February 2015 - Freeradius-Users - lists.freeradius.org

Custom attributes
by Flamur Rogova 04 Feb '15

04 Feb '15

Hi, I want to use custom attribute of integer type, to hold user's total amount of consumed bytes, something like this ATTRIBUTE Total-Used-Bytes 3003 integer What is bit width of custom integer attributes, 32 or 64 bit ? I need it to store 64 counters. Br/Flamur

2 1

What else should radmin do?
by Alan DeKok 04 Feb '15

04 Feb '15

I’ve pushed some changes to radmin, which will be in the 3.0.7 release. The changes make radmin work a little better, in that it now makes a distinction between STDOUT and STDERR. Also, when a command fails, radmin will exit with an error: $ radmin -e “help” … $ echo $? 0 Versus: $ radmin -e “no such command” … $ echo $? 1 These changes were made possible by updating the underlying framework used by radmin and the server. The result of these framework changes is that we can now exchange *anything* safely between the server and radmin. So… what would be useful to exchange? We can’t do configuration changes, as the server can’t write to /etc/raddb. But we could do test packets, for example. $ radmin “send packet X pretending to be from NAS 192.0.2.1” And get a response. This means it would be possible to perform better tests on live systems. Any other ideas? Alan DeKok.

3 6

Re: Disconnect message!
by Kos 04 Feb '15

04 Feb '15

I found this awesome Java API(https://github.com/GideonLeGrange/mikrotik-java) and make possible to disconnect the user through. Thanks all for your answers.

1 0

Expiration Feature / Session-Timeout Problem
by Sven 04 Feb '15

04 Feb '15

Hello, i try to use the Expiration Feature to get control over the Password lifetime of our Users. The idea was to set a date maybe 90 Day from last Passwordchange. This worked well, Users got denied but ive tested this feature only with a few Days ahead from now. Now i found out that if i set this to more than a Month from now that some of our Devices rejects the Access while i can see in the Radius Log that they where supplied with a Access-Accept. I guess that some of our older Devices got Problems with the releated Session-Timeout value which is in the Access-Accept reply too. Is there a way to not send Session-Timeout Data to these or all Devices ? In my setup i dont think that i need this because my goal is not to Disconnect a User, only to block him from logging in. Maybe there is a better solution to get this "feature" :) Im not sure if the Expiration Feature is the right thing for this task. Kind Regards, Sven

3 3

Stored Procedure
by Robert Graham 03 Feb '15

03 Feb '15

How do you execute a stored proc against a sql sever to authenticate a user. What do you do with the response to either accept or reject the user? We are trying to authenticate the user by returning a 1 for yes or 0 for no. The stored proc is executed by the update control but the User Password is not being added, its only adding the User-name and leaving the Userpassword field blank. Tmp-String-0 := "%{sql:EXEC [IsUserAuthenticated] ('%{User-Name}','%{User-Password}'" } if (Tmp-String-0 =~ /1/) update control { &Auth-Type := Accept }

2 1

freeradius memory leak after use detail file
by Yanrui Hu 03 Feb '15

03 Feb '15

free radius 2.2.6 it works well on production system and one day we change to not write accouting data to database directly, instead, we write it to detail disk file and sync to db latter. after this change we found the memory consumption increase day by day. with valgrind I test it in lab environment with same configuration. here is the output: anybody can help if this is leak and if newest 3.2.x already fixed it? valgrind --leak-check=full --time-stamp=yes --show-leak-kinds=all --log-file=/tmp/valgrind.log /usr/sbin/freeradius ==00:00:00:07.586 59730== LEAK SUMMARY: ==00:00:00:07.586 59730== definitely lost: 125 bytes in 3 blocks ==00:00:00:07.586 59730== indirectly lost: 480 bytes in 20 blocks ==00:00:00:07.586 59730== possibly lost: 0 bytes in 0 blocks ==00:00:00:07.586 59730== still reachable: 6,173,476 bytes in 70,774 blocks ==00:00:00:07.586 59730== suppressed: 0 bytes in 0 blocks ==00:00:00:07.586 59730== ==00:00:00:07.586 59730== For counts of detected and suppressed errors, rerun with: -v ==00:00:00:07.586 59730== Use --track-origins=yes to see where uninitialised values come from ==00:00:00:07.586 59730== ERROR SUMMARY: 41122 errors from 100 contexts (suppressed: 0 from 0) ==00:00:03:34.727 59824== Thread 6: ==00:00:00:07.569 59730== 160 bytes in 4 blocks are still reachable in loss record 891 of 1,273 ==00:00:00:07.569 59730== at 0x4C2CFA7: malloc (vg_replace_malloc.c:296) ==00:00:00:07.569 59730== by 0x4E48CA5: rbtree_insertnode (rbtree.c:270) ==00:00:00:07.569 59730== by 0x4E48EB8: rbtree_insert (rbtree.c:299) ==00:00:00:07.569 59730== by 0x40D829: cf_item_add (conffile.c:531) ==00:00:00:07.569 59730== by 0x40D829: cf_item_add (conffile.c:507) ==00:00:00:07.569 59730== by 0x4104AA: cf_item_parse (conffile.c:1085) ==00:00:00:07.569 59730== by 0x410890: cf_section_parse (conffile.c:1197) ==00:00:00:07.569 59730== by 0xF1DE5DE: detail_instantiate (rlm_detail.c:132) ==00:00:00:07.569 59730== by 0x41D38B: find_module_instance (modules.c:620) ==00:00:00:07.569 59730== by 0x41FC63: do_compile_modsingle (modcall.c:1966) ==00:00:00:07.569 59730== by 0x41C69F: load_component_section (modules.c:908) ==00:00:00:07.569 59730== by 0x41CBE1: load_byserver (modules.c:1109) ==00:00:00:07.569 59730== by 0x41DA6C: virtual_servers_load (modules.c:1273) ==00:00:00:07.564 59730== 56 bytes in 1 blocks are still reachable in loss record 792 of 1,273 ==00:00:00:07.564 59730== at 0x4C2CFA7: malloc (vg_replace_malloc.c:296) ==00:00:00:07.564 59730== by 0x424B18: rad_malloc (util.c:347) ==00:00:00:07.564 59730== by 0xF1DE577: detail_instantiate (rlm_detail.c:126) ==00:00:00:07.564 59730== by 0x41D38B: find_module_instance (modules.c:620) ==00:00:00:07.564 59730== by 0x41FC63: do_compile_modsingle (modcall.c:1966) ==00:00:00:07.564 59730== by 0x41C69F: load_component_section (modules.c:908) ==00:00:00:07.564 59730== by 0x41CBE1: load_byserver (modules.c:1109) ==00:00:00:07.564 59730== by 0x41DB14: virtual_servers_load (modules.c:1244) ==00:00:00:07.564 59730== by 0x41E0B7: setup_modules (modules.c:1568) ==00:00:00:07.564 59730== by 0x4097C2: main (radiusd.c:289) -- Best Regards, Yanrui Hu -- *This email may contain or reference confidential information and is intended only for the individual to whom it is addressed. Please refrain from distributing, disclosing or copying this email and the information contained within unless you are the intended recipient. If you received this email in error, please notify us at legal(a)appannie.com <legal(a)appannie.com>** immediately and remove it from your system.*

3 2

Is it possible to have different TLS configurations per EAP type?
by Louis Munro 02 Feb '15

02 Feb '15

Hello, I have a set of FR 2.2.5 servers which are currently handling PEAP connections. We now want to add EAP-TLS authentication, which is pretty straightforward. The only stumbling block I have is that the EAP-TLS client certs are signed by a root CA different from the one that signed the server certificate currently used for PEAP authentication. While that is not a problem in itself it makes client devices configuration more troublesome than I would like because it forces the user to install two root CA certs. So I am trying to write a configuration that would support two eap configurations. Instantiating two modules is not the problem, it’s more a matter of finding how to select a configuration to be used while maintaining backwards compatibility for the existing PEAP clients. Assuming the following modules: eap { […] tls { certdir = ${confdir}/certs cadir = ${confdir}/certs private_key_file =${certdir}/server.key certificate_file = ${certdir}/server.crt CA_file = ${certdir}/ca_PEAP.crt dh_file = ${certdir}/dh random_file = /dev/urandom cipher_list = "DEFAULT" make_cert_command = "${certdir}/bootstrap” […] } eap eap-tls { [..] tls { certdir = ${confdir}/certs cadir = ${confdir}/certs private_key_file = ${certdir}/ca.key private_key_password = whatever certificate_file = ${certdir}/ca.pem dh_file = ${certdir}/dh random_file = /dev/urandom cipher_list = "DEFAULT" make_cert_command = "${certdir}/bootstrap" CA_file = ${certdir}/ca.pem […] } This does not seem to work: authorize { # assuming an instance called eap-tls eap-tls { updated = return } # else eap { ok = return } […] } And since things like EAP-Type are detected by the eap module itself I also can’t seem to do if (EAP-Type && (EAP-Type == EAP-TLS)) { eap-tls { ok = return } } else { eap { ok = return } } Which leaves me with a chicken and egg type of situation. Is this doable in FR 2? Am I just missing the obvious? Thank you for your help. -- Louis Munro lmunro(a)inverse.ca :: www.inverse.ca +1.514.447.4918 x125 :: +1 (866) 353-6153 x125 Inverse inc. :: Leaders behind SOGo (www.sogo.nu) and PacketFence (www.packetfence.org)

3 3

[ANN] Release 3.0.7 rc0
by Arran Cudbard-Bell 02 Feb '15

02 Feb '15

A preview release of 3.0.7 is available here: https://github.com/FreeRADIUS/freeradius-server/archive/release_3_0_7_rc0.t… We're creating a release candidate for 3.0.7 as there have been many modifications to error reporting, and error categorisation in rlm_sql. One major change is in the logging API used by SQL drivers to report errors. Instead of using static buffers, they now use talloc pools, which are as efficient, but avoid thread safety issues. They can now log errors with different priorities, and log multiple error messages. This is used by the rlm_sql_mysql driver to output the result of SHOW WARNINGs if additional warnings are available on the server. Another big change is how the the drivers report failures. For rlm_sql_mysql and rlm_sql_sqlite, the drivers now distinguish between constraints violations, server errors and malformed queries. For those drivers rlm_sql.accounting will now return noop (if no more alternative queries), fail, and invalid respectively. Previously it would just return noop. More work is needed to bring this functionality to other drivers. Please send patches if you think this will be useful for you. These changes could not be tested fully as we don't have access to the various databases. If a particular driver is important for your deployment, please test 3.0.7 before it's released. Here's the changelog so far: Feature improvements * Allow coa home_servers to be derived from client sections if a coa_server section is provided. * Automatically determine the correct port if no port is provided for a home server. * Allow foreach to operate over lists. * Add compile time features to ${feature.*} and versions of core libraries to ${version.*}. Feature and version names match output of radiud -xv. %v is now deprecated. * Add support for PATCH method in rlm_rest. * Validate more module xlats on startup, and warn if an xlat expansion is found in a double quoted config item which will not be expanded. * Add support for sub-second timeouts in rlm_rest. * Add support for connection timeouts in rlm_rest. * Add %{jsonquote:<str>} xlat to escape strings for insertion into json documents. * Add %{ldapquote:<str>} xlat to escape strings for insertion into json documents. * Add %{explode:&ref <char>}, splits value of &ref on <char> and creates new &ref type attributes with the fragments. * Allow rlm_ldap to use attribute references for base_dn and filter config items. The attribute references are not escaped, allowing DNs and filters to be created dynamically. * Add %{nexttime:[<int>]h|d|w|y} to calculate the number of seconds before the next <int> hour(s), day(s), week(s), or year(s). * Allow the left side of update sections to be xlat expansions. The result of the expansion is then used to reference the attribute to be modified. * Added %{lpad:&Attribute-Name 7 x} and rpad. These produce fixed-width output strings, with padding to the left (lpad) or the right (rpad). * For some SQL drivers (MySQL, sqlite) distinguish between constraints violations (on insert), invalid queries, and server errors, and return noop, invalid, and error respectively. * Call SHOW WARNINGS in the MySQL driver and write them to the request log, if libmysqlclient indicates warnings are available on the server. * Provide mechanism to create non-standard VSAs. * Make dhcpclient work with raw sockets and various other improvements - Contributed by nchaigne * Add support for SSHA2 - Contributed by PDD. * Add perle dictionary - Contributed by Hachmer * Modernise init scripts for RHEL, SUSE and Debian. Bug fixes * Fix issues parsing LDAP hostnames with non-standard ports. * Fix issues with realms containing regular expressions. * Allow unary negation before parantheses in rlm_expr. * Fix infinite loop in kevent event loop code. Issue only presented on FreeBSD. * Be more careful to define Auth-Types before loading modules. * Link libfreeradius-radius against OpenSSL too, to avoid multi-version symbols in SSL libraries. * When rlm_ldap rebinds a connection, it should use bind credentials from the module that created the connection pool, not credentials from the module referencing it. * Empty server config pairs should be allowed in rlm_ldap instances that reference another module's connection pool. * Don't try and change the permissions of unix sockets used for the control socket on non-linux systems. Instead inform the user that permissions need to be changed on parent directory. Unix socket permissions are a Linux extension. * Mark rlm_always as huppable, so its rcode can be changed via radmin (allows policy toggles). * Emit warnings when ignoring user configured pool values. * Fix issue that would cause radclient to complain intermittently about differing numbers of filters and requests. * Fix cosmetic issues in connection pool logging, that made it appear as if the same connection was being opened multiple times. * Fix threadsafety issues in SQL drivers, where a static buffer was used to store error messages. * Log RERROR, RWARN, RINFO to the global log if request logging is not enabled. * Link to libldap instead of libldap_r. Linking to libldap_r is not supported for use by projects outside of OpenLDAP. * Set connection timeout correctly in rlm_sql_mysql. * Build with older versions of libcurl, and use CFLAGS from curl-config. * Honour Packet-Src-Port and Packet-Src-IP-address in radclient. * Initialise ldapai_info_version field, so libldap will report its vendor and version. * Fix log rotation scripts by using the copyrotate option. * Fix issue that caused opening control sockets to always fail on non-Linux systems, if a user or group was set. * Save Session-State after proxying. * Additional fixes for reading CoA/DM requests from flat files. -Arran Arran Cudbard-Bell <a.cudbardb(a)freeradius.org> FreeRADIUS development team FD31 3077 42EC 7FCD 32FE 5EE2 56CF 27F9 30A8 CAA2

1 0

AW: Re: using external script in virtual server config
by the2nd 01 Feb '15

01 Feb '15

I already have implemented mschap authentication im OTPme and use it from within the mschap module as a ntlm_auth replacement. But it would be great if i could also handle this in rlm_python. If if i could get challenge and response from authData just like its done with username and password i could verify it and return the nt_key on success. regards the2nd <div>-------- Ursprüngliche Nachricht --------</div><div>Von: Alan DeKok <aland(a)deployingradius.com> </div><div>Datum:01.25.2015 21:32 (GMT+01:00) </div><div>An: FreeRadius users mailing list <freeradius-users(a)lists.freeradius.org> </div><div>Betreff: Re: using external script in virtual server config </div><div> </div>On Jan 25, 2015, at 1:15 PM, the2nd(a)otpme.org wrote: > today i've written an python module for use with rlm_python and it works great for clear-text requests. but i dont know how to handle ntlm/mschap requests. You don’t. FreeRADIUS implements MS-CHAP. You don’t want to re-implement that in python. What do you want to do with the OTP and MS-CHAP? Alan DeKok. - List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html

4 14