February 2016 - Freeradius-Users - lists.freeradius.org

Error in my EAP-TLS config since 3.0.11
by Jannis Pinter 06 Feb '16

06 Feb '16

Hi List, I use FreeRADIUS 3.0.11 on Arch Linux (ARM). Since I've updated FreeRADIUS from 3.0.10 to 3.0.11 I'm unable to start the FreeRADIUS server. > # Instantiating module "eap" from file /etc/raddb/mods-enabled/eap > /etc/raddb/mods-enabled/eap[17]: Failed to find 'Auth-Type EAP' section. Cannot authenticate users. > /etc/raddb/mods-enabled/eap[17]: Instantiation failed for module "eap" Here is the full output of radiusd -X: http://pastebin.com/GARg9fGC Here is the file /etc/raddb/mods-enabled/eap: http://pastebin.com/3Rww96t6 I haven't changed the configuration of the server for months. Downgrading to older versions (e.g. 3.0.10) resolves the issue. Is this a bug in the FreeRADIUS server or rather a misconfiguration that was tolerated in older versions? Thanks in advance for any hints. Regards Jannis

2 3

RadPerf Overload Testing packets/s is much lower than in Performance Testing
by Jim 06 Feb '16

06 Feb '16

I tried the performance testing in RadPerf for -p 8 to see the maximum accepted load that a RADIUS server can handle. The result was 203 packets/s. My problem now is in the overload testing, I was not able to reach the packets/s number printed out for -p. I tried -n 200 and 500 but got a very low packets/s in my result, it was 34 packets/s. What might be wrong? I'm using python module and MySQL database. Here's my result for -p 8: Total sent : 10000 Total retransmits : 0 Total succeeded : 10000 Total failed : 0 Total no reply : 0 Total time (s) : 49.300 Packets/s : 203 Response times: < 10 usec : 0 < 100 usec : 0 < msec : 0 < 10 msec : 0 < 0.1s : 9998 < s : 2 < 10s : 0 < 100s : 0 and this is my result for -n 200 Total sent : 10000 Total retransmits : 0 Total succeeded : 10000 Total failed : 0 Total no reply : 0 Total time (s) : 292.100 Packets/s : 34 Response times: < 10 usec : 0 < 100 usec : 0 < msec : 0 < 10 msec : 0 < 0.1s : 9997 < s : 3 < 10s : 0 < 100s : 0 and for -n 500 Total sent : 10000 Total retransmits : 0 Total succeeded : 10000 Total failed : 0 Total no reply : 0 Total time (s) : 296.937 Packets/s : 34 Response times: < 10 usec : 0 < 100 usec : 0 < msec : 0 < 10 msec : 0 < 0.1s : 9993 < s : 7 < 10s : 0 < 100s : 0 Jim Well Balatero

2 1

ERROR: Failed continuing EAP MD5 (4) session
by Mohamed Lrhazi 05 Feb '16

05 Feb '16

I have some users, apparently always the same, who get rejected with this error message... I managed to get a session containing the failure captured in debug mode. Not sure if I should post more, but this the end of one such session.... How can I get to the root cause of their rejections? This is running 3.0.11 but I saw the same errors in previous versions as well. Thanks a lot, Mohamed. Waking up in 0.4 seconds. (267) Received Access-Request Id 50 from 64.57.22.74:59485 to 10.212.11.16:1812 length 322 (267) User-Name = "usernamescrub(a)georgetown.edu" (267) NAS-IP-Address = 137.158.248.12 (267) NAS-Identifier = "mc-wlan-3" (267) EAP-Message = 0x020d006019001703010020a656b177e50de453353cc5168dee3c22a1ed723cbb64f31aef3691fa701022dd17030100305b78b8ff2b863942c2334a32879eadff634098f4bfedef9becd8c6bdb487a756b1171bb2702c3646f84ecae10457efa4 (267) State = 0x7f22f2a0752febe91327d6769b7e379b (267) Message-Authenticator = 0x33f00e391800047cf82dac79dae82745 (267) Attr-26.9048.0 = 0x50726f786965642d42793d65746c72312e656475726f616d2e6f72672d31343534363537343033 (267) Attr-26.9048.0 = 0x50726f786965642d42793d72616469756d2e737572666e65742e6e6c2d31343534363537343033 (267) Attr-26.9048.0 = 0x50726f786965642d42793d544c5253312e656475726f616d2e7573 (267) session-state: No cached attributes (267) # Executing section authorize from file /etc/raddb/sites-enabled/default (267) authorize { (267) policy filter_username { (267) if (User-Name != "%{tolower:%{User-Name}}") { (267) EXPAND %{tolower:%{User-Name}} (267) --> usernamescrub(a)georgetown.edu (267) if (User-Name != "%{tolower:%{User-Name}}") -> FALSE (267) if (User-Name =~ / /) { (267) if (User-Name =~ / /) -> FALSE (267) if (User-Name =~ /@.*@/ ) { (267) if (User-Name =~ /@.*@/ ) -> FALSE (267) if (User-Name =~ /\\.\\./ ) { (267) if (User-Name =~ /\\.\\./ ) -> FALSE (267) if ((User-Name =~ /@/) && (User-Name !~ /(a)(.+)\\.(.+)$/)) { (267) if ((User-Name =~ /@/) && (User-Name !~ /(a)(.+)\\.(.+)$/)) -> FALSE (267) if (User-Name =~ /\\.$/) { (267) if (User-Name =~ /\\.$/) -> FALSE (267) if (User-Name =~ /(a)\\./) { (267) if (User-Name =~ /(a)\\./) -> FALSE (267) } # policy filter_username = notfound (267) [preprocess] = ok (267) policy operator-name.authorize { (267) if ("%{client:Operator-Name}") { (267) EXPAND %{client:Operator-Name} (267) --> (267) if ("%{client:Operator-Name}") -> FALSE (267) } # policy operator-name.authorize = ok (267) [chap] = noop (267) [mschap] = noop (267) [digest] = noop (267) suffix: Checking for suffix after "@" (267) suffix: Looking up realm "georgetown.edu" for User-Name = " usernamescrub(a)georgetown.edu" (267) suffix: Found realm "georgetown.edu" (267) suffix: Adding Stripped-User-Name = "usernamescrub" (267) suffix: Adding Realm = "georgetown.edu" (267) suffix: Authentication realm is LOCAL (267) [suffix] = ok (267) if ("%{User-Name}" =~ /\\\\?([^@\\\\]+)@?([-[:alnum:]._]*)?$/) { (267) EXPAND %{User-Name} (267) --> usernamescrub(a)georgetown.edu (267) if ("%{User-Name}" =~ /\\\\?([^@\\\\]+)@?([-[:alnum:]._]*)?$/) -> TRUE (267) if ("%{User-Name}" =~ /\\\\?([^@\\\\]+)@?([-[:alnum:]._]*)?$/) { (267) if ("%{2}" && ("%{2}" !~ /.*georgetown\.edu$/i && "%{2}" !~ /msb\.edu$/i) ) { (267) EXPAND %{2} (267) --> georgetown.edu (267) EXPAND %{2} (267) --> georgetown.edu (267) if ("%{2}" && ("%{2}" !~ /.*georgetown\.edu$/i && "%{2}" !~ /msb\.edu$/i) ) -> FALSE (267) } # if ("%{User-Name}" =~ /\\\\?([^@\\\\]+)@?([-[:alnum:]._]*)?$/) = ok (267) if ("%{Realm}" != 'NULL' && "%{Realm}" != 'LOCAL' && "%{Realm}" != 'georgetown.edu' && "%{Realm}" != 'gu.edu' && "%{Realm}" != 'msb.edu' && "%{Realm}" != 'eduroam') { (267) if ("%{Realm}" != 'NULL' && "%{Realm}" != 'LOCAL' && "%{Realm}" != 'georgetown.edu' && "%{Realm}" != 'gu.edu' && "%{Realm}" != 'msb.edu' && "%{Realm}" != 'eduroam') -> FALSE (267) eap: Peer sent EAP Response (code 2) ID 13 length 96 (267) eap: Continuing tunnel setup (267) [eap] = ok (267) } # authorize = ok (267) Found Auth-Type = eap (267) # Executing group from file /etc/raddb/sites-enabled/default (267) authenticate { (267) eap: Expiring EAP session with state 0x4cf0afb84dfdabc5 (267) eap: Finished EAP session with state 0x7f22f2a0752febe9 (267) eap: Previous EAP request found for state 0x7f22f2a0752febe9, released from the list (267) eap: Peer sent packet with method EAP PEAP (25) (267) eap: Calling submodule eap_peap to process data (267) eap_peap: Continuing EAP-TLS (267) eap_peap: [eaptls verify] = ok (267) eap_peap: Done initial handshake (267) eap_peap: [eaptls process] = ok (267) eap_peap: Session established. Decoding tunneled attributes (267) eap_peap: PEAP state phase2 (267) eap_peap: EAP method MD5 (4) (267) eap_peap: Got tunneled request (267) eap_peap: EAP-Message = 0x020d001604104ed6fcaab16a1dcd4bc8ba2eded04e1b (267) eap_peap: Setting User-Name to usernamescrub(a)georgetown.edu (267) eap_peap: Sending tunneled request to inner-tunnel (267) eap_peap: EAP-Message = 0x020d001604104ed6fcaab16a1dcd4bc8ba2eded04e1b (267) eap_peap: FreeRADIUS-Proxied-To = 127.0.0.1 (267) eap_peap: User-Name = "usernamescrub(a)georgetown.edu" (267) eap_peap: State = 0x4cf0afb84dfdabc5e4cbfa01e2805e60 (267) eap_peap: NAS-IP-Address = 137.158.248.12 (267) eap_peap: NAS-Identifier = "mc-wlan-3" (267) eap_peap: Attr-26.9048.0 = 0x50726f786965642d42793d65746c72312e656475726f616d2e6f72672d31343534363537343033 (267) eap_peap: Attr-26.9048.0 = 0x50726f786965642d42793d72616469756d2e737572666e65742e6e6c2d31343534363537343033 (267) eap_peap: Attr-26.9048.0 = 0x50726f786965642d42793d544c5253312e656475726f616d2e7573 (267) eap_peap: Attr-26.9048.0 = 0x50726f786965642d42793d72616469756d2e737572666e65742e6e6c2d31343534363537343033 (267) eap_peap: Attr-26.9048.0 = 0x50726f786965642d42793d544c5253312e656475726f616d2e7573 (267) eap_peap: Attr-26.9048.0 = 0x50726f786965642d42793d544c5253312e656475726f616d2e7573 (267) eap_peap: Event-Timestamp = "Feb 5 2016 14:09:55 EST" (267) Virtual server inner-tunnel received request (267) EAP-Message = 0x020d001604104ed6fcaab16a1dcd4bc8ba2eded04e1b (267) FreeRADIUS-Proxied-To = 127.0.0.1 (267) User-Name = "usernamescrub(a)georgetown.edu" (267) State = 0x4cf0afb84dfdabc5e4cbfa01e2805e60 (267) NAS-IP-Address = 137.158.248.12 (267) NAS-Identifier = "mc-wlan-3" (267) Attr-26.9048.0 = 0x50726f786965642d42793d65746c72312e656475726f616d2e6f72672d31343534363537343033 (267) Attr-26.9048.0 = 0x50726f786965642d42793d72616469756d2e737572666e65742e6e6c2d31343534363537343033 (267) Attr-26.9048.0 = 0x50726f786965642d42793d544c5253312e656475726f616d2e7573 (267) Attr-26.9048.0 = 0x50726f786965642d42793d72616469756d2e737572666e65742e6e6c2d31343534363537343033 (267) Attr-26.9048.0 = 0x50726f786965642d42793d544c5253312e656475726f616d2e7573 (267) Attr-26.9048.0 = 0x50726f786965642d42793d544c5253312e656475726f616d2e7573 (267) Event-Timestamp = "Feb 5 2016 14:09:55 EST" (267) WARNING: Outer and inner identities are the same. User privacy is compromised. (267) server inner-tunnel { (267) session-state: No cached attributes (267) # Executing section authorize from file /etc/raddb/sites-enabled/inner-tunnel (267) authorize { (267) [chap] = noop (267) [mschap] = noop (267) suffix: Checking for suffix after "@" (267) suffix: Looking up realm "georgetown.edu" for User-Name = " usernamescrub(a)georgetown.edu" (267) suffix: Found realm "georgetown.edu" (267) suffix: Adding Stripped-User-Name = "usernamescrub" (267) suffix: Adding Realm = "georgetown.edu" (267) suffix: Authentication realm is LOCAL (267) [suffix] = ok (267) update control { (267) Proxy-To-Realm := LOCAL (267) } # update control = noop (267) eap: Peer sent EAP Response (code 2) ID 13 length 22 (267) eap: No EAP Start, assuming it's an on-going EAP conversation (267) [eap] = updated (267) [files] = noop rlm_ldap (ldap): Reserved connection (12) (267) ldap: EXPAND (uid=%{%{Stripped-User-Name}:-%{User-Name}}) (267) ldap: --> (uid=usernamescrub) (267) ldap: Performing search in "ou=people,dc=georgetown,dc=edu" with filter "(uid=usernamescrub)", scope "sub" (267) ldap: Waiting for search result... (267) ldap: User object found at DN "uid=usernamescrub,ou=people,dc=georgetown,dc=edu" (267) ldap: Processing user attributes (267) ldap: control:Password-With-Header += {MD4}1DD9FC26BF0FCD74413AF390A74F559B rlm_ldap (ldap): Released connection (12) (267) [ldap] = updated (267) if (&control:Password-With-Header =~ /^.MD4.(.*)$/) { (267) if (&control:Password-With-Header =~ /^.MD4.(.*)$/) -> TRUE (267) if (&control:Password-With-Header =~ /^.MD4.(.*)$/) { (267) update control { (267) EXPAND {nt}%{1} (267) --> {nt}1DD9FC26BF0FCD74413AF390A74F559B (267) Password-With-Header := {nt}1DD9FC26BF0FCD74413AF390A74F559B (267) } # update control = noop (267) pap: Converted: Password-With-Header -> NT-Password (267) pap: Removing &control:Password-With-Header (267) pap: Normalizing NT-Password from hex encoding, 32 bytes -> 16 bytes (267) pap: WARNING: Auth-Type already set. Not setting to PAP (267) [pap] = noop (267) } # if (&control:Password-With-Header =~ /^.MD4.(.*)$/) = noop (267) if ((ok || updated) && User-Password) { (267) if ((ok || updated) && User-Password) -> FALSE (267) [expiration] = noop (267) [logintime] = noop (267) pap: WARNING: Auth-Type already set. Not setting to PAP (267) [pap] = noop (267) } # authorize = updated (267) Found Auth-Type = eap (267) # Executing group from file /etc/raddb/sites-enabled/inner-tunnel (267) authenticate { (267) eap: Expiring EAP session with state 0x4cf0afb84dfdabc5 (267) eap: Finished EAP session with state 0x4cf0afb84dfdabc5 (267) eap: Previous EAP request found for state 0x4cf0afb84dfdabc5, released from the list (267) eap: Peer sent packet with method EAP MD5 (4) (267) eap: Calling submodule eap_md5 to process data (267) eap_md5: Cleartext-Password is required for EAP-MD5 authentication (267) eap: ERROR: Failed continuing EAP MD5 (4) session. EAP sub-module failed (267) eap: Sending EAP Failure (code 4) ID 13 length 4 (267) eap: Failed in EAP select (267) [eap] = invalid (267) } # authenticate = invalid (267) Failed to authenticate the user (267) Using Post-Auth-Type Reject (267) # Executing group from file /etc/raddb/sites-enabled/inner-tunnel (267) Post-Auth-Type REJECT {

2 5

Re: Framed-IP-Address to Proxy acct
by Elton Machado 05 Feb '16

05 Feb '16

Hi Alan, First of all thanks for your help, the pre-proxy statement must go in the site-enabled/default right? or it goes in proxy.conf? Should this work instead? update request { Framed-IP-Address := "%{Framed-IP-Address}" } Regards, Elton It is not possible to use the Date: Fri, 5 Feb 2016 13:43:47 -0500 From: Alan DeKok <aland(a)deployingradius.com> To: FreeRadius users mailing list <freeradius-users(a)lists.freeradius.org> Subject: Re: Framed-IP-Address to Proxy acct Message-ID: <345DD157-E00A-486D-AE46-1DBA3898AEB4(a)deployingradius.com> Content-Type: text/plain; charset=us-ascii On Feb 4, 2016, at 6:55 PM, Elton Machado <elton.machado(a)tenforce.com> wrote: > How can I sent the Framed-IP-Address to a acct remote proxy? Add the attribute to the packet in the pre-proxy section. > My authentication is being done in a Remote Radius, and I need to send back > the accounting from Freeradius to another radius accounting server or at > least duplicate accounting to there (Sonicwall) > > Since my Dell switch are not able to send the attribute 8 but only the mac > address. OK. That's fine. > > Freeradius is responsible for the DHCP and I can see the Framed-IP-Address > being there and being set to the DHCP Client IP, but on my proxy acct > server I don't see on the AVP the attr 8. The IP address is stored in an SQL database, along with the MAC address of the machine. So... when the server receives an Accounting-Request packet containing a MAC address, look up the MAC in the SQL database to get the IP address. pre-proxy { ... update request { Framed-IP-Address := "%{sql:SELECT ...}" } ... } You'll have to write the SQL select statement. Test it by hand first, and then add it to the server configuration. Alan DeKok.

2 5

Framed-IP-Address to Proxy acct
by Elton Machado 05 Feb '16

05 Feb '16

Hi There, How can I sent the Framed-IP-Address to a acct remote proxy? My authentication is being done in a Remote Radius, and I need to send back the accounting from Freeradius to another radius accounting server or at least duplicate accounting to there (Sonicwall) Since my Dell switch are not able to send the attribute 8 but only the mac address. Freeradius is responsible for the DHCP and I can see the Framed-IP-Address being there and being set to the DHCP Client IP, but on my proxy acct server I don't see on the AVP the attr 8. Cheers, Elton

2 1

freeradius fail redundant
by Дмитрий 05 Feb '16

05 Feb '16

Freeradius Version: 2.1.12+dfsg-1.2ubuntu8.1 /etc/freeradius/radiusd.conf accounting { switch "%{Hint}" { case "session" { redundant { module-sql-session write-backlog ok } } case "service" { redundant { module-sql-service write-backlog ok } } } } In debug sql returns "noop" Mon Feb 1 13:12:58 2016 : Debug: rlm_sql (module-sql-session): Reserving sql socket id: 14 Mon Feb 1 13:12:58 2016 : Debug: rlm_sql_mysql: query: call freeradius_session_sql('2016-02-01 13:12:58', '7c4d32221312f4c7', '', 'test-user', '172.12.12.5', '172.1.1.52', 0, 0, 0, 0, 0, 0, 0); Mon Feb 1 13:12:58 2016 : Debug: rlm_sql (module-sql-session): Released sql socket id: 14 Mon Feb 1 13:12:58 2016 : Info: +++++[module-sql-session] returns noop Mon Feb 1 13:12:58 2016 : Info: [write-backlog] expand: /var/log/freeradius/radacct/backlog/write-backlog-%Y-%m-%d-%H.log -> /var/log/freeradius/radacct/backlog/write-backlog-2016-02-01-13.log Mon Feb 1 13:12:58 2016 : Info: [write-backlog] /var/log/freeradius/radacct/backlog/write-backlog-%Y-%m-%d-%H.log expands to /var/log/freeradius/radacct/backlog/write-backlog-2016-02-01-13.log Mon Feb 1 13:12:58 2016 : Info: [write-backlog] Acquired filelock, tried 1 time(s) Mon Feb 1 13:12:58 2016 : Info: [write-backlog] expand: %t -> Mon Feb 1 13:12:58 2016 Mon Feb 1 13:12:58 2016 : Info: +++++[write-backlog] returns ok Mon Feb 1 13:12:58 2016 : Info: ++++- group safe-module-sql-session returns ok Mon Feb 1 13:12:58 2016 : Info: +++- case session returns ok Mon Feb 1 13:12:58 2016 : Info: ++- switch %{Hint} returns ok BUT in tcpdump Mysql Response OK

5 12

RE: [freeRADIUS 2.2.9 : fail building the rlm_sql_oracle module : make: *** No rule to make target `../../../../../Make.inc'. Stop
by Vincent MARCEL 05 Feb '16

05 Feb '16

Hello, I have followed your advice and got freeradius 3.0.11 tarball and followed new instructions here : http://wiki.freeradius.org/modules/Rlm_sql_oracle Top level configure script => OK make => OK cd src/modules/rlm_sql/drivers/rlm_sql_oracle => OK make install => KO : [radiusrec@radiusa1r1 rlm_sql_oracle]$ make install make: *** No rule to make target `install'. Stop. Indeed, there is no Makefile in this directory. I tried "make install" on top level (freeradius-server-3.0.11 directory) : [radiusrec@radiusa1r1 freeradius-server-3.0.11]$ make install mkdir: cannot create directory `/usr/local/include/freeradius': Permission denied make: *** [/usr/local/include/freeradius] Error 1 What do I have to do to install properly this freeradius WITH rlm_sql_oracle driver ? Best regards, Vincent MARCEL -----Message d'origine----- De : Alan DeKok [mailto:aland@deployingradius.com] Envoyé : jeudi 4 février 2016 16:04 À : Vincent MARCEL Objet : Re: [freeRADIUS 2.2.9 : fail building the rlm_sql_oracle module : make: *** No rule to make target `../../../../../Make.inc'. Stop On Feb 4, 2016, at 6:20 AM, vincent.marcel(a)monext.net wrote: > > Hi, > > Thank you for your answer. > The top level configure + make commands are successful and I now get 2 problems : > > 1/ if I use in the new binary freeradius-server-2.2.9/src/main/radius instead of /usr/sbin/radius (2.2.6 version) in /etc/init.d/radius script (in order to keep same version for server and rlm_sql module), I get this error at launch : > Thu Feb 4 10:34:02 2016 : Error: Refusing to start with libssl > version OpenSSL 1.0.1e-fips 11 Feb 2013 (in range 1.0.1 - 1.0.1f). > Security advisory CVE-2014-0160 (Heartbleed) Thu Feb 4 10:34:02 2016 > : Error: For more information see http://heartbleed.com Read raddb/radiusd.conf from the 2.2.9 distribution. Look for "openssl". > But my CentOS is up to date with a 1.0.1e openssl version that include all security patches. So, heartbleed is fixed and radius should not refuse to start. Is it possible de disable this check at launch ? Yes. And this is documented. > 2/ When I want to install the rlm_sql_oracle library, I get this error : > [radiusrec@radiusa1r1 rlm_sql_oracle]$ make install if [ > "xrlm_sql_oracle" != "x" ]; then \ > /USR/radiusrec/freeradius-server-2.2.9/libtool --mode=install /USR/radiusrec/freeradius-server-2.2.9/install-sh -c -c \ > rlm_sql_oracle.la /usr/local/lib/rlm_sql_oracle.la || exit $?; \ > rm -f /usr/local/lib/rlm_sql_oracle-2.2.9.la; \ > ln -s rlm_sql_oracle.la /usr/local/lib/rlm_sql_oracle-2.2.9.la || exit $?; \ > fi > /USR/radiusrec/freeradius-server-2.2.9/install-sh -c -c > .libs/rlm_sql_oracle-2.2.9.so /usr/local/lib/rlm_sql_oracle-2.2.9.so > cp: cannot create regular file `/usr/local/lib/_inst.50844_': > Permission denied > make: *** [install] Error 1 Weird. I've never seen that happen. > I have found where /usr/local/lib is configured (rlm_sql_oracle.la) but may I change the install path for my home directory for example : will it work ? I doubt that radiusd will find rlm_sql_oracle module at launch. > What should I do ? Try 3.0.11. We've updated the build system so that it doesn't use the crappy GNU libtool / libltdl. That should help. Alan DeKok.

3 2

RadPerf failed requests explanation
by Jim 05 Feb '16

05 Feb '16

I'm using RadPerf to test our servers for 10k auth requests in 10 requests in parallel. The server used python module and sql, and performs around 285 packets/s accepting all the 10k requests but there are times when there are several failed requests around 5 to 20. Why are there failed requests? From RadPerf README file, Performance testing ------------------- To see the maximum accepted load that a RADIUS server can handle, use: $ radperf -p 100 -s -f test.csv ... Using larger values for -p will not change the maximum accepted load, but will change the delay between a request and response. > "Using larger values for -p will not change the maximum accepted load, but will change the delay between a request and response" Why is that?

2 1

OpenLDAP+FreeRadius Encryption
by Greg Mischel Smith 05 Feb '16

05 Feb '16

We're using currently using freeradius 2.x and migrating to a new server where we will be using 3.0.4. Our OpenLDAP server has plaintext passwords currently, but as I migrate the server over, I would like to encrypt and salt them (something like SSHA). Both the LDAP and Radius servers will be on the same box. The problem devices is our wireless clients made up of Macs and phones (Android and iPhone) and the traffic passes through a Cisco WLC. If I want to encrypt, then it seems I would have to use EAP-GTC along with PAP. The Macs seem to only want to authenticate with MSCHAPv2. I found on Android phones if I don't set the Phase 2 authentication, it only checks MSCHAPv2, however if I force it to use GTC, then it authenticates correctly. I did notice in the logs using GTC, it has the ability to display the encrypted password in the clear. Didn't do this with MSCHAPv2. So here are my questions: 1. Is there something I'm missing from what I've trying and seeing above? 2. Is GTC and PAP with encrypted passwords less secure than using MSCHAPv2 with Plain text passwords in LDAP (even though they are on the same box)? 3. Should Mac's be able to use GTC? I've read that with Cisco ISE, this can be force, but beyond that I couldn't come across any article discussing it. I'm having trouble finding the article or thread, but I had read before the best solution with OpenLDAP and FreeRadius is plain-text passwords in LDAP, MSCHAPv2 for authentication and ACL's on the ldap OU's. Is this the recommendation? I would also like to prevent the ability to sniff the passwords in whichever scenario is used.

6 21

rest modules JSON replies format and types
by Louis Munro 05 Feb '16

05 Feb '16

Hello all, I am having a bit of fun playing around with the rest module in 3.0.10 to replace a custom coded perl module. I got it working and everything seem to work nicely but for one thing. The documentation says that the JSON payload in the request and in the reply should be in the same format. I have no problem with the request (since FR is encoding it anyway), and I have been able to hack a reply in the right format which is accepted by the module and sets the attributes I want, but I must concede that I am cheating a little at this point. I am returning every attribute with the type set to “string”. That is to say, if I get a request that looks like the following: { "Called-Station-SSID": { "value": [ "IofStuff" ], "type": "string" }, "EAP-Type": { "value": [ 26 ], "type": "integer" }, "FreeRADIUS-Proxied-To": { "value": [ "127.0.0.1" ], "type": "ipaddr" }, "Location-Capable": { "value": [ 1 ], "type": "integer" }, "Tunnel-Medium-Type": { "value": [ "IEEE-802" ], "type": "integer" }, } My reply will actually look like: { "Tunnel-Medium-Type": { "type": "string", "value": [ 6 ] }, "Tunnel-Type": { "type": "string", "value": [ 13 ] }, "Tunnel-Private-Group-ID": { "type": "string", "value": [ 2 ] } } And yet it seems to work. So, does FreeRADIUS actually look at those types in the JSON reply? Should I be looking into parsing the dictionary files in my REST service to populate the reply with the correct types? Not that it would be that hard, but if it does not matter I can find better ways of keeping myself entertained... Much obliged for any help, -- Louis Munro lmunro(a)inverse.ca :: www.inverse.ca +1.514.447.4918 x125 :: +1 (866) 353-6153 x125 Inverse inc. :: Leaders behind SOGo (www.sogo.nu) and PacketFence (www.packetfence.org)

2 5