- Freeradius-Users - lists.freeradius.org

Freeradius Packages
by Nicolas Breuer 30 May '19

30 May '19

Hello, Is there a way to change the link to a more recent mysql client library ? The linked library is the compat mysql lib. [root@ns1 freeradius]# ldd rlm_sql_mysql.so linux-vdso.so.1 => (0x00007ffe659bb000) libmysqlclient_r.so.16 => /usr/lib64/mysql/libmysqlclient_r.so.16 (0x00007efed1200000) libz.so.1 => /lib64/libz.so.1 (0x00007efed0fea000) libpthread.so.0 => /lib64/libpthread.so.0 (0x00007efed0dcc000) libcrypt.so.1 => /lib64/libcrypt.so.1 (0x00007efed0b95000) libnsl.so.1 => /lib64/libnsl.so.1 (0x00007efed097c000) libm.so.6 => /lib64/libm.so.6 (0x00007efed06f7000) libssl.so.10 => /usr/lib64/libssl.so.10 (0x00007efed048b000) libcrypto.so.10 => /usr/lib64/libcrypto.so.10 (0x00007efed00a6000) libc.so.6 => /lib64/libc.so.6 (0x00007efecfd11000) /lib/ld-linux.so.2 (0x000055a5f8a11000) libfreebl3.so => /lib64/libfreebl3.so (0x00007efecfb0e000) libgssapi_krb5.so.2 => /lib64/libgssapi_krb5.so.2 (0x00007efecf8ca000) libkrb5.so.3 => /lib64/libkrb5.so.3 (0x00007efecf5e2000) libcom_err.so.2 => /lib64/libcom_err.so.2 (0x00007efecf3de000) libk5crypto.so.3 => /lib64/libk5crypto.so.3 (0x00007efecf1b2000) libdl.so.2 => /lib64/libdl.so.2 (0x00007efecefad000) libkrb5support.so.0 => /lib64/libkrb5support.so.0 (0x00007efeceda2000) libkeyutils.so.1 => /lib64/libkeyutils.so.1 (0x00007efeceb9f000) libresolv.so.2 => /lib64/libresolv.so.2 (0x00007efece984000) libselinux.so.1 => /lib64/libselinux.so.1 (0x00007efece765000) Thanks

2 1

FR and accounting question
by dg 30 May '19

30 May '19

Hello i have question about accounting in freeradius (3.0.18) i notced in sql table radacct that from time to time i have as a "username" host/DELL-LAPBD5 logged. so in file /etc/raddb/policy.d/filter i put if (User-Name =~ /^host/) { update request { Module-Failure-Message += 'Rejected: banned host' } reject } not i have "Access-Reject" and username starting with "host" are denied. But anyway when i check accouting host/DELL-LAPBD5 still is appears (with some data downloaded). How it this possible that username is Rejected but can download data from network (browsing websites etc.. ) and appears in accounting ?? I thought that if someone is Rejected should not be able to download data from internet. best regards

2 1

Help in moving FR1.x to 3.x EAP-TLS setup.
by Gregory Sloop 30 May '19

30 May '19

So, I've got a current FR setup, version 2.2.8 [although the last time I've done this was under a 1.x FR version - these configs are under an upgraded distro version - so the newer FR setups are somewhat confusing for me. This is all under Ubuntu - this setup started life as a 12.04 (IIRC) setup, and got upgraded to 16.04. I'm now trying to migrate it to a fresh setup on 18.04.] I'm trying to move it to a new FR setup under 3.0.16. It's a Wifi WPA setup - using EAP-TLS with certificates/key only. [Not PEAP etc.] And I'm having trouble. Rather than have you look at a debug - perhaps I should start here. I'm not sure I'm doing the right steps for setup/configuration. Moving clients.conf is obvious. [Though I've added the newer "ipaddr" to them.] I have created new certs/keys/ca - and I'm pretty sure I've done that correctly. [Lets assume I have for now - we'll come back to that later, if needed. I can always test with the old certs/keys too, because I know those work. I'm using GNUTLS to handle CA/Cert/Key creation, and I know I need to add the OID's for "server" and "client" as applicable. And I've verified these are present in the relevant certs.] Now, to where I'm quite unsure... I need to edit the EAP configuration in ./mods-available, and create a link to it in ./mods-enabled - right? --- Here's what is in my current eap [in FR 2.2.8] - though the eap.conf file isn't in the mods-available directory, it's in the main FR config dir. I suppose I could probably leave it that way, but I'm trying to do this the "new" way. --- eap { default_eap_type = tls timer_expire = 60 ignore_unknown_eap_types = no cisco_accounting_username_bug = no max_sessions = 4096 #md5 { #} # #leap { #} # #gtc { # auth_type = PAP #} tls { certdir = ${confdir}/certs cadir = ${confdir}/certs #private_key_password = whatever private_key_file = ${certdir}/radius.somedom.local.key certificate_file = ${certdir}/radius.somedom.local.pem CA_file = ${cadir}/ca.pem dh_file = ${certdir}/dh random_file = /dev/urandom CA_path = ${cadir} check_crl = yes cipher_list = "DEFAULT" make_cert_command = "${certdir}/bootstrap" cache { enable = no lifetime = 24 # hours max_entries = 255 } verify { } } #ttls { # default_eap_type = md5 # copy_request_to_tunnel = no # use_tunneled_reply = no # virtual_server = "inner-tunnel" #} #peap { # default_eap_type = mschapv2 # copy_request_to_tunnel = no # use_tunneled_reply = no # virtual_server = "inner-tunnel" #} #mschapv2 { #} } --- Though to start, I think I'll avoid checking a CRL - just to keep things simple. Do, I just essentially paste this config straight into the new one? [I don't think so - there's a new section "tls-config tls-common" and I'm unsure about that.] I don't believe there are any changes I made previously [or need to make now] to radiusd.conf? Is there anything else I need to do? Thanks in advance! -Greg

2 5

Commercial support on freeRADIUS
by Raghu nathan 29 May '19

29 May '19

Hello Evereyone, We are looking for some commercial support on freeRADIUS. Is there any company providing commercial support for freeRADIUS? I'm trying to contact networkRADIUS but no response. Regards, Raghu.

4 3

CoA request.
by myxmail1919＠yahoo.com 29 May '19

29 May '19

Hi , anyone knows why i get thi warnining message ? WARNING: Unknown destination 88.99.xx.xx:3799 for CoA request.

2 1

[REQ] Users of the rlm_securid module, make yourselves known
by Arran Cudbard-Bell 28 May '19

28 May '19

Dear list users, We're currently debating about whether to remove the rlm_securid module from FreeRADIUS v4, and are looking for a quick show of hands to see if people are actually using it currently in FreeRADIUS v3. If you're using it, and are comfortable sharing that fact, can you reply to this thread, or send me a message off list (a.cudbardb(a)freeradius.org) Many Thanks, -Arran Arran Cudbard-Bell <a.cudbardb(a)freeradius.org> FreeRADIUS Development Team FD31 3077 42EC 7FCD 32FE 5EE2 56CF 27F9 30A8 CAA2

1 0

Session-Timeout
by myxmail1919＠yahoo.com 28 May '19

28 May '19

hi there, is there anyone can tell me why session will not end after session-timeout ? i configured sql counter its working fine ! the only problem is session will not end ! and user stays logged in ! but when user end the session cant login again !i tried on diffrent Accesspoints , its same everywhere ... thanks authorize { sql update control { Max-Daily-Session = 4752 }} dailycounter: EXPAND %{sql:SELECT SUM(acctsessiontime - GREATEST((1558994400 - UNIX_TIMESTAMP(acctstarttime)), 0)) FROM radacct WHERE username = '%{User-Name}' AND UNIX_TIMESTAMP(acctstarttime) + acctsessiontime > '1558994400'}dailycounter: --> 4729dailycounter: Allowing user, &control:Max-Daily-Session value (4752) is greater than counter value (4729)dailycounter: Setting &reply:Session-Timeout value to 23 [dailycounter] = ok

2 1

ServerSide Attributes
by Nicolas Breuer 28 May '19

28 May '19

Hello, https://networkradius.com/doc/3.0.10/concepts/dictionary/creating_server_at… Following the documentation, we can create server-side attributes with number range 3000-4000. If I create a new attribute , I have a warning on the startup that I can't use that on a reply attribute in the user file but it's working. Can you advise what we can do ? Thanks

2 3

DHCPv6 server support
by Vano 27 May '19

27 May '19

Hi there! Does freeradius support ipv6 dhcp server? If not, when do you plan to add support for ipv6? Ivan Bubnov

4 3

"acctupdatetime" missing in the radacct table; accounting failure
by Suketu Soni 26 May '19

26 May '19

Hello, This question is for FreeRADIUS Version 3.0.13. The server is not responding with Accounting-Response, and the debug suggested: (1) sql: ERROR: rlm_sql_mysql: ERROR 1054 (Unknown column 'acctupdatetime' in 'field list'): 42S22 (1) sql: SQL query returned: server error The "radacct" table in mysql does not have "acctupdatetime" and "acctinterval". However, the structure for the "radacct" table in "/etc/raddb/mods-config/sql/main/mysql/schema.sql" file does have "AcctUpdateTime" and "AcctInterval". Can you please advise if these fields should be added in mysql manually and the insert statements for the same? Thank you very much. -- Suketu Soni

2 2