- Freeradius-Users - lists.freeradius.org

Dictionnary Redback
by Nicolas Breuer 03 May '19

03 May '19

Hello, Is it expected that dictionary.redback is missing from release 3.0.19 ? Thanks

3 4

grace period support in redis and dhcp server
by Chinnapaiyan, Nagamani 03 May '19

03 May '19

Hi, Currently redis_ippool module has options for offer_time and lease_time. There is another time in dhcp server concept called grace-period: A particular ip is reserved for a particular mac address after lease expired until time mentioned in grace-period(before it is made available to other mac addresses). Is this grace period option is supported in FreeRadius dhcp server? If yes, how to enable it? Regards, Nagamani Chinnapaiyan

2 1

Failed finding socket
by Bassem Mettichi 03 May '19

03 May '19

Hello, please have you any idea about this error message, i got it when i make a bench test using radclient or radperf: Failed to send packet for ID 160: Failed finding socket, caller must allocate a new one Thanks Bassem

2 1

Multiple LDAP failover issue
by Satish Patel 01 May '19

01 May '19

I have freeradius configure with LDAP servers and so far everything is working great but today when i have added second ldap server i got following error I have created two ldap file as per document ldap1 & ldap2 and my authorization and authentication section look like following. authorization { ... Auth-Type LDAP { ldap1 { fail = 1 ok = return } ldap2 { fail = 1 ok = return } } authorize { .... redundant { ldap1 ldap2 } My users files look like following DEFAULT Ldap-Group == "cn=employee,cn=groups,cn=compat,dc=foo,dc=com", ASA-TunnelGroupName = "EMPLOYEE" DEFAULT Auth-Type := Reject Reply-Message = "Sorry, you're not part of an authorized group! when i start radiusd -X it failed here reading pairlist file /etc/raddb/mods-config/files/authorize /etc/raddb/mods-config/files/authorize[48]: Parse error (check) for entry DEFAULT: Unknown name "Ldap-Group" Failed reading /etc/raddb/mods-config/files/authorize /etc/raddb/mods-enabled/files[9]: Instantiation failed for module "files" but when i changed Ldap-Group to ldap1-LDAP-Group it works do does that means i have to create two section in users file for two LDAP? ldap1-LDAP-Group ldap2-LDAP-Group

3 2

Semi-OT: Mime type for CA certificates on Android (landing page browser)
by Mathieu Simon (Lists) 01 May '19

01 May '19

Hi It's partially off-topic to FreeRADIUS specifically, however it's related to provisioning and configuration so I give it a shot: I've been sending users through a open setup-only SSID to an informational page where I'd either forward them to enterprise-wifi.net (previously 802.1x-config.org) for platforms supported there. For others like Android I'd provide instructions on how to get connected manually. On that page we'd link a download to the CA certificate the Android supplicant should trust for the encrypted SSID and I'd show the users how to get it loaded. I remember this having worked over a couple of Android vendors. I've come to realize that more recent Android's landing page browsers would request the certificate (according to the Webserver logs) but then wouldn't do anything on the user side. - Users can't even download it. Back then I remember that I had to tweak the MIME type for Apple's .mobileconfig and certificate files (application/x-apple-aspen-config) files on the webserver. Also some Androids required to set application/x-x509-ca-cert for PEM encoded CA certificates to be downloaded correctly but that doesn't seem to work anymore. (wget --verbose shows the type) Is there something Android / Chrome has changed that I need to take care of in order to fix certificate downloads? Maybe people related to eduroam have experience? (Though eduroam can use an Android app, even if it's not perfect yet) Regards Mathieu

1 0

Bootstrap overwrite my certs
by Rafael Leiva-Ochoa 30 Apr '19

30 Apr '19

Hi Everyone, I recently upgraded to 3.0.19-1 and I noticed after I restarted the service I was getting the following errors: Apr 29 22:01:29 freeradius systemd[1]: Starting FreeRADIUS high performance RADIUS server.... Apr 29 22:01:30 freeradius sh[1970]: make: *** No rule to make target 'server.cnf', needed by 'passwords.mk'. Stop. Apr 29 22:01:30 freeradius systemd[1]: radiusd.service: Control process exited, code=exited status=2 Apr 29 22:01:30 freeradius systemd[1]: radiusd.service: Failed with result 'exit-code'. Apr 29 22:01:30 freeradius systemd[1]: Failed to start FreeRADIUS high performance RADIUS server.. Apr 29 22:01:30 freeradius audit[1]: SERVICE_START pid=1 uid=0 auid=4294967295 ses=4294967295 subj=system_u:system_r:init_t:s0 msg='unit=radiusd comm="systemd " exe="/usr/lib/systemd/systemd" hostname=? addr=? terminal=? res=failed' After a lot of digging, I found that a "bootstrap" script on the /etc/raddb/certs/ directory was being called on the /usr/lib/systemd/system/radiusd.service. This script overwrote my current certificate files. I had to comment out the ExecStartPre=/bin/sh /etc/raddb/certs/bootstrap to fix the problem. I am not sure if anyone else encountered this problem before. Is this being addressed on future releases? Thanks, Rafael

2 4

freeradius monitoring
by Satish Patel 30 Apr '19

30 Apr '19

Folks, I am reading this page https://wiki.freeradius.org/config/Status and trying to configure freeradius monitoring, seems like i am missing something. somehow i don't have /etc/raddb/mods-available/status file because i have install freeradius using yum install finally after google i found sample status file and i put that in mods-enabled directory and now i am getting this error Failed to link to module 'rlm_server': /usr/lib64/freeradius/rlm_server.so: cannot open shared object file: No such file or directory Now my question is by default radiusd.conf has status_server = yes so any client can query so i have try following and i got this reply. [root@radius]# echo "Message-Authenticator = 0x00, FreeRADIUS-Statistics-Type = 1, Response-Packet-Type = Access-Accept" | radclient -x localhost:1812 status testing123 Sent Status-Server Id 62 from 0.0.0.0:57892 to 127.0.0.1:18120 length 50 Message-Authenticator = 0x00 FreeRADIUS-Statistics-Type = Authentication Response-Packet-Type = Access-Accept Received Access-Accept Id 62 from 127.0.0.1:1812 to 0.0.0.0:0 length 20 getting no other data back from radius

3 5

Re: SQL not a variable
by Nicolas Breuer 30 Apr '19

30 Apr '19

Hello, It's not working... allocate-find = "SELECT ip_address FROM radippool WHERE (pool_name like '%{reply:Pool-Suffix}*%%' and pool_name not like '%%STATx%%') AND expiry_time < NOW() ORDER BY rand(), pool_name, expiry_time LIMIT 1 FOR UPDATE" [IP-POOLING-01] expand: SELECT ip_address FROM radippool WHERE (pool_name like '%{reply:Pool-Suffix}*%' and pool_name not like '%STATx%') AND expiry_time < NOW() ORDER BY rand(), pool_name, expiry_time LIMIT 1 FOR UPDATE -> SELECT ip_address FROM radippool WHERE (pool_name like 'BC*%' and pool_name not like '2019-04-30 17:55:08TATx%') AND expiry_time < NOW() ORDER BY rand(), pool_name, expiry_time LIMIT 1 FOR UPDATE What I'm doing wrong?

2 1

SQL not a variable
by Nicolas Breuer 30 Apr '19

30 Apr '19

Hello, In the module IP POOL, I'm trying to use the "%" SQL chars. allocate-find = "SELECT ip_address FROM radippool WHERE (pool_name like '%{reply:Pool-Suffix}*\%' and pool_name not like '\%STAT\%')..... The issue is that the module expand the %S as a variable. (Time) What can I do to avoid that ? Thanks

3 2

RE: redis_ippool module doesnot process lease_time in ack
by Chinnapaiyan, Nagamani 30 Apr '19

30 Apr '19

Hi, We are blocked here. Can you please give some suggestions? Regards, Nagamani Chinnapaiyan

2 1