May 2015 - Freeradius-Users - lists.freeradius.org

Newbie question... using different authentication sources?
by José Queiroz 25 May '15

25 May '15

Hi, I'm trying to set up a freeradius server to serve two clients, each of them an independent wireless network. The first one uses WPA2-Enterprise, and is expected to authenticate our users based on our internal LDAP server. The second one is a guest/open network, where users will pass their credentials in a captive portal, and are expected to be authenticated by a MySQL database. Problem is, both networks are covering the same area, and users of one of them is not allowed to use the other. I tried to set up radiusd.conf to include the appropriate modules, but I noticed that if the user sends a valid credential in the wrong network, it still gets authenticated. So, how can I enforce that users from NAS-IP-Address 1 get authenticated only by MySQL, and NAS-IP-Address 2 only on LDAP? I'm using FreeRADIUS 1.1.7 on Suse SLES 10 SP4. I have some machines with SLES 11 SP3, which will give me FreeRADIUS 2.1.1, but I prefer not using them by now, for several reasons.

4 9

Can't load LDAP groups 3.0.7
by Dave Aldwinckle 25 May '15

25 May '15

Hi All, I am trying to reconfigure from version 2.1.12 to 3.0.7 and I am having an issue checking LDAP groups in the post-auth section. I'm doing EAP-PEAP for authentication, and I want to check for group membership in post-auth, and assign a VLAN. I've tried putting the check in post-auth of "inner-tunnel" as well as post-auth of "default". The result was the same. I'm expecting to see a comparison of all the users groups with the one I have specified, but that does not occur. I do see a successful search for the user: rlm_ldap (ldap): Reserved connection (4) (8) ldap: EXPAND (samaccountname=%{%{Stripped-User-Name}:-%{User-Name}}) (8) ldap: --> (samaccountname=daldwinc) (8) ldap: Performing search in "x" with filter "(samaccountname=user1)", scope "sub" (8) ldap: Waiting for search result... (8) ldap: User object found at DN "CN=David A (x),x" (8) ldap: Processing user attributes (8) ldap: WARNING: No "known good" password added. Ensure the admin user has permission to read the password attribute (8) ldap: WARNING: PAP authentication will *NOT* work with Active Directory (if that is what you were trying to configure) rlm_ldap (ldap): Released connection (4) (8) [ldap] = ok 2.1.12 LDAP config: ldap x.ldap { server = "x" identity = "x" port = 636 password = x basedn = "dc=x" filter = "(samaccountname=%{%{Stripped-User-Name}:-%{User-Name}})" ldap_connections_number = 50 timeout = 20 timelimit = 20 net_timeout = 10 tls { start_tls = no } dictionary_mapping = ${confdir}/ldap.attrmap password_attribute = userPassword edir_account_policy_check = no groupname_attribute = cn groupmembership_filter = "(memberof=%{control:Ldap-UserDn})(&(objectClass=GroupOfUniqueNames)(uniquemember=%{control:Ldap-UserDn}))" groupmembership_attribute = memberof set_auth_type = yes } 3.0.7 LDAP config: ldap { server = 'x' port = 389 identity = 'x' password = x base_dn = 'x' update { control:Password-With-Header += 'userPassword' control: += 'radiusCheckAttributes' reply: += 'radiusReplyAttributes' } user { base_dn = 'x' filter = "(samaccountname=%{%{Stripped-User-Name}:-%{User-Name}})" } group { base_dn = 'x' filter = '(objectClass=posixGroup)' membership_filter = "(memberof=%{control:Ldap-UserDn})(&(objectClass=GroupOfUniqueNames)(uniquemember=%{control:Ldap-UserDn}))" membership_attribute = 'memberOf' } profile { } client { base_dn = 'x' filter = '(objectClass=radiusClient)' attribute { ipaddr = 'radiusClientIdentifier' secret = 'radiusClientSecret' } } options { chase_referrals = yes rebind = yes timeout = 10 timelimit = 3 net_timeout = 1 idle = 60 probes = 3 interval = 3 ldap_debug = 0x0028 } tls { start_tls = yes ca_file = ${certdir}/ca.pem ca_path = ${certdir} certificate_file = ${certdir}/x.ca-2015-12.crt private_key_file = ${certdir}/x.ca.key } pool { start = 5 min = 4 max = ${thread[pool].max_servers} spare = 3 uses = 0 lifetime = 0 idle_timeout = 60 retry_delay = 1 } } /etc/raddb/sites-enabled/inner-tunnel: server inner-tunnel { listen { ipaddr = 127.0.0.1 port = 18120 type = auth } authorize { chap mschap suffix update control { &Proxy-To-Realm := LOCAL } eap { ok = return } files -sql -ldap expiration logintime pap } authenticate { Auth-Type PAP { pap } Auth-Type CHAP { chap } Auth-Type MS-CHAP { mschap } eap } session { radutmp } post-auth { -sql ldap if (ldap-LDAP-Group == group1 ) { update reply { Aruba-User-Vlan := 1020 } } Post-Auth-Type REJECT { -sql attr_filter.access_reject update outer.session-state { Module-Failure-Message := &request:Module-Failure-Message } } } pre-proxy { } post-proxy { eap } Debug excerpt (forgive me for not including the full output, its very cumbersome to sanitize.) (8) # Executing section post-auth from file /etc/raddb/sites-enabled/inner-tunnel (8) post-auth { (8) [ldap] = noop (8) if (ldap-LDAP-Group == group1 ) { (8) if (ldap-LDAP-Group == group1 ) -> FALSE (8) } # post-auth = noop Thanks in advance, Dave -- Dave Aldwinckle

2 3

Acct-Authentic in Accounting-On and Accounting-Off forms of Accounting-Request. Valid?
by Nick Lowe 25 May '15

25 May '15

Hi all, I have been assisting Aerohive with an interop issue with Cisco's ACS whereby that RADIUS server would drop/reject the Accounting-On and Accounting-Off forms of Accounting-Request packets that Aerohive's APs are sending, spamming the log with the following error: "RADIUS packet contains invalid attribute(s)" A quick look at this showed that they were including the Acct-Terminate-Cause attribute in the Accounting-On and Accounting-Off forms of Accounting-Request packet which, by spec, is strictly invalid: 5.10. Acct-Terminate-Cause Description This attribute indicates how the session was terminated, and can only be present in Accounting-Request records where the Acct- Status-Type is set to Stop. Aerohive have now fixed this in a forthcoming software update that should resolve the interop issue. >From reviewing that, I had a related question about the Acct-Authentic attribute in Accounting-On and Accounting-Off. Aerohive are presently including this too. Is this valid? The spec says: 5.6. Acct-Authentic Description This attribute MAY be included in an Accounting-Request to indicate how the user was authenticated, whether by RADIUS, the NAS itself, or another remote authentication protocol. Users who are delivered service without being authenticated SHOULD NOT generate Accounting records. >From my reading, it appears to only be semantically valid in the context of a session and therefore it should not be present. Other vendors, such as Ruckus, do however document that they include this attribute in Accounting-On and Accounting-Off: http://a030f85c1e25003d7609-b98377aee968aad08453374eb1df3398.r40.cf2.rackcd… (Ruckus also document that they are not including a Called-Station-Id in their Accounting-On and Accounting-Off with the BSSID/SSID, scoping instead to a SSID with a 'Ruckus-SSID' VSA, yuck!) It appears to be a grey area therefore. Is there a legitimate purpose to including this attribute here? Should it be removed from such packets? Cheers, Nick

3 19

Accounting redundancy
by Ricardo Larrañaga 25 May '15

25 May '15

Hello Everyone: I am planning on deploying freeradius on a redundancy configuration. It will be runing under linux, and freeradius version is 3.0.4 In the simplest configuration, i would have two servers. Redundancy for the authentication database will be done via master-slave replication on the database side. I would like to implement redundancy on the accounting database using copy-acct-to-home-server. >From what i understand, i should be able to maintain identical copies of the accounting tables this way, and i would be able to accomplish simultaneous use check, which would be desirable. Now, first of all, each of the servers have a local accounting database, and i am writing to the database using an sql_buffered server. This works great. Now, reading through the forums, i understand that having several readers reading on the same accounting file can bring unpredictable results, is this the case? In that case, can these two functions work together? Also is this kind of configuration scalable to more than two servers? I am wondering how can i configure each server to send the packets to 2 or more different servers at the same time (In the case i would like to increase to 3 servers, or even more) Any comments or recommendations would be appreciated. Regards!

2 3

missing coredump file
by Peter Balsianok 22 May '15

22 May '15

Hi, I have this setup: Freeradius is running as normal user (has permission to write file) In the radiusd.conf: allow_core_dumps = yes radiusd@tdrad freeradius-server-2.2.5]$ cat /etc/redhat-release Red Hat Enterprise Linux Server release 5.11 (Tikanga) [radiusd@tdrad freeradius-server-2.2.5]$ ulimit -c unlimited [radiusd@tdrad freeradius-server-2.2.5]$ cat /proc/sys/fs/suid_dumpable 1 [radiusd@tdrad freeradius-server-2.2.5]$ head -30 config.log .. $ ./configure --enable-developer .. ... Unfortunately no coredump is created (in case of any issue with freeradius. For testing i use kill -SIGABRT [pid] or kill -11 [pid] Thx for help.

3 3

FR + EAP-GTC + LDAP (SHA1)
by gabriel_skupien 22 May '15

22 May '15

Hi, The aim and assumptions: -configure FR to authenticate users against OpenLDAP server, -FR would use EAP method, -passwords in LDAP are stored as SHA1, -according to http://deployingradius.com/documents/protocols/compatibility.html the only way to deal with LDAP auth is to use PAP or EAP-GTC. Since client forces EAP method we have no choice than EAP-GTC. Is that correct? -clients are EAP-GTC capable, -FR v2.2.6. After some hours in my lab I finished with the following FR config: 1) in eap.conf: -in eap general settings I set default_eap_type to "gtc" -in gtc section I put "auth_type = LDAP". 2) in sites-enabled/default: -authorize section - not touched, -authentication section - uncomment "Auth-Type LDAP { ldap }", And it is working fine! Now, the questions: a) I am afraid about your comments in gtc section. It stands that: # Currently, this is only permitted inside of EAP-TTLS, # or EAP-PEAP. The module "challenges" the user with # text, and the response from the user is taken to be # the User-Password. # # Proxying the tunneled EAP-GTC session is a bad idea, # the users password will go over the wire in plain-text, # for anyone to see. Can I use eap-gtc "alone" without PEAP/TTLS? Secure tunnel is delivered via IPsec connection so I do not bother about security in that case. What is your opinion? b) How would you configure FR to meet mentioned above requirements? Gabriel

2 7

Re: FreeRadius 3.0.4 | Failed to find "sql" in the "modules" section
by Larry Cataina 22 May '15

22 May '15

Dear FreeRADIUS, Greetings! I am a newbie linux system admin. I had setup freeradius 3.04 and tried to use DaloRadius for web management, however I am facing issue as not able to start the radius. error: ****** /etc/raddb/sites-enabled/default[372]: Failed to find "sql" in the "modules" section. /etc/raddb/sites-enabled/default[254]: Errors parsing authorize section. ****** With the freeradius only, it is working. I do understand modules folder had been changed in version 3.0.4. Already uncommented the most sql in mods-available. I appreciate if you can help me how to fix it. I had attached the radiusD -X logs for your reference. Looking forward for your reply. Thanks ============= [root@pacific-technology raddb]# service radiusd start Redirecting to /bin/systemctl start radiusd.service Job for radiusd.service failed. See 'systemctl status radiusd.service' and 'journalctl -xn' for details. [root@pacific-technology raddb]# systemctl status radiusd.service radiusd.service - FreeRADIUS high performance RADIUS server. Loaded: loaded (/usr/lib/systemd/system/radiusd.service; enabled) Active: failed (Result: exit-code) since Fri 2015-05-22 14:17:51 HKT; 12s ago Process: 7050 ExecStartPre=/usr/sbin/radiusd -C (code=exited, status=1/FAILURE) Process: 7048 ExecStartPre=/bin/chown -R radiusd.radiusd /var/run/radiusd (code=exited, status=0/SUCCESS) May 22 14:17:51 pacific-technology systemd[1]: Starting FreeRADIUS high performance RADIUS server.... May 22 14:17:51 pacific-technology systemd[1]: radiusd.service: control process exited, code=exited status=1 May 22 14:17:51 pacific-technology systemd[1]: Failed to start FreeRADIUS high performance RADIUS server.. May 22 14:17:51 pacific-technology systemd[1]: Unit radiusd.service entered failed state. [root@pacific-technology raddb]# radiusd -X radiusd: FreeRADIUS Version 3.0.4, for host x86_64-redhat-linux-gnu, built on Mar 5 2015 at 23:41:36 Copyright (C) 1999-2014 The FreeRADIUS server project and contributors There is NO warranty; not even for MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE You may redistribute copies of FreeRADIUS under the terms of the GNU General Public License For more information about these matters, see the file named COPYRIGHT Starting - reading configuration files ... including dictionary file /usr/share/freeradius/dictionary including dictionary file /usr/share/freeradius/dictionary.dhcp including dictionary file /usr/share/freeradius/dictionary.vqp including dictionary file /etc/raddb/dictionary including configuration file /etc/raddb/radiusd.conf including configuration file /etc/raddb/proxy.conf including configuration file /etc/raddb/clients.conf including files in directory /etc/raddb/mods-enabled/ including configuration file /etc/raddb/mods-enabled/always including configuration file /etc/raddb/mods-enabled/attr_filter including configuration file /etc/raddb/mods-enabled/cache_eap including configuration file /etc/raddb/mods-enabled/chap including configuration file /etc/raddb/mods-enabled/detail including configuration file /etc/raddb/mods-enabled/detail.log including configuration file /etc/raddb/mods-enabled/dhcp including configuration file /etc/raddb/mods-enabled/digest including configuration file /etc/raddb/mods-enabled/dynamic_clients including configuration file /etc/raddb/mods-enabled/eap including configuration file /etc/raddb/mods-enabled/echo including configuration file /etc/raddb/mods-enabled/exec including configuration file /etc/raddb/mods-enabled/expiration including configuration file /etc/raddb/mods-enabled/expr including configuration file /etc/raddb/mods-enabled/files including configuration file /etc/raddb/mods-enabled/linelog including configuration file /etc/raddb/mods-enabled/logintime including configuration file /etc/raddb/mods-enabled/mschap including configuration file /etc/raddb/mods-enabled/ntlm_auth including configuration file /etc/raddb/mods-enabled/pap including configuration file /etc/raddb/mods-enabled/passwd including configuration file /etc/raddb/mods-enabled/preprocess including configuration file /etc/raddb/mods-enabled/radutmp including configuration file /etc/raddb/mods-enabled/realm including configuration file /etc/raddb/mods-enabled/replicate including configuration file /etc/raddb/mods-enabled/soh including configuration file /etc/raddb/mods-enabled/sradutmp including configuration file /etc/raddb/mods-enabled/unix including configuration file /etc/raddb/mods-enabled/unpack including configuration file /etc/raddb/mods-enabled/utf8 including files in directory /etc/raddb/policy.d/ including configuration file /etc/raddb/policy.d/accounting including configuration file /etc/raddb/policy.d/canonicalization including configuration file /etc/raddb/policy.d/control including configuration file /etc/raddb/policy.d/cui including configuration file /etc/raddb/policy.d/debug including configuration file /etc/raddb/policy.d/dhcp including configuration file /etc/raddb/policy.d/eap including configuration file /etc/raddb/policy.d/filter including configuration file /etc/raddb/policy.d/operator-name including files in directory /etc/raddb/sites-enabled/ including configuration file /etc/raddb/sites-enabled/default including configuration file /etc/raddb/sites-enabled/inner-tunnel main { security { user = "radiusd" group = "radiusd" allow_core_dumps = no } } main { name = "radiusd" prefix = "/usr" localstatedir = "/var" sbindir = "/usr/sbin" logdir = "/var/log/radius" run_dir = "/var/run/radiusd" libdir = "/usr/lib64/freeradius" radacctdir = "/var/log/radius/radacct" hostname_lookups = no max_request_time = 30 cleanup_delay = 5 max_requests = 1024 pidfile = "/var/run/radiusd/radiusd.pid" checkrad = "/usr/sbin/checkrad" debug_level = 0 proxy_requests = yes log { stripped_names = no auth = no auth_badpass = no auth_goodpass = no colourise = yes msg_denied = "You are already logged in - access denied" } security { max_attributes = 200 reject_delay = 1 status_server = yes } } radiusd: #### Loading Realms and Home Servers #### proxy server { retry_delay = 5 retry_count = 3 default_fallback = no dead_time = 120 wake_all_if_all_dead = no } home_server localhost { ipaddr = 127.0.0.1 port = 1812 type = "auth" secret = <<< secret >>> response_window = 20.000000 response_timeouts = 1 max_outstanding = 65536 zombie_period = 40 status_check = "status-server" ping_interval = 30 check_interval = 30 check_timeout = 4 num_answers_to_alive = 3 revive_interval = 120 coa { irt = 2 mrt = 16 mrc = 5 mrd = 30 } limit { max_connections = 16 max_requests = 0 lifetime = 0 idle_timeout = 0 } } home_server_pool my_auth_failover { type = fail-over home_server = localhost } realm example.com { auth_pool = my_auth_failover } realm LOCAL { } radiusd: #### Loading Clients #### client 10.10.10.0/24 { require_message_authenticator = no secret = <<< secret >>> nas_type = "other" limit { max_connections = 16 lifetime = 0 idle_timeout = 30 } } No 'ipaddr' or 'ipv4addr' or 'ipv6addr' field found in client 10.10.10.0/24. Please fix your configuration Support for old-style clients will be removed in a future release client 192.168.100.0/24 { require_message_authenticator = no secret = <<< secret >>> nas_type = "other" limit { max_connections = 16 lifetime = 0 idle_timeout = 30 } } No 'ipaddr' or 'ipv4addr' or 'ipv6addr' field found in client 192.168.100.0/24. Please fix your configuration Support for old-style clients will be removed in a future release client localhost { ipaddr = 127.0.0.1 require_message_authenticator = no secret = <<< secret >>> nas_type = "other" proto = "*" limit { max_connections = 16 lifetime = 0 idle_timeout = 30 } } client localhost_ipv6 { ipv6addr = ::1 require_message_authenticator = no secret = <<< secret >>> limit { max_connections = 16 lifetime = 0 idle_timeout = 30 } } radiusd: #### Instantiating modules #### instantiate { } modules { # Loaded module rlm_always # Instantiating module "reject" from file /etc/raddb/mods-enabled/always always reject { rcode = "reject" simulcount = 0 mpp = no } # Instantiating module "fail" from file /etc/raddb/mods-enabled/always always fail { rcode = "fail" simulcount = 0 mpp = no } # Instantiating module "ok" from file /etc/raddb/mods-enabled/always always ok { rcode = "ok" simulcount = 0 mpp = no } # Instantiating module "handled" from file /etc/raddb/mods-enabled/always always handled { rcode = "handled" simulcount = 0 mpp = no } # Instantiating module "invalid" from file /etc/raddb/mods-enabled/always always invalid { rcode = "invalid" simulcount = 0 mpp = no } # Instantiating module "userlock" from file /etc/raddb/mods-enabled/always always userlock { rcode = "userlock" simulcount = 0 mpp = no } # Instantiating module "notfound" from file /etc/raddb/mods-enabled/always always notfound { rcode = "notfound" simulcount = 0 mpp = no } # Instantiating module "noop" from file /etc/raddb/mods-enabled/always always noop { rcode = "noop" simulcount = 0 mpp = no } # Instantiating module "updated" from file /etc/raddb/mods-enabled/always always updated { rcode = "updated" simulcount = 0 mpp = no } # Loaded module rlm_attr_filter # Instantiating module "attr_filter.post-proxy" from file /etc/raddb/mods-enabled/attr_filter attr_filter attr_filter.post-proxy { filename = "/etc/raddb/mods-config/attr_filter/post-proxy" key = "%{Realm}" relaxed = no } reading pairlist file /etc/raddb/mods-config/attr_filter/post-proxy # Instantiating module "attr_filter.pre-proxy" from file /etc/raddb/mods-enabled/attr_filter attr_filter attr_filter.pre-proxy { filename = "/etc/raddb/mods-config/attr_filter/pre-proxy" key = "%{Realm}" relaxed = no } reading pairlist file /etc/raddb/mods-config/attr_filter/pre-proxy # Instantiating module "attr_filter.access_reject" from file /etc/raddb/mods-enabled/attr_filter attr_filter attr_filter.access_reject { filename = "/etc/raddb/mods-config/attr_filter/access_reject" key = "%{User-Name}" relaxed = no } reading pairlist file /etc/raddb/mods-config/attr_filter/access_reject # Instantiating module "attr_filter.access_challenge" from file /etc/raddb/mods-enabled/attr_filter attr_filter attr_filter.access_challenge { filename = "/etc/raddb/mods-config/attr_filter/access_challenge" key = "%{User-Name}" relaxed = no } reading pairlist file /etc/raddb/mods-config/attr_filter/access_challenge # Instantiating module "attr_filter.accounting_response" from file /etc/raddb/mods-enabled/attr_filter attr_filter attr_filter.accounting_response { filename = "/etc/raddb/mods-config/attr_filter/accounting_response" key = "%{User-Name}" relaxed = no } reading pairlist file /etc/raddb/mods-config/attr_filter/accounting_response # Loaded module rlm_cache # Instantiating module "cache_eap" from file /etc/raddb/mods-enabled/cache_eap cache cache_eap { key = "%{%{control:State}:-%{%{reply:State}:-%{State}}}" ttl = 15 max_entries = 16384 epoch = 0 add_stats = no } # Loaded module rlm_chap # Instantiating module "chap" from file /etc/raddb/mods-enabled/chap # Loaded module rlm_detail # Instantiating module "detail" from file /etc/raddb/mods-enabled/detail detail { filename = "/var/log/radius/radacct/%{%{Packet-Src-IP-Address}:-%{Packet-Src-IPv6-Address}}/detail-%Y%m%d" header = "%t" permissions = 384 locking = no log_packet_header = no } # Instantiating module "auth_log" from file /etc/raddb/mods-enabled/detail.log detail auth_log { filename = "/var/log/radius/radacct/%{%{Packet-Src-IP-Address}:-%{Packet-Src-IPv6-Address}}/auth-detail-%Y%m%d" header = "%t" permissions = 384 locking = no log_packet_header = no } rlm_detail (auth_log): 'User-Password' suppressed, will not appear in detail output # Instantiating module "reply_log" from file /etc/raddb/mods-enabled/detail.log detail reply_log { filename = "/var/log/radius/radacct/%{%{Packet-Src-IP-Address}:-%{Packet-Src-IPv6-Address}}/reply-detail-%Y%m%d" header = "%t" permissions = 384 locking = no log_packet_header = no } # Instantiating module "pre_proxy_log" from file /etc/raddb/mods-enabled/detail.log detail pre_proxy_log { filename = "/var/log/radius/radacct/%{%{Packet-Src-IP-Address}:-%{Packet-Src-IPv6-Address}}/pre-proxy-detail-%Y%m%d" header = "%t" permissions = 384 locking = no log_packet_header = no } # Instantiating module "post_proxy_log" from file /etc/raddb/mods-enabled/detail.log detail post_proxy_log { filename = "/var/log/radius/radacct/%{%{Packet-Src-IP-Address}:-%{Packet-Src-IPv6-Address}}/post-proxy-detail-%Y%m%d" header = "%t" permissions = 384 locking = no log_packet_header = no } # Loaded module rlm_dhcp # Instantiating module "dhcp" from file /etc/raddb/mods-enabled/dhcp # Loaded module rlm_digest # Instantiating module "digest" from file /etc/raddb/mods-enabled/digest # Loaded module rlm_dynamic_clients # Instantiating module "dynamic_clients" from file /etc/raddb/mods-enabled/dynamic_clients # Loaded module rlm_eap # Instantiating module "eap" from file /etc/raddb/mods-enabled/eap eap { default_eap_type = "md5" timer_expire = 60 ignore_unknown_eap_types = no mod_accounting_username_bug = no max_sessions = 1024 } # Linked to sub-module rlm_eap_md5 # Linked to sub-module rlm_eap_leap # Linked to sub-module rlm_eap_gtc gtc { challenge = "Password: " auth_type = "PAP" } # Linked to sub-module rlm_eap_tls tls { tls = "tls-common" } tls-config tls-common { rsa_key_exchange = no dh_key_exchange = yes rsa_key_length = 512 dh_key_length = 512 verify_depth = 0 ca_path = "/etc/raddb/certs" pem_file_type = yes private_key_file = "/etc/raddb/certs/server.pem" certificate_file = "/etc/raddb/certs/server.pem" ca_file = "/etc/raddb/certs/ca.pem" private_key_password = <<< secret >>> dh_file = "/etc/raddb/certs/dh" fragment_size = 1024 include_length = yes check_crl = no cipher_list = "DEFAULT" ecdh_curve = "prime256v1" cache { enable = yes lifetime = 24 max_entries = 255 } verify { } ocsp { enable = no override_cert_url = yes url = "http://127.0.0.1/ocsp/" use_nonce = yes timeout = 0 softfail = yes } } # Linked to sub-module rlm_eap_ttls ttls { tls = "tls-common" default_eap_type = "md5" copy_request_to_tunnel = no use_tunneled_reply = no virtual_server = "inner-tunnel" include_length = yes require_client_cert = no } Using cached TLS configuration from previous invocation # Linked to sub-module rlm_eap_peap peap { tls = "tls-common" default_method = "mschapv2" copy_request_to_tunnel = no use_tunneled_reply = no proxy_tunneled_request_as_eap = yes virtual_server = "inner-tunnel" soh = no require_client_cert = no } Using cached TLS configuration from previous invocation # Linked to sub-module rlm_eap_mschapv2 mschapv2 { with_ntdomain_hack = no send_error = no } # Loaded module rlm_exec # Instantiating module "echo" from file /etc/raddb/mods-enabled/echo exec echo { wait = yes program = "/bin/echo %{User-Name}" input_pairs = "request" output_pairs = "reply" shell_escape = yes } # Instantiating module "exec" from file /etc/raddb/mods-enabled/exec exec { wait = no input_pairs = "request" shell_escape = yes timeout = 10 } # Loaded module rlm_expiration # Instantiating module "expiration" from file /etc/raddb/mods-enabled/expiration # Loaded module rlm_expr # Instantiating module "expr" from file /etc/raddb/mods-enabled/expr expr { safe_characters = "@abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ0123456789.-_: /" } # Loaded module rlm_files # Instantiating module "files" from file /etc/raddb/mods-enabled/files files { filename = "/etc/raddb/mods-config/files/authorize" usersfile = "/etc/raddb/mods-config/files/authorize" acctusersfile = "/etc/raddb/mods-config/files/accounting" preproxy_usersfile = "/etc/raddb/mods-config/files/pre-proxy" compat = "cistron" } reading pairlist file /etc/raddb/mods-config/files/authorize [/etc/raddb/mods-config/files/authorize]:86 Cistron compatibility checks for entry gannis ... [/etc/raddb/mods-config/files/authorize]:89 Cistron compatibility checks for entry thomas ... [/etc/raddb/mods-config/files/authorize]:92 Cistron compatibility checks for entry larry ... [/etc/raddb/mods-config/files/authorize]:95 Cistron compatibility checks for entry demo1 ... [/etc/raddb/mods-config/files/authorize]:98 Cistron compatibility checks for entry bob ... [/etc/raddb/mods-config/files/authorize]:101 Cistron compatibility checks for entry test ... [/etc/raddb/mods-config/files/authorize]:103 Cistron compatibility checks for entry crew1 ... [/etc/raddb/mods-config/files/authorize]:194 Cistron compatibility checks for entry DEFAULT ... [/etc/raddb/mods-config/files/authorize]:201 Cistron compatibility checks for entry DEFAULT ... [/etc/raddb/mods-config/files/authorize]:208 Cistron compatibility checks for entry DEFAULT ... reading pairlist file /etc/raddb/mods-config/files/authorize [/etc/raddb/mods-config/files/authorize]:86 Cistron compatibility checks for entry gannis ... [/etc/raddb/mods-config/files/authorize]:89 Cistron compatibility checks for entry thomas ... [/etc/raddb/mods-config/files/authorize]:92 Cistron compatibility checks for entry larry ... [/etc/raddb/mods-config/files/authorize]:95 Cistron compatibility checks for entry demo1 ... [/etc/raddb/mods-config/files/authorize]:98 Cistron compatibility checks for entry bob ... [/etc/raddb/mods-config/files/authorize]:101 Cistron compatibility checks for entry test ... [/etc/raddb/mods-config/files/authorize]:103 Cistron compatibility checks for entry crew1 ... [/etc/raddb/mods-config/files/authorize]:194 Cistron compatibility checks for entry DEFAULT ... [/etc/raddb/mods-config/files/authorize]:201 Cistron compatibility checks for entry DEFAULT ... [/etc/raddb/mods-config/files/authorize]:208 Cistron compatibility checks for entry DEFAULT ... reading pairlist file /etc/raddb/mods-config/files/accounting reading pairlist file /etc/raddb/mods-config/files/pre-proxy # Loaded module rlm_linelog # Instantiating module "linelog" from file /etc/raddb/mods-enabled/linelog linelog { filename = "/var/log/radius/linelog" permissions = 384 format = "This is a log message for %{User-Name}" reference = "messages.%{%{Packet-Type}:-default}" } # Instantiating module "log_accounting" from file /etc/raddb/mods-enabled/linelog linelog log_accounting { filename = "/var/log/radius/linelog-accounting" permissions = 384 format = "" reference = "Accounting-Request.%{%{Acct-Status-Type}:-unknown}" } # Loaded module rlm_logintime # Instantiating module "logintime" from file /etc/raddb/mods-enabled/logintime logintime { minimum_timeout = 60 } # Loaded module rlm_mschap # Instantiating module "mschap" from file /etc/raddb/mods-enabled/mschap mschap { use_mppe = yes require_encryption = no require_strong = no with_ntdomain_hack = yes passchange { } allow_retry = yes } # Instantiating module "ntlm_auth" from file /etc/raddb/mods-enabled/ntlm_auth exec ntlm_auth { wait = yes program = "/path/to/ntlm_auth --request-nt-key --domain=MYDOMAIN --username=%{mschap:User-Name} --password=%{User-Password}" shell_escape = yes } # Loaded module rlm_pap # Instantiating module "pap" from file /etc/raddb/mods-enabled/pap pap { normalise = yes } # Loaded module rlm_passwd # Instantiating module "etc_passwd" from file /etc/raddb/mods-enabled/passwd passwd etc_passwd { filename = "/etc/passwd" format = "*User-Name:Crypt-Password:" delimiter = ":" ignore_nislike = no ignore_empty = yes allow_multiple_keys = no hash_size = 100 } rlm_passwd: nfields: 3 keyfield 0(User-Name) listable: no # Loaded module rlm_preprocess # Instantiating module "preprocess" from file /etc/raddb/mods-enabled/preprocess preprocess { huntgroups = "/etc/raddb/mods-config/preprocess/huntgroups" hints = "/etc/raddb/mods-config/preprocess/hints" with_ascend_hack = no ascend_channels_per_line = 23 with_ntdomain_hack = no with_specialix_jetstream_hack = no with_cisco_vsa_hack = no with_alvarion_vsa_hack = no } reading pairlist file /etc/raddb/mods-config/preprocess/huntgroups reading pairlist file /etc/raddb/mods-config/preprocess/hints # Loaded module rlm_radutmp # Instantiating module "radutmp" from file /etc/raddb/mods-enabled/radutmp radutmp { filename = "/var/log/radius/radutmp" username = "%{User-Name}" case_sensitive = yes check_with_nas = yes permissions = 384 caller_id = yes } # Loaded module rlm_realm # Instantiating module "IPASS" from file /etc/raddb/mods-enabled/realm realm IPASS { format = "prefix" delimiter = "/" ignore_default = no ignore_null = no } # Instantiating module "suffix" from file /etc/raddb/mods-enabled/realm realm suffix { format = "suffix" delimiter = "@" ignore_default = no ignore_null = no } # Instantiating module "realmpercent" from file /etc/raddb/mods-enabled/realm realm realmpercent { format = "suffix" delimiter = "%" ignore_default = no ignore_null = no } # Instantiating module "ntdomain" from file /etc/raddb/mods-enabled/realm realm ntdomain { format = "prefix" delimiter = "\" ignore_default = no ignore_null = no } # Loaded module rlm_replicate # Instantiating module "replicate" from file /etc/raddb/mods-enabled/replicate # Loaded module rlm_soh # Instantiating module "soh" from file /etc/raddb/mods-enabled/soh soh { dhcp = yes } # Instantiating module "sradutmp" from file /etc/raddb/mods-enabled/sradutmp radutmp sradutmp { filename = "/var/log/radius/sradutmp" username = "%{User-Name}" case_sensitive = yes check_with_nas = yes permissions = 420 caller_id = no } # Loaded module rlm_unix # Instantiating module "unix" from file /etc/raddb/mods-enabled/unix unix { radwtmp = "/var/log/radius/radwtmp" } # Loaded module rlm_unpack # Instantiating module "unpack" from file /etc/raddb/mods-enabled/unpack # Loaded module rlm_utf8 # Instantiating module "utf8" from file /etc/raddb/mods-enabled/utf8 } # modules radiusd: #### Loading Virtual Servers #### server { # from file /etc/raddb/radiusd.conf } # server server default { # from file /etc/raddb/sites-enabled/default # Creating Auth-Type = digest # Loading authenticate {...} # Loading authorize {...} /etc/raddb/sites-enabled/default[372]: Failed to find "sql" in the "modules" section. /etc/raddb/sites-enabled/default[254]: Errors parsing authorize section. [root@pacific-technology raddb]# Best Regards, Larry

2 4

Re: FreeRadius 3.0.4 | Failed to find "sql" in the "modules" section
by Rui Ribeiro 22 May '15

22 May '15

Hi Larry, As far as I am aware, DaloRadius only supports v2.2.x. Regards > Message: 6 > Date: Fri, 22 May 2015 15:00:36 +0800 > From: Larry Cataina <hdcataina(a)gmail.com> > To: freeradius-users(a)lists.freeradius.org > Cc: freeradius-devel(a)lists.freeradius.org > Subject: Re: FreeRadius 3.0.4 | Failed to find "sql" in the "modules" > section > Message-ID: <A65D86B9-E181-487D-91F4-350321C28EAB(a)gmail.com> > Content-Type: text/plain; charset=us-ascii > > Dear FreeRADIUS, > > Greetings! > I am a newbie linux system admin. > I had setup freeradius 3.04 and tried to use DaloRadius for web > management, however I am facing issue as not able to start the radius. > > -- Regards, -- Rui Ribeiro Senior Sysadm ISCTE-IUL https://www.linkedin.com/pub/rui-ribeiro/16/ab8/434

2 1

Change cli format in log
by Marcin Michta 21 May '15

21 May '15

Hi, How can I change cli format in logs from dashes separated to colons? ( from client client port 59 cli 00-00-00-00-00-00 -> from client client port 59 cli 00:00:00:00:00:00) Regards, Martin

1 0

Re:QUERY REGARDING PFX
by pavani 21 May '15

21 May '15

Message: 4 Date: Thu, 21 May 2015 07:59:39 -0400 From: Arran Cudbard-Bell<a.cudbardb(a)freeradius.org> To: FreeRadius users mailing list <freeradius-users(a)lists.freeradius.org> Subject: Re: QUERY_REGARDING PFX Message-ID:<151F9C43-AF6A-4E6F-8B8B-BAA98E36EE62(a)freeradius.org> Content-Type: text/plain; charset="utf-8" Hi Arran, Thanks For your response. Actually I tried with PEM format.It works fine.But the requirement is I need to conevert .pem to .pfx format and install only pfx format certificates from free radius server side.so my query is free radius supports pfx format type of certificates or not??.If it supports then I want some suggestions from you. 1.How to convert pem to pfx format. 2.How to install these pfx certificates on radius server side. AndMy Radius server version is 2.2.3 and platform is x86. Please Suggest me regarding these queries. Regards, pavani Convert them to pem, point the RADIUS server at them. Arran Cudbard-Bell<a.cudbardb(a)freeradius.org> FreeRADIUS development team > On 21 May 2015, at 03:57, pavani<pavani.muthyala(a)redpinesignals.com> wrote: > > Hi All, > > Can any one tell me how to install certificates with pfx format On radius server side.for EAP-TLS mode.

2 1