July 2014 - Freeradius-Users - lists.freeradius.org

FreeRadius/NetMotion issue
by Levavi, Yariv 14 Jul '14

14 Jul '14

Hello, There's this environment of NetMotion which its authentication is through FreeRadius. I've made it work with EAP authentication and verify the configuration works. Then, I was asked to change the authentication to EAP-GTC (second authentication - Challenge/Response). I've made the necessary changes to eap.conf file (attached) but it seems that even though the FreeRadius is waiting for client's response, I don't get any login window in the client machine (only first login). I just wonder whether it is FreeRadius configuration or NetMotion's? Can you tell what is wrong? Regards, Yariv Levavi SafeNet's Integration Team The information contained in this electronic mail transmission may be privileged and confidential, and therefore, protected from disclosure. If you have received this communication in error, please notify us immediately by replying to this message and deleting it from your computer without copying or disclosing it.

2 1

24 hours after login not working
by Goke M Aruna 13 Jul '14

13 Jul '14

Thanks all, I am currently running FreeRADIUS Version 2.1.12, mysql version 5.1.73 I have set up counter.conf based on guide from http://lists.freeradius.org/pipermail/freeradius-users/2005-October/003506.… however, I noticed the counter just keep counting without terminating the user. my radgroupcheck is as follows: mysql> select * from radgroupcheck; +----+-----------+------------------+----+-------+ | id | groupname | attribute | op | value | +----+-----------+------------------+----+-------+ | 1 | validity | Max-Secs-Passed | := | 300 | | 2 | validity | Idle-Timeout | += | 300 | | 3 | validity | Simultaneous-Use | := | 1 | +----+-----------+------------------+----+-------+ 3 rows in set (0.00 sec) my counter.conf has the following: sqlcounter validity { counter-name = All-Secs-Passed check-name = Max-Secs-Passed sqlmod-inst = sql key = User-Name reset = daily query = "SELECT UNIX_TIMESTAMP(now()) - UNIX_TIMESTAMP(AcctStartTime) secs_passed_since_start FROM radacct WHERE UserName = '%{%k}' LIMIT 1" } an attribute called validity and I set Max-Secs-Passed to 300. however, I discover the query is not returning values in secs and I will like the user to spend only an hour a day and reset the counter the following day to zero for another 1 hour everday. Can someone assists?

1 0

Connection pool reuse v3.0.x
by Arran Cudbard-Bell 12 Jul '14

12 Jul '14

A few people have requested this be added since v3.0.0 was released. Occasionally for some complex modules like rlm_ldap, it's useful to run different sets of queries against the same server. People usually achieved this by using multiple instances of the same module (though I've also seen some quite creative uses of xlat). When multiple instances of the same module were used, a new set of connections were opened for the module. Where many instances of the same module were used the number of open connections could get very large. The connection pool reuse feature allows multiple instances of the same module to share a single connection pool. Example: ldap baz { pool = ldap } ldap { pool { <pool parameters> } } ldap foo { pool = ldap } ldap bar { pool = foo } The server will automatically fix the loading order of modules, so in this case even though baz is listed first, ldap will get instantiated first. The server will also detect cycles, i.e. ldap foo { pool = bar } ldap bar { pool = foo } and error out. If you specify server settings in module instances which use another module's connection pool they will be ignored. Log messages involving the shared connection pool will have prefixes consistent with the module that 'owns' the connection pool, not the modules that use it. You cannot use connection pools from modules of a different type, doing so will produce an error. I've worked through the obvious test cases for this feature, but if anyone else wants to try it out, that would be much appreciated. -Arran Arran Cudbard-Bell <a.cudbardb(a)freeradius.org> FreeRADIUS Core Developer FD31 3077 42EC 7FCD 32FE 5EE2 56CF 27F9 30A8 CAA2

1 0

error log radius.log
by Arnaud . 11 Jul '14

11 Jul '14

Hello, Looking at the file radius.log I still have the same error comes up: Error: rlm_radutmp: Logout for NAS localhost 5 port, but no Login record Error: rlm_radutmp: Logout for NAS localhost port 3, but no Login record Error: rlm_radutmp: Logout for NAS localhost Port 4, but no Login record .... Can you tell me what it is and what should be done to avoid this error? Best regards.

3 5

Error 1: gmake Free Radius 3.0.3 at Solaris
by Rafael de Farias Meurer 11 Jul '14

11 Jul '14

I'm trying to install free radius 3.0.3 at Solaris, after I use gmake command I got this error, I tried to use make and didn't work either: CC src/lib/cbuff.c In file included from /home/nms/radiusTeste/freeradius-server-3.0.3/src/freeradius-devel/libradius.h:65, from src/lib/cbuff.c:26: /home/nms/radiusTeste/freeradius-server-3.0.3/src/freeradius-devel/missing.h:419:1: warning: "htonll" redefined In file included from /usr/include/netinet/in.h:73, from /usr/include/netdb.h:74, from /home/nms/radiusTeste/freeradius-server-3.0.3/src/freeradius-devel/missing.h:40, from /home/nms/radiusTeste/freeradius-server-3.0.3/src/freeradius-devel/libradius.h:65, from src/lib/cbuff.c:26: /usr/include/sys/byteorder.h:46:1: warning: this is the location of the previous definition In file included from src/lib/cbuff.c:26: /home/nms/radiusTeste/freeradius-server-3.0.3/src/freeradius-devel/libradius.h:637: error: syntax error before "func" gmake: *** [build/objs/src/lib/cbuff.lo] Error 1 What can I do to solve this error? Thanks

7 31

Assigning users into different VLANs
by Martin Hrabovský 11 Jul '14

11 Jul '14

Hi, I am using FreeRADIUS together with WLC from Cisco. I have 1 WLAN connected to 2 VLANs and I need to assign user into VLAN based on successful pass AAA or not. By that I mean to separate guests and members. How can I achieve that? For now I am using "users" as source of members. I came up wtih this "admin" Cleartext-Password := "admin" Tunnel-Type = VLAN, Tunnel-Medium-Type = IEEE-802, Tunnel-Private-Group-Id = 52, Tunnel-Preference = 0x000000 to assign member into VLAN 52 but I strugle with assigning VLAN for user without certificate or password (I need two variants based on certificate and PEAP, two different servers). Thank you for any advice. -- Martin

3 14

Two or more Address Lists
by Anderson Scouto da Silva 10 Jul '14

10 Jul '14

You return only one and not all lists, this worked once. Thank you.

5 7

Client Library
by Scott Neugroschl 10 Jul '14

10 Jul '14

I'm currently using the FreeRADIUS client library, version 1.1.6. I have a requirement for IPv6. Has the client library been updated? Or should I be asking this on the dev list? --- Scott Neugroschl

2 4

Musing and digressing around sqlite
by Axel Luttgens 10 Jul '14

10 Jul '14

Hello, I'm testing FR with the slite backend, with the configs provided by: raddb/mods-config/sql/main/sqlite/schema.sql raddb/mods-config/sql/main/sqlite/queries.conf And I have some questions. So, if I may ask... 1. Almost all tables have an id column, conveniently named "id" and defined as: id int(11) PRIMARY KEY Is there any reason for not having defined those columns as id INTEGER PRIMARY KEY AUTOINCREMENT instead? 2. Incidentally, table "radusergroup" doesn't have such a column. An omission? Or could it prove problematic to define such a column? 3. The post-auth query is defined as: query = "\ INSERT INTO ${..postauth_table} \ (username, pass, reply, authdate) \ VALUES ( \ '%{SQL-User-Name}', \ '%{%{User-Password}:-%{Chap-Password}}', \ '%{reply:Packet-Type}', \ %{%{integer:Event-Timestamp}:-date('now')})" and the log shows it expands as: INSERT INTO radpostauth (username, pass, reply, authdate) VALUES ( 'bob', 'hello', 'Access-Accept', ) As a result, no row is inserted into table "radpostauth", since its column "authdate" is defined to be NOT NULL. How is the expression %{%{integer:Event-Timestamp}:-date('now')} supposed to be interpreted? More specifically, why the enclosing %{...}? 4. Replacing above expression by '%S' works beautifully. I mean, the expansion for the query yields a timestamp such as "'2014-07-08 18:09:54'", and a row is now happily inserted into table "radpostauth". :-) What is the rationale for having devised a query based on Event-Timestamp at first hand? 5. BTW, file http://networkradius.com/doc/FreeRADIUS-Implementation-Ch16.pdf describes %S as returning a timestamp with format "YYYY-mmm-ddd HH:MM:SS". Wouldn't something like "YYYY-MM-DD HH:MM:SS" be more accurate? 6. I've left the default setting radius_db = "radius" in raddb/mods-available/sql, even if my db file is named "radiusdb". Everything seems to be working fine. What is the role of variable "radius_db" in an sqlite context? 7. Going back to question 3, this raises the usual question about sqlite in such cases. Would there be a way to get an explicit error message written to syslog? Many thanks in advance, Axel

3 7

Question about cui.post-auth in FR 3
by Stefan Paetow 09 Jul '14

09 Jul '14

Hi, I've just spotted something that I'm not entirely sure is right: I get a reply from another host and it feeds back into my post-auth section. I happen to have the 'cui' module set in it. The existing 'cui' policy will strip the User-Name property regardless of whether the conditions for the CUI were met or not, is that correct? Shouldn't it strip the User-Name only if a CUI was generated? I'm just wondering... Stefan Paetow Moonshot Industry & Research Liaison Coordinator t: +44 (0)1235 822 125 Janet, the UK's research and education network. Janet(UK) is a trading name of Jisc Collections and Janet Limited, a not-for-profit company which is registered in England under No. 2881024 and whose Registered Office is at Lumen House, Library Avenue, Harwell Oxford, Didcot, Oxfordshire. OX11 0SG. VAT No. 614944238

4 11