May 2014 - Freeradius-Users - lists.freeradius.org

dhcp and rlm_python am i missing something?
by Serge Krawczenko 08 May '14

08 May '14

all i need is just to invoke my python script from dhcp section to perform my actions and return some values. if i got it right, there are handlers in python module, for corresponding sections in radiusd.conf for example, i have instantiate section in radiusd.conf and def instantiate(_params) function in my script and it is being invoked successfully there's python module config as well, where we define module and appropriate function for each event, such as mod_instantiate = "test_freeradius" func_instantiate = "instantiate" next, i've not found any mention of 'dhcp' section in rlm_python sources and even added it. and added module and func_dhcp='dhcp' in the module config nothing happened indeed now, the question. how do i call my python function from dhcp {whatever} section? python script is being called but there's no entry point, like 'python returns noop' therefore i can't return any values into radius instance. weird feeling i'm doing it first in the universe, please any help appreciated, spent over a week on this issue. thanks. ps i dont need any auth, acct, detail, post-auth logic. all i need is to call my python scipt from dhcp section and return values.

5 14

FreeRADIUS v3.0.2 Fedora packages available
by Nikolai Kondrashov 08 May '14

08 May '14

Hi everyone, Fedora packages of FreeRADIUS release v3.0.2 are finally available [1]. Users of Fedora 20 are welcome to test and leave karma feedback [2]. I apologize for the (huge) delay. It was due to a series of colds I had. Nick P.S. Fedora 19 packages of release v2.2.5 are coming soon. [1] https://admin.fedoraproject.org/updates/FEDORA-2014-6089/freeradius-3.0.2-1… [2] http://fedoraproject.org/wiki/How_to_test_updates

1 0

Freeradius-dialupadmin and LXC: "PHP Notice: Undefined variable:" or "PHP Fatal error: Call to undefined function"
by Osvaldo T Crispim Filho 07 May '14

07 May '14

My environment: - Ubuntu 14.04 amd64 (all: host and containers) - Packages created with script from freeradius 2.2.5 (freeradius, freeradius-postgresql, freeradius-dialupadmin,etc) - Freeradius on LXC Container - Freeradius-Dialupadmin on another LXC container with apache2 - ip on server host: 192.168.10.4 and 10.0.3.1 (for lxc nated network) - ip on guest freeradius: 10.0.3.14 - ip on guest freeradius-dialupadmin/apache2: 10.0.3.15 - ip of my pc: 192.168.10.19 - Server host with UFW/Iptables with active firewall and port forward ================ ============== The problem is with freeradius-dialupadmin: with lines in /etc/freeradius-dialupadmin/config.php: $curVer=intval(str_replace(".", "",phpversion())); if( $curVer >= $testVer ) import_request_variables('GPC'); I have: [Wed May 07 13:40:19.294851 2014] [:error] [pid 2272] [client 192.168.10.19:59084] PHP Fatal error: Call to undefined function import_request_variables() in /etc/freeradius-dialupadmin/config.php on line 9, referer: http://192.168.10.4/fradmin/buttons.php If i comment this lines i have: [Wed May 07 13:26:14.272903 2014] [:error] [pid 2271] [client 192.168.10.19:58985] PHP Notice: Undefined variable: clear_fields in /usr/share/freeradius-dialupadmin/htdocs/nas_admin.php on line 269, referer: http://192.168.10.4/fradmin/buttons.php [Wed May 07 13:26:14.272910 2014] [:error] [pid 2271] [client 192.168.10.19:58985] PHP Notice: Undefined variable: do_it in /usr/share/freeradius-dialupadmin/htdocs/nas_admin.php on line 269, referer: http://192.168.10.4/fradmin/buttons.php [Wed May 07 13:26:14.272916 2014] [:error] [pid 2271] [client 192.168.10.19:58985] PHP Notice: Undefined variable: select_nas in /usr/share/freeradius-dialupadmin/htdocs/nas_admin.php on line 269, referer: http://192.168.10.4/fradmin/buttons.php [Wed May 07 13:26:14.272923 2014] [:error] [pid 2271] [client 192.168.10.19:58985] PHP Notice: Undefined variable: clear_fields in /usr/share/freeradius-dialupadmin/htdocs/nas_admin.php on line 271, referer: http://192.168.10.4/fradmin/buttons.php Thanks for your help. -- - Osvaldo T Crispim Filho -

2 2

Concatenation of authentication
by Jérôme MATER 07 May '14

07 May '14

Hello everyone, I'm explaining to you my case. I use FreeRadius like a Proxy Radius. On the other side, I have a Windows Radius server, a TMS server and a SQL server. I've made a configuration to use TMS server for authentication with token --> OK I've made a configuration to use SQL database for authentication --> OK My problem is : When a user loses his token, I want he cans authenticate himself with the SQL database. I have made both configurations and it works separately. However, the goal is : 1) I want to authenticate users with Windows Radius server and authentication with token 2) If authentication 1 failed, then user tries to connect on the SQL database automatically. I've tried with post-auth section, post-proxy section... Is it possible ? How can I do that. Thanks for your help. Regard, Jérôme

4 4

Re: Freeradius.net Authentication wrong
by Serdar Metin 07 May '14

07 May '14

also why are my mails so weird, i have 'enter'ed someplaces. the format is very different when i read them on the "list".

3 2

Setting ntlm_auth parameters depending on NAS-IP-Address
by Antoine Benkemoun 07 May '14

07 May '14

Hello, We currently have a Freeradius server version 2.1.12 used to authenticate our Wifi users against our Active Directory server. The link between Freeradius and the Active Directory is done by Winbind. In order for the user to be able to obtain authorization, it needs to be belong to a group in the Active Directory. This is done by adding an argument to the ntlm_auth command and it works great so far. We are now adding 802.1X to our cabled networks and would like to re-use the existing Radius server to authenticate against the same Active Directory. Everything will be the same except the authorization will need to be based on whether the user belongs to a different one than that of the Wifi networks. I have browsed the Freeradius documentation as much as possible and have seen that it is possible to use conditionnals and variables. My plan therefore was to put a variable in the ntlm_auth command that would contain the group SID (as suggested on this mailing-list : http://freeradius.1045715.n5.nabble.com/Different-Auth-Methods-based-on-cli…) The group SID would be dependent on the IP of the network device which should be contained in "NAS-IP-Address". This should just be a case of writing a simple conditionnal statement and setting a variable. Nonetheless, I have not been able to do this as Freeradius will not start every time I try to add a conditional to the configuration files. I have tried doing it in the "default" site and a few other places. How would I go about doing this ? Where would I put the conditional and how would I write it ? Thank you in advance for your help, Antoine

4 7

Freeradius.net Authentication wrong
by Serdar Metin 07 May '14

07 May '14

hi, i followed a couple of tutorials on the web for setting up the freeradius server on windows(7). i can connect with the AP, and i see that the RADIUS is acces-REJECT every attempt i made. i configured a couple of clients but no luck. The output of the debug mode has been attached in this mail. If you could just point me where to look, would be very appriciated! i just want to make some users with username and pasword like bob/bob mike/mike, for logging in the radius server. but somehow i fails to authenticate i think. THX! -------------------- Going to the next requestWaking up in 6 seconds...rad_recv: Access-Request packet from host 192.168.2.245:2052, id=4, length=177 User-Name = "bob" NAS-IP-Address = 192.168.2.245 NAS-Port = 0 Called-Station-Id = "C4-64-13-0C-2D-3F:ciscosboeler" Calling-Station-Id = "00-1F-3B-B2-F5-09" Framed-MTU = 1400 NAS-Port-Type = Wireless-802.11 Connect-Info = "CONNECT 0Mbps 802.11" EAP-Message = 0x0205001119800000000715030100020230 State = 0x548893238d27ece11880dca12aeac968 Message-Authenticator = 0x28f1188edd091a3de53af1afb35fca26 Processing the authorize section of radiusd.confmodcall: entering group authorize for request 4 modcall[authorize]: module "preprocess" returns ok for request 4radius_xlat: '../var/log/radius/radacct/192.168.2.245/auth-detail-20140507.log' rlm_detail: ../var/log/radius/radacct/%{Client-IP-Address}/auth-detail-%Y%m%d.log expands to ../var/log/radius/radacct/192.168.2.245/auth-detail-20140507.log modcall[authorize]: module "auth_log" returns ok for request 4 modcall[authorize]: module "chap" returns noop for request 4 modcall[authorize]: module "mschap" returns noop for request 4 rlm_realm: No '@' in User-Name = "bob", looking up realm NULL rlm_realm: No such realm "NULL" modcall[authorize]: module "suffix" returns noop for request 4 rlm_eap: EAP packet type response id 5 length 17 rlm_eap: No EAP Start, assuming it's an on-going EAP conversation modcall[authorize]: module "eap" returns updated for request 4 users: Matched entry bob at line 85 modcall[authorize]: module "files" returns ok for request 4rlm_pap: Found existing Auth-Type, not changing it. modcall[authorize]: module "pap" returns noop for request 4modcall: leaving group authorize (returns updated) for request 4 rad_check_password: Found Auth-Type EAPauth: type "EAP" Processing the authenticate section of radiusd.confmodcall: entering group authenticate for request 4 rlm_eap: Request found, released from the list rlm_eap: EAP/peap rlm_eap: processing type peap rlm_eap_peap: Authenticate rlm_eap_tls: processing TLSrlm_eap_tls: Length Included eaptls_verify returned 11 rlm_eap_tls: <<< TLS 1.0 Alert [length 0002], fatal unknown_caTLS Alert read:fatal:unknown CA TLS_accept:failed in SSLv3 read client certificate Arlm_eap: SSL error error:14094418:SSL routines:SSL3_READ_BYTES:tlsv1 alert unknown carlm_eap_tls: SSL_read failed inside of TLS (-1), TLS session fails. eaptls_process returned 13 rlm_eap_peap: EAPTLS_HANDLED rlm_eap: Freeing handler modcall[authenticate]: module "eap" returns reject for request 4modcall: leaving group authenticate (returns reject) for request 4auth: Failed to validate the user.Login incorrect: [bob/<no User-Password attribute>] (from client testing123 port 0 cli 00-1F-3B-B2-F5-09)Delaying request 4 for 1 secondsFinished request 4Going to the next requestWaking up in 6 seconds...rad_recv: Access-Request packet from host 192.168.2.245:2052, id=4, length=177Sending Access-Reject of id 4 to 192.168.2.245 port 2052 EAP-Message = 0x04050004 Message-Authenticator = 0x00000000000000000000000000000000--- Walking the entire request list ---Waking up in 3 seconds...--- Walking the entire request list ---Cleaning up request 0 ID 0 with timestamp 536a397bCleaning up request 1 ID 1 with timestamp 536a397bCleaning up request 2 ID 2 with timestamp 536a397bCleaning up request 3 ID 3 with timestamp 536a397bCleaning up request 4 ID 4 with timestamp 536a397bNothing to do. Sleeping until we see a request.

2 1

Replicated Acctounting blocks replys
by Dalton Porter 07 May '14

07 May '14

Hi, I need a configuration that works as follows regarding accounting data: NAS sends Accounting Request ->radius svr1 radius svr1 writes to acct db and sends Accounting Request -> radius svr2 radius svr1 sends Accounting Response back to NAS Using my current configuration, I have defined a home server for the NULL realm and in the accounting section of sites-enabled/default, I have added "replicate" This sort of works, but when the response comes from radius svr2, it is rejected by radius svr1, I believe because "replicate" is fire and forget. In any case, an Accounting Response is never sent back to the NAS so the NAS tries to start the process over. I don't require an ACK response from svr2 to svr1, but I do need a response from svr1 to the NAS. Is replicate the right way to go? Freeradius version=radiusd: FreeRADIUS Version 2.1.12, for host x86_64-redhat-linux-gnu sites-enabled/default (acct sections) ----- preacct { preprocess update control { Replicate-To-Realm := 'NULL' } acct_unique suffix files } accounting { sql replicate } proxy.conf -------------- home_server sv { type = acct ipaddr = 10.101.248.112 port = 1813 secret = testing123 require_message_authenticator = yes response_window = 20 zombie_period = 40 revive_interval = 120 status_check = status-server check_interval = 30 num_answers_to_alive = 3 max_outstanding = 65536 coa { irt = 2 mrt = 16 mrc = 5 mrd = 30 } } home_server_pool sv_pool { type = fail-over home_server = sv } realm LOCAL { } realm NULL { acct_pool = sandvine_pool }

3 5

grant access problem in postgresql db
by Priyadarshini Trivedi 06 May '14

06 May '14

Hi, I have installed free radius with postgresql db. And when i am trying to acess my server,getting ACCESS REQUEST but after that getting error of table "dhcpcheck" table not found. I think my radius doesnt have permission on db. Please guide me how to grant access on db to radius. I am using centos. Regards, Priyadarshini Trivedi

2 2

Re: FR 2.2.5 64 bit
by Sander Eerdekens 06 May '14

06 May '14

Try exporting this before configuring and compiling: export LD_LIBRARY_PATH=/usr/sfw/lib/64:$LD_LIBRARY_PATH Kind regards Sander Eerdekens -----Original Message----- Again compilation failed with the following error: ld: fatal: file .libs/debug.o: wrong ELF class: ELFCLASS64 ld: fatal: File processing errors. No output written to .libs/libfreeradius-radius--m64.so collect2: ld returned 1 exit status gmake[4]: *** [libfreeradius-radius.la] Error 1 * Note even with 3.0.2 same error. Thanks; Alwaad Alhaq

2 1