sql1, sql2, or sql3), and call it. This feature has long been requested,and it's finally in the "master" branch. The question is whether it should go into the 3.0.5 release. Since the connection pools now support a "retry_delay" parameter, the cost of querying a "down" SQL server is essentially zero. In v2, the server would usually try to reconnect to SQL for evcery request. In v3, the "retry_delay" makes the "redundant-load-balance" blocks more useful. SQL servers which are down are effectively remove from the redundant list, until "retry_delay" seconds have passed. These changes increase the performance of the server, and make problems much less notable. Alan DeKok.

2 2

Plans for the next few releases
by Alan DeKok 14 Nov '14

14 Nov '14

We're continuing to develop the server, so I'd like to clarify the policy around releases. Version 2.2.x: Long term stable release. No new features. Minor bug fixes. The goal is long-term stability. We will maintain it 2-3 years. Version 3.0.x: Version 3 stable release Minor new features Focus on bug fixes and stability Will maintain it for 4-5 years Version 3.1: unstable new development Major new features Major re-architecture of the server core Which version should you use? That depends on what you have now, and what you need: * basic RADIUS and running 1.x: UPGRADE NOW * basic RADIUS and running version 2: should use 2.2.x * need better "unlang", error checking, SNMP triggers, RadSec: 3.0.x * experimental new work: bleeding edge 3.1. Arran and I have started announcing new features to this list, as the features are implemented. We'll keep doing that for the 3.1 branch. And probably stop doing new features in 3.0. We've had issues with 3.0 stability (sorry). A good part of that was problems with talloc. The documentation says one thing, but the code does something else. So that made life difficult for a while. The work of the last few months has made 3.0.4 very stable. The bug fixes for 3.0.5 are minor, and ensure that all of the "corner cases" are handled correctly. Now that we have a stable version of 3.0, we can start re-working the "master" branch for 3.1. We have a long list of new features, many of which require re-architecture. We don't want to break 3.0, so those features require a new version. Alan DeKok.

2 3

Re: NAP with Freeradius
by Zulzig 14 Nov '14

14 Nov '14

accept my apologies Alan i didn't see your answer. you said: > You shouldn't do that. This should be a separate policy. i didn't understand your answer. I should create two policies. isn't it ? the first, in the goal to compare the last authentication and the last to update my radusergroup. thank a lot

2 1

Re: NAP with freeradius
by Zulzig 14 Nov '14

14 Nov '14

Hello Rui, in fact i would like to assign users in different vlan, with an automatic process. If the user's last session is superior à 5 days, mysql does the update of the radusergrouptable, it will change the user's groupname (A to B). At the resultat, freeradius will have to send to the nas a different radgroupreply (B parameters). I use a trigger for it. It works, but i found an issue. Freeradius send to the NAS the old values of the radgrouprely (A parameters). I will try to update ma version of freeradius and find some information about ulang. Thank a lot for your help

1 0

module return codes
by Travis Dimmig 14 Nov '14

14 Nov '14

I can't figure out how to get modules to return with the codes I want them too. I have (what I believe to be) a very simple policy for checking if a request looks like a MAC authentication request. I would like the policy module return to be able to indicate if the request looks like it's MAC authentication or not. I have a policy defined in policy.conf as follows: check.mac_authentication { if ( (Calling-Station-Id) && (User-Name) ) { if ( "%{User-Name}" =~ /^%{config:policy.mac-addr}$/i ) { update request { Tmp-String-0 := "%{tolower:%{1}%{2}%{3}%{4}%{5}%{6}}" } } if ( "%{Calling-Station-Id}" =~ /^%{config:policy.mac-addr}$/i ) { update request { Tmp-String-1 := "%{tolower:%{1}%{2}%{3}%{4}%{5}%{6}}" } } } if ( (Tmp-String-0) && (Tmp-String-1) && "%{Tmp-String-0}" == "%{Tmp-String-1}" ) { ok } else { noop } } The goal is to return "ok" if both attributes exist, look like mac addresses, and have the same value (after being normalized to lower-case and having delimiters removed). Otherwise, it should return "noop". What is happening instead: +++- entering policy check.mac_authentication {...} ++++? if ((Calling-Station-Id) && (User-Name) ) ?? Evaluating (Calling-Station-Id) -> TRUE ?? Evaluating (User-Name) -> TRUE ++++? if ((Calling-Station-Id) && (User-Name) ) -> TRUE ++++- entering if ((Calling-Station-Id) && (User-Name) ) {...} +++++? if ("%{User-Name}" =~ /^%{config:policy.mac-addr}$/i ) expand: %{User-Name} -> 11bbccddeeff expand: policy.mac-addr -> policy.mac-addr expand: ^%{config:policy.mac-addr}$ -> ^([0-9a-f]{2})[^0-9a-f]?([0-9a-f]{2})[^0-9a-f]?([0-9a-f]{2})[^0-9a-f]?([0-9a-f]{2})[^0-9a-f]?([0-9a-f]{2})[^0-9a-f]?([0-9a-f]{2})$ ? Evaluating ("%{User-Name}" =~ /^%{config:policy.mac-addr}$/i) -> TRUE +++++? if ("%{User-Name}" =~ /^%{config:policy.mac-addr}$/i ) -> TRUE +++++- entering if ("%{User-Name}" =~ /^%{config:policy.mac-addr}$/i ) {...} expand: %{1}%{2}%{3}%{4}%{5}%{6} -> 11bbccddeeff expand: %{tolower:%{1}%{2}%{3}%{4}%{5}%{6}} -> 11bbccddeeff ++++++[request] returns ok +++++- if ("%{User-Name}" =~ /^%{config:policy.mac-addr}$/i ) returns ok +++++? if ("%{Calling-Station-Id}" =~ /^%{config:policy.mac-addr}$/i ) expand: %{Calling-Station-Id} -> AA-BB-CC-DD-EE-FF expand: policy.mac-addr -> policy.mac-addr expand: ^%{config:policy.mac-addr}$ -> ^([0-9a-f]{2})[^0-9a-f]?([0-9a-f]{2})[^0-9a-f]?([0-9a-f]{2})[^0-9a-f]?([0-9a-f]{2})[^0-9a-f]?([0-9a-f]{2})[^0-9a-f]?([0-9a-f]{2})$ ? Evaluating ("%{Calling-Station-Id}" =~ /^%{config:policy.mac-addr}$/i) -> TRUE +++++? if ("%{Calling-Station-Id}" =~ /^%{config:policy.mac-addr}$/i ) -> TRUE +++++- entering if ("%{Calling-Station-Id}" =~ /^%{config:policy.mac-addr}$/i ) {...} expand: %{1}%{2}%{3}%{4}%{5}%{6} -> AABBCCDDEEFF expand: %{tolower:%{1}%{2}%{3}%{4}%{5}%{6}} -> aabbccddeeff ++++++[request] returns ok +++++- if ("%{Calling-Station-Id}" =~ /^%{config:policy.mac-addr}$/i ) returns ok ++++- if ((Calling-Station-Id) && (User-Name) ) returns ok ++++? if ((Tmp-String-0) && (Tmp-String-1) && "%{Tmp-String-0}" == "%{Tmp-String-1}" ) ?? Evaluating (Tmp-String-0) -> TRUE ?? Evaluating (Tmp-String-1) -> TRUE expand: %{Tmp-String-0} -> 11bbccddeeff expand: %{Tmp-String-1} -> aabbccddeeff ? Evaluating ("%{Tmp-String-0}" == "%{Tmp-String-1}" ) -> FALSE ++++? if ((Tmp-String-0) && (Tmp-String-1) && "%{Tmp-String-0}" == "%{Tmp-String-1}" ) -> FALSE ++++- entering else else {...} +++++[noop] returns noop ++++- else else returns noop +++- policy check.mac_authentication returns ok When execution enters the final "else" with the noop, why does the module still return "ok" ? Any help will be greatly appreciated.... -Travis

2 1