September 2014 - Freeradius-Users - lists.freeradius.org

RE: Maximum username length
by Franks Andy (RLZ) IT Systems Engineer 30 Sep '14

30 Sep '14

They should make a movie.. So you're suggesting I reprogram pfsense then? I'll have to inform the boss it's going to take a bit longer! Anyway, point taken, I'll have to see what this entails. The string was looking to be pretty long anyway. :-) -----Original Message----- From: freeradius-users-bounces+andy.franks=sath.nhs.uk(a)lists.freeradius.org [mailto:freeradius-users-bounces+andy.franks=sath.nhs.uk@lists.freeradius.org] On Behalf Of Alan DeKok Sent: 30 September 2014 14:03 To: FreeRadius users mailing list Subject: Re: Maximum username length Franks Andy (RLZ) IT Systems Engineer wrote: > We’re going to attempt to pass a number of delimited variables > through via the username field Dear god no. This is a *terrible* idea. It will cause global warming, rickets, plagues, alien invasions, and help bring on the coming apocalypse. > and split them at the freeradius end, mostly to avoid rewriting the > php in the captive portal to use more orthodox existing attributes. There's no good reason to push crap onto someone else. Your laziness just makes life harder for everyone else. If you care about your users, *don't* do this. > Can someone confirm the maximum username field length? I can see in > the RFCs that 63 is the recommended minimum nas length but there’s not > much else I can see in there. A lot of equipment and systems won't handle more than 63 characters. This is a terrible, evil, disgusting idea. RADIUS is full of enough crap already without people deliberately adding more. Alan DeKok. - List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html

2 1

Maximum username length
by Franks Andy (RLZ) IT Systems Engineer 30 Sep '14

30 Sep '14

Hi all, We have a project trying to integrate pfsense and freeradus together to form a captive portal, not rocket science. We're going to attempt to pass a number of delimited variables through via the username field and split them at the freeradius end, mostly to avoid rewriting the php in the captive portal to use more orthodox existing attributes. Can someone confirm the maximum username field length? I can see in the RFCs that 63 is the recommended minimum nas length but there's not much else I can see in there. Thanks Andy

3 2

RE: Maximum username length
by Franks Andy (RLZ) IT Systems Engineer 30 Sep '14

30 Sep '14

Hi Stefan, Yes user-name, missed the hyphen. Thanks for the information. Andy -----Original Message----- From: freeradius-users-bounces+andy.franks=sath.nhs.uk(a)lists.freeradius.org [mailto:freeradius-users-bounces+andy.franks=sath.nhs.uk@lists.freeradius.org] On Behalf Of Stefan Paetow Sent: 30 September 2014 11:22 To: FreeRadius users mailing list Subject: Re: Maximum username length Username as in the RADIUS User-Name attribute? If so, it's a standard attribute, so a length of 253 octets (250 would probably be safer). Stefan Paetow Moonshot Industry & Research Liaison Coordinator t: +44 (0)1235 822 125 Janet, the UK’s research and education network. On 30 Sep 2014, at 10:21, Franks Andy (RLZ) IT Systems Engineer <Andy.Franks(a)sath.nhs.uk> wrote: > Hi all, > > We have a project trying to integrate pfsense and freeradus together to form a captive portal, not rocket science. > > We’re going to attempt to pass a number of delimited variables through via the username field and split them at the freeradius end, mostly to avoid rewriting the php in the captive portal to use more orthodox existing attributes. > > Can someone confirm the maximum username field length? I can see in the RFCs that 63 is the recommended minimum nas length but there’s not much else I can see in there. > > Thanks > > Andy > > - > List info/subscribe/unsubscribe? See > http://www.freeradius.org/list/users.html Janet(UK) is a trading name of Jisc Collections and Janet Limited, a not-for-profit company which is registered in England under No. 2881024 and whose Registered Office is at Lumen House, Library Avenue, Harwell Oxford, Didcot, Oxfordshire. OX11 0SG. VAT No. 614944238 - List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html

1 0

Per Proxy Server Statistics
by Himanshu Pandey 30 Sep '14

30 Sep '14

Hi Friends, I have a question? Do radius server support Per Proxy Server Statistics like minimum response time, maximum response time, Average response time, Mean response time? Regards, Sonu

3 2

TCP/ UDP SMTP, POP, HTTP, SIP services FreeRADIUS
by Russell Mike 30 Sep '14

30 Sep '14

Dear List How can i configure FreeRADIUS to allow a user for following SMTP, POP, HTTP, SIP services Only? No other network access. PORTS: 25,110,143 80, 5060,5061 Thanks RM --

3 4

Show module statistics using radmin
by Himanshu Pandey 30 Sep '14

30 Sep '14

Dear Alan, To show my module statistics using radmin I referred command.c and radmin.c and added my new command "show module statistics <module>". To brief you, I added an usigned array of module return codes in module_instance_t structure and updated the array in call_modsingle() function using the statement: modsingle *sp; sp->modinst->rtcode[result] = sp->modinst->rtcode[result] + 1; I tested this and it is giving 100% correct results. Now I have written a function static int command_show_module_statistics(rad_listen_t *listener, int argc, char *argv[]) in command.c file. I have used radius methods & structures only in this function, so guide me which is correct/wrong or what else radius methods or structures should be used. The problem is that correct module statistics are not being diplayed rather it is displaying 0 statistics for all modules.Please help me resolve this. Here goes the function code: static int command_show_module_statistics(rad_listen_t *listener, int argc, char *argv[]) { int i; CONF_SECTION *cs; module_instance_t const *mi; if (argc != 1) { cprintf(listener, "ERROR: No module name was given\n"); return 0; } cs = cf_section_find("modules"); if (!cs) return 0; mi = find_module_instance(cs, argv[0], false); if (!mi) { cprintf(listener, "ERROR: No such module \"%s\"\n", argv[0]); return 0; } for (i = 0; i < RLM_MODULE_NUMCODES; i++) { cprintf(listener, "\nRTCODE[%d]=%ld\n",i,mi->rtcode[i]); } return 1; /* success */ } Regards, Sonu

2 1

Re: Beginner help
by KAVYA PRABHAKAR 30 Sep '14

30 Sep '14

Hi, I am trying to send RADIUS authentication only packet from NAS IP to Freeradius server. Over UDP it worked fine. Now I have got a certificate installed on Freeradius server, as I am willing to send Radius auth request over TLS connection. Before sending request from NAS I am trying to create TLS conenction b/n NAS ip and Freeradius server. I want that connection to happen over 1814 port. What configuration changes should I be doing for the same(port number)? What other configuration needs to be done on Freeradius server to make TLS work? Freeradius server is running on ubuntu 14.04. Thanks, Kavya

2 1

Re: Beginner need help
by Alan DeKok 29 Sep '14

29 Sep '14

Himanshu Pandey wrote: > I modified users configuration file and radiusd.conf. If you don't know what you're doing, DO NOT EDIT THE FILES. This isn't difficult. > I have attached radiusd.conf file. I'm not going to read it. The default radiusd.conf file works. Use it. > Please tell me what shall I not modify in > radiusd.conf file. Actually I did some modifications in radiusd.conf > file since I was getting some error in starting the radius server. Nonsense. The default configuration works. Alan DeKok.

3 9

Sqlcounter fail over
by Emanuele Fia 29 Sep '14

29 Sep '14

Dear Freeradius Users, I need some help in my freeradius configuration. radusergroup +---------------------+---------------------+----------+ | username | groupname | priority | +---------------------+---------------------+----------+ | 1aaaaaaaaa1228721nx | offertaA_unlimited | 1 | | 1aaaaaaaaa1228721nx | offertaA_limited | 2 | +---------------------+---------------------+----------+ radgroupcheck +----+---------------------+-----------------------+----+---------+ | id | groupname | attribute | op | value | +----+---------------------+-----------------------+----+---------+ | 35 | offertaA_unlimited | Max-Monthly-TrafficIN | := | 5000000 | +----+---------------------+-----------------------+----+---------+ radgroupreply +-----+---------------------+---------------------+----+------------+ | id | groupname | attribute | op | value | +-----+---------------------+---------------------+----+------------+ | 207 | offertaA_unlimited | Fall-Through | = | yes | | 205 | offertaA_unlimited | Rate-Limit | = | 2048k/512k | | 211 | offertaA_limited | Fall-Through | = | yes | | 209 | offertaA_limited | Rate-Limit | = | 100k/100k | +-----+---------------------+---------------------+----+------------+ My goal is that user '1aaaaaaaaa1228721nx' use the group 'offertaA_unlimited' until the attribute 'Max-Monthly-TrafficIN' ( sqlcounter ) reach the value and after this radius reply with settings of the group 'offertaA_limited' Now happen that when sqlcounter 'Max-Monthly-TrafficIN' reach the value set in radgroupreply return auth reject. Probably there is something to do in policy.conf, i have done some test without results =( Thank you for help, Emanuele

3 8

FreeRADIUS using Active Directory integration broken without any traces
by Vinícius Ferrão 29 Sep '14

29 Sep '14

Hello guys, I've a FreeBSD 10.0 server running FreeRADIUS 3 and things got broken without any apparent reason. I'm using Winbind from Samba4 to authenticate with ntlm_auth. I've done some debug to solve the problem, but I was unable to find where is the problem. ntlm_auth is working: # ntlm_auth --username=ferrao --request-nt-key # Password: # NT_STATUS_OK: Success (0x0) But RADIUS fails when doing EAP-PEAP authentication, and running FreeRADIUS in debug mode this is the error message: # (9) mschap : Executing: /usr/local/bin/ntlm_auth --request-nt-key --username=%{%{Stripped-User-Name}:-%{%{User-Name}:-None}} --challenge=%{%{mschap:Challenge}:-00} --nt-response=%{%#{mschap:NT-Response}:-00} # (9) mschap : EXPAND --username=%{%{Stripped-User-Name}:-%{%{User-Name}:-None}} # (9) mschap : --> --username=ferrao # (9) mschap : Creating challenge hash with username: ferrao # (9) mschap : EXPAND --challenge=%{%{mschap:Challenge}:-00} # (9) mschap : --> --challenge=082e8ba7b848aaae # (9) mschap : EXPAND --nt-response=%{%{mschap:NT-Response}:-00} # (9) mschap : --> --nt-response=27b40a6d1dba1b4acfd33aff5c710a43e70d050269087bf1 # (9) ERROR: mschap : Program returned code (1) and output 'Reading winbind reply failed! (0xc0000001)' # (9) mschap : External script failed. # (9) ERROR: mschap : External script says: Reading winbind reply failed! (0xc0000001) # (9) ERROR: mschap : MS-CHAP2-Response is incorrect # (9) [mschap] = reject # (9) } # Auth-Type MS-CHAP = reject # (9) eap : Freeing handler # (9) [eap] = reject # (9) } # authenticate = reject # (9) Failed to authenticate the user. # (9) Login incorrect (mschap: Program returned code (1) and output 'Reading winbind reply failed! (0xc0000001)'): [ferrao/<via Auth-Type = EAP>] (from client 192.168.0.0/26 port 0 via TLS tunnel) So something is wrong with Winbind and FreeRADIUS, and I don't know what. Thanks in advance,

5 4