April 2019 - Freeradius-Users - lists.freeradius.org

FreeRADIUS server is not recognizing updates from my users file
by Aaron Dalla-Longa 12 Apr '19

12 Apr '19

for example, lines from my users file: testing Cleartext-Password := "52345" guestuser Cleartext-Password := "16109" Debug file 1 (Notice how it is authenticating with password 12345, an old password) -- *Aaron Dalla-Longa* Systems Administrator Shortgrass Library System tf: 1.866.529.0550 | p: 403.529.0550

2 5

Radius stale sessions
by Renato Sousa 12 Apr '19

12 Apr '19

Hello everyone, I am fine-tuning the radius accountig sql information and noticed that there are multiple stale sessions. I would like to use a script in cron to delete these sessions but I have a question. How should I select a session as stale? Time difference (acctstarttime and now()) ? Other records with the same mac-address and open sessions (acctstoptime is null) ? Regards, Renato L. Sousa

3 3

Identity attribute
by Elias Pereira 12 Apr '19

12 Apr '19

hello, In the EAP-tls access, the textbox "Identity" on smartphones have a correspondent attribute in freeradius? eap_tls: TLS-Cert-Common-Name := "COMPANY CA" Wed Apr 10 15:09:30 2019 : Debug: (2957) eap_tls: chain-depth : 1 Wed Apr 10 15:09:30 2019 : Debug: (2957) eap_tls: error : 0 Wed Apr 10 15:09:30 2019 : Debug: (2957) eap_tls: *identity : 99171* -- Elias Pereira

4 4

acct terminate cause -supplicant-restart
by Somanath Mishra 12 Apr '19

12 Apr '19

Hi Team, We are now getting new acctterminatecause type i.e supplicant-restart . We have not set any attribute like that in radreply. and disconnecting user automatically. So what does it mean? Is it any radius attribute? Kind regards, Somanath Mishra Software Engineer Luscious Software Pvt Ltd m: 8095019974 Skype ID: pbsomanath w: http://www.luscious-it.com/

2 2

repo error
by Aditya Vijjan 12 Apr '19

12 Apr '19

Hi Team, I am getting below error while running sudo apt-get update on freeradius server. PPA repo was added for freeradius and the source didn't have a release file, it was causing validation issues with APT Python API. Please refer to the error below: ----------ERROR------- Traceback (most recent call last): File "/usr/lib/python3/dist-packages/apt/cache.py", line 544, in update pulse_interval) apt_pkg.Error: E:The repository ' http://ppa.launchpad.net/freeradius/stable-3.0/ubuntu bionic Release' does not have a Release file. Regards Aditya Vijjan

2 1

data format of Acct-Input-Octets
by Somanath Mishra 11 Apr '19

11 Apr '19

Hi Team, Can anyone please tell me we are storing data in Acct-Input-Octets and Acct-Output-Octets is bits or bytes or any other format ? Kind regards, Somanath Mishra

4 4

Daily usage Limitation,
by myxmail1919＠yahoo.com 11 Apr '19

11 Apr '19

Hello, im still busy with configuring freeradius to limit users,anyone can help please ?I have to limit daily usage for all users to 3 hours per day,There is no pre-defined users , have MAC-based access control and allow everyone to connect, and need to limit daily usage to 3 hours per day, As I know I can run a SQL query to authenticate user, need to know how !! sql query have made to check SUM(acctsessiontime) but don’t know where and how to limit Max-Daily-Session for users ! Have no Database for users ! have to run sql query to che SUM of Acct session time per day and if not more than 10.800 seconds permit user to log in. have not much experience in freeradius,I don’t know where to set counters ! and where have to set sql authentication ! and etc …Every search result just telling me how to limit a pre-defined users, but didn’t find anything for not pre-defined users ! Thanks

1 0

3.0.19 has been released
by Alan DeKok 10 Apr '19

10 Apr '19

This release fixes all known issues in v3. We've also released a notification about EAP-PWD security issues. Please see the web site for more details. https://freeradius.org/security/ FreeRADIUS 3.0.19 Wed 10 Apr 2019 09:00:00 EDT urgency=high Feature improvements * Update dictionary.cisco * Update sqlippool to allow for stored procedures with PostgreSQL. This increases performance substantially. Patch from Nathan Ward. Fixes #2540. * Re-added "show client config" command to radmin. * Cleaned up mods-available/sql example so that it is easier to understand. * Added pfSense dictionary. Closes #2581 * Update dictionary.h3c Closes #2592 * Update elasticsearch/logstash config for v6.7.0. * EAP-PWD security fixes from Mathy Vanhoef. See http://freeradius.org/security/ Bug fixes * Update dynamic_client module and server core so that the functionality works. This has been broken since at least v2. * Fix crash in sqlippool due to escaping changes. Patch from Nathan Ward. Fixes #2532, #2533. * Fix systemd notify, watchdog and unit files. Fixes #2541, #2499. * Fix erroneous length check in EAP-FAST. * Update documentation to remove old "ignore_null" configuration. Fixes #2578. * Fix default POD port. Should be 3799. Fixes #2591 * Correctly encode vendor-specific "encrypted" attributes. Fixes #2600

1 0

Newbie question on caching Ldap-Group
by Alexander Harm 09 Apr '19

09 Apr '19

Hello, I have a probably stupid question regarding the caching of Ldap-Group. I've read rather confusing information on the net (like v3 caches Ldap-Group per default, it doesn't work for me) etc. Contrary to most examples I want the cache to be the failover for LDAP. So if my LDAP server is down, group membership should be retrieved from cache. sites-enabled/... authorize { # read group membership from LDAP or cache update control { Cache-Status-Only = yes } redundant { ldap cache } update control { Cache-Status-Only := no } cache mods-enabled/cache update { # Cache LDAP group membership &control:Ldap-Group += &control:Ldap-Group } While the fallback works, I'm a bit surprised to see the group information multiply in the cache: (0) ldap: Waiting for search result... (0) ldap: Adding cacheable group object memberships (0) ldap: &control:LDAP-Group += "AAD DC Administrators" (0) ldap: &control:LDAP-Group += "ka.hq.all" (0) ldap: &control:LDAP-Group += "ka.hq.portal" (0) ldap: Processing user attributes (0) ldap: WARNING: No "known good" password added. Ensure the admin user has permission to read the password attribute (0) ldap: WARNING: PAP authentication will *NOT* work with Active Directory (if that is what you were trying to configure) rlm_ldap (ldap): Released connection (0) (0) [ldap] = ok (0) } # redundant = ok (0) update control { (0) Cache-Status-Only := no (0) } # update control = noop (0) cache: EXPAND %{User-Name} (0) cache: --> John.Doe (0) cache: No cache entry found for "John.Doe" (0) cache: Creating new cache entry (0) cache: EXPAND Cache last updated at %t (0) cache: --> Cache last updated at Tue Apr 9 01:32:38 2019 (0) cache: &reply:Reply-Message += Cache last updated at Tue Apr 9 01:32:38 2019 (0) cache: EXPAND %{randstr:ssssssssssssssssssssssssssssssss} (0) cache: --> v9I9w/YhZ9zjjYCDwku8M1o2yY1EZtHj (0) cache: &reply:Class := 0x76394939772f59685a397a6a6a594344776b75384d316f32795931455a74486a (0) cache: control:Ldap-Group += &control:Ldap-Group[*] -> 'ka.hq.portal' (0) cache: control:Ldap-Group += &control:Ldap-Group[*] -> 'ka.hq.all' (0) cache: control:Ldap-Group += &control:Ldap-Group[*] -> 'AAD DC Administrators' (0) cache: control:Ldap-Group += &control:Ldap-Group[*] -> 'AAD DC Administrators' (0) cache: control:Ldap-Group += &control:Ldap-Group[*] -> 'ka.hq.all' (0) cache: control:Ldap-Group += &control:Ldap-Group[*] -> 'ka.hq.portal' (0) cache: Merging cache entry into request (0) cache: &reply:Reply-Message += "Cache last updated at Tue Apr 9 01:32:38 2019" (0) cache: &reply:Class := 0x76394939772f59685a397a6a6a594344776b75384d316f32795931455a74486a (0) cache: &control:LDAP-Group += "ka.hq.portal" (0) cache: &control:LDAP-Group += "ka.hq.all" (0) cache: &control:LDAP-Group += "AAD DC Administrators" (0) cache: &control:LDAP-Group += "AAD DC Administrators" (0) cache: &control:LDAP-Group += "ka.hq.all" (0) cache: &control:LDAP-Group += "ka.hq.portal" (0) cache: Committed entry, TTL 86400 seconds Can I ignore this or did I setup something wrong? Thanks for your input, Alexander

2 4

abfab-tls site with both, IPv4 and IPv6 enabled
by Alex Perez 09 Apr '19

09 Apr '19

Hi Alan, I'd like to make the abfab-tls configuration file (https://github.com/FreeRADIUS/freeradius-server/blob/v3.0.x/raddb/sites-ava…) to accept both, IPv4 *and* IPv6. For what I've read, I cannot have two ipaddr (in any of its variants) taking place within the same "listen" section but instead I have to duplicate the "listen" section. Is that right, or is there any other more convenient way of doing it that I'm missing? For the "clients" section, I guess that adding something like: client default_ip6 { ipaddr = ::0 proto = tls } would suffice, right? Thanks, -- Alejandro Perez-Mendez Technical Specialist (AAA), Trust & Identity M (+34) 619 333 219 Skype alejandro_perez_mendez jisc.ac.uk Jisc is a registered charity (number 1149740) and a company limited by guarantee which is registered in England under Company No. 5747339, VAT No. GB 197 0632 86. Jisc’s registered office is: One Castlepark, Tower Hill, Bristol, BS2 0JA. T 0203 697 5800. Jisc Services Limited is a wholly owned Jisc subsidiary and a company limited by guarantee which is registered in England under company number 2881024, VAT number GB 197 0632 86. The registered office is: One Castle Park, Tower Hill, Bristol BS2 0JA. T 0203 697 5800.

1 2