July 2017 - Freeradius-Users - lists.freeradius.org

Query Regarding IPV6 address support in RADIUS
by Javed 26 Jul '17

26 Jul '17

Hello Team, I am glad with few of this group support I was able to deploy FREERadius client to support over TLS.Now our aim is to support IPV6 Query I am trying to upgrade my FreeRADIUS client library to support IPv6 address(vs 1.7) and I almost did it and while testing I came across traces: Jul 26 10:59:14 rc_get_ipaddr: couldn't resolve hostname: 2009:4600:5840:2004:3530::8 Jul 26 10:59:14 rc_send_server: unable to find server: 2009:4600:5840:2004:3530::8 Jul 26 10:59:14 Unexpected return value Call flow across files : sendserver.c -> config.c -> ip_util.c Call flow across functions : rc_findserver() -> rc_get_ipaddr() -> rc_good_ipaddr() This seems to return negative value(rc_good_ipaddr() ) and followed by rc_gethostbyname(host) results the error saying rc_send_server: unable to find server: 2009:4600:5840:2004:3530::8 Am I missing something ? Is rc_good_ipaddr() not expect to validate ipv6 address also ? Kindly share your opinion . Thanks & Regards, Javed Akhtar Technical Lead <mailto:jaakhtar@cisco.com> jaakhtar(a)cisco.com Tel: Cisco Systems, Inc. India cisco.com Think before you print. This email may contain confidential and privileged material for the sole use of the intended recipient. Any review, use, distribution or disclosure by others is strictly prohibited. If you are not the intended recipient (or authorized to receive for the recipient), please contact the sender by reply email and delete all copies of this message. Please <http://www.cisco.com/web/about/doing_business/legal/cri/index.html> click here for Company Registration Information.

2 1

Authorization for Oracle DB
by Arvind Gupta 26 Jul '17

26 Jul '17

Hi All I have Oracle DB configured for RADIUS authentication and now having issue with Authorization part. My use case is as follows: 1. Oracle DB sends RADIUS AUthentication request to RADIUS server, which performs authentication against LDAP. 2. After succesfull authentication it retrieves group and role information for authenticated user and that group and role information it has to sent as part of authorization. 3. After receiving group and role info Oracle DB should provide him access of schemas associated with group and role. I am facing issue during Authorization. If anybody know Authorization steps then please let me know. Any help is highly appreciated. Thanks Arvind Kumar Gupta

2 1

LDAP group check not working with SQL expansion
by Klara Mall 25 Jul '17

25 Jul '17

Hi, I'm using FreeRADIUS Version 3.0.12. I'm doing EAP-TTLS/PAP and I have the following policy in the authorize section of the inner tunnel virtual server (same behaviour when it's in post-auth): w2vgroupcheck { if("%{Stripped-User-Domain}" =~ /^([^\.]+)\.w2v\.kit\.edu$/) { if ("%{sql:SELECT COUNT(*) FROM w2v WHERE vlan_name=regexp_replace('%{Stripped-User-Domain}', '\.w2v\.kit\.edu$', '')}" > 0) { if (LDAP-Group == "%{sql:SELECT group_name FROM w2v WHERE vlan_name=regexp_replace('%{Stripped-User-Domain}', '\.w2v\.kit\.edu$', '')}") { update reply { Tunnel-Private-Group-Id := "%{sql:SELECT vlan_id FROM w2v WHERE vlan_name=regexp_replace('%{Stripped-User-Domain}', '\.w2v\.kit\.edu$', '')}" Tunnel-Type := VLAN Tunnel-Medium-Type := IEEE-802 } } else { reject } } } } Which results in: (8) policy w2vgroupcheck { (8) if ("%{Stripped-User-Domain}" =~ /^([^\.]+)\.w2v\.kit\.edu$/) { (8) EXPAND %{Stripped-User-Domain} (8) --> vlan-1.w2v.kit.edu (8) if ("%{Stripped-User-Domain}" =~ /^([^\.]+)\.w2v\.kit\.edu$/) -> TRUE (8) if ("%{Stripped-User-Domain}" =~ /^([^\.]+)\.w2v\.kit\.edu$/) { (8) if ("%{sql:SELECT COUNT(*) FROM w2v WHERE vlan_name=regexp_replace('%{Stripped-User-Domain}', '\.w2v\.kit\.edu$', '')}" > 0) { rlm_sql (sql): Reserved connection (0) (8) Executing select query: SELECT COUNT(*) FROM w2v WHERE vlan_name=regexp_replace('vlan-1.w2v.kit.edu', '\.w2v\.kit\.edu$', '') rlm_sql_postgresql: Status: PGRES_TUPLES_OK rlm_sql_postgresql: query affected rows = 1 , fields = 1 rlm_sql (sql): Released connection (0) (8) EXPAND %{sql:SELECT COUNT(*) FROM w2v WHERE vlan_name=regexp_replace('%{Stripped-User-Domain}', '\.w2v\.kit\.edu$', '')} (8) --> 1 (8) if ("%{sql:SELECT COUNT(*) FROM w2v WHERE vlan_name=regexp_replace('%{Stripped-User-Domain}', '\.w2v\.kit\.edu$', '')}" > 0) -> TRUE (8) if ("%{sql:SELECT COUNT(*) FROM w2v WHERE vlan_name=regexp_replace('%{Stripped-User-Domain}', '\.w2v\.kit\.edu$', '')}" > 0) { (8) if (LDAP-Group == "%{sql:SELECT group_name FROM w2v WHERE vlan_name=regexp_replace('%{Stripped-User-Domain}', '\.w2v\.kit\.edu$', '')}") { rlm_sql (sql): Reserved connection (1) (8) Executing select query: SELECT group_name FROM w2v WHERE vlan_name=regexp_replace('vlan-1.w2v.kit.edu', '\.w2v\.kit\.edu$', '') rlm_sql_postgresql: Status: PGRES_TUPLES_OK rlm_sql_postgresql: query affected rows = 1 , fields = 1 rlm_sql (sql): Released connection (1) (8) EXPAND %{sql:SELECT group_name FROM w2v WHERE vlan_name=regexp_replace('%{Stripped-User-Domain}', '\.w2v\.kit\.edu$', '')} (8) --> KIT-Group-1 (8) if (LDAP-Group == "%{sql:SELECT group_name FROM w2v WHERE vlan_name=regexp_replace('%{Stripped-User-Domain}', '\.w2v\.kit\.edu$', '')}") -> FALSE (8) else { (8) [reject] = reject (8) } # else = reject (8) } # if ("%{sql:SELECT COUNT(*) FROM w2v WHERE vlan_name=regexp_replace('%{Stripped-User-Domain}', '\.w2v\.kit\.edu$', '')}" > 0) = reject (8) } # if ("%{Stripped-User-Domain}" =~ /^([^\.]+)\.w2v\.kit\.edu$/) = reject (8) } # policy w2vgroupcheck = reject I don't understand it because the SQL expansion works but then there is no try to do the LDAP group check. It just says FALSE and rejects. When I replace (LDAP-Group == "%{sql:SELECT group_name FROM w2v WHERE vlan_name=regexp_replace('%{Stripped-User-Domain}', '\.w2v\.kit\.edu$', '')}") with (LDAP-Group == "KIT-Group-1") it works: (8) policy w2vgroupcheck { [50/1950] (8) if ("%{Stripped-User-Domain}" =~ /^([^\.]+)\.w2v\.kit\.edu$/) { (8) EXPAND %{Stripped-User-Domain} (8) --> vlan-1.w2v.kit.edu (8) if ("%{Stripped-User-Domain}" =~ /^([^\.]+)\.w2v\.kit\.edu$/) -> TRUE (8) if ("%{Stripped-User-Domain}" =~ /^([^\.]+)\.w2v\.kit\.edu$/) { (8) if ("%{sql:SELECT COUNT(*) FROM w2v WHERE vlan_name=regexp_replace('%{Stripped-User-Domain}', '\.w2v\.kit\.edu$', '')}" > 0) { rlm_sql (sql): Reserved connection (0) (8) Executing select query: SELECT COUNT(*) FROM w2v WHERE vlan_name=regexp_replace('vlan-1.w2v.kit.edu', '\.w2v\.kit\.edu$', '') rlm_sql_postgresql: Status: PGRES_TUPLES_OK rlm_sql_postgresql: query affected rows = 1 , fields = 1 rlm_sql (sql): Released connection (0) (8) EXPAND %{sql:SELECT COUNT(*) FROM w2v WHERE vlan_name=regexp_replace('%{Stripped-User-Domain}', '\.w2v\.kit\.edu$', '')} (8) --> 1 (8) if ("%{sql:SELECT COUNT(*) FROM w2v WHERE vlan_name=regexp_replace('%{Stripped-User-Domain}', '\.w2v\.kit\.edu$', '')}" > 0) -> TRUE (8) if ("%{sql:SELECT COUNT(*) FROM w2v WHERE vlan_name=regexp_replace('%{Stripped-User-Domain}', '\.w2v\.kit\.edu$', '')}" > 0) { (8) if (LDAP-Group == "KIT-Group-1") { (8) Searching for user in group "KIT-Group-1" rlm_ldap (ldap): Reserved connection (1) (8) Using user DN from request "uid=abc123,ou=People,ou=unix,ou=IDM,dc=kit,dc=edu" (8) Checking for user in group objects (8) EXPAND (&(cn=KIT-Group-1)(objectClass=posixGroup)(memberUid=%{%{Stripped-User-Name}:-%{User-Name}})) (8) --> (&(cn=KIT-Group-1)(objectClass=posixGroup)(memberUid=abc123)) (8) Performing search in "ou=unix,ou=IDM,dc=kit,dc=edu" with filter "(&(cn=KIT-Group-1)(objectClass=posixGroup)(memberUid=abc123))", scope "sub" (8) Waiting for search result... (8) User found in group object "ou=unix,ou=IDM,dc=kit,dc=edu" rlm_ldap (ldap): Released connection (1) (8) if (LDAP-Group == "KIT-Group-1") -> TRUE (8) if (LDAP-Group == "KIT-Group-1") { (8) update reply { rlm_sql (sql): Reserved connection (1) (8) Executing select query: SELECT vlan_id FROM w2v WHERE vlan_name=regexp_replace('vlan-1.w2v.kit.edu', '\.w2v\.kit\.edu$', '') rlm_sql_postgresql: Status: PGRES_TUPLES_OK rlm_sql_postgresql: query affected rows = 1 , fields = 1 rlm_sql (sql): Released connection (1) (8) EXPAND %{sql:SELECT vlan_id FROM w2v WHERE vlan_name=regexp_replace('%{Stripped-User-Domain}', '\.w2v\.kit\.edu$', '')} (8) --> 22 (8) Tunnel-Private-Group-Id := 22 (8) Tunnel-Type := VLAN (8) Tunnel-Medium-Type := IEEE-802 (8) } # update reply = noop (8) } # if (LDAP-Group == "KIT-Group-1") = noop (8) ... skipping else: Preceding "if" was taken (8) } # if ("%{sql:SELECT COUNT(*) FROM w2v WHERE vlan_name=regexp_replace('%{Stripped-User-Domain}', '\.w2v\.kit\.edu$', '')}" > 0) = noop (8) } # if ("%{Stripped-User-Domain}" =~ /^([^\.]+)\.w2v\.kit\.edu$/) = noop (8) } # policy w2vgroupcheck = noop Thanks in advance Klara

3 7

Browser and Device information
by Safiullah Tariq 25 Jul '17

25 Jul '17

Dear All, I hope you are doing great. I want to know that when as user is authenticated via freeradius, is there a possibility that I can also get the clients device's type, browser information and other sort of info along with it. If yes, can anyone please point me - I will do my best to move in that direction. Regards, Safiullah Tariq PRIVILEGED AND CONFIDENTIAL INFORMATION: This e-mail and attachments, if any, may contain confidential and/or proprietary information. Please be advised that the unauthorized use or disclosure of the information is strictly prohibited. The information herein is intended only for use by the intended recipient(s) named above. If you have received this transmission in error, please notify the sender immediately and permanently delete the e-mail and any copies, printouts or attachments thereof.

4 4

Questions pam_radius and accounting logs
by Junk XL 24 Jul '17

24 Jul '17

I am trying to utilize the pam_radius client (1.4.0) on several RHEL 6 servers for authentication and accounting with ssh and sudo, against a Cisco ACS (ver 5.5) The authentication works as expected for both, however i am not seeing what i would expect in the accounting. My first question is, is there a setting that i am missing that enables pam_radius to send the full accounting back to the ACS? I do see the start/stop packets, however i only ever see the "sudo" issued as a NAS identifier, and never anything else. ==== output from /var/log/messages Jul 24 10:04:00 secutil sshd[6148]: Accepted password for test_user from XXX.XXX.XXX.XXX port 53291 ssh2 Jul 24 10:04:00 secutil sshd[6148]: error: ssh_selinux_setup_pty: security_compute_relabel: Invalid argument Jul 24 10:04:24 secutil sudo: pam_radius_auth: Got user name test_user Jul 24 10:04:24 secutil sudo: pam_radius_auth: ignore last_pass, force_prompt set Jul 24 10:04:29 secutil sudo: pam_radius_auth: Sending RADIUS request code 1 Jul 24 10:04:29 secutil sudo: pam_radius_auth: DEBUG: getservbyname(radius, udp) returned 0x7f3b816089a0. Jul 24 10:04:29 secutil sudo: pam_radius_auth: Got RADIUS response code 2 Jul 24 10:04:29 secutil sudo: pam_radius_auth: authentication succeeded Jul 24 10:04:29 secutil sudo: test_user : TTY=pts/1 ; PWD=/home/test_user ; USER=root ; COMMAND=/bin/cat /etc/named.conf ==== output from ACS Start Accounting Details : Diagnostics Details ACS Configuration Changes Logged At : Jul 24,17 10:04:29.336 AM ACS Time : Jul 24,17 10:04:29.313 AM ACS Server : scrubbed User Name : root Failure Reason : Identity Store : Identity Group : Network Device Name : Linux_Servers Network Device Group : Device Type:All Device Types, Location:All Locations Service Selection Rule Name : Access Service : Security Group : AD Domain : Authorization Profile: MAC Address : Endpoint IP Address : NAS IP Address : scrubbed NAS Port : 6171 NAS Port Id: NAS Identifier : sudo Account Status Type : Start Account Session Id : 00006171 Account MultiSession Id : Audit Session Id : ACS Session Id : scrubbed/230060300/66963046 Account Authentic : RADIUS Account Terminate Cause : Terminate Action : Account Interim Intervals : Account Delay Time : Account Session Time : Account Input Octets : Account Output Octets : Account Input Packets : Account Output Packets : Account Tunnel Connection : Account Tunnel Packet Lost : Session Timeout : Idle Timeout : Event Timestamp : Service Type : Response Time : 1 Class : Framed Protocol : Tunnel Details : Cisco H323 : Cisco SSG : Cisco-AvPairs : Other Attributes : ACSVersion=acs-5.5.0.46-B.723 ConfigVersionId=200 NAS-Port-Type=Virtual Device IP Address=scrubbed Audit Session Key root:sudo:6171 Steps Received RADIUS Accounting-Request RADIUS created a new session Evaluating Service Selection Policy Matched rule Selected Access Service - Accounting start was received for non-existing session. Returned RADIUS Accounting-Response ==== output from ACS Stop Accounting Details : Diagnostics Details ACS Configuration Changes Logged At : Jul 24,17 10:04:29.336 AM ACS Time : Jul 24,17 10:04:29.320 AM ACS Server : scrubbed User Name : root Failure Reason : Identity Store : Identity Group : Network Device Name : Linux_Servers Network Device Group : Device Type:All Device Types, Location:All Locations Service Selection Rule Name : Access Service : Security Group : AD Domain : Authorization Profile: MAC Address : Endpoint IP Address : NAS IP Address : scrubbed NAS Port : 6171 NAS Port Id: NAS Identifier : sudo Account Status Type : Stop Account Session Id : 00006171 Account MultiSession Id : Audit Session Id : ACS Session Id : scrubbed/230060300/66963047 Account Authentic : RADIUS Account Terminate Cause : Terminate Action : Account Interim Intervals : Account Delay Time : Account Session Time : 0 Account Input Octets : Account Output Octets : Account Input Packets : Account Output Packets : Account Tunnel Connection : Account Tunnel Packet Lost : Session Timeout : Idle Timeout : Event Timestamp : Service Type : Response Time : 1 Class : Framed Protocol : Tunnel Details : Cisco H323 : Cisco SSG : Cisco-AvPairs : Other Attributes : ACSVersion=acs-5.5.0.46-B.723 ConfigVersionId=200 NAS-Port-Type=Virtual Device IP Address=scrubbed Audit Session Key root:sudo:6171 Received RADIUS Accounting-Request RADIUS created a new session Evaluating Service Selection Policy Matched rule Selected Access Service - Audit session was not found. Returned RADIUS Accounting-Response ==== /etc/pam.d/sshd auth sufficient pam_radius_auth.so debug account sufficient pam_radius_auth.so debug session sufficient pam_radius_auth.so debug #auth include tacacs auth required pam_sepermit.so auth include password-auth #account include tacacs account required pam_nologin.so account include password-auth password include password-auth # pam_selinux.so close should be the first session rule #session include tacacs session required pam_selinux.so close session required pam_loginuid.so # pam_selinux.so open should only be followed by sessions to be executed in the user context session required pam_selinux.so open env_params session required pam_namespace.so session optional pam_keyinit.so force revoke session include password-auth ==== /etc/pam.d/sudo auth sufficient pam_radius_auth.so debug account sufficient pam_radius_auth.so debug session sufficient pam_radius_auth.so debug auth include system-auth account include system-auth password include system-auth session optional pam_keyinit.so revoke session required pam_limits.so /etc/raddb/server (scrubbed) XXX.XXX.XXX.XXX test 3 Am i just incorrect in my assumptions on what i think i should be seeing with the accounting? I know with other devices, I can see the full accounting commands issued, but i do not know if that is a limitation with Linux and pam_radius, or if i have something set incorrectly. Thanks in advance, GR

2 2

Re: LDAP group authentication
by Jake L. 23 Jul '17

23 Jul '17

Thanks again Bogdan and sorry for my long delay on this. If you or anyone else can assist in our question below that would be awesome. Just getting back to it with my co-workers and we are running into the following issue. We've set it up using your examples below, but it says it's unable to find the user via ldap. When we disable checking via the "memberOf" method, it is able to find the user. The part I may have wrong is the commented out section inside of the ldap stanza underneath 'update'. However, anything I uncommented there failed to work. Any thoughts? Here are our tests and setups: If anyone has any suggestions, please let me know (or if you need more details!). Much thanks!! Testing using radtest (on the same machine running radiusd -X): [root@radius-server ~]# radtest "intopstest" 'testing123' localhost 2 'secret' Sending Access-Request Id 139 from 0.0.0.0:45099 to 127.0.0.1:1812 User-Name = 'intopstest' User-Password = 'testing123' NAS-IP-Address = 100.64.67.30 NAS-Port = 2 Message-Authenticator = 0x00 Received Access-Reject Id 139 from 127.0.0.1:1812 to 127.0.0.1:45099 length 20 (0) -: Expected Access-Accept got Access-Reject LOG ERROR using radiusd -X: (snipped for readability) (0) ldap : EXPAND (|(&(uid=%{%{Stripped-User-Name}:-%{User-Name}})(memberOf=cn=netops_radius,cn=groups,cn=accounts,dc=example,dc=com))) (0) ldap : --> (|(&(uid=intopstest)(memberOf=cn=netops_radius,cn=groups,cn=accounts,dc=example,dc=com))) (0) ldap : EXPAND cn=users,cn=accounts,dc=example,dc=com (0) ldap : --> cn=users,cn=accounts,dc=example,dc=com (0) ldap : Performing search in 'cn=users,cn=accounts,dc=example,dc=com' with filter '(|(&(uid=intopstest)(memberOf=cn=netops_radius,cn=groups,cn=accounts,dc=example,dc=com)))', scope 'sub' (0) ldap : Waiting for search result... (0) ldap : Search returned no results rlm_ldap (ldap): Released connection (4) (0) [ldap] = notfound (0) if ((ok || updated) && User-Password) (0) if ((ok || updated) && User-Password) -> FALSE (0) [expiration] = noop (0) [logintime] = noop (0) ERROR: No Auth-Type found: rejecting the user via Post-Auth-Type = Reject (0) Failed to authenticate the user /etc/radiusd/mods-available/ldap: (snipped for readability) ldap { server = "ldap.lxi.example.com" port = 389 identity = "uid=svc_ovirt,cn=users,cn=accounts,dc=example,dc=com" password = "password" base_dn = "cn=users,cn=accounts,dc=example,dc=com" rad_group = "cn=netops_radius,cn=groups,cn=accounts,dc=example,dc=com" sasl { } update { control:Password-With-Header += 'userPassword' # control:NT-Password := 'ntPassword' # reply:Reply-Message := 'radiusReplyMessage' # reply:Tunnel-Type := 'radiusTunnelType' # reply:Tunnel-Medium-Type := 'radiusTunnelMediumType' # reply:Tunnel-Private-Group-ID := 'radiusTunnelPrivategroupId' # control: += 'radiusCheckAttributes' # reply: += 'radiusReplyAttributes' } user { base_dn = "${..base_dn}" filter = "(|(&(uid=%{%{Stripped-User-Name}:-%{User-Name}})(memberOf=${..rad_group})))" sasl { } # Search scope, may be 'base', 'one', sub' or 'children' scope = 'sub' } group { base_dn = "${..base_dn}" filter = "(objectClass=posixGroup)" memberUid=%{%{Stripped-User-Name}:-%{User-Name}}))" } ..... Thank you, Jake -------------------------------------------- On Wed, 6/28/17, Bogdan Rudas via Freeradius-Users <freeradius-users(a)lists.freeradius.org> wrote: Subject: Re: LDAP group authentication To: "FreeRadius users mailing list" <freeradius-users(a)lists.freeradius.org> Date: Wednesday, June 28, 2017, 3:23 AM Hi, Something like this: ldap { server = 'ldap.int' identity = 'cn=raidus-ro,ou=users,dc=company,dc=int' password = '12345' base_dn = 'ou=users,dc=company,dc=int' ldapgroup = 'cn=WiFi,ou=group,dc=company,dc=int' sasl { } update { control:Password-With-Header += 'userPassword' control: += 'radiusControlAttribute' request: += 'radiusRequestAttribute' reply: += 'radiusReplyAttribute' } user { base_dn = "${..base_dn}" filter = "(|(&(uid=%{%{Stripped-User-Name}:-%{User-Name}})(memberOf=${..ldapgroup})))" sasl { } } ...... cut here... On Tue, Jun 27, 2017 at 6:53 PM, Jake L. <jake_homs(a)yahoo.com> wrote: > Hi Bogdan, > Thank you for the information. This looks like a good method for us as > well. Are you setting up the 'ldapgroup' inside the group section of the > ldap module? If so, can you show me the stanza you're using? Thank you! > > > On Tuesday, June 27, 2017 1:20 AM, Bogdan Rudas via Freeradius-Users < > freeradius-users(a)lists.freeradius.org> wrote: > > > Hi Jake, > > We are useing *memberOf* in filter of "user { }" section in > */etc/freeradius/mods-available/ldap* > > user { > base_dn = "${..base_dn}" > > filter = > "(|(&(uid=%{%{Stripped-User-Name}:-%{User-Name}})( > memberOf=${..ldapgroup})))" > > sasl { > } > } > > I suspect FreeIPA have similar attribute for reverse group membership > lookups. > > On Tue, Jun 27, 2017 at 1:36 AM, Jake L. via Freeradius-Users < > freeradius-users(a)lists.freeradius.org> wrote: > > > Hello - I successfully got our Freeradius server to authenticate against > > our FreeIPA LDAP environment, allowing user access. Currently, all users > in > > here will be granted successful access. However, I'm having trouble > trying > > to identify what to setup to get only a single group in our FreeIPA > > environment allowed to authenticate while all other groups are denied. > In a > > nutshell, I want to only allow the "network-team" group authenticated > > access via the Freeradius server, and any/all other groups to be denied. > In > > my wiki and google searches, I've found reference to > "group_authorization", > > but I can't find that module in the policy.d or mods-available folder. > > Also, I've seen the reference to huntgroups, but only when queried > against > > SQL, which shouldn't be needed in my case. Can anyone point me in the > right > > direction to get this working? > > TL;DR = Need info on setting up Freeradius authentication to LDAP only > for > > a specific group, denying all other groups. > > Thank you!Jake > > - > > List info/subscribe/unsubscribe? See http://www.freeradius.org/ > > list/users.html > > > > > -- > Bogdan Rudas > Director of IT offshore > Exadel Inc. > http://www.exadel.com/ > E-mail: brudas(a)exadel.com > Skype ID: bogdan.rudas > > -- > > > CONFIDENTIALITY NOTICE: This email and files attached to it are > confidential. If you are not the intended recipient you are hereby > notified > that using, copying, distributing or taking any action in reliance on the > contents of this information is strictly prohibited. If you have received > this email in error please notify the sender and delete this email. > > - > List info/subscribe/unsubscribe? See http://www.freeradius.org/ > list/users.html > > > -- Bogdan Rudas Director of IT offshore Exadel Inc. http://www.exadel.com/ E-mail: brudas(a)exadel.com Skype ID: bogdan.rudas -- CONFIDENTIALITY NOTICE: This email and files attached to it are confidential. If you are not the intended recipient you are hereby notified that using, copying, distributing or taking any action in reliance on the contents of this information is strictly prohibited. If you have received this email in error please notify the sender and delete this email. - List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html

3 2

How freeradius responds in json format to the request to authorize
by Fiorella De Luca 23 Jul '17

23 Jul '17

Hello! I am a new Freeradius user. I'm participating in the Google Summer Code and I'm working on an OpenWISP project regarding the creation of a freeradius web interface. This app Django-freeradius will be a web interface to a manage freeradius database using a Django Rest framework . I I installed FreeRADIUS Version 3.0.12 on Ubuntu. I am using rlm_rest So I can configure freeradius to delegate some or all of its operations (authorization, authentication, accounting, mail order) to a REST API. But I can not understand how freeradius responds in json format to the request to authorize . I tried to accept the user with Auth-Type: = Accept And for the user to refuse: Auth-Type: = Reject but it does not work. If anyone could give me an explanation I'll be more than happy. Thank you!

3 2

Attr-26.135.22.100?
by Stefan Paetow 21 Jul '17

21 Jul '17

Hi Alan, Arran, After an upgrade to FR 3.0.15 on a test system, I suddenly have an unknown attribute 'Attr-26.135.22.100' in the debug output. It appears that EAP-Channel-Binding-Message is no longer recognised as such in the debug output? When I downgrade to 3.0.14 the issue persists, but when I drop back to 3.0.10 it recovers itself to say 'EAP-Channel-Binding-Message' in the debug output... Can someone else reproduce this with 3.0.15? I know this doesn't affect operations, but... it's irksome? *puzzled face* With Regards Stefan Paetow Moonshot Industry & Research Liaison Coordinator t: +44 (0)1235 822 125 gpg: 0x3FCE5142 xmpp: stefanp(a)jabber.dev.ja.net skype: stefan.paetow.janet jisc.ac.uk Jisc is a registered charity (number 1149740) and a company limited by guarantee which is registered in England under Company No. 5747339, VAT No. GB 197 0632 86. Jisc’s registered office is: One Castlepark, Tower Hill, Bristol, BS2 0JA. T 0203 697 5800.

2 4

Radsec config query
by Alex Sharaz 21 Jul '17

21 Jul '17

Been playing with RADSEC (FR3.0.15) and having gt stuff working thought I'd tidy up my config files so ... sites-enabled/tls has the following structure listen { ... clients = radsec limit { ... } tls { <my radse tls config> } } //end of listen clients radsec { .... } home_server tls .... home_server_pool ... realm ..... having sorted out the tls {..} section, I added a tls { $include our_tls/ } to my radiusd.conf file and copied the contents of my original tls section into /usr/local/etc/freeradius/our_tls/prodn2 as shown below prodn2 { <all tls config setting from original sites-enabled/tls file tls section> } In sites-enabled/tls I then replaced tls { .. } with tls = ${tls.prodn2} FR fails to start up with error Fri Jul 21 10:19:24 2017 : Error: /usr/local/etc/freeradius/sites-enabled/tls[87]: Client does not have the same TLS configuration as the listener Fri Jul 21 10:19:24 2017 : Error: /usr/local/etc/freeradius/sites-enabled/tls[7]: Failed to load clients for this listen section but all I've done is move the tls{..} contents into radiusd.conf tls {prodn2 {...}} and added a tls=${tls.prodn2} statement.

3 4

TCP - FR3 client/server connection timeout
by Edelberto Franco 21 Jul '17

21 Jul '17

With TCP/TLS I have a curious comportment Imagine this scenario: # server : port case (1) FR3:33001 -> radsecproxy:2083 case (2) radsecproxy: 44001 -> FR3:2083 For case (1) FR3 is the client, and radsecproxy is the server. Case (2) shows FR3 as a server of radsecproxy for TCP/TLS connections. In case (1) FR3 TCP connection always keeps ESTABLISHED with radsecproxy, but in case (2) FR3 closes its connection with radsecproxy (client) after less than 1 minute (sending a FIN, normal...). So, is it possible to set FR3 to don't send FIN and close the TCP connection with radsecproxy client? Thank you, --E

2 3