May 2019 - Freeradius-Users - lists.freeradius.org

Instance on Files Module
by Nicolas Breuer 04 May '19

04 May '19

Hello, I tried to configure two instances for the files modules but doesn’t seems to work.. files DSL { # Search for files in a subdirectory of mods-config which # matches this instance of the files module. moddir = ${modconfdir}/${.:instance} filename = ${moddir}/authorize instance=DSL usersfile = ${moddir}/authorize1 acctusersfile = ${moddir}/accounting preproxy_usersfile = ${moddir}/pre-proxy } files { # Search for files in a subdirectory of mods-config which # matches this instance of the files module. moddir = ${modconfdir}/${.:instance} filename = ${moddir}/authorize instance=dialup usersfile = ${moddir}/authorize2 acctusersfile = ${moddir}/accounting preproxy_usersfile = ${moddir}/pre-proxy } Looked on the website & docs but didn’t find any informations about that 😊

4 8

Evaluation of Service-Type.
by Nicolas Breuer 03 May '19

03 May '19

Hello, Any ideas what is wrong here ? (0) if (&reply:Service-Type == test) { (0) ERROR: Failed retrieving values required to evaluate condition Thanks in advance,

3 9

How to check logs
by Tornóci László 03 May '19

03 May '19

Hi, I use freeradius to provide eduroam service for our university. It works fine. My setup is pretty basic, with just a few changes from the default. I am using EAP-TTLS with PAP in the inner tunnel. Yesterday I got a complaint from a foreign user, he didn't get wifi service with his usual settings. I looked for the logs under radacct/ in the folder with the IP of the NAS. I have 'auth-detail', 'pre-proxy', 'post-proxy' and 'reply-detail'. I was able to find logs of his packages in auth-detail and pre-proxy, but was unable to find out if I got any reply. I can link logs of packets between 'auth-detail' and 'pre-proxy', and also between 'post-proxy' and 'reply-detail', but I couldn't find a way to see which reply-detail packets correspond to any one in auth-detail. Is that possible? If yes, how? If not, what should I do to be able to track reports like that without running the server in debug mode? Laszlo

2 1

Compilation Issue
by Nicolas Breuer 03 May '19

03 May '19

Any ideas about this compilation issue : CC src/lib/cbuff.c In file included from /usr/include/talloc.h:28, from src/freeradius-devel/libradius.h:60, from src/lib/cbuff.c:26: /usr/include/stdlib.h:96: error: expected â=â, â,â, â;â, âasmâ or â__attribute__â before â__BEGIN_NAMESPACE_STDâ /usr/include/stdlib.h:140: error: expected â=â, â,â, â;â, âasmâ or â__attribute__â before âexternâ /usr/include/stdlib.h:145: error: expected â=â, â,â, â;â, âasmâ or â__attribute__â before âexternâ /usr/include/stdlib.h: In function âatoiâ: /usr/include/stdlib.h:149: error: expected declaration specifiers before â__THROWâ /usr/include/stdlib.h:152: error: expected â=â, â,â, â;â, âasmâ or â__attribute__â before â__THROWâ /usr/include/stdlib.h:153: error: expected declaration specifiers before â__END_NAMESPACE_STDâ /usr/include/stdlib.h:168: error: expected declaration specifiers before â__END_NAMESPACE_STDâ /usr/include/stdlib.h:190: error: expected â=â, â,â, â;â, âasmâ or â__attribute__â before â__THROWâ /usr/include/stdlib.h:191: error: expected declaration specifiers before â__END_NAMESPACE_STDâ /usr/include/stdlib.h:382: error: expected â=â, â,â, â;â, âasmâ or â__attribute__â before â__THROWâ /usr/include/stdlib.h:383: error: expected declaration specifiers before â__END_NAMESPACE_STDâ /usr/include/stdlib.h:474: error: expected â=â, â,â, â;â, âasmâ or â__attribute__â before â__THROWâ /usr/include/stdlib.h:475: error: expected declaration specifiers before â__END_NAMESPACE_STDâ /usr/include/stdlib.h:488: error: expected â=â, â,â, â;â, âasmâ or â__attribute__â before â__THROWâ /usr/include/stdlib.h:489: error: expected declaration specifiers before â__END_NAMESPACE_STDâ /usr/include/stdlib.h:518: error: expected â=â, â,â, â;â, âasmâ or â__attribute__â before â__THROWâ /usr/include/stdlib.h:531: error: expected declaration specifiers before â__END_NAMESPACE_STDâ .....

3 14

Dictionnary Redback
by Nicolas Breuer 03 May '19

03 May '19

Hello, Is it expected that dictionary.redback is missing from release 3.0.19 ? Thanks

3 4

grace period support in redis and dhcp server
by Chinnapaiyan, Nagamani 03 May '19

03 May '19

Hi, Currently redis_ippool module has options for offer_time and lease_time. There is another time in dhcp server concept called grace-period: A particular ip is reserved for a particular mac address after lease expired until time mentioned in grace-period(before it is made available to other mac addresses). Is this grace period option is supported in FreeRadius dhcp server? If yes, how to enable it? Regards, Nagamani Chinnapaiyan

2 1

Failed finding socket
by Bassem Mettichi 03 May '19

03 May '19

Hello, please have you any idea about this error message, i got it when i make a bench test using radclient or radperf: Failed to send packet for ID 160: Failed finding socket, caller must allocate a new one Thanks Bassem

2 1

Multiple LDAP failover issue
by Satish Patel 01 May '19

01 May '19

I have freeradius configure with LDAP servers and so far everything is working great but today when i have added second ldap server i got following error I have created two ldap file as per document ldap1 & ldap2 and my authorization and authentication section look like following. authorization { ... Auth-Type LDAP { ldap1 { fail = 1 ok = return } ldap2 { fail = 1 ok = return } } authorize { .... redundant { ldap1 ldap2 } My users files look like following DEFAULT Ldap-Group == "cn=employee,cn=groups,cn=compat,dc=foo,dc=com", ASA-TunnelGroupName = "EMPLOYEE" DEFAULT Auth-Type := Reject Reply-Message = "Sorry, you're not part of an authorized group! when i start radiusd -X it failed here reading pairlist file /etc/raddb/mods-config/files/authorize /etc/raddb/mods-config/files/authorize[48]: Parse error (check) for entry DEFAULT: Unknown name "Ldap-Group" Failed reading /etc/raddb/mods-config/files/authorize /etc/raddb/mods-enabled/files[9]: Instantiation failed for module "files" but when i changed Ldap-Group to ldap1-LDAP-Group it works do does that means i have to create two section in users file for two LDAP? ldap1-LDAP-Group ldap2-LDAP-Group

3 2

Semi-OT: Mime type for CA certificates on Android (landing page browser)
by Mathieu Simon (Lists) 01 May '19

01 May '19

Hi It's partially off-topic to FreeRADIUS specifically, however it's related to provisioning and configuration so I give it a shot: I've been sending users through a open setup-only SSID to an informational page where I'd either forward them to enterprise-wifi.net (previously 802.1x-config.org) for platforms supported there. For others like Android I'd provide instructions on how to get connected manually. On that page we'd link a download to the CA certificate the Android supplicant should trust for the encrypted SSID and I'd show the users how to get it loaded. I remember this having worked over a couple of Android vendors. I've come to realize that more recent Android's landing page browsers would request the certificate (according to the Webserver logs) but then wouldn't do anything on the user side. - Users can't even download it. Back then I remember that I had to tweak the MIME type for Apple's .mobileconfig and certificate files (application/x-apple-aspen-config) files on the webserver. Also some Androids required to set application/x-x509-ca-cert for PEM encoded CA certificates to be downloaded correctly but that doesn't seem to work anymore. (wget --verbose shows the type) Is there something Android / Chrome has changed that I need to take care of in order to fix certificate downloads? Maybe people related to eduroam have experience? (Though eduroam can use an Android app, even if it's not perfect yet) Regards Mathieu

1 0