May 2016 - Freeradius-Users - lists.freeradius.org

3.0.4: binary LDAP attributes
by Nikolai Kondrashov 24 Mar '17

24 Mar '17

Hi everyone, Our (Red Hat) QA was testing the effect of this entry in 3.0.4 ChangeLog: * Modify pairparsevalue to deal with embedded NULLs better, and use the binary versions of attribute values in rlm_ldap. They have noticed that binary LDAP values get truncated on embedded zero characters (\0) in RADIUS replies, in radiusReplyMessage in particular. I.e. for radiusReplyMessage:: cmVwbHkgd2l0aCBhAGI= The response output by radtest was Reply-Message = 'reply with a' The network capture also showed that RADIUS reply packets contained truncated values. Is this intended, or was there a fix for this? In related discoveries, it seems that backslashes get removed from LDAP attribute values in RADIUS replies, so radiusReplyMessage: reply with a\0b becomes Reply-Message = 'reply with a0b' in radtest output. Is this intended? Thank you. Nick

4 12

user-group for rejected users
by Fabricio Viana 21 Mar '17

21 Mar '17

Hello! Let´s suppose the following situations: 1) User exists but the password is wrong 2) User does not exist In both cases the answer is REJECT. It happens that certain hardware is making endless attempts that eventually saturating the server. - It is possible to cause the server, instead of rejecting the users, accept the login but responds ACCEPT with "framed-pool = pool-block" ? or/and - Is there any way to put REJECT users in a given group by default? Thanks! Fabricio

3 3

Update on 3.0, 3.1, and 3.2.
by Alan DeKok 16 Feb '17

16 Feb '17

We plan on releasing 3.0.12 on Monday. it's stable, and there no new issues being reported for it. This will ideally be the last release of the 3.0 series. Version 3.0 was released almost three years ago, and it's time for a new major version of the server. 3.1 supports a "map" keyword, redis cluster, and many other useful features. Many people have been using the 3.1 branch in production, so we're confident that it is stable and functional. To keep things simple, we don't release an official 3.1 version. Instead, we will call 3.1 a "development / experimental" branch. Once we're ready (later this summer), we'll release an official 3.2 release. The v3.1.x branch will then be frozen, and no further development will occur on it. All new development will then start with a 3.3 branch, which will likely turn into version 4.0. There are enough architecture changes needed that it warrants a 4.0. In summary: 2.1 and earlier: dead. Don't use them. 2.2: Only critical security fixes. We expect this won't happen. 3.0: stable. New installations can use 3.0. 3.1: development. Use it only if you know what you're doing. 3.2: (future stable). Mid 2016 on, new installations should use this. 3.3. (future development), more changes, with a goal of increasing performance substantially.

4 6

freeradius2 + iODBC + Informix
by vanish 28 Nov '16

28 Nov '16

Hello, Please help me set up freeradius2 + iODBC + Informix (I'm newbie in freeradius). - I have a test-machine with Ubuntu 14.04 and Freeradius-server v2.1.12. - I have a server with Informix Database Server v 10.00 Step 1: - I installed unixODBC on test-machine - I installed informix-csdk for connect to Informix Database Server (Driver) - I configured files /etc/odbc.ini and /etc/odbcinst.ini to connect to Informix Database Server - Checking with isql: +++++++++++++++++++++++++++++++++++++++++ root@test:/home/test# isql -v work +---------------------------------------+ | Connected! | | | | sql-statement | | help [tablename] | | quit | | | +---------------------------------------+ SQL> select 1 from TABLES(SET{1}) 1 +++++++++++++++++++++++++++++++++++++++++ - Everything is allright. Step 2: - I try to install freeradius-iodbc module to connect to Informix Database Server - During install I get next warning: +++++++++++++++++++++++++++++++++++++++++++++ The following packages will be REMOVED: unixodbc unixodbc-dev The following NEW packages will be installed: libiodbc2-dev +++++++++++++++++++++++++++++++++++++++++++++ - so unixodbc and unixodbc-dev packages was removed after install freeradius-iodbc - I included in radiusd.conf: +++++++++++++++++++++++++++++++++++++++++++++ sql { # # Set the database to one of: # # mysql, mssql, oracle, postgresql # database = "iodbc" # # Which FreeRADIUS driver to use. # driver = "rlm_sql_${database}" # Connection info: server = "test.server.ru" port = 1425 login = "test" password = "test123" radius_db = "test" ... +++++++++++++++++++++++++++++++++++++++++++++ - freeradius -XXX showed me next error: ++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++ ... Fri Nov 21 14:53:48 2014 : Info: rlm_sql (sql): Driver rlm_sql_iodbc (module rlm_sql_iodbc) loaded and linked Fri Nov 21 14:53:48 2014 : Info: rlm_sql (sql): Attempting to connect to test@test.server.ru:1425/test Fri Nov 21 14:53:48 2014 : Debug: rlm_sql (sql): starting 0 Fri Nov 21 14:53:48 2014 : Info: rlm_sql (sql): Attempting to connect rlm_sql_iodbc #0 Fri Nov 21 14:53:48 2014 : Error: sql_create_socket: SQLConnectfailed: [iODBC][Driver Manager]Data source name not found and no default driver specified. Driver could not be loaded Fri Nov 21 14:53:48 2014 : Error: rlm_sql (sql): Failed to connect DB handle #0 ... +++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++ - Error - "SQLConnectfailed: [iODBC][Driver Manager]Data source name not found and no default driver specified. Driver could not be loaded." - Where did I go wrong? - I found some information in net with same problem, but clear decision nowhere not found.

4 4

Adding additional password encryption options
by Laurens Vets 03 Sep '16

03 Sep '16

Hello list, Is it possible to add additional password encryption options to FreeRADIUS so that the user database can be used as a user/password store (For instance PBKDF2 or scrypt)? When I look at "man rlm_pap", the amount of encryption options for passwords are limited when FreeRADIUS is your only user database. I'm creating a POC where users can register for an account to use certain services (accessible via radius authentication) and I'm trying to only use the FreeRADIUS mysql database as a backend to keep it simple, but the password encryption methods aren't considered secure by today's standards. Short of maintaining 2 databases with user information, how are people on the list handling these cases or is my use case a bit out of the ordinary?

4 4

RadPerf running in another server.
by Jim 19 Aug '16

19 Aug '16

Hello, I'm currently running FreeRADIUS 3.0.4 on a CentOS server and I wanted to use RadPerf for testing. Since I cannot install RadPerf in CentOS, I installed RadPerf in a separate Ubuntu 14.04 server, my question is: which is better for RadPerf installation? on the same server where FreeRADIUS was installed or different server?

4 4

authentication-failed
by Ejaz 04 Aug '16

04 Aug '16

Hello all. 1. NAS (MDG from Motorola, do we need add addionational attributes in dictionary file for the Motorola MDG) 2. Freeradius version 3.x, oracle 11g client (installed or Dell PowerEdge R730 or oracle 11x86) 3. Database (installed or Sparc remote server) 4. Driver rlm_sql is already installed . <mailto:root@ruh02saaa02:/usr/local/freeradius3/lib> root@ruh02saaa02:/usr/local/freeradius3/lib# ls -l rlm_sql_oracle* -rwxr-xr-x 1 root root 964808 Apr 14 14:35 rlm_sql_oracle.a -rwxr-xr-x 1 root root 27 Apr 14 14:35 <http://rlm_sql_oracle.la/> rlm_sql_oracle.la -rwxr-xr-x 1 root root 775232 Apr 14 14:35 rlm_sql_oracle.so The Radius server is able to connect to the database as below but the authentication is failed. as i am very new to freeradius any help would be highly appreciated.. } Listening on auth address 127.0.0.1 port 18120 bound to server inner-tunnel Listening on auth address * port 1812 bound to server default Listening on acct address * port 1813 bound to server default Listening on auth address :: port 1812 bound to server default Listening on acct address :: port 1813 bound to server default Listening on proxy address * port 59512 Listening on proxy address :: port 52582 Ready to process requests (0) Received Access-Request Id 0 from <http://10.99.10.135:54942/> 10.99.10.135:54942 to <http://0.0.0.0:1812/> 0.0.0.0:1812 length 52 (0) User-Name = "10.10.82.80 " (0) User-Password = "cisco" (0) # Executing section authorize from file /usr/local/freeradius3/etc/raddb/sit es-enabled/default (0) authorize { (0) policy filter_username { (0) if (&User-Name) { (0) if (&User-Name) -> TRUE (0) if (&User-Name) { (0) if (&User-Name =~ / /) { (0) if (&User-Name =~ / /) -> TRUE (0) if (&User-Name =~ / /) { (0) update request { (0) &Module-Failure-Message += 'Rejected: User-Name contains whitesp ace' (0) } # update request = noop (0) [reject] = reject (0) } # if (&User-Name =~ / /) = reject (0) } # if (&User-Name) = reject (0) } # policy filter_username = reject (0) } # authorize = reject (0) Using Post-Auth-Type Reject (0) # Executing group from file /usr/local/freeradius3/etc/raddb/sites-enabled/d efault (0) Post-Auth-Type REJECT { (0) sql: EXPAND .query (0) sql: --> .query (0) sql: Using query template 'query' rlm_sql (sql): Closing connection (0): Hit idle_timeout, was idle for 104 second s rlm_sql (sql): Closing connection (1): Hit idle_timeout, was idle for 104 second s rlm_sql (sql): Closing connection (2): Hit idle_timeout, was idle for 104 second s rlm_sql (sql): You probably need to lower "min" rlm_sql (sql): Closing connection (3): Hit idle_timeout, was idle for 104 second s rlm_sql (sql): You probably need to lower "min" rlm_sql (sql): Closing connection (4): Hit idle_timeout, was idle for 104 second s rlm_sql (sql): You probably need to lower "min" rlm_sql (sql): 0 of 0 connections in use. You may need to increase "spare" rlm_sql (sql): Opening additional connection (5), 1 of 32 pending slots used rlm_sql (sql): Reserved connection (5) (0) sql: EXPAND %{User-Name} (0) sql: --> 10.10.82.80 (0) sql: SQL-User-Name set to '10.10.82.80 ' (0) sql: EXPAND INSERT INTO radpostauth (username, pass, reply, authdate) VALUES ( '%{SQL-User-Name}', '%{%{User-Password}:-%{Chap-Password}}', '%{reply:Packet- Type}', '%S') (0) sql: --> INSERT INTO radpostauth (username, pass, reply, authdate) VALUES ( '10.10.82.80 ', 'cisco', 'Access-Reject', '2016-04-14 16:32:58') (0) sql: Executing query: INSERT INTO radpostauth (username, pass, reply, authda te) VALUES ( '10.10.82.80 ', 'cisco', 'Access-Reject', '2016-04-14 16:32:58') (0) sql: SQL query returned: success (0) sql: 1 record(s) updated rlm_sql (sql): Released connection (5) rlm_sql (sql): Need 2 more connections to reach 10 spares rlm_sql (sql): Opening additional connection (6), 1 of 31 pending slots used (0) [sql] = ok (0) attr_filter.access_reject: EXPAND %{User-Name} (0) attr_filter.access_reject: --> 10.10.82.80 (0) attr_filter.access_reject: Matched entry DEFAULT at line 11 (0) [attr_filter.access_reject] = updated (0) [eap] = noop (0) policy remove_reply_message_if_eap { (0) if (&reply:EAP-Message && &reply:Reply-Message) { (0) if (&reply:EAP-Message && &reply:Reply-Message) -> FALSE (0) else { (0) [noop] = noop (0) } # else = noop (0) } # policy remove_reply_message_if_eap = noop (0) } # Post-Auth-Type REJECT = updated (0) Delaying response for 1.000000 seconds Waking up in 0.3 seconds. Waking up in 0.6 seconds. (0) Sending delayed response (0) Sent Access-Reject Id 0 from <http://0.0.0.0:1812/> 0.0.0.0:1812 to <http://10.99.10.135:54942/> 10.99.10.135:54942 length 20 Waking up in 3.9 seconds. (0) Cleaning up request packet ID 0 with timestamp +104 Ready to process requests Thanks, Mohammed Ejaz Asst. Operation Director of Systems. Cyberia SAUDI ARABIA P.O.Box: 301079, Riyadh 11372 Phone: (+966) 11 464 7114 Ext. 140 Mobile: (+966) 562311787 Fax: (+966) 11 465 4735 Website: http://www.cyberia.net.sa

3 5

using SSL certs with EAP-TLS
by Wouter 05 Jul '16

05 Jul '16

Goodday, In my FreeRadius setup for authenticating WiFi devices with EAP-TLS, I use server- and client SSL certificates from CA provider ' X '. I understand that now everyone with knowledge of this fact, can get a client SSL cert (PKCS#12) from this CA provider X and can authenticate with my WPA2 Enterprise network. After reading the following from the README: "In general, you should use self-signed certificates for 802.1x (EAP) authentication. When you list root CAs from other organisations in the "ca_file", you permit them to masquerade as you, to authenticate your users, and to issue client certificates for EAP-TLS." I would like to ask the following question. Is there something I can configure on the server side that only certain CommonName's and/or serial's can be used to authenticate correctly? Next to this question, I wonder why also a username (Benutzername) is asked in iOS when we use EAP-TLS with a certificate? I can fill out this field with whatever string and it authenticates in FreeRadius (when a correct cert is presented of course). screenshot: https://hilfe.uni-paderborn.de/images/thumb/4/4f/Eduroam_iOS7_04.png/250px-… I run version 3.0.11 on Ubuntu 14.04 LTS 64bit. Thank you

4 10

determining conditions to differentiate message? types
by Brendan Kearney 30 May '16

30 May '16

i was told that the "if (EAP-Message)" condition would not differentiate between MAC auth and normal .1x, and that i need to capture and read the packets a bit more to make that differentiation. where can i go to find more info about how to do that? how do i find what are conditions that i can key off of? i am looking to do radius vlan assignment, and need to work through getting the conditions identified properly and replying correctly. thanks in advance, brendan

2 3

Using rlm_perl freeradiis 3.0.11
by khouzam.yaghi＠gmail.com 30 May '16

30 May '16

I read the documentation for rlm_perl but i didnt understand where should i write the function , in /mods-available/perl i should uncomment the function i want and then i write it in example.pl , or i should write in the same file (/mods-available/perl) ??? Also after writting the function i just add perl in the specified section in sites-available/default?? Thanks in advance.

2 1