June 2015 - Freeradius-Users - lists.freeradius.org

Rejected: Username contains ..s; 3.0.8
by firing neurons 15 Jun '15

15 Jun '15

I compiled freeradius-3.0.8-2.fc23 from fedora koji with the SRPM method. Running on fedora 22. I used modified files of my 3.0.4 config. 3.0.4 crashes on originate-coa. What version is recommended for coa? FN

3 2

Re: %{check:Attribute-Name} not working in V3
by Jake He 14 Jun '15

14 Jun '15

I am trying to migrate from version 2 to version 3. The same unlang code worked in version 2. However in version 3 the same code does not work. This is the error: /etc/freeradius/sites-enabled/default[406]: Failed parsing expanded string: /etc/freeradius/sites-enabled/default[406]: %{sql:SET @reset_date = '%{check:Reset-Date}'; SELECT IFNULL((sum(acctinputoctets)+sum(acctoutp... /etc/freeradius/sites-enabled/default[406]: ^ Unknown module If I remove check the parser does not throw errors. Change '%{check:Reset-Date}' to '%{Reset-Date}'. However this will break my code, because Reset-Date is a radcheck attribute, stored in the radcheck table. Any ideas? Jake He

2 1

How create profile with Counter time that limit for device?
by Bruno D'Ambrosio 14 Jun '15

14 Jun '15

Hi Mate I have need to this Profile on freeradius2: 1 Hour to navigation internet for device - Reset daily. Each connected device will have its own counter. Please.Help Best Regard Bruno D'Ambrosio

1 0

How create profile with Counter time that limit for device?
by bruno d'ambrosio 13 Jun '15

13 Jun '15

Hi mate How create profile attribute with counter time that limit for device? Best regard Bruno D'Ambrosio

2 1

Help. Counter time that limit per device.
by Bruno D'Ambrosio 13 Jun '15

13 Jun '15

Hi Mate What is the profile with Counter time that limit per device ? Help Please. Best Regard Bruno D'Ambrosio

1 0

MSCHAPv2 fails to authenticate against OpenDirectory with error 5100 (0x13ec)
by Alan Egerton 13 Jun '15

13 Jun '15

Dear FreeRADIUS users, I'm trying to follow the instructions in Dan Barrett's article <https://www.yesdevnull.net/2013/10/os-x-mavericks-server-setting-up-freerad…> to get the distribution of FreeRADIUS (v2.2.0) that ships with OS X Server (v4.1) to authenticate Open Directory users via non-Apple authenticators. However, the MSCHAPv2 module always fails as follows: [mschap] No Cleartext-Password configured. Cannot create LM-Password. [mschap] No Cleartext-Password configured. Cannot create NT-Password. [mschap] Creating challenge hash with username: username [mschap] Client is using MS-CHAPv2 for username, we need NT-Password [mschap] Using OpenDirectory to authenticate [mschap] Doing OD MSCHAPv2 auth [mschap] Authentication failed for username: error 5100 (0x13ec): unknown error I can't find any documentation on what might have caused this error and am not sure how to progress from here. Your thoughts would be most welcome! Kind regards, -- Alan

6 11

how do I define in my dictionary the vendor of format Extended-Vendor-Specific-1
by Vereecke, Katrien (Katrien) 12 Jun '15

12 Jun '15

Hello, I am using freeradius-server-3.0.8. I am trying to use the extended-vendor-sepcific-1 attribute as specified in RC6929. How can I indicate in my dictionary that the vendor must be according to the extended-vendor-specific format? I added the following in a new dictionary file: VENDOR Alcatel-IPD-Ext-1 241.26.6527 BEGIN-VENDOR Alcatel-IPD-Ext-1 ATTRIBUTE Alc-Ext-TestAttr-1 1 integer END-VENDOR Alcatel-IPD-Ext-1 This gives no problems when starting the radius server, but the attribute is not sent in the extended-vendor-specific format but still in the old way VSA. I found in the http://freeradius.org/radiusd/man/dictionary.txt that : "You can also use "format=Extended-Vendor-Specific-1", through "format=Extended-Vendor-Specific-6". These define VSAs in the "extended vendor-specific" space" but this gives errors : Errors reading dictionary: dict_init: /usr/local/share/freeradius/dictionary.alcatel.sr.ext[15]: Invalid format for VENDOR. Expected text like "1,1", got "Extended-Vendor-Specific-1" Could you please help in how this should be done? Thanks.

3 8

Doubts about the rlm_replicate
by Jorge Pereira 12 Jun '15

12 Jun '15

Hi, I have a situation that I get a packet "Acct-Start" and then is necessary to duplicate and transform in a "Acct-Interim-Update". but, I should send the second packet "Acct-Interim-Update" after I get the "Accounting-Response" from the first sending "Acct-Start". have someone idea about the solution? My first thought was to add in rlm_replicate the capability to process a "preaccounting" and add some "flag" in the first packet saving in redis cache... but is a madness. I prefer to hear other suggestions! p.s: my radius is a proxy between two others. -- Jorge Pereira

1 0

FreeRADIUS 3.0.7 Segmentation Fault
by Donald Sherker 12 Jun '15

12 Jun '15

We are running FreeRADIUS 3.0.7. FreeRADIUS has been crashing every couple days due to segmentation faults. I enabled core dumps and got a core dump from the seg fault this morning. Using the core dump, what is the best way to determine what is causing the segmentation fault? Thanks, Don

2 3

OpenSSL problems
by Alan DeKok 12 Jun '15

12 Jun '15

A sad note from the HostAP mailing list. OpenSSL has broken the most recent release. The good news is that we've put changes into v3 to detect this kind of nonsense. It refuses to start with a broken OpenSSL. But, this means that if your system auto-upgrades OpenSSL, FreeRADIUS will refuse to start. If you upgrade OpenSSL, you MUST REBUILD FreeRADIUS. This requirement is made because the OpenSSL people hate their end users, and break binary compatibility. --- Please note that the OpenSSL versions released yesterday are not binary compatible with the prior releases due to a quite undesired ABI change (HMAC_CTX size changes). This affects multiple programs using OpenSSL shared libraries, including wpa_supplicant. If you are using wpa_supplicant with OpenSSL as a shared library and update the OpenSSL shared library without rebuilding the wpa_supplicant binary against the new header files from the new OpenSSL version, you may hit memory corruption issues at runtime. Rebuilding wpa_supplicant against the matching OpenSSL version will fix those. Based on a quick test, this issue did not show up in practice for me on 64-bit Ubuntu 14.04 with gcc build due to the HMAC_CTX struct padding done by the compiler. However, on 32-bit Ubuntu 14.04, this did result in memory corruption and process termination due to malloc() memory corruption and/or stack smashing detection. This is an OpenSSL issue and I hope that the previous ABI will be restored in a new release shortly. There is not really anything that wpa_supplicant can do about this apart from doing that rebuild with new OpenSSL header files.

3 3