February 2016 - Freeradius-Users - lists.freeradius.org

Upgrading FreeRadius / MSSQL
by Richard J Palmer 29 Feb '16

29 Feb '16

Hi All I am after a little advice if I may as we upgrade our FreeRadius Servers here. For long and complicated reasons the backed database is on a MSSQL Server rather than mysql etc. We are currently using the very old 2.1.x server (which works BUT I know is rather old in the tooth) but moving to the latest 3.1 release. However I have a quick question before I start the process. Taking a look at http://wiki.freeradius.org/modules/Rlm_sql I can see that there are 3 possible drivers mentioned for use with mssql - We are currently using freetds - however the site mentions: rlm_sql_freetds - FreeTDS (mssql) rlm_sql_sybase - Sybase (mssql) rlm_sql_unixodbc - unixODBC (mssql) As possibly suitable - is there a current 'preference' ? If it makes any difference I am hoping to set up failover between two mssql servers - one as primary the other for IF the primary server fails Thanks in advance Richard Palmer

3 2

Re: acct_unique problem
by Viana 28 Feb '16

28 Feb '16

Hello Alan. Thanks for you reply. As you said, I did this modification into sites-available/default file: preacct { "%{NAS-Port}" if (outer.request) { update request { NAS-Port := &NAS-Port } } ... Here is the log file: (0) # Executing section preacct from file /usr/local/etc/raddb/sites-enabled/default (0) preacct { (0) EXPAND %{NAS-Port} (0) --> 0 (0) if (outer.request) { (0) if (outer.request) -> TRUE (0) if (outer.request) { (0) update request { (0) NAS-Port := &NAS-Port -> 0 (0) } # update request = noop (0) } # if (outer.request) = noop The problem is that NAS-Port is 0 (zero) when the request enters preacct, and setting NAS-Port := &NAS-Port inside preacct is taking the zero value. Is it possible to set a temporary variable berfore preacct and use this value inside? Something like this: NAS-Port_temp := &NAS-Port (before preacct) And inside preacct: if (outer.request) { update request { NAS-Port := &NAS-Port_temp } } If it´s possible, where can I set NAS-Port_temp to be used by preacct later? Did you find the solution to this issue for newer versions of FreeRadius? Thanks again! Regards Fabricio --- Este email foi escaneado pelo Avast antivírus. http://www.avast.com

1 0

how to test CHAP authentication with radtest/radclient
by Michael Martinez 28 Feb '16

28 Feb '16

I'm running freeradius-3.0.11. I've got a test user configured in the local unix system, and PAP authentication works. I'm trying to test it with CHAP (for educational purposes). First I run radtest: radtest -t chap test4 testing4 127.0.0.1 0 xxxxx (7) Login incorrect (chap: &control:Cleartext-Password is required for authentication): [test4/<CHAP-Password>] (from client localhost port 0) Then I try radclient: echo "User-Name=test4,Cleartext-Password=testing4,Chap-Password=testing4" | radclient 127.0.0.1 auth hello I tried this latter one with different combinations of "User-Password", "CHAP-Password" and "Cleartext-Password" but they all result in the same error seen below: (11) Found Auth-Type = CHAP (11) # Executing group from file /usr/local/freeradius/etc/raddb/sites-enabled/default (11) Auth-Type CHAP { (11) chap: ERROR: &control:Cleartext-Password is required for authentication (11) [chap] = fail (11) } # Auth-Type CHAP = fail (11) Failed to authenticate the user (11) Login incorrect (chap: &control:Cleartext-Password is required for authentication): [test4/<CHAP-Password>] (from client localhost port 0) I can't tell whether I'm running the tests incorrectly or I've got the server set up incorrectly (I suspect it's the former.) -- --- Michael Martinez http://www.michael--martinez.com

1 1

PPA stable 3.x plans for Ubuntu 16.04?
by Lovaas,Steven 27 Feb '16

27 Feb '16

I'm looking at upgrading from 2.x to 3, but wonder if a new stable build is coming soon. Are there plans to have the PPA updated soon after the release of 16.04? Thanks! Steve

3 2

installing freeradius error
by Doug Berman 27 Feb '16

27 Feb '16

Hello There is an error towards the bottom. I previously had an older version which I installed. Now I'm running into this. Thank you! /doug doug@db-dell:/etc$ sudo apt-get install freeradius make Reading package lists... Done Building dependency tree Reading state information... Done make is already the newest version. The following package was automatically installed and is no longer required: libfreeradius2 Use 'apt-get autoremove' to remove it. The following extra packages will be installed: freeradius-common freeradius-config freeradius-utils Suggested packages: freeradius-ldap freeradius-postgresql freeradius-mysql freeradius-krb5 snmp The following NEW packages will be installed: freeradius freeradius-common freeradius-config freeradius-utils 0 upgraded, 4 newly installed, 0 to remove and 114 not upgraded. Need to get 105 kB/2,069 kB of archives. After this operation, 5,233 kB of additional disk space will be used. Do you want to continue? [Y/n] y WARNING: The following packages cannot be authenticated! freeradius-common freeradius-config freeradius freeradius-utils Install these packages without verification? [y/N] y Get:1 http://ppa.launchpad.net/freeradius/stable-3.0/ubuntu/ trusty/main freeradius-utils amd64 3.0.10-ppa2~trusty [105 kB] Fetched 105 kB in 0s (144 kB/s) dpkg: unrecoverable fatal error, aborting: syntax error: unknown user 'freerad' in statoverride file E: Sub-process /usr/bin/dpkg returned an error code (2)

4 14

How to enable the "Session-Timeout" attribute?
by zhengfish 26 Feb '16

26 Feb '16

Hello, I want to enable the Session-Timeout attribute, and add it into /etc/freeradius/users as below: friends Cleartext-Password := "12343333" Service-Type = Framed-User, Session-timeout = 80, Reply-Message = "Welcome, %{User-Name}" Then I can test it with radeapclient and got a result with Session-Timeout value. Next I want to connect hostapd to freeradius as a radius client, however I cannot get a result with Session-Timeout value. I do some tcpdump to parse the RADIUS udp packet, I found that there is a Session-Timeout attribute in early "Access-Challenge" packets, however in later "Access-Challenge" packets and the last "Access-Accept", the Session-Timeout attribute disappear. Why? I want to know how to enable Session-Timeout attribute in last "Access-Accept" packet. ------------------------------------ Here is the decoded UDP-1812 packets ----------------------------------------------------- /////////////////////////////////////////////////////////////////////////////////////////////////////////////// //////////// There is a AVP: Session-Timeout: 80 RADIUS Protocol Code: Access-Challenge (11) Packet identifier: 0x65 (101) Length: 110 Authenticator: 513ca93d5b2fe694852edad5796e873f [This is a response to a request in frame 1] [Time from request: 0.000964000 seconds] Attribute Value Pairs AVP: l=6 t=Service-Type(6): Framed(2) Service-Type: Framed (2) AVP: l=6 t=Session-Timeout(27): 80 Session-Timeout: 80 AVP: l=18 t=Reply-Message(18): Welcome, friends Reply-Message: Welcome, friends AVP: l=24 t=EAP-Message(79) Last Segment[1] EAP fragment: 019a00160410aa40b4b2c24e6e447f48c1de9530e45c Extensible Authentication Protocol Code: Request (1) Id: 154 Length: 22 Type: MD5-Challenge EAP (EAP-MD5-CHALLENGE) (4) [Expert Info (Warn/Security): Vulnerable to MITM attacks. If possible, change EAP type.] [Vulnerable to MITM attacks. If possible, change EAP type.] [Severity level: Warn] [Group: Security] EAP-MD5 Value-Size: 16 EAP-MD5 Value: aa40b4b2c24e6e447f48c1de9530e45c AVP: l=18 t=Message-Authenticator(80): eb392ef543cf61e13c6e58bcaed46577 Message-Authenticator: eb392ef543cf61e13c6e58bcaed46577 AVP: l=18 t=State(24): b5d32c27b54928e8e6f7137e05697f5e State: b5d32c27b54928e8e6f7137e05697f5e /////////////////////////////////////////////////////////////////////////////////////////////////////////////// //////////// There is no AVP: Session-Timeout, and why it disappear? RADIUS Protocol Code: Access-Challenge (11) Packet identifier: 0x67 (103) Length: 1090 Authenticator: cb2585fb656ee2f714fb5425ec4e6527 [This is a response to a request in frame 5] [Time from request: 0.004675000 seconds] Attribute Value Pairs AVP: l=255 t=EAP-Message(79) Segment[1] EAP fragment: 019c040019c00000045c1603010039020000350301e7a203... AVP: l=255 t=EAP-Message(79) Segment[2] EAP fragment: f8536db5bc4ebf41cdcdbdaf51935045343680b0104d1b8f... AVP: l=255 t=EAP-Message(79) Segment[3] EAP fragment: 0d06092a864886f70d01010b05000382010100daebd2a23e... AVP: l=255 t=EAP-Message(79) Segment[4] EAP fragment: f93c85f6c573803c63a809ed50872b35472336d5b30f1603... AVP: l=14 t=EAP-Message(79) Last Segment[5] EAP fragment: f46d3040cff8f0ac356b4d90 Extensible Authentication Protocol Code: Request (1) Id: 156 Length: 1024 Type: Protected EAP (EAP-PEAP) (25) EAP-TLS Flags: 0xc0 1... .... = Length Included: True .1.. .... = More Fragments: True ..0. .... = Start: False .... .000 = Version: 0 EAP-TLS Length: 1116 [2 EAP-TLS Fragments (1116 bytes): #6(1014), #8(102)] [Frame: 6, payload: 0-1013 (1014 bytes)] [Frame: 8, payload: 1014-1115 (102 bytes)] [Fragment Count: 2] [Reassembled EAP-TLS Length: 1116] Secure Sockets Layer TLSv1 Record Layer: Handshake Protocol: Server Hello Content Type: Handshake (22) Version: TLS 1.0 (0x0301) Length: 57 Handshake Protocol: Server Hello Handshake Type: Server Hello (2) Length: 53 Version: TLS 1.0 (0x0301) Random GMT Unix Time: Feb 22, 2093 23:22:25.000000000 China Standard Time Random Bytes: 608ccc8b12dc4d965050630f0f439ea9bdae18141a97a288... Session ID Length: 0 Cipher Suite: TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA (0xc014) Compression Method: null (0) Extensions Length: 13 Extension: renegotiation_info Type: renegotiation_info (0xff01) Length: 1 Renegotiation Info extension Renegotiation info extension length: 0 Extension: ec_point_formats Type: ec_point_formats (0x000b) Length: 4 EC point formats Length: 3 Elliptic curves point formats (3) EC point format: uncompressed (0) EC point format: ansiX962_compressed_prime (1) EC point format: ansiX962_compressed_char2 (2) TLSv1 Record Layer: Handshake Protocol: Certificate Content Type: Handshake (22) Version: TLS 1.0 (0x0301) Length: 704 Handshake Protocol: Certificate Handshake Type: Certificate (11) Length: 700 Certificates Length: 697 Certificates (697 bytes) Certificate Length: 694 Certificate: 308202b23082019aa003020102020900dcb8917524af35a0... (id-at-commonName=ubuntu) signedCertificate version: v3 (2) serialNumber: -2542122057337981536 signature (sha256WithRSAEncryption) Algorithm Id: 1.2.840.113549.1.1.11 (sha256WithRSAEncryption) issuer: rdnSequence (0) rdnSequence: 1 item (id-at-commonName=ubuntu) RDNSequence item: 1 item (id-at-commonName=ubuntu) RelativeDistinguishedName item (id-at-commonName=ubuntu) Id: 2.5.4.3 (id-at-commonName) DirectoryString: printableString (1) printableString: ubuntu validity notBefore: utcTime (0) utcTime: 14-07-24 08:10:04 (UTC) notAfter: utcTime (0) utcTime: 24-07-21 08:10:04 (UTC) subject: rdnSequence (0) rdnSequence: 1 item (id-at-commonName=ubuntu) RDNSequence item: 1 item (id-at-commonName=ubuntu) RelativeDistinguishedName item (id-at-commonName=ubuntu) Id: 2.5.4.3 (id-at-commonName) DirectoryString: printableString (1) printableString: ubuntu subjectPublicKeyInfo algorithm (rsaEncryption) Algorithm Id: 1.2.840.113549.1.1.1 (rsaEncryption) Padding: 0 subjectPublicKey: 3082010a0282010100e856b7f9bb7b62f9392a07c95cf88c... extensions: 1 item Extension (id-ce-basicConstraints) Extension Id: 2.5.29.19 (id-ce-basicConstraints) BasicConstraintsSyntax [0 length] algorithmIdentifier (sha256WithRSAEncryption) Algorithm Id: 1.2.840.113549.1.1.11 (sha256WithRSAEncryption) Padding: 0 encrypted: daebd2a23ef9eaa63ddbcc2e15c6e989d0cdeeca59b9284d... TLSv1 Record Layer: Handshake Protocol: Server Key Exchange Content Type: Handshake (22) Version: TLS 1.0 (0x0301) Length: 331 Handshake Protocol: Server Key Exchange Handshake Type: Server Key Exchange (12) Length: 327 EC Diffie-Hellman Server Params Curve Type: named_curve (0x03) Named Curve: secp256r1 (0x0017) Pubkey Length: 65 Pubkey: 04c14aa367d5908392067e94509943044f585b4fb6f5f114... Signature Length: 256 Signature: 2282fe1506f827e574054f7faea4830bf6cc651c598e070e... TLSv1 Record Layer: Handshake Protocol: Server Hello Done Content Type: Handshake (22) Version: TLS 1.0 (0x0301) Length: 4 Handshake Protocol: Server Hello Done Handshake Type: Server Hello Done (14) Length: 0 AVP: l=18 t=Message-Authenticator(80): f6c1655b8f0daf6211be63b8512e3674 Message-Authenticator: f6c1655b8f0daf6211be63b8512e3674 AVP: l=18 t=State(24): b5d32c27b74f35e8e6f7137e05697f5e State: b5d32c27b74f35e8e6f7137e05697f5e /////////////////////////////////////////////////////////////////////////////////////////////////////////////// //////////// This is the last Access-Accept Packet, no "Session-Timeout" RADIUS Protocol Code: Access-Accept (2) Packet identifier: 0x6e (110) Length: 169 Authenticator: d91a7b3eb51f9603cb77c7b4ec81a9c8 [This is a response to a request in frame 19] [Time from request: 0.000736000 seconds] Attribute Value Pairs AVP: l=58 t=Vendor-Specific(26) v=Microsoft(311) VSA: l=52 t=MS-MPPE-Recv-Key(17): 825135d40982501e28a6937e32a17dd647d73ed1e6da099f... MS-MPPE-Recv-Key: 825135d40982501e28a6937e32a17dd647d73ed1e6da099f... AVP: l=58 t=Vendor-Specific(26) v=Microsoft(311) VSA: l=52 t=MS-MPPE-Send-Key(16): 8f794639cd3defeb9d0528fb98a5e8c4ea98b7bab29a7eb7... MS-MPPE-Send-Key: 8f794639cd3defeb9d0528fb98a5e8c4ea98b7bab29a7eb7... AVP: l=6 t=EAP-Message(79) Last Segment[1] EAP fragment: 03a20004 Extensible Authentication Protocol Code: Success (3) Id: 162 Length: 4 AVP: l=18 t=Message-Authenticator(80): a8628059998e6599571d318fc1db6d9f Message-Authenticator: a8628059998e6599571d318fc1db6d9f AVP: l=9 t=User-Name(1): friends User-Name: friends

2 3

Link to 2-3 migration on download page is wrong?
by Phil Mayers 26 Feb '16

26 Feb '16

The download page says: """ A basic 2.2.x to 3.0.x migration guide is available here """ ...but that link leads to a file that says: """ If you're upgrading from v2.2.x you should read the v3.0.x version of this file. It describes changed from v2 to v3.0. This file describes only the changes from v3.0 to v3.1 """

2 1

freeradius3, rlm_preprocess changed defaults without notice
by Boris Lytochkin 26 Feb '16

26 Feb '16

Hi. I am struggling moving our RADIUS server from freeradius 2.1 to freeradius 3 and found a (yet another) snag: rlm_preprocess in 2.1 does load huntgroups/users even they are not specified in configuration because it has defaults compiled in. Version 3, instead, needs them to be specified directly as have NULLs instead of default location: version 2: static const CONF_PARSER module_config[] = { { "huntgroups", PW_TYPE_FILENAME, offsetof(rlm_preprocess_t,huntgroup_file), NULL, "${raddbdir}/huntgroups" }, { "hints", PW_TYPE_FILENAME, offsetof(rlm_preprocess_t,hints_file), NULL, "${raddbdir}/hints" }, version 3: static const CONF_PARSER module_config[] = { { "huntgroups", FR_CONF_OFFSET(PW_TYPE_FILE_INPUT, rlm_preprocess_t, huntgroup_file), NULL }, { "hints", FR_CONF_OFFSET(PW_TYPE_FILE_INPUT, rlm_preprocess_t, hints_file), NULL }, This is not mentioned in "Changed modules" here: http://networkradius.com/doc/3.0.10/upgrading/changed-modules.html and adds a cherry on the top of migrating hell pie. Please find a way to fix it properly. -- Boris Lytochkin Yandex NOC +7 (495) 739 70 00 ext. 7671

3 8

Freeradius+CMTS
by Suporte2 - TVC Tubarão 26 Feb '16

26 Feb '16

Hello! I created a new server to work with Centos installed 7. freeradius 3.0.4 repositories by the yum command. This server will authenticate the CM MAC address with NAS as one CMTS. I have a mysql-proxy server with two clusters for authentication. With the command radiusxd -X, I realize you're doing the research in the database, returning the settings. But could not deliver the NAS (CMTS). I I disabled the firewall, the necessary routes were created. The message appears in the log CMTS is dhcp (d). Can someone help me? --- Este email foi escaneado pelo Avast antivírus. https://www.avast.com/antivirus

2 1

Post-Proxy Accept/Reject checking
by Peter Lambrechtsen 25 Feb '16

25 Feb '16

Hello I've got FR3.0.10 working happily and now I am testing some edge cases with post-proxy accepts and rejects. When the proxy returns Reject, which VSA would I need to query to pick that up, as it doesn't seem to be in control:Auth-Type So where could it be?

2 3