September 2014 - Freeradius-Users - lists.freeradius.org

policy.d question
by BALSIANOK, Peter 14 Sep '14

14 Sep '14

Do you plan to use the same directory organization for policy.d (as in the case of mods-* site-*) ? Something like: policy-available (I can backup some file and freeradius won`t parse it) policy-enabled Thx

4 3

EAP-TLS and client certs issued with different CA's
by Bruncko Michal 14 Sep '14

14 Sep '14

Hello list, I am successfully using Freeradius in our Wifi environment using EAP-TLS in single-CA environment - i.e same CA was used to sign both server and clients SSL certificates. Now I have started to use new certificate PKI with new CA hierarchy - RootCA -> SubCA -> Wifi certificates, but I wanted to keep existing legacy CA in place. This means: - that I wanted to use client certificates issued by two different CA's for EAP-TLS authentication - and as I mentioned before, the new CA is a subCA of new rootCA. - and server certificate is signed still using legacy CA I looked over older posts and it looks that this scenario is supported by freeradius and can be achieved in two ways: - using CA_file (within tls section in eap.conf) pointing to file bundling all CA related certificates (i.e. legacy CA, new SubCA and RootCA), or - using CA_path pointing to directory with separate CA *.pem files (and running "c_rehash" over that directory). both subCA and rootCA in single pem file (but I tried to separate it as well) The problem is, that everytime I wanted to authenticate with client using certificate signed by subCA, I always get: [campuswifi] Request found, released from the list [campuswifi] EAP/tls [campuswifi] processing type tls [tls] Authenticate [tls] processing EAP-TLS [tls] eaptls_verify returned 7 [tls] Done initial handshake [tls] <<< TLS 1.0 Handshake [length 03d6], Certificate --> verify error:num=20:unable to get local issuer certificate [tls] >>> TLS 1.0 Alert [length 0002], fatal unknown_ca TLS Alert write:fatal:unknown CA TLS_accept: error in SSLv3 read client certificate B rlm_eap: SSL error error:140890B2:SSL routines:SSL3_GET_CLIENT_CERTIFICATE:no certificate returned SSL: SSL_read failed in a system call (-1), TLS session fails. TLS receive handshake failed during operation [tls] eaptls_process returned 4 [campuswifi] Handler failed in EAP/tls [campuswifi] Failed in EAP select Questions: - what I am doing wrong? Miss I anything in order to get working EAP-TLS authentication over both legacy CA and new CA? recall: please note that new CA is not self signed, but signed by another rootCA authority (created also by me). thanks for any help -- Ing. Michal Bruncko, PhD., CCNP, RHCSA

2 3

how to store some data in freeradius users file into custom table?
by rafa alfurqan 13 Sep '14

13 Sep '14

Hi all, is it possible to store IMSI code (IMSI for eap-sim data in users file) from freeradius to a custom table that i made in phpmyadmin, if it's possible can someone show me if the examples of the implementation? what i want to achieve is that for freeradius to store IMSI data to asterisk's real time table or for asterisk to read from freeradius's table for sip.conf and extension.conf username in asterisk files. really need help. thank you

2 2

server type=detail and detail.work file
by Andrea Gabellini - SC 13 Sep '14

13 Sep '14

Hello, I'm starting to play with a virtual server of type = detail. I'm using FR 2.1.12 and the detail server writes to a MySQl DB. I have a stable configuration that just works! I noticed a strange behaviour. If I stop FR, the server leaves the detail.work file, and at the next start FR reloads this file and pushes duplicate records to the DB. Is it a normal behaviour or I'm doing something wrong? Thanks, Andrea

2 5

rlm_perl logging
by BALSIANOK, Peter 13 Sep '14

13 Sep '14

Hi, Is it possible to add request number (x) also for radius::radlog function (in rlm_perl module)? It would be very helpful (for debugging). Thx (0) perl : $RAD_CHECK{'Tmp-String-0'} = &control:Tmp-String-0 -> 'LNS1' (0) perl : $RAD_CONFIG{'Group-Name'} = &control:Group-Name -> 'MM1' (0) perl : $RAD_CONFIG{'Cleartext-Password'} = &control:Cleartext-Password -> 'dummy' (0) perl : $RAD_CONFIG{'Tmp-String-0'} = &control:Tmp-String-0 -> 'LNS1' (x) rlm_perl: ### Authorize start (x) rlm_perl: RAD_REQUEST: Called-Station-Id=1.5895:50.405#188653810#RSP_BA_NSLO 5/1/5#speed:UBR#pppoe 00:24:c4:35:54:15#/ User-Password=dummy Framed-Protocol=PPP Event-Timestamp=Sep 13 2014 12:24:08 CEST NAS-Port=776 NAS-Port-Id=Uniq-Sess-ID776 Huntgroup-Name=LNS User-Name=dummy NAS-IP-Address=213.151.232.208 Calling-Station-Id=atm 10 NAS-Port-Type=Virtual Service-Type=Framed-User Connect-Info=155520000 (x) rlm_perl: ### Authorize end (0) perl : &request:Called-Station-Id = $RAD_REQUEST{'Called-Station-Id'} -> '1.5895:50.405#188653810#RSP_BA_NSLO 5/1/5#speed:UBR#pppoe 00:24:c4:35:54:15#/' (0) perl : &request:User-Password = $RAD_REQUEST{'User-Password'} -> 'dummy' (0) perl : &request:Framed-Protocol = $RAD_REQUEST{'Framed-Protocol'} -> 'PPP'

1 0

Release of Version 3.0.4
by Alan DeKok 12 Sep '14

12 Sep '14

We've release version 3.0.4. It has a long changelong from 3.0.3: http://freeradius.org/version3.html But the wait has been worth it, I think. Lots of minor fixes, and many new features. The regex handling for strings has been fixed. This means that where it was hard / impossible to use regexes before, it's now simpler. The down-side is that you MAY have to update your regexes. Since the old ones didn't work in some situations, fixing them is preferable to leaving them broken. Alan DeKok.

7 19

Re: New repository - was Re: Release of Version 3.0.4 (Alan DeKok)
by Rui Ribeiro 12 Sep '14

12 Sep '14

Thanks, it is already working, and I have already installed it in my pre-production server for tests. Date: Thu, 11 Sep 2014 07:21:04 -0400 > From: Alan DeKok <aland(a)deployingradius.com> > To: FreeRadius users mailing list > <freeradius-users(a)lists.freeradius.org> > Subject: Re: New repository - was Re: Release of Version 3.0.4 > Message-ID: <541185A0.8020108(a)deployingradius.com> > Content-Type: text/plain; charset=UTF-8 > > Rui Ribeiro wrote: > > Err http://packages.networkradius.com wheezy/main amd64 Packages > > I've removed the redirect. The https site uses a self-signed key, so > that's why it doesn't work. > > Alan DeKok. > > > -- Rui Ribeiro Senior Sysadm ISCTE-IUL https://www.linkedin.com/pub/rui-ribeiro/16/ab8/434

1 1

Poll: Which OS for pre-built packages?
by Alan DeKok 12 Sep '14

12 Sep '14

We've release packages for Debian "Wheezy", Ubuntu "Trusty", and Centos 6.5. The question now is which *other* OS packages does the community need? Please respond with suggestions. If there is enough demand, we can supply packages for common systems. Alan DeKok.

8 8

[3.0.4] LDAP issues
by Hachmer, Tobias 12 Sep '14

12 Sep '14

Hello list, thanks for version 3.0.4. On our test system here I encountered the following issues regarding the ldap module: 1. rlm_ldap: Falling back to build time libldap version info. Query for LDAP_OPT_API_INFO returned: -1 rlm_ldap: libldap vendor: OpenLDAP version: 20423 Is this an error/warning/info? Should I act on this? 2. lots of: (0) ERROR: ldap : Failed tokenising attribute string: Expecting operator (0) WARNING: ldap : Failed parsing 'radiusAttribute' value "reply:Xylan-Access-Priv += Xylan-Read-Priv" as valuepair, skipping... What have changed regarding generic radiusAttribute in ldap? Thanks in advance, Tobias Hachmer

3 4

New repository - was Re: Release of Version 3.0.4
by Rui Ribeiro 11 Sep '14

11 Sep '14

Good morning Alan, This is excellent news! I would like to point out it is apparently giving an error in Debian, when running apt-get update: Get:12 http://ftp.us.debian.org wheezy/contrib amd64 Packages [42.0 kB] Get:13 http://ftp.us.debian.org wheezy/non-free amd64 Packages [80.8 kB] Err http://packages.networkradius.com wheezy/main amd64 Packages 500 Bad redirection (invalid URL) Ign http://packages.networkradius.com wheezy/main Translation-en_US Get:14 http://ftp.us.debian.org wheezy/contrib Translation-en [34.8 kB] Ign http://packages.networkradius.com wheezy/main Translation-en Get:15 http://ftp.us.debian.org wheezy/main Translation-en [3,847 kB] Get:16 http://ftp.us.debian.org wheezy/non-free Translation-en [66.1 kB] Fetched 10.5 MB in 4s (2,476 kB/s) W: Failed to fetch http://packages.networkradius.com/debian/dists/wheezy/main/binary-amd64/Pac… 500 Bad redirection (invalid URL) E: Some index files failed to download. They have been ignored, or old ones used instead. Regards, Rui Ribeiro > Message: 6 > Date: Wed, 10 Sep 2014 16:56:06 -0400 > From: Alan DeKok <aland(a)deployingradius.com> > To: FreeRadius users mailing list > <freeradius-users(a)lists.freeradius.org> > Subject: Re: Release of Version 3.0.4 > Message-ID: <5410BAE6.8030609(a)deployingradius.com> > Content-Type: text/plain; charset=ISO-8859-1 > > We encourage people to use the latest release, even when OS vendors > don't upgrade their packages. > > To help people use the latest release, we now offer "official" > pre-built packages. They currently are for a limited range of systems. > > If there is demand for more packages, please ask. We'll see what we > can do. > > The packages are available here: > > https://packages.networkradius.com/ > > Alan DeKok. > > >

4 3