March 2015 - Freeradius-Users - lists.freeradius.org

ipaddr, ipv4addr ipv6addr
by Arran Cudbard-Bell 06 Mar '15

06 Mar '15

The behaviour of the ipaddr config item has changed slightly for 3.0.4. If the ipaddr value contains ':' or '[' or ']', it will be treated as an IPv6 address. If it fails to parse as an IPv6 address the server will refuse to start. If the ipaddr value does not contain any ipv6 chars the server will first check to see if it looks like an ipv4 address. If it does, the server will parse it, if it doesn't and DNS resolution is enabled, it will instead attempt to resolve it. If DNS resolution is not enabled the server will refuse to start. If a matching A record is available it will be used, else if a AAAA record is available else the server will refuse to start. If instead of the ipaddr config item the ipv4addr config item is used the server will check if it looks like an IPv4 address. If it does, the server will parse it, if it doesn't and DNS resolution is enabled, it will instead attempt to resolve it. If DNS resolution is not enabled the server will refuse to start. If a matching A record is available it will be used, else the server will refuse to start. If instead of the ipaddr config item the ipv6addr config item is used the server will check if it looks like an IPv6 address. If it does, the server will parse it, if it doesn't and DNS resolution is enabled, it will instead attempt to resolve it. If DNS resolution is not enabled the server will refuse to start. If a matching AAAA record is available it will be used, else the server will refuse to start. The behaviour is similar for the client, home_server and listen sections. Though those config items in client sections may have an optional /[0-9]{1,3} suffix to map clients to ranges of IP addresses. This should also work with things like example.org/96 though i'm not entirely sure why you'd ever want to do that. 'netmask' is now deprecated but will still function as expected until 3.1.0. These changes should make it slightly easier to manage v4/v6 transitions. Wildcard clients 0.0.0.0 <ipaddr>/0 '*' are not supported. -Arran Arran Cudbard-Bell <a.cudbardb(a)freeradius.org> FreeRADIUS Development Team FD31 3077 42EC 7FCD 32FE 5EE2 56CF 27F9 30A8 CAA2

5 15

Freeradius 3.0.7 regex check in module files doesn't work
by Stabla, Daniel 06 Mar '15

06 Mar '15

Hello, we maybe found a bug in Freeradius 3.0.7. We assign V-LAN's dynamically through the module files in the section post-auth. To assign the right VLAN, various attributes are checked like the NAS-Identifier. In 3.0.4 it works without problems, but in 3.0.7 the regex check doesn't seem to work. ################################### sites-enabled/default ################################### server eap_server { listen { ipaddr = * port = 1645 type = auth limit { } } authorize { eap { ok = return } } authenticate { Auth-Type PAP { } Auth-Type CHAP { } eap Auth-Type eap { eap { handled = 1 } if (handled && (Response-Packet-Type == Access-Challenge)) { } } } post-auth { update request { Stripped-User-Name := "%{mschap:User-Name}" Realm := "%{mschap:NT-Domain}" } update reply { Tunnel-Type := "13" Tunnel-Medium-Type := "6" } rad-vlan.authorize update reply { Tunnel-Private-Group-Id="%{control:Tunnel-Private-Group-Id}" } Post-Auth-Type REJECT { eap } } pre-proxy { update proxy-request { proxy-request:User-Name := "%{proxy-request:MS-CHAP-User-Name}" } } post-proxy { post_proxy_log eap } } ################################### mods-enabled/files ################################### files { filename = ${confdir}/radius-station-mac usersfile = ${confdir}/radius-station-mac compat = no EAP-TLS-Require-Client-Cert = yes } files radius-station-allow { usersfile = ${confdir}/radius-station-allow key = %{Stripped-User-Name} compat = cistron } files radius-station-ids { usersfile = ${confdir}/radius-station-ids key = %{Stripped-User-Name} compat = no } files radius-station-ids-test { usersfile = ${confdir}/radius-station-ids-test key = %{Stripped-User-Name} compat = cistron } files rad-vlan { usersfile = ${confdir}/rad-vlan key = %{Calling-Station-Id} compat = cistron Fall-Through = Yes } ################################### raddb/rad-vlan ################################### 12-34-56-78-90-AB NAS-Identifier =~ "WPA-GG.*", Stripped-User-Name == "ldapsearch123", Tunnel-Private-Group-Id := "200" 12-34-56-78-90-AB NAS-Identifier =~ "WPA-GG.*", Stripped-User-Name == "ldapsearch", Tunnel-Private-Group-Id := "200" 12-34-56-78-90-AB NAS-Identifier =~ "WPA-GG.*", Tunnel-Private-Group-Id := "200" DEFAULT Tunnel-Private-Group-Id := "001" ################################### Debug 3.0.7: ################################### (14) User-Name = 'materna\ldapsearch' (14) NAS-IP-Address = 127.0.0.1 (14) Calling-Station-Id = '12-34-56-78-90-AB' (14) Framed-MTU = 1400 (14) NAS-Port-Type = Wireless-802.11 (14) Connect-Info = 'CONNECT 11Mbps 802.11b' (14) NAS-Identifier = 'WPA-GG' (14) EAP-Message = 0x020e0050190017030100206d1d4cd5d01f3a7153236662e595c5daaaa6336c78322b05cc4c9fd9bc092eaf1703010020d37b532af4b18cb31b84ba696ea369a746e9f295e4f1e32a6d9081884be47bcd (14) State = 0xbfb2fbdeb2bce21540db8fbcb8edd37b (14) Message-Authenticator = 0x23a2fd8b9b2e1ade466b27c4b28100a3 (14) session-state: No cached attributes (14) # Executing section authorize from file ./etc/radius-eap//sites-enabled/default (14) authorize { (14) eap: Peer sent code Response (2) ID 14 length 80 (14) eap: Continuing tunnel setup (14) [eap] = ok (14) } # authorize = ok (14) Found Auth-Type = EAP (14) # Executing group from file ./etc/radius-eap//sites-enabled/default (14) authenticate { (14) eap: Expiring EAP session with state 0xbfb2fbdeb2bce215 (14) eap: Finished EAP session with state 0xbfb2fbdeb2bce215 (14) eap: Previous EAP request found for state 0xbfb2fbdeb2bce215, released from the list (14) eap: Peer sent method PEAP (25) (14) eap: EAP PEAP (25) (14) eap: Calling eap_peap to process EAP data (14) eap_peap: processing EAP-TLS (14) eap_peap: eaptls_verify returned 7 (14) eap_peap: Done initial handshake (14) eap_peap: eaptls_process returned 7 (14) eap_peap: FR_TLS_OK (14) eap_peap: Session established. Decoding tunneled attributes (14) eap_peap: PEAP state send tlv success (14) eap_peap: Received EAP-TLV response (14) eap_peap: Success (14) eap_peap: Using saved attributes from the original Access-Accept (14) eap_peap: User-Name = 'materna\ldapsearch' (14) eap_peap: Saving session b5f76169be377c4eb841c0ec3f4cc92488683fe647ffb81eb89abb1dbe84068f vps 0x7fab2c002200 in the cache (14) eap: Freeing handler (14) [eap] = ok (14) } # authenticate = ok (14) # Executing section post-auth from file ./etc/radius-eap//sites-enabled/default (14) post-auth { (14) update request { (14) EXPAND %{mschap:User-Name} (14) --> ldapsearch (14) Stripped-User-Name := "ldapsearch" (14) EXPAND %{mschap:NT-Domain} (14) --> materna (14) Realm := "materna" (14) } # update request = noop (14) update reply { (14) Tunnel-Type := VLAN (14) Tunnel-Medium-Type := IEEE-802 (14) } # update reply = noop (14) rad-vlan: EXPAND %{Calling-Station-Id} (14) rad-vlan: --> 12-34-56-78-90-AB (14) rad-vlan: EXPAND WPA-GG.* (14) rad-vlan: --> WPA-GG.* (14) rad-vlan: EXPAND WPA-GG.* (14) rad-vlan: --> WPA-GG.* (14) rad-vlan: users: Matched entry DEFAULT at line 4 (14) [rad-vlan.authorize] = ok (14) update reply { (14) EXPAND %{control:Tunnel-Private-Group-Id} (14) --> 001 (14) Tunnel-Private-Group-Id = "001" (14) } # update reply = noop (14) } # post-auth = ok (14) Login OK: [materna\ldapsearch/<via Auth-Type = EAP>] (from client sles11 port 0 cli 12-34-56-78-90-AB) (14) Sent Access-Accept Id 14 from 139.2.35.240:1645 to 139.2.38.67:55213 length 197 (14) User-Name = 'materna\ldapsearch' (14) MS-MPPE-Recv-Key = 0x106181fbc445a0ff2341792c573ab68ef78633d6308c7171c8a5db18d52fc33f (14) MS-MPPE-Send-Key = 0x7de75e7f18cc057b55abc4f1c3e41cfebfa3e7d32ef85ba091b7b42a2fc193e5 (14) EAP-Message = 0x030e0004 (14) Message-Authenticator = 0x00000000000000000000000000000000 (14) Tunnel-Type = VLAN (14) Tunnel-Medium-Type = IEEE-802 (14) Tunnel-Private-Group-Id = '001' (14) Finished request Thread 1 waiting to be assigned a request Waking up in 0.2 seconds. Waking up in 4.3 seconds. ################################### Debug 3.0.4: ################################### Thread 1 got semaphore Thread 1 handling request 14, (3 handled so far) User-Name = 'materna\ldapsearch' NAS-IP-Address = 127.0.0.1 Calling-Station-Id = '12-34-56-78-90-AB' Framed-MTU = 1400 NAS-Port-Type = Wireless-802.11 Connect-Info = 'CONNECT 11Mbps 802.11b' NAS-Identifier = 'WPA-GG' EAP-Message = 0x020e0050190017030100200178abd6cb94ebd3a457a0e14cebf41f0ddd572a3d7dfd5867087817f0d5966a1703010020b3483f13ae714a12e4fc5151018f0691a8555d9c76983af3fbe8cd112e63266d State = 0xfc812f3df18f362cddee265392cf2627 Message-Authenticator = 0x500747f00648ebdd6ecce7c3770fe689 (14) Received Access-Request packet from host 139.2.38.67 port 41678, id=14, length=220 (14)User-Name = 'materna\ldapsearch' (14)NAS-IP-Address = 127.0.0.1 (14)Calling-Station-Id = '12-34-56-78-90-AB' (14)Framed-MTU = 1400 (14)NAS-Port-Type = Wireless-802.11 (14)Connect-Info = 'CONNECT 11Mbps 802.11b' (14)NAS-Identifier = 'WPA-GG' (14)EAP-Message = 0x020e0050190017030100200178abd6cb94ebd3a457a0e14cebf41f0ddd572a3d7dfd5867087817f0d5966a1703010020b3483f13ae714a12e4fc5151018f0691a8555d9c76983af3fbe8cd112e63266d (14)State = 0xfc812f3df18f362cddee265392cf2627 (14)Message-Authenticator = 0x500747f00648ebdd6ecce7c3770fe689 (14) # Executing section authorize from file /etc/radiusd/sites-enabled/default (14)authorize { (14)eap : Peer sent code Response (2) ID 14 length 80 (14)eap : Continuing tunnel setup (14)[eap] = ok (14)} #authorize = ok (14) Found Auth-Type = EAP (14) # Executing group from file /etc/radiusd/sites-enabled/default (14)authenticate { (14)eap : Expiring EAP session with state 0xfc812f3df18f362c (14)eap : Finished EAP session with state 0xfc812f3df18f362c (14)eap : Previous EAP request found for state 0xfc812f3df18f362c, released from the list (14)eap : Peer sent method PEAP (25) (14)eap : EAP PEAP (25) (14)eap : Calling eap_peap to process EAP data (14)eap_peap : processing EAP-TLS (14)eap_peap : eaptls_verify returned 7 (14)eap_peap : Done initial handshake (14)eap_peap : eaptls_process returned 7 (14)eap_peap : FR_TLS_OK (14)eap_peap : Session established.Decoding tunneled attributes (14)eap_peap : Peap state send tlv success (14)eap_peap : Received EAP-TLV response (14)eap_peap : Success (14)eap_peap : Using saved attributes from the original Access-Accept User-Name = 'materna\ldapsearch' (14)eap_peap : Saving session 467ec288d1ef3786548e67dd6ddc2493765cab9d520bef51307869c3cf86776a vps 0x7facbc003e90 in the cache (14)eap : Freeing handler (14)[eap] = ok (14)} #authenticate = ok (14) Login OK: [materna\ldapsearch/<via Auth-Type = EAP>] (from client sles11 port 0 cli 12-34-56-78-90-AB) (14) # Executing section post-auth from file /etc/radiusd/sites-enabled/default (14)post-auth { (14)update request { (14) EXPAND %{mschap:User-Name} (14)--> ldapsearch (14)Stripped-User-Name := "ldapsearch" (14) EXPAND %{mschap:NT-Domain} (14)--> materna (14)Realm := "materna" (14)} # update request = noop (14)update reply { (14)Tunnel-Type := VLAN (14)Tunnel-Medium-Type := IEEE-802 (14)} # update reply = noop (14)rad-vlan : EXPAND %{Calling-Station-Id} (14)rad-vlan :--> 12-34-56-78-90-AB (14)rad-vlan : EXPAND WPA-GG.* (14)rad-vlan :--> WPA-GG.* (14)rad-vlan : EXPAND WPA-GG.* (14)rad-vlan :--> WPA-GG.* (14)rad-vlan : EXPAND WPA-GG.* (14)rad-vlan :--> WPA-GG.* (14)rad-vlan : EXPAND WPA-GG.* (14)rad-vlan :--> WPA-GG.* (14)rad-vlan : users: Matched entry 12-34-56-78-90-AB at line 2 (14)[rad-vlan.authorize] = ok (14)update reply { (14) EXPAND %{control:Tunnel-Private-Group-Id} (14)--> 200 (14) Tunnel-Private-Group-Id = "200" (14)} # update reply = noop (14)} #post-auth = ok (14) Sending Access-Accept packet to host 139.2.38.67 port 41678, id=14, length=0 (14)User-Name = 'materna\ldapsearch' (14)MS-MPPE-Recv-Key = 0x8973d3f59b6ce58227550444df27760f7bd43151d1367444e1883aa5288a99dd (14)MS-MPPE-Send-Key = 0x1cc9775a68f9ed8715f7e50510981ea04330364949c228eb58a227a27352a440 (14)EAP-MSK = 0x8973d3f59b6ce58227550444df27760f7bd43151d1367444e1883aa5288a99dd1cc9775a68f9ed8715f7e50510981ea04330364949c228eb58a227a27352a440 (14)EAP-EMSK = 0xa8fc008102830647de31e83c4091d01c4717d0785bb964ab682b87b47c00bfe17aa903f0aa969e000d1835b2623128d6b4d585184b977c884176d1e1dbc9e8ee (14)EAP-Session-Id = 0x1954f85fa7840493a4abe8ee3c005b56ba8e198835115a1fef65c4e1ade3b674ac0ed3759d36b7b6033b489b000a4a6515eb1ec3ef719d7bf589cf8b132dba8b5c (14)EAP-Message = 0x030e0004 (14)Message-Authenticator = 0x00000000000000000000000000000000 (14)Tunnel-Type = VLAN (14)Tunnel-Medium-Type = IEEE-802 (14)Tunnel-Private-Group-Id = '200' Sending Access-Accept Id 14 from 139.2.35.240:1645 to 139.2.38.67:41678 User-Name = 'materna\ldapsearch' MS-MPPE-Recv-Key = 0x8973d3f59b6ce58227550444df27760f7bd43151d1367444e1883aa5288a99dd MS-MPPE-Send-Key = 0x1cc9775a68f9ed8715f7e50510981ea04330364949c228eb58a227a27352a440 EAP-Message = 0x030e0004 Message-Authenticator = 0x00000000000000000000000000000000 Tunnel-Type = VLAN Tunnel-Medium-Type = IEEE-802 Tunnel-Private-Group-Id = '200' (14) Finished request Thread 1 waiting to be assigned a request Waking up in 0.2 seconds. Waking up in 4.3 seconds. (0) Cleaning up request packet ID 0 with timestamp +2 (1) Cleaning up request packet ID 1 with timestamp +2 Kind regards. D. Stabla

2 1

PAP auth fails on new install/config of freeradius v 2.1.12
by John Williams 05 Mar '15

05 Mar '15

In the debug output freeradius –X I see the “WARNING: Please update your configuration and remove ‘Auth-Type = Local’” I have looked at all the config files and don’t seem to be finding Auth-Type = Local. I thought it should be found in sites-enabled/default Can someone please point me to where I’m missing that. <most of the freeradius –X> Ready to process requests. rad_recv: Access-Request packet from host 192.168.1.24 port 43300, id=231, length=41 User-Name = "t5admin" NAS-Port = 5060 NAS-IP-Address = 192.168.1.24 # Executing section authorize from file /etc/freeradius/sites-enabled/default +- entering group authorize {...} ++[preprocess] returns ok ++[chap] returns noop ++[mschap] returns noop ++[digest] returns noop [suffix] No '@' in User-Name = "t5admin", looking up realm NULL [suffix] No such realm "NULL" ++[suffix] returns noop [eap] No EAP-Message, not doing EAP ++[eap] returns noop [files] users: Matched entry t5admin at line 86 ++[files] returns ok ++[expiration] returns noop ++[logintime] returns noop [pap] No clear-text password in the request. Not performing PAP. ++[pap] returns noop WARNING: Please update your configuration, and remove 'Auth-Type = Local' WARNING: Use the PAP or CHAP modules instead. No User-Password or CHAP-Password attribute in the request. Cannot perform authentication. Failed to authenticate the user. Using Post-Auth-Type Reject # Executing group from file /etc/freeradius/sites-enabled/default +- entering group REJECT {...} [attr_filter.access_reject] expand: %{User-Name} -> t5admin attr_filter: Matched entry DEFAULT at line 11 ++[attr_filter.access_reject] returns updated Delaying reject of request 1 for 1 seconds Going to the next request Waking up in 0.9 seconds. Sending delayed reject for request 1 Sending Access-Reject of id 231 to 192.168.1.24 port 43300 Waking up in 4.9 seconds. Cleaning up request 1 ID 231 with timestamp +1703 Ready to process requests. TIA, John Williams -- *Thomas Edison once said, "The doctor of the future will give no medicine; instead he will interest his patients in the care of the human frame, nutrition and the cause and prevention of disease.”*

2 1

rlm_cache_memcached not installing
by Donald Sherker 05 Mar '15

05 Mar '15

I am using freeradius 3.0.7 and want to be able to use the rlm_cache_memcached driver to cache data between two servers. I have memcached, memcached-devel, libmemcached, and libmemcached-devel installed on the server. When I compile freeradius i get the following error: === configuring in ./drivers/rlm_cache_memcached (/tmp/freeradius-server-3.0.x/src/modules/rlm_cache/./drivers/rlm_cache_memcached) checking for gcc... gcc checking whether the C compiler works... yes checking for C compiler default output file name... a.out checking for suffix of executables... checking whether we are cross compiling... no checking for suffix of object files... o checking whether we are using the GNU C compiler... yes checking whether gcc accepts -g... yes checking for gcc option to accept ISO C89... none needed checking how to run the C preprocessor... gcc -E checking for libmemcached/memcached.h... yes checking for memcached in -lmemcached... no checking for memcached in -lmemcached in /usr/local/lib... no checking for memcached in -lmemcached in /opt/lib... no configure: WARNING: libmemcached libraries not found. Use --with-libmemcached-lib-dir=<path>. configure: WARNING: silently not building rlm_cache_memcached. configure: WARNING: FAILURE: rlm_cache_memcached requires: libmemcached . Here is the information on the memcached and libmemcached packages that are installed on the servers: ======================================================================================================== Package Arch Version Repository Size ======================================================================================================== Installing: memcached-devel x86_64 1.4.4-3.el6 base 8.8 k Installing for dependencies: memcached x86_64 1.4.4-3.el6 base 68 k ======================================================================================================== Package Arch Version Repository Size ======================================================================================================== Installing: libmemcached-devel x86_64 0.31-1.1.el6 base 116 k Installing for dependencies: libmemcached x86_64 0.31-1.1.el6 base 80 k I feel like I am missing something simple here and appreciate any help. Thanks, Don

2 1

Still battling to get FreeRadius running
by IT geek 31 05 Mar '15

05 Mar '15

Hi, When I try to run radiusd -X it hangs (no error) after instantiating the eap-tls module. I'm guessing it's having an issue with something, I just don't know what. Any thoughts? -Mark Debug output: FreeRADIUS Version 2.2.0, for host mipsel--netbsd, built on Mar 4 2015 at 18:04:29 Copyright (C) 1999-2012 The FreeRADIUS server project and contributors. There is NO warranty; not even for MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. You may redistribute copies of FreeRADIUS under the terms of the GNU General Public License v2. Starting - reading configuration files ... including configuration file /usr/pkg/etc/raddb/radiusd.conf including configuration file /usr/pkg/etc/raddb/proxy.conf including configuration file /usr/pkg/etc/raddb/clients.conf including files in directory /usr/pkg/etc/raddb/modules/ including configuration file /usr/pkg/etc/raddb/modules/acct_unique including configuration file /usr/pkg/etc/raddb/modules/always including configuration file /usr/pkg/etc/raddb/modules/attr_filter including configuration file /usr/pkg/etc/raddb/modules/attr_rewrite including configuration file /usr/pkg/etc/raddb/modules/chap including configuration file /usr/pkg/etc/raddb/modules/checkval including configuration file /usr/pkg/etc/raddb/modules/counter including configuration file /usr/pkg/etc/raddb/modules/detail including configuration file /usr/pkg/etc/raddb/modules/detail.example.com including configuration file /usr/pkg/etc/raddb/modules/detail.log including configuration file /usr/pkg/etc/raddb/modules/digest including configuration file /usr/pkg/etc/raddb/modules/echo including configuration file /usr/pkg/etc/raddb/modules/etc_group including configuration file /usr/pkg/etc/raddb/modules/exec including configuration file /usr/pkg/etc/raddb/modules/expiration including configuration file /usr/pkg/etc/raddb/modules/expr including configuration file /usr/pkg/etc/raddb/modules/files including configuration file /usr/pkg/etc/raddb/modules/inner-eap including configuration file /usr/pkg/etc/raddb/modules/ippool including configuration file /usr/pkg/etc/raddb/modules/krb5 including configuration file /usr/pkg/etc/raddb/modules/ldap including configuration file /usr/pkg/etc/raddb/modules/linelog including configuration file /usr/pkg/etc/raddb/modules/logintime including configuration file /usr/pkg/etc/raddb/modules/mac2ip including configuration file /usr/pkg/etc/raddb/modules/mac2vlan including configuration file /usr/pkg/etc/raddb/modules/mschap including configuration file /usr/pkg/etc/raddb/modules/otp including configuration file /usr/pkg/etc/raddb/modules/pam including configuration file /usr/pkg/etc/raddb/modules/pap including configuration file /usr/pkg/etc/raddb/modules/passwd including configuration file /usr/pkg/etc/raddb/modules/perl including configuration file /usr/pkg/etc/raddb/modules/policy including configuration file /usr/pkg/etc/raddb/modules/preprocess including configuration file /usr/pkg/etc/raddb/modules/radutmp including configuration file /usr/pkg/etc/raddb/modules/realm including configuration file /usr/pkg/etc/raddb/modules/smbpasswd including configuration file /usr/pkg/etc/raddb/modules/smsotp including configuration file /usr/pkg/etc/raddb/modules/sql_log including configuration file /usr/pkg/etc/raddb/modules/sqlcounter_expire_on_login including configuration file /usr/pkg/etc/raddb/modules/sradutmp including configuration file /usr/pkg/etc/raddb/modules/unix including configuration file /usr/pkg/etc/raddb/modules/wimax including configuration file /usr/pkg/etc/raddb/eap.conf including configuration file /usr/pkg/etc/raddb/policy.conf including files in directory /usr/pkg/etc/raddb/sites-enabled/ including configuration file /usr/pkg/etc/raddb/sites-enabled/default main { user = "radius" group = "radius" allow_core_dumps = no } including dictionary file /usr/pkg/etc/raddb/dictionary main { name = "radiusd" prefix = "/usr/pkg" localstatedir = "/var" sbindir = "/usr/pkg/sbin" logdir = "/var/log/radiusd" run_dir = "/var/run/radiusd" libdir = "/usr/pkg/lib" radacctdir = "/var/log/radiusd/radacct" hostname_lookups = no max_request_time = 30 cleanup_delay = 5 max_requests = 1024 pidfile = "/var/run/radiusd/radiusd.pid" checkrad = "/usr/pkg/sbin/checkrad" debug_level = 0 proxy_requests = yes log { stripped_names = no auth = no auth_badpass = no auth_goodpass = no } security { max_attributes = 200 reject_delay = 1 status_server = yes } } radiusd: #### Loading Realms and Home Servers #### proxy server { retry_delay = 5 retry_count = 3 default_fallback = no dead_time = 120 wake_all_if_all_dead = no } home_server localhost { ipaddr = 127.0.0.1 port = 1812 type = "auth" secret = "testing123" response_window = 20 max_outstanding = 65536 require_message_authenticator = yes zombie_period = 40 status_check = "status-server" ping_interval = 30 check_interval = 30 num_answers_to_alive = 3 num_pings_to_alive = 3 revive_interval = 120 status_check_timeout = 4 coa { irt = 2 mrt = 16 mrc = 5 mrd = 30 } } home_server_pool my_auth_failover { type = fail-over home_server = localhost } realm example.com { auth_pool = my_auth_failover } realm LOCAL { } radiusd: #### Loading Clients #### client localhost { ipaddr = 127.0.0.1 require_message_authenticator = no secret = "testing123" nastype = "other" } client ServerA { ipaddr = 192.168.1.2 require_message_authenticator = no secret = "testing123" nastype = "other" } radiusd: #### Instantiating modules #### instantiate { Module: Linked to module rlm_exec Module: Instantiating module "exec" from file /usr/pkg/etc/raddb/modules/exec exec { wait = no input_pairs = "request" shell_escape = yes } Module: Linked to module rlm_expr Module: Instantiating module "expr" from file /usr/pkg/etc/raddb/modules/expr Module: Linked to module rlm_expiration Module: Instantiating module "expiration" from file /usr/pkg/etc/raddb/modules/expiration expiration { reply-message = "Password Has Expired " } Module: Linked to module rlm_logintime Module: Instantiating module "logintime" from file /usr/pkg/etc/raddb/modules/logintime logintime { reply-message = "You are calling outside your allowed timespan " minimum-timeout = 60 } } radiusd: #### Loading Virtual Servers #### server { # from file /usr/pkg/etc/raddb/radiusd.conf modules { Module: Creating Auth-Type = digest Module: Creating Post-Auth-Type = REJECT Module: Checking authenticate {...} for more modules to load Module: Linked to module rlm_pap Module: Instantiating module "pap" from file /usr/pkg/etc/raddb/modules/pap pap { encryption_scheme = "auto" auto_header = no } Module: Linked to module rlm_chap Module: Instantiating module "chap" from file /usr/pkg/etc/raddb/modules/chap Module: Linked to module rlm_mschap Module: Instantiating module "mschap" from file /usr/pkg/etc/raddb/modules/mschap mschap { use_mppe = yes require_encryption = no require_strong = no with_ntdomain_hack = no allow_retry = yes } Module: Linked to module rlm_digest Module: Instantiating module "digest" from file /usr/pkg/etc/raddb/modules/digest Module: Linked to module rlm_unix Module: Instantiating module "unix" from file /usr/pkg/etc/raddb/modules/unix unix { radwtmp = "/var/log/radiusd/radwtmp" } Module: Linked to module rlm_eap Module: Instantiating module "eap" from file /usr/pkg/etc/raddb/eap.conf eap { default_eap_type = "md5" timer_expire = 60 ignore_unknown_eap_types = no cisco_accounting_username_bug = no max_sessions = 4096 } Module: Linked to sub-module rlm_eap_md5 Module: Instantiating eap-md5 Module: Linked to sub-module rlm_eap_leap Module: Instantiating eap-leap Module: Linked to sub-module rlm_eap_gtc Module: Instantiating eap-gtc gtc { challenge = "Password: " auth_type = "PAP" } Module: Linked to sub-module rlm_eap_tls Module: Instantiating eap-tls tls { rsa_key_exchange = no dh_key_exchange = yes rsa_key_length = 512 dh_key_length = 512 verify_depth = 0 CA_path = "/usr/pkg/etc/raddb/certs" pem_file_type = yes private_key_file = "/usr/pkg/etc/raddb/certs/server.pem" certificate_file = "/usr/pkg/etc/raddb/certs/server.pem" CA_file = "/usr/pkg/etc/raddb/certs/ca.pem" private_key_password = "whatever" dh_file = "/usr/pkg/etc/raddb/certs/dh" random_file = "/dev/random" fragment_size = 1024 include_length = yes check_crl = no cipher_list = "DEFAULT" make_cert_command = "/usr/pkg/etc/raddb/certs/bootstrap" ecdh_curve = "prime256v1" cache { enable = no lifetime = 24 max_entries = 255 } verify { } ocsp { enable = no override_cert_url = yes url = "http://127.0.0.1/ocsp/" use_nonce = yes timeout = 0 softfail = no } }

2 1

[Off Topic] Mysql system optimization to work with Freeradius
by Michell Antunes 05 Mar '15

05 Mar '15

Sorry for the off-topic, I have a problem with the authentication regarding the Radius with MySQL database. There are about 12k users who authenticate to 2 Radius servers and 1 MySQL. Accounting is done every 5 minutes and the IPs are in a PostgreSQL base. How much of the network is wireless during storms (I live in a tropical country) have to disconnect multiple users and when the station is restored have problems of "No DB Handles" which creates duplication of IP addresses in some cases. I have made some tests with various settings in MySQL, different file systems and when increasing the number of clients connecting to the system IO Wait begins to increase. When I make an appointment for an extract over a period of time a little bigger or my system performs the calculation of access franchise the situation worsens. See setups reports of Freeradius + MySQL in larger environments. Would advise evaluate PostgreSQL? Any suggestions to optimize the system? In the tests used a softraid (I know) and deactivated the Ext4 journaling on which gave me a good improvement. But do not feel comfortable working with the double filesystem + softraid, the more without journaling. I thank in advance the opinions on this subject. Under my system: OS: CentOS 7 Mem: 12G CPU: Xeon (R) CPU E5620 @ 2:40 BD: MariaDB 10.0.16 FS: EXT4 or XFS Raid: 10 (6 SATA disks 2TB 7200 RPM 64MB WD2003FYYS Cache SATA 3.0Gb / s) att Michell

4 3

Getting the following error - WARNING: Empty authorize section
by IT geek 31 05 Mar '15

05 Mar '15

Hi, I'm trying to do a simple PAP test on a fresh installation. When I fire up radiusd -X I get "Ready to process requests", but when I use radtest from another machine (defined in clients.conf) I get the following error: rad_recv: Access-Request packet from host 192.168.1.2 port 64983, id=105, length=74 User-Name = "test_user" User-Password = "test_pw" NAS-IP-Address = 192.168.1.2 NAS-Port = 0 Message-Authenticator = 0xb8f49c45c576d8eda5e8b0c6e4decb6c WARNING: Empty authorize section. Using default return values. ERROR: No authenticate method (Auth-Type) found for the request: Rejecting the user Failed to authenticate the user. Delaying reject of request 0 for 1 seconds Going to the next request Waking up in 0.9 seconds. Sending delayed reject for request 0 Sending Access-Reject of id 105 to 192.168.1.2 port 64983 Waking up in 4.9 seconds. This is a fresh build of 2.2.0 on NetBSD 5.2.2 (I can't go to 2.2.6 yet). I've not deleted anything, but my sites-enabled is empty. Should it be? As always, any help is appreciated. -Mark Full radiusd -X: FreeRADIUS Version 2.2.0, for host mipsel--netbsd, built on Mar 4 2015 at 18:04:29 Copyright (C) 1999-2012 The FreeRADIUS server project and contributors. There is NO warranty; not even for MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. You may redistribute copies of FreeRADIUS under the terms of the GNU General Public License v2. Starting - reading configuration files ... including configuration file /usr/pkg/etc/raddb/radiusd.conf including configuration file /usr/pkg/etc/raddb/proxy.conf including configuration file /usr/pkg/etc/raddb/clients.conf including files in directory /usr/pkg/etc/raddb/modules/ including configuration file /usr/pkg/etc/raddb/modules/acct_unique including configuration file /usr/pkg/etc/raddb/modules/always including configuration file /usr/pkg/etc/raddb/modules/attr_filter including configuration file /usr/pkg/etc/raddb/modules/attr_rewrite including configuration file /usr/pkg/etc/raddb/modules/chap including configuration file /usr/pkg/etc/raddb/modules/checkval including configuration file /usr/pkg/etc/raddb/modules/counter including configuration file /usr/pkg/etc/raddb/modules/detail including configuration file /usr/pkg/etc/raddb/modules/detail.example.com including configuration file /usr/pkg/etc/raddb/modules/detail.log including configuration file /usr/pkg/etc/raddb/modules/digest including configuration file /usr/pkg/etc/raddb/modules/echo including configuration file /usr/pkg/etc/raddb/modules/etc_group including configuration file /usr/pkg/etc/raddb/modules/exec including configuration file /usr/pkg/etc/raddb/modules/expiration including configuration file /usr/pkg/etc/raddb/modules/expr including configuration file /usr/pkg/etc/raddb/modules/files including configuration file /usr/pkg/etc/raddb/modules/inner-eap including configuration file /usr/pkg/etc/raddb/modules/ippool including configuration file /usr/pkg/etc/raddb/modules/krb5 including configuration file /usr/pkg/etc/raddb/modules/ldap including configuration file /usr/pkg/etc/raddb/modules/linelog including configuration file /usr/pkg/etc/raddb/modules/logintime including configuration file /usr/pkg/etc/raddb/modules/mac2ip including configuration file /usr/pkg/etc/raddb/modules/mac2vlan including configuration file /usr/pkg/etc/raddb/modules/mschap including configuration file /usr/pkg/etc/raddb/modules/otp including configuration file /usr/pkg/etc/raddb/modules/pam including configuration file /usr/pkg/etc/raddb/modules/pap including configuration file /usr/pkg/etc/raddb/modules/passwd including configuration file /usr/pkg/etc/raddb/modules/perl including configuration file /usr/pkg/etc/raddb/modules/policy including configuration file /usr/pkg/etc/raddb/modules/preprocess including configuration file /usr/pkg/etc/raddb/modules/radutmp including configuration file /usr/pkg/etc/raddb/modules/realm including configuration file /usr/pkg/etc/raddb/modules/smbpasswd including configuration file /usr/pkg/etc/raddb/modules/smsotp including configuration file /usr/pkg/etc/raddb/modules/sql_log including configuration file /usr/pkg/etc/raddb/modules/sqlcounter_expire_on_login including configuration file /usr/pkg/etc/raddb/modules/sradutmp including configuration file /usr/pkg/etc/raddb/modules/unix including configuration file /usr/pkg/etc/raddb/modules/wimax including configuration file /usr/pkg/etc/raddb/eap.conf including configuration file /usr/pkg/etc/raddb/policy.conf including files in directory /usr/pkg/etc/raddb/sites-enabled/ main { user = "radius" group = "radius" allow_core_dumps = no } including dictionary file /usr/pkg/etc/raddb/dictionary main { name = "radiusd" prefix = "/usr/pkg" localstatedir = "/var" sbindir = "/usr/pkg/sbin" logdir = "/var/log/radiusd" run_dir = "/var/run/radiusd" libdir = "/usr/pkg/lib" radacctdir = "/var/log/radiusd/radacct" hostname_lookups = no max_request_time = 30 cleanup_delay = 5 max_requests = 1024 pidfile = "/var/run/radiusd/radiusd.pid" checkrad = "/usr/pkg/sbin/checkrad" debug_level = 0 proxy_requests = yes log { stripped_names = no auth = no auth_badpass = no auth_goodpass = no } security { max_attributes = 200 reject_delay = 1 status_server = yes } } radiusd: #### Loading Realms and Home Servers #### proxy server { retry_delay = 5 retry_count = 3 default_fallback = no dead_time = 120 wake_all_if_all_dead = no } home_server localhost { ipaddr = 127.0.0.1 port = 1812 type = "auth" secret = "testing123" response_window = 20 max_outstanding = 65536 require_message_authenticator = yes zombie_period = 40 status_check = "status-server" ping_interval = 30 check_interval = 30 num_answers_to_alive = 3 num_pings_to_alive = 3 revive_interval = 120 status_check_timeout = 4 coa { irt = 2 mrt = 16 mrc = 5 mrd = 30 } } home_server_pool my_auth_failover { type = fail-over home_server = localhost } realm example.com { auth_pool = my_auth_failover } realm LOCAL { } radiusd: #### Loading Clients #### client localhost { ipaddr = 127.0.0.1 require_message_authenticator = no secret = "testing123" nastype = "other" } client serverA { ipaddr = 192.168.1.2 require_message_authenticator = no secret = "testing123" nastype = "other" } radiusd: #### Instantiating modules #### instantiate { Module: Linked to module rlm_exec Module: Instantiating module "exec" from file /usr/pkg/etc/raddb/modules/exec exec { wait = no input_pairs = "request" shell_escape = yes } Module: Linked to module rlm_expr Module: Instantiating module "expr" from file /usr/pkg/etc/raddb/modules/expr Module: Linked to module rlm_expiration Module: Instantiating module "expiration" from file /usr/pkg/etc/raddb/modules/expiration expiration { reply-message = "Password Has Expired " } Module: Linked to module rlm_logintime Module: Instantiating module "logintime" from file /usr/pkg/etc/raddb/modules/logintime logintime { reply-message = "You are calling outside your allowed timespan " minimum-timeout = 60 } } radiusd: #### Loading Virtual Servers #### server { # from file /usr/pkg/etc/raddb/radiusd.conf modules { } # modules } # server radiusd: #### Opening IP addresses and Ports #### listen { type = "auth" ipaddr = * port = 0 } listen { type = "acct" ipaddr = * port = 0 } ... adding new socket proxy address * port 64982 Listening on authentication address * port 1812 Listening on accounting address * port 1813 Listening on proxy address * port 1814 Ready to process requests.

2 2

Failed to link to module 'rlm_exec': file not found
by IT geek 31 05 Mar '15

05 Mar '15

Hi, I'm having trouble running FreeRadius 2.2.0 on NetBSD. I've compiled using *pkgsrc*, and it builds and installs perfectly. However, when I run radiusd -X I get the following: FreeRADIUS Version 2.2.0, for host mipsel--netbsd, built on Mar 4 2015 at 18:04:29 Copyright (C) 1999-2012 The FreeRADIUS server project and contributors. There is NO warranty; not even for MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. You may redistribute copies of FreeRADIUS under the terms of the GNU General Public License v2. Starting - reading configuration files ... including configuration file /usr/pkg/etc/raddb/radiusd.conf including configuration file /usr/pkg/etc/raddb/proxy.conf including configuration file /usr/pkg/etc/raddb/clients.conf including files in directory /usr/pkg/etc/raddb/modules/ including configuration file /usr/pkg/etc/raddb/modules/acct_unique including configuration file /usr/pkg/etc/raddb/modules/always including configuration file /usr/pkg/etc/raddb/modules/attr_filter including configuration file /usr/pkg/etc/raddb/modules/attr_rewrite including configuration file /usr/pkg/etc/raddb/modules/chap including configuration file /usr/pkg/etc/raddb/modules/checkval including configuration file /usr/pkg/etc/raddb/modules/counter including configuration file /usr/pkg/etc/raddb/modules/detail including configuration file /usr/pkg/etc/raddb/modules/detail.example.com including configuration file /usr/pkg/etc/raddb/modules/detail.log including configuration file /usr/pkg/etc/raddb/modules/digest including configuration file /usr/pkg/etc/raddb/modules/echo including configuration file /usr/pkg/etc/raddb/modules/etc_group including configuration file /usr/pkg/etc/raddb/modules/exec including configuration file /usr/pkg/etc/raddb/modules/expiration including configuration file /usr/pkg/etc/raddb/modules/expr including configuration file /usr/pkg/etc/raddb/modules/files including configuration file /usr/pkg/etc/raddb/modules/inner-eap including configuration file /usr/pkg/etc/raddb/modules/ippool including configuration file /usr/pkg/etc/raddb/modules/krb5 including configuration file /usr/pkg/etc/raddb/modules/ldap including configuration file /usr/pkg/etc/raddb/modules/linelog including configuration file /usr/pkg/etc/raddb/modules/logintime including configuration file /usr/pkg/etc/raddb/modules/mac2ip including configuration file /usr/pkg/etc/raddb/modules/mac2vlan including configuration file /usr/pkg/etc/raddb/modules/mschap including configuration file /usr/pkg/etc/raddb/modules/otp including configuration file /usr/pkg/etc/raddb/modules/pam including configuration file /usr/pkg/etc/raddb/modules/pap including configuration file /usr/pkg/etc/raddb/modules/passwd including configuration file /usr/pkg/etc/raddb/modules/perl including configuration file /usr/pkg/etc/raddb/modules/policy including configuration file /usr/pkg/etc/raddb/modules/preprocess including configuration file /usr/pkg/etc/raddb/modules/radutmp including configuration file /usr/pkg/etc/raddb/modules/realm including configuration file /usr/pkg/etc/raddb/modules/smbpasswd including configuration file /usr/pkg/etc/raddb/modules/smsotp including configuration file /usr/pkg/etc/raddb/modules/sql_log including configuration file /usr/pkg/etc/raddb/modules/sqlcounter_expire_on_login including configuration file /usr/pkg/etc/raddb/modules/sradutmp including configuration file /usr/pkg/etc/raddb/modules/unix including configuration file /usr/pkg/etc/raddb/modules/wimax including configuration file /usr/pkg/etc/raddb/eap.conf including configuration file /usr/pkg/etc/raddb/policy.conf including files in directory /usr/pkg/etc/raddb/sites-enabled/ main { user = "radius" group = "radius" allow_core_dumps = no } including dictionary file /usr/pkg/etc/raddb/dictionary main { name = "radiusd" prefix = "/usr/pkg" localstatedir = "/var" sbindir = "/usr/pkg/sbin" logdir = "/var/log/radiusd" run_dir = "/var/run/radiusd" libdir = "/usr/pkg/lib" radacctdir = "/var/log/radiusd/radacct" hostname_lookups = no max_request_time = 30 cleanup_delay = 5 max_requests = 1024 pidfile = "/var/run/radiusd/radiusd.pid" checkrad = "/usr/pkg/sbin/checkrad" debug_level = 0 proxy_requests = yes log { stripped_names = no auth = no auth_badpass = no auth_goodpass = no } security { max_attributes = 200 reject_delay = 1 status_server = yes } } radiusd: #### Loading Realms and Home Servers #### proxy server { retry_delay = 5 retry_count = 3 default_fallback = no dead_time = 120 wake_all_if_all_dead = no } home_server localhost { ipaddr = 127.0.0.1 port = 1812 type = "auth" secret = "testing123" response_window = 20 max_outstanding = 65536 require_message_authenticator = yes zombie_period = 40 status_check = "status-server" ping_interval = 30 check_interval = 30 num_answers_to_alive = 3 num_pings_to_alive = 3 revive_interval = 120 status_check_timeout = 4 coa { irt = 2 mrt = 16 mrc = 5 mrd = 30 } } home_server_pool my_auth_failover { type = fail-over home_server = localhost } realm example.com { auth_pool = my_auth_failover } realm LOCAL { } radiusd: #### Loading Clients #### client localhost { ipaddr = 127.0.0.1 require_message_authenticator = no secret = "testing123" nastype = "other" } radiusd: #### Instantiating modules #### instantiate { /usr/pkg/etc/raddb/modules/exec[24]: Failed to link to module 'rlm_exec': file not found The file */usr/pkg/etc/raddb/modules/exec* does indeed exist, and is owned by radius:radius and is chmod 640. The end-game is to get this authenticating Wireless EAP clients. I'd just to get it running so I can test PAP authentication first :-) Any help is greatly appreciated! -Mark

2 6

freeradius and the current date
by Graham Leggett 05 Mar '15

05 Mar '15

Hi all, I am looking to perform an LDAP search in freeradius that includes the option to specify users that have not expired, where expiry is contained an a standard LDAP attribute. Something similar to this: (&(uid=%{User-Name})(myExpiryTimestamp>=%{[TIMESTAMP_NOW]})) (In other words, I am looking for a suitable unlang attribute that represents “time now on radius server”) The closest I’ve found are these deprecated one character variables as follows: http://wiki.freeradius.org/config/Run%20time%20variables Unfortunately they are marked as deprecated with no indication of what replaces them. The source code for rlm_date seems to indicate that date formatting is possible, but there is no functionality that I can see to provide the current date, which is a shame. Should this module be a good place for this kind of functionality or should I be looking somewhere else for this? Regards, Graham —

4 7

Unable to use regexp in virtual server
by "RESTOUX, Loïc" 05 Mar '15

05 Mar '15

Hi everyone, I checked out the 3.0.x branch this morning, and I can't get it working. Part of the configuration is: authorize { [...] foreach Cisco-AVPair { if ("%{Foreach-Variable-0}" =~ /^circuit-id-tag=(.+)/ ) { <do something> } } [...] } The startup fails with the following error: <file>[38]: Invalid regular expression: <file>[38]: ^circuit-id-tag=(.+) <file>[38]: ^ Apparently, the failure comes from the computation of the size of the pattern. regex_compile() tries to find a NULL value in the 23 characters of the regexp, when obviously the length of the pattern is only 20. Am I missing something in the syntax of the virtual server configuration ? -- LRS This message contains information that may be privileged or confidential and is the property of the Capgemini Group. It is intended only for the person to whom it is addressed. If you are not the intended recipient, you are not authorized to read, print, retain, copy, disseminate, distribute, or use this message or any part thereof. If you receive this message in error, please notify the sender immediately and delete all copies of this message.

2 1