January 2015 - Freeradius-Users - lists.freeradius.org

RE: Pleace help (Lic. Lester Perez)
by David Mitton 09 Jan '15

09 Jan '15

EAP-MD5 was deprecated by default in Windows Vista forward. (check your calendars!) However, the code remains and can be turned back on with some registry tweaks. This article doesn't say it, but Windows Server and NPS still have the capability, given some support site user comments. https://support.microsoft.com/kb/922574/en-us/ Dave. Quoting Arran Cudbard-Bell <a.cudbardb(a)freeradius.org>: >> On 9 Jan 2015, at 16:36, Rui Ribeiro <ruyrybeyro(a)gmail.com> wrote: >> >> >> Hi Lester, >> >> I could swear MD5 is not supported in Windows > > I'm fairly sure it is in windows. Though doesn't produce keying > material so useless > for WPA-Enterprise. > > -Arran > > Arran Cudbard-Bell <a.cudbardb(a)freeradius.org> > FreeRADIUS development team > > FD31 3077 42EC 7FCD 32FE 5EE2 56CF 27F9 30A8 CAA2 > > - > List info/subscribe/unsubscribe? See > http://www.freeradius.org/list/users.html ----- End forwarded message -----

1 0

Most stable version of FreeRadius ?
by Sautron Nick 09 Jan '15

09 Jan '15

Hello, I am in training in Master in computer science , and I have set up freeradius and eduroam service. I want to know that it is the most stable version of freeradius? Thank you for your reply Best Regards

3 3

3.0.6: all good :-)
by Stefan Winter 09 Jan '15

09 Jan '15

Hello, just a little heads up to the team: I'm now running the shipped 3.0.6 for all my clients and all vservers - previously I was sitting between chairs with my old 2.x installation because some small things just weren't working quite so well on 3.0.x in my somewhat sophisticated (or, as Alan put it, "weird") config. Now with 3.0.6 the server runs as well as it did in 2.x times with all those strange corner-case configs. And I can finally decommission the old server :-) Thanks for bearing with me during my feature/bug nagging in the last months! Greetings, Stefan Winter -- Stefan WINTER Ingenieur de Recherche Fondation RESTENA - Réseau Téléinformatique de l'Education Nationale et de la Recherche 6, rue Richard Coudenhove-Kalergi L-1359 Luxembourg Tel: +352 424409 1 Fax: +352 422473 PGP key updated to 4096 Bit RSA - I will encrypt all mails if the recipient's key is known to me http://pgp.mit.edu:11371/pks/lookup?op=get&search=0xC0DE6A358A39DC66

5 8

Execute SQL command after Authentication
by Marcelo Santoro 09 Jan '15

09 Jan '15

Hi Friends… i Would like to know, how to execute a SQL UPDATE command after my client Authenticate for example. After client Authenticate… i want to execute a UPDATE command to my database sending the NAS where the client is connected… i know that this information exist in radacct, but i need this information in another table… My RadAcct table has more than 9 millions of registers… and i don`t want to make SELECTs in this table. Tks for your Attention. Best Regards Marcelo Santoro

2 4

Re: Pleace help (Lic. Lester Perez)
by Rui Ribeiro 09 Jan '15

09 Jan '15

Hi Lester, I could swear MD5 is not supported in Windows, and in iPhones. Please have a look at the matrix http://deployingradius.com/documents/protocols/compatibility.html. (I think you already have it on another message). I would leave MAC authorisation to the DHCP service (i.e. registering the approved MACs and not allowing unknown MACs), and would do the authentication of users with FreeRadius. Here we are authenticating against an AD server. Yo juraría que MD5 no es compatible con Windows , y con iPhones . Por favor haz un vistazo a la matriz http://deployingradius.com/documents/protocols/compatibility.html . (Creo que ya la tienes en otro mensaje ) . Yo dejaría la autorización MAC para el servicio DHCP (es decir, el registro de los MACs aprobados y no permitiria los MAC desconocidos ) y haría de la autenticación de usuarios con FreeRadius . Aquí nosotros nos autentificamos con un servidor AD . Saludos, Rui Ribeiro -- Rui Ribeiro Senior Sysadm ISCTE-IUL https://www.linkedin.com/pub/rui-ribeiro/16/ab8/434 Date: Thu, 08 Jan 2015 11:20:27 -0400 > From: "Lic. Lester Perez" <lesterpl(a)infomed.sld.cu> > To: freeradius-users(a)lists.freeradius.org > Subject: Pleace help > Message-ID: <54AEA03B.2020600(a)infomed.sld.cu> > Content-Type: text/plain; charset=utf-8; format=flowed > > Hola good morning have freeradiuses 2 . 1 . 12 on debian7 and by > authenticating against MySql and have it to authenticate my users of the > wireless nets. I have several TP,Link TL,WR642G router and have achieved > that functions me but with several problems: > 1- The passwords in MySQL have to be in plane text because not > authenticate > 2- Want that it could the encript password at least in MD5 > 3- It is connect me well dispositive motives but have problems that > many labtops are not connect me and when do a radtest with the user and > it key responds me correct. > 4- Wanted that it checked me the MAC of the dispositive clients as > well as putting you hourly in order that can connect . > It gives me a lot of taste is in being connected with this community. > Waiting your help and thanks for all. > Best regards > Lester > > -- > Este mensaje le ha llegado mediante el servicio de correo electronico que > ofrece Infomed para respaldar el cumplimiento de las misiones del Sistema > Nacional de Salud. La persona que envia este correo asume el compromiso de > usar el servicio a tales fines y cumplir con las regulaciones establecidas > > Infomed: http://www.sld.cu/ > > >

2 1

Pleace help
by Lic. Lester Perez 08 Jan '15

08 Jan '15

Hola good morning have freeradiuses 2 . 1 . 12 on debian7 and by authenticating against MySql and have it to authenticate my users of the wireless nets. I have several TP,Link TL,WR642G router and have achieved that functions me but with several problems: 1- The passwords in MySQL have to be in plane text because not authenticate 2- Want that it could the encript password at least in MD5 3- It is connect me well dispositive motives but have problems that many labtops are not connect me and when do a radtest with the user and it key responds me correct. 4- Wanted that it checked me the MAC of the dispositive clients as well as putting you hourly in order that can connect . It gives me a lot of taste is in being connected with this community. Waiting your help and thanks for all. Best regards Lester -- Este mensaje le ha llegado mediante el servicio de correo electronico que ofrece Infomed para respaldar el cumplimiento de las misiones del Sistema Nacional de Salud. La persona que envia este correo asume el compromiso de usar el servicio a tales fines y cumplir con las regulaciones establecidas Infomed: http://www.sld.cu/

2 1

RAD_REQUEST: Calling-Station-Id = ARRAY(0x825a588)
by Thomas Zenz 08 Jan '15

08 Jan '15

Just for Info. We are running freeradius-2.2.0. We are unsing 802.1x on Cisco Switches with MAB (Mac Authentication Bypass). In the beginning we used the sql module to put the Clients into their VLAN using MAB. Now we use Certifiacts and the Client info to decide where we put the Port. Because we get no Info if the Client is usind 802.1x or MAB I check with the perl script, if the Calling-Station-Id equals the Stripped-User-Name. After an uptdate in Win7 or using the debugging option in Windows: # netsh ras set tracing * enable/disable # Logs: C:\Windows\tracing # - Explorer_RASTLS.log # - svchost_RASTLS.log The authorization was running fine during a Windows Boot. One moment befor the Logon Prompt is showing, Windows makes a last reauthentication, or link down/up. This session has as Calling-Station-Id an ARRAY. So my script failed, and the Port was set to the MAB VLAN where clients only get Updates or PXE Boot. With Help of the Script from <Ana Gallardo Gómez> I created this script. Feel free to use it: my $Client_REQ_TYPE = ""; my $VLAN = ""; my $CSI = ""; my $req; my @array; if (exists $RAD_REQUEST{'Calling-Station-Id'} && defined $RAD_REQUEST{'Calling-Station-Id'}) { $req=$RAD_REQUEST{'Calling-Station-Id'}; #RAD Request is an array. if (ref($req) eq "ARRAY") { foreach (@{$req}) { #print ("\nCSId: $_"); $CSI=lc($_); push(@array, $_); } } if ($#array ==1 ){ # everyting OK, one Entry ; } elsif ($#array > 1){ syslog('info', "More than one Calling-Station-Id"); print "\n"; print @array; print "\n"; } elsif ($#array == 0){ syslog('info', "No Calling-Station-Id"); print $array[0]; } unless (ref($req)) { #not an Array simply $CSI=lc($req); print ("\nCSId End: $req"); } } our $SessionIdentifier; $CSI =~ s/-//g; my $SUID = lc($RAD_REQUEST{'Stripped-User-Name'}); #syslog('info', "CSI: $CSI"); #syslog('info', "SUID: $SUID"); print "CSI: $CSI\n"; print "SUID: $SUID\n"; print "--------------CallerID VLan---------------\n"; if ( $CSI == $SUID) { $Client_REQ_TYPE = "MAB"; syslog('info', "MAB Request $SUID"); } else { $Client_REQ_TYPE = "dot1x"; syslog('info', "802.1X Authentication $SUID"); } Have Fun Tom

4 4

Clients.conf
by Clive 08 Jan '15

08 Jan '15

Hi all, I recently posted a question regarding only the local host showing in the debug for the clients file even though I had added a new one to the file. I have my answer as to why that occurred...... A basic mistake to make so thought I would post the answer here.... It helps if, when configuring the new client, it is configured OUTSIDE the current parenthesis for the localhost. I did this and it now shows in the debug. Thanks Sent from my iPad

1 0

Re: If statement regex match with multiple similar attributes
by jberry＠plus.net 08 Jan '15

08 Jan '15

> Is upgrading your FreeRADIUS a possibility? Starting from version 3, > there is a foreach statement in unlang, that can loop through the >results. Sadly not. We are planning to do this but have custom modules at the moment which need to be purged/rewritten but this is good knowledge for when we do! > Otherwise, if it is always the second Class, you could use > %{reply:Class[1]}, but this feels a bit like a hack. There are some > hints about this in the man page of unlang. I will have to go with this for now. I did find a further improvement to this that works so replying to the list in case anyone else finds it useful: if( "%{reply:Class[*]}" =~ /.*0x434653494421.*/ ) { update reply { ... } } This assesses the array containing all Class attrs as a string (I think) so providing you are looking for something you know is going to be unique it works a treat: ++? if ("%{reply:Class[*]}" =~ /.*0x434653494421.*/ ) expand: %{reply:Class[*]} -> 0x5030323a3*************************************** 0x434653494421**************** ? Evaluating ("%{reply:Class[*]}" =~ /.*0x434653494421.*/) -> TRUE P.s. Sorry if I messed up anyones threading, had the list in digest mode and couldn¹t work out how to reply! Many thinks -- Josh Berry Senior Systems Engineer Plusnet PLC | www.plus.net Phone: 01142 733547 Registered Office: The Balance | 2 Pinfold Street | Sheffield | S1 2GU Registered in England no: 3279013

1 0

mysqlippool
by Miha 08 Jan '15

08 Jan '15

Hi, is it possible to set in freeradius when time is expired in ippool for some ip that radius will send stop packet to NAS? BR miha

2 2