August 2016 - Freeradius-Users - lists.freeradius.org

3.0.4: binary LDAP attributes
by Nikolai Kondrashov 24 Mar '17

24 Mar '17

Hi everyone, Our (Red Hat) QA was testing the effect of this entry in 3.0.4 ChangeLog: * Modify pairparsevalue to deal with embedded NULLs better, and use the binary versions of attribute values in rlm_ldap. They have noticed that binary LDAP values get truncated on embedded zero characters (\0) in RADIUS replies, in radiusReplyMessage in particular. I.e. for radiusReplyMessage:: cmVwbHkgd2l0aCBhAGI= The response output by radtest was Reply-Message = 'reply with a' The network capture also showed that RADIUS reply packets contained truncated values. Is this intended, or was there a fix for this? In related discoveries, it seems that backslashes get removed from LDAP attribute values in RADIUS replies, so radiusReplyMessage: reply with a\0b becomes Reply-Message = 'reply with a0b' in radtest output. Is this intended? Thank you. Nick

4 12

user-group for rejected users
by Fabricio Viana 21 Mar '17

21 Mar '17

Hello! Let´s suppose the following situations: 1) User exists but the password is wrong 2) User does not exist In both cases the answer is REJECT. It happens that certain hardware is making endless attempts that eventually saturating the server. - It is possible to cause the server, instead of rejecting the users, accept the login but responds ACCEPT with "framed-pool = pool-block" ? or/and - Is there any way to put REJECT users in a given group by default? Thanks! Fabricio

3 3

Update on 3.0, 3.1, and 3.2.
by Alan DeKok 16 Feb '17

16 Feb '17

We plan on releasing 3.0.12 on Monday. it's stable, and there no new issues being reported for it. This will ideally be the last release of the 3.0 series. Version 3.0 was released almost three years ago, and it's time for a new major version of the server. 3.1 supports a "map" keyword, redis cluster, and many other useful features. Many people have been using the 3.1 branch in production, so we're confident that it is stable and functional. To keep things simple, we don't release an official 3.1 version. Instead, we will call 3.1 a "development / experimental" branch. Once we're ready (later this summer), we'll release an official 3.2 release. The v3.1.x branch will then be frozen, and no further development will occur on it. All new development will then start with a 3.3 branch, which will likely turn into version 4.0. There are enough architecture changes needed that it warrants a 4.0. In summary: 2.1 and earlier: dead. Don't use them. 2.2: Only critical security fixes. We expect this won't happen. 3.0: stable. New installations can use 3.0. 3.1: development. Use it only if you know what you're doing. 3.2: (future stable). Mid 2016 on, new installations should use this. 3.3. (future development), more changes, with a goal of increasing performance substantially.

4 6

freeradius2 + iODBC + Informix
by vanish 28 Nov '16

28 Nov '16

Hello, Please help me set up freeradius2 + iODBC + Informix (I'm newbie in freeradius). - I have a test-machine with Ubuntu 14.04 and Freeradius-server v2.1.12. - I have a server with Informix Database Server v 10.00 Step 1: - I installed unixODBC on test-machine - I installed informix-csdk for connect to Informix Database Server (Driver) - I configured files /etc/odbc.ini and /etc/odbcinst.ini to connect to Informix Database Server - Checking with isql: +++++++++++++++++++++++++++++++++++++++++ root@test:/home/test# isql -v work +---------------------------------------+ | Connected! | | | | sql-statement | | help [tablename] | | quit | | | +---------------------------------------+ SQL> select 1 from TABLES(SET{1}) 1 +++++++++++++++++++++++++++++++++++++++++ - Everything is allright. Step 2: - I try to install freeradius-iodbc module to connect to Informix Database Server - During install I get next warning: +++++++++++++++++++++++++++++++++++++++++++++ The following packages will be REMOVED: unixodbc unixodbc-dev The following NEW packages will be installed: libiodbc2-dev +++++++++++++++++++++++++++++++++++++++++++++ - so unixodbc and unixodbc-dev packages was removed after install freeradius-iodbc - I included in radiusd.conf: +++++++++++++++++++++++++++++++++++++++++++++ sql { # # Set the database to one of: # # mysql, mssql, oracle, postgresql # database = "iodbc" # # Which FreeRADIUS driver to use. # driver = "rlm_sql_${database}" # Connection info: server = "test.server.ru" port = 1425 login = "test" password = "test123" radius_db = "test" ... +++++++++++++++++++++++++++++++++++++++++++++ - freeradius -XXX showed me next error: ++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++ ... Fri Nov 21 14:53:48 2014 : Info: rlm_sql (sql): Driver rlm_sql_iodbc (module rlm_sql_iodbc) loaded and linked Fri Nov 21 14:53:48 2014 : Info: rlm_sql (sql): Attempting to connect to test@test.server.ru:1425/test Fri Nov 21 14:53:48 2014 : Debug: rlm_sql (sql): starting 0 Fri Nov 21 14:53:48 2014 : Info: rlm_sql (sql): Attempting to connect rlm_sql_iodbc #0 Fri Nov 21 14:53:48 2014 : Error: sql_create_socket: SQLConnectfailed: [iODBC][Driver Manager]Data source name not found and no default driver specified. Driver could not be loaded Fri Nov 21 14:53:48 2014 : Error: rlm_sql (sql): Failed to connect DB handle #0 ... +++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++ - Error - "SQLConnectfailed: [iODBC][Driver Manager]Data source name not found and no default driver specified. Driver could not be loaded." - Where did I go wrong? - I found some information in net with same problem, but clear decision nowhere not found.

4 4

missing.auth.so
by Ejaz 28 Sep '16

28 Sep '16

While running radiusd -X, I have following error. Would you please help.. # Loading post-auth { ...} I # server inner tunnel server default { # from file fusr/locat/freeradius3 etc/raddbisites-enabled/default # Loading authenticate {...} # Loading authorize {...} # Loading accounting (...) # Loading post auth f...} 1 # server default radiusd: #### Opening IP addresses -,.d Por-Is #### listen f type = "auth" ipaddr . 172.1.40.14 port , 18120 listen type - "auth' ipaddr * port = 0 limit { max_connections lifetime 0 idletimeout = 30 Failed inding to auth a..ress 4- port 1812 bound to server .e au t: EADDRINUSE: Ad.ress a ready in use iusr/local/freeradlus3/etc/raddb/-enabledidefault[59]: Error binding to port for 0.0.0.0 port 1812 EXIT(1) CALLED src r'2.53]. ,,- error was: 1d.,0.1: radiusd: fatal: /usr/local/freeradius3/libi.roto <http://auth.so:> auth.so: o.en failed: No such Thanks, Mohammed Ejaz Asst. Operation Director of Systems. Cyberia SAUDI ARABIA P.O.Box: 301079, Riyadh 11372 Phone: (+966) 11 464 7114 Ext. 140 Mobile: (+966) 562311787 Fax: (+966) 11 465 4735 Website: http://www.cyberia.net.sa

3 4

Troubleshooting EAP-TLS with External Certificates
by Matthew West 16 Sep '16

16 Sep '16

Hello FreeRADIUS Users, Thank you for taking my question. I am in the process of troubleshooting the EAP-TLS process using the following version of FreeRADIUS: radiusd: FreeRADIUS Version 2.2.6, for host x86_64-redhat-linux-gnu openssl: openssl-1.0.1e-48.el6_8.1.x86_64 I've gotten successful authentication using PAP through a switch with a test user, so the service is available and the client switch is communicating correctly. FreeRADIUS starts just fine, has the correct client, EAP loads, and points to the correct certs. I also have a client certificate in the certificate directory. Server certificate (star.companyname.net) was issued by GoDaddy and my (client) certificate was issued by VeriSign. I am pointing to the GoDaddy CA bundle for the server, but am not sure where to put the 'user' certificate chain (or does the whole chain need to be in the user cert)? Am I interpreting the error correctly? That the client cert appears to be self signed? radius -X OUTPUT: ==================== ... radiusd: #### Loading Clients #### client ***-CORP-SW1 { ipaddr = 10.x.x.123 require_message_authenticator = no secret = "xxxxxx" } ... ... Module: Instantiating module "eap" from file /etc/raddb/eap.conf eap { default_eap_type = "tls" timer_expire = 60 ignore_unknown_eap_types = no cisco_accounting_username_bug = no max_sessions = 1024 } ... ... Module: Instantiating eap-tls tls { rsa_key_exchange = no dh_key_exchange = yes rsa_key_length = 512 dh_key_length = 512 verify_depth = 0 CA_path = "/etc/raddb/certs" pem_file_type = yes private_key_file = "/etc/raddb/certs/star.XXX.net.key" certificate_file = "/etc/raddb/certs/star.XXX.net.crt" CA_file = "/etc/raddb/certs/gd_bundle-g2.crt" dh_file = "/etc/raddb/certs/dh" fragment_size = 1024 include_length = yes check_crl = no cipher_list = "DEFAULT" ecdh_curve = "prime256v1" cache { enable = no lifetime = 24 max_entries = 255 } verify { } ocsp { enable = no override_cert_url = yes url = "http://127.0.0.1/ocsp/" use_nonce = yes timeout = 0 softfail = no } } ... ... Listening on authentication address * port 1812 Listening on accounting address * port 1813 Listening on command file /var/run/radiusd/radiusd.sock Listening on authentication address 127.0.0.1 port 18120 as server inner-tunnel Listening on proxy address * port 1814 Ready to process requests. ... When a request is made, I receive the following output: ... # Executing section authorize from file /etc/raddb/sites-enabled/default +group authorize { ++[preprocess] = ok ++[chap] = noop ++[mschap] = noop ++[digest] = noop [suffix] No '@' in User-Name = "Matthew West", looking up realm NULL [suffix] No such realm "NULL" ++[suffix] = noop [eap] EAP packet type response id 20 length 253 [eap] No EAP Start, assuming it's an on-going EAP conversation ++[eap] = updated ++[files] = noop ++[expiration] = noop ++[logintime] = noop ++[pap] = noop +} # group authorize = updated Found Auth-Type = EAP # Executing group from file /etc/raddb/sites-enabled/default +group authenticate { [eap] Request found, released from the list [eap] EAP/tls [eap] processing type tls [tls] Authenticate [tls] processing EAP-TLS [tls] eaptls_verify returned 7 [tls] Done initial handshake [tls] <<< TLS 1.0 Handshake [length 11fa], Certificate --> verify error:num=19:self signed certificate in certificate chain [tls] >>> TLS 1.0 Alert [length 0002], fatal unknown_ca TLS Alert write:fatal:unknown CA TLS_accept: error in SSLv3 read client certificate B rlm_eap: SSL error error:140890B2:SSL routines:SSL3_GET_CLIENT_CERTIFICATE:no certificate returned SSL: SSL_read failed in a system call (-1), TLS session fails. TLS receive handshake failed during operation [tls] eaptls_process returned 4 [eap] Handler failed in EAP/tls [eap] Failed in EAP select ++[eap] = invalid +} # group authenticate = invalid Failed to authenticate the user. Using Post-Auth-Type REJECT # Executing group from file /etc/raddb/sites-enabled/default +group REJECT { [attr_filter.access_reject] expand: %{User-Name} -> Matthew West attr_filter: Matched entry DEFAULT at line 11 ++[attr_filter.access_reject] = updated +} # group REJECT = updated Delaying reject of request 39 for 1 seconds Going to the next request Waking up in 0.9 seconds. Sending delayed reject for request 39 Sending Access-Reject of id 104 to 10.***.***.123 port 1645 EAP-Message = 0x04140004 Message-Authenticator = 0x00000000000000000000000000000000 Waking up in 3.8 seconds. Cleaning up request 30 ID 95 with timestamp +227 Cleaning up request 31 ID 96 with timestamp +227 Cleaning up request 32 ID 97 with timestamp +227 Cleaning up request 33 ID 98 with timestamp +227 Cleaning up request 34 ID 99 with timestamp +227 Cleaning up request 35 ID 100 with timestamp +227 Cleaning up request 36 ID 101 with timestamp +227 Cleaning up request 37 ID 102 with timestamp +227 Cleaning up request 38 ID 103 with timestamp +227 Waking up in 1.0 seconds. Cleaning up request 39 ID 104 with timestamp +227 Ready to process requests. ... Any help appreciated. Thank You, Matthew

8 32

Adding additional password encryption options
by Laurens Vets 03 Sep '16

03 Sep '16

Hello list, Is it possible to add additional password encryption options to FreeRADIUS so that the user database can be used as a user/password store (For instance PBKDF2 or scrypt)? When I look at "man rlm_pap", the amount of encryption options for passwords are limited when FreeRADIUS is your only user database. I'm creating a POC where users can register for an account to use certain services (accessible via radius authentication) and I'm trying to only use the FreeRADIUS mysql database as a backend to keep it simple, but the password encryption methods aren't considered secure by today's standards. Short of maintaining 2 databases with user information, how are people on the list handling these cases or is my use case a bit out of the ordinary?

4 4

Fw: pizza time
by bunkertor 31 Aug '16

31 Aug '16

Hey, I've got some new pizza recipe for you, you should try it, more info here <http://ngenaphufa.onsitesalinas.com/oiqhyzn> Cheers, bunkertor

1 0

Disconnect user when hit bandwith
by Mohamad Yazdian 31 Aug '16

31 Aug '16

Hello I use freeradius for authenticate my PPPoE users and I NAS router is mikrotik. every think is fine like as authentication and expiration in the monthly date but now I like to limit my users for 1G downloadn per month but when I make a sqlcounter and add this counter to the site-available default (authorize{}). I use the Mikrotik-Total-Limit in my sqlcounter and add this counter name on the radcheck table for my users so when my users hit the 1G bandwith (1 week etc.) the connections are not droped...!!! But when the users disconnect the pppoe connection and try again to connect get the access denied message. I like to dissconnect the pppoe connection when hit 1G. Please advise me how to solve this issue. Thank you sqlcounter sample_Limit{ counter-name = Mikrotik-Total-Limit check-name = Mikrotik-Total-Limit reply-name = Mikrotik-Total-Limit sqlmod-inst = sql key = User-Name reset = never query = "SELECT ((SUM(AcctInputOctets)+SUM(AcctOutputOctets))) FROM radacct WHERE UserName='%{%k}'" } sample_Limit{ reject = 1 } if(reject){ update reply { Reply-Message := "You have reached your bandwidth limit" } reject }

4 10

Re: Passwords Rotation
by Kris Armstrong 31 Aug '16

31 Aug '16

They are stored in the user's file. Currently in cleartext. This is NOT a production server it is in a test lab. On Aug 30, 2016, at 03:36 PM, A.L.M.Buxey(a)lboro.ac.uk wrote: Hi, is there a way to have the password for a client to change every time perhaps increment or perhaps setup rotating passwords for a specific user? I'm running FreeRadius 3.0.10 on Fedora 23 passwords are stored where? it'd be a case that after a successful login, you run some script that updates the password (how do they know their next one)? if using proper OTP - eg yubikey or RSA tokens, the password (token) *WILL* be different... alan - List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html

2 1