October 2015 - Freeradius-Users - lists.freeradius.org

input_/output_password?
by Jim Seymour 04 Oct '15

04 Oct '15

Hi All, In the ca.cnf and server.cnf files: It would appear only the output_password is actually used? Can output_password be eliminated, as well? I intend that the resulting certs be used by more than FreeRADIUS alone. I've never found it necessary to protect certs with passwords, before. Thanks, Jim -- Note: My mail server employs *very* aggressive anti-spam filtering. If you reply to this email and your email is rejected, please accept my apologies and let me know via my web form at <http://jimsun.LinxNet.com/contact/scform.php>.

2 2

Version 2.2.9 has been released
by Alan DeKok 03 Oct '15

03 Oct '15

This should be the last release from version 2. We recommend everyone upgrade to v3. Feature improvements * None. Bug fixes * Fix Tunnel-Password crash from home server. Found by Denis Andzakovic. * Fix timer issue when proxying. * Update EAP-TTLS so that MPPE keys are correctly calculated with TLSv1.2. * Always delete MS-MPPE-* from the TTLS inner tunnel. This allows TTLS / EAP-MSCHAPv2 to work. * Don't fall through in empty "case" statements. Fixes #1274.

4 5

ERROR: User-Name ... is not the same as MS-CHAP Name
by Jim Seymour 02 Oct '15

02 Oct '15

Hi All, FreeRADIUS version 2.1.12 (2.1.12+dfsg-1.2ubuntu8.1) Ubuntu 14.04.3 LTS OpenLDAP 2.4.31 Goal is to use existing sambaLMPassword/sambaNTPassword/sambaEtc. in OpenLDAP server data, to authenticate wireless clients--mostly running MS-Win7. Some MS-WinXP. A few Linux clients. Old version was FreeRADIUS 1.1.1, built from a tarball, running on a Sun Sparc Solaris box, working against an older version of OpenLDAP and Samba. Worked like a champ. Still working. Referring to various on-line "how to"s and my old configs: Got the new server kind of more-or-less running, the trick being in finding.. filter = "(uid=%{mschap:User-Name})" to get clients authenticating via ldap. Then ran into the dreaded Info: [mschap] ERROR: User-Name (hostname\username) is not the same as MS-CHAP Name (username) from EAP-MSCHAPv2 Realms is not possible, because these are all workgroup computers--not part of a domain. So they all send "HOSTNAME\\username", rather than just "username." I can auth with a Linux Mint client, no problem. Searching and searching: I finally ran across a Red Hat bug report thread where RH claimed "It's a bug, it's been patched" and they closed it. So: *Was* it a bug and *has* it been squashed? I have no problem building and installing from a tarball, *if* it will fix the problem. Thanks, Jim -- Note: My mail server employs *very* aggressive anti-spam filtering. If you reply to this email and your email is rejected, please accept my apologies and let me know via my web form at <http://jimsun.LinxNet.com/contact/scform.php>.

6 9

Operator to remove attributes
by Gary T. Giesen 01 Oct '15

01 Oct '15

I'm currently using FreeRADIUS 2.1.12 with an SQL backend and a custom-developed front end. I've run into a situation where we need to be able to apply a group to the user (that contains a check attribute) that would strip reply items (basically we want to strip Service-Type, Framed-Protocol, Framed-IP-Address, Framed-IP-Netmask, Framed-Route, etc) depending on which device the request is coming from. I realize that using unlang is probably the best supported method for this, unfortunately it doesn't jive well with our setup. I noticed a while back that Joe Maimon wrote some patches to create some custom operators to do just that: http://lists.freeradius.org/pipermail/freeradius-devel/2005-October/000550.h tml "Attribute -= Value" As a reply item it means remove matching items from the reply list. Not allowed as a check item. "Attribute -* Value" As a reply item it means remove all "Attribute" attributes items from the reply list. Not allowed as a check item. "Attribute -~ Value" As a reply item it means remove regex matching items from the reply list. Not allowed as a check item. Since it's not in the documentation, I presume this never made it into an official release. Were there problems with the patch? I'd be very interested to see this implemented... Cheers, Gary T. Giesen

4 12

REST API in v3
by Jim Shi 01 Oct '15

01 Oct '15

Hi, I was recommend to use REST API instead of jradius. Is there any doc how to implement the backend (which servers the REST API calls)? Thanks Jim

3 4