February 2017 - Freeradius-Users - lists.freeradius.org

Trying to Authorize Users based on AD Groups and SSIDs
by Misbah Hussaini 17 Feb '17

17 Feb '17

Dear, I'm trying to configure PEAP Authentication with AD backend on my FR Server which is running version 3.0.4 on Centos 7. So far, I'm able to authenticate against AD but group membership checking is not working, appreciate if some help can be provided. I want to map my SSIDs - SSID02362, SSID02363 etc to AD groups so that users in specific groups can access that particular SSID. As mentioned in man page of rlm_ldap I have configured group membership check in post-auth by adding below configuration in default and inner-tunnel config files but my users are getting access-reject messages. If I remove the ldap-group check config then all users are able to authenticate and access SSID, off course without any control. post-auth { if (LDAP-Group == "FR-TEST") { noop } else { reject } } if group membership works then I can go ahead and add below config to test SSID with Group membership. (this is not one yet). post-auth { if (LDAP-Group == "FR-TEST" && Calling-Station-SSID == "SSID02362") { noop } else { reject } } Where am I going wrong? Debug can be found here -> http://pastebin.com/zSptQPaa Regards Misbah

3 9

Maximum number of virtual servers?
by Clayton Knorr 16 Feb '17

16 Feb '17

Any opinions (or hard facts) about the upper limit of virtual servers are advisable? Potentially more than 1,000 if we decide to go the virtual server route. Thanks, Clayton

5 8

Update on 3.0, 3.1, and 3.2.
by Alan DeKok 16 Feb '17

16 Feb '17

We plan on releasing 3.0.12 on Monday. it's stable, and there no new issues being reported for it. This will ideally be the last release of the 3.0 series. Version 3.0 was released almost three years ago, and it's time for a new major version of the server. 3.1 supports a "map" keyword, redis cluster, and many other useful features. Many people have been using the 3.1 branch in production, so we're confident that it is stable and functional. To keep things simple, we don't release an official 3.1 version. Instead, we will call 3.1 a "development / experimental" branch. Once we're ready (later this summer), we'll release an official 3.2 release. The v3.1.x branch will then be frozen, and no further development will occur on it. All new development will then start with a 3.3 branch, which will likely turn into version 4.0. There are enough architecture changes needed that it warrants a 4.0. In summary: 2.1 and earlier: dead. Don't use them. 2.2: Only critical security fixes. We expect this won't happen. 3.0: stable. New installations can use 3.0. 3.1: development. Use it only if you know what you're doing. 3.2: (future stable). Mid 2016 on, new installations should use this. 3.3. (future development), more changes, with a goal of increasing performance substantially.

4 6

Using multiple databases on the same freeRadius instance
by Gabriel Marais 15 Feb '17

15 Feb '17

Hi Guys, I am wondering if there are any way to use two different databases within the same freeRadius instance? Currently, I am using the default MySQL schema for AAA. I am inserting additional attributes in the pre-proxy configuration of my site. The attribute information comes from the same database. This works perfectly. I now have a site where I need to do the same but the additional attribute information needs to come from a different database (existing database on the client side), other than the AAA database. Is there a way to do this? Regards Gabriel

4 10

Active directory integration and grant access base on AD group membership
by Luc Paulin 15 Feb '17

15 Feb '17

Hi, I am trying to setup a radius server on centos6.8. I succeeded to setup the active directory integration by following the guide at http://wiki.freeradius.org/guide/freeradius-active-directory-integration-ho… . So I can get my user authentificate through the active directory. Now I would like grant system access base on group membership from active directory. How can this be done. I have tried by configuring the users and huntgroup files, but look like it grant access to everyone if username/password is good. -- !!!!! ( o o ) --------------oOO----(_)----OOo-------------- Luc Paulin email: paulinster(at)gmail.com Skype: paulinster

3 6

v3.0.11 Radmin problem
by LABAT, Xavier 15 Feb '17

15 Feb '17

Hi, I have some problems with radmin since version 3.0.10 (the first version in 3.0 tried) that I don't encountered in previous versions (2.1.6 and 2.2.6) . The main problem is when I try to launch the tool. The command < radmin > work correctly at first start but then I have to add options to start again as below : [proxyRadius /usr/local/etc/raddb]# radmin radmin version 3.0.11, built on Mar 31 2016 at 10:41:17 - FreeRADIUS Server administration tool. ... radmin> [proxyRadius/usr/local/etc/raddb]# radmin radmin: Error in socket: Broken pipe [proxyRadius/usr/local/etc/raddb]# radmin radmin: Error in socket: No such file or directory [proxyRadius/usr/local/etc/raddb]# ls /usr/local/var/run/radiusd/ radiusd.pid radiusd.sock [proxyRadius/usr/local/etc/raddb]# radmin -d /usr/local/etc/raddb/ radmin: Error in socket: No such file or directory [proxyRadius/usr/local/etc/raddb]# radmin -n radiusd radmin: Error in socket: No such file or directory [proxyRadius/usr/local/etc/raddb]# radmin -f /usr/local/var/run/radiusd/radiusd.sock radmin version 3.0.11, built on Mar 31 2016 at 10:41:17 - FreeRADIUS Server administration tool. ... radmin> [proxyRadius/usr/local/etc/raddb]# radmin radmin: Error in socket: No such file or directory The second problem is when I use a condition in Radmin. Previously we set a condition in order to capture only requests based on it, but since version 3.0.10, radmin log all requests received by server. I can see a < & > before the condition that I didn't have with previous versions : radmin> debug condition User-Name == "toto@foo" radmin> show debug condition &User-Name == "toto@foo" Can anyone tell me if it's better with version 3.0.12 or if there is a problem with my utilisation of the tool ? Here the configuration of my solution : radiusd.conf ... localstatedir = /usr/local/var name = radiusd run_dir = ${localstatedir}/run/${name} ... sites-enabled/control-socket listen { type = control socket = ${run_dir}/${name}.sock mode = rw } Thanks you. Regards. Xavier LABAT STN2 Axione -- Les donnees et renseignements contenus dans ce message sont personnels, confidentiels et secrets. Toute publication, utilisation ou diffusion, meme partielle, doit etre autorisee. Si vous n'etes pas le bon destinataire, nous vous demandons de ne pas lire, copier, utiliser ou divulguer cette communication. Nous vous prions de notifier cette erreur a l'expediteur et d'effacer immediatement cette communication de votre systeme. Any data and information contained in this electronic mail is personal, confidential and secret. Any total or partial publication, use or distribution must be authorized. If you are not the right addressee, we ask you not to read, copy, use or disclose this communication. Please notify this error to the sender and erase at once this communication from your system.

3 12

Problems with eap certificate and MacOS
by Marco Scholl 15 Feb '17

15 Feb '17

Hi, i have a problem EAP. I have a root ca for our company with an intermediate ca. Now i have generate an certificate for the radius server with EAP OIDs (1.3.6.1.5.5.7.3.13, 1.3.6.1.5.5.7.3.14) Then i have installed our root ca as trusted for all type (eap, smime, webserver ....). When i now connect by wlan or cable to the freeradius, i got an server certificate error. But when i open the dialog for confirmation, i see our root ca als trusted, i see the intermediate as trustend and i see the radius certificate as trust! every connect i must accept the certificate for new. anybody an idea? when i use an normal webserver certificate from a public ca the problem not exists, after i confirm the certificate on first try. greets marco

4 4

Removing unused SQL drivers
by Arran Cudbard-Bell 15 Feb '17

15 Feb '17

We’re starting to investigate moving rlm_sql to the new async I/O model. The main benefits being: - Significant increase in TPS where DB benefits from increased parallelism, or RTT to the database is high. - FreeRADIUS no longer appears to “hang” when databases go away (it doesn’t actually hang, but all the worker threads get tied up until they time out). - In the hanging (not hanging) scenario, we can drain the incoming packet queue to detail files without “hiccups” (where the inbound packet queue fills) waiting for stale connections to close or queries to time out. Ongoing discussion on GitHub is here: https://github.com/FreeRADIUS/freeradius-server/issues/1913 Questions for users are: - Does anyone still use DB2? It’s virtually undocumented and it’s not clear if it has an async interface. - Does anyone still use Firebird? Is there any disadvantage in using it via ODBC. - Is there still value in maintaining IODBC compatibility? It seems to lack many features of UnixODBC. Previously IODBC was included in OSX Lion, so it was useful to keep around. It’s since been removed however, and UnixODBC can be installed with hombrew. -Arran Arran Cudbard-Bell <a.cudbardb(a)freeradius.org> FreeRADIUS Development Team FD31 3077 42EC 7FCD 32FE 5EE2 56CF 27F9 30A8 CAA2

1 0

Unresponsive server when debugging
by Lucas Diaz 14 Feb '17

14 Feb '17

I'm running a 3.0.11 server with Firebird as the backend database. It works very well. I have an issue though when debugging (output to STDOUT): if an authentication query hangs or becomes very slow to respond, during that period of time, the server becomes unresponsive and it can be seen on the log of the nases "Radius server is not responding". Until this happens, it works just fine. If I launch the server without debug, it authorizes all users super fast (except the ones that are very slow), but it don't "hang" the server. It's like in debug mode threads are not used. Is that right? Thanks.

3 3

Multiple shared secret per IP?
by Chris Taylor (chtaylo2) 13 Feb '17

13 Feb '17

On FreeRadius v.3.0.12. I have a requirement where I need to send test authentications to the F.R. server, which are then proxy’ed. i.e: user: monitor source IP: 64.0.0.1 secret: MonitorAgent ^ - That’s easy. To complicate, I need to also authenticate real users from the same source server, using a different shared secret. (anyone can view the one above, so not secure) Ideally, I’d like to also lockdown the above secret key, to the single user. i.e: user: userA, etc, etc source IP: 64.0.0.1 secret: SD%^GHJ Is it possible to have multiple secret strings per IP or maybe different domains per IP? If not, any recommendations? Thanks!!

4 4