April 2015 - Freeradius-Users - lists.freeradius.org

Version 2.2.7 has been released
by Alan DeKok 22 Apr '15

22 Apr '15

We've also release version 2.2.7. The ChangeLog is short. We hope that this will be the last release of the version 2 software. From now on, the only changes to version 2 will be security fixes, and critical bug fixes. We hope that everyone upgrades to version 3 over the next year. FreeRADIUS 2.2.7 Wednesday 22 Apr 2014 14:00:00 EST, urgency=medium Feature improvements * Allow "eap" to be listed in Post-Auth-Type Reject so that it sends EAP-Fail and Message-Authenticator. Bug fixes * Fix typo in code checking for blocked threads. Closes #880. * Added more $(EXEEXT) to module utilities so that it builds on Cygwin. Closes #875. * Note that we don't need to generate ephemeral RSA keys. * Port detail file fixes from v3. * Use correct destination port for replies to DHCP relay. * rlm_perl can store multiple tagged attributes of the same name. * Update EAP-TLS methods for TLSv1.2 * Fix load-balance sections. Closes #945

1 0

attr_filter rule evaluation
by Gerald Vogt 22 Apr '15

22 Apr '15

Hi! >From the documentation I find it a little bit confusing how filter rules work exactly. The manual page rlm_attr_filter says: "The rules for each entry are parsed to top to bottom, and an attribute must pass *all* the rules which affect it in order to make it past the filter." The post-proxy file contains this: DEFAULT Service-Type == Framed-User, Service-Type == Login-User, Login-Service == Telnet, Login-Service == Rlogin, Login-Service == TCP-Clear, Login-TCP-Port <= 65536, ... But if it has to pass all the rules doesn't that mean that Service-Type and Login-Service are basically always filtered out because, for instance, for a single valued Service-Type attribute either the first or second rule will always fail. And as there is always one rule failing it will never make it past the filter. Thanks, Gerald

2 4

Re: Freeradius-Users Digest, Vol 120, Issue 91
by Rui Ribeiro 22 Apr '15

22 Apr '15

Yes, use the git for now. I can confirm I never used in production 3.0.7 because of this issue, and the git 3.0.8 has been rock solid for a while and seems to be faster too. > > > Message: 3 > Date: Wed, 22 Apr 2015 06:49:19 -0400 > From: Alan DeKok <aland(a)deployingradius.com> > To: FreeRadius users mailing list > <freeradius-users(a)lists.freeradius.org> > Subject: Re: dynamic expansion will not be dynamically expanded in > ldap configuration > Message-ID: <0B8AC4C2-9E60-4C66-9DDA-DED45F33948B(a)deployingradius.com> > Content-Type: text/plain; charset=us-ascii > > On Apr 22, 2015, at 3:19 AM, Angel L. Mateo <amateo(a)um.es> wrote: > > I'm trying to configure ldap module for freeradius. For group > membership I have this configuration: > > > > membership_filter = "(&(uid=%{User-Name})(objectClass=posixAccount))" > > > > but whenever I start freeradius, I get the error > > > > /etc/freeradius/mods-enabled/ldap[176]: Found dynamic expansion in > string which will not be dynamically expanded > > It's an issue which was fixed, and will be in 3.0.8. > > Alan DeKok. > > > > -- Regards, -- Rui Ribeiro Senior Sysadm ISCTE-IUL https://www.linkedin.com/pub/rui-ribeiro/16/ab8/434

1 0

Time users
by sandy.napoles＠eccmg.cupet.cu 22 Apr '15

22 Apr '15

Hello list, Iam using freeradius with Active directory. Everythings is ok. but I need to put time users, example only connect at a specific time. I try to put it in iptables rules, but when I put this rules nobody can connect. example $IPTABLES -A OUTPUT -d x.x.x.x -p tcp -m multiport --sports 1812,1813 -m time --timestart 00:00 --timestop 20:00 --weekdays Sun,Mon,Tue,Wed,Thu,Fri,Sat -j ACCEPT Thereis some file in freeradius that make it..???

2 1

buffered-sql pool_interval
by Marcin 22 Apr '15

22 Apr '15

Hi, Are there any solution to increas pool_interval up to 300s? -- Pozdrawiam Marcin / nicraM

2 4

Access Challenge (11) reply
by Olivier Nicole 22 Apr '15

22 Apr '15

Hello, My FreeRadius 2.2 is trying to proxy authentication to another radius server, but the reply I get is Access Challenge (11). I tried to google for that error but really get nothing. Here a tcpdump of the dialogue: 14:16:13.266719 00:0c:29:34:75:1c (oui Unknown) > f0:4d:a2:0c:0f:a3 (oui Unknown), ethertype IPv4 (0x0800), length 198: ldap.cs.ait.ac.th.1647 > eduroam-th.uni.net.th.radius: RADIUS, Access Request (1), id: 0x3b length: 156 0x0000: 4500 00b8 65a8 0000 4011 703a c029 aa06 E...e...@.p:.).. 0x0010: ca1c 7006 066f 0714 00a4 a508 013b 009c ..p..o.......;.. 0x0020: 346b 4b04 1c8b 6239 fe62 aecb faf8 f099 4kK...b9.b...... 0x0030: 0116 6775 6573 742d 6169 7440 756e 692e ..guest-ait@uni. 0x0040: 6e65 742e 7468 etc. hidden forsecurity net.th etc. 14:16:13.271033 f0:4d:a2:0c:0f:a3 (oui Unknown) > 00:0c:29:34:75:1c (oui Unknown), ethertype IPv4 (0x0800), length 109: eduroam-th.uni.net.th.radius > ldap.cs.ait.ac.th.1647: RADIUS, Access Challenge (11), id: 0x3b length: 67 0x0000: 4500 005f 1f3c 0000 3b11 bbff ca1c 7006 E.._.<..;.....p. 0x0010: c029 aa06 0714 066f 004b 7aea 0b3b 0043 .).....o.Kz..;.C 0x0020: a618 0ac0 99f6 2162 8997 7996 d6bc b5b7 ......!b..y..... 0x0030: 4f08 0102 0006 1920 5012 e641 225b 62b6 O.......P..A"[b. 0x0040: 9910 a5ed e9e7 6a4a fbad 1812 3dfc 0c96 ......jJ....=... 0x0050: 3dfe 1591 41d5 e623 3bab acf5 2103 30 =...A..#;...!.0 The other party seems even more cluless than I am so I really don't know where to seek for enlightment. Thanks in advance, Olivier --

2 1

802.1x with Cisco wireless controller
by Mohammad H. Al Shami 21 Apr '15

21 Apr '15

Hi all, I have been asked to integrate our Cisco WLC2504 wireless controller with Active Directory through LDAP. It is currently working well with Microsoft's radius server. For some reason while running radiusd -X, I can see the requests coming from the access controller but nothing happens after a "Sent Access-Challenge" message. But if I wait some time without doing anything, the authentication works. What is puzzling me is the fact that the connection sometimes works but not always, also, I got a TP-Link running OpenWRT and set up WiFi to work with the same radius setup. It works properly. Am I missing anything guys? Here are the client sections for both client cisco { ipaddr = 192.168.0.240 secret = 123456 nas_type = cisco } client openwrt { ipaddr = 192.168.0.33 secret = 123456 }

6 12

config section in rlm_perl module
by Peter Balsianok 21 Apr '15

21 Apr '15

Hi, I am not able to use %RAD_PERLCONF during parsing phase of radius.pm. I understand why, because section config (rlm_perl) is parsed after parsing radius.pm itself. Therefore i am able to set up global constant based on freeradius configuration. Is it correct behaviour ? Piece of radius.pm code: ... # Hashes with request / reply parameters use vars qw(%RAD_PERLCONF %RAD_REQUEST %RAD_REPLY %RAD_CHECK %RAD_REQUEST_PROXY %RAD_REQUEST_PROXY_REPLY); use constant LOG_DIR => $RAD_PERLCONF{'logdir'}; (line 47) use constant LOG_FILENAME => LOG_DIR().$RAD_PERLCONF{'name'}.'.gen'; use constant RADIUS_RADDB_DIR => $RAD_PERLCONF{'confdir'}; ... Debug output (freeradius 3.0.7): .... radiusd: #### Instantiating modules #### instantiate { # Loaded module rlm_perl # Instantiating module "perl" from file ./mods-enabled/perl perl { filename = "./mods-config/perl/radius.pm" func_authorize = "authorize" func_authenticate = "authenticate" func_post_auth = "post_auth" func_accounting = "accounting" func_preacct = "preacct" func_checksimul = "checksimul" func_detach = "detach" func_xlat = "xlat" func_pre_proxy = "pre_proxy" func_post_proxy = "post_proxy" func_recv_coa = "recv_coa" func_send_coa = "send_coa" } Use of uninitialized value in concatenation (.) or string at ./mods-config/perl/radius.pm line 47, <DATA> line 751. rlm_perl (perl): parsing 'config' section... config { logdir = /app_log/radius/auth/ confdir = ./ name = auth } rlm_perl (perl): done parsing 'config'.

3 6

Documentation
by Alan DeKok 21 Apr '15

21 Apr '15

We've been working behind the scenes to create more documentation for the server. Every new version from 3.0.7 onwards will have new documentation added to the site http://networkradius.com/doc/. Documentation for the old versions will be archived, but not updated. We've added some more documentation for 3.0.8. More modules are there, and we've expanded / updated the documentation for the existing modules. I've also updated the main page on freeradius.org. Apparently the "documentation" tab in the page header was hard to find. I've added a section called "Documentation", and written text pointing to the various things available. Since the largest complaint is about concepts, the first link is to the technical guide available from Network RADIUS. I've also added links to "unlang" keywords, and to documentation for each module. The documentation for each module describes what the module does, which processing sections it can be used in, what values it returns, along with the configuration items it takes. It also points to the default configuration on github, for people who want worked examples. Many modules also include short examples in their documentation page. Astute readers will note that much of the new documentation is on the commercial site. The reality is that it takes months of effort and professional copy editing to get high-quality documentation. That investment was done by Network RADIUS, so that's where the documentation resides. The FreeRADIUS wiki is still available. It contains many "how to" guides, which serve a different purpose from the detailed configuration documentation. The wiki will continue to exist, and we will still accept any and all useful patches for documentation updates. However, the *detailed* documentation on unlang, modules, string expansions, debugging guides, etc. will only be on the commercial side. As head of Network RADIUS, I'm investing not only in developing more code for the server, I'm also investing in documentation for it, too. The commercial documentation is available for free, and will always be free. It's one more contribution I can make to the community. Alan DeKok.

6 5

Freeradius rate limit
by Fazal Ahmed Malik 21 Apr '15

21 Apr '15

Dear members, I am using freeradius with mikrotik nas. Mikrotik rate limit is not working rest all is working just fine. Mikrotik rate limit work fine with mikrotik builtin radius but when I shifted to freeradius no rate limit works. Any help is much appreciated. Thanks, FAM

3 2