September 2015 - Freeradius-Users - lists.freeradius.org

3.0.4: binary LDAP attributes
by Nikolai Kondrashov 24 Mar '17

24 Mar '17

Hi everyone, Our (Red Hat) QA was testing the effect of this entry in 3.0.4 ChangeLog: * Modify pairparsevalue to deal with embedded NULLs better, and use the binary versions of attribute values in rlm_ldap. They have noticed that binary LDAP values get truncated on embedded zero characters (\0) in RADIUS replies, in radiusReplyMessage in particular. I.e. for radiusReplyMessage:: cmVwbHkgd2l0aCBhAGI= The response output by radtest was Reply-Message = 'reply with a' The network capture also showed that RADIUS reply packets contained truncated values. Is this intended, or was there a fix for this? In related discoveries, it seems that backslashes get removed from LDAP attribute values in RADIUS replies, so radiusReplyMessage: reply with a\0b becomes Reply-Message = 'reply with a0b' in radtest output. Is this intended? Thank you. Nick

4 12

user-group for rejected users
by Fabricio Viana 21 Mar '17

21 Mar '17

Hello! Let´s suppose the following situations: 1) User exists but the password is wrong 2) User does not exist In both cases the answer is REJECT. It happens that certain hardware is making endless attempts that eventually saturating the server. - It is possible to cause the server, instead of rejecting the users, accept the login but responds ACCEPT with "framed-pool = pool-block" ? or/and - Is there any way to put REJECT users in a given group by default? Thanks! Fabricio

3 3

freeradius2 + iODBC + Informix
by vanish 28 Nov '16

28 Nov '16

Hello, Please help me set up freeradius2 + iODBC + Informix (I'm newbie in freeradius). - I have a test-machine with Ubuntu 14.04 and Freeradius-server v2.1.12. - I have a server with Informix Database Server v 10.00 Step 1: - I installed unixODBC on test-machine - I installed informix-csdk for connect to Informix Database Server (Driver) - I configured files /etc/odbc.ini and /etc/odbcinst.ini to connect to Informix Database Server - Checking with isql: +++++++++++++++++++++++++++++++++++++++++ root@test:/home/test# isql -v work +---------------------------------------+ | Connected! | | | | sql-statement | | help [tablename] | | quit | | | +---------------------------------------+ SQL> select 1 from TABLES(SET{1}) 1 +++++++++++++++++++++++++++++++++++++++++ - Everything is allright. Step 2: - I try to install freeradius-iodbc module to connect to Informix Database Server - During install I get next warning: +++++++++++++++++++++++++++++++++++++++++++++ The following packages will be REMOVED: unixodbc unixodbc-dev The following NEW packages will be installed: libiodbc2-dev +++++++++++++++++++++++++++++++++++++++++++++ - so unixodbc and unixodbc-dev packages was removed after install freeradius-iodbc - I included in radiusd.conf: +++++++++++++++++++++++++++++++++++++++++++++ sql { # # Set the database to one of: # # mysql, mssql, oracle, postgresql # database = "iodbc" # # Which FreeRADIUS driver to use. # driver = "rlm_sql_${database}" # Connection info: server = "test.server.ru" port = 1425 login = "test" password = "test123" radius_db = "test" ... +++++++++++++++++++++++++++++++++++++++++++++ - freeradius -XXX showed me next error: ++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++ ... Fri Nov 21 14:53:48 2014 : Info: rlm_sql (sql): Driver rlm_sql_iodbc (module rlm_sql_iodbc) loaded and linked Fri Nov 21 14:53:48 2014 : Info: rlm_sql (sql): Attempting to connect to test@test.server.ru:1425/test Fri Nov 21 14:53:48 2014 : Debug: rlm_sql (sql): starting 0 Fri Nov 21 14:53:48 2014 : Info: rlm_sql (sql): Attempting to connect rlm_sql_iodbc #0 Fri Nov 21 14:53:48 2014 : Error: sql_create_socket: SQLConnectfailed: [iODBC][Driver Manager]Data source name not found and no default driver specified. Driver could not be loaded Fri Nov 21 14:53:48 2014 : Error: rlm_sql (sql): Failed to connect DB handle #0 ... +++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++ - Error - "SQLConnectfailed: [iODBC][Driver Manager]Data source name not found and no default driver specified. Driver could not be loaded." - Where did I go wrong? - I found some information in net with same problem, but clear decision nowhere not found.

4 4

Dynamic User Help
by J Kephart 24 Feb '16

24 Feb '16

We provide AAA services to a variety of client businesses across North America, and we use FreeRADIUS as the final piece of our authentication process. Because our clients' customers are unknown until they attempt to connect to the network, all user radius credentials are created dynamically, after an initial authentication via another method (typically, credit card charges, access codes, etc.); once that initial auth is complete, we create a credential using the user devices' MAC address to ensure uniqueness, and to facilitate the MAC auth feature of the gateway devices we employ, which permits immediate reconnection following idle time-out without having to open a browser (a limitation of the gateway devices). Of concern to us is that we don't want a user to authenticate in one place of business for which we provide service, then move to another client site, at which MAC authentication is enabled, and have the device automatically connected at the second location. This is mainly due to differences in service offerings at different client sites. What we're looking to do is create an additional table in the radius database. That table would contain the following fields: id primary table key callingstationid self-explanatory nasid identifies the specific site the user is at, and corresponds to our own internal site id nasportid the vlan the user is in groupname the group to which the user is assigned in radusergroup As we create each user's credentials, we'll populate this new table with the information indicated. For each VLAN the user connects to, there would be a separate row so that, as he moves from vlan to vlan, we can update the group assignment in radusergroup so that he'd get the proper group attributes. Does this sound like something that could work? If so, I need a bit of help understanding where we'd put the table query (and the construction of it) in whichever file it should be in (e.g., sites-enabled/default?). The goal is to perform the query, and if there's a corresponding row match, do an update on the username in radusergroup to set the proper group id, and then continue normal processing; if there is no match, we'd simply reject the connection, which would force the gateway to redirect to a captive portal server for initial authentication, as described above). For me, the sticking point is where and how to put the SQL query, so I'd appreciate any pointers I can get. And, too, if there's a better way of doing this, I'd welcome any advice! I hope I've provided enough information to start. Many thanks in advance! Jim

2 7

No Logon Servers error with FreeRADIUS + NTLM
by Stefan Paetow 19 Feb '16

19 Feb '16

Hi, I know this is not a problem with FreeRADIUS, however, there are several people on this list who run FreeRADIUS with Active Directory as a back end and I need their advice on this. I've run into the dreaded "No logon servers (0xc000005e)" error with NTLM. In the past I've found that the computer password for the server expired on AD and that it was either fixed by rejoining, or by tweaking the password's expiry. Do any AD folk on the list know what we can do to get this stable and that this does not occur again? Any ideas will be very useful. :-) With Regards Stefan Paetow Moonshot Industry & Research Liaison Coordinator t: +44 (0)1235 822 125 Janet, the UK's research and education network. Janet(UK) is a trading name of Jisc Collections and Janet Limited, a not-for-profit company which is registered in England under No. 2881024 and whose Registered Office is at Lumen House, Library Avenue, Harwell Oxford, Didcot, Oxfordshire. OX11 0SG. VAT No. 614944238

2 1

Need information on checking for SSID during group verification
by Adarsha S 27 Oct '15

27 Oct '15

Hi , I'm using free-radius on my debian linux. Free radius is contacting external WINDOWS AD server for authentication. The topology is to authenticate Mobile unites[MU] connecting to wireless network. The MU's are authenticated along with group verification. During group verification I'm able to configure Login-Time also as one of the check. Along with this I need to verify the SSID via which MU's are connecting. Please guide me what changes/add I need to do in config file of Radius. Below is my user file content: */root # more /etc/raddb/users* *DEFAULT Realm != "NULL"* *anonymous Auth-Type := EAP* * Fall-Through = No* *Anonymous Auth-Type := EAP* * Fall-Through = No* *#Access Policy for Guest Users....* *# primary ldap group policy configuration* *# Policy for the groups* *DEFAULT ldap_primary-Ldap-Group == "adarsha_radius_group_1", Login-Time := "Any0600-2359"* * Symbol-User-Group = "adarsha_radius_group_1",* * Symbol-Allowed-ESSID += "adarsha_wlan"* *DEFAULT ldap_primary-Ldap-Group == "adarsha_radius_group", Login-Time := "Any0600-2359"* * Symbol-User-Group = "adarsha_radius_group",* * Symbol-Allowed-ESSID += "adhi_2"* *DEFAULT ldap_primary-Ldap-Group == "adarsha_radius_group_2", Login-Time := "Any0000-2359"* * Symbol-User-Group = "adarsha_radius_group_2",* *DEFAULT Auth-Type := Reject* I need to use Symbol-Allowed-ESSID as one of the parameter for group verification. Currently its only group and login time: *ldap_primary-Ldap-Group == "adarsha_radius_group_1", Login-Time := "Any0600-2359"* Please guide me Thanks, Adarsha

2 4

radius CoA client for PPTP box
by Brock Eastman 07 Oct '15

07 Oct '15

I am currently trying to implement radius CoA on a NAS client using freeradius to handle the listening of inbound packets. I need to add a feature to change the shaping policy on the fly from our radius system to each existing NAS. Freeradius appears to employ a nice framework to accomplish this such as PPTP/PPPOE servers for an ISP environment. I originally started out with a PHP socket program that listened on port 3799 - it worked but has compatibility issues with older php4 systems that I must still support. I am not trying to proxy anything, just straight listen for packets, send the attributes to a secondary program and change rate shaping or disconnect users on the fly. I have no problems sending requests from my radius server to the NAS hosting the radius CoA listener on port 3799. RADIUS AUTH/ACCT SERVER - > SEND REQUEST ON PORT 3799 Radclient call - echo "User-Name = test, Framed-IP-Address=198.204.209.33, NAS-Port=382" | radclient -x 198.204.208.XX:3799 coa mypass What I need is in the recv-coa section to allow me to send a remote command using exec. So far nothing has worked for me. I've dug around in the documentation all day without anything working. I'm validating the php script runs by touching a filesystem command and running the daemon in debug mode from the command line to see the output. But the php is never called. ----------------snippet from radiusd.conf server coa { # When a packet is received, it is processed through the # recv-coa section. This applies to *both* CoA-Request and # Disconnect-Request packets. recv-coa { # CoA && Disconnect packets can be proxied in the same # way as authentication or accounting packets. # Just set Proxy-To-Realm, or Home-Server-Pool, and the # packets will be proxied. # Insert your own policies here. update control { Auth-Type:=`/usr/bin/php /usr/local/bin/radius_coa.php %{User-Name}` } ok } } ----------------------- Here is the output I have .. successfully getting data into freeradius NAS from central radius... radiusd -X ... adding new socket proxy address * port 53450 Listening on coa address * port 3799 Listening on accounting address * port 1813 Listening on command file /var/run/radiusd/radiusd.sock Listening on authentication address 127.0.0.1 port 18120 as server inner-tunnel Listening on proxy address * port 1151 Ready to process requests. rad_recv: CoA-Request packet from host 198.204.208.XX port 39238, id=55, length=38 User-Name = "test" Framed-IP-Address = 198.204.209.33 NAS-Port = 382 WARNING: Empty recv-coa section. Using default return values. WARNING: Empty send-coa section. Using default return values. Sending CoA-ACK of id 55 to 198.204.208.XX port 39238 Finished request 0. Going to the next request Cleaning up request 0 ID 55 with timestamp +23 Ready to process requests. ------------------------------------------------------ I am sure this is something simple to fix. Thanks Brock Eastman VP Engineering DigitalPath, Inc

2 3

Version 2.2.9 has been released
by Alan DeKok 03 Oct '15

03 Oct '15

This should be the last release from version 2. We recommend everyone upgrade to v3. Feature improvements * None. Bug fixes * Fix Tunnel-Password crash from home server. Found by Denis Andzakovic. * Fix timer issue when proxying. * Update EAP-TTLS so that MPPE keys are correctly calculated with TLSv1.2. * Always delete MS-MPPE-* from the TTLS inner tunnel. This allows TTLS / EAP-MSCHAPv2 to work. * Don't fall through in empty "case" statements. Fixes #1274.

4 5

Testing Certificates
by Lightfoot, Maurice P. 30 Sep '15

30 Sep '15

Hello, I am having trouble testing if the certificates created are actually working. I am using JRadiusSimulator to test if the certificates work. I can get an access-accept when I input the correct the correct user name and password and the Radius server IP address and password. There is also a Keys tab on the JRadiusSimulator to input the client certificate and root certificate. When I put the wrong or right path and password for the certificates I still get an access-accept from the debugger. My question is how do I test the certificates created with RADIUS. Thank you

3 4

freeradius + jradius
by Jim Shi 30 Sep '15

30 Sep '15

Hi, I would like to use freeradius radius for verify client certificate (EAP - TLS) (authentication), and use jradius (which is java code) for authorization. In jradius, I need access the CN of client certificate for authorization. Is that possible? That is, I would like freeradius to put client certificate’s CN in the radius packet before sending to jradius for authorization. Thanks Jim

3 4