April 2014 - Freeradius-Users - lists.freeradius.org

New features in v3.0.3
by Alan DeKok 16 Apr '14

16 Apr '14

As part of our code cleanups and reorganizations, we've added some new features to version 3.0.3. Previously, array references could only be used in string expansions. e.g. "%{Cisco-AVPair[2]}". This limitation is problematic, so we've fixed it. You can now use array references in "unlang", in every place attribute references were allowed before. In some situations, this doesn't make much difference. In others, it makes a lot of difference. e.g. switch &Cisco-AVPair[2] {...} And even better (as an artificial example): update reply { Filter-Id[1] := &request:Cisco-AVPair[2] } In previous versions, it was impossible to update the second attribute of the same name. You could either update the first one, or delete all of them, and re-create them. It's now possible to "reach into" a list, and re-write individual attributes. Other new features include more sanity checks on inputs, so that more errors in the configuration files are caught. This means that dynamic expansions are pre-parsed, as are regular expressions. Please respond if there are issues, questions, concerns, etc. Alan DeKok.

3 4

Re: Question on pam_radius_auth module getting INCORRECT
by David Li 15 Apr '14

15 Apr '14

Hi Alan, I took out all the pam modules from my auth stack in /etc/pam/sshd except for pam_radius_auth. The problem didn't go away. I am not using SElinux either. One interesting thing I noticed is that first login attempt always fails due to this problem. But the second attempt after restarting the ssh session then it succeeds. This makes me wonder if somehow the password was stored on the first try and correctly retrieved on the second try. But I have no clue what happened. David > ------------------------------ > > Message: 2 > Date: Mon, 14 Apr 2014 20:53:52 -0400 > From: Alan DeKok <aland(a)deployingradius.com> > To: FreeRadius users mailing list > <freeradius-users(a)lists.freeradius.org> > Subject: Re: Question on pam_radius_auth module getting INCORRECT > password > Message-ID: <534C8320.8010907(a)deployingradius.com> > Content-Type: text/plain; charset=UTF-8 > > David Li wrote: > > I am new to this. Please let me know if there is a better list to post > > this question. > > It's an OK list. > > > I have been trying to track down a wired problem. When a user is logging > > via ssh, the pam_radius_auth module would try to retrieve the password > > and send it to the radius server. But the password returned by the > > rad_converse() function is INCORRECT. > > > > I have done some searching and found suggestions that there might be > > something wrong with "other" module that is doing the password checking. > > > > My real question is how I can find out which module is the culprit. > > It should be simple. Look at the pam ssh file, and see which modules > it's using. Then, delete them one by one until it works. > > But largely this is a PAM issue. I know very little about PAM, even > after spending time reading the docs and programming it. > > Alan DeKok. > > > ------------------------------ > >

2 1

TACACS+ question
by Alan DeKok 15 Apr '14

15 Apr '14

Is anyone interested in TACACS+ support in FreeRADIUS? We're looking at development priorities for the next year. We'd like to know whether or not TACACS+ is of interest. i.e. Are you using it now? If so, would you consider switching to FreeRADIUS for TACACS+? Alan DeKok.

15 15

Default Authorization Level
by Michael Harvey 15 Apr '14

15 Apr '14

I am trying to use freeradius to handle login's into my Adtran gear such as the MX 2820. I can get Authentication to work but I am trying to set up Authorization for the gear. For Default Authorization Level my choices are NONE READ READ/WRITE TEST ADMIN Right now I have it set to Admin but I want to be able to set some users to READ and some to READ/WRITE. As is typical with Adtran their documentation on this is lacking. If anyone has had any experience on this please point me in the right direction.

1 0

Freeradius proxy support
by Ilavajuthy Palanisamy 15 Apr '14

15 Apr '14

Hi, I'm new to Freeradius. I would like to get some pointers and documentation details about setting up Freeradius as proxy. Our requirement is to have a Radius proxy and modify the Access Accept response based on certain criteria. Few questions regarding Freeradius proxy support. Does Freeradius proxy has support for a plugin probably in Java to snoop the Radius request calls? Does Freeradius proxy setup has option to specify which Radius server to pickup based on some attribute value in Access Request? Our requirement is to have multiple Radius Servers for certain groups. This group information will be available in one of the VSA in Access Request. Any help will be really helpful. Thanks, Ila.

4 8

User-Name in the Accounting log is being stripped
by Clement Ogedengbe 15 Apr '14

15 Apr '14

Hello, I am proxying non-local requests to an offshore server for authentication. Authentication process is successful but the reply log shows that User-Name is being stripped for some offshore users. I configured my detail reply_log file with the following: header = "%{Packet-Src-IP-Address} Returned from %{home_server:ipaddr} for User %{User-Name} - %t" The reply log captured shows the records below: The User-Name in the header for the reply_log shows the complete user-name whereas the user-name in the reply log record is being stripped for some reasons. As a result of this, the accounting log is showing the "stripped" user-name instead of the complete user name. Extract of reply log below: 10.255.252.248 Returned from roaming0.ja.net for User user(a)domain.com - Tue Apr 15 10:49:59 2014 Packet-Type = Access-Accept Tunnel-Private-Group-Id:0 = "222" User-Name = user@domain.<mailto:user@domain.> Extract of accounting log below: 10.255.252.248 - Tue Apr 15 10:50:36 2014 User-Name = "user@domain." NAS-Port = 13 NAS-IP-Address = 10.255.252.248 Framed-IP-Address = 172.21.30.255 NAS-Identifier = "XXX_WLC5" Airespace-Wlan-Id = 4 Acct-Session-Id = "534d00ec/ac:22:0b:a2:a2:b8/6564" NAS-Port-Type = Wireless-802.11 Cisco-AVPair = "audit-session-id=0afffcf800002060534d0098" Acct-Authentic = RADIUS Tunnel-Type:0 = VLAN Tunnel-Medium-Type:0 = IEEE-802 Tunnel-Private-Group-Id:0 = "222" Event-Timestamp = "Apr 15 2014 10:50:36 BST" Acct-Status-Type = Start Calling-Station-Id = "172.21.30.255" Called-Station-Id = "10.255.252.248" Acct-Unique-Session-Id = "948506c37df9d95c" Timestamp = 1397555436 Clement

2 5

Re: FreeRADIUS auditory and performance
by Antonio Fernández Pérez 15 Apr '14

15 Apr '14

Thanks for your replies and your advices. I have choosen status virtual server to check some statistics and then, using a small PHP script, write it into database. After that (Even being not enough), I will make some operations to get statistics about the service and its use. Regards, Antonio.

1 0

Is LDAP + EAP Possible For Me?
by Ethan Chrisawn 15 Apr '14

15 Apr '14

I've been searching for a while now, and I can't seem to find a good answer. I have an ldap server and I would like to authenticate my users wirelessly without generating individual client certs for every device. I heard that PEAP doesn't require the manual creation of client certs, but I can't use that with ldap because I can't pass it a cleartext password, right? What other options do I have to accomplish what I'm after?

4 3

FreeRADIUS auditory and performance
by Antonio Fernández Pérez 15 Apr '14

15 Apr '14

Hi everybody, I would like to know how can I do this on my server: Check FreeRADIUS performance and authentication capacity. I have read about radperf but I can't download it from its web page. On the other hand, I would like to know how can I monitor FreeRADIUS with SNMP ( It's very interesting to know how many users are connected, how many requests has received the server ...). I hope your advices. Thanks in advance. Regards, Antonio.

3 2

Question on pam_radius_auth module getting INCORRECT password
by David Li 15 Apr '14

15 Apr '14

Hi, I am new to this. Please let me know if there is a better list to post this question. My system is running RHEL and using a separate FreeRadius server to authenticate ssh user logins. All regular user credentials are stored on the radius server. I have been trying to track down a wired problem. When a user is logging via ssh, the pam_radius_auth module would try to retrieve the password and send it to the radius server. But the password returned by the rad_converse() function is INCORRECT. I have done some searching and found suggestions that there might be something wrong with "other" module that is doing the password checking. My real question is how I can find out which module is the culprit. David

4 3