May 2016 - Freeradius-Users - lists.freeradius.org

help - zone migration
by Amardeep Singh 04 May '16

04 May '16

Hi, I am trying to implement zone migration on Nomadix. I have made the desired configuration settings on the Nomadix. However when I switch between the SSIDs it does not redirect me to the AAA page. Although I get authenticated on Nomadix but the redirection is not working. I have added the authentication query on free radius as (/etc/raddb/sites-enabled/default):- if ("%{Called-Station-Id}" =~ /^00-50-E8-/) { update request { Tmp-String-0 = "%{sql: SELECT radius_group_name from raduserzone where \ site_id='%{NAS-Identifier}' and \ mac_address='%{Calling-Station-Id}' and \ vlan_id='%{NAS-Port}'}" } if (&Tmp-String-0 != "") { update request { Tmp-String-1 := "%{sql: update radusergroup set \ groupname='%{Tmp-String-0}' \ where username='%{Calling-Station-Id}'}"; } } else { reject } } raduserzone is a custom table :- mysql> select * from raduserzone ; +----+---------+-------------------+---------+-------------------+ | id | site_id | mac_address | vlan_id | radius_group_name | +----+---------+-------------------+---------+-------------------+ I am using custom radius table here to track the guest data while switching in the database. I have attached the radius debug logs. Any ideas/suggestions? Thanks, Amardeep

1 0

how many clients use TCP Radius
by Florin Andrei 04 May '16

04 May '16

What clients actually use Radius over TCP? I can't find anything out there that's widely deployed and can query a Radius server over TCP. E.g. the Cisco documentation for routers, etc. seems to indicate that they only do UDP. The reason why I'm asking - I'm looking into setting up authentication for a variety of clients, with Radius used as a transport protocol, and I'm wondering if it's worth the trouble to even think about enabling TCP, or promising I could offer TCP. Thanks, -- Florin Andrei http://florin.myip.org/

4 6

Definite Auth-Type via SQL-DB
by dump＠gmx.info 03 May '16

03 May '16

Dear list. I'm using freeradius 2.2.5 on Debian-Jessie. I would like to limit the accepted authentication types to TTLS-PAP, as I'm using SHA1-PWs stored in a MySQL-DB. As described on http://deployingradius.com/documents/configuration/auth_type.html using `Auth-Type' in sites-available/inner-tunnel or default to generally reject mschap and chap is not recommended. Instead an entry in the users file (or radcheck table) should be used. The problem is for me, that the example describes the acception of MSCHAP only, but I didn't succeed in adapting it for accepting PAP only. How is this possible to reject any authentication attempt except PAP? For advanced: How generally switch of PEAP? Many thanks in advance and best regards Jens

2 2

Invalid variable expansion, mysql pattern matching, like %
by Ana Gallardo Gómez 03 May '16

03 May '16

Hello, I'm using FreeRADIUS Version 3.0.8in a debian 8. I want to exec a sql query to return a value in Reply-Message: /etc/freeradius/users user Cleartext-Password := "pass" Reply-Message := "%{sql:SELECT username FROM radpostauth WHERE client like 'PA%' ....}" When I run freeradius server in debug mode, I get: Tue May 3 11:58:52 2016 : Debug: (0) files: ::: Examining Reply-Message Tue May 3 11:58:52 2016 : ERROR: (0) files: %{sql:SELECT username FROM radpostauth WHERE client like 'PA%' .... Tue May 3 11:58:52 2016 : ERROR: (0) files: ^ Invalid variable expansion If I delete the % in users files: /etc/freeradius/users user Cleartext-Password := "pass" Reply-Message := "%{sql:SELECT username FROM radpostauth WHERE client like 'PA' ....}" When I run freeradius server in debug mode, I get: rlm_sql (sql): Reserved connection (4) (0) files: Executing select query: SELECT username FROM radpostauth WHERE client like 'PA' and ... (0) files: SQL query returned no results rlm_sql (sql): Released connection (4) (0) files: EXPAND %{sqllocal:SELECT username FROM radpostauth WHERE client like 'PA' and I have this running in older versions of freeradius.Sorry for my english and thank you very much in advance. :::::::::::::::::::::::::::::::::::: :: Ana Gallardo Gómez :: ::::::::::::::::::::::::::::::::::::

2 1

Subject: Re: freeradius 2 certificate compatibility issue with ubuntu
by Dustin S 03 May '16

03 May '16

14.04 Message-ID: <20160430132627.GA10793(a)lboro.ac.uk> Content-Type: text/plain; charset=us-ascii >> p.s.: using v2 since v3 isn't supported on Ubuntu yet. After a full week of trying both the unofficial release and attempting to compile it myself, I realized that I don't know anywhere near enough about freeradius to debug it properly. >v3 is supported on Ubuntu - I've installed it on 14.x, 15.x and 16.x servers. Excellent! Maybe you can help my get past the part that held me up (for most of a week) the last several times I tried to install this version. I did the following and everything went fine (generating the large prime took several minutes): apt-add-repository ppa:freeradius/stable-3.0 apt-get update apt-get install freeradius make Then, after making sure all the necessary utilities were installed: sudo apt-get install freeradius freeradius-mysql freeradius-utils and creating a test user, I started it with "freeradius -X" and the following tests all gave me "Access-Accept" (the third one wouldn't work for my freeradius2): radtest bob h3llo localhost 1812 t3sting123 radtest -t mschap bob h3llo localhost 100 t3sting123 radtest -t eap-md5 bob h3llo localhost 100 t3sting123 The problem I had is that I could never get the database to work. I installed extra mysql stuff I remembered needing for v2: sudo apt-get install mysql-server sudo apt-get install libmysqlclient-dev Then added a database "radius", and imported its tables and user: mysql -u root -p radius < /etc/freeradius/mods-config/sql/main/mysql/schema.sql mysql -u root -p < /etc/freeradius/mods-config/sql/main/mysql/setup.sql And added a test user: INSERT INTO radcheck (UserName, Attribute, op, Value) VALUES ('bobsql', 'Password', ':=', 'h3llo'); Now, the manual at http://wiki.freeradius.org/guide/SQL-HOWTO says to open "/etc/raddb/radiusd.conf" and "$INCLUDE sql.conf", but "sql.conf" isn't in this version. It also says to edit "/etc/raddb/sql.conf" and the "raddb" directory doesn't even exist on my computer. I tried cross referencing this with other sites (and made much use of "grep" and "find"), but nothing worked. Installing daloradius seemed to fix the problem but it came back the next day. Dustin

2 1

Issues with special character 'ß' in password?
by Rudolf Mayer 02 May '16

02 May '16

Hi All! I tried to find information on this on the web, but didn't succeed. I am using freeradius, which is using PAM to talk to an LDAP, together with a Cisco ASA, and all works fine, except that I have a few users that use a 'ß' in their password (ß is a special German character, similar to an s). It seems that somewhere along the lines the characters get scrambled. *) Trying with the Cisco ASA radius test client, I see in the freeradius logs things like Auth: Login incorrect: [blabla/D$D4?p?591924] (from client xxx port y) (the ? where initially ß) *) And with the radtest tool: radtest blabla 'ßß' xxx.yyy.zzz.aaa secret => Auth: Login incorrect: [blabla/<C3>?<C3>?] (from client xxx port 18120) Is there any specific restriction on characters that are allowed? ß is part of the ISO/IEC 8859-1, so it doesn't actually require unicode or the likes. I would also rule out any issues with my LDAP backend, as the passwords work fine when doing authentication directly via LDAP PAM, and via various other applications using an Apache module. Any hint would be welcome! Thanks, Rudolf

2 1